CB-201: make unmapped target notice truthful

Two fixes to HerdrPeerLauncher.waitUntilInjectableOrThrow.

Fix 1: the status call is now guarded. A herdr *_not_found answer — what happens
when the backend process exited rather than being slow — used to escape as a raw
HerdrException, skipping stop() and leaking the pane and tab, with a message that
blamed a slow pane. It now fails immediately, runs the same teardown, and says the
process exited.

Fix 2: the gate can now resolve UNKNOWN with the same StatusRefiner the status
poller uses, behind two guards. It only runs for the claude adapter, because
StatusRefiner.classify reads a Claude Code TUI. And a refined result is accepted
only when the same agents.get sample still reports a non-null agentType. That
second guard closes a trap: a dead pane sits at a shell prompt containing the same
❯ glyph the classifier reads as idle, so refining without corroboration would turn
"the backend died" into "ready to inject".

Verified by the lead before merge: NAME_PREFIX really is "claude"/"opencode" so the
adapter split holds; AgentControl.status(t) was already get(t).status(), so moving
the loop to get() adds no herdr call; and a *_not_found already failed the spawn
before this change, so fix 1 improves an existing failure rather than creating one.
The adapter guard was mutation-tested independently (set it to `if (false)`, the new
opencode test fails with "Expected PeerUnreachableException to be thrown, but nothing
was thrown"; restored, it passes). Independent build: 1123 tests, 0 failures,
0 errors, 0 skipped.

Not fixed, and not claimed: that herdr reports a null agentType for a bare shell
pane is unverified against a live daemon. To be proved by a live spawn on both
backends after deploy. The seat-accounting suggestion in #176 was deliberately not
built — its cause was tested in that issue and not reproduced.

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -169,6 +169,12 @@ public final class Fleetd {
             }
         });
         List<HerdrPeerLauncher> adapters = new ArrayList<>();
+        // fleetd #175: the daemon's real ExhaustionSink can only be built once `sessions` exists
+        // (below), but `sessions` needs `workers`, which needs the adapters built right here — a
+        // genuine cycle. Break it exactly like liveCountRef below: a forwarding sink built now,
+        // pointed at the real one once it exists.
+        AtomicReference<ExhaustionSink> exhaustionSinkRef = new AtomicReference<>(ExhaustionSink.none());
+        ExhaustionSink forwardingExhaustionSink = (target, reason) -> exhaustionSinkRef.get().onExhausted(target, reason);
         // The claude-code adapter is the always-present default; keep it even with no profiles (so a
         // bridge configured with no workers, or opencode-only, still has a well-defined base adapter)
         // unless opencode is the only kind configured.
@@ -184,7 +190,7 @@ public final class Fleetd {
                     opencodeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
                     cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
                     () -> config.get().fleet(),
-                    () -> config.get().memberCredentials(), config::get));
+                    () -> config.get().memberCredentials(), config::get, forwardingExhaustionSink));
         }
         AtomicReference<Function<String, Integer>> liveCountRef = new AtomicReference<>(_ -> 0);
         // CB-578 stage B: one quarantine tracker for the whole daemon, shared between the launcher
@@ -334,6 +340,11 @@ public final class Fleetd {
         // CREDENTIAL — not the profile name — so a profile sharing that credential (e.g. two models
         // on one OpenAI account) is refused too, not just the one that happened to report it. Reads
         // the profile config live off `config`, so a credentialId edit is hot: no restart needed.
+        //
+        // fleetd #175: this sink is now also the quarantine target for OpenCodeLauncher's
+        // model-mismatch check — it needs nothing profile-specific from the caller beyond `target`
+        // (a herdr terminal id) and `reason`, so reusing it here is exactly "the existing
+        // ExhaustionSink path", not a new mechanism.
         ExhaustionSink exhaustionSink = (target, reason) -> sessions.roster().stream()
                 .filter(session -> target.equals(session.terminalId()))
                 .findFirst()
@@ -342,10 +353,12 @@ public final class Fleetd {
                 .ifPresent(profile -> {
                     String credentialId = profile.effectiveCredentialId();
                     quarantine.quarantine(credentialId);
-                    log.warn("credential '{}' quarantined for {}s (profile '{}' classified "
-                                    + "BACKEND_EXHAUSTED): {}", credentialId,
+                    log.warn("credential '{}' quarantined for {}s (profile '{}'): {}", credentialId,
                             cfg.quarantineCooldownSeconds(), profile.profile(), reason);
                 });
+        // fleetd #175: point the forwarding sink handed to OpenCodeLauncher above at the real one,
+        // now that `sessions` exists to resolve target -> session -> profile.
+        exhaustionSinkRef.set(exhaustionSink);
         AgentControl agents = router.memberAgents();
         CompletionResolver completion = new CompletionResolver(agents, rendezvous, exhaustedPatterns, exhaustionSink);
         // CB-113: deliver only to an available worker (its MCP is connected), never its boot window.

fleetd/src/main/java/dev/ltms/fleet/auth/MemberLifecycle.java

@@ -5,6 +5,9 @@ import dev.ltms.fleet.peer.MemberRole;
 /** Optional session lifecycle hook for live member-slot bindings. */
 public interface MemberLifecycle {
 
+    /** A slot held before a member process starts. */
+    record SlotReservation(String slot, String profile) { }
+
     MemberLifecycle NONE = new MemberLifecycle() {
         @Override
         public MemberRole acquired(MemberRole role, String profile, String terminal) {
@@ -19,6 +22,20 @@ public interface MemberLifecycle {
         public void requireSlotFor(MemberRole role, String profile) {
             // no registry configured — nothing to validate against, so nothing is refused
         }
+
+        @Override
+        public SlotReservation reserve(MemberRole role, String profile) {
+            return null;
+        }
+
+        @Override
+        public boolean bind(SlotReservation reservation, String terminal) {
+            return false;
+        }
+
+        @Override
+        public void release(SlotReservation reservation) {
+        }
     };
 
     /**
@@ -29,10 +46,9 @@ public interface MemberLifecycle {
      *         role — never {@code role} — when a slot-bound role (architect) could not be bound.
      *         Callers must record THIS value on the session, never the requested {@code role}, so
      *         a later roster read never reports a role the session does not hold (CB-619). In
-     *         normal operation this fallback should not happen once {@link #requireSlotFor} has
-     *         refused every unbindable spawn upfront — but a slot can still be lost between that
-     *         check and this call to a concurrent spawn racing for the same slot, so the honest
-     *         answer is still needed here too.
+     *         normal operation this fallback should not happen once a reservation has been bound.
+     *         It remains the honest answer if a caller has no reservation, or if binding a
+     *         reservation unexpectedly fails.
      */
     MemberRole acquired(MemberRole role, String profile, String terminal);
 
@@ -46,4 +62,13 @@ public interface MemberLifecycle {
      * @throws IllegalArgumentException naming the role, the profile, and the pools that do carry it
      */
     void requireSlotFor(MemberRole role, String profile);
+
+    /** Reserve a matching slot before launch, or refuse before a charter can be delivered. */
+    SlotReservation reserve(MemberRole role, String profile);
+
+    /** Convert a reservation into a live terminal binding. */
+    boolean bind(SlotReservation reservation, String terminal);
+
+    /** Return an unbound reservation after a failed launch. */
+    void release(SlotReservation reservation);
 }

fleetd/src/main/java/dev/ltms/fleet/auth/MemberRegistry.java

@@ -56,8 +56,10 @@ public final class MemberRegistry implements MemberLifecycle {
     }
 
     private final Map<String, Entry> slots;
-    /** Live {@code terminal_id → qualified slot key}; guarded by {@code this}. */
+    /** Live {@code terminal_id → qualified slot key}; guarded by {@code terminalToSlot}. */
     private final Map<String, String> terminalToSlot = new HashMap<>();
+    /** Slot keys held between reservation and the terminal binding. Guarded by terminalToSlot. */
+    private final java.util.Set<String> reservedSlots = new java.util.HashSet<>();
 
     /** Flatten every role pool in {@code fleet} into one registry. Leaders are not members. */
     public MemberRegistry(FleetConfig.Fleet fleet) {
@@ -167,7 +169,7 @@ public final class MemberRegistry implements MemberLifecycle {
             if (existingSlot != null) {
                 return slot.equals(existingSlot); // already this slot (idempotent) or a different one
             }
-            if (terminalToSlot.containsValue(slot)) {
+            if (terminalToSlot.containsValue(slot) || reservedSlots.contains(slot)) {
                 return false; // slot already hosts a terminal — no second one
             }
             terminalToSlot.put(terminal, slot);
@@ -275,6 +277,50 @@ public final class MemberRegistry implements MemberLifecycle {
                         + " on one of those profiles instead");
     }
 
+    @Override
+    public SlotReservation reserve(MemberRole role, String profile) {
+        if (role != MemberRole.ARCHITECT) {
+            return null;
+        }
+        synchronized (terminalToSlot) {
+            for (Entry entry : slotsFor(MemberRole.ARCHITECT).values()) {
+                if ((profile == null || profile.isBlank() || Objects.equals(profile, entry.profile()))
+                        && !terminalToSlot.containsValue(entry.key()) && reservedSlots.add(entry.key())) {
+                    return new SlotReservation(entry.key(), entry.profile());
+                }
+            }
+        }
+        throw new IllegalArgumentException("no free architect slot for profile '" + profile
+                + "' — every matching slot is already bound or reserved");
+    }
+
+    @Override
+    public boolean bind(SlotReservation reservation, String terminal) {
+        if (reservation == null || terminal == null || terminal.isBlank()) {
+            return false;
+        }
+        synchronized (terminalToSlot) {
+            if (!reservedSlots.remove(reservation.slot())) {
+                return false;
+            }
+            if (!isSlot(reservation.slot()) || terminalToSlot.containsKey(terminal)
+                    || terminalToSlot.containsValue(reservation.slot())) {
+                return false;
+            }
+            terminalToSlot.put(terminal, reservation.slot());
+            return true;
+        }
+    }
+
+    @Override
+    public void release(SlotReservation reservation) {
+        if (reservation != null) {
+            synchronized (terminalToSlot) {
+                reservedSlots.remove(reservation.slot());
+            }
+        }
+    }
+
     /** Unbind a released terminal using the compare-safe registry operation. */
     @Override
     public void released(String terminal) {

fleetd/src/main/java/dev/ltms/fleet/member/HerdrPeerLauncher.java

@@ -3,11 +3,13 @@ package dev.ltms.fleet.member;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
 import dev.ltms.fleet.herdr.HerdrClient;
 import dev.ltms.fleet.herdr.HerdrException;
 import dev.ltms.fleet.herdr.Tab;
 import dev.ltms.fleet.herdr.Workspace;
 import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.StatusRefiner;
 import dev.ltms.fleet.peer.Capability;
 import dev.ltms.fleet.peer.CharterReceipt;
 import dev.ltms.fleet.peer.MemberRole;
@@ -151,6 +153,14 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     private final LongSupplier nowMillis; // monotonic clock (injectable for tests)
     private final Runnable sleeper; // sleep/wait hook (injectable for tests; never real-sleep in unit tests)
 
+    /**
+     * fleetd #176 fix 2: the same UNKNOWN-refinement {@code dev.ltms.fleet.inject.StatusPoller}
+     * uses, reused here for the spawn-readiness gate. Constructed once from {@link #agents} — see
+     * {@link #refinedInjectable(String, Agent)} for the corroboration that keeps it from firing on
+     * a dead pane's bare shell prompt.
+     */
+    private final StatusRefiner statusRefiner;
+
     // Per-process token mixed into each peer name so a fresh process (nameSeq back at 0) cannot
     // collide with same-profile peers that outlived a restart. See startUniquelyNamed.
     private final String nameNonce = String.format("%06x", new SecureRandom().nextInt(1 << 24));
@@ -272,6 +282,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         this.memberCredentials = memberCredentials;
         this.hostEnvNames = hostEnvNames != null ? hostEnvNames : () -> System.getenv().keySet();
         this.config = config;
+        this.statusRefiner = new StatusRefiner(agents);
     }
 
     // --- adapter seams -------------------------------------------------------------------------
@@ -909,16 +920,35 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     // --- spawn-readiness gate (CB-306) ---------------------------------------------------------
 
     /**
-     * Poll {@link AgentControl#status} until the pane reports an injectable state or the configured
+     * Poll {@link AgentControl#get} until the pane reports an injectable state or the configured
      * timeout elapses. On timeout, close the pane (self-reap) and throw.
+     *
+     * <p>fleetd #176 fix 1: {@code agents.get} was previously unguarded here, so a herdr
+     * {@code *_not_found} answer — which is what happens when the backend process EXITED rather
+     * than being slow — propagated as a raw {@link HerdrException} instead of the
+     * {@link PeerUnreachableException} every other failure path of this gate produces, and skipped
+     * teardown ({@link #stop}) entirely, leaking the pane/tab. {@link #failFastOnGoneBackend} closes
+     * that gap: it stops waiting immediately (never burns the rest of the timeout), runs the same
+     * teardown the timeout path below runs, and throws with a message that says the backend exited
+     * rather than that the pane was slow. Any other {@link HerdrException} still propagates
+     * unchanged — this gate does not know how to recover from it.
      */
     private void waitUntilInjectableOrThrow(String paneId) {
-        long deadline = nowMillis.getAsLong() + spawnReadyTimeoutMs;
-        Object lastStatus = null;
+        long start = nowMillis.getAsLong();
+        long deadline = start + spawnReadyTimeoutMs;
+        AgentStatus lastStatus = null;
         while (nowMillis.getAsLong() < deadline) {
-            var status = agents.status(paneId);
-            lastStatus = status;
-            if (status.injectable()) {
+            Agent sample;
+            try {
+                sample = agents.get(paneId);
+            } catch (HerdrException e) {
+                if (isAlreadyGone(e)) {
+                    failFastOnGoneBackend(paneId, e, nowMillis.getAsLong() - start);
+                }
+                throw e; // any other herdr failure is not ours to interpret — let it propagate
+            }
+            lastStatus = sample.status();
+            if (lastStatus.injectable() || refinedInjectable(paneId, sample)) {
                 log.debug("peer pane={} reached injectable state", paneId);
                 return;
             }
@@ -937,6 +967,66 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
                         + spawnReadyTimeoutMs + "ms");
     }
 
+    /**
+     * fleetd #176 fix 1: the backend process exited while the gate was still waiting — herdr
+     * answered {@code *_not_found} instead of ever reporting an injectable status. Fails
+     * immediately (never burns the rest of {@link #spawnReadyTimeoutMs}), runs the exact same
+     * teardown {@link #waitUntilInjectableOrThrow}'s timeout path runs, and throws a
+     * {@link PeerUnreachableException} whose message says the process exited rather than that the
+     * pane was slow.
+     *
+     * @throws PeerUnreachableException always — this method never returns normally
+     */
+    private void failFastOnGoneBackend(String paneId, HerdrException cause, long elapsedMs) {
+        String tail = readPaneQuietly(paneId); // read before stop() closes the pane
+        log.warn("peer pane={} backend process exited after {}ms while waiting for injectable "
+                        + "state (herdr: {}) — closing. Pane tail:\n{}",
+                paneId, elapsedMs, cause.getMessage(), tail);
+        stop(paneId);
+        throw new PeerUnreachableException(
+                "worker pane " + paneId + " backend process exited after " + elapsedMs
+                        + "ms while waiting to become injectable (herdr reported: " + cause.getMessage()
+                        + "). Pane tail:\n" + tail);
+    }
+
+    /**
+     * fleetd #176 fix 2: resolve a raw {@link AgentStatus#UNKNOWN} sample into a trustworthy
+     * injectable state via pane content, the same refinement {@code StatusPoller} applies during a
+     * peer's working life — but corroborated, because the trap this gate is exposed to that the
+     * poller is not: a pane whose backend has already exited settles at a plain shell prompt, and
+     * that prompt commonly contains the same {@code ❯} glyph {@link StatusRefiner#classify} treats
+     * as "idle at the Claude Code TUI prompt". Naively wiring the refiner in would turn "the backend
+     * died" into "ready to inject" — strictly worse than today's timeout.
+     *
+     * <p>Two guards, both required:
+     * <ul>
+     *   <li>{@link StatusRefiner#classify} is written for the Claude Code TUI only (its own javadoc
+     *       says so), so refinement only ever runs for the {@code claude} adapter — never for
+     *       {@code opencode} or any future non-Claude backend, whatever its pane looks like.</li>
+     *   <li>The refined status is accepted only when the <em>same</em> {@code agents.get} sample
+     *       ({@code sample}, taken once by the caller) still reports a non-null
+     *       {@link Agent#agentType()} — herdr's own "a supported backend is still detected here"
+     *       signal, read from the very sample the raw status came from so the two can never
+     *       disagree. A bare shell prompt left by an exited backend reports no {@code agentType}.</li>
+     * </ul>
+     *
+     * <p>Called only when {@code sample.status() == UNKNOWN}, so a healthy spawn — which never sees
+     * {@code UNKNOWN} — triggers zero extra herdr calls; only a persistently-{@code unknown} pane
+     * pays the one extra {@code agent.read} {@link StatusRefiner#refine} performs.
+     */
+    private boolean refinedInjectable(String paneId, Agent sample) {
+        if (sample.status() != AgentStatus.UNKNOWN) {
+            return false;
+        }
+        if (!"claude".equals(namePrefix)) {
+            return false; // StatusRefiner.classify reads a Claude Code TUI prompt specifically
+        }
+        if (sample.agentType() == null) {
+            return false; // no corroborating liveness signal — could be a dead pane's bare shell
+        }
+        return statusRefiner.refine(paneId, AgentStatus.UNKNOWN, agents).injectable();
+    }
+
     /**
      * fleetd #220: the pane's recent output, clipped, for the readiness-gate timeout log — or a
      * short note when it cannot be read. Best-effort by construction: this runs on a path that is

fleetd/src/main/java/dev/ltms/fleet/member/OpenCodeLauncher.java

@@ -6,6 +6,7 @@ import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.ExhaustionSink;
 import dev.ltms.fleet.peer.Capability;
 import dev.ltms.fleet.peer.CharterReceipt;
 import dev.ltms.fleet.peer.PeerHandle;
@@ -73,6 +74,19 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      */
     private final OpenCodeSessionDiscovery discovery;
 
+    /**
+     * fleetd #175: notified when {@link SessionAwareHandle} detects, on the same late-resolve
+     * read that discovers the session id, that the live opencode session is running a DIFFERENT
+     * model than the profile requested — opencode does not fail on an unknown {@code -m}, it
+     * silently falls back to a default (potentially paid) model. Reused exactly as
+     * {@code CompletionResolver}'s {@code BACKEND_EXHAUSTED} path uses it: this launcher supplies
+     * only the herdr terminal id and a reason string; mapping target → session → profile →
+     * credential stays entirely the sink's job (see {@code Fleetd.main}'s wiring). Defaults to
+     * {@link ExhaustionSink#none()} for a caller (an older constructor, or a test not exercising
+     * this) that opts out.
+     */
+    private final ExhaustionSink exhaustionSink;
+
     /**
      * Production constructor — disables the spawn-ready gate ({@code spawnReadyTimeoutMs == 0}) so it
      * matches the legacy non-blocking spawn semantics. Config dirs are created under the JVM temp dir.
@@ -132,9 +146,25 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                              Supplier<FleetConfig.Fleet> fleet,
                              Supplier<FleetConfig.MemberCredentials> memberCredentials,
                              Supplier<FleetConfig> config) {
+        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs, spawnReadyPollMs,
+                fleet, memberCredentials, config, ExhaustionSink.none());
+    }
+
+    /**
+     * Production constructor, plus the live config for URI environment exclusions and the fleetd
+     * #175 model-mismatch quarantine sink.
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                             Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                             Function<String, String> env, long spawnReadyTimeoutMs, long spawnReadyPollMs,
+                             Supplier<FleetConfig.Fleet> fleet,
+                             Supplier<FleetConfig.MemberCredentials> memberCredentials,
+                             Supplier<FleetConfig> config,
+                             ExhaustionSink exhaustionSink) {
         this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                 System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
-                defaultConfigRoot(), defaultDiscoveryRoot(), fleet, memberCredentials, config);
+                defaultConfigRoot(), defaultDiscoveryRoot(), fleet, memberCredentials, config,
+                exhaustionSink);
     }
 
     /**
@@ -182,6 +212,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                 spawnReadyTimeoutMs, nowMillis, sleeper, fleet);
         this.configRoot = configRoot;
         this.discovery = new OpenCodeSessionDiscovery(discoveryRoot);
+        this.exhaustionSink = ExhaustionSink.none();
     }
 
     /**
@@ -207,10 +238,29 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                              Supplier<FleetConfig.Fleet> fleet,
                              Supplier<FleetConfig.MemberCredentials> memberCredentials,
                              Supplier<FleetConfig> config) {
+        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs, nowMillis, sleeper,
+                configRoot, discoveryRoot, fleet, memberCredentials, config, ExhaustionSink.none());
+    }
+
+    /**
+     * Full testability constructor, plus the live config for URI environment exclusions and the
+     * fleetd #175 model-mismatch quarantine sink — the constructor a test drives directly to
+     * observe {@link ExhaustionSink#onExhausted} without going through {@code Fleetd.main}'s
+     * wiring.
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                             Map<String, FleetConfig.Profile> profiles, String defaultProfile,
+                             Function<String, String> env, long spawnReadyTimeoutMs,
+                             LongSupplier nowMillis, Runnable sleeper, Path configRoot, Path discoveryRoot,
+                             Supplier<FleetConfig.Fleet> fleet,
+                             Supplier<FleetConfig.MemberCredentials> memberCredentials,
+                             Supplier<FleetConfig> config,
+                             ExhaustionSink exhaustionSink) {
         super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                 spawnReadyTimeoutMs, nowMillis, sleeper, fleet, memberCredentials, null, config);
         this.configRoot = configRoot;
         this.discovery = new OpenCodeSessionDiscovery(discoveryRoot);
+        this.exhaustionSink = exhaustionSink == null ? ExhaustionSink.none() : exhaustionSink;
     }
 
     private static Path defaultConfigRoot() {
@@ -622,8 +672,13 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     @Override
     public PeerHandle spawn(SpawnRequest req) {
         PeerHandle inner = super.spawn(req);
-        return new SessionAwareHandle(inner, discovery, effectiveCwd(req),
-                this::memberHerdrSocketConfigured, discoveryUnavailableWarned);
+        // fleetd #175: the same profile config buildLaunch resolved for this spawn (requireProfile
+        // is deterministic on req.profileName(), so re-resolving here costs a map lookup, not a
+        // second decision) — SessionAwareHandle needs cfg.model() to know what THIS session should
+        // be running.
+        FleetConfig.Profile cfg = requireProfile(req.profileName());
+        return new SessionAwareHandle(inner, discovery, effectiveCwd(req), cfg,
+                this::memberHerdrSocketConfigured, discoveryUnavailableWarned, exhaustionSink);
     }
 
     /**
@@ -633,22 +688,37 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
      * are untouched — only the opencode-specific identity answer is added. {@code sessionName()}
      * stays null: opencode has no display-name seam, so the logical name lives only in the bridge's
      * roster (see the SESSION_NAME capability).
+     *
+     * <p>fleetd #175: {@link #agentSessionId()} is also where the model-mismatch check lives (see
+     * {@link #checkModelMatch()}) — it is the one method the real late-resolve path
+     * ({@code SessionManager.resolveAgentSessionId}, via {@code get}/{@code rosterResolved}/
+     * {@code release}) actually calls, and only while the session id is still unknown. Putting the
+     * check anywhere else risks repeating PR #203's mistake: a check that runs before opencode has
+     * written the row it needs, and so never fires.
      */
     private static final class SessionAwareHandle implements PeerHandle {
         private final PeerHandle delegate;
         private final OpenCodeSessionDiscovery discovery;
         private final String cwd;
+        private final FleetConfig.Profile cfg;
         private final BooleanSupplier discoveryUnavailable;
         private final AtomicBoolean discoveryUnavailableWarned;
+        private final ExhaustionSink exhaustionSink;
+        /** CAS'd true the first (and only) time a model mismatch is reported for this handle. */
+        private final AtomicBoolean modelMismatchReported = new AtomicBoolean();
 
         SessionAwareHandle(PeerHandle delegate, OpenCodeSessionDiscovery discovery, String cwd,
+                            FleetConfig.Profile cfg,
                             BooleanSupplier discoveryUnavailable,
-                            AtomicBoolean discoveryUnavailableWarned) {
+                            AtomicBoolean discoveryUnavailableWarned,
+                            ExhaustionSink exhaustionSink) {
             this.delegate = delegate;
             this.discovery = discovery;
             this.cwd = cwd;
+            this.cfg = cfg;
             this.discoveryUnavailable = discoveryUnavailable;
             this.discoveryUnavailableWarned = discoveryUnavailableWarned;
+            this.exhaustionSink = exhaustionSink;
         }
 
         @Override
@@ -693,7 +763,64 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
             // when the session is first persisted, so null here is the correct interim answer and
             // the caller re-calls later (each call re-scans, picking up a record that has since
             // appeared).
-            return discovery.sessionIdForDirectory(cwd);
+            String id = discovery.sessionIdForDirectory(cwd);
+            // fleetd #175: check on the SAME tick — while the caller (SessionManager's late-resolve
+            // step) is still re-polling because the id is unknown, the row this id came from (once
+            // it exists) is exactly the row that also carries the actual model. Once id resolves,
+            // the caller stops calling agentSessionId() for this session, so this is naturally a
+            // once-only check that happens right when the row first appears.
+            checkModelMatch();
+            return id;
+        }
+
+        /**
+         * Verify the live opencode session is running the model {@link #cfg} requested (fleetd
+         * #175) and, on a real mismatch, log an ERROR and quarantine through {@link
+         * #exhaustionSink}. A no-op when there is nothing to compare against — no model configured,
+         * already reported once for this handle, or the actual model is still UNKNOWN (no row yet,
+         * unreadable database, or unparseable evidence). UNKNOWN must never be treated as a
+         * mismatch: that is the single most important safety rule here — a false positive would
+         * quarantine a perfectly working profile's credential.
+         */
+        private void checkModelMatch() {
+            if (modelMismatchReported.get() || cfg.model() == null || cfg.model().isBlank()) {
+                return;
+            }
+            OpenCodeSessionDiscovery.ActualModel actual = discovery.actualModelForDirectory(cwd);
+            if (actual == null) {
+                return; // UNKNOWN evidence — never a mismatch
+            }
+            String[] requestedParts = splitProviderModel(cfg.model());
+            String requestedProvider = requestedParts == null ? null : requestedParts[0];
+            String requestedId = requestedParts == null ? cfg.model() : requestedParts[1];
+            boolean idMatches = requestedId.equals(actual.id());
+            // Compare the provider ONLY when BOTH sides have one. requestedProvider == null covers
+            // a bare profile model with no "/" — the profile never asked for a specific provider.
+            // actual.provider() == null covers opencode's model JSON having an id but no providerID
+            // (a real shape parseModel accepts) — that is missing evidence, not a contradiction, and
+            // acceptance rule 4 says missing evidence is UNKNOWN, never a mismatch. Narrowing the
+            // provider comparison this way keeps the id comparison (the part that actually caught the
+            // xf bug) fully intact — a genuine id mismatch is still caught either way (fleetd #175
+            // review round 2).
+            boolean providerMatches = requestedProvider == null || actual.provider() == null
+                    || requestedProvider.equals(actual.provider());
+            if (idMatches && providerMatches) {
+                return;
+            }
+            if (!modelMismatchReported.compareAndSet(false, true)) {
+                return; // another thread already reported this exact mismatch
+            }
+            String actualDisplay = actual.provider() == null
+                    ? actual.id() : actual.provider() + "/" + actual.id();
+            log.error("opencode profile '{}' requested model '{}' but the live session is actually "
+                            + "running '{}' — opencode does not fail on an unknown -m, it silently "
+                            + "falls back to a default model, which may be a PAID credential "
+                            + "(fleetd #175); quarantining this profile's credential",
+                    cfg.profile(), cfg.model(), actualDisplay);
+            exhaustionSink.onExhausted(delegate.terminalId(),
+                    "opencode model mismatch: profile '" + cfg.profile() + "' requested '"
+                            + cfg.model() + "' but the live session is running '" + actualDisplay
+                            + "' (fleetd #175)");
         }
 
         @Override

fleetd/src/main/java/dev/ltms/fleet/member/OpenCodeSessionDiscovery.java

@@ -1,9 +1,12 @@
 package dev.ltms.fleet.member;
 
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 import org.sqlite.SQLiteConfig;
 
+import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.sql.Connection;
@@ -44,6 +47,18 @@ import java.util.concurrent.atomic.AtomicBoolean;
 final class OpenCodeSessionDiscovery {
 
     private static final Logger log = LoggerFactory.getLogger(OpenCodeSessionDiscovery.class);
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+
+    /**
+     * The model opencode actually ran a session on, parsed from the {@code session.model} JSON
+     * column (fleetd #175). {@code id} is never null/blank on a non-null {@code ActualModel} —
+     * {@link #parseModel} returns {@code null} instead when {@code id} cannot be determined, so a
+     * caller only ever sees a fully-known record or {@code null} (UNKNOWN). {@code provider} may
+     * still be {@code null} on its own when the profile that requested the session named no
+     * provider prefix, or opencode's JSON omitted {@code providerID}.
+     */
+    record ActualModel(String provider, String id) {
+    }
 
     private final Path storageRoot;   // e.g. ~/.local/share/opencode (injectable for tests)
     private final Path databasePath;
@@ -117,4 +132,73 @@ final class OpenCodeSessionDiscovery {
                 storageRoot, directory);
         return null;
     }
+
+    /**
+     * The model opencode actually ran the {@code directory}'s most-recent session on (fleetd
+     * #175), read from the same row {@link #sessionIdForDirectory} matches — but via its own
+     * query and its own connection, deliberately kept independent so a database whose schema
+     * predates the {@code model} column (or any other read failure on this column alone) can
+     * never take {@link #sessionIdForDirectory}'s id resolution down with it. That would be a
+     * regression of the id-resolution feature #209 shipped; this method degrades on its own.
+     *
+     * <p>Never throws, and every failure mode — no matching row, a missing/unreadable database, a
+     * missing {@code model} column, a null/blank {@code model} value, or JSON that does not parse
+     * into {@code {"id": "...", "providerID": "..."}} with a non-blank {@code id} — resolves to
+     * {@code null}. That is UNKNOWN evidence, not a mismatch signal: the caller must never
+     * quarantine a profile on the strength of a {@code null} here.
+     *
+     * @param directory the worker's cwd, as resolved for this spawn
+     * @return the actual model, or {@code null} when unknown
+     */
+    ActualModel actualModelForDirectory(String directory) {
+        if (directory == null || directory.isBlank()) {
+            return null;
+        }
+        if (!Files.isRegularFile(databasePath)) {
+            // sessionIdForDirectory already WARNs once (shared warnedMissingDatabase) for this
+            // exact condition — do not double-log it here.
+            return null;
+        }
+        String sql = "SELECT model FROM session WHERE directory = ? ORDER BY time_updated DESC LIMIT 1";
+        try (Connection connection = openReadOnly();
+             PreparedStatement statement = connection.prepareStatement(sql)) {
+            statement.setString(1, directory);
+            try (ResultSet rows = statement.executeQuery()) {
+                if (rows.next()) {
+                    return parseModel(rows.getString("model"));
+                }
+            }
+        } catch (SQLException e) {
+            // Locked/corrupt database, or a `model` column this schema version does not have —
+            // never fatal, and never a mismatch signal. See the class doc above.
+            log.debug("opencode session model unreadable at {}: {}", databasePath, e.toString());
+            return null;
+        }
+        return null;
+    }
+
+    /**
+     * Parse opencode's {@code model} column — {@code {"id":"...","providerID":"..."}} — into an
+     * {@link ActualModel}, or {@code null} when {@code json} is null/blank, is not valid JSON, or
+     * parses without a non-blank {@code id}. {@code providerID} may be absent; that alone does not
+     * make the record unknown, since a caller comparing against a profile with no provider prefix
+     * never looks at it.
+     */
+    private static ActualModel parseModel(String json) {
+        if (json == null || json.isBlank()) {
+            return null;
+        }
+        try {
+            JsonNode node = MAPPER.readTree(json);
+            String id = node.path("id").asText(null);
+            if (id == null || id.isBlank()) {
+                return null;
+            }
+            String provider = node.path("providerID").asText(null);
+            return new ActualModel(provider, id);
+        } catch (IOException e) {
+            log.debug("opencode session model JSON unparseable: {}", e.toString());
+            return null;
+        }
+    }
 }

fleetd/src/main/java/dev/ltms/fleet/msg/ReplyPushLoop.java

@@ -9,8 +9,10 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import java.util.ArrayList;
+import java.util.Collection;
 import java.util.HashSet;
 import java.util.List;
+import java.util.Map;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ScheduledExecutorService;
@@ -68,6 +70,12 @@ public final class ReplyPushLoop {
     static final String QUESTIONS_NUDGE_FORMAT =
             "%d workers are paused on a question — run fleet_poll(ticket=...) for each, then answer "
                     + "with fleet_send(turnId=..., content=...): %s";
+    static final String BACKEND_INCIDENT_NUDGE_FORMAT =
+            "Backend credential %s is cooling for %d remaining seconds; affected profiles: %s; "
+                    + "affected workers: %s. Run fleet_list to see more.";
+    static final String BACKEND_TARGET_UNMAPPED_NUDGE_FORMAT =
+            "A backend error on worker %s could not be mapped to a credential (%s) — no cool-off "
+                    + "was applied. Run fleet_list to check that worker.";
 
     private final PrimaryRegistry primaryRegistry;
     private final AgentControl agents;
@@ -93,6 +101,13 @@ public final class ReplyPushLoop {
      * how depleted an older, still-open question's count is.
      */
     private final ConcurrentHashMap<String, PendingQuestion> pendingQuestions = new ConcurrentHashMap<>();
+    /** Backend incidents awaiting one successful delivery, keyed by incident id and owning lead. */
+    private final ConcurrentHashMap<IncidentLead, PendingIncident> pendingIncidents = new ConcurrentHashMap<>();
+    /** Incident/lead pairs already delivered. They make repeated incident reports one-shot. */
+    private final Set<IncidentLead> deliveredIncidents = ConcurrentHashMap.newKeySet();
+    private final ConcurrentHashMap<UnmappedTargetLead, PendingUnmappedTarget> pendingUnmappedTargets =
+            new ConcurrentHashMap<>();
+    private final Set<UnmappedTargetLead> deliveredUnmappedTargets = ConcurrentHashMap.newKeySet();
     /** CB-590: leads with an active combined reminder schedule (replies and/or tickets and/or questions). */
     private final ConcurrentHashMap<String, Boolean> activeLeads = new ConcurrentHashMap<>();
 
@@ -178,7 +193,20 @@ public final class ReplyPushLoop {
      * tracked per question, not per lead per source).
      */
     private record PendingQuestion(String turnId, String ticket, String target, String lead,
-                                   String question, int nudgeCount) {
+                                    String question, int nudgeCount) {
+    }
+
+    private record IncidentLead(String incidentId, String lead) {
+    }
+
+    private record PendingIncident(IncidentLead key, String credential, List<String> profiles,
+                                   List<String> targets, int remainingCoolOffSeconds, int nudgeCount) {
+    }
+
+    private record UnmappedTargetLead(String target, String reason, String lead) {
+    }
+
+    private record PendingUnmappedTarget(UnmappedTargetLead key, int nudgeCount) {
     }
 
     /** Questions still open for {@code lead}, snapshotted fresh for one tick. */
@@ -192,6 +220,24 @@ public final class ReplyPushLoop {
                 .collect(Collectors.toUnmodifiableSet());
     }
 
+    private List<PendingIncident> pendingIncidentsFor(String lead) {
+        return pendingIncidents.values().stream().filter(i -> lead.equals(i.key().lead())).toList();
+    }
+
+    private Set<IncidentLead> pendingIncidentKeysFor(String lead) {
+        return pendingIncidentsFor(lead).stream().map(PendingIncident::key)
+                .collect(Collectors.toUnmodifiableSet());
+    }
+
+    private List<PendingUnmappedTarget> pendingUnmappedTargetsFor(String lead) {
+        return pendingUnmappedTargets.values().stream().filter(i -> lead.equals(i.key().lead())).toList();
+    }
+
+    private Set<UnmappedTargetLead> pendingUnmappedTargetKeysFor(String lead) {
+        return pendingUnmappedTargetsFor(lead).stream().map(PendingUnmappedTarget::key)
+                .collect(Collectors.toUnmodifiableSet());
+    }
+
     /**
      * The reply-source reminder count {@link #decide} should see for {@code lead} on this tick:
      * the <em>minimum</em> nudge count among the reply targets currently pending for it (CB-598).
@@ -236,6 +282,15 @@ public final class ReplyPushLoop {
         return min == Integer.MAX_VALUE ? 0 : min;
     }
 
+    private int minIncidentNudgeCountFor(String lead) {
+        return pendingIncidentsFor(lead).stream().mapToInt(PendingIncident::nudgeCount).min().orElse(0);
+    }
+
+    private int minUnmappedTargetNudgeCountFor(String lead) {
+        return pendingUnmappedTargetsFor(lead).stream().mapToInt(PendingUnmappedTarget::nudgeCount)
+                .min().orElse(0);
+    }
+
     /**
      * Pure decision function: examine everything pending for {@code lead} — reply targets and
      * tickets alike — and return what the loop should do.
@@ -272,17 +327,35 @@ public final class ReplyPushLoop {
      * @param questionReminderCount the lowest nudge count among questions open for this lead
      */
     Action decide(String lead, int replyReminderCount, int ticketReminderCount, int questionReminderCount) {
+        return decide(lead, replyReminderCount, ticketReminderCount, questionReminderCount,
+                minIncidentNudgeCountFor(lead));
+    }
+
+    /** As above, with backend incidents as a fourth, independently bounded source. */
+    Action decide(String lead, int replyReminderCount, int ticketReminderCount, int questionReminderCount,
+                  int incidentReminderCount) {
+        return decide(lead, replyReminderCount, ticketReminderCount, questionReminderCount,
+                incidentReminderCount, minUnmappedTargetNudgeCountFor(lead));
+    }
+
+    /** As above, with unmapped backend targets as a fifth, independently bounded source. */
+    Action decide(String lead, int replyReminderCount, int ticketReminderCount, int questionReminderCount,
+                  int incidentReminderCount, int unmappedTargetReminderCount) {
         boolean hasReplyWork = !pendingReplyTargetsFor(lead).isEmpty();
         boolean hasTicketWork = !pendingTicketIdsFor(lead).isEmpty();
         boolean hasQuestionWork = !pendingQuestionTurnIdsFor(lead).isEmpty();
-        if (!hasReplyWork && !hasTicketWork && !hasQuestionWork) {
+        boolean hasIncidentWork = !pendingIncidentKeysFor(lead).isEmpty();
+        boolean hasUnmappedTargetWork = !pendingUnmappedTargetKeysFor(lead).isEmpty();
+        if (!hasReplyWork && !hasTicketWork && !hasQuestionWork && !hasIncidentWork && !hasUnmappedTargetWork) {
             log.debug("push: nothing pending for lead {}, stopping reminder", lead);
             return Action.STOP;
         }
         boolean replyEligible = hasReplyWork && replyReminderCount < maxReminders;
         boolean ticketEligible = hasTicketWork && ticketReminderCount < maxReminders;
         boolean questionEligible = hasQuestionWork && questionReminderCount < maxReminders;
-        if (!replyEligible && !ticketEligible && !questionEligible) {
+        boolean incidentEligible = hasIncidentWork && incidentReminderCount < maxReminders;
+        boolean unmappedTargetEligible = hasUnmappedTargetWork && unmappedTargetReminderCount < maxReminders;
+        if (!replyEligible && !ticketEligible && !questionEligible && !incidentEligible && !unmappedTargetEligible) {
             log.debug("push: reminder cap ({}) reached for lead {} on every source with pending work, stopping",
                     maxReminders, lead);
             countNudge("exhausted");
@@ -394,6 +467,48 @@ public final class ReplyPushLoop {
         pendingQuestions.remove(turnId);
     }
 
+    /**
+     * Queue a one-shot backend credential outage notice for every distinct lead that owns an
+     * affected worker. A successful injection records its {@code (incidentId, lead)} key, so a
+     * repeat report never reminds that lead again.
+     */
+    public void onBackendIncident(String incidentId, Collection<String> targets, String credential,
+                                  Collection<String> profiles, int remainingCoolOffSeconds) {
+        Map<String, List<String>> targetsByLead = new ConcurrentHashMap<>();
+        for (String target : targets) {
+            var lead = primaryRegistry.nudgeTargetFor(target);
+            if (lead.isEmpty()) {
+                log.warn("push: backend incident {} has no known lead for target {}", incidentId, target);
+                continue;
+            }
+            targetsByLead.computeIfAbsent(lead.get(), _ -> new ArrayList<>()).add(target);
+        }
+        List<String> profileNames = profiles.stream().sorted().toList();
+        for (var entry : targetsByLead.entrySet()) {
+            IncidentLead key = new IncidentLead(incidentId, entry.getKey());
+            if (deliveredIncidents.contains(key)) continue;
+            pendingIncidents.putIfAbsent(key, new PendingIncident(key, credential, profileNames,
+                    entry.getValue().stream().sorted().toList(), remainingCoolOffSeconds, 0));
+            startOrCoalesce(entry.getKey());
+        }
+    }
+
+    /**
+     * Tell the owning lead that a classified backend error could not be tied to a credential.
+     * Without an owning lead, emit a warning because no control can act on the target.
+     */
+    public void onBackendTargetUnmapped(String target, String reason) {
+        var lead = primaryRegistry.nudgeTargetFor(target);
+        if (lead.isEmpty()) {
+            log.warn("push: backend target {} could not map to a credential: {}", target, reason);
+            return;
+        }
+        UnmappedTargetLead key = new UnmappedTargetLead(target, reason, lead.get());
+        if (deliveredUnmappedTargets.contains(key)) return;
+        pendingUnmappedTargets.putIfAbsent(key, new PendingUnmappedTarget(key, 0));
+        startOrCoalesce(lead.get());
+    }
+
     // --- the schedule ----------------------------------------------------------------------------
 
     /** Start a reminder schedule for {@code lead}, or join the one already running. */
@@ -425,18 +540,25 @@ public final class ReplyPushLoop {
         Set<String> repliesBefore = pendingReplyTargetsFor(lead);
         Set<String> ticketsBefore = pendingTicketIdsFor(lead);
         Set<String> questionsBefore = pendingQuestionTurnIdsFor(lead);
+        Set<IncidentLead> incidentsBefore = pendingIncidentKeysFor(lead);
+        Set<UnmappedTargetLead> unmappedTargetsBefore = pendingUnmappedTargetKeysFor(lead);
         int replyReminderCount = minReplyNudgeCountFor(lead);
         int ticketReminderCount = minTicketNudgeCountFor(lead);
         int questionReminderCount = minQuestionNudgeCountFor(lead);
-        var action = decide(lead, replyReminderCount, ticketReminderCount, questionReminderCount);
+        int incidentReminderCount = minIncidentNudgeCountFor(lead);
+        int unmappedTargetReminderCount = minUnmappedTargetNudgeCountFor(lead);
+        var action = decide(lead, replyReminderCount, ticketReminderCount, questionReminderCount,
+                incidentReminderCount, unmappedTargetReminderCount);
         switch (action) {
             case INJECT -> {
-                injectNudge(lead, replyReminderCount, ticketReminderCount, questionReminderCount);
+                injectNudge(lead, replyReminderCount, ticketReminderCount, questionReminderCount,
+                        incidentReminderCount, unmappedTargetReminderCount);
                 scheduleNext(lead);
             }
             // Re-check after the configured backoff; the lead may become injectable soon.
             case WAIT_BUSY -> scheduleNext(lead);
-            case STOP -> stopOrRestart(lead, repliesBefore, ticketsBefore, questionsBefore);
+            case STOP -> stopOrRestart(lead, repliesBefore, ticketsBefore, questionsBefore, incidentsBefore,
+                    unmappedTargetsBefore);
         }
     }
 
@@ -480,11 +602,25 @@ public final class ReplyPushLoop {
      * decision-to-release window reclaims the schedule slot exactly like a raced-in reply or ticket.
      */
     void stopOrRestart(String lead, Set<String> repliesBefore, Set<String> ticketsBefore,
-                       Set<String> questionsBefore) {
+                        Set<String> questionsBefore) {
+        stopOrRestart(lead, repliesBefore, ticketsBefore, questionsBefore, pendingIncidentKeysFor(lead));
+    }
+
+    private void stopOrRestart(String lead, Set<String> repliesBefore, Set<String> ticketsBefore,
+                               Set<String> questionsBefore, Set<IncidentLead> incidentsBefore) {
+        stopOrRestart(lead, repliesBefore, ticketsBefore, questionsBefore, incidentsBefore,
+                pendingUnmappedTargetKeysFor(lead));
+    }
+
+    private void stopOrRestart(String lead, Set<String> repliesBefore, Set<String> ticketsBefore,
+                               Set<String> questionsBefore, Set<IncidentLead> incidentsBefore,
+                               Set<UnmappedTargetLead> unmappedTargetsBefore) {
         activeLeads.remove(lead);
         boolean racedIn = pendingReplyTargetsFor(lead).stream().anyMatch(t -> !repliesBefore.contains(t))
                 || pendingTicketIdsFor(lead).stream().anyMatch(t -> !ticketsBefore.contains(t))
-                || pendingQuestionTurnIdsFor(lead).stream().anyMatch(t -> !questionsBefore.contains(t));
+                || pendingQuestionTurnIdsFor(lead).stream().anyMatch(t -> !questionsBefore.contains(t))
+                || pendingIncidentKeysFor(lead).stream().anyMatch(i -> !incidentsBefore.contains(i))
+                || pendingUnmappedTargetKeysFor(lead).stream().anyMatch(i -> !unmappedTargetsBefore.contains(i));
         if (racedIn && activeLeads.putIfAbsent(lead, Boolean.TRUE) == null) {
             log.debug("push: new work for lead {} raced the reminder loop's stop — restarting", lead);
             scheduleNext(lead);
@@ -495,18 +631,22 @@ public final class ReplyPushLoop {
 
     /** Send one combined nudge covering everything currently pending for {@code lead}. */
     private void injectNudge(String lead, int replyReminderCount, int ticketReminderCount,
-                             int questionReminderCount) {
+                              int questionReminderCount, int incidentReminderCount,
+                              int unmappedTargetReminderCount) {
         // Re-read rather than threading it down from decide(): a reply can drain, a ticket be
         // collected, or a question be answered (or another arrive), between the decision and the
         // injection.
         Set<String> replyTargets = pendingReplyTargetsFor(lead);
         List<PendingTicket> tickets = pendingTicketsFor(lead);
         List<PendingQuestion> questions = pendingQuestionsFor(lead);
-        if (replyTargets.isEmpty() && tickets.isEmpty() && questions.isEmpty()) {
+        List<PendingIncident> incidents = pendingIncidentsFor(lead);
+        List<PendingUnmappedTarget> unmappedTargets = pendingUnmappedTargetsFor(lead);
+        if (replyTargets.isEmpty() && tickets.isEmpty() && questions.isEmpty() && incidents.isEmpty()
+                && unmappedTargets.isEmpty()) {
             log.debug("push: pending work for lead {} drained before the nudge could be sent", lead);
             return;
         }
-        String nudge = formatNudge(replyTargets, tickets, questions);
+        String nudge = formatNudge(replyTargets, tickets, questions, incidents, unmappedTargets);
         try {
             agents.send(lead, nudge);
             log.debug("push: nudge sent to lead {} (reply {}/{}, ticket {}/{}, question {}/{}; "
@@ -515,6 +655,16 @@ public final class ReplyPushLoop {
                     questionReminderCount + 1, maxReminders,
                     replyTargets.size(), tickets.size(), questions.size());
             countNudge("delivered");
+            for (PendingIncident incident : incidents) {
+                if (pendingIncidents.remove(incident.key(), incident)) {
+                    deliveredIncidents.add(incident.key());
+                }
+            }
+            for (PendingUnmappedTarget unmappedTarget : unmappedTargets) {
+                if (pendingUnmappedTargets.remove(unmappedTarget.key(), unmappedTarget)) {
+                    deliveredUnmappedTargets.add(unmappedTarget.key());
+                }
+            }
         } catch (RuntimeException e) {
             log.warn("push: failed to nudge lead {} (reply {}/{}, ticket {}/{}, question {}/{}): {}",
                     lead, replyReminderCount + 1, maxReminders, ticketReminderCount + 1, maxReminders,
@@ -526,12 +676,13 @@ public final class ReplyPushLoop {
         // item already at or over the cap keeps riding along in the text (still pending, still
         // named) but its extra bumps here are inert: decide() already treats it as ineligible once
         // its count reaches maxReminders.
-        bumpNudgeCounts(replyTargets, tickets, questions);
+        bumpNudgeCounts(replyTargets, tickets, questions, incidents, unmappedTargets);
     }
 
     /** Record that every one of these items was just named in a sent (or attempted) nudge. */
     private void bumpNudgeCounts(Set<String> replyTargets, List<PendingTicket> tickets,
-                                 List<PendingQuestion> questions) {
+                                  List<PendingQuestion> questions, List<PendingIncident> incidents,
+                                  List<PendingUnmappedTarget> unmappedTargets) {
         for (String target : replyTargets) {
             pendingReplies.computeIfPresent(target, (t, e) -> new ReplyEntry(e.lead(), e.nudgeCount() + 1));
         }
@@ -544,6 +695,14 @@ public final class ReplyPushLoop {
                     new PendingQuestion(e.turnId(), e.ticket(), e.target(), e.lead(), e.question(),
                             e.nudgeCount() + 1));
         }
+        for (PendingIncident incident : incidents) {
+            pendingIncidents.computeIfPresent(incident.key(), (id, e) -> new PendingIncident(e.key(),
+                    e.credential(), e.profiles(), e.targets(), e.remainingCoolOffSeconds(), e.nudgeCount() + 1));
+        }
+        for (PendingUnmappedTarget unmappedTarget : unmappedTargets) {
+            pendingUnmappedTargets.computeIfPresent(unmappedTarget.key(), (id, e) ->
+                    new PendingUnmappedTarget(e.key(), e.nudgeCount() + 1));
+        }
     }
 
     /** Schedule the next tick on the scheduler thread pool. */
@@ -556,7 +715,8 @@ public final class ReplyPushLoop {
 
     /** Render everything pending for one lead as a single nudge line. */
     private static String formatNudge(Set<String> replyTargets, List<PendingTicket> tickets,
-                                      List<PendingQuestion> questions) {
+                                       List<PendingQuestion> questions, List<PendingIncident> incidents,
+                                       List<PendingUnmappedTarget> unmappedTargets) {
         List<String> parts = new ArrayList<>();
         if (!replyTargets.isEmpty()) {
             parts.add(formatRepliesNudge(replyTargets));
@@ -567,6 +727,12 @@ public final class ReplyPushLoop {
         if (!questions.isEmpty()) {
             parts.add(formatQuestionsNudge(questions));
         }
+        if (!incidents.isEmpty()) {
+            parts.addAll(incidents.stream().map(ReplyPushLoop::formatBackendIncidentNudge).toList());
+        }
+        if (!unmappedTargets.isEmpty()) {
+            parts.addAll(unmappedTargets.stream().map(ReplyPushLoop::formatUnmappedTargetNudge).toList());
+        }
         return String.join(" | ", parts);
     }
 
@@ -606,6 +772,16 @@ public final class ReplyPushLoop {
         return QUESTIONS_NUDGE_FORMAT.formatted(pending.size(), ids);
     }
 
+    private static String formatBackendIncidentNudge(PendingIncident incident) {
+        return BACKEND_INCIDENT_NUDGE_FORMAT.formatted(incident.credential(), incident.remainingCoolOffSeconds(),
+                String.join(", ", incident.profiles()), String.join(", ", incident.targets()));
+    }
+
+    private static String formatUnmappedTargetNudge(PendingUnmappedTarget unmappedTarget) {
+        return BACKEND_TARGET_UNMAPPED_NUDGE_FORMAT.formatted(unmappedTarget.key().target(),
+                unmappedTarget.key().reason());
+    }
+
     // --- lifecycle -----------------------------------------------------------------------------
 
     /**
@@ -627,6 +803,10 @@ public final class ReplyPushLoop {
         pendingReplies.clear();
         pendingTickets.clear();
         pendingQuestions.clear();
+        pendingIncidents.clear();
+        deliveredIncidents.clear();
+        pendingUnmappedTargets.clear();
+        deliveredUnmappedTargets.clear();
     }
 
     /** @see #stop() */

fleetd/src/main/java/dev/ltms/fleet/session/GitWorktrees.java

@@ -13,6 +13,7 @@ import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.StandardCopyOption;
+import java.nio.file.attribute.PosixFilePermissions;
 import java.security.SecureRandom;
 import java.util.ArrayList;
 import java.util.HashSet;
@@ -161,6 +162,7 @@ public final class GitWorktrees implements Worktrees {
         } catch (IOException e) {
             throw new WorktreeException("cannot create worktree root " + root + ": " + e.getMessage(), e);
         }
+        shareRootWithGroup(root);
         String wt = path.toAbsolutePath().toString();
         log.info("adding worktree branch={} path={} base={}", branch, wt, base);
         removeUserInfoFromHttpsOrigin(repoRoot);
@@ -712,6 +714,54 @@ public final class GitWorktrees implements Worktrees {
                 group, repoRoot, worktreePath, touched);
     }
 
+    /**
+     * fleetd #224: make {@code worktreeRoot} ITSELF group-traversable — established once, here,
+     * where the root is created, never at a use site. {@link #shareWithGroup} shares each worktree
+     * (and the repo's common git dir) with {@link #group}, but never the PARENT directory that
+     * contains every worktree — and under {@code memberHerdrSocket:} the member pane runs as a
+     * different OS user, which needs the execute bit on every ancestor directory to reach anything
+     * underneath, no matter how carefully each child is shared. Without this, a member cannot read
+     * the ephemeral {@code opencode.json} #219 places under this root, cannot reach its own
+     * worktree, and cannot read #213's ZDOTDIR scrub when placed here either.
+     *
+     * <p>No-op — no process spawned — when {@link #group} is null/blank, so behaviour with
+     * {@code worktreeGroup:} unset (today's only live mode) is unchanged. Only {@code root} itself
+     * is touched (non-recursive): each child underneath is shared individually, either by
+     * {@link #shareWithGroup} for a worktree or by the launcher that generates it (fleetd #213/#219)
+     * for a scrub/config directory — sharing this level again would just duplicate that policy in
+     * the wrong layer.
+     *
+     * <p>Fails loudly, naming {@code root}, its mode at the time of the attempt, and {@link #group}:
+     * a member that starts and then cannot see its own checkout is worse than a refused spawn, since
+     * nothing about that failure mode points at a directory's permission bits.
+     */
+    private void shareRootWithGroup(Path root) {
+        if (group == null) {
+            return;
+        }
+        String mode = currentPosixMode(root);
+        try {
+            shareGroupRunner.apply(new String[]{"chgrp", group, root.toString()});
+            shareGroupRunner.apply(new String[]{"chmod", "g+x", root.toString()});
+        } catch (WorktreeException e) {
+            throw new WorktreeException("cannot make worktree root " + root + " (mode " + mode
+                    + ") group-traversable for group '" + group + "': " + e.getMessage()
+                    + " — the group must exist, and the fleetd operator (" + System.getProperty("user.name")
+                    + ") must be a member of it", e);
+        }
+        log.info("worktreeGroup={} made worktree root {} group-traversable (was mode {})", group, root, mode);
+    }
+
+    /** {@code root}'s current POSIX permission string, or {@code "unknown"} on a filesystem that does
+     *  not support POSIX permissions — used only to name the mode in a refusal message. */
+    private static String currentPosixMode(Path root) {
+        try {
+            return PosixFilePermissions.toString(Files.getPosixFilePermissions(root));
+        } catch (IOException | UnsupportedOperationException e) {
+            return "unknown";
+        }
+    }
+
     /**
      * The repo's <em>common</em> git directory as an absolute path — where {@code objects},
      * {@code refs} and {@code worktrees} actually live. {@code git rev-parse --git-common-dir}

fleetd/src/main/java/dev/ltms/fleet/session/SessionManager.java

@@ -190,49 +190,44 @@ public final class SessionManager implements TurnListener {
         if (profile != null && !profile.isBlank()) {
             memberLifecycle.requireSlotFor(memberRole, profile);
         }
+        MemberLifecycle.SlotReservation reservation = memberLifecycle.reserve(memberRole, profile);
+        String launchProfile = reservation == null ? profile : reservation.profile();
         if (wt == null) {
             // CB-557: the role must ride on the SpawnRequest, not stay a local. The launcher needs it
             // to pick the profile out of that role's pool and to label the tab; a role kept only on
             // the MemberSession is recorded after the spawn it was supposed to steer.
-            SpawnRequest req = new SpawnRequest(profile, requestedCwd, callerCwd, sessionName, resumeSessionId, memberRole);
+            SpawnRequest req = new SpawnRequest(launchProfile, requestedCwd, callerCwd, sessionName, resumeSessionId, memberRole);
             PeerHandle handle;
+            boolean bound = false;
             try {
                 handle = launcher.spawn(req);
+                String resolvedProfile = resolveProfile(handle, launchProfile);
+                String cwd = launcher.effectiveCwd(new SpawnRequest(resolvedProfile, requestedCwd, callerCwd));
+                long now = nowNanos.getAsLong();
+                MemberRole actualRole = acquired(memberRole, resolvedProfile, handle.terminalId(), reservation);
+                bound = reservation == null || actualRole == MemberRole.ARCHITECT;
+                MemberSession session = new MemberSession(
+                        handle.id(), handle.terminalId(), resolvedProfile, actualRole, cwd, ownerTerminal, now, now, 0,
+                        MemberSession.State.SPAWNING, null, null, handle.charterReceipt(), handle.agentSessionId());
+                registry.put(handle.id(), session);
+                handles.put(handle.id(), handle);
+                log.debug("acquired session id={} terminal={} profile={} owner={}",
+                        handle.id(), handle.terminalId(), session.profile(), session.ownerTerminal());
+                notifyAcquired(session.terminalId());
+                return session;
             } catch (RuntimeException e) {
-                log.warn("spawn failed for profile={} role={}: {}", profile, memberRole, e.getMessage());
+                if (!bound) memberLifecycle.release(reservation);
+                log.warn("spawn failed for profile={} role={}: {}", launchProfile, memberRole, e.getMessage());
                 throw e;
             }
-            String resolvedProfile = resolveProfile(handle, profile);
-            String cwd = launcher.effectiveCwd(new SpawnRequest(resolvedProfile, requestedCwd, callerCwd));
-            long now = nowNanos.getAsLong();
-            // CB-619: bind (or fail to bind) BEFORE the session is recorded, and store whatever role
-            // this call actually returns — never the requested memberRole — so the session's role,
-            // what GET /members and fleet_list report, is never a lie about what this terminal holds.
-            MemberRole actualRole = memberLifecycle.acquired(memberRole, resolvedProfile, handle.terminalId());
-            MemberSession session = new MemberSession(
-                    handle.id(),
-                    handle.terminalId(),
-                    resolvedProfile,
-                    actualRole,
-                    cwd,
-                    ownerTerminal,
-                    now,
-                    now,
-                    0,
-                    MemberSession.State.SPAWNING,
-                    null,
-                    null,
-                    handle.charterReceipt(),
-                    handle.agentSessionId());
-            registry.put(handle.id(), session);
-            handles.put(handle.id(), handle);
-            log.debug("acquired session id={} terminal={} profile={} owner={}",
-                    handle.id(), handle.terminalId(), session.profile(), session.ownerTerminal());
-            notifyAcquired(session.terminalId());
-            return session;
         }
-        return acquireWithWorktree(profile, memberRole, requestedCwd, callerCwd, ownerTerminal, wt,
-                sessionName, resumeSessionId);
+        try {
+            return acquireWithWorktree(launchProfile, memberRole, requestedCwd, callerCwd, ownerTerminal, wt,
+                    sessionName, resumeSessionId, reservation);
+        } catch (RuntimeException e) {
+            memberLifecycle.release(reservation);
+            throw e;
+        }
     }
 
     /**
@@ -478,7 +473,8 @@ public final class SessionManager implements TurnListener {
 
     private MemberSession acquireWithWorktree(String profile, MemberRole memberRole, String requestedCwd, String callerCwd,
                                               String ownerTerminal, WorktreeRequest wt,
-                                              String sessionName, String resumeSessionId) {
+                                               String sessionName, String resumeSessionId,
+                                               MemberLifecycle.SlotReservation reservation) {
         String preResolvedProfile = (profile == null || profile.isBlank())
                 ? launcher.defaultProfile() : profile;
         // CB-507: resolve through the launcher's CB-112 chain (requested → profile cwd → caller →
@@ -521,7 +517,7 @@ public final class SessionManager implements TurnListener {
         long now = nowNanos.getAsLong();
         // CB-619: see the no-worktree path above — bind before recording, and store the returned
         // actual role, so this session's role is never a lie about what it actually holds.
-        MemberRole actualRole = memberLifecycle.acquired(memberRole, resolvedProfile, handle.terminalId());
+        MemberRole actualRole = acquired(memberRole, resolvedProfile, handle.terminalId(), reservation);
         MemberSession session = new MemberSession(
                 handle.id(),
                 handle.terminalId(),
@@ -545,6 +541,18 @@ public final class SessionManager implements TurnListener {
         return session;
     }
 
+    private MemberRole acquired(MemberRole role, String profile, String terminal,
+                                MemberLifecycle.SlotReservation reservation) {
+        if (reservation == null) {
+            return memberLifecycle.acquired(role, profile, terminal);
+        }
+        if (memberLifecycle.bind(reservation, terminal)) {
+            return role;
+        }
+        memberLifecycle.release(reservation);
+        return memberLifecycle.acquired(role, profile, terminal);
+    }
+
     private String slug(String raw) {
         return raw == null ? "ticket" : raw.toLowerCase().replaceAll("[^a-z0-9]+", "-").replaceAll("^-+|-+$", "");
     }

fleetd/src/test/java/dev/ltms/fleet/herdr/FakeHerdr.java

@@ -44,10 +44,13 @@ public final class FakeHerdr implements HerdrClient {
     private String agentSendErrorCode = null;
     private boolean noPanes = false;
     private volatile String agentStatus = "idle"; // steady-state agent.get status
+    private volatile String agentType = "claude"; // detected agent kind on agent.get; null = undetected
     private volatile String readText = "worker transcript tail"; // canned agent.read output
     private int pinnedStarts = 0;   // how many upcoming agent.start calls report a fixed pane
     private String pinnedStartTerminal;
     private String pinnedStartPane;
+    private volatile int agentGetOkCalls = Integer.MAX_VALUE; // how many agent.get calls succeed first
+    private volatile String agentGetFailCode = null; // error code every agent.get call after that reports
 
     public FakeHerdr healthy(boolean h) {
         this.healthy = h;
@@ -103,6 +106,27 @@ public final class FakeHerdr implements HerdrClient {
         return this;
     }
 
+    /**
+     * Set the detected agent kind ({@code "agent"} field) that {@code agent.get} reports —
+     * {@code null} models herdr not (or no longer) detecting a supported backend in the pane, e.g.
+     * a bare shell prompt (fleetd #176 fix 2 corroboration test).
+     */
+    public FakeHerdr agentType(String type) {
+        this.agentType = type;
+        return this;
+    }
+
+    /**
+     * Make {@code agent.get} succeed normally for its first {@code okCalls} invocations, then fail
+     * every call after that with {@code code} — fleetd #176 fix 1's "backend exited mid-wait"
+     * fixture. {@code okCalls == 0} fails from the very first call.
+     */
+    public FakeHerdr agentGetFailsWithAfter(int okCalls, String code) {
+        this.agentGetOkCalls = okCalls;
+        this.agentGetFailCode = code;
+        return this;
+    }
+
     /** The text {@code agent.read} returns (the CB-106 completion scrape). */
     public FakeHerdr readText(String text) {
         this.readText = text;
@@ -208,10 +232,21 @@ public final class FakeHerdr implements HerdrClient {
                     }
                     yield mapper.readTree("{\"type\":\"ok\"}");
                 }
-                case "agent.get" -> mapper.readTree(("""
-                        {"type":"agent_info","agent":{"terminal_id":"term_a","agent":"claude",
+                case "agent.get" -> {
+                    if (agentGetFailCode != null) {
+                        long getCalls = calls.stream().filter(c -> c.method().equals("agent.get")).count();
+                        if (getCalls > agentGetOkCalls) {
+                            throw new HerdrException(
+                                    "herdr error [" + agentGetFailCode + "]: agent target not found",
+                                    agentGetFailCode, null);
+                        }
+                    }
+                    String agentField = agentType == null ? "null" : "\"" + agentType + "\"";
+                    yield mapper.readTree(("""
+                        {"type":"agent_info","agent":{"terminal_id":"term_a","agent":%s,
                           "agent_status":"%s","workspace_id":"w2","tab_id":"w2:t7","pane_id":"w2:p7"}}""")
-                        .formatted(agentStatus));
+                            .formatted(agentField, agentStatus));
+                }
                 case "agent.read" -> mapper.readTree(mapper.writeValueAsString(
                         java.util.Map.of("type", "agent_read", "read", java.util.Map.of("text", readText))));
                 case "agent.start" -> {

fleetd/src/test/java/dev/ltms/fleet/member/ClaudeCodeLauncherTest.java

@@ -963,6 +963,152 @@ class ClaudeCodeLauncherTest {
         assertDoesNotThrow(() -> UUID.fromString(handle.id()));
     }
 
+    // --- fleetd #176 fix 1: fail fast when the backend process exits mid-wait -------------------
+
+    @Test
+    void spawnFailsFastWhenBackendProcessExitsMidWaitInsteadOfBurningTheTimeout() {
+        // First agent.get sees UNKNOWN (one normal tick); the second reports the pane gone, exactly
+        // what herdr answers when the backend process has already exited. The timeout is generous
+        // (60s) so a test that wrongly falls through to the old unguarded call — and therefore
+        // waits out the whole window — is unambiguously distinguishable from one that fails fast.
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("unknown");
+        herdr.agentGetFailsWithAfter(1, "pane_not_found");
+        long[] clock = {0};
+
+        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(
+                new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")),
+                workerConfigMap("ltms-local", null), "ltms-local", _ -> null,
+                60_000, () -> clock[0], () -> clock[0] += 50);
+
+        PeerUnreachableException ex = assertThrows(
+                PeerUnreachableException.class,
+                () -> svc.spawn(new SpawnRequest(null, null, null)));
+
+        assertTrue(ex.getMessage().contains("w9:pRoot_1"),
+                "exception message references the paneId: " + ex.getMessage());
+        assertTrue(ex.getMessage().toLowerCase().contains("exited"),
+                "exception message says the backend exited, not that the pane was slow: "
+                        + ex.getMessage());
+        assertTrue(clock[0] < 60_000,
+                "the gate must not burn the rest of the 60s timeout: clock only reached " + clock[0]);
+        long getCalls = herdr.calls.stream().filter(c -> c.method().equals("agent.get")).count();
+        assertEquals(2, getCalls,
+                "exactly one normal poll then the not_found answer — no further polling after that: "
+                        + getCalls);
+        assertEquals(1, paneCloseCount(herdr, "w9:pRoot_1"),
+                "the pane is torn down (no orphan) even on the fail-fast path");
+    }
+
+    @Test
+    void spawnLetsAnUnrelatedHerdrErrorPropagateUnchanged() {
+        // Fix 1 must only special-case a "*_not_found" answer. Any other herdr failure keeps
+        // propagating as-is — this gate does not know how to recover from it.
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("unknown");
+        herdr.agentGetFailsWithAfter(0, "internal_error");
+        long[] clock = {0};
+
+        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(
+                new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")),
+                workerConfigMap("ltms-local", null), "ltms-local", _ -> null,
+                60_000, () -> clock[0], () -> clock[0] += 50);
+
+        dev.ltms.fleet.herdr.HerdrException ex = assertThrows(
+                dev.ltms.fleet.herdr.HerdrException.class,
+                () -> svc.spawn(new SpawnRequest(null, null, null)));
+
+        assertEquals("internal_error", ex.code());
+        assertEquals(0, paneCloseCount(herdr, "w9:pRoot_1"),
+                "an error this gate does not recognize is not this gate's teardown to run");
+    }
+
+    // --- fleetd #176 fix 2: corroborated UNKNOWN refinement --------------------------------------
+
+    @Test
+    void refinedIdleIsNotAcceptedWhenAgentTypeIsNull() {
+        // The trap fix 2 must close: a pane sitting at a bare shell prompt after its backend exited
+        // still contains the same "❯" glyph StatusRefiner.classify treats as "idle at the Claude
+        // Code TUI prompt". Without the agentType corroboration this would be misread as injectable
+        // and the gate would hand back a peer that never started. herdr reports no agentType for
+        // that bare shell.
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("unknown"); // always UNKNOWN
+        herdr.agentType(null);        // no supported backend detected — could be a bare shell
+        herdr.readText("some-host:~ user$ ❯ "); // looks exactly like an idle Claude Code prompt
+        long[] clock = {0};
+
+        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(
+                new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")),
+                workerConfigMap("ltms-local", null), "ltms-local", _ -> null,
+                500, () -> clock[0], () -> clock[0] += 50);
+
+        PeerUnreachableException ex = assertThrows(
+                PeerUnreachableException.class,
+                () -> svc.spawn(new SpawnRequest(null, null, null)));
+
+        assertTrue(clock[0] >= 500,
+                "a null agentType must not let the '❯' prompt refine to injectable — the gate has "
+                        + "to wait out the full timeout: clock only reached " + clock[0]);
+        assertEquals(1, paneCloseCount(herdr, "w9:pRoot_1"),
+                "the pane is torn down on timeout, same as any other never-injectable spawn");
+    }
+
+    @Test
+    void refinedIdleIsAcceptedWhenAgentTypeCorroboratesLiveness() {
+        // The positive case: a genuinely live claude pane that herdr misreports as UNKNOWN (CB-115)
+        // still resolves to injectable once agentType corroborates that a supported backend is
+        // detected in the same sample.
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("unknown"); // always UNKNOWN at the raw level
+        herdr.agentType("claude");    // herdr still detects a live claude backend
+        herdr.readText("? for shortcuts"); // StatusRefiner.classify's idle footer marker
+        long[] clock = {0};
+
+        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(
+                new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")),
+                workerConfigMap("ltms-local", null), "ltms-local", _ -> null,
+                60_000, () -> clock[0], () -> clock[0] += 50);
+
+        PeerHandle handle = svc.spawn(new SpawnRequest(null, null, null));
+
+        assertNotNull(handle, "a corroborated refined-IDLE sample lets the spawn succeed");
+        assertTrue(clock[0] < 60_000,
+                "refinement must resolve well before the timeout: clock reached " + clock[0]);
+        assertEquals(0, paneCloseCount(herdr, "w9:pRoot_1"),
+                "no pane close — the peer is genuinely injectable");
+    }
+
+    @Test
+    void refinementNeverFiresWhenRawStatusIsAlreadyInjectable() {
+        // Acceptance criterion 4: refinement must trigger only on a raw UNKNOWN sample. Seed the
+        // pane content with an active-generation marker that StatusRefiner.classify would read as
+        // WORKING (never injectable) if refine() were wrongly invoked here — proving that a raw
+        // IDLE status short-circuits before refine() (and its extra agent.read call) ever runs.
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("idle"); // already injectable at the raw level
+        herdr.agentType("claude");
+        herdr.readText("esc to interrupt"); // would classify as WORKING if refine() ran anyway
+
+        long[] clock = {0};
+        ClaudeCodeLauncher gated = new ClaudeCodeLauncher(
+                new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")),
+                workerConfigMap("ltms-local", null), "ltms-local", _ -> null,
+                5000, () -> clock[0], () -> clock[0] += 300);
+
+        PeerHandle handle = gated.spawn(new SpawnRequest(null, null, null));
+
+        assertNotNull(handle, "an already-injectable raw status succeeds without ever refining");
+        assertFalse(herdr.called("agent.read"),
+                "refine() must never run (and so never call agent.read) when the raw status is "
+                        + "already injectable");
+    }
+
     // --- CB-511: worker environment seeding -----------------------------------------------------
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/member/EnvAllowListScrubTest.java

@@ -114,6 +114,68 @@ class EnvAllowListScrubTest {
         assertNull(EnvAllowListScrub.readReport(dir));
     }
 
+    /**
+     * fleetd #224 criterion 5 (a gap the #221 reviewer flagged): {@link EnvAllowListScrub#shareWithGroup}
+     * lists one FLAT level of {@code dir} and shares every file it finds there — which does cover the
+     * OPTIONAL files a caller may or may not have written before calling it ({@code member-charter.md},
+     * {@code ide-rules.md} — both written by {@code OpenCodeLauncher#writeConfig}), but nothing
+     * pinned that down.
+     * Without this test, a future change that writes a file AFTER the sharing call, or into a
+     * subdirectory, would pass every existing test while quietly leaving that file unreadable to a
+     * different-uid member.
+     *
+     * <p>This drives {@code shareWithGroup} directly against a directory holding several flat files —
+     * not only {@code opencode.json}, but also the two optional ones named above plus a third,
+     * unrelated file, so the assertion is "every flat file", not "the two files someone thought of".
+     */
+    @Test
+    void shareWithGroupCoversEveryFlatFileIncludingTheOptionalOnes(@TempDir Path dir) throws Exception {
+        String group = currentUserGroup();
+        Files.writeString(dir.resolve("opencode.json"), "{}\n");
+        Files.writeString(dir.resolve("member-charter.md"), "# charter\n");
+        Files.writeString(dir.resolve("ide-rules.md"), "# ide rules\n");
+        Files.writeString(dir.resolve("another-flat-file.txt"), "unrelated\n");
+
+        EnvAllowListScrub.shareWithGroup(dir, group);
+
+        assertEquals("rwxr-x---", java.nio.file.attribute.PosixFilePermissions.toString(
+                        Files.getPosixFilePermissions(dir)),
+                "the directory itself must be group-traversable+readable, owner-only writable");
+        for (String name : List.of("opencode.json", "member-charter.md", "ide-rules.md", "another-flat-file.txt")) {
+            Path file = dir.resolve(name);
+            assertEquals("rw-r-----", java.nio.file.attribute.PosixFilePermissions.toString(
+                            Files.getPosixFilePermissions(file)),
+                    name + " must be group-readable, never group-writable");
+        }
+    }
+
+    /**
+     * The current process's REAL primary group — resolved via {@code id -gn}, never by reading a
+     * directory's owning group (fleetd #225: that reads wherever Maven happened to be started from,
+     * not the process's own group, and the two diverge outside a home checkout). Skips (never fails)
+     * when {@code id} is unavailable or its primary group cannot be resolved on this host.
+     */
+    private static String currentUserGroup() {
+        String out;
+        boolean ok;
+        try {
+            Process p = new ProcessBuilder("id", "-gn").redirectErrorStream(true).start();
+            String raw = new String(p.getInputStream().readAllBytes(), StandardCharsets.UTF_8).trim();
+            out = raw;
+            ok = p.waitFor(5, java.util.concurrent.TimeUnit.SECONDS) && p.exitValue() == 0 && !raw.isBlank();
+        } catch (IOException e) {
+            out = null;
+            ok = false;
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            out = null;
+            ok = false;
+        }
+        assumeTrue(ok, "cannot resolve this process's real primary group via `id -gn` on this host "
+                + "— skipping a POSIX-group-dependent test rather than failing it");
+        return out;
+    }
+
     /**
      * The same equality, for a shell that is INTERACTIVE but NOT a login shell — the shape herdr
      * opens on Linux.

fleetd/src/test/java/dev/ltms/fleet/member/HerdrPeerLauncherAllowListWiringTest.java

@@ -18,7 +18,6 @@ import org.slf4j.LoggerFactory;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.nio.file.attribute.PosixFileAttributeView;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -513,11 +512,37 @@ class HerdrPeerLauncherAllowListWiringTest {
                         + "java.io.tmpdir, unchanged from before this fix: " + dir);
     }
 
-    /** The current process's own primary group — resolvable on whatever host runs this test. */
-    private static String currentUserGroup() throws IOException {
-        PosixFileAttributeView view = Files.getFileAttributeView(Path.of("."), PosixFileAttributeView.class);
-        assumeTrue(view != null, "this host's filesystem does not support POSIX group ownership");
-        return view.readAttributes().group().getName();
+    /**
+     * The current process's REAL primary group — resolved via {@code id -gn}, never by reading a
+     * directory's owning group (fleetd #225). Those two coincide only by accident: a directory's
+     * group is whichever group happened to own the path Maven was started from — {@code staff} in
+     * a home checkout, {@code wheel} under {@code /private/tmp} on macOS — and the fix-up this test
+     * exercises then fails for real when the operator is not a member of that borrowed group,
+     * exactly the case {@code assumeTrue(view != null, ...)} never covered (it only detects a
+     * filesystem with no POSIX groups at all, not a resolvable-but-wrong one). Skips (never fails)
+     * when {@code id} is unavailable or its primary group cannot be resolved on this host.
+     */
+    private static String currentUserGroup() {
+        String out;
+        boolean ok;
+        try {
+            Process p = new ProcessBuilder("id", "-gn").redirectErrorStream(true).start();
+            try (java.io.BufferedReader r = new java.io.BufferedReader(
+                    new java.io.InputStreamReader(p.getInputStream(), java.nio.charset.StandardCharsets.UTF_8))) {
+                out = r.lines().collect(java.util.stream.Collectors.joining("\n")).trim();
+            }
+            ok = p.waitFor(5, java.util.concurrent.TimeUnit.SECONDS) && p.exitValue() == 0 && !out.isBlank();
+        } catch (IOException e) {
+            out = null;
+            ok = false;
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            out = null;
+            ok = false;
+        }
+        assumeTrue(ok, "cannot resolve this process's real primary group via `id -gn` on this host "
+                + "— skipping a POSIX-group-dependent test rather than failing it");
+        return out;
     }
 
     /** Spawn once through the real launcher path, capturing every INFO+ line this class logs. */

fleetd/src/test/java/dev/ltms/fleet/member/OpenCodeLauncherTest.java

@@ -10,12 +10,15 @@ import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.FakeHerdr;
 import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.ExhaustionSink;
 import dev.ltms.fleet.peer.Capability;
 import dev.ltms.fleet.peer.CharterReceipt;
 import dev.ltms.fleet.peer.MemberRole;
 import dev.ltms.fleet.peer.PeerHandle;
 import dev.ltms.fleet.peer.PeerUnreachableException;
 import dev.ltms.fleet.peer.SpawnRequest;
+import dev.ltms.fleet.session.MemberSession;
+import dev.ltms.fleet.session.SessionManager;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.LoggerFactory;
@@ -23,10 +26,11 @@ import org.slf4j.LoggerFactory;
 import java.io.IOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.nio.file.attribute.PosixFileAttributeView;
 import java.nio.file.attribute.PosixFilePermissions;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
@@ -392,6 +396,46 @@ class OpenCodeLauncherTest {
         assertNotNull(ex.getMessage());
     }
 
+    /**
+     * fleetd #176 fix 2's per-adapter guard: {@code StatusRefiner.classify} is written for the
+     * Claude Code TUI only, and the spawn-readiness gate must never run it against an opencode
+     * pane. {@code agentType("opencode")} deliberately satisfies the OTHER guard (the corroborating
+     * liveness check) so it cannot be what makes this test pass — only the {@code namePrefix}
+     * check can be. If that check were ever removed, this pane's {@code ❯} content would refine
+     * straight to IDLE and the gate would report ready before the backend actually was.
+     */
+    @Test
+    void opencodePaneIsNeverRefinedEvenWhenItsContentLooksLikeAnIdleClaudePrompt(@TempDir Path root) {
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("unknown"); // always UNKNOWN
+        herdr.agentType("opencode");  // non-null — satisfies the liveness guard on its own
+        herdr.readText("some-host:~ user$ ❯ "); // content StatusRefiner.classify reads as IDLE
+        long[] clock = {0};
+        OpenCodeLauncher svc = new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                Map.of("gemini", opencodeCfg(null, null, null)), "gemini", _ -> null,
+                1000, () -> clock[0], () -> clock[0] += 50, root, root);
+
+        assertThrows(PeerUnreachableException.class,
+                () -> svc.spawn(new SpawnRequest(null, null, null)));
+
+        assertTrue(clock[0] >= 1000,
+                "an opencode pane must never refine to injectable, however its content reads — "
+                        + "the gate has to wait out the full timeout: clock only reached " + clock[0]);
+        // A blanket "agent.read is never called" does not hold here: the timeout path itself reads
+        // the pane tail (source=recent) for its own log message, on every timeout, regardless of
+        // adapter — see HerdrPeerLauncher.readPaneQuietly. So assert on the refiner's OWN probe
+        // source (StatusRefiner.PROBE_SOURCE = "detection") instead — that call happens only inside
+        // StatusRefiner.refine, so its absence proves the refiner itself was never reached for this
+        // opencode pane, not merely that its answer was discarded.
+        long detectionReads = herdr.calls.stream()
+                .filter(c -> c.method().equals("agent.read"))
+                .filter(c -> "detection".equals(((Map<?, ?>) c.params()).get("source")))
+                .count();
+        assertEquals(0, detectionReads,
+                "the refiner's own pane probe (source=detection) must never run against an "
+                        + "opencode pane — the namePrefix guard has to stop it before that call");
+    }
+
     @Test
     void spawnReturnsHandleWhenGateDisabled(@TempDir Path root) {
         FakeHerdr herdr = new FakeHerdr();
@@ -657,11 +701,37 @@ class OpenCodeLauncherTest {
                 0, System::currentTimeMillis, () -> { }, configRoot, discoveryRoot, null, null, config);
     }
 
-    /** The current process's own primary group — resolvable on whatever host runs this test. */
-    private static String currentUserGroup() throws IOException {
-        PosixFileAttributeView view = Files.getFileAttributeView(Path.of("."), PosixFileAttributeView.class);
-        assumeTrue(view != null, "this host's filesystem does not support POSIX group ownership");
-        return view.readAttributes().group().getName();
+    /**
+     * The current process's REAL primary group — resolved via {@code id -gn}, never by reading a
+     * directory's owning group (fleetd #225). Those two coincide only by accident: a directory's
+     * group is whichever group happened to own the path Maven was started from — {@code staff} in
+     * a home checkout, {@code wheel} under {@code /private/tmp} on macOS — and the fix-up this test
+     * exercises then fails for real when the operator is not a member of that borrowed group,
+     * exactly the case {@code assumeTrue(view != null, ...)} never covered (it only detects a
+     * filesystem with no POSIX groups at all, not a resolvable-but-wrong one). Skips (never fails)
+     * when {@code id} is unavailable or its primary group cannot be resolved on this host.
+     */
+    private static String currentUserGroup() {
+        String out;
+        boolean ok;
+        try {
+            Process p = new ProcessBuilder("id", "-gn").redirectErrorStream(true).start();
+            try (java.io.BufferedReader r = new java.io.BufferedReader(
+                    new java.io.InputStreamReader(p.getInputStream(), java.nio.charset.StandardCharsets.UTF_8))) {
+                out = r.lines().collect(java.util.stream.Collectors.joining("\n")).trim();
+            }
+            ok = p.waitFor(5, java.util.concurrent.TimeUnit.SECONDS) && p.exitValue() == 0 && !out.isBlank();
+        } catch (IOException e) {
+            out = null;
+            ok = false;
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            out = null;
+            ok = false;
+        }
+        assumeTrue(ok, "cannot resolve this process's real primary group via `id -gn` on this host "
+                + "— skipping a POSIX-group-dependent test rather than failing it");
+        return out;
     }
 
     /**
@@ -811,4 +881,256 @@ class OpenCodeLauncherTest {
         assertTrue(warnings.get(0).contains("memberHerdrSocket"),
                 "the WARN must name memberHerdrSocket as the reason — got: " + warnings.get(0));
     }
+
+    // --- fleetd #175: opencode silently substitutes a model on an unknown -m flag ----------------
+
+    private static OpenCodeLauncher serviceWithSink(FakeHerdr herdr, Path configRoot, Path discoveryRoot,
+                                                      FleetConfig.Profile cfg, ExhaustionSink sink) {
+        return new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null,
+                0, System::currentTimeMillis, () -> { }, configRoot, discoveryRoot,
+                null, null, null, sink);
+    }
+
+    /**
+     * fleetd #175 acceptance criterion 1: the check must fire on the REAL late-resolve path —
+     * {@code SessionManager}'s {@code get}/{@code roster} re-polling a retained {@link PeerHandle}
+     * (fleetd #209) — not on a handle built and queried directly. A handle whose row does not exist
+     * yet, then does, proves the check runs exactly where production runs it: PR #203 shipped a
+     * check that ran inside {@code spawn()}, before opencode had written the row, and every test
+     * passed anyway because none of them drove it through this path. This test would have caught
+     * that: {@code sessions.get(...)} before the row exists must show no mismatch, and the SAME
+     * call, re-driven after the row appears, must be what fires the sink.
+     */
+    @Test
+    void theRealSessionManagerLateResolvePathCatchesAModelMismatch(@TempDir Path configRoot,
+                                                                     @TempDir Path discRoot) throws Exception {
+        FakeHerdr herdr = new FakeHerdr();
+        // xf's real shape (fleetd #175): weight:80, model "opencode/nemotron-3-ultra-free", no
+        // credentialId — the profile that actually escaped the fleet's accounting.
+        FleetConfig.Profile cfg = opencodeCfg("opencode/nemotron-3-ultra-free", null, null);
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason) -> exhausted.add(target + "|" + reason);
+        OpenCodeLauncher launcher = serviceWithSink(herdr, configRoot, discRoot, cfg, sink);
+
+        SessionManager sessions = new SessionManager(launcher);
+        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+
+        // Real late-resolve path, driven BEFORE opencode has written its session row — same shape
+        // as production the instant a pane goes ready.
+        Optional<MemberSession> beforeRow = sessions.get(acquired.paneId());
+        assertTrue(beforeRow.isPresent());
+        assertNull(beforeRow.get().agentSessionId(), "no opencode row yet");
+        assertTrue(exhausted.isEmpty(), "no row yet → nothing to compare, the sink must stay silent");
+
+        // opencode writes its row late, running gpt-5.6-sol (a PAID credential) instead of the
+        // withdrawn free model the profile actually asked for — the exact fleetd #175 scenario.
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
+
+        // Drive the SAME real late-resolve path again: sessions.get() -> resolveAgentSessionId ->
+        // the retained PeerHandle's agentSessionId() -> discovery -> checkModelMatch, all in one
+        // call, unmodified SessionManager code from fleetd #209.
+        Optional<MemberSession> afterRow = sessions.get(acquired.paneId());
+        assertEquals("ses_x", afterRow.get().agentSessionId(),
+                "the id itself still resolves correctly alongside the model check");
+
+        assertEquals(1, exhausted.size(), "the mismatch must fire exactly once through the real path");
+        assertTrue(exhausted.get(0).contains(cfg.model()), "reports the requested model: " + exhausted.get(0));
+        assertTrue(exhausted.get(0).contains("gpt-5.6-sol"), "reports the actual model: " + exhausted.get(0));
+    }
+
+    /** THE TRAP, row 1: a provider-prefixed request matching the DB's id AND provider is a match. */
+    @Test
+    void aProviderPrefixedModelMatchingBothIdAndProviderIsNotAMismatch(@TempDir Path configRoot,
+                                                                        @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason) -> exhausted.add(reason);
+        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
+        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"gpt-5.6-terra\",\"providerID\":\"openai\"}");
+
+        assertEquals("ses_x", handle.agentSessionId());
+        assertTrue(exhausted.isEmpty(), "id and provider both match → never a mismatch: " + exhausted);
+    }
+
+    /** THE TRAP, row 2: same shape as row 1 with a different provider/id pair (the gx profile). */
+    @Test
+    void aGxProviderPrefixedModelMatchingBothIdAndProviderIsNotAMismatch(@TempDir Path configRoot,
+                                                                          @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason) -> exhausted.add(reason);
+        FleetConfig.Profile cfg = opencodeCfg("gx/deepseek-v4-flash", null, null);
+        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");
+
+        assertEquals("ses_x", handle.agentSessionId());
+        assertTrue(exhausted.isEmpty(), "id and provider both match → never a mismatch: " + exhausted);
+    }
+
+    /**
+     * Incomplete evidence, not THE TRAP's provider mismatch: opencode's {@code model} JSON had an
+     * {@code id} but no {@code providerID} at all (a real shape {@code parseModel} accepts — see
+     * {@code OpenCodeSessionDiscoveryTest}). The id matches; the provider dimension is simply
+     * unknown, not contradicted. A provider-prefixed profile must NOT be quarantined on this —
+     * that would quarantine on incomplete evidence, which acceptance rule 4 forbids.
+     */
+    @Test
+    void aMissingProviderIdInTheEvidenceIsUnknownNotAMismatchWhenTheIdMatches(
+            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason) -> exhausted.add(reason);
+        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
+        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"gpt-5.6-terra\"}");
+
+        assertEquals("ses_x", handle.agentSessionId());
+        assertTrue(exhausted.isEmpty(),
+                "id matches and provider is simply unknown (absent), never a mismatch: " + exhausted);
+    }
+
+    /**
+     * The other half of the same fix: a missing {@code providerID} must NOT blind the check to a
+     * genuine id mismatch. This is what proves the fix narrows the comparison rather than switching
+     * the whole check off whenever {@code providerID} happens to be absent.
+     */
+    @Test
+    void aMissingProviderIdInTheEvidenceStillCatchesARealIdMismatch(
+            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason) -> exhausted.add(reason);
+        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
+        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"gpt-5.6-sol\"}");
+
+        assertEquals("ses_x", handle.agentSessionId());
+        assertEquals(1, exhausted.size(),
+                "the id genuinely differs, so this must still quarantine even with providerID absent: "
+                        + exhausted);
+        assertTrue(exhausted.get(0).contains("gpt-5.6-sol") && exhausted.get(0).contains(cfg.model()),
+                "reports both the requested and actual model: " + exhausted.get(0));
+    }
+
+    /**
+     * THE TRAP, row 3: a profile that names no provider prefix (bare {@code "deepseek-v4-flash"})
+     * must match on id alone — the profile never asked for a specific provider, so opencode
+     * resolving it to {@code gx} is not evidence of anything wrong.
+     */
+    @Test
+    void aBareModelWithNoProviderPrefixMatchesOnIdAloneAndIsNotAMismatch(@TempDir Path configRoot,
+                                                                          @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason) -> exhausted.add(reason);
+        FleetConfig.Profile cfg = opencodeCfg("deepseek-v4-flash", null, null);
+        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");
+
+        assertEquals("ses_x", handle.agentSessionId());
+        assertTrue(exhausted.isEmpty(),
+                "no provider was requested, so opencode's own provider resolution is not a mismatch: "
+                        + exhausted);
+    }
+
+    /**
+     * THE TRAP, row 4 (not a row in the table, the reason the table exists): a mismatched id, with
+     * the profile's requested and the actual model both named in the ERROR and the sink's reason —
+     * the exact fleetd #175 scenario (a withdrawn model silently falls back to a paid one).
+     */
+    @Test
+    void aRealIdMismatchLogsAnErrorNamingBothModelsAndQuarantinesThroughTheSink(
+            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason) -> exhausted.add(target + "|" + reason);
+        FleetConfig.Profile cfg = opencodeCfg("opencode/nemotron-3-ultra-free", null, null);
+
+        Logger logger = (Logger) LoggerFactory.getLogger(OpenCodeLauncher.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        PeerHandle handle;
+        try {
+            handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                    .spawn(new SpawnRequest(null, "/work/dir", null));
+            OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                    "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
+            assertEquals("ses_x", handle.agentSessionId());
+        } finally {
+            logger.detachAppender(appender);
+        }
+
+        assertEquals(1, exhausted.size(), "a real id mismatch must reach the sink exactly once");
+        assertTrue(exhausted.get(0).contains("opencode/nemotron-3-ultra-free"),
+                "the sink reason must name the requested model: " + exhausted.get(0));
+        assertTrue(exhausted.get(0).contains("gpt-5.6-sol"),
+                "the sink reason must name the actual model: " + exhausted.get(0));
+
+        List<ILoggingEvent> errors = appender.list.stream()
+                .filter(e -> e.getLevel() == Level.ERROR)
+                .toList();
+        assertEquals(1, errors.size(), "exactly one ERROR for the mismatch: " + appender.list);
+        String message = errors.get(0).getFormattedMessage();
+        assertTrue(message.contains("opencode/nemotron-3-ultra-free") && message.contains("gpt-5.6-sol")
+                        && message.contains(cfg.profile()),
+                "the ERROR must name the requested model, the actual model, AND the profile: " + message);
+
+        // The check runs at most once per handle even if agentSessionId() is polled again.
+        handle.agentSessionId();
+        assertEquals(1, exhausted.size(), "no duplicate quarantine on a repeated call");
+    }
+
+    /**
+     * fleetd #175's central safety rule: absent, empty, or unparseable model evidence is UNKNOWN,
+     * never a mismatch — it must never quarantine a working profile. Covers every "no real
+     * evidence yet" shape: no row at all, a row with a null model, and a row with unparseable JSON.
+     */
+    @Test
+    void unknownOrUnparseableModelEvidenceNeverQuarantines(@TempDir Path configRoot,
+                                                             @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason) -> exhausted.add(reason);
+        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
+        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+
+        // No row yet at all.
+        assertNull(handle.agentSessionId());
+        assertTrue(exhausted.isEmpty(), "no row yet is UNKNOWN, not a mismatch: " + exhausted);
+
+        // A row exists (for a DIFFERENT directory) so a poll on ours still finds nothing.
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_other", "/work/other", 500L,
+                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
+        assertNull(handle.agentSessionId());
+        assertTrue(exhausted.isEmpty(), "a row for a different directory is UNKNOWN, not a mismatch: "
+                + exhausted);
+    }
+
+    /**
+     * A profile with no {@code model:} configured has nothing to compare against — the check must
+     * stay silent no matter what opencode actually ran, since there is no requested value to be
+     * wrong about.
+     */
+    @Test
+    void aProfileWithNoConfiguredModelIsNeverCheckedForAMismatch(@TempDir Path configRoot,
+                                                                  @TempDir Path discRoot) throws Exception {
+        List<String> exhausted = new ArrayList<>();
+        ExhaustionSink sink = (target, reason) -> exhausted.add(reason);
+        FleetConfig.Profile cfg = opencodeCfg(null, null, null);
+        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                "{\"id\":\"anything-at-all\",\"providerID\":\"anyone\"}");
+
+        assertEquals("ses_x", handle.agentSessionId());
+        assertTrue(exhausted.isEmpty(), "no model configured → nothing to compare: " + exhausted);
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/member/OpenCodeSessionDiscoveryTest.java

@@ -27,19 +27,30 @@ class OpenCodeSessionDiscoveryTest {
      * and insert one row. Static so {@link OpenCodeLauncherTest} can reuse it.
      */
     static void writeRecord(Path root, String id, String directory, long timeUpdated) throws Exception {
+        writeRecord(root, id, directory, timeUpdated, null);
+    }
+
+    /**
+     * Same as {@link #writeRecord(Path, String, String, long)}, plus the {@code model} column
+     * fleetd #175 reads — the raw JSON opencode writes, e.g.
+     * {@code {"id":"gpt-5.6-terra","providerID":"openai"}}. {@code modelJson} may be {@code null}.
+     */
+    static void writeRecord(Path root, String id, String directory, long timeUpdated, String modelJson)
+            throws Exception {
         Path db = root.resolve("opencode.db");
         try (Connection connection = DriverManager.getConnection("jdbc:sqlite:" + db)) {
             try (Statement statement = connection.createStatement()) {
                 statement.execute("CREATE TABLE IF NOT EXISTS session ("
-                        + "id TEXT PRIMARY KEY, directory TEXT, time_updated INTEGER)");
+                        + "id TEXT PRIMARY KEY, directory TEXT, time_updated INTEGER, model TEXT)");
             }
             // Bound parameters, not string interpolation: the class under test uses a
             // PreparedStatement, and a hand-escaped INSERT here is a pattern someone copies out.
             try (PreparedStatement insert = connection.prepareStatement(
-                    "INSERT INTO session (id, directory, time_updated) VALUES (?, ?, ?)")) {
+                    "INSERT INTO session (id, directory, time_updated, model) VALUES (?, ?, ?, ?)")) {
                 insert.setString(1, id);
                 insert.setString(2, directory);
                 insert.setLong(3, timeUpdated);
+                insert.setString(4, modelJson);
                 insert.executeUpdate();
             }
         }
@@ -134,4 +145,96 @@ class OpenCodeSessionDiscoveryTest {
         assertNull(new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"),
                 "an unreadable database resolves to null, not an exception");
     }
+
+    // --- fleetd #175: actualModelForDirectory / the model JSON column ---------------------------
+
+    @Test
+    void parsesTheModelJsonIntoProviderAndId(@TempDir Path root) throws Exception {
+        writeRecord(root, "ses_aaa", "/w/a", 1000L, "{\"id\":\"gpt-5.6-terra\",\"providerID\":\"openai\"}");
+
+        OpenCodeSessionDiscovery.ActualModel actual =
+                new OpenCodeSessionDiscovery(root).actualModelForDirectory("/w/a");
+
+        assertNotNull(actual, "a well-formed model JSON parses");
+        assertEquals("gpt-5.6-terra", actual.id());
+        assertEquals("openai", actual.provider());
+    }
+
+    @Test
+    void prefersTheModelOfTheMostRecentlyUpdatedRow(@TempDir Path root) throws Exception {
+        writeRecord(root, "ses_old", "/w/a", 1000L, "{\"id\":\"old-model\",\"providerID\":\"openai\"}");
+        writeRecord(root, "ses_new", "/w/a", 5000L, "{\"id\":\"new-model\",\"providerID\":\"openai\"}");
+
+        assertEquals("new-model",
+                new OpenCodeSessionDiscovery(root).actualModelForDirectory("/w/a").id(),
+                "the model of the row with the highest time_updated wins, same as the id");
+    }
+
+    @Test
+    void aNonMatchingDirectoryYieldsUnknownModelRatherThanAMismatch(@TempDir Path root) throws Exception {
+        writeRecord(root, "ses_aaa", "/w/a", 1000L, "{\"id\":\"x\",\"providerID\":\"y\"}");
+
+        assertNull(new OpenCodeSessionDiscovery(root).actualModelForDirectory("/w/other"),
+                "no row for this cwd yet → unknown, not a wrong model");
+    }
+
+    @Test
+    void aNullModelColumnYieldsUnknownWithoutThrowing(@TempDir Path root) throws Exception {
+        writeRecord(root, "ses_aaa", "/w/a", 1000L, null);
+
+        assertNull(new OpenCodeSessionDiscovery(root).actualModelForDirectory("/w/a"),
+                "a row with no model value yet is unknown, not a mismatch");
+    }
+
+    @Test
+    void unparseableModelJsonYieldsUnknownWithoutThrowing(@TempDir Path root) throws Exception {
+        writeRecord(root, "ses_aaa", "/w/a", 1000L, "this is not json");
+
+        assertNull(new OpenCodeSessionDiscovery(root).actualModelForDirectory("/w/a"),
+                "JSON that fails to parse resolves to unknown, never an exception");
+    }
+
+    @Test
+    void modelJsonMissingIdYieldsUnknown(@TempDir Path root) throws Exception {
+        writeRecord(root, "ses_aaa", "/w/a", 1000L, "{\"providerID\":\"openai\"}");
+
+        assertNull(new OpenCodeSessionDiscovery(root).actualModelForDirectory("/w/a"),
+                "no id in the JSON → unknown, since id is what a caller actually compares");
+    }
+
+    @Test
+    void aMissingDatabaseYieldsUnknownModelWithoutThrowing(@TempDir Path root) {
+        assertNull(new OpenCodeSessionDiscovery(root).actualModelForDirectory("/w/a"));
+    }
+
+    /**
+     * fleetd #175 site 2: a schema that predates the {@code model} column entirely — the exact
+     * shape a real opencode upgrade/downgrade could produce. This must degrade to UNKNOWN for the
+     * model, and — the property that actually matters — must NOT take id resolution down with it.
+     * A combined single query for both columns would fail this test; that is why
+     * {@link OpenCodeSessionDiscovery#actualModelForDirectory} runs its own independent query.
+     */
+    @Test
+    void aMissingModelColumnYieldsUnknownButIdResolutionStillWorks(@TempDir Path root) throws Exception {
+        Path db = root.resolve("opencode.db");
+        try (Connection connection = DriverManager.getConnection("jdbc:sqlite:" + db)) {
+            try (Statement statement = connection.createStatement()) {
+                statement.execute("CREATE TABLE session (id TEXT PRIMARY KEY, directory TEXT, "
+                        + "time_updated INTEGER)");
+            }
+            try (PreparedStatement insert = connection.prepareStatement(
+                    "INSERT INTO session (id, directory, time_updated) VALUES (?, ?, ?)")) {
+                insert.setString(1, "ses_aaa");
+                insert.setString(2, "/w/a");
+                insert.setLong(3, 1000L);
+                insert.executeUpdate();
+            }
+        }
+
+        OpenCodeSessionDiscovery discovery = new OpenCodeSessionDiscovery(root);
+        assertEquals("ses_aaa", discovery.sessionIdForDirectory("/w/a"),
+                "id resolution must survive a database with no model column at all");
+        assertNull(discovery.actualModelForDirectory("/w/a"),
+                "no model column → unknown, not a throw and not a mismatch");
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/msg/ReplyPushLoopTest.java

@@ -43,6 +43,7 @@ class ReplyPushLoopTest {
     private static final String PRIMARY = "term_primary";
     private static final String WORKER = "term_worker";
     private static final String WORKER2 = "term_worker2";
+    private static final String OTHER_PRIMARY = "term_other_primary";
     private static final ObjectMapper MAPPER = new ObjectMapper();
 
     private PrimaryRegistry registry;
@@ -529,6 +530,106 @@ class ReplyPushLoopTest {
         assertTrue(nudge.contains("task-1"), "the ticket must not be dropped: " + nudge);
     }
 
+    // --- CB-201: backend credential outage nudges -----------------------------------------------
+
+    @Test
+    void oneBackendIncidentForTwoWorkersOfOneLeadSendsOnceAndIsOneShot() throws Exception {
+        var rec = recordingClient();
+        agents = new AgentControl(rec);
+        registry.recordDelegation(WORKER, PRIMARY);
+        registry.recordDelegation(WORKER2, PRIMARY);
+        var loop = loop(2, 100);
+
+        loop.onBackendIncident("incident-1", List.of(WORKER, WORKER2), "cred-a",
+                List.of("terra", "codex"), 47);
+
+        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS), "one lead gets one outage injection");
+        Thread.sleep(200);
+        assertEquals(1, rec.sendCount(), "two workers for one lead must send only one outage notice");
+        String nudge = rec.sentParams().getFirst().getValue().toString();
+        assertTrue(nudge.contains("cred-a"));
+        assertTrue(nudge.contains("codex, terra"));
+        assertTrue(nudge.contains(WORKER) && nudge.contains(WORKER2));
+        assertTrue(nudge.contains("47 remaining seconds"));
+        assertTrue(nudge.contains("fleet_list"));
+
+        loop.onBackendIncident("incident-1", List.of(WORKER, WORKER2), "cred-a",
+                List.of("terra", "codex"), 47);
+        Thread.sleep(250);
+        assertEquals(1, rec.sendCount(), "a delivered incident id must never be sent again");
+    }
+
+    @Test
+    void oneBackendIncidentSendsOnceToEachAffectedLead() throws Exception {
+        var rec = recordingClient();
+        rec.sendLatch = new CountDownLatch(2);
+        agents = new AgentControl(rec);
+        registry.recordDelegation(WORKER, PRIMARY);
+        registry.recordDelegation(WORKER2, OTHER_PRIMARY);
+        var loop = loop(1, 50);
+
+        loop.onBackendIncident("incident-2", List.of(WORKER, WORKER2), "cred-a", List.of("terra"), 60);
+
+        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS), "each affected lead gets its one notice");
+        assertEquals(2, rec.sendCount());
+    }
+
+    @Test
+    void backendIncidentWaitsForBusyLeadThenCombinesWithFailedTicket() throws Exception {
+        var rec = new BusyThenIdleHerdrClient(2);
+        agents = new AgentControl(rec);
+        var loop = loop(1, 50);
+
+        loop.onTicketTerminal("task-failed", WORKER, true);
+        loop.onBackendIncident("incident-3", List.of(WORKER), "cred-b", List.of("terra"), 31);
+
+        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS), "busy lead should receive deferred combined nudge");
+        assertEquals(1, rec.sendCount(), "ticket and outage must use the same injection");
+        String nudge = rec.sentParams().getFirst().getValue().toString();
+        assertTrue(nudge.contains("task-failed") && nudge.contains("cred-b"),
+                "the one nudge must name both the failed ticket and outage: " + nudge);
+    }
+
+    @Test
+    void failedBackendIncidentSendRetriesWithinTheExistingReminderCap() throws Exception {
+        var rec = new ThrowOnceHerdrClient();
+        agents = new AgentControl(rec);
+        var loop = loop(2, 50);
+
+        loop.onBackendIncident("incident-4", List.of(WORKER), "cred-c", List.of("terra"), 20);
+
+        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS), "failed first send must retry under maxReminders");
+        assertEquals(2, rec.promptAttempts.get(), "one failed send and one retry use the existing cap");
+    }
+
+    @Test
+    void unmappedBackendTargetUsesTheKnownLeadSchedule() throws Exception {
+        var rec = recordingClient();
+        agents = new AgentControl(rec);
+        var loop = loop(1, 50);
+
+        loop.onBackendTargetUnmapped(WORKER, "no credential matched");
+
+        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS));
+        String nudge = ((Map<?, ?>) rec.sentParams().getFirst().getValue()).get("text").toString();
+        assertEquals("A backend error on worker term_worker could not be mapped to a credential "
+                        + "(no credential matched) — no cool-off was applied. "
+                        + "Run fleet_list to check that worker.",
+                nudge);
+    }
+
+    @Test
+    void stopClearsPendingBackendIncidents() {
+        agents = agentWithStatus("idle");
+        var loop = loop(1, 100_000);
+        loop.onBackendIncident("incident-stop", List.of(WORKER), "cred-stop", List.of("terra"), 60);
+
+        loop.stop();
+
+        assertEquals(ReplyPushLoop.Action.STOP, loop.decide(PRIMARY, 0, 0, 0),
+                "stop must clear a pending backend incident as well as older sources");
+    }
+
     // --- CB-590 follow-up: per-source reminder budgets — the regression this round exists for ---
 
     @Test
@@ -928,6 +1029,31 @@ class ReplyPushLoopTest {
         return new RecordingHerdrClient();
     }
 
+    /** Fails its first prompt call, then records the retry. */
+    private static final class ThrowOnceHerdrClient implements HerdrClient {
+        private final AtomicInteger promptAttempts = new AtomicInteger();
+        private final CountDownLatch sendLatch = new CountDownLatch(1);
+
+        @Override
+        public JsonNode call(String method, Object params) {
+            if ("agent.get".equals(method)) {
+                return MAPPER.createObjectNode().set("agent", MAPPER.createObjectNode()
+                        .put("terminal_id", PRIMARY).put("agent_status", "idle"));
+            }
+            if ("agent.prompt".equals(method) && promptAttempts.getAndIncrement() == 0) {
+                throw new IllegalStateException("first prompt fails");
+            }
+            if ("agent.prompt".equals(method)) {
+                sendLatch.countDown();
+            }
+            return MAPPER.createObjectNode();
+        }
+
+        @Override
+        public void close() {
+        }
+    }
+
     /**
      * Thread-safe fake that reports {@code working} (not injectable) for its first
      * {@code busyChecks} status calls, then {@code idle} forever after — used to prove work queued

fleetd/src/test/java/dev/ltms/fleet/session/GitWorktreesTest.java

@@ -1099,4 +1099,82 @@ class GitWorktreesTest {
         assertTrue(e.getMessage().contains("cb185-nonexistent-group-zz"),
                 "exception must name the missing/refused group: " + e.getMessage());
     }
+
+    // --- fleetd #224: worktreeRoot itself must be group-traversable, established in add() ---------
+
+    /**
+     * {@code add} must make the worktree ROOT itself group-traversable when a group is configured —
+     * established once here, where the root is created, never at a use site (never inside a
+     * launcher). A recording runner stands in for chgrp/chmod, the same seam
+     * {@link #shareWithGroupRunsConfigThenChgrpChmodSetgidPerPath} uses for the per-worktree share.
+     */
+    @Test
+    void addSharesWorktreeRootWithGroupWhenConfigured(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        Path root = tmp.resolve("wts");
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            return "";
+        };
+        GitWorktrees gitWorktrees = new GitWorktrees(root.toString(), "devteam", _ -> {}, recordingRunner);
+
+        gitWorktrees.add(repo.toString(), "cb-224-branch", "HEAD");
+
+        assertTrue(recorded.contains(List.of("chgrp", "devteam", root.toString())),
+                "the worktree root itself must be chgrp'd to the configured group: " + recorded);
+        assertTrue(recorded.contains(List.of("chmod", "g+x", root.toString())),
+                "the worktree root itself must gain group-execute so a different-uid member can "
+                        + "traverse into it: " + recorded);
+    }
+
+    /** {@code worktreeGroup} unset (today's only live mode) ⇒ {@code add} spawns no share process
+     *  for the root at all — behaviour must be byte-identical to before fleetd #224. */
+    @Test
+    void addSharesNothingForTheRootWhenNoGroupConfigured(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        Path root = tmp.resolve("wts");
+        List<List<String>> recorded = new java.util.ArrayList<>();
+        java.util.function.Function<String[], String> recordingRunner = cmd -> {
+            recorded.add(joined(cmd));
+            return "";
+        };
+        GitWorktrees gitWorktrees = new GitWorktrees(root.toString(), null, _ -> {}, recordingRunner);
+
+        gitWorktrees.add(repo.toString(), "cb-224-nogroup", "HEAD");
+
+        assertTrue(recorded.isEmpty(), "no group configured must spawn no share process for the "
+                + "root at all: " + recorded);
+    }
+
+    /**
+     * fleetd #224, acceptance criterion 2/3: when the root cannot be made group-traversable — here
+     * because the configured group does not exist, the same real-failure shape
+     * {@link #shareWithGroupThrowsNamingTheGroupWhenChgrpFails} drives for the per-worktree share —
+     * the spawn is refused with a message naming the root, its current mode, and the group. This
+     * drives the REAL {@code chgrp} (no recording runner), and the refusal happens before {@code git
+     * worktree add} ever runs, so no partial worktree is left behind either.
+     */
+    @Test
+    void addRefusesWhenWorktreeRootCannotBeMadeGroupTraversable(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        Path root = tmp.resolve("wts");
+        GitWorktrees gitWorktrees = new GitWorktrees(root.toString(), "cb224-nonexistent-group-zz");
+
+        WorktreeException e = assertThrows(WorktreeException.class,
+                () -> gitWorktrees.add(repo.toString(), "cb-224-refuse", "HEAD"));
+
+        assertTrue(e.getMessage().contains(root.toString()),
+                "refusal must name the worktree root: " + e.getMessage());
+        assertTrue(e.getMessage().contains("cb224-nonexistent-group-zz"),
+                "refusal must name the missing/refused group: " + e.getMessage());
+        assertTrue(Files.isDirectory(root), "the root is created before the group check runs");
+        String mode = java.nio.file.attribute.PosixFilePermissions.toString(Files.getPosixFilePermissions(root));
+        assertTrue(e.getMessage().contains(mode),
+                "refusal must name the root's current mode (" + mode + "): " + e.getMessage());
+        try (java.util.stream.Stream<Path> children = Files.list(root)) {
+            assertTrue(children.findAny().isEmpty(), "no worktree must be left behind under the root: "
+                    + "the refusal must happen before `git worktree add` ever runs");
+        }
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/session/SessionManagerTest.java

@@ -5,6 +5,7 @@ import ch.qos.logback.classic.LoggerContext;
 import ch.qos.logback.classic.spi.ILoggingEvent;
 import ch.qos.logback.core.read.ListAppender;
 import dev.ltms.fleet.auth.MemberRegistry;
+import dev.ltms.fleet.auth.MemberLifecycle;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.AgentControl;
@@ -335,18 +336,31 @@ class SessionManagerTest {
     }
 
     /**
-     * CB-619 / fleetd #123: {@code requireSlotFor} closes the config-gap case (no slot at all
-     * carries the profile) before anything spawns, but a profile that DOES carry a slot can still
-     * lose the bind to a concurrent spawn racing for the same slot. This drives that residual case
-     * through the REAL path — {@link SessionManager#acquire} against the real {@link
-     * dev.ltms.fleet.member.ClaudeCodeLauncher} and {@link FakeHerdr} — never {@link
-     * dev.ltms.fleet.auth.MemberRegistry#bind} directly for the session under test (only the
-     * precondition uses it, to occupy the slot before the real spawn happens). The session that
-     * loses the race must be held as a plain {@code dev}, never left claiming {@code architect} in
-     * the roster, and the daemon log must say so at WARN.
+     * fleetd #226: a contended slot is refused through the real {@link SessionManager#acquire}
+     * path before the real launcher can hand an architect charter to a process.
      */
+    @Test
+    void aContendedArchitectSlotRefusesBeforeTheLauncherStartsAMember() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr);
+        MemberRegistry members = architectRegistry();
+        assertTrue(members.bind("architect:opus", "term_already_bound"),
+                "precondition: occupy the sole architect slot before the real spawn under test");
+        sessions.setMemberLifecycle(members);
+
+        assertThrows(IllegalArgumentException.class, () -> sessions.acquire("ltms-local", MemberRole.ARCHITECT,
+                null, "/caller", "term_primary", null));
+
+        assertFalse(herdr.called("agent.start"), "a refused slot must never reach the launcher");
+        assertTrue(sessions.roster().isEmpty(), "no member exists to receive the wrong charter");
+    }
+
     @Test
     void aSecondArchitectOnAnAlreadyBoundProfileIsHeldAsDevNotArchitectAndWarnsLoudly() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr);
+        MemberRegistry members = architectRegistry();
+        sessions.setMemberLifecycle(bindFailureAfterReservation(members));
         LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
         ch.qos.logback.classic.Logger registryLog = (ch.qos.logback.classic.Logger)
                 LoggerFactory.getLogger(MemberRegistry.class);
@@ -356,35 +370,75 @@ class SessionManagerTest {
         registryLog.addAppender(appender);
         registryLog.setLevel(Level.WARN);
         try {
-            FakeHerdr herdr = new FakeHerdr();
-            SessionManager sessions = sessionManager(herdr);
-            MemberRegistry members = new MemberRegistry(
-                    new FleetConfig.Fleet(Map.of(), Map.of("opus", new FleetConfig.Slot("ltms-local")),
-                            Map.of(), Map.of(), null));
-            assertTrue(members.bind("architect:opus", "term_already_bound"),
-                    "precondition: occupy the sole architect slot before the real spawn under test");
-            sessions.setMemberLifecycle(members);
-
             MemberSession session = sessions.acquire("ltms-local", MemberRole.ARCHITECT, null,
                     "/caller", "term_primary", null);
 
-            assertEquals(MemberRole.DEV, session.role(),
-                    "the slot is taken, so this session must be held as a plain member, never a lie");
-            assertEquals("dev", SessionManager.rosterView(session, null).get("role"),
-                    "the roster must report what this session actually holds, not what it asked for");
-
+            assertEquals(MemberRole.DEV, session.role(), "a failed reservation bind must use the fallback");
             String warn = appender.list.stream()
                     .filter(e -> e.getLevel().equals(Level.WARN))
                     .map(ILoggingEvent::getFormattedMessage)
                     .findFirst()
                     .orElse("no slot-exhaustion WARN logged");
-            assertTrue(warn.contains("ltms-local"), "the log names the profile: " + warn);
-            assertTrue(warn.contains(session.terminalId()), "the log names the terminal: " + warn);
+            assertTrue(warn.contains("ltms-local"), "the WARN names the profile: " + warn);
+            assertTrue(warn.contains(session.terminalId()), "the WARN names the terminal: " + warn);
         } finally {
             registryLog.detachAppender(appender);
         }
     }
 
+    @Test
+    void reservedArchitectSlotBindsTheLaunchedMember() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr);
+        sessions.setMemberLifecycle(architectRegistry());
+
+        MemberSession session = sessions.acquire("ltms-local", MemberRole.ARCHITECT, null,
+                "/caller", "term_primary", null);
+
+        assertEquals(MemberRole.ARCHITECT, session.role());
+    }
+
+    private static MemberRegistry architectRegistry() {
+        return new MemberRegistry(new FleetConfig.Fleet(Map.of(), Map.of("opus", new FleetConfig.Slot("ltms-local")),
+                Map.of(), Map.of(), null));
+    }
+
+    private static MemberLifecycle bindFailureAfterReservation(MemberRegistry members) {
+        return new MemberLifecycle() {
+            @Override
+            public MemberRole acquired(MemberRole role, String profile, String terminal) {
+                return members.acquired(role, profile, terminal);
+            }
+
+            @Override
+            public void released(String terminal) {
+                members.released(terminal);
+            }
+
+            @Override
+            public void requireSlotFor(MemberRole role, String profile) {
+                members.requireSlotFor(role, profile);
+            }
+
+            @Override
+            public SlotReservation reserve(MemberRole role, String profile) {
+                return members.reserve(role, profile);
+            }
+
+            @Override
+            public boolean bind(SlotReservation reservation, String terminal) {
+                members.release(reservation);
+                assertTrue(members.bind(reservation.slot(), "term_racer"), "the racer takes the released slot");
+                return false;
+            }
+
+            @Override
+            public void release(SlotReservation reservation) {
+                members.release(reservation);
+            }
+        };
+    }
+
     @Test
     void rosterReflectsAcquiredMinusReleased() {
         FakeHerdr herdr = new FakeHerdr();
@@ -651,6 +705,32 @@ class SessionManagerTest {
                 "no session is registered when spawn times out (roster empty)");
     }
 
+    @Test
+    void failedArchitectLaunchReleasesItsReservationForTheNextLaunch() {
+        FakeHerdr herdr = new FakeHerdr();
+        herdr.agentStatus("unknown");
+        long[] clock = {0};
+        FleetConfig.Profile cfg = new FleetConfig.Profile(
+                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
+                List.of("ccs", "ltms-local"), "tab", "fleetd-workers",
+                "worker: {profile} #{n}", null, null, null);
+        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(
+                new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null,
+                1, () -> clock[0], () -> clock[0] += 10);
+        SessionManager sessions = new SessionManager(workers, new GitWorktrees(), () -> 0L, 0);
+        sessions.setMemberLifecycle(architectRegistry());
+
+        assertThrows(PeerUnreachableException.class, () -> sessions.acquire("ltms-local", MemberRole.ARCHITECT,
+                null, "/caller", "term_primary", null));
+
+        herdr.agentStatus("idle");
+        MemberSession retry = sessions.acquire("ltms-local", MemberRole.ARCHITECT, null,
+                "/caller", "term_primary", null);
+        assertEquals(MemberRole.ARCHITECT, retry.role(),
+                "the failed launch returned its reservation instead of silently shrinking the slot pool");
+    }
+
     // --- CB-516: release must notify, so a blocked send can be failed --------------------------
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/session/WorktreeSessionManagerTest.java

@@ -95,10 +95,9 @@ class WorktreeSessionManagerTest {
                 null, "/caller/proj", null, null);
         assertEquals("architect:architect", members.slotForTerminal(replacement.terminalId()));
 
-        MemberSession overflow = sessions.acquire("ltms-local", MemberRole.ARCHITECT,
-                null, "/caller/proj", null, null);
-        assertNull(members.slotForTerminal(overflow.terminalId()),
-                "a full slot pool must not stop the architect spawn");
+        assertThrows(IllegalArgumentException.class, () -> sessions.acquire("ltms-local", MemberRole.ARCHITECT,
+                null, "/caller/proj", null, null),
+                "a full slot pool must stop the spawn before it can receive an architect charter");
     }
 
     @Test