fleetd #249 : withhold agentSessionId for a non-provisioned opencode cwd

OpenCodeSessionDiscovery.sessionIdForDirectory keys on the worker's cwd, which is reliable only when fleetd provisioned a unique git worktree for that member. Without one (the default no-worktree spawn), the cwd is shared with other sessions, and "most recently updated row for this directory" can pick a stranger's session — fleet_list would then hand a lead an agentSessionId that resumes someone else's conversation. Move isProvisionedWorktree from ClaudeCodeLauncher to the shared HerdrPeerLauncher base (both adapters need it now). OpenCodeLauncher.spawn now refuses a resumeSessionId spawn outright when the target cwd is not a provisioned worktree (fleetd can never verify or re-report that identity), and SessionAwareHandle.agentSessionId() withholds the id — returns null rather than guessing — for any member spawned without one, resumed or not. Corrected fleet_list/fleet_spawn's tool descriptions, which previously implied agentSessionId is always a safe resume handle.
fleetd #201 : the coverage line must name the key its caller actually means
2026-09-03 12:51:56 +07:00 · 2026-09-03 12:29:27 +07:00 · 2026-09-03 12:22:32 +07:00
8 changed files with 249 additions and 73 deletions
@@ -351,7 +351,8 @@ public final class Fleetd {
                .map(session -> exhaustedPatternsByProfile.get(session.profile()))
                .orElse(null);
        log.info("backend-exhausted classification (CB-578 stage A): {}",
-                CompletionResolver.coverage(cfg.profiles().keySet(), exhaustedPatternsByProfile.keySet()));
+                CompletionResolver.coverage("exhaustedPattern", cfg.profiles().keySet(),
+                        exhaustedPatternsByProfile.keySet()));
        // fleetd #201 Unit 5: classify a completion-fallback scrape that matches a profile's
        // configured backend-error refusal (a credential outage, a provider 5xx) as a backend error
        // rather than handing it back as a real answer. Compiled once at startup, keyed by profile
@@ -371,7 +372,8 @@ public final class Fleetd {
        BackendErrorPatternLookup backendErrorPatterns = backendErrorPatternLookup(sessions::roster,
                errorPatternsByProfile);
        log.info("backend-error classification (fleetd #201 Unit 5): {}",
-                CompletionResolver.coverage(cfg.profiles().keySet(), errorPatternsByProfile.keySet()));
+                CompletionResolver.coverage("errorPattern", cfg.profiles().keySet(),
+                        errorPatternsByProfile.keySet()));
        // CB-578 stage B: on a classification that actually wins, quarantine the exhausted profile's
        // CREDENTIAL — not the profile name — so a profile sharing that credential (e.g. two models
        // on one OpenAI account) is refused too, not just the one that happened to report it. Reads
@@ -620,9 +620,9 @@ public final class CompletionResolver implements TurnListener {
     * @param allProfiles        every configured profile name
     * @param configuredProfiles the subset of {@code allProfiles} that carry an exhausted pattern
     */
-    public static String coverage(Set<String> allProfiles, Set<String> configuredProfiles) {
+    public static String coverage(String patternKey, Set<String> allProfiles, Set<String> configuredProfiles) {
        if (configuredProfiles.isEmpty()) {
-            return "off (no profile has an exhaustedPattern configured; profiles: " + sorted(allProfiles) + ")";
+            return "off (no profile has an " + patternKey + " configured; profiles: " + sorted(allProfiles) + ")";
        }
        Set<String> unconfigured = new TreeSet<>(allProfiles);
        unconfigured.removeAll(configuredProfiles);
@@ -1253,7 +1253,11 @@ public final class FleetMcp {
                        + "worktree:<ticket-slug> to provision an isolated git worktree. Pass resumeSessionId "
                        + "to relaunch onto a prior conversation instead of starting cold — this requires an "
                        + "explicit profile whose backend supports it (fleet_list shows agentSessionId for "
-                        + "resumable members), and is refused otherwise rather than silently starting fresh. "
+                        + "resumable members; it is absent for a member fleetd cannot reliably re-identify, "
+                        + "e.g. an opencode member spawned without a worktree), and is refused otherwise "
+                        + "rather than silently starting fresh. For an opencode profile, resumeSessionId "
+                        + "itself also requires worktree:true/<slug> on THIS spawn — without one fleetd can "
+                        + "never re-verify which conversation it actually resumed (fleetd #249). "
                        + "sessionName gives the member a display name in its own UI when the backend supports "
                        + "one. Returns the member's sessionId (use with fleet_send) and paneId (use with "
                        + "fleet_stop).",
@@ -1264,7 +1268,7 @@ public final class FleetMcp {
                        "worktree", Map.of("type", "string", "description", "'true' or a ticket slug — requests an isolated git worktree"),
                        "ticket", stringProp("Ticket slug when worktree:true"),
                        "sessionName", stringProp("Logical display name for the member's own session, when its backend supports one"),
-                        "resumeSessionId", stringProp("A prior member's agentSessionId (from fleet_list) to resume — requires an explicit profile that supports it")),
+                        "resumeSessionId", stringProp("A prior member's agentSessionId (from fleet_list) to resume — requires an explicit profile that supports it, and (for opencode) a worktree on this spawn too")),
                        List.of()));
    }

@@ -1285,9 +1289,14 @@ public final class FleetMcp {
                        + "discover a peer lead without being told its address. 'members' are the "
                        + "sessions delegated to — each with sessionId, paneId, role (architect/dev/"
                        + "reviewer), profile (the backend it runs on), state, optional "
-                        + "worktree/branch/owner/agentSessionId (the id to pass as fleet_spawn's "
-                        + "resumeSessionId to relaunch onto that same conversation, when the backend "
-                        + "supports it), and live herdr status. An empty 'members' "
+                        + "worktree/branch/owner/agentSessionId, and live herdr status. agentSessionId, "
+                        + "when present, is the id to pass as fleet_spawn's resumeSessionId to relaunch "
+                        + "onto that same conversation. It is ABSENT — not a guess — for a member fleetd "
+                        + "cannot reliably re-identify: some backends (e.g. opencode) resolve it from the "
+                        + "member's working directory, which only uniquely identifies a member when it "
+                        + "was spawned into its own fleetd-provisioned worktree (worktree:true/<slug>); a "
+                        + "member spawned without one shares its directory with others and never reports "
+                        + "an id, however long it runs (fleetd #249). An empty 'members' "
                        + "means no members are spawned; it says nothing about peers. When capacity "
                        + "facts are configured, a 'capacity' row per profile also reports free: 0 for "
                        + "a quarantined profile's credential (see fleet_profiles), whatever its "
@@ -505,7 +505,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * peer that starts without the seed still starts; it just may hit the dialog fleetd #149
     * describes.
     *
-     * <p><b>Gated to a provisioned worktree</b> ({@link #isProvisionedWorktree}) — see that
+     * <p><b>Gated to a provisioned worktree</b> ({@link HerdrPeerLauncher#isProvisionedWorktree}) — see that
     * method's javadoc for the incident that made this gate mandatory, not optional: this must
     * never run against a real checkout or an un-configured fallback cwd, only the exact
     * always-fresh-directory population fleetd #149 describes.
@@ -516,7 +516,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * sibling-temp-file + {@code ATOMIC_MOVE}, never a truncate-in-place) so a crash mid-write or a
     * concurrent reader never observes a half-written file, and through {@link #TRUST_JSON_LOCK} so
     * two concurrent spawns' entries both survive instead of the second write silently discarding
-     * the first. Both exist because of a real incident: see {@link #isProvisionedWorktree}'s javadoc
+     * the first. Both exist because of a real incident: see {@link HerdrPeerLauncher#isProvisionedWorktree}'s javadoc
     * and {@link #writeAtomically}'s javadoc.
     *
     * @param configDir the profile's {@code CLAUDE_CONFIG_DIR} ({@code cfg.configDir()}), or
@@ -578,7 +578,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * <p><b>fleetd #149 incident.</b> The original implementation used
     * {@code Files.writeString(target, content)} directly, which truncates {@code target} in place
     * before writing the replacement bytes. Combined with an ungated {@code cwd} (see
-     * {@link #isProvisionedWorktree}'s javadoc), a mutation-testing run hit that truncation window
+     * {@link HerdrPeerLauncher#isProvisionedWorktree}'s javadoc), a mutation-testing run hit that truncation window
     * against the operator's real {@code ~/.claude.json} and left it at 178 bytes. The gate closes
     * <em>which file</em> this can ever target; this closes <em>how</em> the target is written, so
     * that even a legitimate write against a real, live, concurrently-read {@code .claude.json}
@@ -628,32 +628,6 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
        }
    }

-    /**
-     * Whether {@code cwd} is a fleetd-provisioned git worktree — signalled the same way
-     * {@link #writeIdeOverlay} already gates on: a {@code .git} that is a <strong>regular
-     * file</strong> holding a {@code gitdir:} pointer, as opposed to a real checkout's {@code .git}
-     * <strong>directory</strong>. {@code null}/blank never qualifies.
-     *
-     * <p>Shared by every write that must land only in a worktree fleetd itself created for a
-     * member — never in a real checkout, an arbitrary configured directory, or (see the incident
-     * below) the daemon's own fallback cwd.
-     *
-     * <p><b>fleetd #149 incident.</b> {@link #seedTrustDialog} originally ran unconditionally on
-     * any non-blank {@code cwd}. Most of this launcher's OWN tests spawn a profile with no
-     * {@code cwd} configured, so the base class's {@code resolveCwd} falls through to the real
-     * {@code user.dir} — and with no {@code configDir} either (also the common case in this
-     * file's fixtures), the seed's target falls through the same way to the real
-     * {@code ~/.claude.json}. Running this repo's own test suite corrupted the operator's actual
-     * config file (it shrank from ~72 KB to a single seeded entry) the first time a mutation
-     * happened to make the write non-additive. Gating both cwd-targeted writes on "this is a
-     * worktree fleetd provisioned" — exactly the population fleetd #149 describes
-     * ({@code worktree: true} always lands in a brand-new directory) — makes that class of write
-     * impossible against a real checkout or an untouched fallback cwd, in production or in tests.
-     */
-    private static boolean isProvisionedWorktree(String cwd) {
-        return cwd != null && !cwd.isBlank() && Files.isRegularFile(Path.of(cwd, ".git"));
-    }
-
    /** {@code s}, or {@code null} when {@code s} is null/blank — the charter-presence test used above. */
    private static String nonBlank(String s) {
        return (s == null || s.isBlank()) ? null : s;
@@ -358,6 +358,42 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        return Files.isRegularFile(candidate) ? candidate : null;
    }

+    /**
+     * Whether {@code cwd} is a fleetd-provisioned git worktree — signalled the same way
+     * {@code ClaudeCodeLauncher#writeIdeOverlay} already gates on: a {@code .git} that is a
+     * <strong>regular file</strong> holding a {@code gitdir:} pointer, as opposed to a real
+     * checkout's {@code .git} <strong>directory</strong>. {@code null}/blank never qualifies.
+     *
+     * <p>Shared by every write (and, since fleetd #249, every identity read) that must land only
+     * in a worktree fleetd itself created for a member — never in a real checkout, an arbitrary
+     * configured directory, or (see the incident below) the daemon's own fallback cwd. Package-
+     * private (not {@code protected}) on purpose: {@link ClaudeCodeLauncher} and
+     * {@link OpenCodeLauncher} both call it, and same-package visibility is enough — no subclass
+     * outside this package needs it.
+     *
+     * <p><b>fleetd #149 incident.</b> {@code ClaudeCodeLauncher#seedTrustDialog} originally ran
+     * unconditionally on any non-blank {@code cwd}. Most of that launcher's OWN tests spawn a
+     * profile with no {@code cwd} configured, so the base class's {@code resolveCwd} falls
+     * through to the real {@code user.dir} — and with no {@code configDir} either (also the
+     * common case in that file's fixtures), the seed's target falls through the same way to the
+     * real {@code ~/.claude.json}. Running this repo's own test suite corrupted the operator's
+     * actual config file (it shrank from ~72 KB to a single seeded entry) the first time a
+     * mutation happened to make the write non-additive. Gating both cwd-targeted writes on "this
+     * is a worktree fleetd provisioned" — exactly the population fleetd #149 describes
+     * ({@code worktree: true} always lands in a brand-new directory) — makes that class of write
+     * impossible against a real checkout or an untouched fallback cwd, in production or in tests.
+     *
+     * <p><b>fleetd #249.</b> The same reasoning extends to a READ: {@code
+     * OpenCodeSessionDiscovery#sessionIdForDirectory} keys on {@code directory}, a heuristic that
+     * is only reliable when the directory is unique to this member — i.e., exactly the population
+     * this gate identifies. {@link OpenCodeLauncher} uses it to withhold {@code agentSessionId()}
+     * (report absence rather than a guess) and to refuse a {@code resumeSessionId} spawn that
+     * cannot be resolved reliably going forward.
+     */
+    static boolean isProvisionedWorktree(String cwd) {
+        return cwd != null && !cwd.isBlank() && Files.isRegularFile(Path.of(cwd, ".git"));
+    }
+
    // --- profile surface -----------------------------------------------------------------------

    /** The configured peer profile names (what {@code spawn(profile)} accepts). */
@@ -672,13 +672,29 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
    /** Add lazy on-disk session discovery to the base handle. */
    @Override
    public PeerHandle spawn(SpawnRequest req) {
+        String cwd = effectiveCwd(req);
+        // fleetd #249: refuse rather than silently resume into unverifiable territory. opencode's
+        // `-s <id>` flag itself resumes precisely — the resolved id is what fails, not the resume —
+        // but resolvedSessionId() below can never confirm (or later re-report) this handle's own
+        // identity without a fleetd-provisioned worktree (isProvisionedWorktree(cwd)), because the
+        // directory is shared and sessionIdForDirectory's "most recently updated row" heuristic can
+        // pick a sibling's session. Refusing here, before anything spawns, beats letting the member
+        // start and only then discovering fleetd can never again verify who it actually is.
+        if (req.resumeSessionId() != null && !req.resumeSessionId().isBlank()
+                && !isProvisionedWorktree(cwd)) {
+            throw new IllegalArgumentException("resumeSessionId requires a fleetd-provisioned "
+                    + "worktree for an opencode profile — without one, this member's cwd is shared "
+                    + "with other sessions, so fleetd can never reliably confirm (now or later) which "
+                    + "conversation it is actually running (fleetd #249). Pass fleet_spawn{worktree:"
+                    + "<ticket-slug>} to resume this member.");
+        }
        PeerHandle inner = super.spawn(req);
        // fleetd #175: the same profile config buildLaunch resolved for this spawn (requireProfile
        // is deterministic on req.profileName(), so re-resolving here costs a map lookup, not a
        // second decision) — SessionAwareHandle needs cfg.model() to know what THIS session should
        // be running.
        FleetConfig.Profile cfg = requireProfile(req.profileName());
-        return new SessionAwareHandle(inner, discovery, effectiveCwd(req), cfg,
+        return new SessionAwareHandle(inner, discovery, cwd, cfg,
                this::memberHerdrSocketConfigured, discoveryUnavailableWarned, exhaustionSink);
    }

@@ -718,6 +734,17 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
         * the directory right now."
         */
        private final AtomicReference<String> resolvedSessionId = new AtomicReference<>();
+        /**
+         * fleetd #249: whether {@link #cwd} is a fleetd-provisioned git worktree
+         * ({@link HerdrPeerLauncher#isProvisionedWorktree}), computed once at spawn time since
+         * {@code cwd} never changes for this handle. When {@code false} the directory is shared
+         * with other sessions (the default no-worktree spawn inherits the lead's own cwd), so
+         * {@link OpenCodeSessionDiscovery#sessionIdForDirectory}'s "most recently updated row for
+         * this directory" heuristic can and does pick another session's row — see that class's
+         * javadoc. {@link #agentSessionId()} refuses to guess in that case: it reports absent
+         * rather than a possibly-foreign id.
+         */
+        private final boolean worktreeProvisioned;

        SessionAwareHandle(PeerHandle delegate, OpenCodeSessionDiscovery discovery, String cwd,
                            FleetConfig.Profile cfg,
@@ -731,6 +758,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
            this.discoveryUnavailable = discoveryUnavailable;
            this.discoveryUnavailableWarned = discoveryUnavailableWarned;
            this.exhaustionSink = exhaustionSink;
+            this.worktreeProvisioned = isProvisionedWorktree(cwd);
        }

        @Override
@@ -760,6 +788,9 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
            // built from (see OpenCodeLauncher#defaultDiscoveryRoot's javadoc for the full
            // reasoning). Scanning fleetd's own $HOME under that config would only ever find "no
            // row" and read as "resume unsupported" — declare it unavailable instead, once, loudly.
+            // Checked before the fleetd #249 worktree gate below: this OS-user mismatch makes
+            // discovery unusable regardless of whether cwd happens to be a provisioned worktree, so
+            // it earns the one-time WARN either way.
            if (discoveryUnavailable.getAsBoolean()) {
                if (discoveryUnavailableWarned.compareAndSet(false, true)) {
                    log.warn("opencode session discovery unavailable: memberHerdrSocket is "
@@ -771,6 +802,16 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                }
                return null;
            }
+            // fleetd #249: cwd is shared with other sessions unless fleetd itself provisioned this
+            // worktree, and sessionIdForDirectory's directory-keyed heuristic cannot tell this
+            // member's row apart from a sibling's in that case (measured: a three-day-old row from
+            // a different profile). Refuse to guess — absent is the honest answer, and it is what
+            // this codebase already returns elsewhere for absent evidence (fleetd #175's UNKNOWN).
+            // No WARN here: unlike discoveryUnavailable above, this is the ordinary, expected shape
+            // of the large majority of spawns (no worktree requested), not a configuration gap.
+            if (!worktreeProvisioned) {
+                return null;
+            }
            // fleetd #234: once resolved, stay resolved. Re-deriving from `directory` on every call
            // would let this handle's identity drift to a sibling session that later shares the
            // same cwd and writes a newer row — see resolvedSessionId's javadoc.
@@ -768,19 +768,37 @@ class CompletionResolverTest {
    @Test
    void coverageIsOffWhenNoProfileHasAPatternConfigured() {
        assertEquals("off (no profile has an exhaustedPattern configured; profiles: [terra])",
-                CompletionResolver.coverage(Set.of("terra"), Set.of()));
+                CompletionResolver.coverage("exhaustedPattern", Set.of("terra"), Set.of()));
    }

    @Test
    void coverageIsFullWhenEveryProfileHasAPatternConfigured() {
        assertEquals("full (all profiles configured: [gx10, terra])",
-                CompletionResolver.coverage(Set.of("terra", "gx10"), Set.of("terra", "gx10")));
+                CompletionResolver.coverage("exhaustedPattern", Set.of("terra", "gx10"), Set.of("terra", "gx10")));
    }

    @Test
    void coverageIsPartialAndNamesWhichProfilesAreConfigured() {
        assertEquals("partial (configured: [terra]; not configured: [gx10])",
-                CompletionResolver.coverage(Set.of("terra", "gx10"), Set.of("terra")));
+                CompletionResolver.coverage("exhaustedPattern", Set.of("terra", "gx10"), Set.of("terra")));
+    }
+
+    /**
+     * Found live on 2026-09-03, reading a real boot log rather than a test. {@code coverage} is
+     * shared by two call sites — CB-578's {@code exhaustedPattern} line and fleetd#201 Unit 5's
+     * {@code errorPattern} line — but its "off" branch hard-coded the word {@code exhaustedPattern}.
+     * So a daemon with no {@code errorPattern} anywhere printed "no profile has an exhaustedPattern
+     * configured" directly beneath a line reporting that two profiles DO have one. Both lines were
+     * individually defensible and together they were nonsense, and the message sent an operator to
+     * set the wrong key.
+     *
+     * <p>Every earlier test here passed the exhaustion case only, so none of them could see it. This
+     * one pins that the message names the key the caller actually meant.
+     */
+    @Test
+    void coverageNamesTheConfigKeyItsCallerMeansRatherThanAlwaysSayingExhaustedPattern() {
+        assertEquals("off (no profile has an errorPattern configured; profiles: [gx10, terra])",
+                CompletionResolver.coverage("errorPattern", Set.of("terra", "gx10"), Set.of()));
    }

    // --- fleetd#201 Unit 1: target-keyed backend-error pattern + typed sink ----------------------
@@ -323,11 +323,39 @@ class OpenCodeLauncherTest {

    // --- CB-547: resume + post-hoc session discovery --------------------------------------------

+    /**
+     * Give {@code dir} the exact signature {@link HerdrPeerLauncher#isProvisionedWorktree} checks
+     * for: a {@code .git} REGULAR FILE, never a directory. Content is never parsed by that gate, so
+     * any {@code gitdir:} pointer is fine. Mirrors {@code ClaudeCodeLauncherTest}'s helper of the
+     * same shape (fleetd #249).
+     */
+    private static void markAsProvisionedWorktree(Path dir) throws IOException {
+        Files.writeString(dir.resolve(".git"), "gitdir: /tmp/not-a-real-gitdir");
+    }
+
+    /**
+     * A fresh subdirectory of {@code configRoot}, marked as a provisioned worktree (fleetd #249),
+     * for tests that predate this gate and stood in a bare {@code "/work/dir"} string as their
+     * member's cwd — a directory that never existed on disk and, post-#249, would never pass
+     * {@link HerdrPeerLauncher#isProvisionedWorktree} either. Those tests are about the model
+     * mismatch / late-resolve machinery (fleetd #175/#234/#209), not about the worktree gate
+     * itself, so they need a cwd the gate accepts without changing what each test demonstrates.
+     */
+    private static String provisionedWorkDir(Path configRoot) throws IOException {
+        Path dir = Files.createDirectories(configRoot.resolve("work-dir"));
+        markAsProvisionedWorktree(dir);
+        return dir.toString();
+    }
+
    @Test
-    void aResumeSpawnPassesTheSessionIdAsDashS(@TempDir Path root) {
+    void aResumeSpawnIntoAProvisionedWorktreePassesTheSessionIdAsDashS(@TempDir Path root,
+                                                                        @TempDir Path worktree)
+            throws Exception {
+        markAsProvisionedWorktree(worktree);
        FakeHerdr herdr = new FakeHerdr();
        service(herdr, root, opencodeCfg("google/gemini-2.5-pro", null, null))
-                .spawn(new SpawnRequest(null, null, null, null, "ses_41b79fc90ffeI9E8uZv6VprUn2"));
+                .spawn(new SpawnRequest(null, worktree.toString(), null, null,
+                        "ses_41b79fc90ffeI9E8uZv6VprUn2"));

        List<String> args = startArgs(herdr);
        int s = args.indexOf("-s");
@@ -336,6 +364,27 @@ class OpenCodeLauncherTest {
                "the resume target id follows -s");
    }

+    /**
+     * fleetd #249 acceptance criterion 3: without a fleetd-provisioned worktree, the member's cwd
+     * is shared with other sessions, so fleetd can never reliably confirm (now or later via {@link
+     * OpenCodeSessionDiscovery}) which conversation it is actually running. Refuse the spawn itself
+     * rather than silently launching opencode's {@code -s <id>} into unverifiable territory.
+     */
+    @Test
+    void aResumeSpawnWithoutAProvisionedWorktreeIsRefused(@TempDir Path root) {
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = service(herdr, root,
+                opencodeCfg("google/gemini-2.5-pro", null, null));
+
+        IllegalArgumentException e = assertThrows(IllegalArgumentException.class, () ->
+                launcher.spawn(new SpawnRequest(null, null, null, null,
+                        "ses_41b79fc90ffeI9E8uZv6VprUn2")));
+
+        assertTrue(e.getMessage().contains("worktree"), e.getMessage());
+        assertFalse(herdr.called("agent.start"),
+                "the refusal must happen before anything spawns — no pane, no process");
+    }
+
    @Test
    void aFreshSpawnCarriesNoSessionFlag(@TempDir Path root) {
        FakeHerdr herdr = new FakeHerdr();
@@ -348,25 +397,59 @@ class OpenCodeLauncherTest {

    @Test
    void theHandleDiscoversTheSessionIdForTheWorkersCwdOnlyAfterItAppears(@TempDir Path root,
-                                                                          @TempDir Path discRoot)
+                                                                          @TempDir Path discRoot,
+                                                                          @TempDir Path worktree)
            throws Exception {
+        markAsProvisionedWorktree(worktree);
        FakeHerdr herdr = new FakeHerdr();
        OpenCodeLauncher launcher = new OpenCodeLauncher(new AgentControl(herdr),
                new WorkspaceControl(herdr), Map.of("gemini", opencodeCfg(null, null, null)),
                "gemini", _ -> null, 0, System::currentTimeMillis, () -> { }, root, discRoot);

-        PeerHandle handle = launcher.spawn(new SpawnRequest(null, "/work/dir", null));
+        PeerHandle handle = launcher.spawn(new SpawnRequest(null, worktree.toString(), null));

        // opencode writes the record only when the session is first persisted — the instant the
        // pane is ready it does not exist, so agentSessionId() is null (never a spawn failure).
        assertNull(handle.agentSessionId(), "no record yet → null, not a spawn-time block");
        // Once the record appears (here: same cwd), lazy discovery resolves it — the handle's
        // session id matches its own worktree, not another's.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_resolved", "/work/dir", 1000L);
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_resolved", worktree.toString(), 1000L);
        assertEquals("ses_resolved", handle.agentSessionId(),
                "agentSessionId() re-scans and picks up a record that has since been written");
    }

+    /**
+     * fleetd #249 acceptance criterion 1, exercised through the real caller path (the handle
+     * {@code fleet_list} actually reads), not {@link OpenCodeSessionDiscovery} directly. Without a
+     * fleetd-provisioned worktree the member's cwd is shared — the default no-worktree spawn
+     * inherits the lead's own long-lived cwd — so even once a matching row appears (here:
+     * simulating another profile's session that happens to share the directory) the handle must
+     * report absence rather than guess. Measured real-world case (2026-09-03): the row it would
+     * otherwise pick was three days old and belonged to a different profile.
+     */
+    @Test
+    void theHandleNeverReportsAnIdForANonProvisionedCwdEvenAfterARowAppears(@TempDir Path root,
+                                                                             @TempDir Path discRoot)
+            throws Exception {
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = new OpenCodeLauncher(new AgentControl(herdr),
+                new WorkspaceControl(herdr), Map.of("gemini", opencodeCfg(null, null, null)),
+                "gemini", _ -> null, 0, System::currentTimeMillis, () -> { }, root, discRoot);
+        // No markAsProvisionedWorktree — this cwd has no .git file, the shared-cwd shape a
+        // no-worktree spawn (or a real checkout) actually has.
+        String sharedCwd = root.resolve("shared-cwd").toString();
+
+        PeerHandle handle = launcher.spawn(new SpawnRequest(null, sharedCwd, null));
+
+        assertNull(handle.agentSessionId(), "no record yet → null, same as the provisioned case");
+        // A row for this exact directory now appears — e.g. a sibling member, or a stale session
+        // from days earlier, sharing the same unprovisioned cwd.
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_someone_elses", sharedCwd, 1000L);
+        assertNull(handle.agentSessionId(),
+                "a non-provisioned cwd must NEVER report an id, even once a row for it exists — "
+                        + "the row could belong to any other session sharing this directory");
+    }
+
    @Test
    void foreignWorkerMatchesOpencodePrefixButNotClaude() {
        String nonce = "abc123";
@@ -920,6 +1003,7 @@ class OpenCodeLauncherTest {
    @Test
    void theRealSessionManagerLateResolvePathCatchesAModelMismatch(@TempDir Path configRoot,
                                                                     @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        FakeHerdr herdr = new FakeHerdr();
        // xf's real shape (fleetd #175): weight:80, model "opencode/nemotron-3-ultra-free", no
        // credentialId — the profile that actually escaped the fleet's accounting.
@@ -929,7 +1013,7 @@ class OpenCodeLauncherTest {
        OpenCodeLauncher launcher = serviceWithSink(herdr, configRoot, discRoot, cfg, sink);

        SessionManager sessions = new SessionManager(launcher);
-        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);

        // Real late-resolve path, driven BEFORE opencode has written its session row — same shape
        // as production the instant a pane goes ready.
@@ -940,7 +1024,7 @@ class OpenCodeLauncherTest {

        // opencode writes its row late, running gpt-5.6-sol (a PAID credential) instead of the
        // withdrawn free model the profile actually asked for — the exact fleetd #175 scenario.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");

        // Drive the SAME real late-resolve path again: sessions.get() -> resolveAgentSessionId ->
@@ -959,12 +1043,13 @@ class OpenCodeLauncherTest {
    @Test
    void aProviderPrefixedModelMatchingBothIdAndProviderIsNotAMismatch(@TempDir Path configRoot,
                                                                        @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-terra\",\"providerID\":\"openai\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -975,12 +1060,13 @@ class OpenCodeLauncherTest {
    @Test
    void aGxProviderPrefixedModelMatchingBothIdAndProviderIsNotAMismatch(@TempDir Path configRoot,
                                                                          @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("gx/deepseek-v4-flash", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -997,12 +1083,13 @@ class OpenCodeLauncherTest {
    @Test
    void aMissingProviderIdInTheEvidenceIsUnknownNotAMismatchWhenTheIdMatches(
            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-terra\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -1018,12 +1105,13 @@ class OpenCodeLauncherTest {
    @Test
    void aMissingProviderIdInTheEvidenceStillCatchesARealIdMismatch(
            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-sol\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -1042,12 +1130,13 @@ class OpenCodeLauncherTest {
    @Test
    void aBareModelWithNoProviderPrefixMatchesOnIdAloneAndIsNotAMismatch(@TempDir Path configRoot,
                                                                          @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("deepseek-v4-flash", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -1064,6 +1153,7 @@ class OpenCodeLauncherTest {
    @Test
    void aRealIdMismatchLogsAnErrorNamingBothModelsAndQuarantinesThroughTheSink(
            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(target + "|" + reason);
        FleetConfig.Profile cfg = opencodeCfg("opencode/nemotron-3-ultra-free", null, null);
@@ -1075,8 +1165,8 @@ class OpenCodeLauncherTest {
        PeerHandle handle;
        try {
            handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                    .spawn(new SpawnRequest(null, "/work/dir", null));
-            OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                    .spawn(new SpawnRequest(null, workDir, null));
+            OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                    "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
            assertEquals("ses_x", handle.agentSessionId());
        } finally {
@@ -1111,11 +1201,12 @@ class OpenCodeLauncherTest {
    @Test
    void unknownOrUnparseableModelEvidenceNeverQuarantines(@TempDir Path configRoot,
                                                             @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
+                .spawn(new SpawnRequest(null, workDir, null));

        // No row yet at all.
        assertNull(handle.agentSessionId());
@@ -1137,12 +1228,13 @@ class OpenCodeLauncherTest {
    @Test
    void aProfileWithNoConfiguredModelIsNeverCheckedForAMismatch(@TempDir Path configRoot,
                                                                  @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg(null, null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"anything-at-all\",\"providerID\":\"anyone\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -1166,21 +1258,22 @@ class OpenCodeLauncherTest {
    @Test
    void modelCheckReadsTheResolvedSessionsOwnRowNotWhateverIsNewestInTheSharedDirectory(
            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
+                .spawn(new SpawnRequest(null, workDir, null));

        // Our own session's row, correctly matching the profile's requested model.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_ours", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_ours", workDir, 1000L,
                "{\"id\":\"gpt-5.6-terra\",\"providerID\":\"openai\"}");
        assertEquals("ses_ours", handle.agentSessionId(), "resolves to our own session");
        assertTrue(exhausted.isEmpty(), "matching model → no mismatch on first resolve: " + exhausted);

        // A sibling member, spawned later into the SAME shared directory (no worktree, fleetd
        // #234's default), writes a newer row running a totally different model.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_sibling", "/work/dir", 9000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_sibling", workDir, 9000L,
                "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");

        assertEquals("ses_ours", handle.agentSessionId(),
@@ -1212,6 +1305,7 @@ class OpenCodeLauncherTest {
    @Test
    void aSpawnTimeModelMismatchActuallyQuarantinesTheCredentialThroughTheRealAcquirePath(
            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        FleetConfig.Profile cfg = opencodeCfgWithCredential(
                "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
        Map<String, FleetConfig.Profile> profiles = Map.of(cfg.profile(), cfg);
@@ -1232,14 +1326,14 @@ class OpenCodeLauncherTest {

        // The mismatching row exists BEFORE the spawn — reproducing fleetd #234's exact timing:
        // opencode's session table already carries evidence by the moment acquire() first asks.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");

        assertFalse(quarantine.isQuarantined("openai-shared"), "nothing quarantined before the spawn");

        // The real production entrypoint: acquire() builds the MemberSession by calling
        // handle.agentSessionId() BEFORE registry.put() runs.
-        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);

        assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
        assertTrue(quarantine.isQuarantined("openai-shared"),
@@ -1258,6 +1352,7 @@ class OpenCodeLauncherTest {
    @Test
    void aRosterOnlySinkSilentlyDropsTheSpawnTimeQuarantine(@TempDir Path configRoot,
                                                              @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        FleetConfig.Profile cfg = opencodeCfgWithCredential(
                "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.SECONDS.toNanos(1800));
@@ -1270,10 +1365,10 @@ class OpenCodeLauncherTest {
        OpenCodeLauncher launcher = serviceWithSink(herdr, configRoot, discRoot, cfg, rosterOnlySink);
        SessionManager sessions = new SessionManager(launcher);

-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");

-        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);

        assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
        assertFalse(quarantine.isQuarantined("openai-shared"),
@@ -1301,6 +1396,7 @@ class OpenCodeLauncherTest {
    @Test
    void theSpawnTimeQuarantineSurvivesTheFleetdStyleForwardingHop(@TempDir Path configRoot,
                                                                     @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        FleetConfig.Profile cfg = opencodeCfgWithCredential(
                "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
        Map<String, FleetConfig.Profile> profiles = Map.of(cfg.profile(), cfg);
@@ -1332,12 +1428,12 @@ class OpenCodeLauncherTest {
        };
        exhaustionSinkRef.set(realSink);

-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");

        assertFalse(quarantine.isQuarantined("openai-shared"), "nothing quarantined before the spawn");

-        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);

        assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
        assertTrue(quarantine.isQuarantined("openai-shared"),