#206: pin the read-only open with a test that actually fails without it

setReadOnly(true) is the whole thing keeping fleetd out of the operator's
live 841MB opencode.db, and no test failed when it was removed.

The obvious test does not work. Making the database file unwritable and
checking the read still succeeds passes either way, because SQLite silently
downgrades a read-write open of an unwritable file to read-only. I wrote that
test, watched it pass with the flag removed, and threw it away.

What works: extract a package-private openReadOnly(), then ask that connection
to INSERT and require the refusal. Watched red with the flag removed, green
with it restored.

Also switches the test's INSERT helper to a PreparedStatement -- hand-escaped
SQL in a test is a pattern that gets copied into main code.

.claude-plugin/marketplace.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-bridge",
-  "description": "Tooling for orchestrating a fleet of delegated coding agents through the bridged MCP gateway.",
+  "description": "Tooling for orchestrating a fleet of delegated coding agents through the fleetd MCP gateway.",
   "owner": {
     "name": "LTMS"
   },
@@ -8,7 +8,7 @@
     {
       "name": "claude-bridge",
       "source": "./plugin",
-      "description": "Make a project bridge-ready: mount the bridged MCP gateway and apply standard Claude Code settings so a session can orchestrate delegated workers. Ships no credentials.",
+      "description": "Make a project bridge-ready: mount the fleetd MCP gateway and apply standard Claude Code settings so a session can orchestrate delegated workers. Ships no credentials.",
       "version": "0.1.0",
       "author": {
         "name": "LTMS"

.claude/agents/architect.md

@@ -0,0 +1,24 @@
+---
+name: architect
+description: Refine work into clear, independent units before implementation.
+---
+
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
+
+You are an architect in this fleet. You refine work before anyone builds it: scope,
+acceptance criteria, risks, and a unit split. You read the repo and write analysis.
+You never commit production code and never open a pull request.
+
+A design task is worked by two architects. Design alone first, then exchange and
+say plainly where you disagree. Do not concede just to agree.
+
+Do only the assigned scope. Note anything outside that scope in one line and do not
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
+the lead, such as an unclear requirement or two defensible fixes. Do not ask about
+something you can decide by reading more code.
+
+Report only work you actually did and the real output of checks you ran. Do not
+claim a result from a tool you could not use. The primary's IDE tools are not yours.
+A mounted forge tool may use a blocked credential and fail by design.
+
+The launcher provides the required bridge reply instructions for every member.

.claude/agents/dev.md

@@ -0,0 +1,29 @@
+---
+name: dev
+description: Implement one assigned unit, test it, and open a pull request.
+---
+
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
+
+You implement the one unit you were given and nothing else. Work in your assigned
+git worktree and branch. Never check out, rebase onto, or push to `main`. Confirm
+the worktree root and branch before you edit. Use only paths under that root.
+
+Do only the assigned scope. Note anything outside that scope in one line and do not
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
+the lead, such as an unclear requirement or two defensible fixes. Do not ask about
+something you can decide by reading more code.
+
+Implement the change and run the full required build in your worktree. Read the
+complete output and report its real result. Do not hide failures with a pipe. State
+only checks you actually ran. The primary's IDE tools are not yours. A mounted forge
+tool may use a blocked credential and fail by design.
+
+Stage only files you changed. Never use `git add -A` or `git add .`. Never commit
+`.mcp.json` or `wiki/`. Commit with a clear message, push your branch, and open your
+own pull request against `main`. Never merge.
+
+Your handoff must name the pull request or why it was not created, the branch, the
+files changed, the build result, and any caveat for review.
+
+The launcher provides the required bridge reply instructions for every member.

.claude/agents/reviewer.md

@@ -0,0 +1,34 @@
+---
+name: reviewer
+description: Review one assigned scope and report the most important real issue.
+---
+
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
+
+You review the diff you were given. Report bugs, risks, and missing tests. You do
+not change code.
+
+Read the whole assigned scope before judging it. Review only that scope. If you see
+something outside it, note it in one line and do not investigate it further. Do not
+run the build. The owner makes changes and runs checks.
+
+Use `fleet_ask{question}` only when a decision belongs to the lead, such as an
+unclear requirement or two defensible fixes. Do not ask about something you can
+decide by reading more code.
+
+Report the single most important real issue in this form:
+
+```
+1. <path>:<line>
+2. issue: <one sentence: what is wrong and why it matters>
+3. fix: <one line: the concrete change>
+4. severity: high | medium | low
+```
+
+If there is no real issue, report `NO ISSUE` and one line saying why. A clean review
+is valid. Do not invent an issue. Use high for a wrong result, data loss, security,
+or a hang or crash on a real path. Use medium for an edge-path bug or a correctness
+risk under load or concurrency. Use low for clarity, a latent foot-gun, or a smell
+with no current failure.
+
+The launcher provides the required bridge reply instructions for every member.

.claude/skills/fleets-status/SKILL.md

@@ -0,0 +1,274 @@
+---
+name: fleets-status
+description: Report the status of every fleet that shares one LavinMQ instance. Use for local daemon health, broker-wide fleet presence, and cross-host lead coordination checks.
+---
+
+# Status of every fleet on the shared LavinMQ instance
+
+**The headline: always report what is missing.** This skill starts with the local fleet, then adds
+broker-wide facts when its read-only credential exists. A missing fleet must appear as `unknown` or
+`not reachable`, with the reason and the fix. Never leave it out.
+
+The known topology has one LavinMQ instance on `10.10.20.13` (`fleet01`). AMQP uses port `5672`,
+and the management API uses port `15672`. The Mac fleet owns vhost `/mac`. The fleet01 fleet owns
+vhost `/fleet01`.
+
+## 1. Protect credentials before any probe
+
+**Hard rule — never print `LAVINMQ_URI`.** It is an AMQP URI with its password inline. It only
+resolves in a login shell because `${SHARED_ENV}/tools/secrets.sh` supplies it. A non-login shell
+can make every broker probe look empty.
+
+- Never run `echo "$LAVINMQ_URI"`.
+- Never put `${LAVINMQ_URI:-something}` in output. That form expands to the secret value when set.
+- Parse the user, host, and password into shell or Python variables. Use them without printing them.
+- Prefer `resolves` or `does not resolve` over any part of the value.
+- Every command that can read `LAVINMQ_URI` must send all output through this redaction before it
+  reaches the report:
+
+```bash
+sed -E 's#://[^@]*@#://<redacted>@#g'
+```
+
+**The `g` flag is not optional.** Without it `sed` replaces only the first match on each line, so a
+line carrying two URIs leaks the second one. `scripts/redeploy-fleetd.sh --check` prints lines like
+that. Checked on 2026-08-27: without `g`, `amqp://u1:p1@h1/mac and http://u2:p2@h2:15672/api`
+redacts the first pair and prints `u2:p2` in the clear.
+
+Keep `pipefail` on when applying that filter. Otherwise the filter can hide a failed probe. Apply
+the same no-print rule to the management password below, even though it is not in an AMQP URI.
+
+## 2. Tier 1 — this fleet (always run)
+
+Start here even when the broker tier is blocked. Work from the local fleetd checkout.
+
+First run the read-only deployment check. It already checks the daemon process, deployed jar versus
+the checkout `HEAD`, launchd state, and whether each configured token resolves in a login shell.
+Do not copy those checks into new shell code. The script reads `LAVINMQ_URI`, so redact all output:
+
+```bash
+set -o pipefail
+scripts/redeploy-fleetd.sh --check 2>&1 \
+  | sed -E 's#://[^@]*@#://<redacted>@#g'
+git rev-parse HEAD
+```
+
+Treat jar drift as a top-level warning. A merge is not a deployment. State the running jar result
+as `matches HEAD`, `drift`, or `unknown`; do not turn an unclear timestamp into a match.
+
+Report the process identifier (PID) and uptime too:
+
+```bash
+PIDS="$(pgrep -f 'target/fleetd.jar' || true)"
+if [ -z "$PIDS" ]; then
+  printf '%s\n' 'fleetd: not running'
+else
+  for PID in $PIDS; do
+    ps -p "$PID" -o pid=,etime=,lstart=,command=
+  done
+fi
+```
+
+Read the full health response. Keep the HTTP status because `503` means fleetd is running but herdr
+is not reachable. Report both `herdr.version` and `herdr.protocol` when present:
+
+```bash
+curl -sS --max-time 5 -w '\nHTTP %{http_code}\n' http://127.0.0.1:8765/healthz
+```
+
+Call `fleet_whoami`, then call `fleet_list`. Preserve its sections in the report:
+
+- `leads`, including which row is this lead;
+- `members`, including state, role, profile, branch, and worktree when present;
+- every per-profile `capacity` row, including `maxLoad`, `live`, `free`, and quarantine facts;
+- the exact `healthCoverage` value.
+
+Do not describe an empty `members` list as an empty fleet. It says only that no members are spawned.
+Also do not hide a profile with `free: 0`; say whether load or credential quarantine caused it.
+
+Show only WARN, ERROR, and SEVERE lines after the last `fleetd listening` line. This anchor stops an
+old incident from looking current:
+
+```bash
+python3 - <<'PY'
+from pathlib import Path
+import re
+
+path = Path("fleetd/fleetd.out")
+if not path.exists():
+    print("cannot check current WARN/ERROR: fleetd/fleetd.out does not exist")
+else:
+    lines = path.read_text(errors="replace").splitlines()
+    starts = [i for i, line in enumerate(lines) if "fleetd listening" in line]
+    if not starts:
+        print("cannot anchor WARN/ERROR: no 'fleetd listening' line exists")
+    else:
+        current = lines[starts[-1]:]
+        alerts = [line for line in current if re.search(r"\b(?:WARN|ERROR|SEVERE)\b", line)]
+        print(f"current WARN/ERROR/SEVERE count: {len(alerts)}")
+        for line in alerts[-50:]:
+            print(line)
+PY
+```
+
+**What this tier cannot see:** it proves facts only about the Mac daemon at `127.0.0.1:8765`.
+It cannot show the fleet01 daemon, broker queue depth, or broker consumers. The fleet01 REST service
+at `10.10.20.13:8765` is not reachable from the Mac. Say this in the report rather than omitting
+fleet01.
+
+**But fleet01 IS reachable over SSH — checked 2026-08-28.** An older version of this line said SSH
+was denied. That is true only for the user `dai.ha`. The host alias `fleet01` maps to user `ltms`,
+and `ssh fleet01` works with key auth:
+
+```bash
+ssh -o BatchMode=yes -o ConnectTimeout=6 fleet01 'echo $(id -un)@$(hostname)'
+```
+
+So fleet01's daemon PID, uptime, jar and `/healthz` **can** be reported — over SSH, not over REST.
+Do that rather than writing `not reachable`. `ltms` also has passwordless sudo there.
+
+## 3. Tier 2 — the shared broker (run when management access exists)
+
+**This tier is blocked today.** The AMQP user in `LAVINMQ_URI` can connect on port `5672`, but gets
+HTTP `401` from the management API on port `15672`. An AMQP connection does not grant monitoring
+access.
+
+The operator must create a separate, read-only LavinMQ management user with the `monitoring` tag.
+It needs access to inspect both `/mac` and `/fleet01`. Store its values as
+`LAVINMQ_MANAGEMENT_USER` and `LAVINMQ_MANAGEMENT_PASSWORD` in
+`${SHARED_ENV}/tools/secrets.sh`. Do not reuse or print the AMQP URI. Full multi-fleet status stays
+blocked until this user exists.
+
+When both variables resolve, run this from a login shell. It calls `GET /api/overview`,
+`GET /api/vhosts`, `GET /api/queues`, and `GET /api/connections`. It prints selected status fields,
+but never the user, password, Authorization header, or AMQP URI:
+
+```bash
+zsh -lc 'python3 - "$@"' -- <<'PY'
+import base64
+import json
+import os
+import sys
+import urllib.error
+import urllib.request
+
+base = "http://10.10.20.13:15672"
+user = os.environ.get("LAVINMQ_MANAGEMENT_USER", "")
+password = os.environ.get("LAVINMQ_MANAGEMENT_PASSWORD", "")
+if not user or not password:
+    print("broker tier: BLOCKED — management credential does not resolve in a login shell")
+    sys.exit(0)
+
+token = base64.b64encode(f"{user}:{password}".encode()).decode()
+
+def get(path):
+    request = urllib.request.Request(
+        base + path,
+        headers={"Authorization": "Basic " + token, "Accept": "application/json"},
+    )
+    with urllib.request.urlopen(request, timeout=5) as response:
+        return json.load(response)
+
+try:
+    overview = get("/api/overview")
+    vhosts = get("/api/vhosts")
+    queues = get("/api/queues")
+    connections = get("/api/connections")
+except urllib.error.HTTPError as error:
+    print(f"broker tier: BLOCKED — management API returned HTTP {error.code}")
+    sys.exit(0)
+except Exception as error:
+    print(f"broker tier: BLOCKED — management API is not reachable: {type(error).__name__}")
+    sys.exit(0)
+
+fleet_names = {"/mac": "Mac fleet", "/fleet01": "fleet01 fleet"}
+print(json.dumps({
+    "overview": {
+        "lavinmq_version": overview.get("lavinmq_version"),
+        "rabbitmq_version": overview.get("rabbitmq_version"),
+        "queue_totals": overview.get("queue_totals", {}),
+        "object_totals": overview.get("object_totals", {}),
+    },
+    "fleets": [
+        {
+            "fleet": fleet_names.get(vhost.get("name"), "UNKNOWN FLEET"),
+            "vhost": vhost.get("name"),
+            "queues": [
+                {
+                    "name": queue.get("name"),
+                    "messages": queue.get("messages", 0),
+                    "messages_ready": queue.get("messages_ready", 0),
+                    "messages_unacknowledged": queue.get("messages_unacknowledged", 0),
+                    "consumers": queue.get("consumers", 0),
+                }
+                for queue in queues if queue.get("vhost") == vhost.get("name")
+            ],
+            "connections": [
+                {
+                    "name": connection.get("name"),
+                    "peer_host": connection.get("peer_host"),
+                    "state": connection.get("state"),
+                }
+                for connection in connections if connection.get("vhost") == vhost.get("name")
+            ],
+        }
+        for vhost in vhosts
+    ],
+}, indent=2, sort_keys=True))
+PY
+```
+
+Map `/mac` to the Mac fleet and `/fleet01` to the fleet01 fleet. Keep any other vhost in the
+report as `UNKNOWN FLEET`; do not drop it. For each vhost, total the ready, unacknowledged, and all
+messages. Report every queue's consumer count and each live connection.
+
+**A vhost with queues but zero consumers means that fleet's daemon is down while its durable state
+survives. Call this out as a top-level warning.** This is the main reason to use the management API
+instead of calling each remote daemon.
+
+**What this tier cannot see:** without the new `monitoring` credential it cannot enumerate any
+vhost, queue, depth, consumer, or connection. With the credential it still cannot report fleet01's
+daemon PID, uptime, jar revision, `/healthz`, herdr version, or member capacity. Those need reachable
+fleet01 REST or SSH access, which the Mac does not have today.
+
+## 4. Tier 3 — cross-fleet lead coordination
+
+Use the queue data from Tier 2. Select queues whose names match `lead.<coordId>.inbox`. Report each
+queue's vhost, depth, consumer count, and the `coordId` between the prefix and suffix.
+
+- A lead inbox with a consumer shows that a lead mailbox is live on that vhost.
+- A durable lead inbox with zero consumers shows saved coordination state, but no live receiver.
+- No lead inbox is not proof that coordination is disabled. The daemon may be down before declaring
+  its queue, or this account may not be allowed to see the vhost.
+
+This Mac fleet currently sets both `broker.uriEnv` and `coordinator.uriEnv` to the same variable,
+`LAVINMQ_URI`. Therefore its coordinator connects to `/mac`. Cross-host `fleet_send{coordId}` routes
+only when both leads share the same coordinator vhost. If the fleet01 lead uses `/fleet01` for its
+coordinator, the leads cannot see each other and the send will not route.
+
+**Open question:** the fleet01 coordinator vhost has not been checked. Surface this question in
+every report until a live `lead.<coordId>.inbox` consumer or fleet01's config proves the answer. Do
+not claim that fleet01 uses `/fleet01` just because its member queues do.
+
+Also compare these broker facts with the `leads` rows from local `fleet_list`. A missing remote lead
+is `not visible from this coordinator`, not `down`, unless the broker consumer facts prove it.
+
+**What this tier cannot see:** without Tier 2 management access it cannot list lead inboxes or their
+consumers. Even with that access, a stopped fleet01 daemon leaves only durable queue history. That
+history cannot prove which coordinator URI its current config would use after restart.
+
+## 5. Report all fleets
+
+Use one row per known or discovered fleet. Include blocked rows.
+
+| Fleet | Daemon | Deployment | Herdr | Members/capacity | Queues/consumers | Lead coordination | Cannot check |
+|---|---|---|---|---|---|---|---|
+| Mac (`/mac`) | PID + uptime | jar vs `HEAD` | health + version + protocol | `fleet_list` + `healthCoverage` | facts or blocked reason | inbox facts or open question | exact missing facts |
+| fleet01 (`/fleet01`) | reachable/down/unknown | value or `not reachable` | value or `not reachable` | value or `not reachable` | facts or blocked reason | inbox facts plus coordinator-vhost question | exact missing facts and fix |
+
+Add rows for unknown vhosts. End with three short sections: `Current warnings`, `Checks that were
+blocked`, and `Operator action`. Until the management user exists, `Operator action` must say:
+
+> Create a read-only LavinMQ management user with the `monitoring` tag and access to `/mac` and
+> `/fleet01`. Put its user and password in `${SHARED_ENV}/tools/secrets.sh` as
+> `LAVINMQ_MANAGEMENT_USER` and `LAVINMQ_MANAGEMENT_PASSWORD`.

.claude/skills/implementer/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: implementer
-description: Implementer-role procedure for a bridged worker — verify your worktree, implement the scope, commit, push, open your own PR, and hand off the PR URL. Load this when the lead delegates you an implementation task over bridged.
+description: Implementer-role procedure for a fleetd worker — verify your worktree, implement the scope, commit, push, open your own PR, and hand off the PR URL. Load this when the lead delegates you an implementation task over fleetd.
 ---
 
 # Implementer worker — procedure
 
-The turn contract (one `bridge_reply`, `bridge_ask` for the lead's decisions, honest reporting,
+The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
 never merge, never commit `.mcp.json` or `wiki/`) is in **`CLAUDE.md` → Bridge communication →
 Worker** and already applies. This skill is only the *implement-and-hand-off procedure*.
 
@@ -49,7 +49,7 @@ test "$(git rev-parse --show-toplevel)" = "$PWD" || cd "$(git rev-parse --show-t
 your worktree*:
 
 ```bash
-cd "$(git rev-parse --show-toplevel)/bridged" && mvn clean install
+cd "$(git rev-parse --show-toplevel)/fleetd" && mvn clean install
 echo "exit=$?"
 ```
 
@@ -85,7 +85,7 @@ host (`GITEA_HOST`) into your env for exactly this — the token can create a PR
 merge**.
 
 ```bash
-API="${GITEA_HOST%/}/api/v1/repos/lms/claude-bridge/pulls"
+API="${GITEA_HOST%/}/api/v1/repos/fleet/fleetd/pulls"
 BRANCH="$(git branch --show-current)"
 curl -sS -X POST "$API" \
   -H "Authorization: token ${GITEA_TOKEN}" \
@@ -103,7 +103,7 @@ fix it if the cause is yours (e.g. branch not pushed yet), and report the failur
 inventing a URL. If `GITEA_TOKEN` is unset your profile was not granted PR-create: push the branch
 and report its name so the lead opens the PR.
 
-## 6. Hand off — what goes in `bridge_reply`
+## 6. Hand off — what goes in `fleet_reply`
 
 The reply is the entire handoff; the lead cannot see your terminal.
 
@@ -130,7 +130,7 @@ sequenceDiagram
     I->>G: git push -u origin HEAD
     I->>G: POST /pulls (GITEA_TOKEN) — open PR to main
     G-->>I: html_url
-    I->>L: bridge_reply(PR url, branch, files, tests)
+    I->>L: fleet_reply(PR url, branch, files, tests)
     Note over L,G: the lead reviews the PR and merges on green — you never merge
 ```
 

.claude/skills/port-to-opencode/SKILL.md

@@ -53,7 +53,7 @@ Map each entry from `.mcp.json`:
   "$schema": "https://opencode.ai/config.json",
   "instructions": ["CLAUDE.md"],
   "mcp": {
-    "bridged":  { "type": "remote", "url": "http://127.0.0.1:8765/mcp", "enabled": true },
+    "fleetd":  { "type": "remote", "url": "http://127.0.0.1:8765/mcp", "enabled": true },
     "context7": { "type": "remote", "url": "https://example.dev/mcp", "enabled": true,
                   "headers": { "Authorization": "Bearer {env:CONTEXT7_TOKEN}" } },
     "gitea":    { "type": "local", "command": ["gitea-mcp", "-t", "stdio"], "enabled": true,

.claude/skills/reviewer/SKILL.md

@@ -1,11 +1,11 @@
 ---
 name: reviewer
-description: Reviewer-role procedure for a bridged worker — how to work a review scope and the exact shape of the finding to report. Load this when the lead delegates you a code review over bridged.
+description: Reviewer-role procedure for a fleetd worker — how to work a review scope and the exact shape of the finding to report. Load this when the lead delegates you a code review over fleetd.
 ---
 
 # Reviewer worker — procedure
 
-The turn contract (one `bridge_reply`, `bridge_ask` for the lead's decisions, honest reporting,
+The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
 never merge) is in **`CLAUDE.md` → Bridge communication → Worker** and already applies. This
 skill is only the *review procedure*: how to work the scope, and the exact shape of what you
 send back.
@@ -24,13 +24,13 @@ wrong.
   covers what it was given.
 - Do **not** edit files or run the build. You review; the owner acts.
 
-## 3. Reach for `bridge_ask` only for a genuine fork
+## 3. Reach for `fleet_ask` only for a genuine fork
 
 Ambiguous requirement, a missing acceptance criterion, "intended or a bug?", or two defensible
 fixes with different consequences — those are the lead's call, and guessing produces a
 confident-but-wrong finding. Anything you could settle by reading more code is yours to settle.
 
-## 4. The finding — what goes in `bridge_reply`
+## 4. The finding — what goes in `fleet_reply`
 
 Report the **single most important** real issue in the scope, in these four lines, under
 ~90 words:

.gitea/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
       # does not depend on the wiki repo being reachable.
       - uses: actions/checkout@v4
 
-      # The runner image ships an older default-jdk; bridged sets maven.compiler.release=25, so
+      # The runner image ships an older default-jdk; fleetd sets maven.compiler.release=25, so
       # provision the JDK explicitly rather than apt-installing whatever "default" means today.
       - name: Set up JDK 25
         uses: actions/setup-java@v4
@@ -32,7 +32,7 @@ jobs:
           mvn -version
 
       - name: Build and test
-        working-directory: bridged
+        working-directory: fleetd
         # This IS the mock-socket surface CB-503 asks for: the pom's `default-excludes` profile
         # already sets excludedGroups=contract, so the @Tag("contract") tests — which need a live
         # herdr socket and a RabbitMQ container — are excluded without any flag here. Everything
@@ -46,7 +46,7 @@ jobs:
       # the log instead, where they are actually readable.
       - name: Failing test output
         if: failure()
-        working-directory: bridged
+        working-directory: fleetd
         run: |
           for f in target/surefire-reports/*.txt; do
             [ -f "$f" ] || continue
@@ -59,7 +59,7 @@ jobs:
   # AmqpReplyInboxContractTest reads AMQP_URI (set below to the service's network alias) and binds
   # straight to it — no Docker, no skipped tests. This separation (build job hermetic and
   # Docker-free; contract job broker-provided) is deliberate — see the default-excludes/contract
-  # profiles in bridged/pom.xml. `setup-java` provides the JDK only; Maven is installed separately,
+  # profiles in fleetd/pom.xml. `setup-java` provides the JDK only; Maven is installed separately,
   # exactly as in the build job above.
   contract:
     runs-on: ubuntu-latest
@@ -69,8 +69,6 @@ jobs:
         env:
           RABBITMQ_DEFAULT_USER: guest
           RABBITMQ_DEFAULT_PASS: guest
-        ports:
-          - 5672:5672
     env:
       # Service containers are reachable from the job by their network alias on their internal port.
       AMQP_URI: amqp://guest:guest@rabbitmq:5672
@@ -93,12 +91,12 @@ jobs:
       # runs against the RabbitMQ service container (AMQP_URI). Pinned to the one contract test to
       # avoid re-running the unit suite already covered by the `build` job.
       - name: Contract tests
-        working-directory: bridged
+        working-directory: fleetd
         run: mvn -B -Pcontract test -Dtest=AmqpReplyInboxContractTest
 
       - name: Failing test output
         if: failure()
-        working-directory: bridged
+        working-directory: fleetd
         run: |
           for f in target/surefire-reports/*.txt; do
             [ -f "$f" ] || continue

.gitignore

@@ -14,8 +14,8 @@
 .env
 .envrc
 
-# Daemon runtime artefacts. bridged appends its log wherever it is launched from, so both the
-# repo root and bridged/ collect one; neither belongs in git.
-bridged.out
-bridged/bridged.out
+# Daemon runtime artefacts. fleetd appends its log wherever it is launched from, so both the
+# repo root and fleetd/ collect one; neither belongs in git.
+fleetd.out
+fleetd/fleetd.out
 logs/

.gitmodules

@@ -1,3 +1,3 @@
 [submodule "wiki"]
 	path = wiki
-	url = ssh://git@git.ltms.dev:2224/lms/claude-bridge.wiki.git
+	url = ssh://git@git.ltms.dev:2224/fleet/fleetd.wiki.git

.opencode/agent/architect.md

@@ -0,0 +1,24 @@
+---
+description: Refine work into clear, independent units before implementation.
+mode: primary
+---
+
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
+
+You are an architect in this fleet. You refine work before anyone builds it: scope,
+acceptance criteria, risks, and a unit split. You read the repo and write analysis.
+You never commit production code and never open a pull request.
+
+A design task is worked by two architects. Design alone first, then exchange and
+say plainly where you disagree. Do not concede just to agree.
+
+Do only the assigned scope. Note anything outside that scope in one line and do not
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
+the lead, such as an unclear requirement or two defensible fixes. Do not ask about
+something you can decide by reading more code.
+
+Report only work you actually did and the real output of checks you ran. Do not
+claim a result from a tool you could not use. The primary's IDE tools are not yours.
+A mounted forge tool may use a blocked credential and fail by design.
+
+The launcher provides the required bridge reply instructions for every member.

.opencode/agent/dev.md

@@ -0,0 +1,29 @@
+---
+description: Implement one assigned unit, test it, and open a pull request.
+mode: primary
+---
+
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
+
+You implement the one unit you were given and nothing else. Work in your assigned
+git worktree and branch. Never check out, rebase onto, or push to `main`. Confirm
+the worktree root and branch before you edit. Use only paths under that root.
+
+Do only the assigned scope. Note anything outside that scope in one line and do not
+investigate it further. Use `fleet_ask{question}` only when a decision belongs to
+the lead, such as an unclear requirement or two defensible fixes. Do not ask about
+something you can decide by reading more code.
+
+Implement the change and run the full required build in your worktree. Read the
+complete output and report its real result. Do not hide failures with a pipe. State
+only checks you actually ran. The primary's IDE tools are not yours. A mounted forge
+tool may use a blocked credential and fail by design.
+
+Stage only files you changed. Never use `git add -A` or `git add .`. Never commit
+`.mcp.json` or `wiki/`. Commit with a clear message, push your branch, and open your
+own pull request against `main`. Never merge.
+
+Your handoff must name the pull request or why it was not created, the branch, the
+files changed, the build result, and any caveat for review.
+
+The launcher provides the required bridge reply instructions for every member.

.opencode/agent/reviewer.md

@@ -0,0 +1,34 @@
+---
+description: Review one assigned scope and report the most important real issue.
+mode: primary
+---
+
+<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
+
+You review the diff you were given. Report bugs, risks, and missing tests. You do
+not change code.
+
+Read the whole assigned scope before judging it. Review only that scope. If you see
+something outside it, note it in one line and do not investigate it further. Do not
+run the build. The owner makes changes and runs checks.
+
+Use `fleet_ask{question}` only when a decision belongs to the lead, such as an
+unclear requirement or two defensible fixes. Do not ask about something you can
+decide by reading more code.
+
+Report the single most important real issue in this form:
+
+```
+1. <path>:<line>
+2. issue: <one sentence: what is wrong and why it matters>
+3. fix: <one line: the concrete change>
+4. severity: high | medium | low
+```
+
+If there is no real issue, report `NO ISSUE` and one line saying why. A clean review
+is valid. Do not invent an issue. Use high for a wrong result, data loss, security,
+or a hang or crash on a real path. Use medium for an edge-path bug or a correctness
+risk under load or concurrency. Use low for clarity, a latent foot-gun, or a smell
+with no current failure.
+
+The launcher provides the required bridge reply instructions for every member.

CLAUDE.md

@@ -4,35 +4,35 @@
 
 > **Canonical block.** Everything down to §Layering is the portable bridge charter, copied verbatim
 > into every project that mounts the bridge MCP. Keep it byte-identical with the template in the
-> wiki ([Use Cases](https://git.ltms.dev/lms/claude-bridge/wiki/7-Use-Cases) → *The portable
+> wiki ([Use Cases](https://git.ltms.dev/fleet/fleetd/wiki/7-Use-Cases) → *The portable
 > CLAUDE.md block*); improvements go to the template first, then out to each project. Anything
 > specific to *this* repo lives under §Project addendum below, never inline above it.
 
-If no `bridge_*` MCP tools are mounted in this session, this section does not apply — skip it.
+If no `fleet_*` MCP tools are mounted in this session, this section does not apply — skip it.
 
-`bridged` is the **sole communication gateway** between agents here. The orchestrating session (the
+`fleetd` is the **sole communication gateway** between agents here. The orchestrating session (the
 **primary**) and every delegated peer (a **member**) mount the *same* MCP server and talk only
-through its `bridge_*` tools. No session addresses a peer, a broker, or the network directly.
+through its `fleet_*` tools. No session addresses a peer, a broker, or the network directly.
 
 ### Which role am I? — settle this before acting
 
 **Every role reads this file.** A member runs in a git worktree of this same repo, so it inherits
 this `CLAUDE.md` verbatim, and every rule below is role-conditional.
 
-**Call `bridge_whoami`.** It returns `primary`, `worker`, or `architect`, resolved by the daemon from
+**Call `fleet_whoami`.** It returns `primary`, `worker`, or `architect`, resolved by the daemon from
 your connection — unforgeable, and the same resolution its authorization gate uses. A worker also
 carries its `sessionId`, `profile`, `worktree` and `branch`; an architect carries the slot name it
 was bound to. Don't infer what you can ask.
 
 Only if that call is unavailable, fall back to these — each is one-way, so keep reading until one
-fires: the reply charter in your system prompt (*"You are an off-subscription worker in the
-claude-bridge fleet"*) ⇒ **spawned member**; bridge tools prefixed `mcp__bridge__*` ⇒ **spawned
+fires: the reply charter in your system prompt (*"You are a spawned member in the
+claude-bridge fleet"*) ⇒ **spawned member**; fleet tools prefixed `mcp__fleet__*` ⇒ **spawned
 member** (the launcher fixes that mount name; a primary's mount is named by whoever wrote its
-`.mcp.json`, so it varies); `ANTHROPIC_BASE_URL` set ⇒ **spawned member** (Claude-model members run
+`.mcp.json`, so it varies — and a member spawned before CB-632 still says `mcp__bridge__*`); `ANTHROPIC_BASE_URL` set ⇒ **spawned member** (Claude-model members run
 on a clean env, so its *absence* proves nothing). None of these separate a worker from an architect —
-only `bridge_whoami` does. **Still unsure ⇒ act as a worker**, the most restricted member role. The
+only `fleet_whoami` does. **Still unsure ⇒ act as a worker**, the most restricted member role. The
 two mistakes are not symmetric: a primary acting as a worker is refused by the authorization gate —
-loud and self-correcting — while a member acting as the primary ends its turn with no `bridge_reply`,
+loud and self-correcting — while a member acting as the primary ends its turn with no `fleet_reply`,
 and the sender silently receives nothing. Fail toward the recoverable error.
 
 ### Invariants — both roles, no exceptions
@@ -41,7 +41,7 @@ and the sender silently receives nothing. Fail toward the recoverable error.
    stays on subscription; only the bridge puts a member off it, at spawn. Mounting the bridge must
    never move a session across that boundary.
 2. **The bridge is the only channel.** Text you print in your terminal reaches nobody — the other
-   side cannot see your screen. An answer that isn't in a `bridge_*` call is silently discarded.
+   side cannot see your screen. An answer that isn't in a `fleet_*` call is silently discarded.
 3. **Identity comes from the connection, never an argument.** Workers never pass a target; you
    cannot act as another session. Spawn/stop/drain are lead-only; **send is lead or architect**;
    reply/ask are only-as-itself — any peer may answer for its own pane, and for no other. A call
@@ -57,10 +57,10 @@ and the sender silently receives nothing. Fail toward the recoverable error.
 
 **Delegate by default — that is the job.** With the bridge mounted you are an orchestrator on a
 metered subscription, and workers are cheap, parallel, and disposable. The default answer to "who
-does this?" is **a worker**, not you. Reach for `bridge_send` before you reach for `Edit`. The steps
+does this?" is **a worker**, not you. Reach for `fleet_send` before you reach for `Edit`. The steps
 below are the procedure — run them in order, every task, not only the big ones.
 
-0. **Know your role** — `bridge_whoami`, once per session, before anything else.
+0. **Know your role** — `fleet_whoami`, once per session, before anything else.
 1. **Split.** Write the unit list. Every unit carries: scope · the files or PR in question ·
    acceptance criteria · exactly what to report back. A unit with no acceptance criteria is not
    ready to delegate — refine it or keep it.
@@ -70,17 +70,19 @@ below are the procedure — run them in order, every task, not only the big ones
    delegate. The keep-list is closed: the conversation with the user, decomposition and planning,
    the final judgment call, verification, merges, and anything that depends on context only you
    hold. Nothing else is yours by default.
-3. **Spawn every delegated unit first** — `bridge_spawn{profile, worktree:true, ticket}`, one per
+3. **Spawn every delegated unit first** — `fleet_spawn{profile, worktree:true, ticket}`, one per
    unit, *before* sending any. Pass `profile` explicitly: profiles differ in model and cost, not in
    tier, so the default is rarely what you want.
-4. **Then send them all** — `bridge_send{sessionId, content, wait:false}`. Line 1 of every brief is
+4. **Then send them all** — `fleet_send{sessionId, content, wait:false}`. Line 1 of every brief is
    `Load the <name> skill.` naming the worker's playbook; those skills are opt-in and that line is
    what makes them reliable. Where the project ships no such skill, spell the procedure out in the
    brief instead. The brief is self-contained — the worker sees your message and the repo, nothing
    of your context, your plan, or your screen.
-5. **Collect** — `bridge_poll{ticket}` → `bridge_ack{ticket, msgId}`. Answer a worker's `bridge_ask`
-   with `bridge_send{turnId, content}` — **not** `sessionId`. A worker gone quiet is diagnosed with
-   `bridge_status`, never by reading its terminal.
+5. **Collect** — `fleet_poll{ticket}` → `fleet_ack{target, msgId}`. Answer a worker's `fleet_ask`
+   with `fleet_send{turnId, content}` — **not** `sessionId`. A worker gone quiet is diagnosed with
+   `fleet_status`, never by reading its terminal; it also reports an open question and the `turnId`
+   that answers it. **A worker's ask waits ~55 seconds, and no nudge makes that longer** — so never
+   brief a worker to "ask me". Decide before you delegate, or give it an explicit default.
 6. **Verify yourself.** Re-run the build and the checks. A worker cannot run your IDE tooling, any
    forge tools it appears to have hold a blocked credential and fail, and a piped command
    (`… | tail`) hides failures behind a zero exit — never promote a worker's "clean" to a fact.
@@ -91,11 +93,11 @@ below are the procedure — run them in order, every task, not only the big ones
    read it yourself.
 8. **Adjudicate, merge, tear down — yours alone.** Read the diff yourself: fully if it is small,
    targeted at the reported findings and the risky paths if it is large. Reviewer findings direct
-   your attention; they never substitute for it. Then merge, then `bridge_stop{paneId}`.
+   your attention; they never substitute for it. Then merge, then `fleet_stop{paneId}`.
 
 **Steps 3 and 4 are separate on purpose** — spawning and sending in one loop is how parallel work
 silently becomes serial, and it is the most common way this layer is wasted. For the same reason,
-prefer `wait:false` + `bridge_poll` for anything non-trivial: a blocking `bridge_send` is capped by
+prefer `wait:false` + `fleet_poll` for anything non-trivial: a blocking `fleet_send` is capped by
 *your own* MCP client call timeout (~60s), well below the task's real runtime.
 
 **Delegating does not delegate responsibility.** Workers open PRs; you are the gate. Never delegate
@@ -103,21 +105,22 @@ the merge — and merging on a reviewer's word is delegating it by proxy.
 
 | Intent | Tool |
 |---|---|
-| Confirm your own role | `bridge_whoami` |
-| See backends available | `bridge_profiles` |
-| Start a member | `bridge_spawn{role?, profile?, cwd?, worktree?, ticket?, sessionName?, resumeSessionId?}` → `sessionId` + `paneId` |
-| See the fleet | `bridge_list` → `leads` (your peers) + `members` (each carries `agentSessionId` when its backend knows one) · one peer's state: `bridge_status{sessionId}` |
-| Delegate (blocking) | `bridge_send{sessionId, content}` |
-| Delegate (long task) | `bridge_send{sessionId, content, wait:false}` → ticket → `bridge_poll{ticket}` |
-| Answer a member's `bridge_ask` | `bridge_send{turnId, content}` — **not** `sessionId` |
-| Message a **peer lead** | `bridge_send{sessionId: <their terminal>, content}` — `bridge_list` → `leads` reports it. Coordination only, **never** a task |
-| Answer a peer lead that messaged you | `bridge_reply{content}` — the one case a lead replies |
-| Collect a held reply | `bridge_poll{target}` · then `bridge_ack{target, msgId}` |
-| Tear down a member | `bridge_stop{paneId}` |
+| Confirm your own role | `fleet_whoami` |
+| See backends available | `fleet_profiles` |
+| Start a member | `fleet_spawn{role?, profile?, cwd?, worktree?, ticket?, sessionName?, resumeSessionId?}` → `sessionId` + `paneId` |
+| See the fleet | `fleet_list` → `leads` (your peers) + `members` (each carries `agentSessionId` when its backend knows one) · one peer's state: `fleet_status{sessionId}` |
+| Delegate (blocking) | `fleet_send{sessionId, content}` |
+| Delegate (long task) | `fleet_send{sessionId, content, wait:false}` → ticket → `fleet_poll{ticket}` |
+| Answer a member's `fleet_ask` | `fleet_send{turnId, content}` — **not** `sessionId` |
+| Message a **peer lead** on this host | `fleet_send{sessionId: <their terminal>, content}` — `fleet_list` → `leads` reports it. Coordination only, **never** a task |
+| Message a **peer lead** on another daemon or host | `fleet_send{coordId: <their coord-id>, content}` — needs a `coordinator:` block; your own coord-id is in `fleet_list`. Coordination only, **never** a task |
+| Answer a peer lead that messaged you | `fleet_reply{content}` — the one case a lead replies |
+| Collect a held reply | `fleet_poll{target}` · then `fleet_ack{target, msgId}` |
+| Tear down a member | `fleet_stop{paneId}` |
 
 ### Lead ↔ lead — coordinate, never delegate
 
-`bridge_list` returns `leads` alongside `members`; your own row carries `self: true`. Every other row
+`fleet_list` returns `leads` alongside `members`; your own row carries `self: true`. Every other row
 is a peer — an orchestrator with its own context, its own members, and its own judgment. An empty
 `members` array means no members are spawned; it says nothing about peers.
 
@@ -138,7 +141,7 @@ The traffic between leads is coordination and nothing else:
    against the code, and re-run the build. A peer's correction gets the same treatment — right or
    wrong on the evidence, not on who said it. Neither of you merges the other's work unreviewed.
 
-Being messaged by a peer does not make you its worker: answer with `bridge_reply`, and push back on
+Being messaged by a peer does not make you its worker: answer with `fleet_reply`, and push back on
 the substance if it is wrong. A peer that simply complies has thrown away the reason there are two of
 you.
 
@@ -146,11 +149,11 @@ you.
 
 1. **Load the playbook skill the lead named** before doing anything else.
 2. **Do the assigned scope only.** Note anything you spot outside it in one line; don't go hunt it.
-3. **`bridge_ask{question}`** when a decision is genuinely the lead's (ambiguous requirement, two
+3. **`fleet_ask{question}`** when a decision is genuinely the lead's (ambiguous requirement, two
    defensible fixes, "bug or intended?"). It blocks and you resume the *same* turn with the answer.
    Don't ask what you could decide yourself.
-4. **End the turn with exactly one `bridge_reply{content}`**, carrying your complete answer. This is
-   the whole handoff. No `bridge_reply` ⇒ the sender gets nothing and the exchange stalls.
+4. **End the turn with exactly one `fleet_reply{content}`**, carrying your complete answer. This is
+   the whole handoff. No `fleet_reply` ⇒ the sender gets nothing and the exchange stalls.
    Do **not** lean on the completion fallback to carry your answer for you: when you end a turn
    without replying, the bridge scrapes your pane, and it can return only the last 4000 characters.
    A clipped scrape is marked as partial, but the missing text is gone — your report reaches the
@@ -169,33 +172,38 @@ you.
 
 | Layer | Scope | Reaches |
 |---|---|---|
-| the launcher's reply charter | the one rule that must survive with no repo: *end every turn with `bridge_reply`* | every spawned member, at launch, every peer kind — never a lead |
+| the launcher's reply charter | the one rule that must survive with no repo: *end every turn with `fleet_reply`* | every spawned member, at launch, every peer kind — never a lead |
 | **this section** | protocol + orchestration policy | primary **and** every member that reads the repo — tracked in git, so worktrees inherit it |
+| role agent definition files | role contract and per-job procedure | a member whose launcher binds its role to the matching file in its worktree |
 | role playbook skills | per-job procedure (commit/PR recipe, finding format) | a member told to load one |
 | the bridge's own docs | design detail, flows, error model | on demand |
 
-A rule belongs in **exactly one** layer — the outermost one that must obey it. Peers that don't read
-`CLAUDE.md` (non-Claude adapters) get the charter only, so any rule *they* must obey belongs in the
-charter, not here.
+A rule belongs in **exactly one** layer — the outermost one that must obey it. A member without a
+repo checkout still gets the launcher's reply charter, which is why that one rule stays there.
+Peers that don't read `CLAUDE.md` (non-Claude adapters) get the charter only, so any rule *they*
+must obey belongs in the charter, not here.
 
 ## Project addendum — claude-bridge (not part of the canonical block)
 
-- **This repo is the bridge.** The daemon is `bridged`, its MCP mount is `http://127.0.0.1:8765/mcp`,
-  and the code behind the rules above is `mcp/BridgeMcp` (tools), `auth/Authz` (the role table),
+- **This repo is the bridge.** The daemon is `fleetd`, its MCP mount is `http://127.0.0.1:8765/mcp`,
+  and the code behind the rules above is `mcp/FleetMcp` (tools), `auth/Authz` (the role table),
   `mcp/ConnectionIdentity` (connection→role), and `worker/*Launcher` (`REPLY_CHARTER`).
 - **Skills available to delegate:** `implementer` (worktree → commit → push → own PR) and
   `reviewer` (scoped review → one structured finding). Name one in every delegation.
 - **Primary-side skills** (not delegation playbooks — a worker cannot use them):
-  `port-to-opencode` (make an OpenCode session a participant in this workspace).
+  `port-to-opencode` (make an OpenCode session a participant in this workspace) and
+  `fleets-status` (report every fleet that shares one LavinMQ instance).
 - **Never commit** `.mcp.json` (the primary's local copy, flagged `--skip-worktree`) or `wiki/`
   (a submodule with its own remote).
-- **Flows and the error model** — rendezvous, `bridge_ask`, detached delivery, turn-done fallback —
-  are diagrammed in `docs/MCP-Contract.md` §6, kept out of this file because it loads into every
-  session's context.
+- **Flows and the error model** — rendezvous, `fleet_ask`, detached delivery, turn-done fallback —
+  are diagrammed in `docs/MCP-Contract.md` **§6 only**. The rest of that page is a pre-build design
+  doc whose tool names, parameter names and REST paths never caught up with the code, so do not use
+  it as the tool reference (CB-609). Section 6 is kept out of this file because this file loads into
+  every session's context.
 
 ### Redeploying the daemon — the lead may do this (primary only)
 
-**A merge is not a deployment.** The running `bridged` holds the jar it was started with, so a
+**A merge is not a deployment.** The running `fleetd` holds the jar it was started with, so a
 feature merged to `main` does nothing until the daemon is rebuilt and restarted. Saying "shipped"
 about code the live daemon has never loaded is a false report. The lead **may and should** redeploy
 rather than hand the job back to the operator.
@@ -206,9 +214,9 @@ and stopping it kills the worker's own channel mid-turn.
 **Use the script — do not hand-roll the steps.**
 
 ```bash
-scripts/redeploy-bridged.sh --check   # report state, change nothing
-scripts/redeploy-bridged.sh           # build, confirm drain, restart, verify
-scripts/redeploy-bridged.sh --yes     # skip the drain prompt (fleet already checked)
+scripts/redeploy-fleetd.sh --check   # report state, change nothing
+scripts/redeploy-fleetd.sh           # build, confirm drain, restart, verify
+scripts/redeploy-fleetd.sh --yes     # skip the drain prompt (fleet already checked)
 ```
 
 It builds before it stops anything, so a failed build never leaves the fleet down; it waits for the
@@ -225,17 +233,17 @@ if the script is unavailable or a step fails, this is what it was protecting you
    daemon starts fine, and the failure appears much later as workers that cannot open a PR. Nothing
    logs this at startup — the script's `--check` is the only thing that reports it, and it checks
    whether the name resolves without ever printing the value.
-2. **Drain live members first.** `bridge_list`, then `bridge_stop` each member, and collect anything
-   you still want with `bridge_poll` before you kill anything. A restart drops in-flight tickets and
+2. **Drain live members first.** `fleet_list`, then `fleet_stop` each member, and collect anything
+   you still want with `fleet_poll` before you kill anything. A restart drops in-flight tickets and
    rendezvous, and a member's report is not recoverable once its ticket is gone.
 3. **A restart is the only way deferred config keys take effect.** That is usually the reason to do
    it. The startup log names which keys it accepted and which it deferred — read those lines rather
    than assuming.
-4. **Re-check identity afterwards.** Call `bridge_whoami` and confirm it still answers `primary`. The
+4. **Re-check identity afterwards.** Call `fleet_whoami` and confirm it still answers `primary`. The
    lead is found by its tab label (`fleet.leaders.*.tab`), and a lead whose tab no longer matches is
    demoted to worker, which refuses every orchestration call.
-5. **Prove the new jar is the one running.** Confirm a *fresh* `bridged listening` line at the end of
-   `bridged/bridged.out`, dated after the restart. An old daemon that never died looks identical from
+5. **Prove the new jar is the one running.** Confirm a *fresh* `fleetd listening` line at the end of
+   `fleetd/fleetd.out`, dated after the restart. An old daemon that never died looks identical from
    the outside.
 
 **Permission.** A `CLAUDE.md` rule grants intent, not tool permission — the command classifier
@@ -244,7 +252,7 @@ it is one auditable command, so the operator allow-lists it once instead of appr
 start every time. The rule lives in the operator's Claude Code settings:
 
 ```json
-{ "permissions": { "allow": ["Bash(scripts/redeploy-bridged.sh:*)"] } }
+{ "permissions": { "allow": ["Bash(scripts/redeploy-fleetd.sh:*)"] } }
 ```
 
 Granted by the operator on 2026-08-15. If a call is still refused, do **not** route around it by
@@ -262,15 +270,15 @@ Before you call any work done, check the row that matches what you touched:
 
 | You changed… | Re-read and update… |
 |---|---|
-| a `bridge_*` tool — added, removed, renamed, or its params/semantics | the primary's intent→tool table; any rule that names that tool |
+| a `fleet_*` tool — added, removed, renamed, or its params/semantics | the primary's intent→tool table; any rule that names that tool |
 | `Authz` / the role table | invariant 3, and the primary-only vs worker-only claims |
-| `ConnectionIdentity` / how a caller is resolved | the `bridge_whoami` paragraph and the fallback ladder |
-| `REPLY_CHARTER`, or a launcher's mount/flags | the fallback ladder (`mcp__bridge__*`), and the layering table's top row |
+| `ConnectionIdentity` / how a caller is resolved | the `fleet_whoami` paragraph and the fallback ladder |
+| `REPLY_CHARTER`, or a launcher's mount/flags | the fallback ladder (`mcp__fleet__*`), and the layering table's top row |
 | the injector / status gating | invariant 4 |
 | worktree provisioning or the parity overlay | the "both roles read this file" premise — it rests on the worker's worktree being a checkout of this repo |
 | `.claude/skills/**` | the addendum's skill list, and the "name the playbook" rule |
 | a new peer kind (non-Claude adapter) | what that peer can read — anything it must obey belongs in its charter, not in the block |
-| **anything an operator can use, configure, or observe** — an MCP tool, a `bridged.yaml` knob, an endpoint, a visible behaviour | **[Features](wiki/11-Features.md)** — one entry: what it does · the knob that turns it on · **why it exists** · the gotcha |
+| **anything an operator can use, configure, or observe** — an MCP tool, a `fleetd.yaml` knob, an endpoint, a visible behaviour | **[Features](wiki/11-Features.md)** — one entry: what it does · the knob that turns it on · **why it exists** · the gotcha |
 
 That last row is not bookkeeping. Chapters 1–10 answer *how is this built* and *why this way*;
 none of them has a home for *what can it do and how do I turn it on*, so for twenty tickets a
@@ -281,7 +289,7 @@ is a Roadmap line. A change that touches none of the three earns no entry, and t
 outcome rather than an omission.
 
 Then **propagate**: the block in this file and the template in the wiki
-([Use Cases](https://git.ltms.dev/lms/claude-bridge/wiki/7-Use-Cases) → *The portable `CLAUDE.md`
+([Use Cases](https://git.ltms.dev/fleet/fleetd/wiki/7-Use-Cases) → *The portable `CLAUDE.md`
 block*) must stay byte-identical, and other projects carrying the block need the same edit. Verify
 rather than trust:
 
@@ -304,10 +312,10 @@ PY
 
 Two IDE MCP servers are connected: **intellij-index** (semantic code intelligence) and
 **jetbrains** (file problems, reformat, debugger). IntelliJ has multiple projects open; our
-module is **`bridged`**. Always pass these to IDE MCP tools:
+module is **`fleetd`**. Always pass these to IDE MCP tools:
 
-- `project_path` = `/Users/dai.ha/LTMS/claude-bridge/bridged`
-- IDE paths are relative to `bridged/` (e.g. `src/main/java/dev/ltms/bridged/...`)
+- `project_path` = `/Users/dai.ha/LTMS/claude-bridge/fleetd`
+- IDE paths are relative to `fleetd/` (e.g. `src/main/java/dev/ltms/fleet/...`)
 
 ### After editing any file — mandatory
 
@@ -321,7 +329,7 @@ module is **`bridged`**. Always pass these to IDE MCP tools:
    whole-project gate before declaring work done or committing.
 
 **Whenever dependencies change (or a `pom.xml` edit), validate CVEs with
-`jetbrains get_file_problems{filePath: "bridged/pom.xml"}`** — its Mend.io check reflects the
+`jetbrains get_file_problems{filePath: "fleetd/pom.xml"}`** — its Mend.io check reflects the
 dependencies on disk. (Note: `ide_diagnostics` / intellij-index does NOT re-resolve dependencies
 after a pom edit without a full Maven reimport, so it reports stale CVE results — don't trust it
 for this.) Treat a CVE warning like any other: bump to a patched version and confirm

README.md

@@ -9,32 +9,33 @@ Sibling of [`crush-bridge`](https://git.ltms.dev/systems/vms) (which drives a he
 process*, so it inherits `CLAUDE.md`, hooks, skills, and MCP — just pointed at a
 cheaper/local model.
 
-## Leading approach — herdr-centric message server (`bridged`)
+## Leading approach — herdr-centric message server (`fleetd`)
 
-A small always-on message server, **`bridged`**, controls
+A small always-on message server, **`fleetd`**, controls
 [herdr](https://herdr.dev) (an agent multiplexer) over its Unix-socket API and exposes a
 clean 2-way messaging API as an **MCP server that both the primary and the workers mount** —
 one unified Claude setup and the **sole communication gateway** (REST/SSE stays for non-Claude
-clients; any broker is `bridged`-internal, below the gateway).
-herdr owns the PTYs, multiplexing, persistence, and **agent-status events**; `bridged` owns
+clients; any broker is `fleetd`-internal, below the gateway).
+herdr owns the PTYs, multiplexing, persistence, and **agent-status events**; `fleetd` owns
 policy (subscription boundary, session lifecycle, status-gated delivery) and the client
-contract. The worker `claude` launches with `ANTHROPIC_BASE_URL=https://ollama.ltms.dev` + a
-bearer token; the primary Opus stays env-clean and calls `bridged`'s MCP tools.
+contract. A Claude member launches with `ANTHROPIC_BASE_URL` pointed at the gateway,
+`https://llm.ltms.dev/anthropic`, plus a bearer token; the lead stays env-clean and calls
+`fleetd`'s MCP tools. See the wiki's **[13 User Guide](wiki/13-User-Guide.md)** to run it.
 
 ```mermaid
 flowchart LR
     OPUS["Opus — primary<br/>(Claude Code, env CLEAN)<br/>MCP client"]
-    subgraph BD["bridged — standalone daemon (not a claude process)"]
+    subgraph BD["fleetd — standalone daemon (not a claude process)"]
         SRV["SERVER face<br/>MCP · REST/SSE · policy"]
         CLI["CLIENT face<br/>status-gated injector · herdr socket"]
         SRV --> CLI
     end
     HERDR["herdr<br/>panes · agent-status"]
     W["worker claude pane<br/>ANTHROPIC_BASE_URL set<br/>MCP client"]
-    M["ollama.ltms.dev<br/>(worker model)"]
+    M["llm.ltms.dev<br/>(the one gateway)"]
 
-    OPUS -->|"MCP bridge_send (blocks)"| SRV
-    W -.->|"MCP bridge_reply"| SRV
+    OPUS -->|"MCP fleet_send (blocks)"| SRV
+    W -.->|"MCP fleet_reply"| SRV
     CLI -->|"Unix socket<br/>send_text · events.subscribe"| HERDR
     HERDR -->|"drives PTY"| W
     W -->|"inference"| M
@@ -46,24 +47,26 @@ flowchart LR
 ```
 
 - **Subscription boundary:** the *primary* never sets `ANTHROPIC_BASE_URL` (stays on
-  Pro/Max). Only the *secondary* process is off-subscription — and `bridged` itself is a
+  Pro/Max). Only the *secondary* process is off-subscription — and `fleetd` itself is a
   plain daemon (no Anthropic quota), so it may poll/subscribe freely.
-- **One gateway (unified MCP setup):** `bridged` is the **sole communication path** for every
+- **One gateway (unified MCP setup):** `fleetd` is the **sole communication path** for every
   Claude session. Primary and workers each mount it as an MCP server (one `claude mcp add`
-  line, same on both) and talk over MCP tools — `bridge_send` / `bridge_reply` /
-  `bridge_status` (with `bridge_ask` planned for the blocked-worker path). **No Claude session
-  ever addresses a broker, a peer, or the network
-  directly**; any queue is `bridged`-internal. MCP tool I/O never sets `ANTHROPIC_BASE_URL`, so
-  mounting the bridge is subscription-safe by construction.
-- **How the primary consumes a reply:** a single **blocking MCP call** (`bridge_send`);
-  `bridged` holds it open until the worker calls `bridge_reply` or its turn hits
+   line, same on both) and talk over MCP tools — `fleet_send` / `fleet_reply` /
+   `fleet_status` (with `fleet_ask` planned for the blocked-worker path). **No Claude session
+   ever addresses a broker, a peer, or the network
+   directly**; any queue is `fleetd`-internal. MCP tool I/O never sets `ANTHROPIC_BASE_URL`, so
+   mounting the bridge is subscription-safe by construction.
+   **Tool naming:** the tools are `fleet_*` (renamed from `bridge_*` in CB-622). The old
+   `bridge_*` names were removed in CB-634 — only `fleet_*` answers now.
+- **How the primary consumes a reply:** a single **blocking MCP call** (`fleet_send`);
+  `fleetd` holds it open until the worker calls `fleet_reply` or its turn hits
   `agent_status=done`, then returns the reply as the tool result. No cross-turn busy-poll, so
   no quota burn. SSE is an optional side-channel for humans/dashboards watching status.
-- **Worker → primary** rides `bridged`'s **MCP rendezvous** — the reply resolves the primary's
-  blocking call (or, for detached work, `bridged` **injects the primary's idle pane** when it's
+- **Worker → primary** rides `fleetd`'s **MCP rendezvous** — the reply resolves the primary's
+  blocking call (or, for detached work, `fleetd` **injects the primary's idle pane** when it's
   ready), so *no keystroke-into-primary and no broker are involved, even single-host*. The one
   exception: a split-host primary that isn't a herdr pane wakes via its own `Stop`-hook, which
-  polls **`bridged`** (never a broker). See the wiki for the two topologies.
+  polls **`fleetd`** (never a broker). See the wiki for the two topologies.
 - **Different model per process** sidesteps Claude Code's lack of per-subagent provider
   routing — the worker isn't a subagent, it's its own configured process.
 - **AgentAPI** ([`coder/agentapi`](https://github.com/coder/agentapi)) is retained only as a
@@ -72,11 +75,11 @@ flowchart LR
 
 ## Docs
 
-Full design, setup, and operations live in the **[wiki](https://git.ltms.dev/lms/claude-bridge/wiki)**,
+Full design, setup, and operations live in the **[wiki](https://git.ltms.dev/fleet/fleetd/wiki)**,
 vendored here as a submodule under [`wiki/`](./wiki):
 
 ```bash
-git clone --recurse-submodules ssh://git@git.ltms.dev:2224/lms/claude-bridge.git
+git clone --recurse-submodules ssh://git@git.ltms.dev:2224/fleet/fleetd.git
 # or, after a plain clone:
 git submodule update --init
 ```
@@ -86,7 +89,7 @@ Gitea wiki.
 
 ## Status
 
-🟢 **Implemented & dogfooded** — the herdr-centric **`bridged`** message server is built and in
+🟢 **Implemented & dogfooded** — the herdr-centric **`fleetd`** message server is built and in
 real use: an Opus primary delegates tasks to off-subscription workers that reply through the
 bridge (code reviews delegated this way have produced committed bug fixes). Selected as the
 primary approach 2026-07-11, superseding the AgentAPI plan (2026-07-08); AgentAPI retained as a
@@ -97,9 +100,9 @@ tests run separately via `mvn test -Pcontract`):
 
 - **Core gateway** — herdr socket client (contract-tested vs live 0.7.0); guard-checked worker
   spawn with `ANTHROPIC_BASE_URL` injected only into the worker's env; status-gated injector;
-  blocking `bridge_send` with reply rendezvous; MCP server as a thin adapter over the REST core.
-- **MCP tools** — `bridge_send` / `bridge_reply` / `bridge_status` (messaging) and `bridge_spawn`
-  / `bridge_list` / `bridge_stop` / `bridge_profiles` / `bridge_poll` (fleet). Caller identity is
+  blocking `fleet_send` with reply rendezvous; MCP server as a thin adapter over the REST core.
+- **MCP tools** — `fleet_send` / `fleet_reply` / `fleet_status` (messaging) and `fleet_spawn`
+  / `fleet_list` / `fleet_stop` / `fleet_profiles` / `fleet_poll` (fleet). Caller identity is
   connection-based (loopback peer PID → herdr pane), so the same mount serves primary and workers.
 - **Delivery reliability** — completion fallback (a confirmed `working→idle` turn resolves a
   send); async fire-and-poll (beats the caller's MCP call timeout for long tasks); and failure
@@ -107,7 +110,7 @@ tests run separately via `mvn test -Pcontract`):
 - **Fleet** — multiple worker profiles, each with an independent base_url guard check; workers
   inherit the primary's working directory (never `$HOME`); a readiness gate holds delivery until
   a worker's Claude has connected the bridge MCP (no paste lost into its boot window).
-- **Blocked-worker path** — `bridge_ask` reverse rendezvous: a worker pauses its delegated turn to
+- **Blocked-worker path** — `fleet_ask` reverse rendezvous: a worker pauses its delegated turn to
   ask the primary and resumes the *same* turn with the answer (CB-205).
 - **Session lifecycle** — session manager with spawn/reuse/recycle, `idle_ttl` reaper, `context_cap`,
   and graceful drain on shutdown (CB-301/CB-303); per-worker git worktrees on their own branch with

bridged/.gitignore

@@ -1,14 +0,0 @@
-# Build output
-target/
-dependency-reduced-pom.xml
-
-# Local runtime config (copy from bridged.example.yaml)
-bridged.yaml
-
-# CB-505 audit trail + daemon stdout/stderr — runtime records, never source
-logs/
-
-# Editor / OS
-*.iml
-.idea/
-.DS_Store

bridged/src/main/java/dev/ltms/bridged/herdr/PaneLocator.java

@@ -1,59 +0,0 @@
-package dev.ltms.bridged.herdr;
-
-import com.fasterxml.jackson.databind.JsonNode;
-
-import java.util.Map;
-
-/**
- * Resolves which herdr pane a process belongs to — the herdr half of connection-based MCP
- * identity (CB-105). Given the PID that opened an MCP connection, {@link #terminalForPid} finds
- * the agent pane whose process tree contains it, so {@code bridged} can tell <em>which worker</em>
- * is calling without the worker sending anything spoofable.
- *
- * <p>herdr owns the PID→pane truth: {@code pane.process_info} reports each pane's {@code shell_pid}
- * and foreground process PIDs. This scans agent panes; a spawn-time {@code pid→terminal} cache is
- * the obvious optimization once wired into {@code ClaudeCodeLauncher}.
- */
-public final class PaneLocator {
-
-    private final HerdrClient herdr;
-
-    public PaneLocator(HerdrClient herdr) {
-        this.herdr = herdr;
-    }
-
-    /**
-     * The {@code terminal_id} of the agent pane whose process tree contains {@code pid}, or
-     * {@code null} if no agent pane owns it (e.g. the caller is the primary, or off-host).
-     */
-    public String terminalForPid(long pid) {
-        if (pid <= 0) {
-            return null;
-        }
-        for (JsonNode pane : herdr.call("pane.list", Map.of()).path("panes")) {
-            String paneId = pane.path("pane_id").asText(null);
-            if (paneId != null && paneOwnsPid(paneId, pid)) {
-                return pane.path("terminal_id").asText(null);
-            }
-        }
-        return null;
-    }
-
-    private boolean paneOwnsPid(String paneId, long pid) {
-        JsonNode info;
-        try {
-            info = herdr.call("pane.process_info", Map.of("pane_id", paneId)).path("process_info");
-        } catch (HerdrException e) {
-            return false; // pane vanished mid-scan — just skip it
-        }
-        if (info.path("shell_pid").asLong(-1) == pid) {
-            return true;
-        }
-        for (JsonNode p : info.path("foreground_processes")) {
-            if (p.path("pid").asLong(-1) == pid) {
-                return true;
-            }
-        }
-        return false;
-    }
-}

bridged/src/main/java/dev/ltms/bridged/member/ClaudeCodeLauncher.java

@@ -1,325 +0,0 @@
-package dev.ltms.bridged.member;
-
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.EnumSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.UUID;
-import java.util.function.Function;
-import java.util.function.LongSupplier;
-import java.util.function.Supplier;
-
-/**
- * The {@link HerdrPeerLauncher} adapter for <strong>Claude Code</strong> — the safe path from a
- * delegation request to a running off-subscription Claude.
- *
- * <p>Everything transport-related (tab/pane placement, the CB-306 spawn-readiness gate, unique
- * naming, CB-117 orphan reap, teardown, listing, cwd resolution) lives in the base. This class
- * supplies only the two Claude-specific seams:
- * <ul>
- *   <li>the {@code claude} name prefix (so reap matches {@code claude-*} panes, never another
- *       adapter's), and</li>
- *   <li>{@link #buildLaunch}, which encodes the subscription boundary: build the worker env with
- *       {@code ANTHROPIC_BASE_URL}, assert that host is on the allowlist <em>before</em> touching
- *       herdr, and mount the bridge MCP + reply charter as inline launch flags. A worker's base_url
- *       lives in the env map handed to herdr and nowhere else; {@code bridged}'s own environment is
- *       never mutated, and nothing is written to the worker's profile.</li>
- * </ul>
- */
-public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
-
-    /** Label prefix for this adapter's herdr agent names (drives naming + orphan reap). */
-    private static final String NAME_PREFIX = "claude";
-
-    private static final Logger log = LoggerFactory.getLogger(ClaudeCodeLauncher.class);
-
-    private final SubscriptionGuard guard;
-
-    /**
-     * Production constructor — disables the spawn-ready gate ({@code spawnReadyTimeoutMs == 0}) so
-     * existing deployments and tests keep the legacy non-blocking spawn semantics.
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
-                              Function<String, String> env) {
-        this(agents, spaces, guard, profiles, defaultProfile, env, 0,
-                System::currentTimeMillis, () -> sleepUninterruptibly(300));
-    }
-
-    /**
-     * Production constructor with spawn-ready gate enabled. The gate polls {@code agents.status()}
-     * until the pane reports an injectable state or {@code spawnReadyTimeoutMs} elapses.
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
-                              Function<String, String> env,
-                              long spawnReadyTimeoutMs, long spawnReadyPollMs) {
-        this(agents, spaces, guard, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, spawnReadyPollMs, null);
-    }
-
-    /**
-     * Production constructor carrying the fleet-wide tab-label template (CB-557). The template comes
-     * from {@code fleet.tabLabel}, which a profile cannot know because it names the member's
-     * <em>role</em>; a profile may still override it with its own {@code tabLabel}.
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
-                              Function<String, String> env,
-                              long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                              Supplier<BridgedConfig.Fleet> fleet) {
-        this(agents, spaces, guard, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs,
-                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
-                fleet);
-    }
-
-    /**
-     * Full testability constructor. Every injectable collaborator is explicit so unit tests supply
-     * fakes for the clock ({@code nowMillis}) and poll-loop wait ({@code sleeper}). The
-     * {@code sleeper} is never called when the gate is disabled ({@code spawnReadyTimeoutMs == 0}).
-     *
-     * @param agents               herdr agent control (start, status, close)
-     * @param spaces               workspace / tab control (ensure, create, close)
-     * @param guard                subscription-boundary guard (checked before spawning)
-     * @param profiles             configured worker profiles
-     * @param defaultProfile       profile a no-argument spawn uses (nullable)
-     * @param env                  host env lookup (injectable for tests)
-     * @param spawnReadyTimeoutMs  max ms to wait for injectable state (0 disables the gate)
-     * @param nowMillis            monotonic clock source (e.g. {@code System::currentTimeMillis})
-     * @param sleeper              sleep/wait hook (e.g. {@code () -> Thread.sleep(pollMs)}); it
-     *                             already encodes the poll interval, so the 8th positional argument
-     *                             (poll ms) is accepted for API symmetry but otherwise unused here
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
-                              Function<String, String> env,
-                              long spawnReadyTimeoutMs,
-                              LongSupplier nowMillis, Runnable sleeper) {
-        this(agents, spaces, guard, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, nowMillis, sleeper, null);
-    }
-
-    /**
-     * Full testability constructor, plus the fleet-wide tab-label template (CB-557).
-     *
-     * @param fleet live fleet config, read once for each spawn
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
-                              Function<String, String> env,
-                              long spawnReadyTimeoutMs,
-                              LongSupplier nowMillis, Runnable sleeper,
-                              Supplier<BridgedConfig.Fleet> fleet) {
-        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, nowMillis, sleeper, fleet);
-        this.guard = guard;
-    }
-
-    /**
-     * {@inheritDoc}
-     *
-     * <p>The spawn sequence encodes the subscription boundary: assert the profile's base_url is on
-     * the allowlist <em>before</em> any herdr call, then build the worker env with
-     * {@code ANTHROPIC_*}, the parity-neutral git-forge grant, and the bridge MCP + reply charter
-     * mounted as inline launch flags. When the request carries session identity (CB-547a) it is
-     * applied here — see {@link #applySessionIdentity}.
-     */
-    @Override
-    protected Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec) {
-        // CB-539: a profile may deliberately opt into the subscription (subscription: true) when no
-        // off-subscription endpoint exists for it — e.g. `sonnet` on `ccs`. That profile gets no
-        // ANTHROPIC_BASE_URL/AUTH_TOKEN (there is nothing to point them at) and the guard's base_url
-        // requirement is skipped FOR IT ONLY. Every other profile keeps the hard boundary below.
-        boolean onSubscription = cfg.isSubscription();
-        String baseUrl = cfg.baseUrl();
-
-        if (onSubscription) {
-            // NO SILENT CONTRADICTION: subscription:true + a baseUrl state opposite intents; refuse
-            // loudly rather than pick a winner.
-            if (baseUrl != null && !baseUrl.isBlank()) {
-                throw new IllegalStateException("profile '" + cfg.profile()
-                        + "' sets both subscription: true and a baseUrl ('" + baseUrl + "') — the two "
-                        + "are contradictory: a subscription profile must not point at an endpoint. "
-                        + "Drop baseUrl, or drop subscription: true.");
-            }
-            // Visible without anyone going looking for it: this worker bills the subscription.
-            log.warn("spawning profile '{}' on the Claude subscription (subscription: true) — this "
-                    + "worker WILL bill the operator's subscription", cfg.profile());
-        } else {
-            guard.assertWorker(baseUrl); // hard stop before we spawn anything
-        }
-
-        Map<String, String> workerEnv = baseEnv(cfg);
-        if (onSubscription) {
-            // CB-542 belt-and-braces: on the subscription path no guard vets these two keys, and the
-            // profile's env: is layered in by baseEnv — so strip any that rode in there. Config load
-            // already rejects this (loudly, naming the profile); this makes the boundary hold even
-            // for a profile built in code that never passed through that validation.
-            workerEnv.remove("ANTHROPIC_BASE_URL");
-            workerEnv.remove("ANTHROPIC_AUTH_TOKEN");
-        } else {
-            workerEnv.put("ANTHROPIC_BASE_URL", baseUrl);
-            putIfPresent(workerEnv, "ANTHROPIC_AUTH_TOKEN", env.apply(cfg.tokenEnv()));
-        }
-        putIfPresent(workerEnv, "ANTHROPIC_MODEL", cfg.model());
-        putIfPresent(workerEnv, "CLAUDE_CONFIG_DIR", cfg.configDir());
-        applyGitToken(workerEnv, cfg);
-
-        // CB-547a: Claude Code can MINT its own session id, so bridged chooses it — a fresh spawn
-        // gets a UUID we pass as --session-id and return from agentSessionId(), so the resume
-        // handle is known BEFORE the agent has written anything; a resume spawn adopts its prior
-        // id via -r and passes no --session-id (the two conflict). Both are injected before the
-        // model flag so --model keeps outranking the operator's own argv.
-        // mutableArgv: argvWithBridge may hand back the profile's own (immutable) List.of when it
-        // has neither MCP nor a charter — session flags must be added into a list we own.
-        List<String> argv = mutableArgv(argvWithBridge(cfg, spec.charter()));
-        String agentSessionId = applySessionIdentity(argv, spec.sessionName(), spec.resumeSessionId());
-        return new Launch(workerEnv, argvWithModel(argv, cfg), agentSessionId);
-    }
-
-    /**
-     * Add the Claude-specific session-identity flags to {@code argv} and return the peer's OWN
-     * session id — the resume handle. A resume request passes the prior id via {@code -r} and
-     * returns that id; a fresh named session mints a new UUID, passes it via {@code --session-id},
-     * and returns the mint. The bridge's logical name rides along as {@code -n} when present. When
-     * <em>no</em> identity is requested (sessionName and resumeSessionId both blank) this adds
-     * nothing and returns {@code null}, keeping the legacy no-identity launch byte-identical.
-     */
-    private static String applySessionIdentity(List<String> argv, String sessionName, String resumeSessionId) {
-        boolean resuming = resumeSessionId != null && !resumeSessionId.isBlank();
-        boolean named = sessionName != null && !sessionName.isBlank();
-        if (!resuming && !named) {
-            return null; // no identity requested — keep the legacy launch byte-identical
-        }
-        if (named) {
-            argv.add("-n");
-            argv.add(sessionName);
-        }
-        if (resuming) {
-            argv.add("-r");
-            argv.add(resumeSessionId);
-            return resumeSessionId;
-        }
-        String minted = UUID.randomUUID().toString();
-        argv.add("--session-id");
-        argv.add(minted);
-        return minted;
-    }
-
-    /**
-     * The launch argv, plus an inline {@code --mcp-config} when {@code worker.mcpUrl} is set and
-     * {@code --append-system-prompt} when the base composed a charter. Neither touches the profile's
-     * config; both are pure command-line flags. This inline-flag mount is Claude Code specific —
-     * other adapters mount MCP and instructions their own way.
-     */
-    private List<String> argvWithBridge(BridgedConfig.Profile cfg, String charter) {
-        if (!cfg.hasMcp() && charter == null) {
-            return cfg.argv();
-        }
-        List<String> argv = mutableArgv(cfg.argv());
-        if (cfg.hasMcp()) {
-            String mcpJson = "{\"mcpServers\":{\"bridge\":{\"type\":\"http\",\"url\":\""
-                    + cfg.mcpUrl() + "\"}}}";
-            argv.add("--mcp-config");
-            argv.add(mcpJson);
-        }
-        if (charter != null) {
-            argv.add("--append-system-prompt");
-            argv.add(charter);
-        }
-        return argv;
-    }
-
-    /**
-     * Pin the model on the command line as well as in {@code ANTHROPIC_MODEL} (CB-533).
-     *
-     * <p>The env var alone is not a reliable pin for this adapter, because the argv is usually a
-     * launcher rather than {@code claude} itself — {@code ["ccs", "<profile>"]} — and {@code ccs}
-     * exports its profile's own model family ({@code ANTHROPIC_MODEL}, {@code DEFAULT_OPUS/SONNET/
-     * HAIKU}, {@code CLAUDE_CODE_SUBAGENT_MODEL}) over whatever it inherited. A worker profile that
-     * set {@code model:} therefore got silently overruled by its own launcher. Claude Code's
-     * {@code --model} flag outranks the environment, and {@code ccs <profile> [claude-args...]}
-     * passes trailing arguments through, so the flag survives the wrapper.
-     *
-     * <p>Appended last so it also outranks anything in the operator's own {@code argv}. Profiles
-     * that deliberately leave {@code model:} unset (letting {@code ccs} own model selection, as
-     * {@code gx10} does) are untouched — this adds nothing when there is nothing to add. This is
-     * the {@code kind: claude} counterpart of the opencode adapter's {@code -m provider/model}.
-     */
-    private static List<String> argvWithModel(List<String> argv, BridgedConfig.Profile cfg) {
-        if (cfg.model() == null || cfg.model().isBlank()) {
-            return argv;
-        }
-        List<String> withModel = mutableArgv(argv);
-        withModel.add("--model");
-        withModel.add(cfg.model());
-        return withModel;
-    }
-
-    // --- Agent-returning convenience spawns (used by callers/tests that want the herdr Agent) ---
-
-    /** Spawn a worker for the default profile in the resolved default cwd. */
-    public Agent spawn() {
-        return spawnInternal(null, null, null);
-    }
-
-    /** Spawn a worker for a named profile (null → default) in the resolved default cwd. */
-    public Agent spawn(String profileName) {
-        return spawnInternal(profileName, null, null);
-    }
-
-    /** Spawn a worker for a named profile with an explicit requested/caller cwd (CB-112). */
-    public Agent spawn(String profileName, String requestedCwd, String callerCwd) {
-        return spawnInternal(profileName, requestedCwd, callerCwd);
-    }
-
-    // --- capabilities --------------------------------------------------------------------------
-
-    @Override
-    public Set<Capability> capabilities() {
-        Set<Capability> caps = EnumSet.of(Capability.MID_TURN_ASK, Capability.WORKTREE,
-                Capability.CONTEXT_RESET, Capability.ORPHAN_REAP,
-                Capability.SESSION_NAME, Capability.SESSION_RESUME);
-        if (hasGitTokenProfile()) {
-            caps.add(Capability.SELF_PR);
-        }
-        return Set.copyOf(caps);
-    }
-
-    @Override
-    public boolean clearContext(String id) {
-        String target = agentTarget(id);
-        if (target == null) {
-            return false;
-        }
-        // This deliberately bypasses Injector: /clear is housekeeping, not a delegated turn.
-        agents().send(target, "/clear");
-        return true;
-    }
-
-    /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
-    private boolean hasGitTokenProfile() {
-        return profileConfigs().stream().anyMatch(BridgedConfig.Profile::hasGitToken);
-    }
-
-    // --- CB-117 reap predicate (Claude prefix), kept for direct unit testing -------------------
-
-    /**
-     * Whether {@code name} is a Claude Code bridge worker started by a <em>different</em> process
-     * than {@code currentNonce}. A thin {@code claude}-prefix binding of
-     * {@link HerdrPeerLauncher#isForeignWorker(String, String, String)}.
-     */
-    static boolean isForeignWorker(String name, String currentNonce) {
-        return HerdrPeerLauncher.isForeignWorker(NAME_PREFIX, name, currentNonce);
-    }
-}

bridged/src/main/java/dev/ltms/bridged/member/OpenCodeSessionDiscovery.java

@@ -1,122 +0,0 @@
-package dev.ltms.bridged.member;
-
-import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
-
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.stream.Stream;
-
-/**
- * Resolves the opencode session id for a bridged worker from opencode's on-disk storage — the
- * only place this adapter touches opencode's private layout, and deliberately the <em>only</em>
- * class that does.
- *
- * <p><strong>Why this is isolated behind one seam.</strong> The layout is version-coupled and not a
- * stable contract: opencode writes one JSON file per session under
- * {@code <storageRoot>/session/<projectID>/<ses_*.json>}, and each record carries a
- * {@code "version"} field (e.g. {@code "1.1.31"}), so the exact directory shape, file naming, and
- * field names can move between opencode releases. opencode also ships a headless HTTP server that
- * may supersede file scanning entirely. Everything this adapter knows about that private storage —
- * its shape, naming, and field names — lives here, so a layout change, or a switch to the HTTP
- * server, changes exactly one class and nothing in {@link OpenCodeLauncher}.
- *
- * <p>The determinism that makes this useful is structural, not a guess: every bridged worker runs
- * in its own unique git worktree, so the record's {@code directory} (its project root) equals the
- * worker's cwd identifies <em>its</em> session unambiguously. We match on {@code directory} rather
- * than diffing {@code opencode session list} before/after — that races under concurrent spawns, and
- * the CLI listing does not even show the directory.
- *
- * <p>All reads are best-effort and never throw: a missing or unreadable storage root, a record that
- * fails to parse, or a directory with no record yet all yield {@code null}, and the caller (the
- * session handle) treats that as "identity not resolved yet" and retries later.
- */
-final class OpenCodeSessionDiscovery {
-
-    private final Path storageRoot;   // e.g. ~/.local/share/opencode (injectable for tests)
-    private final ObjectMapper json;
-
-    OpenCodeSessionDiscovery(Path storageRoot) {
-        this.storageRoot = storageRoot;
-        this.json = new ObjectMapper();
-    }
-
-    /**
-     * The opencode session id whose record references {@code directory} (the worker's cwd), or
-     * {@code null} when no record matches yet. When several records share the directory — e.g.
-     * repeated spawns into the same worktree — the <em>most recently modified</em> one wins: it is
-     * the session the pane most likely corresponds to.
-     *
-     * <p>Never throws: a missing {@code storageRoot}, an unreadable/malformed record, or a
-     * directory that has not been persisted yet all resolve to {@code null} rather than failing a
-     * spawn. A bridged worker's session record is written lazily (when the session is first
-     * persisted), so {@code null} here is the normal answer right after the pane is ready, and the
-     * caller retries later.
-     *
-     * @param directory the worker's cwd, as resolved for this spawn
-     * @return the matching session id, or {@code null} if none is known yet
-     */
-    String sessionIdForDirectory(String directory) {
-        if (directory == null || directory.isBlank()) {
-            return null;
-        }
-        Path sessionRoot = storageRoot.resolve("session");
-        if (!Files.isDirectory(sessionRoot)) {
-            return null;
-        }
-        String best = null;
-        long bestMtime = Long.MIN_VALUE;
-        try (Stream<Path> projectDirs = Files.list(sessionRoot)) {
-            for (Path projectDir : projectDirs.filter(Files::isDirectory).toList()) {
-                try (Stream<Path> records = Files.list(projectDir)) {
-                    for (Path record : records.toList()) {
-                        String id = matchId(record, directory);
-                        if (id == null) {
-                            continue;
-                        }
-                        long mtime = lastModifiedEpochMillis(record);
-                        if (mtime > bestMtime) {
-                            bestMtime = mtime;
-                            best = id;
-                        }
-                    }
-                } catch (IOException ignored) {
-                    // one project dir unreadable — skip it; another may still match
-                }
-            }
-        } catch (IOException ignored) {
-            // storage root vanished or became unreadable — "no session known yet"
-            return null;
-        }
-        return best;
-    }
-
-    /**
-     * The record's session id when it references {@code directory}, else {@code null}. A record
-     * that is not JSON, lacks {@code id}/{@code directory}, or points at a different directory is
-     * simply not our session; a malformed one is skipped, never fatal.
-     */
-    private String matchId(Path record, String directory) {
-        try {
-            JsonNode node = json.readTree(record.toFile());
-            JsonNode id = node == null ? null : node.get("id");
-            JsonNode dir = node == null ? null : node.get("directory");
-            if (id == null || dir == null || !directory.equals(dir.asText())) {
-                return null;
-            }
-            return id.asText();
-        } catch (IOException e) {
-            return null;
-        }
-    }
-
-    /** The record's last-modified epoch ms, or {@code Long.MIN_VALUE} if unreadable (never wins). */
-    private static long lastModifiedEpochMillis(Path record) {
-        try {
-            return Files.getLastModifiedTime(record).toMillis();
-        } catch (IOException e) {
-            return Long.MIN_VALUE;
-        }
-    }
-}

bridged/src/main/java/dev/ltms/bridged/peer/PeerLauncher.java

@@ -1,107 +0,0 @@
-package dev.ltms.bridged.peer;
-
-import java.util.List;
-import java.util.Set;
-
-/**
- * SPI for materializing a connected peer — the only way the bridge core creates or tears down
- * a peer process. Every launcher is a first-party, in-tree adapter selected by (future) profile
- * config; today's single adapter is the {@code ClaudeCodeLauncher} / Claude Code over herdr.
- *
- * <p>The core delegates spawn and teardown to this interface without knowing how the peer is set
- * up. Environment variables, CLI flags, subscription guards, transport (herdr tab/pane) layout,
- * and naming conventions are all adapter-private — the core sees only the returned
- * {@link PeerHandle} whose {@code id()} is the registry/routing key.
- *
- * <p>The interface is a superset of what {@code SessionManager} and {@code Bridged.main} call
- * on the concrete launcher today.
- */
-public interface PeerLauncher {
-
-    /**
-     * The set of {@link Capability capabilities} this launcher declares. A peer whose profile
-     * opts into a git-forge token should include {@link Capability#SELF_PR}; the base set for
-     * the Claude Code herdr adapter is always {@code MID_TURN_ASK, WORKTREE, ORPHAN_REAP}.
-     */
-    Set<Capability> capabilities();
-
-    /**
-     * The capabilities of the adapter that {@code profileName} resolves to (null/blank → the
-     * default profile, the same resolution {@link #spawn} uses). Distinct from {@link
-     * #capabilities()}, which unions every configured adapter: a caller that must know whether
-     * <em>this</em> profile's backend supports a capability — e.g. {@link Capability#SESSION_RESUME}
-     * before honoring {@link SpawnRequest#resumeSessionId()} — needs the per-profile answer, not
-     * the fleet-wide union, or a mixed fleet could OK a resume that lands on a non-supporting
-     * adapter (CB-584).
-     *
-     * @throws IllegalArgumentException if the profile is unknown and no default is configured
-     */
-    Set<Capability> capabilitiesFor(String profileName);
-
-    /**
-     * {@code profileName}/requestedCwd null/blank → default resolution. Returns after the peer
-     * process is live (env + argv + placement complete). Never returns {@code null}.
-     *
-     * @param req the spawn parameters (profile, requested cwd, caller cwd)
-     * @return a handle whose {@link PeerHandle#id()} is the registry/routing key
-     * @throws IllegalArgumentException if the profile is unknown and no default is configured
-     */
-    PeerHandle spawn(SpawnRequest req);
-
-    /**
-     * The configured worker profile names — the set of names {@code spawn(profileName)} accepts.
-     */
-    Set<String> profiles();
-
-    /**
-     * The profile a no-argument {@link #spawn(SpawnRequest)} uses, or {@code null} if none is configured.
-     */
-    String defaultProfile();
-
-    /**
-     * Resolve the effective working directory for a spawn {@code req} without actually spawning.
-     * Resolution order: requestedCwd → profile cwd → callerCwd → daemon cwd.
-     *
-     * @return the resolved absolute path, never null/blank
-     */
-    String effectiveCwd(SpawnRequest req);
-
-    /**
-     * The parity-overlay file list for {@code profileName} (default list when unset). Used by
-     * worktree provisioning to copy config files into the isolated checkout before spawning.
-     */
-    List<String> parityOverlay(String profileName);
-
-    /**
-     * The set of all agents this launcher currently tracks, transport-specific. Each element
-     * exposes at minimum a pane-like {@code id()} matching this launcher's {@link PeerHandle}
-     * scheme, plus transport-level status. Callers merge this set with the session registry to
-     * build a live roster view.
-     */
-    List<?> list();
-
-    /**
-     * Reap orphaned peers left behind by a prior daemon process. Only peers whose naming scheme
-     * matches this launcher's and whose nonce differs from the current process are eligible.
-     * Best-effort: a failure to list or to stop any one peer is logged and never aborts startup.
-     *
-     * @return the number of orphaned peers reaped
-     */
-    int reapOrphanWorkers();
-
-    /**
-     * Tear a peer down by its registry/routing key ({@link PeerHandle#id()}). Tolerates an
-     * already-gone peer. Also cleans up launcher-private resources (e.g. empty dedicated tabs)
-     * when safe to do so.
-     */
-    void stop(String id);
-
-    /**
-     * Discard the context of the peer identified by {@code id}. Implementations must bypass normal
-     * bridge delivery/turn accounting. Unsupported peer kinds return {@code false} without sending
-     * a guessed command.
-     *
-     * @return {@code true} when a reset was sent and its status transition must settle before reuse
-     */
-    boolean clearContext(String id);
-}

bridged/src/main/java/dev/ltms/bridged/session/GitWorktrees.java

@@ -1,384 +0,0 @@
-package dev.ltms.bridged.session;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.BufferedReader;
-import java.io.IOException;
-import java.io.InputStreamReader;
-import java.io.UncheckedIOException;
-import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.StandardCopyOption;
-import java.security.SecureRandom;
-import java.util.List;
-import java.util.Map;
-import java.util.Optional;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicLong;
-import java.util.stream.Collectors;
-
-/**
- * Production {@link Worktrees} implementation that shells {@code git} via {@link ProcessBuilder}.
- * Non-zero exits become {@link WorktreeException}. Worktree directories live under a configurable
- * root (default: a sibling {@code .bridged-worktrees} of the repo root) so they are never nested
- * inside the primary working tree.
- */
-public final class GitWorktrees implements Worktrees {
-
-    private static final Logger log = LoggerFactory.getLogger(GitWorktrees.class);
-
-    /** Project-level MCP config. Present in the repo, so every worktree would otherwise inherit the
-     *  primary's IDE server mounts (a CB-523 worker edited the primary checkout; see the isolation
-     *  javadoc). Neutralized unconditionally. */
-    private static final String MCP_CONFIG = ".mcp.json";
-
-    /** What {@link #isolateToolSurface} writes for {@code .mcp.json}: a valid, explicitly empty server map. */
-    private static final String NEUTRAL_MCP_CONFIG = "{\n  \"mcpServers\": {}\n}\n";
-
-    /** OpenCode's repo-level config. Tracked here, so it lands in every worktree, and it mounts the
-     *  primary's gitea and context7 servers with the primary's credentials. Neutralized so the worker
-     *  gets only the config its launcher writes via {@code OPENCODE_CONFIG}.
-     *
-     *  <p>The reason has changed shape and is now stronger. It used to be a crash: the file carried
-     *  {@code {file:.secrets/...}} references to gitignored files that never reached a worktree, and
-     *  opencode refuses to start on a dangling reference (CB-543). Those credentials now live in one
-     *  shell-level store and the file reads them as {@code {env:...}}, so in a worktree the reference
-     *  resolves instead of failing. That is worse, not better: a member would silently inherit the
-     *  primary's admin-scoped {@code GITEA_ACCESS_TOKEN}. A loud crash became a quiet privilege leak,
-     *  so this entry protects a boundary now rather than papering over a startup error. */
-    private static final String OPENCODE_CONFIG = "opencode.json";
-
-    /** What {@link #isolateToolSurface} writes for {@code opencode.json}: a valid, empty JSON object. */
-    private static final String NEUTRAL_OPENCODE_CONFIG = "{}\n";
-
-    /** Autoenv's repo-level config. Not tracked today, but re-landing it must stay safe: autoenv
-     *  authorizes by path, so a fresh worktree path is always unauthorized and its interactive prompt
-     *  would block every spawn — neutralize it so it can never be committed. */
-    private static final String AUTOENV_CONFIG = ".autoenv";
-
-    /** What {@link #isolateToolSurface} writes for {@code .autoenv}: a valid, empty env file. */
-    private static final String NEUTRAL_AUTOENV_CONFIG = "";
-
-    /**
-     * A tracked project config that is hostile in a provisioned worktree, and what to replace it
-     * with. {@link #file} is the repo-relative path; {@link #stub} is a neutral but VALID payload for
-     * that file's format — a malformed stub would only trade one crash for another;
-     * {@link #createIfAbsent} keeps {@code .mcp.json}'s long-standing behaviour of writing its stub
-     * even when the repo carries no such file, whereas the others are only touched when present.
-     */
-    private record WorktreeHostileConfig(String file, String stub, boolean createIfAbsent) {}
-
-    /** The worktree-hostile configs neutralized in every provisioned worktree, in order. */
-    private static final List<WorktreeHostileConfig> WORKTREE_HOSTILE_CONFIGS = List.of(
-            new WorktreeHostileConfig(MCP_CONFIG, NEUTRAL_MCP_CONFIG, true),
-            new WorktreeHostileConfig(OPENCODE_CONFIG, NEUTRAL_OPENCODE_CONFIG, false),
-            new WorktreeHostileConfig(AUTOENV_CONFIG, NEUTRAL_AUTOENV_CONFIG, false)
-    );
-
-    private final String configuredRoot;
-    private final SecureRandom random = new SecureRandom();
-    private final AtomicLong seq = new AtomicLong();
-
-    /** Default constructor: worktree root is derived per-repo as {@code <repoRoot>/../.bridged-worktrees}. */
-    public GitWorktrees() {
-        this(null);
-    }
-
-    /** @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of the repo root. */
-    public GitWorktrees(String configuredRoot) {
-        this.configuredRoot = configuredRoot;
-    }
-
-    @Override
-    public String add(String repoRoot, String branch, String baseRef) {
-        String base = (baseRef == null || baseRef.isBlank()) ? "HEAD" : baseRef;
-        String nonce = nonce();
-        Path root = resolveRoot(repoRoot);
-        Path path = root.resolve(nonce);
-        try {
-            Files.createDirectories(root);
-        } catch (IOException e) {
-            throw new WorktreeException("cannot create worktree root " + root + ": " + e.getMessage(), e);
-        }
-        String wt = path.toAbsolutePath().toString();
-        log.info("adding worktree branch={} path={} base={}", branch, wt, base);
-        exec("git", "-C", repoRoot, "worktree", "add", wt, "-b", branch, base);
-        isolateToolSurface(wt);
-        return wt;
-    }
-
-    /**
-     * Neutralize the worktree's worktree-hostile project configs so a worker inherits only the tools
-     * and environment its launcher mounts (the bridge via {@code --mcp-config}, the opencode config
-     * via {@code OPENCODE_CONFIG}) — never the primary's.
-     *
-     * <p>This is unconditional, and it is not the same job as the parity overlay. The repo's own
-     * committed {@code .mcp.json} declares the primary's IDE servers, so a fresh checkout mounts them
-     * whether or not the overlay copies anything; a worker that inherits them navigates and edits
-     * through tools bound to the <em>primary's</em> IntelliJ project, which silently hands it absolute
-     * paths outside its own worktree. That is not hypothetical: a CB-523 worker made all 59 of its
-     * edits in the primary checkout while compiling its worktree, so every build it ran was of code
-     * that did not contain its changes. {@code opencode.json} is the same trap one tool over — tracked,
-     * so it lands in every worktree, and it mounts gitea and context7 with the primary's own
-     * credentials, which a member must never hold. {@code .autoenv} extends the principle to a
-     * config that is not tracked today: autoenv authorizes by path, so a fresh worktree path is always
-     * unauthorized and its interactive prompt would block every spawn, so re-landing one must be safe.
-     *
-     * <p>Where a config exists it is replaced by a valid neutral stub (an explicitly empty
-     * map/object, or an empty env file — never a deletion, which would still let a later
-     * {@code git checkout} restore the hostile copy). The {@code --skip-worktree} bit keeps the
-     * neutralized copy from ever showing up as a local modification the worker might commit. A config
-     * the repo does not carry is skipped silently — no stub is invented for a file the repo does not
-     * have, and one missing file must never fail provisioning.
-     */
-    private void isolateToolSurface(String worktreePath) {
-        Path root = Path.of(worktreePath).toAbsolutePath().normalize();
-        for (WorktreeHostileConfig cfg : WORKTREE_HOSTILE_CONFIGS) {
-            neutralize(root, worktreePath, cfg);
-        }
-    }
-
-    private void neutralize(Path root, String worktreePath, WorktreeHostileConfig cfg) {
-        Path target = root.resolve(cfg.file());
-        if (!Files.exists(target) && !cfg.createIfAbsent()) {
-            log.debug("{} absent in the worktree — skipping (repo does not carry it)", cfg.file());
-            return;
-        }
-        try {
-            Files.writeString(target, cfg.stub());
-        } catch (IOException e) {
-            throw new WorktreeException("cannot neutralize " + cfg.file() + " in the worktree: "
-                    + e.getMessage(), e);
-        }
-        if (isTracked(root, cfg.file())) {
-            exec("git", "-C", worktreePath, "update-index", "--skip-worktree", cfg.file());
-        }
-        log.debug("neutralized {} — worker tool surface is launcher-mounted only", cfg.file());
-    }
-
-    @Override
-    public void remove(String repoRoot, String worktreePath) {
-        Path p = Path.of(worktreePath);
-        if (!Files.exists(p)) {
-            log.debug("worktree {} already gone — nothing to remove", worktreePath);
-            return;
-        }
-        log.info("removing worktree {}", worktreePath);
-        exec("git", "-C", repoRoot, "worktree", "remove", "--force", worktreePath);
-    }
-
-    @Override
-    public boolean hasUncommitted(String worktreePath) {
-        // A worktree that is already gone holds no work to lose, and it must not break teardown:
-        // git -C <missing-dir> status exits non-zero and would throw where release() is mid-way
-        // through stopping a pane. Mirror remove()'s already-gone tolerance by treating it as clean.
-        Path p = Path.of(worktreePath);
-        if (!Files.exists(p)) {
-            log.debug("worktree {} already gone — nothing can be uncommitted", worktreePath);
-            return false;
-        }
-        // No --untracked-files=no: the exact shape of the work lost in CB-576 was a new file
-        // that was never added, so an untracked-only worktree is still dirty.
-        String out = exec("git", "-C", worktreePath, "status", "--porcelain");
-        return !out.isBlank();
-    }
-
-    @Override
-    public void overlayParity(String repoRoot, String worktreePath, List<String> overlay) {
-        if (overlay == null || overlay.isEmpty()) {
-            return;
-        }
-        Path srcRoot = Path.of(repoRoot).toAbsolutePath().normalize();
-        Path dstRoot = Path.of(worktreePath).toAbsolutePath().normalize();
-        for (String rel : overlay) {
-            Path src = srcRoot.resolve(rel).normalize();
-            if (!Files.exists(src)) {
-                log.debug("parity overlay source missing — skipping {}", rel);
-                continue;
-            }
-            Path dst = dstRoot.resolve(rel).normalize();
-            try {
-                Files.createDirectories(dst.getParent());
-                Files.copy(src, dst, StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.COPY_ATTRIBUTES);
-                log.debug("copied parity overlay {}", rel);
-            } catch (IOException e) {
-                throw new WorktreeException("cannot copy overlay " + rel + ": " + e.getMessage(), e);
-            }
-            if (isTracked(dstRoot, rel)) {
-                exec("git", "-C", worktreePath, "update-index", "--skip-worktree", rel);
-                log.debug("marked overlay --skip-worktree {}", rel);
-            }
-        }
-    }
-
-    @Override
-    public String repoRoot(String cwd) {
-        String out = exec("git", "-C", cwd, "rev-parse", "--show-toplevel");
-        return Path.of(out.trim()).toAbsolutePath().normalize().toString();
-    }
-
-    /**
-     * CB-578 stage C, fixed by CB-587. Stages into a <em>temporary</em> index (never the worktree's
-     * real one, which the worker may still be writing to) — but that temp index is first <em>seeded</em>
-     * from the worktree's real one, rather than starting empty:
-     *
-     * <pre>
-     * cp $(git -C worktree rev-parse --git-path index) &lt;temp&gt;
-     * GIT_INDEX_FILE=&lt;temp&gt; git -C worktree add -A
-     * tree=$(GIT_INDEX_FILE=&lt;temp&gt; git -C worktree write-tree)
-     * commit=$(git -C worktree commit-tree $tree -p HEAD -m message)
-     * git -C worktree update-ref refs/wip/branch $commit
-     * </pre>
-     *
-     * A fresh empty index carries none of the real index's {@code --skip-worktree} /
-     * {@code --assume-unchanged} bits, so {@code add -A} into it stages a skip-worktree file's local
-     * on-disk content even though {@code git status --porcelain} correctly hides that file (CB-587).
-     * Seeding from the real index preserves those bits, so {@code add -A} then skips exactly what
-     * {@code git status} skips. {@code add -A} (never {@code -f}) also still respects
-     * {@code .gitignore} exactly as it would in the real index — a gitignored file staying ignored is
-     * what keeps secrets and local config out of the snapshot's tree. The temporary index file is
-     * removed afterwards regardless of outcome; the worker's real index is never opened for writing.
-     */
-    @Override
-    public Optional<String> snapshot(String worktreePath, String branch, String message) {
-        if (!Files.exists(Path.of(worktreePath))) {
-            log.debug("worktree {} already gone — nothing to snapshot", worktreePath);
-            return Optional.empty();
-        }
-        Path tempIndex;
-        try {
-            tempIndex = Files.createTempFile("bridged-wip-index-", ".tmp");
-        } catch (IOException e) {
-            throw new WorktreeException("cannot create a temporary index for snapshot: " + e.getMessage(), e);
-        }
-        Map<String, String> indexEnv = Map.of("GIT_INDEX_FILE", tempIndex.toAbsolutePath().toString());
-        try {
-            Path realIndex = resolveRealIndex(worktreePath);
-            try {
-                Files.copy(realIndex, tempIndex, StandardCopyOption.REPLACE_EXISTING);
-            } catch (IOException e) {
-                throw new WorktreeException("cannot copy the worktree's real index (" + realIndex
-                        + ") into the temporary snapshot index: " + e.getMessage(), e);
-            }
-            exec(indexEnv, "git", "-C", worktreePath, "add", "-A");
-            String tree = exec(indexEnv, "git", "-C", worktreePath, "write-tree").trim();
-            String commit = exec("git", "-C", worktreePath, "commit-tree", tree, "-p", "HEAD", "-m", message).trim();
-            exec("git", "-C", worktreePath, "update-ref", "refs/wip/" + branch, commit);
-            log.info("snapshotted worktree {} to refs/wip/{} commit={}", worktreePath, branch, commit);
-            return Optional.of(commit);
-        } finally {
-            try {
-                Files.deleteIfExists(tempIndex);
-            } catch (IOException e) {
-                log.debug("could not delete temporary snapshot index {}: {}", tempIndex, e.getMessage());
-            }
-        }
-    }
-
-    /**
-     * Resolve the path of {@code worktreePath}'s real index. Never assume {@code <worktree>/.git/index}:
-     * in a linked worktree {@code .git} is a <em>file</em> pointing at the main repo's
-     * {@code worktrees/<name>/} directory, and that is where the real per-worktree index lives.
-     * {@code git rev-parse --git-path index} resolves this correctly for both a linked worktree and
-     * the main checkout. Throws {@link WorktreeException} — same as every other failure in this
-     * class — if the command fails or the resolved path does not exist, rather than silently
-     * snapshotting from an empty index.
-     */
-    private Path resolveRealIndex(String worktreePath) {
-        String out = exec("git", "-C", worktreePath, "rev-parse", "--git-path", "index").trim();
-        Path index = Path.of(out);
-        if (!index.isAbsolute()) {
-            index = Path.of(worktreePath).resolve(index).normalize();
-        }
-        if (!Files.exists(index)) {
-            throw new WorktreeException("worktree's real index not found at resolved path " + index
-                    + " (git rev-parse --git-path index reported '" + out + "')");
-        }
-        return index;
-    }
-
-    /** Resolve the directory that will hold per-session worktree checkouts. */
-    private Path resolveRoot(String repoRoot) {
-        if (configuredRoot != null && !configuredRoot.isBlank()) {
-            return Path.of(configuredRoot).toAbsolutePath().normalize();
-        }
-        Path repo = Path.of(repoRoot).toAbsolutePath().normalize();
-        return repo.resolveSibling(".bridged-worktrees");
-    }
-
-    private String nonce() {
-        return String.format("%06x", random.nextInt(1 << 24)) + "-" + seq.incrementAndGet();
-    }
-
-    private boolean isTracked(Path worktreeRoot, String rel) {
-        return exitCode("git", "-C", worktreeRoot.toString(), "ls-files", "--error-unmatch", rel) == 0;
-    }
-
-    /**
-     * Run a command and return its stdout. Non-zero exit → {@link WorktreeException} with both
-     * stdout and stderr (merged by redirectErrorStream).
-     */
-    private String exec(String... command) {
-        return exec(Map.of(), command);
-    }
-
-    /** Same as {@link #exec(String...)}, with extra environment variables set on the child process. */
-    private String exec(Map<String, String> extraEnv, String... command) {
-        String out;
-        int code;
-        Process p;
-        try {
-            ProcessBuilder pb = new ProcessBuilder(command).redirectErrorStream(true);
-            if (extraEnv != null && !extraEnv.isEmpty()) {
-                pb.environment().putAll(extraEnv);
-            }
-            p = pb.start();
-        } catch (IOException e) {
-            throw new WorktreeException("failed to start " + command[0] + ": " + e.getMessage(), e);
-        }
-        try (BufferedReader r = new BufferedReader(new InputStreamReader(p.getInputStream(), StandardCharsets.UTF_8))) {
-            out = r.lines().collect(Collectors.joining("\n"));
-        } catch (IOException e) {
-            p.destroyForcibly();
-            throw new UncheckedIOException(e);
-        }
-        try {
-            if (!p.waitFor(30, TimeUnit.SECONDS)) {
-                p.destroyForcibly();
-                throw new WorktreeException("command timed out: " + String.join(" ", command) + "\n" + out);
-            }
-            code = p.exitValue();
-        } catch (InterruptedException e) {
-            p.destroyForcibly();
-            Thread.currentThread().interrupt();
-            throw new WorktreeException("interrupted waiting for command: " + String.join(" ", command), e);
-        }
-        if (code != 0) {
-            throw new WorktreeException("exit " + code + " for: " + String.join(" ", command)
-                    + (out.isBlank() ? "" : "\n" + out));
-        }
-        return out;
-    }
-
-    private int exitCode(String... command) {
-        Process p;
-        try {
-            p = new ProcessBuilder(command).redirectErrorStream(true).start();
-        } catch (IOException e) {
-            throw new WorktreeException("failed to start " + command[0] + ": " + e.getMessage(), e);
-        }
-        try {
-            if (!p.waitFor(30, TimeUnit.SECONDS)) {
-                p.destroyForcibly();
-                throw new WorktreeException("command timed out: " + String.join(" ", command));
-            }
-            return p.exitValue();
-        } catch (InterruptedException e) {
-            p.destroyForcibly();
-            Thread.currentThread().interrupt();
-            throw new WorktreeException("interrupted waiting for command: " + String.join(" ", command), e);
-        }
-    }
-}

bridged/src/main/java/dev/ltms/bridged/session/SessionReaper.java

@@ -1,70 +0,0 @@
-package dev.ltms.bridged.session;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.concurrent.TimeUnit;
-
-/**
- * Periodic virtual-thread reaper that tears down {@code READY}/{@code DONE} sessions which have
- * exceeded their idle TTL. Modeled on {@link dev.ltms.bridged.inject.StatusPoller}: a single
- * virtual-thread loop, idempotent start/stop, and no {@code ScheduledExecutorService}.
- */
-public final class SessionReaper {
-
-    private static final Logger log = LoggerFactory.getLogger(SessionReaper.class);
-    private static final long DEFAULT_INTERVAL_MILLIS = 5000;
-
-    private final SessionManager sessions;
-    private final long idleTtlNanos;
-    private final long intervalMillis;
-    private volatile boolean running;
-    private Thread thread;
-
-    /** Construct a reaper with the default 5-second polling interval. */
-    public SessionReaper(SessionManager sessions, long idleTtlSeconds) {
-        this(sessions, idleTtlSeconds, DEFAULT_INTERVAL_MILLIS);
-    }
-
-    /** Construct a reaper with an explicit polling interval (useful for tests). */
-    public SessionReaper(SessionManager sessions, long idleTtlSeconds, long intervalMillis) {
-        this.sessions = sessions;
-        this.idleTtlNanos = TimeUnit.SECONDS.toNanos(idleTtlSeconds);
-        this.intervalMillis = intervalMillis;
-    }
-
-    /** Start the reaper loop on a virtual thread. Idempotent. */
-    public synchronized void start() {
-        if (running) return;
-        running = true;
-        thread = Thread.ofVirtual().name("session-reaper").start(this::loop);
-        log.info("session reaper started (idle ttl {}s, interval {}ms)",
-                TimeUnit.NANOSECONDS.toSeconds(idleTtlNanos), intervalMillis);
-    }
-
-    private void loop() {
-        while (running) {
-            try {
-                sessions.reapIdle(idleTtlNanos);
-            } catch (RuntimeException e) {
-                log.warn("session reaper iteration failed; continuing", e);
-            }
-            sleep();
-        }
-    }
-
-    private void sleep() {
-        try {
-            Thread.sleep(intervalMillis);
-        } catch (InterruptedException e) {
-            Thread.currentThread().interrupt();
-            running = false;
-        }
-    }
-
-    /** Stop the reaper loop. Idempotent. */
-    public synchronized void stop() {
-        running = false;
-        if (thread != null) thread.interrupt();
-    }
-}

bridged/src/test/java/dev/ltms/bridged/health/FleetHealthMonitorTest.java

@@ -1,170 +0,0 @@
-package dev.ltms.bridged.health;
-
-import ch.qos.logback.classic.Logger;
-import ch.qos.logback.classic.spi.ILoggingEvent;
-import ch.qos.logback.core.read.ListAppender;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.FakeHerdr;
-import dev.ltms.bridged.inject.Injector;
-import dev.ltms.bridged.msg.InMemoryReplyInbox;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.member.ClaudeCodeLauncher;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.config.BridgedConfig;
-import org.junit.jupiter.api.Test;
-import org.slf4j.LoggerFactory;
-
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.Executors;
-import java.util.function.BiConsumer;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-class FleetHealthMonitorTest {
-    @Test void oneTickUsesOneFleetListForAnyRosterSize() {
-        FakeHerdr herdr = new FakeHerdr();
-        AgentControl agents = new AgentControl(herdr);
-        BridgedConfig.Profile profile = new BridgedConfig.Profile("test", "http://test:1", null,
-                null, null, null, null, null, null, null, null, null);
-        ClaudeCodeLauncher launcher = new ClaudeCodeLauncher(agents, new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("test")), Map.of("test", profile), "test", _ -> "token");
-        SessionManager sessions = new SessionManager(launcher);
-        sessions.acquire("test", null, null, null);
-        sessions.acquire("test", null, null, null);
-        herdr.calls.clear();
-        MessageService messages = new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox());
-        var scheduler = Executors.newSingleThreadScheduledExecutor();
-        FleetHealthMonitor monitor = new FleetHealthMonitor(agents, sessions::roster, messages, scheduler, () -> 1, 60,
-                (_, _) -> { });
-        monitor.tick();
-        monitor.stop();
-        assertEquals(1, herdr.calls.stream().filter(call -> call.method().equals("agent.list")).count());
-    }
-
-    @Test void failedTickDoesNotStopTheNextTick() {
-        FakeHerdr herdr = new FakeHerdr().healthy(false);
-        AgentControl agents = new AgentControl(herdr);
-        var scheduler = Executors.newSingleThreadScheduledExecutor();
-        FleetHealthMonitor monitor = new FleetHealthMonitor(agents, java.util.List::of,
-                new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
-                scheduler, () -> 1, 60, (_, _) -> { });
-        monitor.tick();
-        herdr.healthy(true);
-        monitor.tick();
-        monitor.stop();
-        assertEquals(2, herdr.calls.stream().filter(call -> call.method().equals("agent.list")).count());
-    }
-
-    @Test void faultTransitionLogsOnlyOnceUntilItChanges() {
-        Logger logger = (Logger) LoggerFactory.getLogger(FleetHealthMonitor.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.start();
-        logger.addAppender(appender);
-        try {
-            FakeHerdr herdr = new FakeHerdr();
-            AgentControl agents = new AgentControl(herdr);
-            var scheduler = Executors.newSingleThreadScheduledExecutor();
-            FleetHealthMonitor monitor = new FleetHealthMonitor(agents, java.util.List::of,
-                    new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
-                    scheduler, () -> 1, 60, (_, _) -> { });
-            monitor.reportTransition("term_a", HealthState.TURN_BOUNDARY_LOST);
-            monitor.reportTransition("term_a", HealthState.TURN_BOUNDARY_LOST);
-            monitor.stop();
-            assertEquals(1, appender.list.stream().filter(event -> event.getFormattedMessage()
-                    .contains("member=term_a state=TURN_BOUNDARY_LOST")).count());
-        } finally {
-            logger.detachAppender(appender);
-        }
-    }
-
-    // --- CB-580: a member that reaches GONE/NEVER_READY must fail its waiting tickets
-
-    private static FleetHealthMonitor monitorWith(BiConsumer<String, String> failTarget) {
-        FakeHerdr herdr = new FakeHerdr();
-        AgentControl agents = new AgentControl(herdr);
-        var scheduler = Executors.newSingleThreadScheduledExecutor();
-        return new FleetHealthMonitor(agents, java.util.List::of,
-                new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
-                scheduler, () -> 1, 60, failTarget);
-    }
-
-    @Test void terminalTransitionFailsTheTargetOnce() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.stop();
-        assertEquals(1, failTarget.calls.size());
-        assertEquals("term_a", failTarget.calls.get(0).target());
-        assertTrue(failTarget.calls.get(0).reason().contains("GONE"));
-    }
-
-    @Test void neverReadyNamesItselfAsTheReason() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.NEVER_READY);
-        monitor.stop();
-        assertEquals(1, failTarget.calls.size());
-        assertTrue(failTarget.calls.get(0).reason().contains("NEVER_READY"));
-    }
-
-    @Test void stayingInATerminalStateProducesOneFailureNotN() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.stop();
-        assertEquals(1, failTarget.calls.size());
-    }
-
-    @Test void aNonTerminalFaultStateDoesNotFailTheTarget() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.TURN_BOUNDARY_LOST);
-        monitor.stop();
-        assertEquals(0, failTarget.calls.size());
-    }
-
-    @Test void failTargetRetryIsBounded() {
-        AlwaysThrowingFailTarget failTarget = new AlwaysThrowingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.stop();
-        assertEquals(FleetHealthMonitor.MAX_FAIL_TARGET_ATTEMPTS, failTarget.calls);
-    }
-
-    @Test void exhaustedRetryStillDoesNotRefireOnAnUnchangedTick() {
-        AlwaysThrowingFailTarget failTarget = new AlwaysThrowingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        int afterFirstTransition = failTarget.calls;
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.stop();
-        assertEquals(afterFirstTransition, failTarget.calls);
-    }
-
-    private record RecordedCall(String target, String reason) { }
-
-    private static final class RecordingFailTarget implements BiConsumer<String, String> {
-        final java.util.List<RecordedCall> calls = new java.util.ArrayList<>();
-
-        @Override public void accept(String target, String reason) {
-            calls.add(new RecordedCall(target, reason));
-        }
-    }
-
-    private static final class AlwaysThrowingFailTarget implements BiConsumer<String, String> {
-        int calls = 0;
-
-        @Override public void accept(String target, String reason) {
-            calls++;
-            throw new RuntimeException("boom");
-        }
-    }
-}

bridged/src/test/java/dev/ltms/bridged/herdr/PaneLocatorTest.java

@@ -1,27 +0,0 @@
-package dev.ltms.bridged.herdr;
-
-import org.junit.jupiter.api.Test;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/** Unit tests for PID → pane resolution (the herdr half of connection-based MCP identity). */
-class PaneLocatorTest {
-
-    private final PaneLocator loc = new PaneLocator(new FakeHerdr());
-
-    @Test
-    void resolvesTerminalForAForegroundPid() {
-        assertEquals("term_a", loc.terminalForPid(FakeHerdr.WORKER_PID));
-    }
-
-    @Test
-    void nullForAPidInNoPane() {
-        assertNull(loc.terminalForPid(999_999));
-    }
-
-    @Test
-    void nullForNonPositivePid() {
-        assertNull(loc.terminalForPid(0));
-        assertNull(loc.terminalForPid(-1));
-    }
-}

bridged/src/test/java/dev/ltms/bridged/member/OpenCodeSessionDiscoveryTest.java

@@ -1,90 +0,0 @@
-package dev.ltms.bridged.member;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.attribute.FileTime;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * {@link OpenCodeSessionDiscovery} matches an opencode session record by the worker's cwd (its
- * {@code directory}) against opencode's on-disk storage. These tests populate a TEMP storage root
- * themselves — never the operator's real {@code ~/.local/share/opencode}.
- */
-class OpenCodeSessionDiscoveryTest {
-
-    /**
-     * Write a session record {@code {"id":..., "directory":...}} under
-     * {@code <root>/session/<projectID>/<fileName>} and stamp it with a known last-modified time,
-     * so "most recently modified wins" is deterministic. Static so the launcher test can reuse it.
-     */
-    static void writeRecord(Path root, String projectId, String fileName, String id,
-                            String directory, long lastModifiedEpochMillis) throws Exception {
-        Path dir = root.resolve("session").resolve(projectId);
-        Files.createDirectories(dir);
-        Path file = dir.resolve(fileName);
-        Files.writeString(file, "{\"id\":\"" + id + "\",\"directory\":\"" + directory
-                + "\",\"projectID\":\"" + projectId + "\",\"version\":\"1.1.31\"}");
-        Files.setLastModifiedTime(file, FileTime.fromMillis(lastModifiedEpochMillis));
-    }
-
-    @Test
-    void findsTheRecordWhoseDirectoryEqualsTheCwd(@TempDir Path root) throws Exception {
-        writeRecord(root, "p1", "ses_a.json", "ses_aaa", "/w/a", 1000L);
-        writeRecord(root, "p2", "ses_b.json", "ses_bbb", "/w/b", 2000L);
-
-        assertEquals("ses_bbb", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/b"),
-                "the record whose directory equals the cwd is the one found");
-        assertEquals("ses_aaa", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"));
-    }
-
-    @Test
-    void aNonMatchingDirectoryYieldsNullRatherThanAMismatch(@TempDir Path root) throws Exception {
-        writeRecord(root, "p1", "ses_a.json", "ses_aaa", "/w/a", 1000L);
-
-        assertNull(new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/other"),
-                "no record for this cwd yet → null, not a wrong session");
-    }
-
-    @Test
-    void prefersTheMostRecentlyModifiedRecordWhenSeveralMatch(@TempDir Path root) throws Exception {
-        writeRecord(root, "p1", "old.json", "ses_old", "/w/a", 1000L);
-        writeRecord(root, "p2", "new.json", "ses_new", "/w/a", 5000L);
-
-        assertEquals("ses_new", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"),
-                "the freshest record for the cwd wins");
-    }
-
-    @Test
-    void aMissingOrEmptyStorageRootYieldsNullWithoutThrowing(@TempDir Path root) throws Exception {
-        // Missing: no session dir at all under the root.
-        assertNull(new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"));
-
-        // Present but empty: a session dir with nothing in it produces no match, not a throw.
-        Path emptyRoot = root.resolve("empty");
-        Files.createDirectories(emptyRoot.resolve("session"));
-        assertNull(new OpenCodeSessionDiscovery(emptyRoot).sessionIdForDirectory("/w/a"));
-    }
-
-    @Test
-    void aBlankOrNullDirectoryYieldsNull(@TempDir Path root) {
-        OpenCodeSessionDiscovery discovery = new OpenCodeSessionDiscovery(root);
-        assertNull(discovery.sessionIdForDirectory(null));
-        assertNull(discovery.sessionIdForDirectory("   "));
-    }
-
-    @Test
-    void aMalformedRecordIsSkippedRatherThanFatal(@TempDir Path root) throws Exception {
-        // A record that fails to parse must not abort the scan of its siblings.
-        Path dir = root.resolve("session").resolve("p1");
-        Files.createDirectories(dir);
-        Files.writeString(dir.resolve("broken.json"), "{not valid json");
-        writeRecord(root, "p1", "good.json", "ses_good", "/w/a", 1000L);
-
-        assertEquals("ses_good", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"),
-                "an unreadable record is skipped; a later valid one still matches");
-    }
-}

bridged/src/test/java/dev/ltms/bridged/session/GitWorktreesTest.java

@@ -1,477 +0,0 @@
-package dev.ltms.bridged.session;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Optional;
-import java.util.Set;
-import java.util.concurrent.TimeUnit;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * CB-525 acceptance test for tool-surface isolation. This is one of the few tests that drives real
- * {@code git} — the behaviour under test is precisely what {@link GitWorktrees} does to a checkout,
- * so a fake would assert nothing. Everything happens inside a {@link TempDir} throwaway repo.
- */
-class GitWorktreesTest {
-
-    /** A project MCP config with servers in it — what this repo actually commits. */
-    private static final String WITH_SERVERS = """
-            {
-              "mcpServers": {
-                "jetbrains": { "type": "sse", "url": "http://localhost:64342/sse" }
-              }
-            }
-            """;
-
-    /** An opencode config carrying a {@code {file:.secrets/...}} reference — CB-543's crash repro. */
-    private static final String OPENCODE_WITH_FILE_REF = """
-            {
-              "env": {
-                "CONTEXT7_TOKEN": "{file:.secrets/context7-token}"
-              }
-            }
-            """;
-
-    /** A non-empty autoenv file — the form that would prompt for authorization in a worktree. */
-    private static final String AUTOENV_WITH_DIRECTIVE = "export HELLO=world\n";
-
-    private static Path initRepo(Path dir) throws Exception {
-        Files.createDirectories(dir);
-        git(dir, "init", "-q", "-b", "main");
-        git(dir, "config", "user.email", "test@example.invalid");
-        git(dir, "config", "user.name", "Test");
-        Files.writeString(dir.resolve(".mcp.json"), WITH_SERVERS);
-        Files.writeString(dir.resolve("README.md"), "seed\n");
-        git(dir, "add", ".mcp.json", "README.md");
-        git(dir, "commit", "-q", "-m", "seed");
-        return dir;
-    }
-
-    private static void git(Path cwd, String... args) throws Exception {
-        List<String> cmd = new java.util.ArrayList<>(List.of("git"));
-        cmd.addAll(List.of(args));
-        Process p = new ProcessBuilder(cmd).directory(cwd.toFile()).redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git timed out: " + String.join(" ", cmd));
-        assertEquals(0, p.exitValue(), "git " + String.join(" ", args) + " failed:\n" + out);
-    }
-
-    /** Pending changes to {@code file} in {@code cwd}, empty when git considers it unmodified. */
-    private static String status(Path cwd, String file) throws Exception {
-        Process p = new ProcessBuilder("git", "status", "--porcelain", "--", file)
-                .directory(cwd.toFile()).redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git status timed out");
-        return out;
-    }
-
-    /** Every pending change in {@code cwd} — the whole-tree porcelain status, unlike {@link #status}. */
-    private static String fullStatus(Path cwd) throws Exception {
-        Process p = new ProcessBuilder("git", "status", "--porcelain")
-                .directory(cwd.toFile()).redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git status timed out");
-        return out;
-    }
-
-    private static String revParse(Path cwd, String ref) throws Exception {
-        Process p = new ProcessBuilder("git", "-C", cwd.toString(), "rev-parse", ref)
-                .redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes()).trim();
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git rev-parse timed out");
-        assertEquals(0, p.exitValue(), "git rev-parse " + ref + " failed:\n" + out);
-        return out;
-    }
-
-    /** The recursive file list of a commit's tree — used to check what a snapshot actually committed. */
-    private static String lsTree(Path cwd, String ref) throws Exception {
-        Process p = new ProcessBuilder("git", "-C", cwd.toString(), "ls-tree", "-r", "--name-only", ref)
-                .redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git ls-tree timed out");
-        assertEquals(0, p.exitValue(), "git ls-tree " + ref + " failed:\n" + out);
-        return out;
-    }
-
-    /** The set of paths in {@code git diff --name-only from..to} — used to check exactly what a
-     *  snapshot's tree changed relative to its parent, the same shape {@code git status --porcelain}
-     *  reports for the worktree it was taken from. */
-    private static Set<String> diffNameOnly(Path cwd, String from, String to) throws Exception {
-        Process p = new ProcessBuilder("git", "-C", cwd.toString(), "diff", "--name-only", from, to)
-                .redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git diff timed out");
-        assertEquals(0, p.exitValue(), "git diff " + from + ".." + to + " failed:\n" + out);
-        Set<String> paths = new HashSet<>();
-        for (String line : out.split("\\R")) {
-            if (!line.isBlank()) {
-                paths.add(line.trim());
-            }
-        }
-        return paths;
-    }
-
-    /** The set of paths a {@code git status --porcelain} listing names, stripping the two-char status
-     *  code prefix each line carries. */
-    private static Set<String> porcelainPaths(String porcelain) {
-        Set<String> paths = new HashSet<>();
-        for (String line : porcelain.split("\\R")) {
-            if (!line.isBlank()) {
-                paths.add(line.substring(3).trim());
-            }
-        }
-        return paths;
-    }
-
-    private static String forEachRef(Path cwd, String pattern) throws Exception {
-        Process p = new ProcessBuilder("git", "-C", cwd.toString(), "for-each-ref", pattern)
-                .redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git for-each-ref timed out");
-        assertEquals(0, p.exitValue(), "git for-each-ref " + pattern + " failed:\n" + out);
-        return out;
-    }
-
-    /**
-     * The heart of CB-525: a provisioned worktree must not inherit the primary's MCP servers. Without
-     * the isolation step the checked-out {@code .mcp.json} carries them in, and a worker navigating
-     * through the primary's IDE servers edits the primary's tree while building its own.
-     */
-    @Test
-    void aProvisionedWorktreeInheritsNoMcpServers(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        String wt = new GitWorktrees(tmp.resolve("wts").toString())
-                .add(repo.toString(), "cb-525-a", "HEAD");
-
-        Path mcp = Path.of(wt).resolve(".mcp.json");
-        assertTrue(Files.exists(mcp), ".mcp.json must still exist — present and explicitly empty");
-        String body = Files.readString(mcp);
-        assertFalse(body.contains("jetbrains"), "worktree inherited the primary's MCP servers:\n" + body);
-        assertTrue(body.replaceAll("\\s+", "").contains("\"mcpServers\":{}"),
-                "expected an explicitly empty server map, got:\n" + body);
-    }
-
-    /** Neutralizing must not look like work in progress, or a worker would commit it into its PR. */
-    @Test
-    void theNeutralizedConfigIsNotAPendingLocalModification(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        String wt = new GitWorktrees(tmp.resolve("wts").toString())
-                .add(repo.toString(), "cb-525-b", "HEAD");
-
-        assertEquals("", status(Path.of(wt), ".mcp.json"),
-                "the neutralized .mcp.json shows as modified — --skip-worktree did not take");
-    }
-
-    /** Isolation is the worktree's business only; the primary's own checkout must be untouched. */
-    @Test
-    void thePrimaryCheckoutIsLeftAlone(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        new GitWorktrees(tmp.resolve("wts").toString()).add(repo.toString(), "cb-525-c", "HEAD");
-
-        assertEquals(WITH_SERVERS, Files.readString(repo.resolve(".mcp.json")),
-                "the primary's .mcp.json was rewritten — isolation reached out of the worktree");
-    }
-
-    /** A repo that commits no {@code .mcp.json} still gets one, so nothing can be inherited later. */
-    @Test
-    void aRepoWithoutAnMcpConfigStillGetsANeutralOne(@TempDir Path tmp) throws Exception {
-        Path repo = tmp.resolve("repo");
-        Files.createDirectories(repo);
-        git(repo, "init", "-q", "-b", "main");
-        git(repo, "config", "user.email", "test@example.invalid");
-        git(repo, "config", "user.name", "Test");
-        Files.writeString(repo.resolve("README.md"), "seed\n");
-        git(repo, "add", "README.md");
-        git(repo, "commit", "-q", "-m", "seed");
-
-        String wt = new GitWorktrees(tmp.resolve("wts").toString())
-                .add(repo.toString(), "cb-525-d", "HEAD");
-
-        // Untracked is the normal case here, so the --skip-worktree branch must be skipped rather
-        // than run and fail: `update-index --skip-worktree` on an unknown path exits non-zero.
-        String body = Files.readString(Path.of(wt).resolve(".mcp.json"));
-        assertTrue(body.replaceAll("\\s+", "").contains("\"mcpServers\":{}"), body);
-    }
-
-    /**
-     * CB-543's repro: a tracked {@code opencode.json} carries a {@code {file:.secrets/...}} reference
-     * to a gitignored secret that never reaches a worktree, and opencode refuses to start on it. The
-     * worktree's copy must be neutralized and hidden like {@code .mcp.json}.
-     */
-    @Test
-    void aTrackedOpencodeConfigIsNeutralizedAndHidden(@TempDir Path tmp) throws Exception {
-        Path repo = tmp.resolve("repo");
-        Files.createDirectories(repo);
-        git(repo, "init", "-q", "-b", "main");
-        git(repo, "config", "user.email", "test@example.invalid");
-        git(repo, "config", "user.name", "Test");
-        Files.writeString(repo.resolve(".mcp.json"), WITH_SERVERS);
-        Files.writeString(repo.resolve("opencode.json"), OPENCODE_WITH_FILE_REF);
-        Files.writeString(repo.resolve("README.md"), "seed\n");
-        git(repo, "add", ".mcp.json", "opencode.json", "README.md");
-        git(repo, "commit", "-q", "-m", "seed");
-
-        String wt = new GitWorktrees(tmp.resolve("wts").toString())
-                .add(repo.toString(), "cb-543-a", "HEAD");
-
-        String body = Files.readString(Path.of(wt).resolve("opencode.json"));
-        assertFalse(body.contains(".secrets"),
-                "worktree kept a dangling {file:...} secret reference:\n" + body);
-        assertEquals("{}", body.replaceAll("\\s+", ""),
-                "expected an empty JSON object stub, got:\n" + body);
-        assertEquals("", status(Path.of(wt), "opencode.json"),
-                "the neutralized opencode.json shows as modified — --skip-worktree did not take");
-    }
-
-    /** A config the repo does not carry must be skipped — no stub invented, provisioning still succeeds. */
-    @Test
-    void anAbsentConfigIsSkippedWithoutError(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));   // only .mcp.json + README are committed
-
-        String wt = new GitWorktrees(tmp.resolve("wts").toString())
-                .add(repo.toString(), "cb-543-b", "HEAD");
-
-        assertFalse(Files.exists(Path.of(wt).resolve("opencode.json")),
-                "a stub was invented for a config the repo does not carry");
-        assertFalse(Files.exists(Path.of(wt).resolve(".autoenv")),
-                "a stub was invented for a config the repo does not carry");
-        // .mcp.json's long-standing create-always behaviour must be unchanged.
-        assertTrue(Files.exists(Path.of(wt).resolve(".mcp.json")), ".mcp.json stub was dropped");
-    }
-
-    /**
-     * CB-576. {@code hasUncommitted} must treat a freshly-provisioned worktree as clean, but a
-     * worktree holding a brand-new, never-added file as dirty. The untracked-file-only shape is
-     * exactly the work lost in the incident — a worker's draft that compiled but was never
-     * committed because it stopped to ask its lead a question.
-     */
-    @Test
-    void anUntrackedOnlyWorktreeCountsAsDirty(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String wt = gitWorktrees.add(repo.toString(), "cb-576-u", "HEAD");
-
-        assertFalse(gitWorktrees.hasUncommitted(wt),
-                "a freshly provisioned worktree must read as clean");
-
-        Files.writeString(Path.of(wt).resolve("brand-new.txt"), "draft that was never added\n");
-
-        assertTrue(gitWorktrees.hasUncommitted(wt),
-                "an untracked-only file must count as dirty");
-
-        Files.writeString(Path.of(wt).resolve("README.md"), "edited tracked file\n");
-        assertTrue(gitWorktrees.hasUncommitted(wt),
-                "a tracked modification must also count as dirty");
-    }
-
-    /**
-     * CB-576 review. {@code hasUncommitted} must tolerate a missing worktree exactly like
-     * {@code remove}: an already-gone directory holds no work to lose, and throwing here would
-     * break teardown — SessionManager.release() calls it before stopping the pane, so an
-     * exception would orphan a live pane and skip the release notification (CB-516).
-     */
-    @Test
-    void hasUncommittedOnAMissingWorktreeReturnsFalseWithoutThrowing(@TempDir Path tmp) {
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String gone = tmp.resolve("wts").resolve("does-not-exist").toString();
-
-        assertFalse(gitWorktrees.hasUncommitted(gone),
-                "a missing worktree is reported clean, not an error");
-    }
-
-    /** All three protected configs are covered: each one present in a worktree is neutralized and hidden. */
-    @Test
-    void allThreeConfigsAreNeutralizedWhenPresent(@TempDir Path tmp) throws Exception {
-        Path repo = tmp.resolve("repo");
-        Files.createDirectories(repo);
-        git(repo, "init", "-q", "-b", "main");
-        git(repo, "config", "user.email", "test@example.invalid");
-        git(repo, "config", "user.name", "Test");
-        Files.writeString(repo.resolve(".mcp.json"), WITH_SERVERS);
-        Files.writeString(repo.resolve("opencode.json"), OPENCODE_WITH_FILE_REF);
-        Files.writeString(repo.resolve(".autoenv"), AUTOENV_WITH_DIRECTIVE);
-        Files.writeString(repo.resolve("README.md"), "seed\n");
-        git(repo, "add", ".mcp.json", "opencode.json", ".autoenv", "README.md");
-        git(repo, "commit", "-q", "-m", "seed");
-
-        String wt = new GitWorktrees(tmp.resolve("wts").toString())
-                .add(repo.toString(), "cb-543-c", "HEAD");
-
-        assertTrue(Files.readString(Path.of(wt).resolve(".mcp.json"))
-                        .replaceAll("\\s+", "").contains("\"mcpServers\":{}"),
-                ".mcp.json was not neutralized");
-        assertEquals("{}", Files.readString(Path.of(wt).resolve("opencode.json")).replaceAll("\\s+", ""),
-                "opencode.json was not neutralized");
-        assertEquals("", Files.readString(Path.of(wt).resolve(".autoenv")),
-                ".autoenv was not neutralized");
-
-        assertEquals("", status(Path.of(wt), ".mcp.json"), ".mcp.json still shows as modified");
-        assertEquals("", status(Path.of(wt), "opencode.json"), "opencode.json still shows as modified");
-        assertEquals("", status(Path.of(wt), ".autoenv"), ".autoenv still shows as modified");
-    }
-
-    /**
-     * CB-578 stage C, acceptance criterion 1. A dirty worktree — a tracked edit plus a brand-new
-     * untracked file, exactly the shape lost in CB-576 — must land in {@code refs/wip/<branch>}'s
-     * tree, and that ref must live outside {@code refs/heads} so it never shows up in
-     * {@code git branch} or gets swept by a branch cleanup.
-     */
-    @Test
-    void dirtySnapshotCreatesARefWhoseTreeContainsUntrackedAndTrackedChanges(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String branch = "cb-578-c-a";
-        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
-        Files.writeString(Path.of(wt).resolve("untracked.txt"), "draft that was never added\n");
-        Files.writeString(Path.of(wt).resolve("README.md"), "edited tracked file\n");
-
-        Optional<String> ref = gitWorktrees.snapshot(wt, branch, "test snapshot");
-
-        assertTrue(ref.isPresent(), "a dirty worktree snapshot returns a commit sha");
-        String tree = lsTree(repo, "refs/wip/" + branch);
-        assertTrue(tree.contains("untracked.txt"), "snapshot tree must include the untracked file:\n" + tree);
-        assertTrue(tree.contains("README.md"), "snapshot tree must include the tracked edit:\n" + tree);
-        String heads = forEachRef(repo, "refs/heads");
-        assertFalse(heads.contains("refs/wip/"), "the snapshot ref must not live under refs/heads:\n" + heads);
-    }
-
-    /**
-     * CB-578 stage C, acceptance criterion 2. Building the commit through a temporary
-     * {@code GIT_INDEX_FILE} must leave the worker's own index, working tree, and HEAD exactly as
-     * they were — the worker may still be mid-write, and staging into the real index would corrupt
-     * that.
-     */
-    @Test
-    void snapshotDoesNotTouchTheWorkersOwnIndexWorkingTreeOrHead(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String branch = "cb-578-c-b";
-        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
-        Files.writeString(Path.of(wt).resolve("untracked.txt"), "draft that was never added\n");
-        Files.writeString(Path.of(wt).resolve("README.md"), "edited tracked file\n");
-        String headBefore = revParse(Path.of(wt), "HEAD");
-        String statusBefore = fullStatus(Path.of(wt));
-
-        gitWorktrees.snapshot(wt, branch, "test snapshot");
-
-        assertEquals(headBefore, revParse(Path.of(wt), "HEAD"), "snapshot must not move HEAD");
-        assertEquals(statusBefore, fullStatus(Path.of(wt)),
-                "snapshot must not change the worker's own index or working tree status");
-    }
-
-    /**
-     * CB-578 stage C, acceptance criterion 3. {@code add -A} (never {@code -f}) respects
-     * {@code .gitignore}, and that is the only thing keeping a gitignored file (secrets, local
-     * config) out of a snapshot commit — an untracked file that is NOT ignored must still be
-     * included, so this isn't just "untracked files are dropped".
-     */
-    @Test
-    void gitignoredFileIsExcludedButOtherUntrackedFilesAreNot(@TempDir Path tmp) throws Exception {
-        Path repo = tmp.resolve("repo");
-        Files.createDirectories(repo);
-        git(repo, "init", "-q", "-b", "main");
-        git(repo, "config", "user.email", "test@example.invalid");
-        git(repo, "config", "user.name", "Test");
-        Files.writeString(repo.resolve(".gitignore"), ".env\n");
-        Files.writeString(repo.resolve("README.md"), "seed\n");
-        git(repo, "add", ".gitignore", "README.md");
-        git(repo, "commit", "-q", "-m", "seed");
-
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String branch = "cb-578-c-c";
-        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
-        Files.writeString(Path.of(wt).resolve(".env"), "SECRET=shh\n");
-        Files.writeString(Path.of(wt).resolve("untracked.txt"), "draft that was never added\n");
-
-        Optional<String> ref = gitWorktrees.snapshot(wt, branch, "test snapshot");
-
-        assertTrue(ref.isPresent());
-        String tree = lsTree(repo, "refs/wip/" + branch);
-        assertFalse(tree.contains(".env"), "a gitignored file must never enter the snapshot:\n" + tree);
-        assertTrue(tree.contains("untracked.txt"),
-                "a non-ignored untracked file must still be included:\n" + tree);
-    }
-
-    /** CB-578 stage C. A clean worktree still produces a valid, if tree-identical, commit — the caller
-     *  (SessionManager) is the one that decides not to call this on a clean worktree. */
-    @Test
-    void snapshotOfAMissingWorktreeReturnsEmptyWithoutThrowing(@TempDir Path tmp) {
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String gone = tmp.resolve("wts").resolve("does-not-exist").toString();
-
-        assertTrue(gitWorktrees.snapshot(gone, "some-branch", "msg").isEmpty(),
-                "a missing worktree has nothing to snapshot, and must not throw");
-    }
-
-    /**
-     * CB-587, acceptance criteria 1 and 2. A file with a REAL {@code --skip-worktree} bit set in the
-     * worktree's own index must never enter the snapshot, even though its on-disk content has locally
-     * diverged from what is committed — that is exactly the divergence {@code --skip-worktree} exists
-     * to hide from {@code git status}, and a snapshot built from a fresh empty temp index (the bug)
-     * stages that local content anyway because the fresh index carries none of the real index's flags.
-     * The snapshot's diff against its parent must list exactly what {@code git status --porcelain}
-     * reports for the worktree — no more, no less.
-     */
-    @Test
-    void dirtySnapshotHonoursARealSkipWorktreeBit(@TempDir Path tmp) throws Exception {
-        Path repo = tmp.resolve("repo");
-        Files.createDirectories(repo);
-        git(repo, "init", "-q", "-b", "main");
-        git(repo, "config", "user.email", "test@example.invalid");
-        git(repo, "config", "user.name", "Test");
-        Files.writeString(repo.resolve("protected.cfg"), "committed-value\n");
-        Files.writeString(repo.resolve("README.md"), "seed\n");
-        git(repo, "add", "protected.cfg", "README.md");
-        git(repo, "commit", "-q", "-m", "seed");
-
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String branch = "cb-587-a";
-        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
-
-        git(Path.of(wt), "update-index", "--skip-worktree", "protected.cfg");
-        Files.writeString(Path.of(wt).resolve("protected.cfg"), "locally-diverged-never-commit\n");
-        Files.writeString(Path.of(wt).resolve("untracked.txt"), "draft that was never added\n");
-        Files.writeString(Path.of(wt).resolve("README.md"), "edited tracked file\n");
-
-        String porcelain = fullStatus(Path.of(wt));
-        assertFalse(porcelain.contains("protected.cfg"),
-                "test setup invalid — protected.cfg must not show in git status once skip-worktree is set:\n"
-                        + porcelain);
-
-        Optional<String> ref = gitWorktrees.snapshot(wt, branch, "test snapshot");
-
-        assertTrue(ref.isPresent(), "a dirty worktree snapshot returns a commit sha");
-        Set<String> diffPaths = diffNameOnly(repo, "HEAD", "refs/wip/" + branch);
-        assertFalse(diffPaths.contains("protected.cfg"),
-                "a --skip-worktree file's local drift leaked into the snapshot:\n" + diffPaths);
-        assertEquals(porcelainPaths(porcelain), diffPaths,
-                "snapshot diff must list exactly what git status --porcelain reports, no more, no less");
-    }
-
-    /**
-     * CB-587, acceptance criterion 6. If the worktree's real index cannot be resolved/read, snapshot
-     * must fail loudly (throw) rather than silently falling back to an empty temp index and producing
-     * a wrong snapshot. SessionManager's caller already catches and WARNs on any exception here — this
-     * only needs to confirm the failure is not swallowed inside snapshot() itself.
-     */
-    @Test
-    void snapshotThrowsWhenTheWorktreesRealIndexCannotBeResolved(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String branch = "cb-587-b";
-        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
-
-        // Break git's ability to resolve the worktree's real index by removing the linked worktree's
-        // `.git` file (which normally points at the main repo's worktrees/<name>/ directory).
-        Files.delete(Path.of(wt).resolve(".git"));
-
-        assertThrows(WorktreeException.class, () -> gitWorktrees.snapshot(wt, branch, "test snapshot"),
-                "an unresolvable real index must fail loudly, not silently snapshot from an empty index");
-    }
-}

deploy/dev.ltms.fleetd.plist

@@ -1,36 +1,36 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
 <!--
-  CB-504 / CB-594 — launchd agent for bridged (macOS).
+  CB-504 / CB-594 — launchd agent for fleetd (macOS).
 
   This is the real supervision target today: the dogfooded daemon runs on macOS, where there is
-  no systemd. A systemd unit ships alongside (deploy/bridged.service) for the Linux gateways
+  no systemd. A systemd unit ships alongside (deploy/fleetd.service) for the Linux gateways
   CB-308 introduces.
 
   Install:
-    cp deploy/dev.ltms.bridged.plist ~/Library/LaunchAgents/
-    launchctl load -w ~/Library/LaunchAgents/dev.ltms.bridged.plist
-    launchctl list | grep bridged
+    cp deploy/dev.ltms.fleetd.plist ~/Library/LaunchAgents/
+    launchctl load -w ~/Library/LaunchAgents/dev.ltms.fleetd.plist
+    launchctl list | grep fleetd
 
   The paths below are already filled in for this host (resolved 2026-08-16 from
   `/usr/libexec/java_home`... except that reported the system Applet-plugin JVM, not the jenv-
-  managed JDK 25 actually used to build/run bridged, so JAVA_HOME here is the real one:
+  managed JDK 25 actually used to build/run fleetd, so JAVA_HOME here is the real one:
   `JENV_VERSION=25.0.3 java -XshowSettings:properties -version 2>&1 | grep java.home`; `which mvn`;
   `echo $HOME`). If this file is copied to a different host, re-resolve all three paths and check
-  no placeholder path is left behind; scripts/redeploy-bridged.sh's check mode does not (and
+  no placeholder path is left behind; scripts/redeploy-fleetd.sh's check mode does not (and
   cannot) check this file for you.
 
   CB-594 — launchd cannot run a login shell (see the PATH comment on EnvironmentVariables below,
-  and scripts/bridged-launchd-wrapper.sh for the fix): ProgramArguments below execs THAT wrapper,
+  and scripts/fleetd-launchd-wrapper.sh for the fix): ProgramArguments below execs THAT wrapper,
   not java directly, so WORKER_GITEA_TOKEN and AI_GATEWAY_TOKEN still get sourced from
   ${SHARED_ENV}/tools/secrets.sh even though launchd itself never sources anything.
 
   Note on ordering: launchd has no "start after herdr" primitive for user agents, and neither
-  does systemd in a way that survives a socket appearing late. bridged retries the herdr socket
+  does systemd in a way that survives a socket appearing late. fleetd retries the herdr socket
   on startup instead, so an agent that comes up before herdr converges rather than dying — that
   retry is the actual fix; KeepAlive below is the backstop.
 
-  CB-594 — KeepAlive vs. scripts/redeploy-bridged.sh: a bare SIGTERM makes this JVM exit 143 even
+  CB-594 — KeepAlive vs. scripts/redeploy-fleetd.sh: a bare SIGTERM makes this JVM exit 143 even
   with its shutdown hook running to completion (measured, see the CB-594 report), which
   SuccessfulExit:false below reads as a crash and races to restart the OLD jar. The redeploy
   script now detects a loaded agent and uses `launchctl unload`/`load` instead of a raw kill, so
@@ -40,20 +40,20 @@
 <plist version="1.0">
 <dict>
     <key>Label</key>
-    <string>dev.ltms.bridged</string>
+    <string>dev.ltms.fleetd</string>
 
     <key>ProgramArguments</key>
     <array>
-        <string>/Users/dai.ha/LTMS/claude-bridge/scripts/bridged-launchd-wrapper.sh</string>
+        <string>/Users/dai.ha/LTMS/claude-bridge/scripts/fleetd-launchd-wrapper.sh</string>
         <string>/Users/dai.ha/Softwares/jdks/jdk-25.0.3.jdk/Contents/Home/bin/java</string>
         <string>-jar</string>
-        <string>/Users/dai.ha/LTMS/claude-bridge/bridged/target/bridged.jar</string>
-        <string>bridged.yaml</string>
+        <string>/Users/dai.ha/LTMS/claude-bridge/fleetd/target/fleetd.jar</string>
+        <string>fleetd.yaml</string>
     </array>
 
     <!-- Config path in ProgramArguments is relative, so the working directory must be the module. -->
     <key>WorkingDirectory</key>
-    <string>/Users/dai.ha/LTMS/claude-bridge/bridged</string>
+    <string>/Users/dai.ha/LTMS/claude-bridge/fleetd</string>
 
     <key>EnvironmentVariables</key>
     <dict>
@@ -62,7 +62,7 @@
         <key>HERDR_SOCKET_PATH</key>
         <string>/Users/dai.ha/.config/herdr/herdr.sock</string>
         <!--
-          PATH matters more than it looks (CB-511): bridged propagates its own PATH to every worker
+          PATH matters more than it looks (CB-511): fleetd propagates its own PATH to every worker
           it spawns, so this line decides whether the fleet can run a build at all. launchd does NOT
           source .zprofile/.zshrc, so without this the daemon (and therefore every worker) gets a
           bare /usr/bin:/bin and no JDK or Maven. Keep the toolchain entries first.
@@ -71,10 +71,10 @@
         <string>/Users/dai.ha/Softwares/jdks/jdk-25.0.3.jdk/Contents/Home/bin:/Users/dai.ha/Softwares/apache-maven/bin:/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin</string>
         <!--
           Worker/API tokens are NOT set here: this file is committed. CB-594 —
-          scripts/bridged-launchd-wrapper.sh (named in ProgramArguments above) is what supplies
+          scripts/fleetd-launchd-wrapper.sh (named in ProgramArguments above) is what supplies
           them, by execing a login shell that sources ${SHARED_ENV}/tools/secrets.sh before the
-          daemon itself starts. bridged also reads the API token from the env var named by
-          auth.tokenEnv (default BRIDGED_API_TOKEN) and only in auth.mode: token — the wrapper
+          daemon itself starts. fleetd also reads the API token from the env var named by
+          auth.tokenEnv (default FLEETD_API_TOKEN) and only in auth.mode: token — the wrapper
           covers that one too, since it is the same login shell.
         -->
     </dict>
@@ -84,21 +84,21 @@
 
     <!--
       CB-600 — read this before assuming ThrottleInterval bounds anything. It paces restarts to at
-      most one per 10s; it does NOT cap how many times launchd retries. If bridged fails fast on
-      every start — a bad bridged.yaml, for example auth.mode: token with the token env var unset,
+      most one per 10s; it does NOT cap how many times launchd retries. If fleetd fails fast on
+      every start — a bad fleetd.yaml, for example auth.mode: token with the token env var unset,
       which throws in main() before the daemon ever binds a port — launchd restarts it forever,
       once every 10s, until a human intervenes. LaunchAgents have no "give up after N attempts"
       primitive, so this is not something a config change here can fix.
 
-      That loop stops only two ways: (1) `launchctl unload -w ~/Library/LaunchAgents/dev.ltms.bridged.plist`,
+      That loop stops only two ways: (1) `launchctl unload -w ~/Library/LaunchAgents/dev.ltms.fleetd.plist`,
       or (2) the underlying cause gets fixed, so the process starts successfully and stays up (no
-      more exits to restart). scripts/redeploy-bridged.sh does not add a third way — it does not
-      make bridged self-disable on a config error, on purpose: a fail-fast exit path that
+      more exits to restart). scripts/redeploy-fleetd.sh does not add a third way — it does not
+      make fleetd self-disable on a config error, on purpose: a fail-fast exit path that
       sometimes decides "this is unrecoverable, stop trying" is one more thing that can misfire,
       and a wrongly self-disabled daemon needs the exact same manual `launchctl load -w` recovery
       this comment already names — so it buys nothing an operator watching for the crash loop
       doesn't already have, at the cost of a new way to be silently down. Watch for it with
-      `launchctl list dev.ltms.bridged` (a high restart count) or by tailing bridged.out for the
+      `launchctl list dev.ltms.fleetd` (a high restart count) or by tailing fleetd.out for the
       same startup error repeating every ~10s.
     -->
     <key>KeepAlive</key>
@@ -110,16 +110,16 @@
     <integer>10</integer>
 
     <!--
-      CB-594 — same file scripts/redeploy-bridged.sh already tails ($BRIDGED/bridged.out), and both
+      CB-594 — same file scripts/redeploy-fleetd.sh already tails ($BRIDGED/fleetd.out), and both
       streams point at it, not two separate log files: the script's fresh-line / ERROR-count checks
       after a restart read this one path regardless of whether launchd or the script started the
       process, and a stdout/stderr split would make half of what happens during a launchd-driven
       restart invisible to it.
     -->
     <key>StandardOutPath</key>
-    <string>/Users/dai.ha/LTMS/claude-bridge/bridged/bridged.out</string>
+    <string>/Users/dai.ha/LTMS/claude-bridge/fleetd/fleetd.out</string>
     <key>StandardErrorPath</key>
-    <string>/Users/dai.ha/LTMS/claude-bridge/bridged/bridged.out</string>
+    <string>/Users/dai.ha/LTMS/claude-bridge/fleetd/fleetd.out</string>
 
     <key>ProcessType</key>
     <string>Background</string>

deploy/fleetd.service

@@ -1,45 +1,45 @@
-# CB-504 — systemd unit for bridged (Linux).
+# CB-504 — systemd unit for fleetd (Linux).
 #
-# The macOS launchd agent (deploy/dev.ltms.bridged.plist) is the supervision target for the
+# The macOS launchd agent (deploy/dev.ltms.fleetd.plist) is the supervision target for the
 # current single-host deployment. This unit exists for the per-host gateways CB-308 introduces,
 # which will run on Linux.
 #
-# Install (user service — bridged drives the user's herdr, not a system daemon):
+# Install (user service — fleetd drives the user's herdr, not a system daemon):
 #   mkdir -p ~/.config/systemd/user
-#   cp deploy/bridged.service ~/.config/systemd/user/
+#   cp deploy/fleetd.service ~/.config/systemd/user/
 #   # edit ExecStart / WorkingDirectory / Environment below, then:
 #   systemctl --user daemon-reload
-#   systemctl --user enable --now bridged
-#   journalctl --user -u bridged -f
+#   systemctl --user enable --now fleetd
+#   journalctl --user -u fleetd -f
 
 [Unit]
-Description=bridged — claude-bridge message server
-Documentation=https://git.ltms.dev/lms/claude-bridge/wiki
+Description=fleetd — claude-bridge message server
+Documentation=https://git.ltms.dev/fleet/fleetd/wiki
 # Ordering only: herdr is a user process and its socket may appear after us. This is advisory —
-# bridged retries the herdr socket rather than exiting, which is what actually makes a late
-# socket survivable. Do NOT add Requires=: a herdr restart must not take bridged down with it.
+# fleetd retries the herdr socket rather than exiting, which is what actually makes a late
+# socket survivable. Do NOT add Requires=: a herdr restart must not take fleetd down with it.
 After=herdr.service
 Wants=herdr.service
 
 [Service]
 Type=simple
-WorkingDirectory=%h/src/claude-bridge/bridged
-ExecStart=/usr/lib/jvm/temurin-25-jdk/bin/java -jar target/bridged.jar bridged.yaml
+WorkingDirectory=%h/src/claude-bridge/fleetd
+ExecStart=/usr/lib/jvm/temurin-25-jdk/bin/java -jar target/fleetd.jar fleetd.yaml
 
 Environment=HERDR_SOCKET_PATH=%h/.config/herdr/herdr.sock
-# PATH matters more than it looks (CB-511): bridged propagates its own PATH to every worker it
+# PATH matters more than it looks (CB-511): fleetd propagates its own PATH to every worker it
 # spawns, so this line decides whether the fleet can run a build at all. systemd does not source a
 # login shell, so without it the daemon — and every worker — gets a bare default with no JDK/Maven.
 Environment=PATH=/usr/lib/jvm/temurin-25-jdk/bin:/usr/share/maven/bin:/usr/local/bin:/usr/bin:/bin
 # Secrets are NOT set here — this file is committed. Put the API/worker tokens in a private
 # drop-in that systemd reads with restrictive permissions:
-#   systemctl --user edit bridged     →  [Service] / Environment=BRIDGED_API_TOKEN=...
+#   systemctl --user edit fleetd     →  [Service] / Environment=FLEETD_API_TOKEN=...
 # or point EnvironmentFile at a 0600 file:
-# EnvironmentFile=%h/.config/bridged/env
+# EnvironmentFile=%h/.config/fleetd/env
 
 Restart=on-failure
 RestartSec=10s
-# A bad config (e.g. a non-loopback bind without token auth) makes bridged fail fast by design.
+# A bad config (e.g. a non-loopback bind without token auth) makes fleetd fail fast by design.
 # Give up rather than restart-loop on a permanent error.
 StartLimitBurst=5
 StartLimitIntervalSec=120
@@ -55,7 +55,7 @@ RestrictSUIDSGID=true
 
 StandardOutput=journal
 StandardError=journal
-SyslogIdentifier=bridged
+SyslogIdentifier=fleetd
 
 [Install]
 WantedBy=default.target

deploy/lavinmq/compose.yaml

@@ -1,8 +1,8 @@
-# LavinMQ — the AMQP broker behind bridged's durable ReplyInbox (CB-307 Stage 2).
+# LavinMQ — the AMQP broker behind fleetd's durable ReplyInbox (CB-307 Stage 2).
 #
 # Why this file exists: the broker was previously run ad hoc and simply vanished from the host,
-# which takes bridged down with it — AmqpReplyInbox.open throws on an unreachable broker and
-# Bridged.java:187 does not guard it, so a missing broker is a hard startup failure, not a
+# which takes fleetd down with it — AmqpReplyInbox.open throws on an unreachable broker and
+# Fleetd.java:187 does not guard it, so a missing broker is a hard startup failure, not a
 # degraded mode. This pins the version, keeps the data, and brings itself back after a reboot.
 #
 # Usage:
@@ -14,27 +14,27 @@
 #
 # Management UI: http://127.0.0.1:15672  (guest / guest)
 #
-# This is bridged's OWN broker. Do not point bridged at any other AMQP server on this host —
+# This is fleetd's OWN broker. Do not point fleetd at any other AMQP server on this host —
 # notably not the `local-rabbitmq` container, which belongs to a different project and would end
 # up carrying this project's queues.
 
-name: bridged-broker
+name: fleetd-broker
 
 services:
   lavinmq:
     # Pinned deliberately: :latest silently moves the broker under a running daemon.
     image: cloudamqp/lavinmq:2.9.1
-    container_name: bridged-lavinmq
+    container_name: fleetd-lavinmq
 
     # The failure this deployment exists to prevent — survive reboots and Docker restarts, but
     # stay down if it was stopped on purpose.
     restart: unless-stopped
 
     # Loopback-bound on purpose. LavinMQ ships a default guest/guest account, which is only
-    # acceptable because nothing off-host can reach it. bridged connects over 127.0.0.1, and
+    # acceptable because nothing off-host can reach it. fleetd connects over 127.0.0.1, and
     # binding 0.0.0.0 here would expose a broker with default credentials to the network.
     ports:
-      - "127.0.0.1:5672:5672"      # AMQP — bridged.yaml broker.uri points here
+      - "127.0.0.1:5672:5672"      # AMQP — fleetd.yaml broker.uri points here
       - "127.0.0.1:15672:15672"    # HTTP management API + UI
 
     # The whole point of Stage 2. Held-but-unacked replies live here; without a named volume a
@@ -57,4 +57,4 @@ services:
 
 volumes:
   lavinmq-data:
-    name: bridged-lavinmq-data
+    name: fleetd-lavinmq-data

docs/CB-301-Session-Manager.md

@@ -2,7 +2,7 @@
 
 **Status:** design spec for review → delegate implementation.
 **Grounded in:** `WorkerService`, `Injector`/`StatusPoller`/`TurnListener`, `MessageService`,
-`BridgeMcp`, `BridgedApp` (see [wiki 9. Implementation](../wiki/9-Implementation.md)).
+`FleetMcp`, `FleetApp` (see [wiki 9. Implementation](../wiki/9-Implementation.md)).
 
 ## Problem
 
@@ -15,7 +15,7 @@ Consequences today:
   since when?" without shelling to herdr for a raw agent list (no state, no ownership, no age).
 - Cleanup of a worker that outlived its owning process depends entirely on the boot-time
   name-nonce **reaper** (CB-117) — there is no live, authoritative roster during a run.
-- `bridge_list` (CB-304) can only surface herdr's view, not a bridge-owned roster.
+- `fleet_list` (CB-304) can only surface herdr's view, not a bridge-owned roster.
 - There is no seam for per-session policy (checkpoint on teardown → CB-302; idle_ttl /
   context_cap / drain → CB-303).
 
@@ -43,7 +43,7 @@ Under no-reuse, a released session is terminal. A new `acquire` always creates a
 subscription-guarded spawn/teardown mechanics; `SessionManager` adds the registry, lifecycle, and
 ownership on top.
 
-**Package:** new `dev.ltms.bridged.session` — keeps the registry/lifecycle concern separate from
+**Package:** new `dev.ltms.fleet.session` — keeps the registry/lifecycle concern separate from
 the `worker` spawn mechanics. Holds `SessionManager` + `WorkerSession`.
 
 ### `WorkerSession` (record or small mutable holder)
@@ -96,13 +96,13 @@ final class SessionManager {
 
 ### Integration points
 
-- **`Bridged.main`** — construct `SessionManager(workerService, ...)`; wire it as/decorating the
+- **`Fleetd.main`** — construct `SessionManager(workerService, ...)`; wire it as/decorating the
   `TurnListener` alongside `CompletionResolver` so it sees turn boundaries, and give it the
   `WorkerPresence` signal for `READY`.
-- **`BridgeMcp.spawn` / `BridgedApp.spawnWorker`** — route spawn through `SessionManager.acquire`
-  (carry `callerTerminal` as `ownerTerminal`). **`bridge_stop` / `DELETE /workers/{paneId}`** →
+- **`FleetMcp.spawn` / `FleetApp.spawnWorker`** — route spawn through `SessionManager.acquire`
+  (carry `callerTerminal` as `ownerTerminal`). **`fleet_stop` / `DELETE /workers/{paneId}`** →
   `SessionManager.release`.
-- **`bridge_list` / `GET /sessions` (CB-304 later)** — read `SessionManager.roster()`.
+- **`fleet_list` / `GET /sessions` (CB-304 later)** — read `SessionManager.roster()`.
 - **`MessageService`** — no change required for one-shot; a later CB-303 auto-release hook can call
   `release` from `onTurnComplete` under policy.
 
@@ -121,4 +121,4 @@ final class SessionManager {
 - **CB-302** — attach a checkpoint step (`STATE.md` + commit) to the `release` path.
 - **CB-303** — a policy loop over `roster()` using `spawnedAtNanos`/state to auto-`release` on
   `idle_ttl`, or drain on `context_cap`.
-- **CB-304** — `bridge_list` reads `roster()` for a bridge-owned roster + live join.
+- **CB-304** — `fleet_list` reads `roster()` for a bridge-owned roster + live join.

docs/CB-301-ext-Worktree-Provisioning.md

@@ -2,12 +2,12 @@
 
 **Status:** ✅ shipped — implemented at commit `97ecc71` (per-worker git worktree + config-parity
 overlay). As-built: `session/GitWorktrees.java` behind the `Worktrees` port, wired in
-`Bridged.main` and configurable via `worktreeRoot` / per-profile `parityOverlay`
-(see `bridged.example.yaml`). Branch/worktree surface in `bridge_list` landed with CB-304
+`Fleetd.main` and configurable via `worktreeRoot` / per-profile `parityOverlay`
+(see `fleetd.example.yaml`). Branch/worktree surface in `fleet_list` landed with CB-304
 (`9fe04bf`); the worker-opened-PR checkpoint landed as CB-302 (`64e70ef`).
 **Extends:** [CB-301 Session Manager](CB-301-Session-Manager.md) (shipped, commit `54d907c`).
 **Realizes:** the config-parity requirement in [Worker Git Workflow](Worker-Git-Workflow.md).
-**Grounded in:** `SessionManager`, `WorkerService.spawn/effectiveCwd`, `BridgedConfig.Worker`,
+**Grounded in:** `SessionManager`, `WorkerService.spawn/effectiveCwd`, `FleetConfig.Worker`,
 `inject/…LsofPeerPidLookup` (the `ProcessBuilder` exec pattern).
 
 ## Problem
@@ -43,7 +43,7 @@ provider.
 ### `WorktreeRequest` (new, nullable = "no worktree")
 
 ```java
-package dev.ltms.bridged.session;
+package dev.ltms.fleet.session;
 /** Ask acquire() to provision an isolated worktree. null ⇒ run in the shared primary tree. */
 public record WorktreeRequest(String ticketSlug, String baseRef) {
     // ticketSlug seeds the branch name; baseRef null/blank ⇒ current HEAD of the repo.
@@ -63,7 +63,7 @@ untouched.
 ### `Worktrees` seam (new)
 
 ```java
-package dev.ltms.bridged.session;
+package dev.ltms.fleet.session;
 public interface Worktrees {
     /** git -C <repoRoot> worktree add <path> -b <branch> <baseRef|HEAD>. Returns the worktree path. */
     String add(String repoRoot, String branch, String baseRef);
@@ -112,7 +112,7 @@ public void release(String paneId) {
 }
 ```
 
-### Config — `BridgedConfig.Worker.parityOverlay` + a `worktreeRoot`
+### Config — `FleetConfig.Worker.parityOverlay` + a `worktreeRoot`
 
 - Add `List<String> parityOverlay` to the `Worker` record (12th field). Compact-constructor default
   when null/empty: `[".mcp.json", ".claude/settings.local.json", ".env", ".envrc"]` (missing paths are
@@ -122,7 +122,7 @@ public void release(String paneId) {
 
 ### Surface: MCP + REST
 
-- `bridge_spawn` gains an optional `worktree` arg: `true`, or a ticket slug string. Truthy ⇒ build a
+- `fleet_spawn` gains an optional `worktree` arg: `true`, or a ticket slug string. Truthy ⇒ build a
   `WorktreeRequest(slug, null)` and call the 5-arg `acquire`.
 - `POST /workers` gains `worktree` (+ optional `ticket`) in the body/query, same mapping.
 - `workerView`/`view(WorkerSession)` include `worktree` and `branch` **when non-null** (omit for

docs/CB-306-Spawn-Readiness-Gate.md

@@ -1,16 +1,16 @@
 # CB-306 — Spawn-Readiness Gate (launcher-owned terminal readiness)
 
 **Status:** design note / delegation spec (branch `worker/cb-306-readiness`)
-**Issue:** gitea `lms/claude-bridge` #4
+**Issue:** gitea `fleet/fleetd` #4
 **Owner of the behaviour:** `ClaudeCodeLauncher` (the `PeerLauncher` adapter) — NOT core.
 
 ## 1. Problem
 
-`bridge_spawn` today returns a session the instant the herdr pane is started. The pane is not
+`fleet_spawn` today returns a session the instant the herdr pane is started. The pane is not
 yet a usable Claude REPL — it may still be sitting at the folder-trust prompt, or the CLI may
 never come up at all. Nothing blocks or times out on that. Consequences:
 
-- A `bridge_send` to a not-yet-ready worker surfaces as a **~60 s MCP-client timeout** (the send
+- A `fleet_send` to a not-yet-ready worker surfaces as a **~60 s MCP-client timeout** (the send
   blocks waiting for a turn that can't start) instead of a fast, explicit spawn failure.
 - A worker stuck at the folder-trust prompt lingers in `SPAWNING` forever; nothing fails it.
 
@@ -55,7 +55,7 @@ a crash, and a slow start all present as "never becomes injectable" and all corr
    or `spawnReadyTimeoutMs` elapses.
 3. **Ready** → return the `WorkerHandle(paneId, terminalId)` as today.
 4. **Timeout** → the launcher **closes the pane it started** (and its tab, via the same path
-   `release`/`stop` uses) and throws **`PeerUnreachableException`** (new, in `dev.ltms.bridged.peer`).
+   `release`/`stop` uses) and throws **`PeerUnreachableException`** (new, in `dev.ltms.fleet.peer`).
    No orphan pane is left behind — the launcher cleans up its own failed birth.
 
 `spawnReadyTimeoutMs == 0` (or unset) **disables** the gate = legacy non-blocking behaviour, so the
@@ -79,8 +79,8 @@ Unit tests (add to the existing `ClaudeCodeLauncher` test):
 
 ## 5. Config
 
-Add to the launcher-level config (a bridged-level knob, not per-profile) in `bridged.yaml` +
-`BridgedConfig`:
+Add to the launcher-level config (a fleetd-level knob, not per-profile) in `fleetd.yaml` +
+`FleetConfig`:
 
 ```yaml
 spawn_ready_timeout_ms: 20000   # 0 disables the gate (legacy non-blocking spawn)
@@ -88,7 +88,7 @@ spawn_ready_poll_ms: 300
 ```
 
 Jackson ignores unknown keys, so omitting them in existing YAML is safe; pick sane defaults in code
-(`20000` / `300`). Keep the names consistent with existing config field style in `BridgedConfig`.
+(`20000` / `300`). Keep the names consistent with existing config field style in `FleetConfig`.
 
 ## 6. Core / MCP propagation
 
@@ -99,11 +99,11 @@ Jackson ignores unknown keys, so omitting them in existing YAML is safe; pick sa
   `spawn` throws — verify the new exception flows through it (worktree removed, nothing registered).
 - The **non-worktree** path registers the session only *after* `spawn` returns, so a throw means no
   half-live `SPAWNING` session is ever registered — confirm this and add a test.
-- `bridge_spawn` (MCP verb) must return an **error result** carrying the exception message, not a
-  success with a dead session. Trace `BridgeMcp`/`BridgedApp` spawn handlers and make sure the
+- `fleet_spawn` (MCP verb) must return an **error result** carrying the exception message, not a
+  success with a dead session. Trace `FleetMcp`/`FleetApp` spawn handlers and make sure the
   exception becomes a clean tool error, not an uncaught 500 with a stack trace.
 
-**Out of scope (do NOT do here):** gating `bridge_send` on session `READY` (existing status-gate +
+**Out of scope (do NOT do here):** gating `fleet_send` on session `READY` (existing status-gate +
 this spawn gate already close the window), MCP-handshake-as-readiness signal, the CB-307 broker,
 any config `kind:` discriminator, any second adapter.
 
@@ -111,7 +111,7 @@ any config `kind:` discriminator, any second adapter.
 
 - `ClaudeCodeLauncher.spawn` blocks until injectable or throws `PeerUnreachableException` +
   self-reaps the pane; gate disabled when timeout is 0.
-- New `PeerUnreachableException` in `dev.ltms.bridged.peer`.
+- New `PeerUnreachableException` in `dev.ltms.fleet.peer`.
 - Config knobs wired (`spawn_ready_timeout_ms`, `spawn_ready_poll_ms`) with safe defaults.
 - Existing `SPAWNING→READY` MCP-contact transition untouched.
 - New unit tests (ready / timeout+reap / disabled) green; **all existing tests still pass unchanged**.

docs/CB-307-Reliable-Delivery.md

@@ -13,28 +13,28 @@ Stage 2 (the AMQP/LavinMQ adapter behind the same port) is explicitly **out of s
 ## 1. The bug this fixes (grounded in current code)
 
 The reverse (worker→primary) path is `Rendezvous` — a `ConcurrentHashMap<session, CompletableFuture<Resolution>>`
-of **live blocking waiters only**. No queue, no store. When a worker calls `bridge_reply` and **no send
+of **live blocking waiters only**. No queue, no store. When a worker calls `fleet_reply` and **no send
 is currently open** for that worker:
 
 - `Rendezvous.resolve(session, content)` → `complete(...)` → `waiters.get(session) == null` →
   returns `false` (`msg/Rendezvous.java:212-215`).
 - The `content` string is **never retained** — it is dropped. The worker is told it failed:
-  `BridgeMcp.reply` returns `error("no send is awaiting a reply for this worker")` (`mcp/BridgeMcp.java:270-272`);
-  REST returns `409 no_pending_send` (`rest/BridgedApp.java:339-345`).
+  `FleetMcp.reply` returns `error("no send is awaiting a reply for this worker")` (`mcp/FleetMcp.java:270-272`);
+  REST returns `409 no_pending_send` (`rest/FleetApp.java:339-345`).
 
-This is the observed "communication break": a worker that finishes just after its `bridge_send` timed
+This is the observed "communication break": a worker that finishes just after its `fleet_send` timed
 out (the ~60s sync window) replies into the void. There is **no message-id, dedup, or ack** anywhere in
 the message path today.
 
 ## 2. What to build
 
-### 2.1 The port — `dev.ltms.bridged.msg.ReplyInbox`
+### 2.1 The port — `dev.ltms.fleet.msg.ReplyInbox`
 
 A thin interface owned by the `msg` layer. The in-memory adapter is Stage 1; the AMQP adapter (Stage 2)
 implements the **same** interface, so keep it broker-agnostic.
 
 ```java
-package dev.ltms.bridged.msg;
+package dev.ltms.fleet.msg;
 
 import java.util.List;
 
@@ -70,7 +70,7 @@ public interface ReplyInbox {
   seen-set — your call; preserve insertion order).
 - `peek` returns an immutable copy; `ack` removes by `msgId`. Thread-safe (concurrent publish vs. drain).
 - **This is soft-state, NOT persistence.** Lost on a `java -jar` bounce — that is correct and consistent
-  with "bridged stays soft-state." Do **not** add any file/DB backing.
+  with "fleetd stays soft-state." Do **not** add any file/DB backing.
 
 ### 2.3 Publish seam — route reply through the service layer
 
@@ -79,7 +79,7 @@ in `MessageService`, which already owns the `Rendezvous` and will own the `Reply
 
 - Add `MessageService.reply(String session, String content)`:
   ```java
-  /** Route a worker's explicit bridge_reply: resolve an open send, or queue it in the inbox if none. */
+  /** Route a worker's explicit fleet_reply: resolve an open send, or queue it in the inbox if none. */
   public boolean reply(String session, String content) {
       if (rendezvous.resolve(session, content)) {
           return true;                       // a live send took it — unchanged fast path
@@ -89,12 +89,12 @@ in `MessageService`, which already owns the `Rendezvous` and will own the `Reply
   }
   ```
 - Repoint the two callers off the bare `rendezvous.resolve(...)` onto `messages.reply(...)`:
-  - `BridgeMcp.reply` (`mcp/BridgeMcp.java:262-273`) — on success return a normal ack; **remove** the
+  - `FleetMcp.reply` (`mcp/FleetMcp.java:262-273`) — on success return a normal ack; **remove** the
     `error("no send is awaiting a reply…")` branch (that case is now a successful queue).
-  - `BridgedApp.replyMessage` (`rest/BridgedApp.java:330-346`) — return `200` (queued) instead of
+  - `FleetApp.replyMessage` (`rest/FleetApp.java:330-346`) — return `200` (queued) instead of
     `409 no_pending_send`.
 
-**DO NOT touch the QUESTION path.** `bridge_ask` / `rendezvous.resolveQuestion` must keep today's
+**DO NOT touch the QUESTION path.** `fleet_ask` / `rendezvous.resolveQuestion` must keep today's
 `NO_WAITER` behaviour — a mid-turn question is **interactive** (the worker blocks synchronously and cannot
 consume a late answer), so it must **never** be queued. Only terminal `REPLY`s go to the inbox.
 
@@ -110,27 +110,27 @@ The primary re-checks a worker it delegated to. Expose a drain keyed by **worker
 - Add `MessageService.drainReplies(String target)`: `peek` the inbox, `ack` each returned `msgId`, hand
   back the `List<InboxMessage>` (or just the contents). At-least-once: peek→deliver→ack (ack only after
   the caller has them, so an in-flight failure re-surfaces them).
-- **DECISION (required default): expose via the existing poll verb, keyed by target.** Extend `bridge_poll`
+- **DECISION (required default): expose via the existing poll verb, keyed by target.** Extend `fleet_poll`
   to accept an optional `target` (worker session) and, when present, return that worker's drained replies —
   alongside a matching REST route `GET /sessions/{id}/replies`. Do **not** change `send`/`answer` semantics
   (do not drain inside `send` — that conflates "deliver to worker" with "collect its mail"). Keep the
-  existing ticket-based `bridge_poll(ticket)` path working unchanged. If you see a cleaner surface, still
+  existing ticket-based `fleet_poll(ticket)` path working unchanged. If you see a cleaner surface, still
   ship this default and note the alternative for review.
 
 ## 3. Config
 
 **None for Stage 1.** The in-memory adapter is the unconditional default — wire `new InMemoryReplyInbox()`
-into `MessageService` in `Bridged.main`. Do **not** add a `broker:` config block (that arrives with the
+into `MessageService` in `Fleetd.main`. Do **not** add a `broker:` config block (that arrives with the
 Stage-2 AMQP adapter: absent → in-memory, present → AMQP).
 
 ## 4. Acceptance criteria (what the primary will verify)
 
-1. New `ReplyInbox` + `InboxMessage` + `InMemoryReplyInbox` in `dev.ltms.bridged.msg`.
-2. `bridge_reply` with **no open send** now **succeeds and queues** (no more `error` / `409`); the reply is
+1. New `ReplyInbox` + `InboxMessage` + `InMemoryReplyInbox` in `dev.ltms.fleet.msg`.
+2. `fleet_reply` with **no open send** now **succeeds and queues** (no more `error` / `409`); the reply is
    later retrievable and identical.
 3. The queued reply is drainable by the primary keyed by target; draining **acks** it (a second drain
    returns nothing); dedup by `msgId` (re-publishing the same id does not double-queue).
-4. **QUESTION path unchanged** — `bridge_ask` with no open send still returns `NO_WAITER` (add/keep a test
+4. **QUESTION path unchanged** — `fleet_ask` with no open send still returns `NO_WAITER` (add/keep a test
    proving a question is never queued).
 5. Completion/failure fallbacks unchanged.
 6. Unit tests covering: `InMemoryReplyInbox` publish/peek/ack/dedup/FIFO/concurrency; `MessageService.reply`
@@ -140,7 +140,7 @@ Stage-2 AMQP adapter: absent → in-memory, present → AMQP).
 
 ## 5. Build & verification (worker side)
 
-- Build with Maven from the worktree's `bridged/` dir. **Capture the exit code without a masking pipe**
+- Build with Maven from the worktree's `fleetd/` dir. **Capture the exit code without a masking pipe**
   (`mvn clean install; echo "MVN_EXIT=$?"` — never `mvn … | tail`, which hides failures).
 - Read the real test totals from `target/surefire-reports/TEST-*.xml`, not from stdout scroll.
 - You do **not** have IDE MCP access — do not claim `ide_diagnostics` results. The **primary** runs the
@@ -152,7 +152,7 @@ Stage-2 AMQP adapter: absent → in-memory, present → AMQP).
 - **`.mcp.json` is `--skip-worktree` in your worktree — never edit, `git add`, or commit it.**
 - **`wiki/` is a submodule — never run git in it; never touch it.**
 - Commit only your feature changes (the new port/adapter, the `msg`/`mcp`/`rest` wiring, tests, and if
-  you add config wiring in `Bridged.java`). Nothing else.
+  you add config wiring in `Fleetd.java`). Nothing else.
 - Work only inside your assigned worktree on your feature branch. The primary fast-forwards `main` after
   re-gating — do not touch `main`.
 - Java 25 idioms are welcome (unnamed `_` params, records). Keep the diff minimal and match surrounding style.
@@ -171,7 +171,7 @@ removal, msgId dedup, cross-restart redelivery). It is `@Tag("contract")`, so th
 untouched. Run it explicitly when Docker (or a broker) is available:
 
 ```bash
-cd bridged
+cd fleetd
 mvn -Pcontract test -Dtest=AmqpReplyInboxContractTest   # local: spins a RabbitMQ Testcontainers fixture
 ```
 

docs/CB-308-Multi-Host-Federation.md

@@ -18,7 +18,7 @@ The design rests on three pieces (the shape this ticket proposes):
 1. **Dedicated per-agent channels** — every agent has its own addressable inbox on the broker.
 2. **A federated agent directory** — a global "who/where/status" lookup, assembled from per-host
    presence, not a central database.
-3. **A per-host gateway** — each host runs a `bridged` that owns its local herdr, registers/manages
+3. **A per-host gateway** — each host runs a `fleetd` that owns its local herdr, registers/manages
    its own sessions, and proxies messages to/from other hosts over the broker.
 
 ## 2. What is single-host today (the assumptions to break)
@@ -27,7 +27,7 @@ The design rests on three pieces (the shape this ticket proposes):
 flowchart TB
     subgraph host["Single host (today)"]
         primary["primary<br/>(MCP client)"]
-        daemon["bridged daemon<br/>127.0.0.1:8765"]
+        daemon["fleetd daemon<br/>127.0.0.1:8765"]
         reg["in-process registry<br/>keyed by PeerHandle.id() == paneId"]
         herdr["herdr<br/>(local unix-socket PTY mux)"]
         w1["worker pane wQ:p1"]
@@ -48,21 +48,21 @@ Three concrete bake-ins assume one host:
 |---|---|---|
 | **herdr is local** | `herdr/` unix socket `~/.config/herdr/herdr.sock` | You cannot drive another host's PTYs → each host **must** own its herdr. This is why a per-host gateway is mandatory. |
 | **registry is in-process, keyed by `paneId`** | `session/SessionManager` | `paneId` (e.g. `wQ:p2B`) is a herdr-local coordinate — meaningless off-host. Routing needs a host-unique id. |
-| **loopback, no authn** | `rest/BridgedApp` binds `127.0.0.1:8765` | Fine on one host; the moment a second host can talk to a gateway, that link is a trust boundary. |
+| **loopback, no authn** | `rest/FleetApp` binds `127.0.0.1:8765` | Fine on one host; the moment a second host can talk to a gateway, that link is a trust boundary. |
 
 ## 3. Target architecture
 
 ```mermaid
 flowchart TB
     subgraph hostA["HOST A"]
-        gA["gateway = bridged A"]
+        gA["gateway = fleetd A"]
         regA["local registry + herdr"]
         primary["primary (MCP client)"]
         gA --- regA
         primary --- gA
     end
     subgraph hostB["HOST B"]
-        gB["gateway = bridged B"]
+        gB["gateway = fleetd B"]
         regB["local registry + herdr"]
         wb["worker panes"]
         gB --- regB
@@ -96,13 +96,13 @@ host's terminals.*
   delayed-message exchange (the remind/backoff loop for free) — the same reasons CB-307 picked it.
 
 - **Federated agent directory** = a **soft-state, bridge-owned** roster, *not* a broker-stored
-  database. Per the persistence-boundary decision (bridged is soft-state; the broker owns *message*
+  database. Per the persistence-boundary decision (fleetd is soft-state; the broker owns *message*
   durability, not *who/where/status*), each gateway announces its local agents `(globalId, host,
   status, capabilities)` on a `roster.*` presence topic with periodic heartbeats. Every gateway
   builds an eventually-consistent **union view** — literally CB-304's `rosterView`, federated. A
   stale entry expires by missed heartbeat (reuses CB-303's idle/TTL thinking).
 
-- **Per-host gateway** = today's `bridged` daemon, evolved. It already registers/manages sessions
+- **Per-host gateway** = today's `fleetd` daemon, evolved. It already registers/manages sessions
   and controls its local herdr; multi-host adds exactly two responsibilities: (a) a broker client
   that consumes its agents' inboxes and injects into local herdr, and (b) presence announce +
   union-roster assembly. Evolution, not rewrite.
@@ -111,7 +111,7 @@ host's terminals.*
 
 ```mermaid
 flowchart LR
-    send["bridge_send(globalId, msg)"] --> lookup{"directory:<br/>is globalId local?"}
+    send["fleet_send(globalId, msg)"] --> lookup{"directory:<br/>is globalId local?"}
     lookup -->|"yes"| local["inject via local herdr<br/>(today's Injector path)"]
     lookup -->|"no"| pub["publish agent.&lt;id&gt;.inbox<br/>(broker routes to owning gateway)"]
     pub --> consume["owning gateway consumes<br/>→ injects into its local herdr"]
@@ -123,7 +123,7 @@ broker. A sender is oblivious to which branch it took.*
 ## 4. What CB-307 already provides vs. what is net-new
 
 **CB-307 delivers the transport half** and is independently valuable on a single host: the AMQP
-broker fabric, the `bridged → broker` client/adapter, at-least-once + idempotent (dedup-by-id)
+broker fabric, the `fleetd → broker` client/adapter, at-least-once + idempotent (dedup-by-id)
 delivery, DLQ, and delayed-retry (remind). That *is* the "proxy cross-host message" backbone;
 extending the same broker from "worker→primary reliability" to "gateway↔gateway" is incremental.
 
@@ -158,17 +158,17 @@ sequenceDiagram
     participant BR as broker
     participant GA as gateway A
     participant P as primary (host A, MCP client)
-    W->>GB: bridge_reply
+    W->>GB: fleet_reply
     GB->>BR: publish primary-bound (durable, msg id)
     BR->>GA: route to A's primary inbox
     Note over GA: held durably until the primary pulls
-    P->>GA: blocking bridge_send resolves / bridge_poll
+    P->>GA: blocking fleet_send resolves / fleet_poll
     GA-->>P: reply (then ACK to broker)
 ```
 
 *Figure 4 — the broker makes the middle hop lossless, ordered, and idempotent; the **final** hop
 into the primary is still a **pull** (gateway A holds the message until the primary's blocking
-`bridge_send` or `bridge_poll`). Cross-host neither improves nor worsens this — it just spans hosts.
+`fleet_send` or `fleet_poll`). Cross-host neither improves nor worsens this — it just spans hosts.
 This is precisely the gap CB-307 closes on one host and CB-308 stretches across hosts.*
 
 ## 6. Staging & dependencies
@@ -207,8 +207,8 @@ they overlap (notably: the envelope is no longer optional, and dedup is split by
    gateway's host. This extends the single-host invariant — *identity comes from the connection,
    never an argument* — across the broker: cross-host, identity comes from the key. Complements
    (not replaces) per-gateway broker logins over TLS.
-2. **Profiles are owned by the worker's host.** `bridge_spawn(profile, host)` resolves the name in
-   the *target* gateway's `bridged.yaml`. Gateways advertise their profile names in presence
+2. **Profiles are owned by the worker's host.** `fleet_spawn(profile, host)` resolves the name in
+   the *target* gateway's `fleetd.yaml`. Gateways advertise their profile names in presence
    heartbeats, so a leader sees what each host offers before spawning; an unknown name is a clear
    error from the target. Secrets (base URLs, tokens) never leave the host that uses them.
 3. **Repo provisioning — clone from the forge, pinned.** A cross-host spawn names the repo URL and
@@ -259,7 +259,7 @@ they overlap (notably: the envelope is no longer optional, and dedup is split by
    serialize acks fleet-wide. Ordering caveat: a *return* (unroutable) arrives **before** the
    confirm, so "confirmed" ≠ "routed"; the sender checks the returned-set at confirm time.
    `mandatory` is false only for `BROADCAST`, where an empty group is legal silence.
-10. **Queue lifecycle is session lifecycle.** `bridge_stop`/reap deletes the worker's inbox queue
+10. **Queue lifecycle is session lifecycle.** `fleet_stop`/reap deletes the worker's inbox queue
     (its `broadcast.*` bindings die with it — no broadcasts to the dead); `x-expires` collects
     queues orphaned by a crashed gateway (long for main/orchestrator inboxes, short for workers).
     Queue names carry a version suffix (`.v2`): AMQP refuses to redeclare an existing durable
@@ -275,11 +275,11 @@ they overlap (notably: the envelope is no longer optional, and dedup is split by
 - **Gateway discovery:** how gateways find the broker and each other (static config vs. discovery).
 - **Control authorization — THE GATE ON U4.** Signing (§7.1) settles *who sent it*; authorization
   is *who may do what*. **Cross-host spawn must not land before the minimal version exists**: a
-  per-host allowlist in `bridged.yaml` — beside the peer public keys — of gateway ids permitted to
+  per-host allowlist in `fleetd.yaml` — beside the peer public keys — of gateway ids permitted to
   publish control to this host, checked against the verified signature. A few lines of config and
   check; without them, any principal holding broker credentials can start processes on every host
   in the fleet.
-- **Key distribution & rotation:** static config (host → public key in each `bridged.yaml`) is
+- **Key distribution & rotation:** static config (host → public key in each `fleetd.yaml`) is
   fine at the current 2–3 host scale; rotation is manual. A refinement, not a blocker.
 - **Gateway death mid-turn:** the roster reaps it by missed heartbeat, and in-flight primary-bound
   messages survive by broker durability; still open is reconciling *worker* state when the dead

docs/CB-401-Peer-Launcher-SPI.md

@@ -7,7 +7,7 @@ the core learning any one peer's environment.
 ## 1. Why
 
 `claude-bridge` is a **communication bus between heterogeneous AI agents** — its stable surface is
-the protocol (`bridge_spawn / send / poll / reply / ask / list / stop / status`), and that surface
+the protocol (`fleet_spawn / send / poll / reply / ask / list / stop / status`), and that surface
 should stay provider-neutral. Today the daemon can only materialize one kind of peer: an
 off-subscription Claude Code CLI over herdr. Everything specific to *how that peer is set up*
 (`ANTHROPIC_BASE_URL`, the subscription guard, `--mcp-config`/system-prompt flags, `claude-*`
@@ -60,7 +60,7 @@ Where Claude/herdr specifics actually live today:
 | `claude-<profile>-<nonce>-<seq>` naming, `WORKER_NAME` regex, orphan reap (CB-117) | `WorkerService` | **→ adapter** (naming is a herdr-label detail) |
 | `GITEA_TOKEN` / `GITEA_HOST` injection (CB-302 checkpoint) | `WorkerService.spawn` | **→ adapter** + a **capability** (§6) |
 | tab/pane placement, worker space, tab labels | `WorkerService.spawnInTab/spawnAsPane` via herdr `WorkspaceControl` | **→ adapter** (herdr transport detail) |
-| `BridgedConfig.Worker` profile shape (`baseUrl`, `model`, `configDir`, …) | `config` | **mostly adapter-shaped** — see §5 |
+| `FleetConfig.Worker` profile shape (`baseUrl`, `model`, `configDir`, …) | `config` | **mostly adapter-shaped** — see §5 |
 | FSM, registry, roster, `reapIdle`/`drainAll`/`contextCap`, `rosterView` | `SessionManager` | **stays core** |
 | turn/completion detection (`TurnListener`, `CompletionResolver`, `StatusPoller`, `WorkerPresence`) | `inject/` | **stays core**, but reads herdr terminal output → transport-coupled (§4b) |
 | message store & routing | `msg/` | **stays core** |
@@ -118,7 +118,7 @@ hard-wire "turns come from herdr".
 
 ## 5. Config shape
 
-`BridgedConfig.Worker` is Claude-shaped (`baseUrl`, `model`, `configDir`, `tokenEnv`). Rather than
+`FleetConfig.Worker` is Claude-shaped (`baseUrl`, `model`, `configDir`, `tokenEnv`). Rather than
 break existing YAML, CB-401 keeps `workers:` exactly as-is and treats those fields as the
 **ClaudeCodeLauncher's** profile schema. A future peer kind adds a `kind:` discriminator
 (default `"claude-code"`) selecting the launcher; unknown-kind → clear config error. No migration of
@@ -126,7 +126,7 @@ existing configs. (Jackson already ignores unknown keys, so adding `kind` is bac
 
 ```mermaid
 sequenceDiagram
-    participant MCP as bridge_spawn (MCP/REST)
+    participant MCP as fleet_spawn (MCP/REST)
     participant SM as SessionManager
     participant L as PeerLauncher (by profile.kind)
     participant T as transport (herdr)
@@ -150,7 +150,7 @@ degrades gracefully when a launcher lacks one:
 
 | Capability | Meaning | Claude Code | Codex (likely) | Human |
 |---|---|---|---|---|
-| `MID_TURN_ASK` | supports `bridge_ask` rendezvous | ✓ | ? | ✗ |
+| `MID_TURN_ASK` | supports `fleet_ask` rendezvous | ✓ | ? | ✗ |
 | `SELF_PR` | can open its own PR at checkpoint (CB-302) | ✓ (opt-in token) | ? | ✗ |
 | `WORKTREE` | can run in a provisioned git worktree | ✓ | ✓ | ✗ |
 | `ORPHAN_REAP` | spawner can reconcile orphaned peers on boot | ✓ | ? | ✗ |
@@ -185,13 +185,13 @@ messages, not verified facts.
 Deliverable for CB-401 Stage A — mechanical, behaviour-preserving:
 
 1. `PeerLauncher` interface + `PeerHandle` (opaque id) + `SpawnRequest` (profile, requestedCwd,
-   callerCwd) + `Capability` enum, new package `dev.ltms.bridged.peer`.
+   callerCwd) + `Capability` enum, new package `dev.ltms.fleet.peer`.
 2. `ClaudeCodeLauncher implements PeerLauncher` = today's `WorkerService`, adapted: `spawn(...)`
    returns a `PeerHandle` (id = paneId), `capabilities()` declares
    `MID_TURN_ASK, SELF_PR(when token), WORKTREE, ORPHAN_REAP`.
 3. `SessionManager` depends on `PeerLauncher`, not `WorkerService` concretely; routing keys on
    `PeerHandle.id()` (== paneId today, so zero value change).
-4. `Bridged.main` wires the concrete `ClaudeCodeLauncher` behind the interface.
+4. `Fleetd.main` wires the concrete `ClaudeCodeLauncher` behind the interface.
 5. **No behaviour change, no config change.** Full green gate: `ide_sync` → `ide_diagnostics`
    (0 errors/0 warnings) → `mvn clean install` with `MVN_EXIT` captured (no masking pipe). All
    existing tests pass unchanged; add tests only for the new `PeerHandle` indirection.

docs/CB-402-OpenCode-Adapter.md

@@ -11,7 +11,7 @@ All five increments of §4 are done, including increment 5 (the §5 live checkli
 
 ## 1. Goal
 
-Prove the [`PeerLauncher`](../bridged/src/main/java/dev/ltms/bridged/peer/PeerLauncher.java) SPI
+Prove the [`PeerLauncher`](../fleetd/src/main/java/dev/ltms/fleet/peer/PeerLauncher.java) SPI
 actually holds for a **non-Claude** coding agent by shipping a second, first-class in-tree
 adapter: **opencode** (`opencode` 1.1.31, a provider-agnostic terminal coding agent).
 
@@ -56,8 +56,8 @@ flowchart TB
 
 *Figure 1 — the two concerns tangled inside today's single launcher; CB-402 splits them.*
 
-There is also a **Stage-A deferral** to finish: `Bridged.main` still casts
-`(ClaudeCodeLauncher) workers` at the `BridgeMcp` and `BridgedApp` constructors. Those two
+There is also a **Stage-A deferral** to finish: `Fleetd.main` still casts
+`(ClaudeCodeLauncher) workers` at the `FleetMcp` and `FleetApp` constructors. Those two
 callers only invoke `profiles()`, `defaultProfile()`, and `list()` — **all already on the
 `PeerLauncher` interface**. The cast survives for one reason only: `PeerLauncher.list()`
 returns `List<?>` (element type erased) while the callers use `Agent` element methods in their
@@ -68,7 +68,7 @@ roster join. Finishing the migration is therefore small and contained (§4.D).
 ## 3. Target design
 
 Template-Method base + two thin adapters + a routing composite that keeps the Stage-A seam
-(one `PeerLauncher` reference held by `SessionManager` / `BridgeMcp` / `BridgedApp`) intact.
+(one `PeerLauncher` reference held by `SessionManager` / `FleetMcp` / `FleetApp`) intact.
 
 ```mermaid
 flowchart TB
@@ -114,7 +114,7 @@ Two adapter **hooks** (abstract):
 protected abstract String namePrefix();               // "claude" | "opencode"
 
 /** Build the peer-specific launch: env map + argv. Runs any pre-spawn guard here. */
-protected abstract Launch buildLaunch(BridgedConfig.Worker cfg, SpawnRequest req);
+protected abstract Launch buildLaunch(FleetConfig.Worker cfg, SpawnRequest req);
 record Launch(Map<String,String> env, List<String> argv) {}
 ```
 
@@ -126,7 +126,7 @@ so the opencode adapter never reaps a `claude-*` pane and vice-versa. The compos
 
 ### B. `kind:` config discriminator
 
-Add one field to `BridgedConfig.Worker`:
+Add one field to `FleetConfig.Worker`:
 
 ```java
 String kind          // "claude-code" (default) | "opencode"
@@ -138,7 +138,7 @@ String kind          // "claude-code" (default) | "opencode"
   so the record stays declarative.)
 - Keep the existing back-compat constructors; `kind` is additive and optional.
 
-`bridged.example.yaml` documents a two-kind `workers:` block.
+`fleetd.example.yaml` documents a two-kind `workers:` block.
 
 ### C. `OpenCodeLauncher` — the adapter hooks for opencode
 
@@ -164,13 +164,13 @@ String kind          // "claude-code" (default) | "opencode"
 
 ### D. `CompositePeerLauncher` + finish the Stage-A migration
 
-- `Bridged.main` groups configured profiles by `kind`, instantiates one launcher per kind
+- `Fleetd.main` groups configured profiles by `kind`, instantiates one launcher per kind
   present, and wraps them in `CompositePeerLauncher implements PeerLauncher`.
 - Routing methods (`spawn(req)`, `effectiveCwd(req)`, `parityOverlay(name)`) dispatch by the
   profile's kind. Fan-out methods (`list()`, `reapOrphanWorkers()`, `capabilities()`,
   `profiles()`, `defaultProfile()`) merge across sub-launchers. `stop(id)` tries each (teardown
   only knows the pane id) — already best-effort/idempotent.
-- **Migrate `BridgeMcp` + `BridgedApp` to the `PeerLauncher` interface**, dropping both
+- **Migrate `FleetMcp` + `FleetApp` to the `PeerLauncher` interface**, dropping both
   `(ClaudeCodeLauncher)` casts. Only friction is `list()`'s `List<?>`; resolve by giving the SPI
   a typed roster element (small neutral `PeerAgent` view exposing `id()`/`name()`/status) that
   the CB-304 roster join consumes — or, minimally, narrow at the callsite. Prefer the typed view.
@@ -179,12 +179,12 @@ String kind          // "claude-code" (default) | "opencode"
 sequenceDiagram
     autonumber
     participant P as Primary
-    participant M as BridgeMcp / REST
+    participant M as FleetMcp / REST
     participant C as CompositePeerLauncher
     participant O as OpenCodeLauncher
     participant B as HerdrPeerLauncher (base)
     participant H as herdr
-    P->>M: bridge_spawn(profile="oc-impl")
+    P->>M: fleet_spawn(profile="oc-impl")
     M->>C: spawn(SpawnRequest)
     C->>C: kind(profile)=="opencode"
     C->>O: spawn(req)
@@ -208,7 +208,7 @@ sequenceDiagram
    `ClaudeCodeLauncher` extend it with `namePrefix()="claude"` and `buildLaunch()` wrapping
    today's guard+env+argv logic. Green build, identical tests — pure refactor. *(IDE
    `refactor` where possible; the primary re-runs the gate workers can't.)*
-2. **`kind:` discriminator.** Add the field + normalization + `bridged.example.yaml`. Default
+2. **`kind:` discriminator.** Add the field + normalization + `fleetd.example.yaml`. Default
    path unchanged (`kind=claude-code`).
 3. **`OpenCodeLauncher`.** Implement the three hooks; unit-test `buildLaunch` (env has no
    `ANTHROPIC_BASE_URL`; `OPENCODE_CONFIG` points at a file carrying the bridge MCP block +
@@ -226,11 +226,11 @@ until it is "major" (Stage-B whole), per the CB-401 bar.
 - **opencode TUI ⇄ herdr injection.** herdr drives a pane by typing into a TUI. Must confirm
   opencode's TUI accepts injected keystrokes/submit the way `claude` does, and reaches an
   `injectable` status the CB-306 gate recognizes. *Validation:* spawn one opencode worker,
-  watch the readiness gate pass, `bridge_send` a trivial task.
+  watch the readiness gate pass, `fleet_send` a trivial task.
 - **Bridge MCP visibility in opencode.** Confirm `OPENCODE_CONFIG` (or `opencode mcp add`)
-  actually surfaces the `bridge_*` tools inside the opencode session, and that `bridge_reply`
+   actually surfaces the `fleet_*` tools inside the opencode session, and that `fleet_reply`
   is callable — the reply-charter is worthless if the tool isn't mounted. *Validation:* the
-  worker completes a task by calling `bridge_reply`; the reply lands via the CB-307 path.
+  worker completes a task by calling `fleet_reply`; the reply lands via the CB-307 path.
 - **opencode MCP/config schema drift.** opencode is fast-moving (1.1.31 today). Pin the config
   schema we generate against the installed version; treat the exact keys (`type: "remote"` vs
   `"http"`, `instructions` shape) as a dogfood-verified fact, not an assumption.
@@ -244,7 +244,7 @@ until it is "major" (Stage-B whole), per the CB-401 bar.
 
 - **Unit (hermetic):** base-extraction regression (existing `ClaudeCodeLauncher` tests pass
   unchanged); `OpenCodeLauncher.buildLaunch` env/argv/config assertions; `kind` normalization
-  in `BridgedConfigTest`; `CompositePeerLauncher` routing + fan-out (merge of `profiles()`,
+  in `FleetConfigTest`; `CompositePeerLauncher` routing + fan-out (merge of `profiles()`,
   summed `reapOrphanWorkers()`, per-kind reap isolation) with fake sub-launchers.
 - **Live (dogfood, manual):** the §5 checklist on the running daemon.
 - **Gate (primary):** IDE diagnostics 0/0 on every changed file, `mvn clean install` green with
@@ -269,7 +269,7 @@ until it is "major" (Stage-B whole), per the CB-401 bar.
 
 ## 8. As-built — live dogfood (2026-07-29)
 
-Run against `bridged` on `127.0.0.1:8766` at main `19cdf8d`, with opencode **1.18.5** installed
+Run against `fleetd` on `127.0.0.1:8766` at main `19cdf8d`, with opencode **1.18.5** installed
 via Homebrew. Every §5 risk is now a verified fact rather than an assumption.
 
 **The version-drift risk was the real one, and it did not bite.** This adapter was designed against
@@ -281,7 +281,7 @@ as a dogfood-verified fact for 1.18.5.
 | §5 risk | Result |
 |---|---|
 | opencode TUI ⇄ herdr injection; CB-306 gate | ✅ `peer pane=wD:p3 reached injectable state` ~0.6s after `agent.start` |
-| Bridge MCP visible + `bridge_reply` callable | ✅ MCP `initialize` from `Implementation[name=opencode, version=1.18.5]`; worker replied through the tool |
+| Bridge MCP visible + `fleet_reply` callable | ✅ MCP `initialize` from `Implementation[name=opencode, version=1.18.5]`; worker replied through the tool |
 | Config schema drift (1.1.31 → 1.18.5) | ✅ unchanged, see above |
 | Provider credentials | ✅ free tier, zero credentials |
 
@@ -291,7 +291,7 @@ Full lifecycle exercised through the REST surface:
    to `OpenCodeLauncher` (`spawning opencode profile=opencode-free`), pane `wD:p3`.
 2. Readiness: `{"ready":true,"status":"idle"}`, roster state `ready`.
 3. `POST /sessions/{id}/message` → **`{"replySource":"reply","reply":"391"}`** — a *structured*
-   `bridge_reply`, not the CB-115 completion-fallback transcript scrape. The clean path.
+   `fleet_reply`, not the CB-115 completion-fallback transcript scrape. The clean path.
 4. `DELETE /workers/wD:p3` → `204`, roster empty, tolerant teardown (`tab_not_found` ignored —
    opencode had already closed its own tab).
 
@@ -301,5 +301,5 @@ identity (loopback peer PID → herdr pane) classified an **opencode** process a
 opencode-specific handling — confirming the identity model is peer-kind-agnostic, which is exactly
 what CB-308 needs when it stretches the roster across hosts.
 
-CB-502 counters for the same run: `bridged_sends_total{outcome="replied"} 1`,
-`bridged_replies_total{path="rendezvous"} 1`, `bridged_inbox_depth{...} 0`.
+CB-502 counters for the same run: `fleet_sends_total{outcome="replied"} 1`,
+`fleet_replies_total{path="rendezvous"} 1`, `fleet_inbox_depth{...} 0`.

docs/CB-500-Multi-Tier-Coordination.md

@@ -38,14 +38,14 @@ never toolchain ownership (§7).
 flowchart TB
     human["human (types)"]
     primary["PRIMARY (Opus)<br/>MCP client — pull-only"]
-    daemon["bridged daemon<br/>127.0.0.1:8765 (single host)"]
+    daemon["fleetd daemon<br/>127.0.0.1:8765 (single host)"]
     comp["CompositePeerLauncher<br/>routes by kind"]
     cc["ClaudeCodeLauncher"]
     oc["OpenCodeLauncher"]
     w1["worker pane (gx00 vLLM)"]
     w2["worker pane (ollama)"]
     human --> primary
-    primary -->|"bridge_send / spawn / ask"| daemon
+    primary -->|"fleet_send / spawn / ask"| daemon
     daemon --> comp
     comp --> cc
     comp --> oc
@@ -80,7 +80,7 @@ flowchart TB
         m1["main A: Opus<br/>MCP client"]
         m2["main B: cloud module<br/>MCP client"]
     end
-    subgraph bus["bridged fabric (CB-307/308 substrate)"]
+    subgraph bus["fleetd fabric (CB-307/308 substrate)"]
         chan["per-agent inbox channels<br/>agent.&lt;globalId&gt;.inbox"]
         roster["federated roster (union view)"]
     end
@@ -146,11 +146,11 @@ env-manager" rule (§7).*
 ```mermaid
 sequenceDiagram
     participant M as main (delegator)
-    participant D as bridged
+    participant D as fleetd
     participant SL as SandboxLauncher
     participant SB as sandbox (peer-owned)
     participant A as agent in sandbox
-    M->>D: bridge_spawn(profile=backend, role=backend)
+    M->>D: fleet_spawn(profile=backend, role=backend)
     D->>SL: spawn(SpawnRequest)
     SL->>SB: start entrypoint (image = backend role)
     Note over SL,SB: bridge injects guarded ANTHROPIC_BASE_URL,<br/>mounts bridge MCP url + reply charter
@@ -189,7 +189,7 @@ flowchart TB
         m2["main B: cloud module<br/>MCP client (pull-only)"]
     end
     reg["PrimaryRegistry → multi-slot<br/>(terminal per main)"]
-    subgraph fabric["bridged"]
+    subgraph fabric["fleetd"]
         ca["agent.A.inbox"]
         cb["agent.B.inbox"]
         push["ReplyPushLoop → N terminals"]
@@ -211,14 +211,14 @@ transport is already peer-neutral — what was missing is N pull endpoints).*
 ```mermaid
 sequenceDiagram
     participant MA as main A (Opus)
-    participant BR as bridged / broker
+    participant BR as fleetd / broker
     participant MB as main B (cloud)
-    MA->>BR: bridge_send(to = main B, msg)
+    MA->>BR: fleet_send(to = main B, msg)
     BR->>BR: publish agent.B.inbox (durable, msg id)
     Note over BR: held until B pulls (B is a client too)
-    MB->>BR: blocking bridge_send / poll resolves
+    MB->>BR: blocking fleet_send / poll resolves
     BR-->>MB: msg (then ACK)
-    MB->>BR: bridge_reply(to = main A)
+    MB->>BR: fleet_reply(to = main A)
     BR->>BR: publish agent.A.inbox
     MA->>BR: poll resolves
     BR-->>MA: reply
@@ -233,7 +233,7 @@ push-loop fan-out; relax "orchestration tools only the primary calls" to "any re
 ## 6. Development C — Orchestrator tier
 
 > **SUPERSEDED — do not implement this model.** The operator rejected a supervisor above the lead.
-> The human continues to drive the pre-existing lead directly; bridged neither spawns nor resumes that
+> The human continues to drive the pre-existing lead directly; fleetd neither spawns nor resumes that
 > lead. What replaced this proposal is **one lead, two short-lived advisory architects, and N workers**:
 > the lead engages architects sideways for a strong-model assessment, then discards them. Architect
 > slots are declared in `architects:` (see Gitea issue #16), rather than making leads managed sessions.
@@ -243,7 +243,7 @@ push-loop fan-out; relax "orchestration tools only the primary calls" to "any re
 
 > **Historical alternative retained.** The text and figures below record the considered model and why it
 > was rejected: it re-rooted the human-facing session above the lead, violating the still-true premise
-> that configured leaders pre-exist, are recognised, and cannot be resumed by bridged.
+> that configured leaders pre-exist, are recognised, and cannot be resumed by fleetd.
 
 The orchestrator is **`SessionManager` recursed one tier up**: today it spawns/names/reaps *worker*
 sessions; the orchestrator does the same for *main* sessions, and adds **context scoping**.
@@ -287,7 +287,7 @@ sequenceDiagram
     H->>O: high-level goal (large context)
     O->>O: name/resume main A session
     O->>MA: task + SCOPED context slice (not the whole history)
-    MA->>W: bridge_send(delegation, carrying only the relevant slice)
+    MA->>W: fleet_send(delegation, carrying only the relevant slice)
     W-->>MA: result
     MA-->>O: rollup
     O->>O: fold into orchestrator context, pick next main/turn
@@ -385,7 +385,7 @@ ticket is an extension of an existing pattern (CB-402 for A, CB-308 for B/C).
 
 The follow-up question — *"clarify the architecture when we have distributed agents in sandboxes"* —
 resolves the fork left open in §4 and §9. **Decision: Development A (sandbox launcher) and CB-308
-(per-host federation) *compose*, not compete — each host runs a `bridged` gateway whose launcher
+(per-host federation) *compose*, not compete — each host runs a `fleetd` gateway whose launcher
 spawns agents into that host's *local* sandboxes.** A sandbox is never reached across the network; it
 is reached by the gateway sitting next to it.
 
@@ -393,7 +393,7 @@ is reached by the gateway sitting next to it.
 
 The bus delivers a turn by **herdr keystroke-injection** — `Injector → AgentControl.send` writes into
 a PTY that its **local** herdr owns. The broker moves *messages and presence*, **never keystrokes**.
-So an agent's PTY must live in a herdr that *some* `bridged` instance drives locally: a remote
+So an agent's PTY must live in a herdr that *some* `fleetd` instance drives locally: a remote
 container with no local herdr **cannot be injected into**. That rules out a central daemon reaching
 remote PTYs, and collapses the design to a single identity:
 
@@ -403,7 +403,7 @@ remote PTYs, and collapses the design to a single identity:
 flowchart TB
     subgraph hostA["HOST A — gateway"]
         mA["main / orchestrator<br/>MCP client → LOCAL gateway"]
-        gA["bridged A<br/>herdr + CompositePeerLauncher<br/>(incl. SandboxLauncher)"]
+        gA["fleetd A<br/>herdr + CompositePeerLauncher<br/>(incl. SandboxLauncher)"]
         cBEa["sandbox: backend<br/>(local container)"]
         cFEa["sandbox: frontend<br/>(local container)"]
         mA --- gA
@@ -415,7 +415,7 @@ flowchart TB
         roster["roster.* (federated presence)"]
     end
     subgraph hostB["HOST B — gateway"]
-        gB["bridged B<br/>herdr + SandboxLauncher"]
+        gB["fleetd B<br/>herdr + SandboxLauncher"]
         cBEb["sandbox: backend<br/>(local container)"]
         gB -->|"spawn → PTY in B's herdr"| cBEb
     end
@@ -440,13 +440,13 @@ sequenceDiagram
     participant BR as broker
     participant GB as gateway B
     participant SB as sandbox agent (host B, container)
-    MA->>GA: bridge_send(globalId on B, msg)
+    MA->>GA: fleet_send(globalId on B, msg)
     GA->>GA: directory lookup - is globalId local? NO
     GA->>BR: publish agent.ID.inbox (durable)
     BR->>GB: route to the owning gateway
     GB->>SB: inject via B's LOCAL herdr (keystrokes)
     Note over GB,SB: SandboxLauncher already spawned the container -<br/>its PTY is in B's herdr, CB-306 readiness passed
-    SB-->>GB: bridge_reply (to B's LOCAL MCP endpoint)
+    SB-->>GB: fleet_reply (to B's LOCAL MCP endpoint)
     GB->>BR: publish primary-bound (durable, msg id)
     BR->>GA: route back to A
     Note over GA: held until the main pulls (the main is a client)
@@ -470,7 +470,7 @@ unchanged — the sandbox is transparent to it.*
 
 | Concern | Provided by |
 |---|---|
-| Per-host gateway (owns local herdr + sessions) | **CB-308** (today's `bridged`, evolved) |
+| Per-host gateway (owns local herdr + sessions) | **CB-308** (today's `fleetd`, evolved) |
 | Spawn into a local sandbox / role→image | **Development A** `SandboxLauncher` (§4), routed by `CompositePeerLauncher` |
 | Addressing a remote sandboxed agent | **CB-308** global id + federated roster (host + role as metadata) |
 | Orphan reap after a gateway restart | **CB-117** per-gateway, summed by the composite — each reaps only its **local** herdr |

docs/CB-591-Gateway-Migration.md

@@ -9,7 +9,7 @@ with no terminator, and our third-party members cannot detect it (§7.2).
 · **Upstream issue:** [systems/vms#31](https://git.ltms.dev/systems/vms/issues/31)
 
 The gateway went live on 2026-08-15 and replaced Bifrost. This plan says what that means for a
-**member definition** in `bridged.yaml`, because that is the part of this repo the change actually
+**member definition** in `fleetd.yaml`, because that is the part of this repo the change actually
 touches.
 
 ---
@@ -51,7 +51,7 @@ Three facts about our side that decide the shape of this work:
    `ANTHROPIC_AUTH_TOKEN` (the value is read from a host env var and never stored in config).
    `local` sets no `tokenEnv` today, because a direct vLLM needs no token.
 2. **`SubscriptionGuard` refuses any host not on an allowlist**, and that allowlist is
-   `guard.offSubscriptionHosts: [gx00.gw]`. It is built once in `Bridged.java:93` and handed to the
+   `guard.offSubscriptionHosts: [gx00.gw]`. It is built once in `Fleetd.java:93` and handed to the
    launcher, so **it is a restart-required key**, not a hot one. Changing `baseUrl` without changing
    this makes every `local` spawn throw.
 3. **The wiki names us as a blocker.** Under *Not done yet*: retiring the shared `legacy` token is
@@ -132,18 +132,18 @@ own provider credentials. So 3b needs **no allowlist change**; only 3a does.
 
 **Both still need a restart, for a different reason.** `tokenEnv` is resolved by
 `HerdrPeerLauncher.resolveEnv` → `env.apply(name)`, which reads the **daemon's own process
-environment**. The running `bridged` inherited its environment when it started, so a variable added to
+environment**. The running `fleetd` inherited its environment when it started, so a variable added to
 `secrets.sh` afterwards is simply not there — the launcher would inject an empty token and the
-gateway would answer 401. This is the same failure as trap 1 in `scripts/redeploy-bridged.sh`
+gateway would answer 401. This is the same failure as trap 1 in `scripts/redeploy-fleetd.sh`
 (`WORKER_GITEA_TOKEN`), and it has the same fix: **restart from a login shell**, and use
-`scripts/redeploy-bridged.sh --check` to confirm the name resolves before restarting anything.
+`scripts/redeploy-fleetd.sh --check` to confirm the name resolves before restarting anything.
 
 ### 3c. What this does to `ccs`
 
 Once a profile carries `baseUrl`, `tokenEnv` and `model` itself, the ccs instance stops being what
 routes a member. Be precise about what is left, though: `configDir` still supplies **folder trust**
 and `settings.json`, and dropping it is what produced the trust dialog and the wrong-model error
-recorded in `bridged.yaml`. So ccs goes from *deciding where the tokens go* to *holding client-side
+recorded in `fleetd.yaml`. So ccs goes from *deciding where the tokens go* to *holding client-side
 state*. Less load-bearing, not removable.
 
 ### Why `/anthropic` and never `/v1/chat/completions`
@@ -186,7 +186,7 @@ Switching buys four things we do not have:
 - **Free opencode capacity, off the shared credential.** The largest single win. See §3b — it retires
   a real single point of failure, not just a cost line.
 - **Per-consumer usage figures.** The cockpit counts requests per consumer. That is the first real
-  measurement of what the fleet consumes, and it feeds [CB-589](https://git.ltms.dev/lms/claude-bridge/issues/74) Gap 2 directly.
+  measurement of what the fleet consumes, and it feeds [CB-589](https://git.ltms.dev/fleet/fleetd/issues/74) Gap 2 directly.
 - **Our own revocable token.** One consumer to revoke if a worker ever leaks it, instead of a shared
   `legacy` token used by four systems.
 - **It works off-LAN.** `gx00.gw` resolves on the LAN only.
@@ -196,7 +196,7 @@ every member spawn. The wiki keeps the direct route open precisely because "if t
 nothing that matters is blocked."
 
 So keep it. Add a second profile `local-direct` pointing at `http://gx00.gw:8000` with **`weight: 0`**
-— never auto-selected, still spawnable with an explicit `bridge_spawn{profile: "local-direct"}`.
+— never auto-selected, still spawnable with an explicit `fleet_spawn{profile: "local-direct"}`.
 That is exactly what CB-554 made `weight: 0` mean, and it turns the escape hatch into something the
 lead can actually reach during an incident.
 
@@ -207,7 +207,7 @@ worker's honesty rule leans on it ("never claim the result of a check you had no
 
 - **Keep bridge-only.** The invariant stays true and simple. Workers stay cheap and narrow.
 - **Add the gateway MCP.** Implementers get context7 documentation lookups, which is genuinely useful
-  for library work. But `mcpUrl` in `BridgedConfig.Profile` is a **single `String`**, so a
+  for library work. But `mcpUrl` in `FleetConfig.Profile` is a **single `String`**, so a
   claude-code member can mount exactly one MCP — this needs a code change, not a config edit.
 
 Note the invariant is **already inaccurate**: `opencode.json` gives `sol` and `terra` both context7
@@ -217,7 +217,7 @@ defensible; picking one is not mine to do.
 ### D3 — token scope
 
 One consumer, `claude-bridge`, its token in `${SHARED_ENV}/tools/secrets.sh` as `AI_GATEWAY_TOKEN`,
-referenced by name only. Never the literal value in `bridged.yaml` — `tokenEnv` exists for this.
+referenced by name only. Never the literal value in `fleetd.yaml` — `tokenEnv` exists for this.
 
 ---
 
@@ -226,7 +226,7 @@ referenced by name only. Never the literal value in `bridged.yaml` — `tokenEnv
 ```mermaid
 flowchart TB
     U1["U1 · consumer token<br/>issue via cockpit, add to secrets.sh"]
-    U2["U2 · profile + guard<br/>bridged.yaml, restart"]
+    U2["U2 · profile + guard<br/>fleetd.yaml, restart"]
     U3["U3 · verify live<br/>spawn, prove thinking survives"]
     U4["U4 · context7 via gateway<br/>.mcp.json + opencode.json"]
     U5["U5 · docs<br/>CLAUDE.md, wiki 11-Features"]
@@ -238,7 +238,7 @@ flowchart TB
 | # | Scope | Who | Why |
 |---|---|---|---|
 | U1 | Issue the `claude-bridge` consumer at `auth.ltms.dev`; store as `AI_GATEWAY_TOKEN` | **operator** | touches secrets and a host we do not own |
-| U2a | New `gx` opencode profile on `/v1` — pure config, no guard change | **lead** | `bridged.yaml` is gitignored, so a worker cannot see or edit it |
+| U2a | New `gx` opencode profile on `/v1` — pure config, no guard change | **lead** | `fleetd.yaml` is gitignored, so a worker cannot see or edit it |
 | U2b | `local` → `/anthropic`; add `local-direct` weight 0; add `llm.ltms.dev` to the guard allowlist | **lead** | same |
 | U2c | One restart from a **login shell**, after U2a and U2b | **lead** | picks up `AI_GATEWAY_TOKEN` into the daemon env *and* the guard allowlist, in one stop |
 | U3 | Live spawn on both new profiles; confirm reasoning survives on each surface | **lead** | needs real spawns and the running daemon |
@@ -266,7 +266,7 @@ Each of these cost someone real debugging time upstream. They apply to us.
 1. **Rotating a token restarts the auth proxy, which drops in-flight streaming responses.** For us
    that means rotating `AI_GATEWAY_TOKEN` kills every live member mid-turn, and an async ticket's
    report goes with it. This is the same rule as a daemon redeploy: **drain the fleet first**
-   (`bridge_list` → `bridge_poll` anything wanted → `bridge_stop`), then rotate.
+   (`fleet_list` → `fleet_poll` anything wanted → `fleet_stop`), then rotate.
 2. **The gateway's own `SecurityPolicy` fails open.** Standalone `aigw run` accepts it and silently
    ignores it — an unauthenticated request returned **200**. Auth is the Caddy proxy in front, and
    nothing else. Never reason as if the gateway authenticates.
@@ -283,10 +283,10 @@ Each of these cost someone real debugging time upstream. They apply to us.
 
 Merging config is not proving it. The checks, in order:
 
-1. `bridge_spawn{profile: "gx"}` succeeds and the member completes a real turn ending in
-   `bridge_reply`. This is the first proof of the token, the URL and the model name, and it risks
+1. `fleet_spawn{profile: "gx"}` succeeds and the member completes a real turn ending in
+   `fleet_reply`. This is the first proof of the token, the URL and the model name, and it risks
    nothing the fleet depends on.
-2. `bridge_spawn{profile: "local"}` succeeds. If the guard allowlist was missed, this **throws** — a
+2. `fleet_spawn{profile: "local"}` succeeds. If the guard allowlist was missed, this **throws** — a
    loud, self-correcting failure, which is the good kind. If the restart was missed, it also throws,
    for the same reason.
 3. A `local` member completes a turn. That exercises streaming through two TLS edges, the auth proxy
@@ -297,9 +297,9 @@ Merging config is not proving it. The checks, in order:
    deltas. For `gx` on `/v1`, this answers the open question in §3 rather than assuming it.
 5. The cockpit at `auth.ltms.dev` shows requests counted against the `claude-bridge` consumer, not
    `legacy`. That is the whole point of taking our own token.
-6. `bridge_spawn{profile: "local-direct"}` still works, so the escape hatch is real rather than
+6. `fleet_spawn{profile: "local-direct"}` still works, so the escape hatch is real rather than
    theoretical.
-7. `bridge_list` shows `gx` carrying no `credentialId`, so a `sol`/`terra` exhaustion cannot
+7. `fleet_list` shows `gx` carrying no `credentialId`, so a `sol`/`terra` exhaustion cannot
    quarantine it. This is the single-point-of-failure claim in §3b, checked rather than asserted.
 
 ---
@@ -372,7 +372,7 @@ one turn; this one costs the whole task and is indistinguishable from a slow wor
 
 > **Diagnosing a stuck opencode member.** Do not read its pane. The launcher writes its config to a
 > temp dir and passes it as `OPENCODE_CONFIG` — find it with
-> `ls -dt /var/folders/*/*/T/bridged-opencode-* | head -1`, check the provider block and the key's
+> `ls -dt /var/folders/*/*/T/fleetd-opencode-* | head -1`, check the provider block and the key's
 > length and prefix (never its value), then reproduce with `opencode run --auto -m <provider>/<model>`
 > using the same `OPENCODE_CONFIG`. That is what turned "it hangs" into a one-line error.
 
@@ -383,7 +383,7 @@ one turn; this one costs the whole task and is indistinguishable from a slow wor
 - `/v1/models` returns exactly `["deepseek-v4-flash"]`, so trap 3 is clear.
 - **Reasoning survives both surfaces** — see §3b above.
 - The launcher's generated opencode provider block is correct, carrying a real 48-character `llmk-`
-  key rather than the `bridged-local-noauth` placeholder.
+  key rather than the `fleetd-local-noauth` placeholder.
 - `SubscriptionGuard` accepted `llm.ltms.dev` after the allowlist edit and the restart: `local`
   spawned without throwing, which is the check that catches a missed restart.
 
@@ -460,7 +460,7 @@ code.** That is the whole reason this section exists.
 
 ## 8. Related
 
-- [CB-589 / #74](https://git.ltms.dev/lms/claude-bridge/issues/74) — cost-first placement and a
+- [CB-589 / #74](https://git.ltms.dev/fleet/fleetd/issues/74) — cost-first placement and a
   gateway that reports live capacity. The per-consumer figures this migration unlocks are the first
   input that ticket actually needs.
 - `docs/CB-500-Multi-Tier-Coordination.md` §11 — the distributed-sandbox topology this gateway is

docs/CB-5xx-Hardening.md

@@ -12,12 +12,12 @@ not after it.
 
 ## 1. Why this stage is not optional bookkeeping
 
-`bridged` today has **exactly one security control: the loopback bind**. Every other guarantee
+`fleetd` today has **exactly one security control: the loopback bind**. Every other guarantee
 rests on it.
 
 The identity model (`mcp/ConnectionIdentity.java`) resolves a caller from the connection alone —
 the OS reports the connecting PID, herdr owns the PID→pane map, so a worker cannot forge another
-worker. Its own javadoc is explicit: *"Single-host only (the herd shares the `bridged` host); the
+worker. Its own javadoc is explicit: *"Single-host only (the herd shares the `fleetd` host); the
 token path is the split-host fallback."* The token path does not exist yet.
 
 That leaves a seam that is **latent today and load-bearing the moment the bind moves**:
@@ -67,7 +67,7 @@ it will be disabled and the stage is wasted. So:
 auth:
   mode: loopback-trust   # default — behaves exactly like today: loopback ⇒ PRIMARY, no token needed
   # mode: token          # every non-worker caller must present a valid bearer token
-  # tokenEnv: BRIDGED_API_TOKEN   # host env var holding the token; never the literal value
+  # tokenEnv: FLEETD_API_TOKEN   # host env var holding the token; never the literal value
 ```
 
 `mode: loopback-trust` is the current behaviour, named honestly and now *chosen* rather than
@@ -112,9 +112,9 @@ The roadmap says "systemd unit". **This host is macOS — there is no systemd on
 not found), and the daemon that has been dogfooded for weeks runs as a bare foreground
 `java -jar`. Ship **both**:
 
-- `deploy/dev.ltms.bridged.plist` — launchd agent, the *actual* runtime here, with `KeepAlive` and
+- `deploy/dev.ltms.fleet.plist` — launchd agent, the *actual* runtime here, with `KeepAlive` and
   ordered start after herdr.
-- `deploy/bridged.service` — systemd unit for the Linux gateways CB-308 introduces.
+- `deploy/fleetd.service` — systemd unit for the Linux gateways CB-308 introduces.
 
 Ordering after herdr is advisory in both: the herdr socket may not exist at boot, so the daemon
 must **retry the socket rather than exit** — supervision ordering is a nicety, socket-retry is the
@@ -158,10 +158,10 @@ configured. It already leaks nothing but herdr's version and up/down.
 ### 3.1 There are TWO entry paths, and only one of them has identity today
 
 The wiki describes MCP as "a thin adapter over the REST core". **At the code level that is not
-literally true, and the difference is security-relevant.** `BridgeMcp` calls `MessageService` /
+literally true, and the difference is security-relevant.** `FleetMcp` calls `MessageService` /
 `SessionManager` *directly*; it never issues an HTTP request against a Javalin route. And `/mcp` is
 mounted as a raw servlet on Jetty's `ServletContextHandler`
-(`BridgedApp.build → cfg.jetty.modifyServletContextHandler`), so it does **not** pass through
+(`FleetApp.build → cfg.jetty.modifyServletContextHandler`), so it does **not** pass through
 Javalin's `before` filters at all.
 
 The current split is the mirror image of what you'd expect:
@@ -172,7 +172,7 @@ The current split is the mirror image of what you'd expect:
 | REST routes | ❌ **none at all** — the session id is taken from the URL path and trusted | ❌ none |
 
 So REST is the *more* exposed surface: `POST /sessions/{id}/reply` accepts any `{id}` from the
-path, whereas the MCP `bridge_reply` derives the worker from the connection and refuses to read it
+path, whereas the MCP `fleet_reply` derives the worker from the connection and refuses to read it
 from an argument. Loopback-only bind is what makes this safe today.
 
 **Therefore CB-505 must enforce on both paths against one shared resolver** — not at a single
@@ -188,15 +188,15 @@ Deliberately small; every one maps to a failure mode we have actually hit.
 
 | Metric | Type | Why it exists |
 |---|---|---|
-| `bridged_sends_total{outcome}` | counter | outcome ∈ replied\|completion_fallback\|timeout\|failed — the completion-fallback rate is the health signal for turn detection (CB-115/116/118) |
-| `bridged_send_duration_seconds` | histogram | delegated turn latency |
-| `bridged_replies_total{path}` | counter | path ∈ rendezvous\|inbox — how often a reply strands (CB-307's whole reason to exist) |
-| `bridged_inbox_depth{target}` | gauge | undrained replies; steady-state should be 0 |
-| `bridged_push_nudges_total{outcome}` | counter | outcome ∈ delivered\|exhausted — a rising `exhausted` means the primary is not draining |
-| `bridged_spawns_total{kind,outcome}` | counter | outcome ∈ ready\|timeout\|guard_rejected; per peer kind (CB-402) |
-| `bridged_sessions{state}` | gauge | SPAWNING/READY/BUSY/DONE census |
-| `bridged_herdr_calls_total{method,outcome}` | counter | socket health — the dependency everything rests on |
-| `bridged_auth_failures_total{reason}` | counter | only meaningful once CB-501 lands; catches misconfigured workers |
+| `fleet_sends_total{outcome}` | counter | outcome ∈ replied\|completion_fallback\|timeout\|failed — the completion-fallback rate is the health signal for turn detection (CB-115/116/118) |
+| `fleet_send_duration_seconds` | histogram | delegated turn latency |
+| `fleet_replies_total{path}` | counter | path ∈ rendezvous\|inbox — how often a reply strands (CB-307's whole reason to exist) |
+| `fleet_inbox_depth{target}` | gauge | undrained replies; steady-state should be 0 |
+| `fleet_push_nudges_total{outcome}` | counter | outcome ∈ delivered\|exhausted — a rising `exhausted` means the primary is not draining |
+| `fleet_spawns_total{kind,outcome}` | counter | outcome ∈ ready\|timeout\|guard_rejected; per peer kind (CB-402) |
+| `fleet_sessions{state}` | gauge | SPAWNING/READY/BUSY/DONE census |
+| `fleet_herdr_calls_total{method,outcome}` | counter | socket health — the dependency everything rests on |
+| `fleet_auth_failures_total{reason}` | counter | only meaningful once CB-501 lands; catches misconfigured workers |
 
 ---
 
@@ -226,7 +226,7 @@ was answered from the forge itself. Kept here as the decision record.*
 
 1. ✅ **TLS scope (D3) — confirmed.** Bearer auth + the fail-fast bind guard ship in the daemon;
    TLS terminates at a reverse proxy, documented with a worked example. AMQP gets TLS via an
-   `amqps://` URI. No keystore handling in `bridged`.
+   `amqps://` URI. No keystore handling in `fleetd`.
 2. ✅ **Micrometer (D4) — confirmed dropped.** Zero-dependency Prometheus text renderer, for the
    reasons in D4 (pom reconciliation burden + the mandated CVE gate being un-runnable this
    session). Revisit if a push-gateway or JVM-metrics requirement appears; the endpoint is the

docs/M4-Fleet-Health.md

@@ -1,7 +1,7 @@
 # M4 - Fleet health, recovery, routing, and capacity
 
 **Status:** Design accepted on 2026-08-15. CB-573 part 1 has shipped the classification model and
-the `bridge_list` capacity view; the remaining M4 units are not yet shipped. See
+the `fleet_list` capacity view; the remaining M4 units are not yet shipped. See
 [Unit 2 — what has landed so far](#unit-2---what-has-landed-so-far) before planning Unit 2 work:
 some of its criteria were met by separate CB tickets, and one of them contradicts the unit text.
 **Scope:** Fleet evidence, safe mechanical repair, lead routing, capacity reporting, and optional
@@ -72,7 +72,7 @@ post-teardown invariant so a later regression becomes `DELEGATION_ORPHANED`.
 
 ### 2.2 Corrections made during design
 
-The first state table missed `BUSY` in bridged plus `IDLE` or `DONE` in herdr. It would have found
+The first state table missed `BUSY` in fleetd plus `IDLE` or `DONE` in herdr. It would have found
 the real trace only through a late, weak stall timer. The final model adds
 `TURN_BOUNDARY_LOST` as a strong disagreement state.
 
@@ -145,7 +145,7 @@ Idle may drive configured resource cleanup. It never opens an incident and never
 | `TURN_BOUNDARY_LOST` | Same session turn stays `BUSY`; same accepted task stays open; two raw snapshots show `IDLE` or `DONE` | Strong disagreement. Strict reconciliation may repair it. |
 | `ERROR_ON_SCREEN` | Suspicious non-working state survives grace; `detection` matches a tested adapter-specific fatal signature | Certain only for the matched signature. A bare word such as `Exception` is not enough. |
 | `STALL_SUSPECTED` | Open turn is older than the configured threshold; two normalised `recent_unwrapped` digests are unchanged; no boundary or reply occurs | Not certain. A long valid API call can look the same. Lead decides. |
-| `MUTE` | Turn resolves through completion fallback instead of `bridge_reply` | Certain that no structured reply won. It does not prove an MCP failure. A single event is a metric, not an incident. |
+| `MUTE` | Turn resolves through completion fallback instead of `fleet_reply` | Certain that no structured reply won. It does not prove an MCP failure. A single event is a metric, not an incident. |
 | `REPLY_STRANDED` | Typed reply or health message remains after owning-lead push reaches its cap | Collection failed. This does not explain whether the lead is busy, dead, or ignoring the nudge. |
 | `DELEGATION_ORPHANED` | Target is gone, failed, or released, but one or more tasks remain `PENDING` after reconciliation grace | Certain bridge invariant failure. This is not an inbox-drain fault. |
 | `WORK_PRODUCT_AT_RISK` | Provisioned branch has commits after its recorded base; member is `DONE`, `FAILED`, or preserved after release; no turn or inbox item remains; long-idle threshold passed | A warning, not proof of loss. Work may already have an open pull request or a squash merge. |
@@ -161,7 +161,7 @@ request or merge state. If committed work appears with `REPLY_STRANDED` or
 
 | State | Exact evidence | Certainty and action |
 |---|---|---|
-| `CONTROL_LINK_DOWN` | Two full-fleet `agent.list` calls fail across the grace, and herdr `ping` also fails | Certain for the bridged-to-herdr link. Retry calls, record the incident, and use human escalation if no lead can be reached. |
+| `CONTROL_LINK_DOWN` | Two full-fleet `agent.list` calls fail across the grace, and herdr `ping` also fails | Certain for the fleetd-to-herdr link. Retry calls, record the incident, and use human escalation if no lead can be reached. |
 
 A failed fleet list alone is not a dead-member claim. A single `_not_found` with a healthy global
 link is a target fault, not a control-link fault.
@@ -230,8 +230,8 @@ Only the lead may:
 - choose how to use partial work in a worktree;
 - restart herdr or change network, model, credentials, backend, or configuration.
 
-Reports include literal safe tool calls such as `bridge_status(sessionId="...")`,
-`bridge_poll(ticket="...")`, `bridge_list()`, and optional `bridge_stop(paneId="...")`. A judgement
+Reports include literal safe tool calls such as `fleet_status(sessionId="...")`,
+`fleet_poll(ticket="...")`, `fleet_list()`, and optional `fleet_stop(paneId="...")`. A judgement
 state never presents stop as the only action.
 
 ### 5.3 Release causes and worktree safety
@@ -251,7 +251,7 @@ preserving cause.
 
 Before abnormal release removes the live session, M4 writes an atomic manifest under the worktree
 root. It records session identity, owner, role, profile, repository, path, branch, base commit,
-release cause, release time, state, and pending task ids. `bridge_list.preservedWorktrees` loads these
+release cause, release time, state, and pending task ids. `fleet_list.preservedWorktrees` loads these
 manifests after restart. Stop output and WARN logs also name the path and cause. M4 never
 auto-deletes a preserved worktree.
 
@@ -298,7 +298,7 @@ Compiled brakes apply even if config asks for more:
 - at most two pane reads occur in one fleet tick;
 - targets rotate fairly;
 - only a normalised digest and optional clipped local excerpt are stored;
-- no pane excerpt leaves bridged in a human webhook.
+- no pane excerpt leaves fleetd in a human webhook.
 
 Use `detection` for tested screen signatures. Use normalised `recent_unwrapped` only for progress
 comparison.
@@ -330,7 +330,7 @@ The reader uses AMQP `content_type`, never body sniffing:
 
 ```text
 Legacy v0: text/plain
-Typed family: application/vnd.ltms.bridged.inbox-message+json
+Typed family: application/vnd.ltms.fleet.inbox-message+json
 ```
 
 A legacy reply may begin with `{`. It remains plain text because its media type is `text/plain`.
@@ -348,7 +348,7 @@ Invalid known-format data is copied byte-for-byte to durable queue
 before the original is acknowledged. A failed quarantine handoff leaves the original unacknowledged.
 The raw body never enters logs.
 
-Decode failure creates a redacted WARN, metric, `bridge_list` summary, and routed health incident.
+Decode failure creates a redacted WARN, metric, `fleet_list` summary, and routed health incident.
 One bad entry never escapes the consumer callback and never stops later valid messages.
 
 Safe downgrade is not supported. The previous build ignores `content_type` and would show typed JSON
@@ -399,13 +399,13 @@ Choose the candidate with the fewest assigned foreign incidents. Break ties by s
 then terminal id. Pin the recipient. Reassign only if that peer becomes unhealthy or retires. A
 routing generation marks a reassignment, and old pending assignments become superseded.
 
-`bridge_list` lead rows show health, health age, assigned foreign incident count, and a bounded list
+`fleet_list` lead rows show health, health age, assigned foreign incident count, and a bounded list
 of incident id, subject, state, severity, age, and routing generation. The top-level view also shows
 owner, recipient, and routing reason.
 
 A peer incident is published under the recipient lead's inbox key, not the failed subject's key. Its
 status-gated nudge names the failed lead and gives the exact
-`bridge_poll(target="<recipient-terminal>")` call.
+`fleet_poll(target="<recipient-terminal>")` call.
 
 ### 7.5 Lead inbox ownership
 
@@ -427,7 +427,7 @@ An idle, reachable lead may receive the existing bounded nudge. An unreachable o
 has no safe in-loop recovery. The bridge must not restart or replace it. A new lead would not have the
 failed lead's plan or context, and an uncertain relaunch could create two orchestrators.
 
-With no webhook, only `bridge_list`, `/healthz`, metrics, WARN logs, and the incident journal remain.
+With no webhook, only `fleet_list`, `/healthz`, metrics, WARN logs, and the incident journal remain.
 These are passive surfaces. They are not a human notification.
 
 ## 8. Lost-boundary reconciliation
@@ -520,8 +520,8 @@ A repaired result uses distinct `RECONCILED_COMPLETION` values in `Rendezvous`,
 task poll source, and metrics. The lead sees:
 
 ```text
-[repaired completion - bridged detected a lost turn boundary. The member did not call
-bridge_reply; pane-derived text follows and may be partial]
+[repaired completion - fleetd detected a lost turn boundary. The member did not call
+fleet_reply; pane-derived text follows and may be partial]
 ```
 
 Clipped text also keeps the existing clipped-tail marker.
@@ -551,7 +551,7 @@ failure operation once. It never recreates the task.
 
 Capacity is a view, not a health state.
 
-`bridge_list` adds one block per profile:
+`fleet_list` adds one block per profile:
 
 ```text
 profile, maxLoad, live, free, reclaimable
@@ -612,7 +612,7 @@ incident feeds lead-health evidence. If the lead then becomes unhealthy, peer or
 Webhook mode requires a resolved environment variable. Turning notification off stops outbound
 attempts but keeps incidents. Turning it back on resumes still-open human incidents.
 
-Without a sink, `bridge_list.healthCoverage` states that human escalation is unavailable. `/healthz`
+Without a sink, `fleet_list.healthCoverage` states that human escalation is unavailable. `/healthz`
 keeps its existing HTTP liveness result and adds a nested `fleetHealth.status=partial` component.
 Metrics and one startup or reload WARN expose the same limit.
 
@@ -687,14 +687,14 @@ The sink response body is ignored. A webhook cannot direct recovery. n8n remains
 M4 adds bounded-label series:
 
 ```text
-bridged_health_incidents{scope,state,severity}
-bridged_health_incidents_total{event}
-bridged_health_notifications_total{event,outcome}
-bridged_health_notification_queue_depth
-bridged_health_notification_last_success_seconds
-bridged_health_notification_capability{mode,status}
-bridged_lead_health{lead,state}
-bridged_lead_assigned_incidents{lead}
+fleet_health_incidents{scope,state,severity}
+fleet_health_incidents_total{event}
+fleet_health_notifications_total{event,outcome}
+fleet_health_notification_queue_depth
+fleet_health_notification_last_success_seconds
+fleet_health_notification_capability{mode,status}
+fleet_lead_health{lead,state}
+fleet_lead_assigned_incidents{lead}
 ```
 
 Metric labels never include terminal ids, incident ids, URLs, or error text.
@@ -792,7 +792,7 @@ Acceptance criteria:
     them.
 16. Explicit stop is state-aware. Any pending task or non-terminal state preserves the worktree.
 17. Atomic preserved-worktree manifests reload after restart and appear in lead-only
-    `bridge_list.preservedWorktrees`.
+    `fleet_list.preservedWorktrees`.
 18. Manifest failure preserves the worktree and opens an operator-visible health failure.
 19. Provision records the base commit. Terminal, long-idle worktrees report
     `WORK_PRODUCT_AT_RISK` only under the evidence in Section 4.2 and never auto-delete work.
@@ -807,7 +807,7 @@ Checked against `main` at `e09cac6` on 2026-08-15. Unit 2 was written as one blo
 have since been built by separate CB tickets. Read this before planning the rest, or that work gets
 done twice.
 
-The check was a symbol survey of `bridged/src/main/java` plus the merge history. It tells you whether
+The check was a symbol survey of `fleetd/src/main/java` plus the merge history. It tells you whether
 the machinery exists at all. It is **not** a line-by-line audit of whether each criterion is fully
 met, and I did not run one.
 
@@ -820,7 +820,7 @@ met, and I did not run one.
 | 14 | `DELEGATION_ORPHANED` | 3 files | **Partial.** The health state exists. The teardown-invariant check that creates it, and the retry rule, do not. |
 | 15 | `SPAWN_ROLLBACK` | 0 files | **Contradicted — see below.** |
 | 16 | — | — | Partial at best. CB-576 made release preserve a dirty worktree; whether explicit stop is state-aware is not checked. |
-| 17, 18 | `preservedWorktrees` | 0 files | Not started. No manifest, and no lead-only `bridge_list` field. |
+| 17, 18 | `preservedWorktrees` | 0 files | Not started. No manifest, and no lead-only `fleet_list` field. |
 | 19 | `WORK_PRODUCT_AT_RISK` | 0 files | Not started. |
 
 **Criterion 15 no longer matches the code, and the code is right.** It says "normal `COMPLETED`
@@ -837,7 +837,7 @@ preserve it. `SPAWN_ROLLBACK` itself does not exist yet.
 ### Unit 3 - Typed inbox and member routing
 
 Scope: semantic record, AMQP migration, both adapters, member routing, polling, and member health in
-`bridge_list`.
+`fleet_list`.
 
 Acceptance criteria:
 
@@ -852,7 +852,7 @@ Acceptance criteria:
 6. Invalid known data never escapes the callback, appears as a reply, or blocks later valid messages.
 7. Invalid data reaches durable per-target quarantine before original ack. Failed handoff leaves the
    original unacked.
-8. Decode failures create redacted WARN, metric, `bridge_list` summary, and routed incident without
+8. Decode failures create redacted WARN, metric, `fleet_list` summary, and routed incident without
    raw content.
 9. Both adapters pass one semantic contract for fields, FIFO, dedup, ownership, ack, and release.
 10. Lead keys require explicit ownership. Publication never claims a queue.
@@ -865,7 +865,7 @@ Acceptance criteria:
 15. RabbitMQ contract tests pass with `mvn test -Pcontract`. The same cases run once on production
     LavinMQ, or the release states that LavinMQ was not checked.
 16. Member incidents route to the exact delegating lead and never resolve a task rendezvous.
-17. `bridge_list` shows compact member health and capacity without pane content. Member
+17. `fleet_list` shows compact member health and capacity without pane content. Member
     `idleForSeconds` is present only when no accepted turn or inbox item exists.
 
 ### Unit 4 - Lead health and peer routing
@@ -887,7 +887,7 @@ Acceptance criteria:
 8. A selected working peer is not interrupted. Its push waits for an injectable window.
 9. Recipient assignment stays pinned. Reassignment increments generation and supersedes old pending
    assignment.
-10. `bridge_list` shows bounded foreign assignments, recipient, reason, and generation without pane
+10. `fleet_list` shows bounded foreign assignments, recipient, reason, and generation without pane
     content.
 11. `LeadInboxRegistry` owns configured and discovered lead keys before publication.
 12. Missing leads keep ownership. Retirement needs an empty queue and handled incidents.
@@ -911,7 +911,7 @@ Acceptance criteria:
 3. Webhook mode requires a resolved environment value. Bad notification config does not disable an
    already valid detector.
 4. Mode changes keep open incidents. Re-enable resumes eligible incidents.
-5. `bridge_list`, `/healthz`, metrics, and one WARN show partial coverage without a sink. HTTP
+5. `fleet_list`, `/healthz`, metrics, and one WARN show partial coverage without a sink. HTTP
    liveness behavior stays unchanged.
 6. One-lead, no-sink coverage states that lead failure has no active notification or recovery.
 7. Incident and outbound dedupe use the stable keys in Section 10.3.
@@ -927,7 +927,7 @@ Acceptance criteria:
 15. Webhook response bodies are ignored and cannot direct recovery.
 16. Tests cover disabled mode, one lead without sink, open/update/reminder/resolve, restart, dedup,
     reassignment, disable/re-enable, and sink failure while local health continues.
-17. `bridged.example.yaml` documents all hot keys and compiled floors.
+17. `fleetd.example.yaml` documents all hot keys and compiled floors.
 18. The operator Features wiki is updated separately. The portable `CLAUDE.md` block is checked and
     changed only if shipped tool or inbox semantics make it untrue.
 19. `mvn clean install` passes.

docs/MCP-Contract.md

@@ -1,11 +1,26 @@
-# MCP Contract — `bridged`'s unified gateway
+# MCP Contract — `fleetd`'s unified gateway
 
-> **Status:** 🟡 Design (2026-07-14). Greenfield — no MCP code exists yet; the pom carries
-> only Javalin/Jackson. This page defines the tool surface that CB-104 and its followers
-> implement. It supersedes nothing; it fills the "MCP server face" left open by the
-> [Architecture](1-Architecture) page.
+> **Status: 🔴 HISTORICAL DESIGN — do NOT use as the tool reference.** Written 2026-07-14, before
+> any MCP code existed. The system shipped and this page never caught up, so **its tool names,
+> parameter names and REST paths are wrong today**. Audited 2026-08-17; the specific drift:
+>
+> - **Tools it names that do not exist:** `fleet_read`, `fleet_cancel`.
+> - **Shipped tools it omits:** `fleet_poll`, `fleet_ack`, `fleet_profiles`, `fleet_whoami`.
+> - **Parameter names are wrong nearly everywhere** — it says `message`/`target`/`timeout_seconds`/
+>   `block` where the code takes `content`/`sessionId`/`timeoutMs`/`wait`; `text` where
+>   `fleet_reply` takes `content`; `target` where `fleet_stop` takes `paneId`.
+> - **REST paths are wrong:** it says `POST /workers` and `DELETE /workers/{paneId}`; the daemon
+>   serves `POST /members` and `DELETE /members/{paneId}`.
+>
+> **The authoritative tool surface is the live MCP schema** (each tool's own description and
+> parameters, as mounted), with the intent→tool table in `CLAUDE.md` as the short form. Both were
+> checked against `mcp/FleetMcp.java` on 2026-08-17 and are accurate.
+>
+> What is still worth reading here is **§6 — the flows and the error model** (rendezvous,
+> `fleet_ask`, detached delivery, the turn-done fallback). The shapes it describes are the ones
+> that shipped; only the names around them drifted. Rewriting this page is tracked as **CB-609**.
 
-`bridged` is the **sole communication gateway** for every Claude session in the bridge. Both
+`fleetd` is the **sole communication gateway** for every Claude session in the bridge. Both
 the **primary** (Opus, on subscription) and every **worker** (off-subscription Claude Code)
 mount the *same* MCP server with a single `claude mcp add` line, and talk only through its
 tools. No Claude session ever addresses a broker, a peer, or the network directly.
@@ -20,18 +35,18 @@ semantics, and how it maps onto the code already in the tree.
 These come from the project's core invariants and bound every decision below.
 
 1. **One server, both roles.** The primary and all workers mount an identical server. The
-   catalog must serve both, and `bridged` must decide *who is calling* from the connection —
+   catalog must serve both, and `fleetd` must decide *who is calling* from the connection —
    never from a caller-supplied argument that could be spoofed.
 2. **Subscription-safe by construction.** No MCP tool ever reads, sets, or forwards
    `ANTHROPIC_BASE_URL`. Mounting the bridge cannot move a session off subscription.
    Enforced today by [`SubscriptionGuard`](1-Architecture).
 3. **Blocking rendezvous, no busy-poll.** The primary consumes a worker's reply through a
-   *single* MCP call that `bridged` holds open — never a cross-turn poll loop that would burn
+   *single* MCP call that `fleetd` holds open — never a cross-turn poll loop that would burn
    subscription quota.
 4. **Status-gated delivery.** Anything that puts text into a worker flows through the existing
    [`Injector`](1-Architecture): delivered only when the worker is `idle`/`blocked`, at most
    one message per turn.
-5. **`bridged` owns policy; herdr owns PTYs.** MCP tools express *intent*; `bridged`
+5. **`fleetd` owns policy; herdr owns PTYs.** MCP tools express *intent*; `fleetd`
    translates it into guard checks, rendezvous bookkeeping, and herdr `agent.*` calls.
 
 ---
@@ -44,8 +59,8 @@ face** is the herdr Unix socket. REST/SSE remains only for non-Claude clients an
 ```mermaid
 flowchart LR
     OPUS["Opus — primary<br/>(Claude Code, env CLEAN)<br/>MCP client"]
-    subgraph BD["bridged — standalone daemon"]
-        MCP["MCP server (north face)<br/>bridge_send · bridge_reply<br/>bridge_ask · bridge_status · lifecycle"]
+    subgraph BD["fleetd — standalone daemon"]
+        MCP["MCP server (north face)<br/>fleet_send · fleet_reply<br/>fleet_ask · fleet_status · lifecycle"]
         RDV["rendezvous registry<br/>(blocking-call waiters)"]
         INJ["Injector + StatusPoller<br/>(status-gated writer)"]
         SOCK["herdr socket client (south face)"]
@@ -57,8 +72,8 @@ flowchart LR
     HERDR["herdr<br/>panes · agent-status"]
     W["worker claude pane<br/>ANTHROPIC_BASE_URL set<br/>MCP client"]
 
-    OPUS -->|"bridge_send (blocks)"| MCP
-    W -.->|"bridge_reply / bridge_ask"| MCP
+    OPUS -->|"fleet_send (blocks)"| MCP
+    W -.->|"fleet_reply / fleet_ask"| MCP
     SOCK -->|"agent.start · agent.send<br/>agent.get · pane.close"| HERDR
     HERDR -->|"drives PTY"| W
 
@@ -72,18 +87,18 @@ flowchart LR
 
 ## 3. Identity & addressing
 
-Because the same server is mounted by everyone, `bridged` resolves the caller's role on every
+Because the same server is mounted by everyone, `fleetd` resolves the caller's role on every
 request — this is the linchpin of the whole contract and has no code yet.
 
-- **Workers are known.** `bridged` spawns every worker
+- **Workers are known.** `fleetd` spawns every worker
   ([`WorkerService`](1-Architecture)) and records its herdr session UUID / `terminal_id` on
   the returned [`Agent`]. When a call arrives on a connection that maps to a known worker,
   the caller is *that* worker — so **workers never pass a target**; routing is implicit.
 - **The primary is "not a worker".** Any connection that does not map to a known worker is
   treated as a primary. It addresses workers **explicitly** by `target` — a session UUID,
   a `terminal_id`, or a friendly `profile` name.
-- **Turn correlation.** A blocking `bridge_send` registers a *waiter* keyed by worker
-  identity. A worker's later `bridge_reply` / `bridge_ask` on the same identity resolves that
+- **Turn correlation.** A blocking `fleet_send` registers a *waiter* keyed by worker
+  identity. A worker's later `fleet_reply` / `fleet_ask` on the same identity resolves that
   waiter. A `turn_id` is minted per exchange so a clarification round-trip
   (§6.2) rejoins the right turn.
 
@@ -91,13 +106,13 @@ request — this is the linchpin of the whole contract and has no code yet.
 
 ## 4. Transport
 
-`bridged` is a long-lived daemon serving **multiple** concurrent clients (one primary + N
+`fleetd` is a long-lived daemon serving **multiple** concurrent clients (one primary + N
 workers), so a per-client stdio child is the wrong shape. The recommended transport is
 **streamable-HTTP / SSE** on the same bind as the REST face:
 
 ```bash
 # identical on primary and every worker
-claude mcp add --transport http bridged http://127.0.0.1:8080/mcp
+claude mcp add --transport http fleetd http://127.0.0.1:8080/mcp
 ```
 
 This adds an MCP-server dependency the pom does not yet carry. See [Open decisions](#10-open-decisions).
@@ -108,65 +123,65 @@ This adds an MCP-server dependency the pom does not yet carry. See [Open decisio
 
 | Tool | Caller | Blocks? | Backing (exists today?) |
 |---|---|---|---|
-| [`bridge_send`](#bridge_send) | primary | yes (default) | `Injector.enqueue` ✅ · rendezvous registry ❌ (CB-104) |
-| [`bridge_reply`](#bridge_reply) | worker | no | rendezvous ❌ · pane injection via `Injector` ✅ |
-| [`bridge_ask`](#bridge_ask) | worker | yes | reverse rendezvous ❌ |
-| [`bridge_status`](#bridge_status) | either | no | `AgentControl.status` ✅ · `Injector.activeTargets` ✅ |
-| [`bridge_spawn`](#lifecycle) | primary | no | `WorkerService.spawn` ✅ (`POST /workers`) |
-| [`bridge_list`](#lifecycle) | either | no | `WorkerService.list` ✅ (`/agents`) |
-| [`bridge_stop`](#lifecycle) | primary | no | `WorkerService.stop` ✅ (`DELETE /workers/{paneId}`) |
-| [`bridge_read`](#bridge_read) | primary | no | `AgentControl.read` ✅ |
-| [`bridge_cancel`](#bridge_cancel) | primary | no | — ❌ (future) |
+| [`fleet_send`](#fleet_send) | primary | yes (default) | `Injector.enqueue` ✅ · rendezvous registry ❌ (CB-104) |
+| [`fleet_reply`](#fleet_reply) | worker | no | rendezvous ❌ · pane injection via `Injector` ✅ |
+| [`fleet_ask`](#fleet_ask) | worker | yes | reverse rendezvous ❌ |
+| [`fleet_status`](#fleet_status) | either | no | `AgentControl.status` ✅ · `Injector.activeTargets` ✅ |
+| [`fleet_spawn`](#lifecycle) | primary | no | `WorkerService.spawn` ✅ (`POST /workers`) |
+| [`fleet_list`](#lifecycle) | either | no | `WorkerService.list` ✅ (`/agents`) |
+| [`fleet_stop`](#lifecycle) | primary | no | `WorkerService.stop` ✅ (`DELETE /workers/{paneId}`) |
+| [`fleet_read`](#fleet_read) | primary | no | `AgentControl.read` ✅ |
+| [`fleet_cancel`](#fleet_cancel) | primary | no | — ❌ (future) |
 
 ### Core: delegation & rendezvous
 
-#### `bridge_send`
+#### `fleet_send`
 *(primary → worker — the headline tool, CB-104)*
 
 - **Params:** `message` (required); `target` (optional — defaults to the sole worker / default
   profile); `timeout_seconds` (default 600); `block` (default `true`); `auto_spawn`
-  (default `true`); `turn_id` (optional — supplied when answering a worker's `bridge_ask`).
+  (default `true`); `turn_id` (optional — supplied when answering a worker's `fleet_ask`).
 - **Blocking (`block:true`):** enqueue `message` via the `Injector`, then hold the call open
   until exactly one of:
-  - worker calls `bridge_reply` → `{ outcome:"reply", text }`
-  - worker calls `bridge_ask` → `{ outcome:"question", text, turn_id }`
+  - worker calls `fleet_reply` → `{ outcome:"reply", text }`
+  - worker calls `fleet_ask` → `{ outcome:"question", text, turn_id }`
   - worker's `agent_status` reaches done/idle with no reply → `{ outcome:"turn_done", text:<terminal tail> }`
   - deadline elapses → `{ outcome:"timeout" }`
   - worker gone → error `worker_gone`
 - **Detached (`block:false`):** enqueue and return `{ outcome:"dispatched", dispatch_id }`
   immediately. The eventual reply is injected into the primary's idle pane (§6.3), or drained
-  via `bridge_status` on a split-host primary.
+  via `fleet_status` on a split-host primary.
 
-#### `bridge_reply`
+#### `fleet_reply`
 *(worker → primary)*
 
 - **Params:** `text` (required); `final` (default `true`).
 - **Behavior:** resolve the primary waiter registered against this worker with `text`. If no
-  waiter exists (detached delegation), `bridged` **injects the primary's idle pane** instead.
+  waiter exists (detached delegation), `fleetd` **injects the primary's idle pane** instead.
   Returns `{ delivered:true, mode:"resolved"|"injected" }`. No `target` — identity is implicit.
 
-#### `bridge_ask`
+#### `fleet_ask`
 *(worker → primary — the reverse rendezvous)*
 
 - **Params:** `question` (required); `timeout_seconds`.
 - **Behavior:** blocks the *worker's* call. Surfaces the question to the primary (resolving its
-  open `bridge_send` with `outcome:"question"`, or injecting its pane). When the primary
-  answers — a `bridge_send` carrying the matching `turn_id` — that unblocks this call and
+  open `fleet_send` with `outcome:"question"`, or injecting its pane). When the primary
+  answers — a `fleet_send` carrying the matching `turn_id` — that unblocks this call and
   returns `{ answer }` to the worker, which continues **in the same turn**.
 
 ### Worker lifecycle
 <a id="lifecycle"></a>
 Thin adapters over [`WorkerService`](1-Architecture) — parity with the existing REST routes.
 
-- **`bridge_spawn`** — `{ profile? }` → worker view (`sessionId`, `terminalId`, `paneId`,
+- **`fleet_spawn`** — `{ profile? }` → worker view (`sessionId`, `terminalId`, `paneId`,
   `status`). Guard-checked; a boundary breach returns error `subscription_boundary` (the
   REST `403`).
-- **`bridge_list`** — no params → all workers + `agent_status`. Read-only, either role.
-- **`bridge_stop`** — `{ target }` → tears down the pane and its dedicated tab. Idempotent.
+- **`fleet_list`** — no params → all workers + `agent_status`. Read-only, either role.
+- **`fleet_stop`** — `{ target }` → tears down the pane and its dedicated tab. Idempotent.
 
 ### Observability
 
-#### `bridge_status`
+#### `fleet_status`
 *(either role — the README's 4th named tool)*
 
 - **Params:** `target?`.
@@ -175,7 +190,7 @@ Thin adapters over [`WorkerService`](1-Architecture) — parity with the existin
   messages addressed to me** — the path a split-host primary's `Stop`-hook uses to wake and
   collect replies without being injectable. Read-only, non-blocking.
 
-#### `bridge_read`
+#### `fleet_read`
 *(primary)*
 
 - **Params:** `target`; `source` ∈ `visible | recent | recent_unwrapped | detection`.
@@ -184,7 +199,7 @@ Thin adapters over [`WorkerService`](1-Architecture) — parity with the existin
 
 ### Control (future)
 
-#### `bridge_cancel`
+#### `fleet_cancel`
 *(primary)*
 
 - **Params:** `target`. Interrupt the worker's current turn / abandon the rendezvous. No
@@ -201,38 +216,38 @@ One blocking call, zero polls.
 ```mermaid
 sequenceDiagram
     participant P as Primary (Opus)
-    participant B as bridged (MCP + Injector)
+    participant B as fleetd (MCP + Injector)
     participant H as herdr
     participant W as Worker (Claude)
 
-    P->>B: bridge_send("do X", target=w) — blocks
+    P->>B: fleet_send("do X", target=w) — blocks
     B->>B: register waiter(w)
     B->>H: agent.send(w, "do X")  (idle window)
     H-->>W: prompt injected
     W->>W: works the turn
-    W->>B: bridge_reply("result")
+    W->>B: fleet_reply("result")
     B->>B: resolve waiter(w)
     B-->>P: { outcome:"reply", text:"result" }
 ```
 
-### 6.2 Clarification — reverse rendezvous (`bridge_ask`)
+### 6.2 Clarification — reverse rendezvous (`fleet_ask`)
 
 The worker pauses mid-turn to ask; the primary answers; the worker resumes in the same turn.
 
 ```mermaid
 sequenceDiagram
     participant P as Primary
-    participant B as bridged
+    participant B as fleetd
     participant W as Worker
 
-    P->>B: bridge_send("do X", target=w) — blocks
+    P->>B: fleet_send("do X", target=w) — blocks
     B-->>W: "do X" (injected)
-    W->>B: bridge_ask("which config?") — worker blocks
+    W->>B: fleet_ask("which config?") — worker blocks
     B-->>P: { outcome:"question", text:"which config?", turn_id }
-    P->>B: bridge_send("config.yaml", target=w, turn_id) — blocks again
-    B-->>W: resolve bridge_ask → { answer:"config.yaml" }
+    P->>B: fleet_send("config.yaml", target=w, turn_id) — blocks again
+    B-->>W: resolve fleet_ask → { answer:"config.yaml" }
     W->>W: resumes same turn
-    W->>B: bridge_reply("done")
+    W->>B: fleet_reply("done")
     B-->>P: { outcome:"reply", text:"done" }
 ```
 
@@ -243,13 +258,13 @@ The primary does not block; the reply arrives later in its idle pane.
 ```mermaid
 sequenceDiagram
     participant P as Primary
-    participant B as bridged
+    participant B as fleetd
     participant W as Worker
 
-    P->>B: bridge_send("do X", target=w, block=false)
+    P->>B: fleet_send("do X", target=w, block=false)
     B-->>P: { outcome:"dispatched", dispatch_id }
     P->>P: continues its own work
-    W->>B: bridge_reply("result")
+    W->>B: fleet_reply("result")
     Note over B: no waiter → detached path
     B->>B: Injector.enqueue(primary_pane, "result")
     B-->>P: injected into idle pane (status-gated)
@@ -257,18 +272,18 @@ sequenceDiagram
 
 ### 6.4 Uncooperative worker — turn-done fallback
 
-A worker that never calls `bridge_reply` still returns a result: `bridged` reads its terminal
+A worker that never calls `fleet_reply` still returns a result: `fleetd` reads its terminal
 tail when the turn completes.
 
 ```mermaid
 sequenceDiagram
     participant P as Primary
-    participant B as bridged
+    participant B as fleetd
     participant W as Worker
 
-    P->>B: bridge_send("do X", target=w) — blocks
+    P->>B: fleet_send("do X", target=w) — blocks
     B-->>W: "do X" (injected)
-    W->>W: works, never calls bridge_reply
+    W->>W: works, never calls fleet_reply
     B->>B: StatusPoller sees agent_status → idle/done
     B->>B: AgentControl.read(w, "recent")
     B-->>P: { outcome:"turn_done", text:<terminal tail> }
@@ -279,7 +294,7 @@ sequenceDiagram
 ## 7. Status gating
 
 Delivery only happens in a safe window. This is the state machine the `Injector` already
-enforces via `AgentStatus.injectable()`; MCP `bridge_send` is simply its producer.
+enforces via `AgentStatus.injectable()`; MCP `fleet_send` is simply its producer.
 
 ```mermaid
 stateDiagram-v2
@@ -315,17 +330,17 @@ touching this state machine.
 
 ## 8. Error model
 
-| Condition | `bridge_send` result | Notes |
+| Condition | `fleet_send` result | Notes |
 |---|---|---|
 | Worker replies | `{ outcome:"reply" }` | normal |
-| Worker asks | `{ outcome:"question", turn_id }` | answer with `bridge_send(turn_id)` |
+| Worker asks | `{ outcome:"question", turn_id }` | answer with `fleet_send(turn_id)` |
 | Turn ends, no reply | `{ outcome:"turn_done" }` | terminal tail as text |
 | Deadline elapsed | `{ outcome:"timeout" }` | message may still be queued/delivered |
 | Worker vanished | error `worker_gone` | `Injector.drop` fails the queued future |
 | Guard breach on spawn | error `subscription_boundary` | REST `403` parity |
 | Delivery failed at herdr | error, message dropped | poisoned message not left blocking the FIFO |
 
-`bridge_reply` from a worker with no open waiter is **not** an error — it falls through to
+`fleet_reply` from a worker with no open waiter is **not** an error — it falls through to
 detached pane injection (§6.3).
 
 ---
@@ -337,27 +352,27 @@ seam. Only the **rendezvous registry** and the **caller-identity resolver** are
 
 | MCP tool | Existing collaborator | New work |
 |---|---|---|
-| `bridge_send` | `Injector.enqueue`, `AgentControl.send` | waiter registry, timeout, outcome mux (CB-104) |
-| `bridge_reply` / `bridge_ask` | `Injector` (pane injection) | reverse rendezvous, identity resolver |
-| `bridge_status` | `AgentControl.status`, `Injector.activeTargets` | pending-drain projection |
-| `bridge_spawn` / `list` / `stop` | `WorkerService.{spawn,list,stop}` | MCP adapter only |
-| `bridge_read` | `AgentControl.read` | MCP adapter only |
+| `fleet_send` | `Injector.enqueue`, `AgentControl.send` | waiter registry, timeout, outcome mux (CB-104) |
+| `fleet_reply` / `fleet_ask` | `Injector` (pane injection) | reverse rendezvous, identity resolver |
+| `fleet_status` | `AgentControl.status`, `Injector.activeTargets` | pending-drain projection |
+| `fleet_spawn` / `list` / `stop` | `WorkerService.{spawn,list,stop}` | MCP adapter only |
+| `fleet_read` | `AgentControl.read` | MCP adapter only |
 
-Because the REST routes in `BridgedApp` already exercise the collaborators, MCP tools are
+Because the REST routes in `FleetApp` already exercise the collaborators, MCP tools are
 validated by **parity** against those routes, not by re-testing behavior.
 
 ---
 
 ## 10. Open decisions
 
-1. **`bridge_ask` direction.** This page defines it as *worker-asks-primary* (a genuine reverse
+1. **`fleet_ask` direction.** This page defines it as *worker-asks-primary* (a genuine reverse
    channel, matching the "inject the primary's pane" language). The alternative — a synonym for
    a blocking primary→worker send — is weaker and produces different plumbing. **Recommend
    worker-asks-primary.**
-2. **Detached delivery shape.** A `block:false` param on `bridge_send` (keeps the catalog
-   small) vs. a separate `bridge_dispatch` tool. **Recommend the param.**
-3. **Auto-spawn on send.** `bridge_send` provisions a worker per profile when none exists
-   (simplest primary UX) vs. requiring an explicit `bridge_spawn` first. **Recommend
+2. **Detached delivery shape.** A `block:false` param on `fleet_send` (keeps the catalog
+   small) vs. a separate `fleet_dispatch` tool. **Recommend the param.**
+3. **Auto-spawn on send.** `fleet_send` provisions a worker per profile when none exists
+   (simplest primary UX) vs. requiring an explicit `fleet_spawn` first. **Recommend
    auto-spawn, defaulting on.**
 4. **Transport & SDK.** Streamable-HTTP/SSE co-located with the REST bind (recommended) vs.
    stdio. Requires choosing a Java MCP server SDK and adding it to the pom.
@@ -366,9 +381,9 @@ validated by **parity** against those routes, not by re-testing behavior.
 
 ## 11. Implementation staging
 
-- **CB-104** — blocking `bridge_send` + rendezvous registry + caller-identity resolver
+- **CB-104** — blocking `fleet_send` + rendezvous registry + caller-identity resolver
   (the producer that finally drives the inert `StatusPoller`).
-- **CB-1xx** — `bridge_reply` / `bridge_ask` reverse rendezvous + detached pane injection.
-- **CB-1xx** — lifecycle + observability adapters (`bridge_spawn/list/stop/status/read`).
+- **CB-1xx** — `fleet_reply` / `fleet_ask` reverse rendezvous + detached pane injection.
+- **CB-1xx** — lifecycle + observability adapters (`fleet_spawn/list/stop/status/read`).
 - **CB-1xx** — transport wiring + `claude mcp add` docs; parity tests vs. REST.
-- **Later** — `bridge_cancel`; swap `StatusPoller` for herdr `events.subscribe`.
+- **Later** — `fleet_cancel`; swap `StatusPoller` for herdr `events.subscribe`.

docs/RELEASE-NOTES-1.0.0.md

@@ -1,8 +1,8 @@
 # v1.0.0 — One leader, one host, complete
 
-This is the first release of **`bridged`**.
+This is the first release of **`fleetd`**.
 
-`bridged` lets one main Claude Code session (the **leader**, on your Pro/Max subscription)
+`fleetd` lets one main Claude Code session (the **leader**, on your Pro/Max subscription)
 run a team of **workers** — extra Claude Code sessions on a cheaper or local model, and
 non-Claude agents too. The leader's own session is never touched: it stays on subscription,
 with a clean environment.
@@ -19,12 +19,12 @@ of this one.
 ## One gateway for all messages
 
 - **Everyone talks through the same door.** The leader and every worker connect to the same
-  MCP server and use only its tools: `bridge_whoami` · `bridge_profiles` · `bridge_spawn` ·
-  `bridge_list` · `bridge_status` · `bridge_send` · `bridge_reply` · `bridge_ask` ·
-  `bridge_poll` · `bridge_ack` · `bridge_stop`.
+  MCP server and use only its tools: `fleet_whoami` · `fleet_profiles` · `fleet_spawn` ·
+  `fleet_list` · `fleet_status` · `fleet_send` · `fleet_reply` · `fleet_ask` ·
+  `fleet_poll` · `fleet_ack` · `fleet_stop`.
 - **You are who your connection says you are.** The bridge finds out who is calling from the
   connection itself, never from a name the caller sends. So a worker cannot pretend to be
-  someone else, and `bridge_whoami` tells each agent its own role — no guessing.
+  someone else, and `fleet_whoami` tells each agent its own role — no guessing.
 - **The subscription line cannot be crossed.** Only a spawned worker gets
   `ANTHROPIC_BASE_URL`; the leader never does. Each worker profile has a list of allowed
   model hosts, checked before anything starts.
@@ -59,7 +59,7 @@ had to ask for its replies. That gap is now closed on a single machine:
 - **The leader gets a tap on the shoulder.** When a reply lands, the bridge nudges the
   leader's own pane — only when the leader is free, and only a few times. If the leader is on
   another machine, this quietly falls back to pick-up mode; the reply still waits.
-- **Workers can ask questions.** With `bridge_ask`, a worker can pause mid-task, ask the
+- **Workers can ask questions.** With `fleet_ask`, a worker can pause mid-task, ask the
   leader something, and continue the *same* task with the answer.
 
 ## More than one kind of worker

docs/Team.md

@@ -1,9 +1,9 @@
 # Team — lead orchestrating a mixed Claude + local-LLM fleet
 
-The message server (`bridged`) delivers **one turn into one worker**. A **team** is the
+The message server (`fleetd`) delivers **one turn into one worker**. A **team** is the
 layer above it: a **Claude team-lead** that fans a job out across a **mixed fleet** of
 workers — some on Claude, some on the remote local LLM — and reduces their replies. Same
-`bridged` delivery, same subscription boundary; this doc is only about **orchestration** —
+`fleetd` delivery, same subscription boundary; this doc is only about **orchestration** —
 who the workers are, how the lead picks one, and how it runs many at once.
 
 > Delivery mechanics (blocking `POST /message`, status-gated reply envelope) live in the
@@ -12,12 +12,12 @@ who the workers are, how the lead picks one, and how it runs many at once.
 ## The team
 
 - **Team-lead** — the primary **Opus** (Claude Code, env **CLEAN**, on Pro/Max). Not a
-  worker; a **thin client of `bridged`**. It plans, routes, dispatches, and integrates, and
+  worker; a **thin client of `fleetd`**. It plans, routes, dispatches, and integrates, and
   never sets `ANTHROPIC_BASE_URL`.
-- **Workers** — a herd of `claude` panes in herdr, each an addressable `bridged` session
+- **Workers** — a herd of `claude` panes in herdr, each an addressable `fleetd` session
   with its **own model/env**:
   - **Claude workers** (clean env, e.g. Sonnet) — reasoning-heavy or high-accuracy subtasks.
-  - **Local workers** (`ANTHROPIC_BASE_URL=https://ollama.ltms.dev`) — bulk, cheap, or
+  - **Local workers** (`ANTHROPIC_BASE_URL=https://llm.ltms.dev/anthropic`) — bulk, cheap, or
     embarrassingly parallel subtasks.
 
 Every worker is still a *real Claude Code process* (inherits `CLAUDE.md`, hooks, skills,
@@ -28,14 +28,14 @@ MCP) — only its model differs. Scale each kind horizontally by adding panes.
 ```mermaid
 flowchart TB
     LEAD["lead — Opus<br/>(Claude Code, env CLEAN)"]
-    BD["bridged<br/>message server + router"]
+    BD["fleetd<br/>message server + router"]
     HERDR["herdr<br/>panes · agent-status"]
     WC1["w-claude-1<br/>Sonnet · CLEAN"]
     WC2["w-claude-2<br/>Sonnet · CLEAN"]
     WL1["w-local-1<br/>ANTHROPIC_BASE_URL set"]
     WL2["w-local-2<br/>ANTHROPIC_BASE_URL set"]
     ANT["api.anthropic.com<br/>(Pro/Max)"]
-    OLL["ollama.ltms.dev<br/>(local model)"]
+    OLL["llm.ltms.dev<br/>(gateway to the local model)"]
 
     LEAD -->|"blocking POST /message (target role)"| BD
     BD -->|"Unix socket · send_text · events.subscribe"| HERDR
@@ -62,14 +62,14 @@ flowchart TB
 | `w-local-*` | `ANTHROPIC_BASE_URL` set | local LLM | task is bulk / cheap / embarrassingly parallel |
 
 The lead applies this rubric itself, guided by its `CLAUDE.md` team charter (below). Worker
-selection is **policy in the lead**, not a `bridged` concern — `bridged` just delivers to
+selection is **policy in the lead**, not a `fleetd` concern — `fleetd` just delivers to
 the session the lead names.
 
 ## Subscription boundary in a team
 
 Unchanged from the base architecture, and it scales with the fleet: **only local-worker
 panes** launch with `ANTHROPIC_BASE_URL`. The lead and every Claude worker stay env-clean on
-the subscription. `bridged` enforces which panes may carry the off-subscription env, so
+the subscription. `fleetd` enforces which panes may carry the off-subscription env, so
 adding workers never widens the boundary.
 
 ## Parallel fan-out (map / reduce)
@@ -80,7 +80,7 @@ different workers at once, then results are gathered.
 ```mermaid
 sequenceDiagram
     participant L as lead (Opus)
-    participant B as bridged
+    participant B as fleetd
     participant WC as w-claude-1
     participant WL as w-local-1
 
@@ -100,26 +100,26 @@ sequenceDiagram
 ```
 
 - **Map:** the lead issues N concurrent blocking `POST /message` calls (one per subtask → its
-  chosen worker). Each call blocks only *that* request; `bridged` holds it open until the
+  chosen worker). Each call blocks only *that* request; `fleetd` holds it open until the
   worker's turn completes (status-gated) and returns the reply envelope.
 - **Reduce:** the lead collects the N envelopes and integrates. A slow local worker never
   blocks a fast Claude worker — wall-clock ≈ the slowest single subtask, not the sum.
 - **Detached / long jobs** use the async broker path instead of a held request (Channel 2 in
   the base architecture), so the lead never busy-polls across turns.
 
-Fan-out is bounded by the herd size (pane count) and `bridged`'s concurrency policy, not by
+Fan-out is bounded by the herd size (pane count) and `fleetd`'s concurrency policy, not by
 the lead.
 
 ## Knowing the roster
 
-The lead discovers its team from `bridged` (session list / roles) rather than hard-coding
+The lead discovers its team from `fleetd` (session list / roles) rather than hard-coding
 pane ids, so workers can be added or restarted without editing the lead. A minimal charter
 in the lead's `CLAUDE.md` turns Opus into the orchestrator:
 
 ```markdown
-## Your team (via bridged)
-You are the team-lead. Delegate through the bridged client — never launch workers yourself.
-Roster: ask bridged for current sessions/roles.
+## Your team (via fleetd)
+You are the team-lead. Delegate through the fleetd client — never launch workers yourself.
+Roster: ask fleetd for current sessions/roles.
 - w-claude-* — Claude Sonnet. Reasoning-heavy / high-accuracy subtasks.
 - w-local-*  — remote local LLM. Bulk, cheap, or parallelizable subtasks.
 
@@ -133,22 +133,22 @@ tool instead of hand-rolling the HTTP request.
 
 ## What this layer does NOT change
 
-- **Delivery** is still `bridged` → herdr `pane.send_text` + status events (Message-Server).
+- **Delivery** is still `fleetd` → herdr `pane.send_text` + status events (Message-Server).
 - **Completion timing** is still the worker status event; **reply content** still rides the
   worker `Stop`-hook envelope.
 - **Single-host** still applies: herdr's socket is local, so the whole herd lives on the
-  `bridged` host. The lead may be remote — it only needs HTTP to `bridged`.
+  `fleetd` host. The lead may be remote — it only needs HTTP to `fleetd`.
 
 ## Open questions
 
-- **Routing intelligence:** rubric-in-`CLAUDE.md` (lead decides) vs. a `bridged` role-router
+- **Routing intelligence:** rubric-in-`CLAUDE.md` (lead decides) vs. a `fleetd` role-router
   (label-based). Start with the former; promote to the latter if routing logic grows.
-- **Backpressure:** per-role concurrency caps in `bridged` so a fan-out can't exhaust the
+- **Backpressure:** per-role concurrency caps in `fleetd` so a fan-out can't exhaust the
   local gateway.
 - **Result schema:** whether reply envelopes should carry structured metadata (worker, model,
   tokens) to help the lead's reduce step.
 
 ## Status
 
-🟡 Design (2026-07-11). Orchestration layer over the selected `bridged` server; inherits
+🟡 Design (2026-07-11). Orchestration layer over the selected `fleetd` server; inherits
 herdr (chosen) + AgentAPI (fallback). Delivery unchanged — see the Message-Server design.

docs/Worker-Git-Workflow.md

@@ -20,7 +20,7 @@ requirement, not a nice-to-have.**
 - **Worktree provisioned by the daemon** — `SessionManager` creates a dedicated git worktree +
   branch per session, **hydrates it to full config parity** (below), and tears it down on release.
 - **Worker opens its own PR** — the worker commits, pushes its branch, and opens the PR/MR itself,
-  returning the PR URL in its `bridge_reply`.
+  returning the PR URL in its `fleet_reply`.
 
 ## Why worktrees (the hazard being fixed)
 
@@ -76,7 +76,7 @@ worktree checks out anyway. Amber is the real gap — untracked local config the
 3. **Never overlay the git plumbing** — the worktree's own `.git` file/branch is what gives
    isolation; that's the *one* thing that must differ from the main tree.
 
-The overlay set lives in config (`BridgedConfig.Worker.parityOverlay` — a list of repo-relative
+The overlay set lives in config (`FleetConfig.Worker.parityOverlay` — a list of repo-relative
 paths, with sane defaults) so it's auditable and per-repo tunable.
 
 > **Trust note (deliberate).** Hydrating local config means the primary's local secrets/tokens
@@ -103,7 +103,7 @@ sequenceDiagram
     Note over W: implement in the isolated worktree
     W->>G: git commit + git push (SSH, same user)
     W->>G: open PR (branch to main)
-    W-->>P: bridge_reply (prUrl, branch, summary, tests)
+    W-->>P: fleet_reply (prUrl, branch, summary, tests)
     P->>SM: release(paneId)
     SM->>G: git worktree remove wt
     Note over G: branch + PR persist for review/merge
@@ -115,9 +115,9 @@ earlier `STATE.md` idea — a PR is reviewable, mergeable, and self-describing.*
 
 ## Infra facts (verified this session)
 
-- **Remote:** `ssh://git@git.ltms.dev:2224/lms/claude-bridge.git` (gitea). Push is over **SSH** —
+- **Remote:** `ssh://git@git.ltms.dev:2224/fleet/fleetd.git` (gitea). Push is over **SSH** —
   a worker running as the same user with the same keys can `git push` **with no extra credential**.
-- **gitea is NOT in the project `.mcp.json`** (only `jetbrains`, `intellij-index`, `bridged`). The
+- **gitea is NOT in the project `.mcp.json`** (only `jetbrains`, `intellij-index`, `fleetd`). The
   primary's gitea MCP comes from a global/user config, so **workers do not inherit it**. A worker
   gets only the `bridge` MCP mounted (via `--mcp-config` launch flag).
 - **No gitea CLI** (`tea`) installed; `glab` is present but is the GitLab CLI (wrong backend).
@@ -128,7 +128,7 @@ earlier `STATE.md` idea — a PR is reviewable, mergeable, and self-describing.*
 
 | Option | Mechanism | Trade-off |
 |---|---|---|
-| **A. gitea REST + token** | Worker `curl`s `POST /api/v1/repos/lms/claude-bridge/pulls` with a scoped token injected by the daemon into the worker env | Minimal, no new server; token lives in the off-subscription worker's env (scope it tightly) |
+| **A. gitea REST + token** | Worker `curl`s `POST /api/v1/repos/fleet/fleetd/pulls` with a scoped token injected by the daemon into the worker env | Minimal, no new server; token lives in the off-subscription worker's env (scope it tightly) |
 | **B. mount gitea MCP into workers** | Add the gitea MCP to the worker's `--mcp-config` alongside `bridge` | Clean tool call, but the gitea MCP's own auth/token must be provisioned per worker; more moving parts |
 | **C. install `tea` CLI** | Worker runs `tea pr create` with a token | Another dependency to install + configure; same token question as A |
 
@@ -140,7 +140,7 @@ and the token is a single scoped secret the daemon injects like it already injec
 
 - Off-subscription workers already *could* push (SSH, same user). The **incremental grant is
   PR-create**, i.e. a gitea API token.
-- Scope the token **minimally**: the `lms/claude-bridge` repo, `write:repository` (create branch +
+- Scope the token **minimally**: the `fleet/fleetd` repo, `write:repository` (create branch +
   PR), **not** merge/admin/org. A leaked token can open PRs, not merge them — the primary/human is
   still the merge gate.
 - Inject via the daemon (env var, e.g. `GITEA_TOKEN`), never written to the worker's config dir —
@@ -153,11 +153,11 @@ and the token is a single scoped secret the daemon injects like it already injec
 |---|---|---|
 | Worktree provision/teardown | **CB-301 ext** — `SessionManager.acquire`/`release`; `WorkerSession` gains `worktree`, `branch` | daemon shells out to `git worktree add/remove` |
 | **Config-parity overlay** | **CB-301 ext** — `SessionManager.acquire`, after `git worktree add` | symlink/copy the `parityOverlay` set into the worktree so the worker is a full peer; **this is what makes worktrees viable, not a dead-end** |
-| Overlay config | `BridgedConfig.Worker.parityOverlay` — repo-relative paths, sane defaults | auditable, per-repo tunable; keep explicit + minimal (trust) |
+| Overlay config | `FleetConfig.Worker.parityOverlay` — repo-relative paths, sane defaults | auditable, per-repo tunable; keep explicit + minimal (trust) |
 | Branch naming | `worker/<ticket-slug>-<nonce>` off `main` (or a configured base) | one branch per session |
 | Commit + push + PR handoff | **CB-302** — worker-driven, guided by the skill | push = SSH; PR = option A |
 | Implementer skill | `.claude/skills/implementer/SKILL.md` | worktree-aware playbook (see below); mounts automatically since workers inherit repo cwd |
-| gitea token injection | `WorkerService` env + `BridgedConfig` | repo-scoped, minimal perms |
+| gitea token injection | `WorkerService` env + `FleetConfig` | repo-scoped, minimal perms |
 | PR review + merge | Primary (has gitea MCP + judgment) | merge on green; the human/primary gate stays |
 
 ## Implementer skill (outline)
@@ -170,7 +170,7 @@ A worker-facing playbook (sibling to the existing `reviewer` skill):
 3. **Push** your branch (`git push -u origin HEAD`).
 4. **Open a PR** to `main` (option A `curl`, or the decided mechanism) with a title/body describing
    the change and referencing the ticket.
-5. **Reply** via `bridge_reply` with the **PR URL**, branch name, files changed, and test names —
+5. **Reply** via `fleet_reply` with the **PR URL**, branch name, files changed, and test names —
    that reply is the whole handoff.
 6. Do **not** merge; do **not** touch `.mcp.json` or `wiki/`.
 

docs/Worker-Startup-and-Trust.md

@@ -1,6 +1,6 @@
 # Worker startup: working directory & the folder-trust prompt
 
-When `bridged` spawns a worker, the worker CLI may show an **interactive startup prompt** before it
+When `fleetd` spawns a worker, the worker CLI may show an **interactive startup prompt** before it
 is ready to accept a task — most importantly a *"Do you trust the files in this folder?"* dialog. An
 unattended worker parked on that prompt never becomes injectable: the status-gated injector waits for
 `idle`/`blocked`, the task is never delivered, and (worst case) a stray Enter answers the dialog
@@ -14,11 +14,11 @@ rule that **a worker inherits the primary's directory** (never `$HOME`), and how
 
 ```mermaid
 flowchart TD
-    A["bridge_spawn / POST /workers"] --> B{"explicit cwd?<br/>(profile cwd or spawn arg)"}
+    A["fleet_spawn / POST /workers"] --> B{"explicit cwd?<br/>(profile cwd or spawn arg)"}
     B -->|"yes — told otherwise"| C["use that cwd"]
     B -->|"no"| D{"caller PID resolvable?<br/>(MCP peer PID)"}
     D -->|"yes"| E["cwd = the primary's cwd<br/>lsof -a -p PID -d cwd"]
-    D -->|"no (REST / off-host)"| F["cwd = bridged daemon cwd<br/>(never $HOME by assumption)"]
+    D -->|"no (REST / off-host)"| F["cwd = fleetd daemon cwd<br/>(never $HOME by assumption)"]
     C --> G["ensureWorkspace → tab.create → agent.start {cwd}"]
     E --> G
     F --> G
@@ -51,10 +51,10 @@ only affect the seed shell, which the bridge closes).
 | # | Source | When |
 |---|--------|------|
 | 1 | Explicit `cwd` — a per-profile `cwd:` in config, or a spawn argument | "told otherwise" — pin a fixed workdir |
-| 2 | The **primary's cwd**, auto-detected from the `bridge_spawn` caller | normal MCP spawn from the primary |
-| 3 | The `bridged` daemon's own cwd | REST spawn / off-host caller — **never `$HOME`** |
+| 2 | The **primary's cwd**, auto-detected from the `fleet_spawn` caller | normal MCP spawn from the primary |
+| 3 | The `fleetd` daemon's own cwd | REST spawn / off-host caller — **never `$HOME`** |
 
-The primary's cwd (source 2) is discoverable with no new plumbing: `bridged` already resolves the MCP
+The primary's cwd (source 2) is discoverable with no new plumbing: `fleetd` already resolves the MCP
 caller's loopback **peer PID** for connection identity (`ConnectionIdentity` → `LsofPeerPidLookup`);
 the same PID yields its cwd via `lsof -a -p <pid> -d cwd -Fn` (the `n…` line). The primary maps to no
 worker pane (it is not a worker), but its PID and cwd are still readable.
@@ -62,10 +62,10 @@ worker pane (it is not a worker), but its PID and cwd are still readable.
 ```mermaid
 sequenceDiagram
     participant P as "Primary (main)"
-    participant B as "bridged"
+    participant B as "fleetd"
     participant O as "OS (lsof)"
     participant H as "herdr"
-    P->>B: "bridge_spawn {profile} (no cwd)"
+    P->>B: "fleet_spawn {profile} (no cwd)"
     B->>O: "peer PID for this connection's port"
     O-->>B: "pid"
     B->>O: "cwd of pid (lsof -d cwd)"
@@ -77,9 +77,9 @@ sequenceDiagram
 
 *Figure 2 — a no-cwd spawn inherits the primary's directory from the caller's PID.*
 
-> **Status:** implemented (CB-112). `bridged` threads the resolved `cwd` onto **`agent.start {cwd}`**
+> **Status:** implemented (CB-112). `fleetd` threads the resolved `cwd` onto **`agent.start {cwd}`**
 > (verified: the worker process is rooted there), keeping the single shared worker space. On an MCP
-> `bridge_spawn` the primary's cwd is auto-detected from the caller's PID; over REST (no MCP caller)
+> `fleet_spawn` the primary's cwd is auto-detected from the caller's PID; over REST (no MCP caller)
 > it is the explicit `cwd` param else the daemon's cwd. Both placements (`tab` and legacy `pane`)
 > carry it, since it rides `agent.start`.
 
@@ -133,5 +133,5 @@ unattended.
 
 ## See also
 
-- `docs/MCP-Contract.md` — the tool surface (`bridge_spawn`, `bridge_profiles`, …).
+- `docs/MCP-Contract.md` — the tool surface (`fleet_spawn`, `fleet_profiles`, …).
 - `wiki/2-Message-Server.md` — the herdr `agent.*` / `workspace.*` schema (`workspace.create {cwd}`).

docs/wiki-audit.md

@@ -0,0 +1,208 @@
+# Wiki audit for #168
+
+**Source checked:** `.wiki-snapshot/` at `68e32c6` (2026-08-31). I did not use
+`wiki/`. Code references below are from the current `fleetd` source tree. A quoted
+line is a concrete claim that needs correction, unless the table says `KEEP`.
+
+| Page | Verdict | One-line reason |
+|---|---|---|
+| `Home.md` | REVISE | Good overview, but it still names the retired product. |
+| `_Sidebar.md` | REVISE | The heading still says `claude-bridge`. |
+| `1-Architecture.md` | REBUILD | Its component contract mixes current names with removed tools, routes, and planned backends. |
+| `2-Message-Server.md` | REBUILD | The claimed MCP schema, mount command, REST/SSE surface, and fallback paths are pre-build design. |
+| `3-Approaches.md` | REVISE | Useful research history, but it presents unbuilt AgentAPI as a selectable fallback. |
+| `4-Setup.md` | RETIRE | It is an intentional stub that only redirects to chapter 13. |
+| `5-Operations.md` | RETIRE | It is an intentional stub that only redirects to chapter 13. |
+| `6-Team.md` | REBUILD | It teaches role-addressed sends and a Claude-only team model that the shipped API does not have. |
+| `7-Use-Cases.md` | REBUILD | Its flagship flow depends on removed `ccs` profiles and removed send parameters. |
+| `8-Roadmap.md` | REBUILD | It is a historical plan, but it presents old implementation choices and planned work as the current stack. |
+| `9-Implementation.md` | REBUILD | Its package, class, endpoint, and outcome map has drifted from the source. |
+| `10-Cross-Host-Messaging.md` | REVISE | It labels most federation work proposed, but misses the shipped `coordinator:` lead channel. |
+| `11-Features.md` | REVISE | It is the right catalogue, but code-path names are old and it misses the second-herdr-daemon capability. |
+| `12-Claude-to-OpenCode.md` | REVISE | The porting guide is mostly current, but calls the product and spawned-member path a bridge. |
+| `13-User-Guide.md` | REVISE | It is the best operator page, but needs the product rename and the second-herdr-daemon setup. |
+
+## Pages needing work
+
+### `Home.md` — REVISE
+
+- Quote: `# claude-bridge` (line 1) and `` `claude-bridge` keeps`` (line 11).
+  The product is `fleet` / `fleetd`. The MCP server identifies itself as `fleet` in
+  `fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java:313-315`.
+- Quote: `AgentAPI ... swappable fallback injector` (lines 73-76).
+  There is no AgentAPI implementation under `fleetd/src/main/java`; the actual
+  launchers are selected by `Profile.kind` in
+  `fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java:265-270`.
+
+### `_Sidebar.md` — REVISE
+
+- Quote: `### 📖 claude-bridge` (line 1).
+  Rename it to `fleet`. `FleetMcp` registers the current product-facing tool set at
+  `fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java:301-326`.
+
+### `1-Architecture.md` — REBUILD
+
+- Quote: `` `claude-bridge` lets`` (line 3). The product was renamed; the MCP
+  server name is `fleet` (`FleetMcp.java:313-315`).
+- Quote: ``fleet_read`` in the tool list (line 102). No such tool is registered.
+  The complete registered list is `fleet_send` through `fleet_whoami` at
+  `FleetMcp.java:301-326`; `fleet_read` is absent.
+- Quote: `SSE (GET /events)` (line 143). `FleetApp.build()` registers no `/events`
+  route; its routes are listed at `FleetApp.java:143-159`.
+- Quote: `Redis Streams / NATS JetStream, or an embedded queue` (line 106).
+  The shipped durable inbox is AMQP, configured by `broker`, at
+  `FleetConfig.java:49-50` and `FleetConfig.java:655-714`.
+- Quote: `AgentAPI (fallback)` (line 107). No AgentAPI adapter exists; shipped
+  launcher kinds are `claude-code` and `opencode` (`FleetConfig.java:265-270`).
+
+### `2-Message-Server.md` — REBUILD
+
+- Quote: `claude mcp add --transport http bridge http://127.0.0.1:8080/mcp`
+  (line 67). The daemon defaults to port `8765` in `FleetConfig.java:183-187`,
+  and identifies its server as `fleet` at `FleetMcp.java:313-315`.
+- Quote: ``fleet_send(message, target?, {block, timeout_seconds, auto_spawn,
+  turn_id})`` (line 80). The real parameters are `sessionId`, `content`,
+  `timeoutMs`, `wait`, `turnId`, and `coordId` (`FleetMcp.java:1096-1108`).
+- Quote: ``fleet_read(target, source)`` (line 85). It is not registered; see the
+  complete registration at `FleetMcp.java:301-326`.
+- Quote: `docs/MCP-Contract.md ... normative` (lines 87-88). That is not a valid
+  reference: only §6 is current, as the current operator guide itself says at
+  `.wiki-snapshot/13-User-Guide.md:466`.
+- Quote: `SSE (GET /events)` (line 45). No route exists in the built REST surface,
+  `FleetApp.java:143-159`.
+
+### `3-Approaches.md` — REVISE
+
+- Quote: `AgentAPI ... remains a swappable fallback injector` (lines 78-84).
+  It was never built. The shipped adapter selection is only `claude-code` or
+  `opencode` (`FleetConfig.java:265-270`). Keep it as discarded research, not an
+  operational fallback.
+- Quote: `claude-bridge` (line 109). Rename the product to `fleet`; the runtime
+  package is `dev.ltms.fleet`, for example `FleetMcp.java:1`.
+
+### `4-Setup.md` — RETIRE
+
+It is a 25-line redirect and says its procedure was never written (lines 3-9).
+Chapter 13 is the maintained install procedure. Keeping a second navigation page
+adds no working documentation.
+
+### `5-Operations.md` — RETIRE
+
+It is a 35-line redirect and says its runbook was never written (lines 3-14).
+Chapter 13 now owns run and recovery instructions.
+
+### `6-Team.md` — REBUILD
+
+- Quote: `fleet_send {role: w-claude, prompt: A}` (line 98). `fleet_send` accepts
+  `sessionId` and `content`, not `role` or `prompt` (`FleetMcp.java:1096-1108`).
+- Quote: `some on Claude, some on the remote local LLM` (lines 3-5) and `Every
+  worker is ... Claude Code` (line 25). `opencode` is a first-class launcher kind,
+  not a Claude worker (`FleetConfig.java:265-270`).
+- Quote: `fleetd's concurrency policy` (line 121). The configured capacity control
+  is per-profile `maxLoad` (`FleetConfig.java:251-264`), not the role routing model
+  described here.
+
+### `7-Use-Cases.md` — REBUILD
+
+- Quote: `ccs profile` (line 10), `ccs + herdr` (line 22), and `ccs-spawn`
+  (line 45). The configuration has `profiles` and `fleet`, not `ccs`:
+  `FleetConfig.java:34-58` and `FleetConfig.java:81-101`.
+- Quote: `fleet_send({"to", "kind", "body", "block"})` (lines 55-62).
+  None of those are the shipped send parameters. The schema is
+  `FleetMcp.java:1096-1108`.
+- Quote: `fleet_list() → { "profiles": ... }` (lines 74-80). `fleet_list` is a
+  roster view; `fleet_profiles` is the configured-backend view, as registered at
+  `FleetMcp.java:307-311` and described at `FleetMcp.java:1176-1182`.
+
+### `8-Roadmap.md` — REBUILD
+
+- Quote: `Java 21+` (line 43). The current project guidance and source use Java 25;
+  the `FleetConfig` source itself uses Java 25 unnamed lambda parameters, for
+  example `FleetConfig.java:102`.
+- Quote: `herdr 0.7.0 / protocol 14` (line 46). The current REST health endpoint
+  reports the live protocol returned by herdr (`FleetApp.java:240-244`), while the
+  current operator guide records protocol 19 at
+  `.wiki-snapshot/13-User-Guide.md:76-85`.
+- Quote: `ccs <profile> claude` and `ccs env <profile>` (lines 47-48). Shipped
+  configuration uses `Profile` records and launcher `kind`,
+  `FleetConfig.java:313-330` and `FleetConfig.java:265-270`.
+- Quote: `Redis Streams via Lettuce` (line 50). The actual durable inbox is AMQP
+  `broker`, `FleetConfig.java:655-714`.
+
+### `9-Implementation.md` — REBUILD
+
+- Quote: `rest.FleetdApp` and `mcp.BridgeMcp` (lines 29-30). The classes are
+  `rest.FleetApp` and `mcp.FleetMcp` (`FleetApp.java:46`; `FleetMcp.java:67`).
+- Quote: `dev.ltms.fleetd` (line 67). The source package is `dev.ltms.fleet`
+  (`FleetMcp.java:1`).
+- Quote: `WorkerPresence` (line 110). The current class is `MemberPresence`, as
+  imported and used by `FleetMcp` at `FleetMcp.java:12` and `465-469`.
+- Quote: the outcome list ending in `STALE_TURN` (lines 128-131). The code also
+  has `BACKEND_EXHAUSTED` (`FleetMcp.java:550-554`) and async `ASKING` handling
+  (`FleetMcp.java:664-668`).
+- Quote: `FleetdApp` (line 207) and `FleetdConfig` (line 211). These names do not
+  resolve; current classes are `FleetApp` and `FleetConfig`.
+
+### `10-Cross-Host-Messaging.md` — REVISE
+
+- Quote: the chapter says the cross-host fabric is proposed except for the
+  single-host inbox (lines 3-8). Cross-host **lead-to-lead** delivery shipped:
+  `fleet_send` accepts `coordId` (`FleetMcp.java:1094-1107`) and publishes it at
+  `FleetMcp.java:616-641`; configuration has `coordinator` at
+  `FleetConfig.java:74-78` and `99-101`.
+- Quote: `bridge.dlx` (line 90). This product name is stale. The shipped lead path
+  uses `LeadChannel`, not the proposed exchange flow (`FleetMcp.java:95-96` and
+  `616-641`). Keep the proposed federation design, but add a clear shipped/proposed
+  boundary for CB-637.
+
+### `11-Features.md` — REVISE
+
+- Quote: `mcp/BridgeMcp` (line 22), `config/FleetdConfig` (lines 25-27), and other
+  index references. These paths no longer resolve; the source classes are
+  `mcp/FleetMcp` (`FleetMcp.java:67`) and `config/FleetConfig`
+  (`FleetConfig.java:81`).
+- Quote: `fleet_whoami` returns only `primary` or `worker` (lines 99-100).
+  It also returns `architect` (`FleetMcp.java:1235-1244`).
+- The page needs the missing separate member-herdr-daemon feature listed below.
+
+### `12-Claude-to-OpenCode.md` — REVISE
+
+- Quote: `same bridge mount` (line 5) and `a bridge-spawned worker` (line 94).
+  Rename the product path to `fleet`. The daemon exposes the MCP server as `fleet`
+  (`FleetMcp.java:313-315`), and profiles select OpenCode with `kind: opencode`
+  (`FleetConfig.java:332-335`).
+- Quote: the sample mount name is `fleetd` (line 67). The server name is `fleet`;
+  update the sample to avoid teaching a second product name.
+
+### `13-User-Guide.md` — REVISE
+
+- Quote: `The bridge is the only channel` (line 63). The invariant is correct, but
+  the product term needs the `fleet` rename. The daemon's MCP server name is
+  `fleet` (`FleetMcp.java:313-315`).
+- Quote: it describes one herdr socket (lines 72-85). It needs the optional
+  `memberHerdrSocket` setup and two-daemon health meaning. The config key is in
+  `FleetConfig.java:34-37`, and `/healthz` checks both daemons when configured at
+  `FleetApp.java:210-245`.
+
+## MISSING
+
+`11-Features.md` has a body section for **routing members through a separate herdr daemon**
+(`## memberHerdrSocket`, line 2174), but **no row in the index table** at the top of the page
+(lines 20-95). That table is how the page is meant to be read, so a capability absent from it is
+effectively undiscoverable. Lead note: this is my own omission — I added the section on 2026-08-31
+and did not add the matching row. Fixed in the wiki at `68e32c6`'s successor.
+
+The original audit stated the feature had no entry at all. That was wrong: the section exists. The
+gap is the index row. Recorded here rather than silently corrected, because the difference matters —
+"undocumented" and "documented but unindexed" are different jobs.
+
+Evidence for the feature itself: `FleetConfig.java:34-37` and `FleetApp.java:103-115`, `210-245`,
+and `247-263`.
+
+## Audit method and coverage
+
+I checked all 15 pages. I checked concrete tool, route, config, class, file, and
+product-name claims claim-by-claim on 11 pages: Home, Sidebar, 1, 2, 4, 5, 6, 7, 9,
+11, and 13. I skimmed the remaining four long historical or research pages (3, 8, 10,
+12), then checked their concrete claims that affect the verdict. This is an audit of
+the supplied snapshot, not a wiki rewrite.

e2e/README.md

@@ -2,11 +2,11 @@
 
 A standard, repeatable **live** end-to-end test of the two-way channel: it drives a real
 multi-turn conversation between a primary and an off-subscription worker **through the
-running `bridged` daemon**, captures the full transcript, and grades the channel.
+running `fleetd` daemon**, captures the full transcript, and grades the channel.
 
 This is the committed form of the ad-hoc channel test that discovered the CB-115 gaps
 (herdr `unknown` misclassification wedging delivery, dirty completion scrapes, and workers
-never calling `bridge_reply` in conversation). Run it after any change to the injector,
+never calling `fleet_reply` in conversation). Run it after any change to the injector,
 status handling, completion/failure paths, or the worker reply charter.
 
 ## What it exercises
@@ -20,7 +20,7 @@ construction** — it only calls the bridge's loopback REST face.
 ```mermaid
 sequenceDiagram
     participant T as conversation_test.py
-    participant B as bridged (REST)
+    participant B as fleetd (REST)
     participant W as worker (off-sub)
     T->>B: POST /workers  (spawn)
     T->>B: GET /sessions/{id}/status  (await ready)
@@ -28,7 +28,7 @@ sequenceDiagram
         T->>B: POST /sessions/{id}/message {wait:false}
         B-->>T: ticket
         B->>W: inject prompt (status-gated)
-        W-->>B: bridge_reply
+        W-->>B: fleet_reply
         T->>B: GET /tasks/{ticket}  (poll)
         B-->>T: done + reply
     end
@@ -37,7 +37,7 @@ sequenceDiagram
 
 ## Prerequisites
 
-- `bridged` is running (default REST on `http://127.0.0.1:8765`) with at least one worker
+- `fleetd` is running (default REST on `http://127.0.0.1:8765`) with at least one worker
   profile configured and its backend reachable.
 - herdr is up (the daemon needs it).
 - Python 3 (standard library only — no pip installs).
@@ -68,7 +68,7 @@ Per-turn grade:
 
 | Grade      | Meaning                                                              |
 |------------|---------------------------------------------------------------------|
-| `OK`       | delivered and resolved by an explicit `bridge_reply` (`source=reply`) |
+| `OK`       | delivered and resolved by an explicit `fleet_reply` (`source=reply`) |
 | `DEGRADED` | delivered and answered, but resolved via completion-scrape fallback |
 | `EMPTY`    | turn completed but the reply was empty                              |
 | `FAILED`   | the worker's turn ended in failure (`phase=failed`)                 |

e2e/conversation_sustained_test.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """Sustained back-and-forth bridge test — ONE primary, ONE worker, many dependent turns
-over a fixed wall-clock window (default 5 minutes), through the running `bridged` daemon.
+over a fixed wall-clock window (default 5 minutes), through the running `fleetd` daemon.
 
 Where conversation_test.py proves a handful of turns work and issue_hunt_test.py proves
 fan-out isolation, this proves the channel stays healthy under a *sustained, stateful*
@@ -24,7 +24,7 @@ Usage:
     --turn-timeout  per-turn max wait, seconds    (default 150)
     --keep-worker   do not stop the worker at the end
 
-Exit code: 0 if every turn in the window resolved via a clean bridge_reply with no channel
+Exit code: 0 if every turn in the window resolved via a clean fleet_reply with no channel
 break; 1 otherwise. A live per-turn log streams to stdout so the run can be watched.
 """
 import argparse
@@ -47,12 +47,12 @@ STEPS = [7, 3, 11, 5, 9, 4, 13, 6, 8, 2]
 RULES = (
     "Let's play a running-total game across several messages. The total starts at 0. "
     "In each message I'll tell you to add a number; keep the running total yourself and "
-    "reply via bridge_reply with ONLY the current total as a plain integer — no words, no "
+    "reply via fleet_reply with ONLY the current total as a plain integer — no words, no "
     "punctuation, just the number. Do not restate the arithmetic. First move: add {step}."
 )
-NEXT = ("Add {step}. Reply via bridge_reply with only the new running total.")
+NEXT = ("Add {step}. Reply via fleet_reply with only the new running total.")
 REANCHOR = ("Let's re-sync — the running total is {total}. Now add {step}. Reply via "
-            "bridge_reply with only the new running total.")
+            "fleet_reply with only the new running total.")
 
 
 def parse_int(reply):
@@ -142,15 +142,15 @@ def main():
     print("=" * 72)
     print(f"SUSTAINED CONVERSATION SUMMARY — 1 primary <-> 1 worker over {dur}s (~{dur/60:.1f} min)")
     print(f"  turns:            {turns}")
-    print(f"  clean bridge_reply exchanges: {oks + drifts}/{turns}   (channel breaks: {breaks})")
+    print(f"  clean fleet_reply exchanges: {oks + drifts}/{turns}   (channel breaks: {breaks})")
     print(f"  arithmetic correct (continuity held): {oks}/{turns}   (drifts: {drifts})")
     print(f"  latency:          avg {avg}s over {turns} turns")
     ok = breaks == 0 and turns >= 2
     if ok and drifts == 0:
-        print("  RESULT: PASS — every turn resolved via bridge_reply and the worker held the "
+        print("  RESULT: PASS — every turn resolved via fleet_reply and the worker held the "
               "running total across the whole window.")
     elif ok:
-        print(f"  RESULT: PASS (channel) — every turn resolved via bridge_reply for the full "
+        print(f"  RESULT: PASS (channel) — every turn resolved via fleet_reply for the full "
               f"window; {drifts} arithmetic drift(s) (worker recovered after re-anchor).")
     else:
         print("  RESULT: FAIL — the channel broke on at least one turn (see CHANNEL BREAK above).")

e2e/conversation_test.py

@@ -1,10 +1,10 @@
 #!/usr/bin/env python3
 """Standard bridge conversation test — a multi-turn primary↔worker exchange through
-the running `bridged` daemon, fully captured, with automatic gap analysis.
+the running `fleetd` daemon, fully captured, with automatic gap analysis.
 
 This is the repeatable form of the ad-hoc channel test that surfaced the CB-115 gaps
 (herdr `unknown` misclassification, dirty completion scrape, workers not calling
-bridge_reply). It drives a real off-subscription worker over the live gateway exactly
+fleet_reply). It drives a real off-subscription worker over the live gateway exactly
 as a primary Opus session would (async fire-and-poll), records every turn, and grades
 the channel.
 
@@ -130,9 +130,9 @@ def grade(rec):
     phase, source, reply = rec["phase"], rec["source"], rec["reply"]
     has_reply = bool(reply and reply.strip())
     if phase == "done" and source == "reply" and has_reply:
-        return "OK", "clean explicit bridge_reply"
+        return "OK", "clean explicit fleet_reply"
     if phase == "done" and has_reply:
-        return "DEGRADED", f"resolved via {source} (worker did not call bridge_reply)"
+        return "DEGRADED", f"resolved via {source} (worker did not call fleet_reply)"
     if phase == "done" and not has_reply:
         return "EMPTY", "turn completed but reply was empty"
     if phase == "failed":
@@ -206,7 +206,7 @@ def main():
     ok = all(g in ("OK", "DEGRADED") for g in grades)
     reply_clean = all(g == "OK" for g in grades)
     if reply_clean:
-        print("  RESULT: PASS — every turn delivered and got a clean bridge_reply.")
+        print("  RESULT: PASS — every turn delivered and got a clean fleet_reply.")
     elif ok:
         print("  RESULT: PASS (with notes) — every turn delivered & replied, but some via fallback.")
     else:

e2e/fleet_ask_test.py

@@ -1,16 +1,16 @@
 #!/usr/bin/env python3
-"""Live bridge_ask test — the REVERSE rendezvous (CB-205), watched end to end.
+"""Live fleet_ask test — the REVERSE rendezvous (CB-205), watched end to end.
 
-Every other harness drives the forward path: primary `bridge_send` → worker `bridge_reply`.
+Every other harness drives the forward path: primary `fleet_send` → worker `fleet_reply`.
 This drives the one that runs the other way. A worker is told to pause its delegated turn,
-ask the primary a question via `bridge_ask`, and only finish once it has the answer — so the
+ask the primary a question via `fleet_ask`, and only finish once it has the answer — so the
 turn round-trips primary→worker→primary→worker inside a SINGLE delegation.
 
 The mechanics that only this path exercises:
 
   • a worker's mid-turn question surfacing on the primary's *own* blocked send (Outcome.QUESTION),
   • the `turnId` correlation that lets the primary answer the exact paused turn,
-  • the answer resuming that same turn and the worker's final `bridge_reply` landing on the
+  • the answer resuming that same turn and the worker's final `fleet_reply` landing on the
     re-opened forward waiter (never a stale or cross-wired one).
 
 It is two blocking REST calls, no polling:
@@ -24,7 +24,7 @@ Like the rest of the suite it talks ONLY to the bridge's REST face on loopback
 ANTHROPIC_BASE_URL and never touches herdr, so it is subscription-safe by construction.
 
 Usage:
-    python3 bridge_ask_test.py [--base URL] [--profile NAME] [--repo DIR] [--out DIR]
+    python3 fleet_ask_test.py [--base URL] [--profile NAME] [--repo DIR] [--out DIR]
                                [--send-timeout SECS] [--answer-timeout SECS] [--keep-worker]
 
     --base            bridge REST base URL              (default http://127.0.0.1:8765)
@@ -57,14 +57,14 @@ ANSWER_COLOR = "blue"
 
 # A task that CANNOT be completed without asking: the worker is not told which color to choose,
 # only that the primary will name one when asked. So a correct final reply is only reachable by
-# actually calling bridge_ask and using the answer.
+# actually calling fleet_ask and using the answer.
 TASK_PROMPT = (
     "You are a bridge worker in a quick coordination game. You do NOT know which color to pick — "
     "only the primary does. Do exactly this, in order:\n"
-    "1. Call the `bridge_ask` tool with EXACTLY this question: \"PICK A COLOR: red or blue?\"\n"
+    "1. Call the `fleet_ask` tool with EXACTLY this question: \"PICK A COLOR: red or blue?\"\n"
     "2. The primary will answer with one color word. Take that color and uppercase it.\n"
-    "3. Call `bridge_reply` with EXACTLY one line: CHOSEN=<COLOR>  (e.g. CHOSEN=GREEN if told green).\n"
-    "Do not guess a color. Do not call bridge_reply before bridge_ask has returned an answer. "
+    "3. Call `fleet_reply` with EXACTLY one line: CHOSEN=<COLOR>  (e.g. CHOSEN=GREEN if told green).\n"
+    "Do not guess a color. Do not call fleet_reply before fleet_ask has returned an answer. "
     "Do nothing else — no file reads, no other tools."
 )
 
@@ -134,7 +134,7 @@ def run(base, profile, repo, send_timeout, answer_timeout):
     rec.update(tid=tid, pane=pane, spawned=True)
     await_ready(base, tid)
 
-    # 1) Delegate the ask-forcing task. This blocks until the worker calls bridge_ask, at which
+    # 1) Delegate the ask-forcing task. This blocks until the worker calls fleet_ask, at which
     #    point our own send unblocks carrying the question and the turnId to answer on.
     print(f"[{now()}] delegating task (blocks until the worker asks; up to {send_timeout}s)…")
     t0 = time.time()
@@ -159,7 +159,7 @@ def run(base, profile, repo, send_timeout, answer_timeout):
         rec.update(phase="no_turnid", detail="question surfaced without a turnId to answer on")
         return rec
 
-    # 2) Answer on that exact turn. This blocks again until the resumed worker calls bridge_reply.
+    # 2) Answer on that exact turn. This blocks again until the resumed worker calls fleet_reply.
     print(f"[{now()}] answering '{ANSWER_COLOR}' on turn {rec['turnId']} (blocks until reply; up to {answer_timeout}s)…")
     t1 = time.time()
     rec["phase"] = "awaiting_reply"
@@ -188,7 +188,7 @@ def run(base, profile, repo, send_timeout, answer_timeout):
 def grade(rec):
     """PASS only if the worker asked, the turn resumed, and the reply reflects the answer."""
     if rec["phase"] == "no_question":
-        return "NO_ASK", "the worker finished/stalled without ever calling bridge_ask"
+        return "NO_ASK", "the worker finished/stalled without ever calling fleet_ask"
     if rec["phase"] in ("send_error", "answer_error", "spawn"):
         return "ERROR", rec.get("detail") or "transport error before the round-trip completed"
     if rec["phase"] == "no_turnid":
@@ -203,26 +203,26 @@ def grade(rec):
             return "OK", "asked, resumed the same turn, and the reply reflected the primary's answer"
         if reflected:
             return "DEGRADED", f"reply reflected the answer but resolved via {rec['replySource']} " \
-                               "(worker did not call bridge_reply cleanly)"
+                               "(worker did not call fleet_reply cleanly)"
         return "WRONG_ANSWER", f"the worker replied but did not reflect '{ANSWER_COLOR}' — " \
                                f"the answer may not have reached the resumed turn: {rec['reply']!r}"
     return "WEDGE", f"unexpected terminal phase {rec['phase']}: {rec.get('detail')}"
 
 
 def write_transcript(out_dir, rec, meta):
-    path = out_dir / "bridge_ask_transcript.md"
+    path = out_dir / "fleet_ask_transcript.md"
     g, note = grade(rec)
     with path.open("w") as f:
-        f.write(f"# Live bridge_ask — reverse rendezvous — {datetime.now():%Y-%m-%d %H:%M}\n\n")
+        f.write(f"# Live fleet_ask — reverse rendezvous — {datetime.now():%Y-%m-%d %H:%M}\n\n")
         f.write(f"One worker paused its delegated turn to ask the primary, then resumed with the "
                 f"answer (profile `{meta['profile']}`). Result: **`{g}`**.\n\n")
         f.write("## Round-trip\n\n")
         f.write(f"1. **primary → worker** (delegation): the ask-forcing task.\n")
-        f.write(f"2. **worker → primary** (`bridge_ask`, {rec.get('ask_latency')}s): "
+        f.write(f"2. **worker → primary** (`fleet_ask`, {rec.get('ask_latency')}s): "
                 f"{rec.get('question')!r} — surfaced on the primary's blocked send as a "
                 f"`question` with `turnId={rec.get('turnId')}`.\n")
         f.write(f"3. **primary → worker** (answer on that turn): `{ANSWER_COLOR}`.\n")
-        f.write(f"4. **worker → primary** (`bridge_reply`, {rec.get('answer_latency')}s, "
+        f.write(f"4. **worker → primary** (`fleet_reply`, {rec.get('answer_latency')}s, "
                 f"source={rec.get('replySource')}): {rec.get('reply')!r}\n\n")
         f.write(f"> **{g}:** {note}\n")
         if rec.get("detail"):
@@ -231,7 +231,7 @@ def write_transcript(out_dir, rec, meta):
 
 
 def main():
-    ap = argparse.ArgumentParser(description="Live bridge_ask reverse-rendezvous test (CB-205)")
+    ap = argparse.ArgumentParser(description="Live fleet_ask reverse-rendezvous test (CB-205)")
     ap.add_argument("--base", default="http://127.0.0.1:8765")
     ap.add_argument("--profile", default=None)
     ap.add_argument("--repo", default=str(REPO_ROOT))
@@ -241,7 +241,7 @@ def main():
     ap.add_argument("--keep-worker", action="store_true")
     args = ap.parse_args()
 
-    print(f"[{now()}] live bridge_ask: 1 primary, 1 worker "
+    print(f"[{now()}] live fleet_ask: 1 primary, 1 worker "
           f"(profile={args.profile or 'default'}, repo={args.repo})\n")
 
     rec = {"spawned": False, "pane": None}
@@ -262,7 +262,7 @@ def main():
 
     print()
     print("=" * 72)
-    print("LIVE bridge_ask SUMMARY — reverse rendezvous (CB-205)")
+    print("LIVE fleet_ask SUMMARY — reverse rendezvous (CB-205)")
     print(f"  asked:    {rec.get('question')!r}  (turnId={rec.get('turnId')}, {rec.get('ask_latency')}s)")
     print(f"  answered: {ANSWER_COLOR!r}")
     print(f"  replied:  {rec.get('reply')!r}  (source={rec.get('replySource')}, {rec.get('answer_latency')}s)")

e2e/fleet_ask_transcript.md

@@ -1,12 +1,12 @@
-# Live bridge_ask — reverse rendezvous — 2026-07-16 16:30
+# Live fleet_ask — reverse rendezvous — 2026-07-16 16:30
 
 One worker paused its delegated turn to ask the primary, then resumed with the answer (profile `default`). Result: **`OK`**.
 
 ## Round-trip
 
 1. **primary → worker** (delegation): the ask-forcing task.
-2. **worker → primary** (`bridge_ask`, 6.6s): 'PICK A COLOR: red or blue?' — surfaced on the primary's blocked send as a `question` with `turnId=term_656bb47d2c42a9e#1`.
+2. **worker → primary** (`fleet_ask`, 6.6s): 'PICK A COLOR: red or blue?' — surfaced on the primary's blocked send as a `question` with `turnId=term_656bb47d2c42a9e#1`.
 3. **primary → worker** (answer on that turn): `blue`.
-4. **worker → primary** (`bridge_reply`, 7.9s, source=reply): 'CHOSEN=BLUE'
+4. **worker → primary** (`fleet_reply`, 7.9s, source=reply): 'CHOSEN=BLUE'
 
 > **OK:** asked, resumed the same turn, and the reply reflected the primary's answer

e2e/issue_hunt_test.py

@@ -1,6 +1,6 @@
 #!/usr/bin/env python3
 """Standard bridge fan-out test — ONE primary vs MANY workers, concurrently, for
-issue hunting through the running `bridged` daemon, fully captured, with gap analysis.
+issue hunting through the running `fleetd` daemon, fully captured, with gap analysis.
 
 Where conversation_test.py exercises a single worker over multiple turns, this drives
 the path that only appears under fan-out: the primary spawns N workers, sends each a
@@ -12,7 +12,7 @@ and collects every reply concurrently. That stresses what a single worker never
   • reply routing under concurrency (worker A's answer must never resolve worker B's send),
 
 and, as the payload, whether a fleet of off-subscription workers can actually surface
-real issues in the repo and report them back structurally via bridge_reply.
+real issues in the repo and report them back structurally via fleet_reply.
 
 It talks ONLY to the bridge's REST face on loopback — it never sets ANTHROPIC_BASE_URL
 and never touches herdr directly, so it is subscription-safe by construction.
@@ -53,18 +53,18 @@ REPO_ROOT = HERE.parent
 # hot files this project has been iterating on, so a real issue is plausible to find.
 DEFAULT_ASSIGNMENTS = [
     {"id": "completion", "probe": "CompletionResolver",
-     "target": "bridged/src/main/java/dev/ltms/bridged/inject/CompletionResolver.java"},
+     "target": "fleetd/src/main/java/dev/ltms/fleet/inject/CompletionResolver.java"},
     {"id": "worker", "probe": "WorkerService",
-     "target": "bridged/src/main/java/dev/ltms/bridged/worker/WorkerService.java"},
+     "target": "fleetd/src/main/java/dev/ltms/fleet/worker/WorkerService.java"},
     {"id": "rendezvous", "probe": "Rendezvous",
-     "target": "bridged/src/main/java/dev/ltms/bridged/msg/Rendezvous.java"},
+     "target": "fleetd/src/main/java/dev/ltms/fleet/msg/Rendezvous.java"},
 ]
 
 PROMPT_TMPL = (
     "You are one of several issue-hunting workers in the claude-bridge repo (it is your "
     "current working directory). Your assignment: inspect the file `{target}` and find the "
     "SINGLE most important real bug, correctness gap, or risk in it. Read the file before "
-    "answering. Reply via bridge_reply with EXACTLY these four lines:\n"
+    "answering. Reply via fleet_reply with EXACTLY these four lines:\n"
     "1. {target}:<line>\n"
     "2. issue: <one sentence>\n"
     "3. fix: <one line>\n"
@@ -147,9 +147,9 @@ def grade(rec):
     phase, source, reply = rec["phase"], rec["source"], rec["reply"]
     has_reply = bool(reply and reply.strip())
     if phase == "done" and source == "reply" and has_reply:
-        return "OK", "clean explicit bridge_reply"
+        return "OK", "clean explicit fleet_reply"
     if phase == "done" and has_reply:
-        return "DEGRADED", f"resolved via {source} (worker did not call bridge_reply)"
+        return "DEGRADED", f"resolved via {source} (worker did not call fleet_reply)"
     if phase == "done" and not has_reply:
         return "EMPTY", "turn completed but reply was empty"
     if phase == "failed":

fleetd/.gitignore

@@ -0,0 +1,16 @@
+# Build output
+target/
+dependency-reduced-pom.xml
+
+# Local runtime config (copy from fleetd.example.yaml). Both names are ignored: fleetd.yaml is
+# the current name, and bridged.yaml is the legacy name Fleetd still falls back to.
+fleetd.yaml
+bridged.yaml
+
+# CB-505 audit trail + daemon stdout/stderr — runtime records, never source
+logs/
+
+# Editor / OS
+*.iml
+.idea/
+.DS_Store

fleetd/docs/CB-307-Push-Loop.md

@@ -5,10 +5,10 @@
 
 ## Why this exists
 
-Stage 2 gave a worker→primary reply a **durable place to wait** when no `bridge_send` is
+Stage 2 gave a worker→primary reply a **durable place to wait** when no `fleet_send` is
 open: it lands in `agent.<target>.inbox` on the broker and survives a daemon bounce. But
 delivery is still **pull** — the primary only sees the reply if it happens to call
-`bridge_poll(target)` / `GET /sessions/{id}/replies`. A reply can sit indefinitely while
+`fleet_poll(target)` / `GET /sessions/{id}/replies`. A reply can sit indefinitely while
 the primary works on something else.
 
 This layer makes delivery **active**: the bridge *pushes* a nudge to the primary the moment
@@ -26,11 +26,11 @@ pointed at the primary's pane instead.
 
 ```mermaid
 flowchart LR
-    W["worker"] -->|"bridge_reply (no open send)"| MS["MessageService.reply"]
+    W["worker"] -->|"fleet_reply (no open send)"| MS["MessageService.reply"]
     MS -->|"inbox.publish"| INBOX[("agent.&lt;target&gt;.inbox<br/>(durable, LavinMQ)")]
     MS -->|"notify"| LOOP["ReplyPushLoop"]
     LOOP -->|"status-gated inject"| PANE["primary's herdr pane"]
-    PANE -->|"primary drains"| DRAIN["bridge_poll(target)<br/>= peek + ack"]
+    PANE -->|"primary drains"| DRAIN["fleet_poll(target)<br/>= peek + ack"]
     DRAIN -->|"inbox now empty"| LOOP
     LOOP -.->|"still non-empty →<br/>re-inject on backoff"| PANE
     classDef store fill:#2c5282,stroke:#1a365d,color:#ffffff;
@@ -51,13 +51,13 @@ the caller runs in a herdr pane on this host. Today it's discarded for the prima
 (`presence.markPresent` is a no-op on it).
 
 **Plan:** a single-slot `PrimaryRegistry` (thread-safe) holding the primary's `terminal_id`.
-Populate it from the **orchestration-side** MCP tools — `bridge_send`, `bridge_spawn`,
-`bridge_poll`, `bridge_list`, `bridge_status`, `bridge_profiles` — capturing
+Populate it from the **orchestration-side** MCP tools — `fleet_send`, `fleet_spawn`,
+`fleet_poll`, `fleet_list`, `fleet_status`, `fleet_profiles` — capturing
 `callerTerminal(exchange)` when it is (a) non-null and (b) **not** a registered worker
 session in `SessionManager`. That caller is, by construction, the primary. Worker-side tools
-(`bridge_reply`, `bridge_ask`) never set it.
+(`fleet_reply`, `fleet_ask`) never set it.
 
-- **Config override / pin:** a `primary: { terminal: "<id>" }` block in `BridgedConfig`
+- **Config override / pin:** a `primary: { terminal: "<id>" }` block in `FleetConfig`
   (nested record, same shape as `Broker`). Lets an operator pin it, or supply it when
   derivation can't (see degrade case).
 - **Degrade:** if the primary is off-host or in a non-herdr terminal, `terminalForPid`
@@ -71,13 +71,13 @@ A `ReplyPushLoop` component, notified at the single no-waiter call site
 (`MessageService.reply` → the `inbox.publish` branch, `MessageService.java:192`).
 
 - **Inject a nudge, not the payload.** The injected turn tells the primary *to drain*
-  (e.g. "Worker `<target>` returned a reply — run `bridge_poll(target=<target>)` to collect
+  (e.g. "Worker `<target>` returned a reply — run `fleet_poll(target=<target>)` to collect
   it"), it does **not** carry the reply text. Rationale: replies can be large/multiline and
   terminal injection would mangle them; the drain response is the clean transport. Keeps the
   push idempotent — re-nudging is harmless.
 - **Ack = drain.** The primary draining (`drainReplies` = peek + ack) is the acknowledgement.
   The loop's **stop condition is `inbox.peek(target).isEmpty()`** — the reply is gone from the
-  inbox because it was acked. No new `bridge_ack` tool needed for v1 (see Increment 3).
+  inbox because it was acked. No new `fleet_ack` tool needed for v1 (see Increment 3).
 - **Status-gated injection (mechanism (b), chosen).** A dedicated lightweight scheduled loop,
   **not** the worker `Injector`. It injects via `AgentControl.send(primaryTerminal, nudge)`
   (the same herdr `agent.send` = `pane send-text` + submit that delivers to workers) only when
@@ -93,10 +93,10 @@ A `ReplyPushLoop` component, notified at the single no-waiter call site
   the reply remains in the durable inbox and the next natural poll (or a later worker reply's
   nudge) still surfaces it. Bounded so the bridge never spams the primary.
 
-### Increment 3 — optional per-`msgId` `bridge_ack` tool (deferred)
+### Increment 3 — optional per-`msgId` `fleet_ack` tool (deferred)
 
 Drain-as-ack is coarse: it clears *all* pending replies for a target at once. If finer
-control is ever needed (ack one reply, leave others held), add a `bridge_ack(msgId)` tool
+control is ever needed (ack one reply, leave others held), add a `fleet_ack(msgId)` tool
 mapping to `inbox.ack(target, msgId)` — the port already supports per-`msgId` ack. Not built
 in v1; the stop-on-empty loop is sufficient.
 
@@ -106,7 +106,7 @@ in v1; the stop-on-empty loop is sufficient.
    resolved terminal is non-null **and not a registered worker session**, seen on an
    orchestration-side tool. This never mislabels a worker (workers are in `SessionManager`)
    and needs no new env var or argument (identity stays connection-derived, per the existing
-   `BridgeMcp` invariant).
+   `FleetMcp` invariant).
 
 2. **Readiness-gate mismatch → dedicated loop.** The existing `Injector` gates delivery on
    `ready.test(target)` = `WorkerPresence` (the *worker's* MCP connected). The primary is not
@@ -132,7 +132,7 @@ boundary**. The bridge is signalling the primary that it has mail — not drivin
   non-null terminal AND not a registered session" predicate; the loop's stop-on-empty and
   bounded-reminder logic with an injected clock + a fake injector (no real herdr).
 - **Live dogfood (primary-side):** with the daemon on the broker jar + a real worker,
-  delegate a task, let the worker reply after the `bridge_send` window closes, and observe the
+  delegate a task, let the worker reply after the `fleet_send` window closes, and observe the
   bridge inject a drain nudge into *this* primary pane; confirm draining stops the reminders;
   confirm an unreachable primary (registry empty) degrades to pull with no loss.
 

fleetd/fleetd.example.yaml

@@ -1,10 +1,10 @@
-# bridged configuration (example). Copy to bridged.yaml and adjust.
+# fleetd configuration (example). Copy to fleetd.yaml and adjust.
 #
-# bridged is the sole gateway between primary/worker Claude sessions and herdr.
+# fleetd is the sole gateway between primary/worker Claude sessions and herdr.
 # It is NOT a Claude process and must never carry ANTHROPIC_BASE_URL.
 
 # REST + MCP listen address. Keep it on loopback unless you also switch auth.mode to `token`
-# below — bridged REFUSES TO START on a non-loopback bind under loopback-trust (see auth).
+# below — fleetd REFUSES TO START on a non-loopback bind under loopback-trust (see auth).
 bind:
   host: 127.0.0.1
   port: 8765
@@ -21,7 +21,7 @@ bind:
 #                           bind — the daemon fails fast otherwise, because "unauthenticated ⇒
 #                           primary" on a reachable port would hand spawn/stop/send to anyone.
 #   tokenEnv              → host env var holding the token (never the literal value). Default
-#                           BRIDGED_API_TOKEN. Read only in token mode; empty ⇒ startup fails.
+#                           FLEETD_API_TOKEN. Read only in token mode; empty ⇒ startup fails.
 #
 # TLS is deliberately NOT terminated in the daemon (CB-501 D3): run a reverse proxy in front and
 # let it own certificate lifecycle, e.g.
@@ -29,13 +29,13 @@ bind:
 # The broker link gets TLS from its own URI (amqps://…) — see `broker` below.
 # auth:
 #   mode: token
-#   tokenEnv: BRIDGED_API_TOKEN
+#   tokenEnv: FLEETD_API_TOKEN
 
 # Optional pinned primary terminal (CB-307). Names the herdr pane the PRIMARY itself runs in:
 # a caller whose connection maps to this pane resolves as the primary (no credential needed —
 # the pane mapping is as unforgeable as a worker's), and reply nudges are pushed to it.
 # REQUIRED when the primary runs inside a herdr pane — without it the pane match reads the
-# primary as a worker and refuses spawn/send/stop. Get the id from bridge_whoami; re-pin if
+# primary as a worker and refuses spawn/send/stop. Get the id from fleet_whoami; re-pin if
 # the primary moves panes.
 # primary:
 #   terminal: term_0123456789abcd
@@ -48,13 +48,13 @@ bind:
 # every orchestration call. List each lead's pane here and all of them resolve as leads.
 #
 #   tab → the ONLY field identity depends on (CB-579); the exact label of the tab hosting the lead.
-#         Label the tab yourself, or let bridged label one it launches — see `fleet.leaders:` below.
-#   kind/model → descriptive; they document what runs in the pane and are echoed by bridge_whoami
+#         Label the tab yourself, or let fleetd label one it launches — see `fleet.leaders:` below.
+#   kind/model → descriptive; they document what runs in the pane and are echoed by fleet_whoami
 #
-# A lead's tab must already carry its label (or be launched by bridged, which labels it) — there is
+# A lead's tab must already carry its label (or be launched by fleetd, which labels it) — there is
 # no terminal id to paste in and nothing to re-pin when the session restarts: the tab survives, so
 # the same label resolves the same lead again on the next scan.
-# `bridge_whoami` reports `{"role":"primary","leader":"<name>"}`; role stays "primary" because a lead
+# `fleet_whoami` reports `{"role":"primary","leader":"<name>"}`; role stays "primary" because a lead
 # IS a primary for authorization, so nothing that keys on the role breaks.
 #
 # KEEP `primary:` when adding leads: it still addresses the CB-307 push loop, which needs a single
@@ -63,13 +63,13 @@ bind:
 # Leads are configured under `fleet.leaders:` — see THE FLEET further down.
 #
 # Two things stop the tab-name convention from becoming a way to claim leadership: the configured
-# member spaces are excluded from the scan, so nothing bridged places can land in a matching tab;
+# member spaces are excluded from the scan, so nothing fleetd places can land in a matching tab;
 # and startup REFUSES a `tabPrefix` that the fleet tabLabel template, or any per-profile `tabLabel`
 # override, also matches — so the two namespaces cannot overlap by accident. The label is a NAME,
 # never a capability: what a pane may do is decided by the role the daemon resolves for it.
 
 # CB-551: IDLE-LEAD HEARTBEAT — nudge the single lead back to work when it has been continuously
-# idle (no open bridge_send driving it) past the quiet period. The fleet is one lead + architects +
+# idle (no open fleet_send driving it) past the quiet period. The fleet is one lead + architects +
 # workers, so a lead that stalls is a single point of failure; the ReplyPushLoop only nudges when a
 # reply lands, and this timer catches the gap where nothing lands and the lead just sits idle.
 #
@@ -93,21 +93,20 @@ bind:
 #   intervalSeconds → how often a tick runs (default 30). ENFORCED floor of 15: the code computes
 #                      Math.max(15, intervalSeconds), so a lower value is silently raised, not
 #                      rejected.
-#   workingSuspectAfterSeconds, paneProbeIntervalSeconds → accepted and parsed, but NOT YET READ by
-#                      anything — the dormant monitor only consumes intervalSeconds today (CB-573
-#                      shipped ahead of the evidence publishers these two knobs are for). Setting
-#                      them changes nothing right now, and no minimum is enforced on either, because
-#                      nothing reads them to enforce one. They exist so a later build can start
-#                      honouring them without another config-shape change.
-#   notifications.mode → "webhook" flips what bridge_list REPORTS (healthCoverage: "full" instead
-#                      of "detection-only") — it does NOT make bridged send any webhook call; no
+#   workingSuspectAfterSeconds → age before a BUSY member is suspected of a stall (default 600).
+#                      ENFORCED floor of 300: a lower value is silently raised.
+#   paneProbeIntervalSeconds → accepted and parsed, but NOT YET READ by anything. Setting it changes
+#                      nothing right now. It exists so a later build can start honouring it without
+#                      another config-shape change.
+#   notifications.mode → "webhook" flips what fleet_list REPORTS (healthCoverage: "full" instead
+#                      of "detection-only") — it does NOT make fleetd send any webhook call; no
 #                      delivery mechanism is implemented yet. Any other value, or omitting the
 #                      block, reports "detection-only".
 # health:
 #   enabled: true
-#   intervalSeconds: 30
-#   workingSuspectAfterSeconds: 600
-#   paneProbeIntervalSeconds: 60
+#   intervalSeconds: 30               # floor 15
+#   workingSuspectAfterSeconds: 600   # floor 300 — how long BUSY with no activity means STALL_SUSPECTED
+#   paneProbeIntervalSeconds: 60      # parsed, but nothing reads it yet — changing it changes nothing
 #   notifications:
 #     mode: disabled
 
@@ -115,6 +114,9 @@ bind:
 # (${HERDR_SOCKET_PATH:-~/.config/herdr/herdr.sock}).
 herdrSocket: ~/.config/herdr/herdr.sock
 
+# Optional socket for member panes. Omit this to use herdrSocket for both leads and members.
+# memberHerdrSocket: /Users/member/.config/herdr/herdr.sock
+
 # How member sessions are spawned. Define one or more named profiles (backends) under
 # `profiles`; each key is the profile name (also the ccs profile). A profile says only WHICH
 # BACKEND — model, CLI adapter, credentials, cost. It says nothing about what a member spawned on
@@ -124,8 +126,34 @@ herdrSocket: ~/.config/herdr/herdr.sock
 # Shared knobs (placement/workspace) can be repeated per profile; they usually match.
 #   placement: tab   → each worker lands in its OWN tab in a dedicated worker space (default).
 #                      Use `pane` for the legacy behaviour (split the focused tab).
-#   mcpUrl           → bridged mounts the bridge MCP (--mcp-config, inline) + reply charter
+#   mcpUrl           → fleetd mounts the bridge MCP (--mcp-config, inline) + reply charter
 #                      (--append-system-prompt) as launch flags; nothing is written to the profile.
+#   ideMcpUrl        → opt-in (CB-634), default off. When set, fleetd mounts the IDE Index MCP as a
+#                      second inline server named `intellij`, and adds an IDE charter that pins every
+#                      ide_* call to the member's own worktree. A URL, not a boolean — host and port
+#                      are host-specific. Set it only on a host where the IDE actually runs.
+#   ideProjectDir    → repo-relative module dir the IDE opens and the overlay pins (CB-634). Only read
+#                      when ideMcpUrl is set. This repo's Maven pom lives in `fleetd/`, not at the
+#                      worktree root, so opening the root imports no module and ide_* resolves nothing;
+#                      set this to `fleetd`. Omit for a repo whose project is the worktree root.
+#   ideOpenCommand   → host command that opens ideProjectDir in the IDE at spawn (CB-634 auto-open).
+#                      Only read when ideMcpUrl is set. `{dir}` is replaced with the absolute module
+#                      dir and the command runs through `/bin/sh -c`, so set env inline if needed —
+#                      e.g. `env DISPLAY=:10.0 idea {dir}`. Best-effort: a failure is logged, never
+#                      fails the spawn. Omit to open the member's module by hand. There is no close
+#                      half yet — an opened module stays open until the operator closes it.
+#   autoCompactWindow → opt-in, default off. A bounded token window that forces a spawned member to
+#                      compact its context instead of running on the backend's own default and dying
+#                      mid-turn (losing its fleet_reply — the whole point of the turn — with it).
+#                      Validated at config load to [100000, 1000000] — the band Claude Code's own
+#                      --autocompact flag accepts.
+#                      CROSS-BACKEND SEMANTICS DIFFER: on claude-code this is a launch-time
+#                      `--autocompact <tokens>` flag — the member compacts AT this window. opencode
+#                      has no equivalent flag (it only forces `compaction.auto: true`, unconditionally,
+#                      already), so this is instead applied as the model's `limit.context` in the
+#                      generated opencode.json — the member compacts WITHIN this window, not exactly
+#                      at it — and only when this profile's `model:` is in `provider/model` form; if it
+#                      isn't, fleetd logs a WARN naming the profile rather than silently doing nothing.
 #   tokenEnv         → host env var holding the worker's auth token (value never stored in config);
 #                      omit for a backend that needs no token (e.g. a local ollama).
 #   cwd              → pin this profile's working directory (CB-112). Omit to inherit the primary's
@@ -135,7 +163,8 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      skills/MCP/hooks. Omit to leave the worker on the host default.
 #   parityOverlay    → repo-relative paths copied primary→worktree so a worker in a provisioned
 #                      worktree sees the same local config (CB-301-ext). Omit for the default set:
-#                      [.claude/settings.local.json, .env, .envrc].
+#                      [.env, .envrc]. (.claude/settings.local.json is NOT in the default — it
+#                      pre-approves IDE/tool grants a member must not hold ambiently; CB-525/CB-634.)
 #
 #                      Do NOT add .mcp.json (CB-525). A worker's tools are whatever its launcher
 #                      mounts — the bridge, and nothing else. Replicating the primary's MCP config
@@ -143,7 +172,7 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      checkout, so its navigation returned paths OUTSIDE its own worktree: one
 #                      worker made all 59 of its edits in the primary tree while compiling its
 #                      worktree, and every build it ran was of code that did not contain them.
-#                      bridged neutralizes a provisioned worktree's .mcp.json for this reason;
+#                      fleetd neutralizes a provisioned worktree's .mcp.json for this reason;
 #                      listing it here would copy the primary's back over that.
 #   gitTokenEnv      → host env var holding the git-forge API token. When set, its value is injected
 #                      as GITEA_TOKEN so the worker can open its OWN PR at checkpoint (CB-302).
@@ -152,11 +181,11 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #   gitHostEnv       → host env var holding the forge host (default GITEA_HOST). Injected as
 #                      GITEA_HOST *only* alongside a resolved gitTokenEnv.
 #   exhaustedPattern → regex matched against a completion-fallback scrape (CB-578 stage A) to
-#                      classify a turn that ended with no bridge_reply as the backend having
+#                      classify a turn that ended with no fleet_reply as the backend having
 #                      refused on a subscription usage limit, rather than a real answer. Opt-in —
 #                      omit and this profile's completion fallback behaves exactly as before.
 #                      Every backend words its refusal differently, so this is config, never a
-#                      vendor string baked into bridged itself.
+#                      vendor string baked into fleetd itself.
 #                      DEFERRED: compiled once into a startup pattern map — editing it needs a
 #                      daemon restart, same as this profile's model/baseUrl/argv.
 #   credentialId     → CB-578 stage B: the credential this profile quarantines WITH when a
@@ -171,15 +200,15 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #   env              → extra environment for this profile's workers, as a literal key/value map
 #                      (CB-511). Use it to give workers a toolchain.
 #
-#                      A worker's environment does NOT come from your shell. bridged hands herdr an
+#                      A worker's environment does NOT come from your shell. fleetd hands herdr an
 #                      explicit env map and herdr merges it into ITS OWN process env — so before
 #                      CB-511 a worker inherited whatever PATH the herdr server happened to be
 #                      started with, which on a long-lived herdr can predate your toolchain entirely
 #                      and leave workers unable to run `mvn` or `java` at all.
-#                      bridged now propagates ITS OWN PATH to every worker by default; set `env:`
+#                      fleetd now propagates ITS OWN PATH to every worker by default; set `env:`
 #                      only to override that or add more (JAVA_HOME, …). Since the default is the
 #                      daemon's PATH, make sure the daemon is started with a good one — see the PATH
-#                      lines in deploy/dev.ltms.bridged.plist and deploy/bridged.service.
+#                      lines in deploy/dev.ltms.fleet.plist and deploy/fleetd.service.
 #
 #                      Adapter-owned variables always win over `env:`: ANTHROPIC_BASE_URL and the
 #                      rest of the ANTHROPIC_*/CLAUDE_* wiring are applied after it, so an `env:`
@@ -192,33 +221,60 @@ profiles:
     baseUrl: http://gx01.gw:8000     # the vLLM host this profile targets (gx00.gw / gx01.gw)
     model: coder
     placement: tab
-    workspace: bridged-workers
+    workspace: fleetd-workers
     # tabLabel: an optional per-profile override; the fleet template usually covers it
     mcpUrl: http://127.0.0.1:8765/mcp
-    tokenEnv: BRIDGED_WORKER_TOKEN
+    tokenEnv: FLEETD_WORKER_TOKEN
     argv: ["ccs", "gx10"]
     # weight: relative selection weight for automatic placement (weighted, round-robin, and
     # fixed's fallback walk). Absent defaults to 1.0. An explicit 0 or negative value means
     # "never auto-select this profile" (CB-554) — it stays reachable via an explicit
-    # `bridge_spawn{profile:"gx10"}`, which bypasses placement entirely; only automatic
+    # `fleet_spawn{profile:"gx10"}`, which bypasses placement entirely; only automatic
     # selection skips it.
     weight: 0.5
     # maxLoad: max live workers on this profile. Omit for unlimited. An explicit 0 (CB-585) caps
     # the profile at zero live members — it is excluded from automatic placement and an explicit
-    # `bridge_spawn{profile:"gx10"}` against it is refused too; a cap holds even when the profile
+    # `fleet_spawn{profile:"gx10"}` against it is refused too; a cap holds even when the profile
     # is named directly. Negative is refused at config load — there is no sane meaning for it.
     maxLoad: 2
+    # subscription: true
+    #   THE KNOB THAT DECIDES WHO PAYS (CB-539). Default false. When true, this profile's members
+    #   run on the OPERATOR'S OWN Claude subscription instead of a metered endpoint — every spawn
+    #   bills your plan and eats your usage limit. Off-subscription is the whole point of this
+    #   daemon, so treat `true` as a deliberate exception, not a convenience.
+    #
+    #   What changes when it is set (ClaudeCodeLauncher):
+    #     - no ANTHROPIC_BASE_URL and no ANTHROPIC_AUTH_TOKEN are injected — the member inherits
+    #       the operator's own Claude Code auth, which is exactly why it bills the plan;
+    #     - SubscriptionGuard never vets it, because there is no baseUrl to vet;
+    #     - no token is required, so `tokenEnv` is irrelevant here.
+    #
+    #   MUTUALLY EXCLUSIVE with `baseUrl` — setting both is refused at config load (CB-542). On the
+    #   subscription path no guard would vet the URL, so allowing both would be a way around the
+    #   guard rather than a configuration.
+    #
+    #   GOTCHA 1 — it is invisible to the startup secret check. `Fleetd.reportRequiredSecrets`
+    #   skips subscription profiles on purpose (they need no token), so a boot log that reports
+    #   every secret as fine says nothing about these profiles.
+    #
+    #   GOTCHA 2 — `maxLoad` is the ONLY throttle you have here. There is no metering, no budget
+    #   and no refusal on cost; the cap on live members is the single thing standing between a
+    #   fan-out and your monthly limit. Set it deliberately and keep it small.
     # gitTokenEnv: GITEA_TOKEN        # opt-in: let this profile's workers open their own PR (CB-302)
     # gitHostEnv: GITEA_HOST          # defaults to GITEA_HOST; injected only with gitTokenEnv
     # exhaustedPattern: "usage limit has been reached"   # opt-in: classify a usage-limit refusal (CB-578)
     # credentialId: shared-openai   # opt-in: quarantine together with every other profile sharing this id (CB-578)
     # configDir: /Users/me/.ccs/instances/gx10   # CLAUDE_CONFIG_DIR — inherit that profile's skills/MCP
     # cwd: /Users/me/src/myrepo       # pin the working dir; omit to inherit the primary's
-    # parityOverlay: [".claude/settings.local.json", ".env", ".envrc"]   # never add .mcp.json — see above
+    # parityOverlay: [".env", ".envrc"]   # the default; never add .mcp.json or .claude/settings.local.json — see above
+    # ideMcpUrl: http://127.0.0.1:29170/index-mcp/streamable-http   # opt-in (CB-634): IDE code intelligence, pinned to the worktree
+    # ideProjectDir: fleetd          # CB-634: module dir the IDE opens + the overlay pins (this repo's pom is in fleetd/)
+    # ideOpenCommand: env DISPLAY=:10.0 idea {dir}   # CB-634 auto-open: opens {dir} in the IDE at spawn; omit to open by hand
+    # autoCompactWindow: 250000   # opt-in: bound member context; claude-code compacts AT this, opencode within it (model limit.context)
   gx11:                              # a second backend, so `placement: weighted` has a choice
     baseUrl: http://gx01.gw:8000     # self-hosted; ccs handles the model + token
     placement: tab
-    workspace: bridged-workers
+    workspace: fleetd-workers
     # tabLabel: an optional per-profile override; the fleet template usually covers it
     mcpUrl: http://127.0.0.1:8765/mcp
     argv: ["ccs", "gx11"]
@@ -236,15 +292,15 @@ profiles:
   # The bridge MCP + reply charter mount via a generated OPENCODE_CONFIG file, and the model is a
   # `provider/model` selector. Placement, tabs, cwd, and the readiness gate are shared with Claude.
   #
-  # Dogfood-verified 2026-07-29 against opencode 1.18.5 (spawn → readiness gate → bridge_send →
-  # structured bridge_reply → teardown). The `opencode/*-free` models run on opencode's own gateway
+  # Dogfood-verified 2026-07-29 against opencode 1.18.5 (spawn → readiness gate → fleet_send →
+  # structured fleet_reply → teardown). The `opencode/*-free` models run on opencode's own gateway
   # and need NO credentials — check `opencode models` for the current free list, since the names
   # change. That also makes the worker off-subscription by construction.
   #   opencode-free:
   #     kind: opencode
   #     model: opencode/north-mini-code-free  # `provider/model` selector, injected as `-m`
   #     placement: tab
-  #     workspace: bridged-workers
+  #     workspace: fleetd-workers
   #     tabLabel: "opencode: {profile} #{n}"
   #     mcpUrl: http://127.0.0.1:8765/mcp
   #     argv: ["opencode"]
@@ -269,7 +325,7 @@ profiles:
   #     baseUrl: http://127.0.0.1:8000
   #     model: local-vllm/deepseek-v4-flash
   #     placement: tab
-  #     workspace: bridged-workers
+  #     workspace: fleetd-workers
   #     tabLabel: "opencode: {profile} #{n}"
   #     mcpUrl: http://127.0.0.1:8765/mcp
   #     argv: ["opencode"]
@@ -307,8 +363,8 @@ placement: weighted
 # quarantineCooldownSeconds: 1800
 
 # Re-read this file without restarting the daemon (CB-559). Off unless you add this block, so an
-# upgraded bridged keeps the old behaviour: the file is read once at boot and never again.
-#   enabled          → turn the watch on. bridged checks the file's modified time on a timer and
+# upgraded fleetd keeps the old behaviour: the file is read once at boot and never again.
+#   enabled          → turn the watch on. fleetd checks the file's modified time on a timer and
 #                      reloads when it moves.
 #   intervalSeconds  → how often to check (default 10). One `stat` per tick, so this is cheap.
 #
@@ -319,7 +375,7 @@ placement: weighted
 #               / credentialId. Those are hot because the placement policy (and, for credentialId,
 #               the CB-578 stage B quarantine check) reads them through a supplier — being config is
 #               not by itself enough to make a key hot.
-#               EXCEPT `fleet.leaders`: Bridged.main reads it once at startup to build the lead tab
+#               EXCEPT `fleet.leaders`: Fleetd.main reads it once at startup to build the lead tab
 #               scanner and launcher, and neither is rebuilt on reload. A changed/added/removed
 #               `fleet.leaders` entry is silently accepted — the reload reports "config reloaded"
 #               with nothing in the deferred list — but has NO effect until you restart. Treat it
@@ -423,8 +479,8 @@ fleet:
   #     workspace: leads             # where a launched lead's tab is created (default "leads").
   #                                  # MUST NOT be a member workspace — those are excluded from the
   #                                  # scan, so a lead placed in one is never found again.
-  #     cwd: /path/to/repo           # the launched lead's working directory (default: bridged's own)
-  #     kind: claude                 # descriptive; reported by bridge_whoami
+  #     cwd: /path/to/repo           # the launched lead's working directory (default: fleetd's own)
+  #     kind: claude                 # descriptive; reported by fleet_whoami
   #   gpt-sol-5.6:
   #     tab: "lead: gpt-sol-5.6"
   #     kind: opencode
@@ -450,6 +506,122 @@ guard:
     - gx00.gw
     - gx01.gw
 
+# Member credential policy (CB-596, gitea issue #82). A herdr pane runs a LOGIN shell, and that
+# shell re-sources the operator's own secret store — so a spawned member inherits every credential
+# the operator's shell holds, not just the ones fleetd means to give it. Measured on this host:
+# 31 credential names, all set, with only ONE (GITEA_ACCESS_TOKEN) blocked before this — and that
+# block was a single name hardcoded in HerdrPeerLauncher.java, not driven by this file. This block
+# replaces that hardcoded shadow with a config-driven list of names.
+#
+# ROUND-2 CORRECTION, measured live: the pane-creation env overlay below (applied at tab.create /
+# pane.split, BEFORE the pane's login shell runs) does NOT survive that login shell for any name
+# secrets.sh actually exports — the shell re-exports it afterwards and overwrites the sentinel.
+# Proof: GITEA_ACCESS_TOKEN comes back blocked only because secrets.sh itself carries a guarded
+# export (`[ -n "${BRIDGED_MEMBER:-}" ] || export GITEA_ACCESS_TOKEN=...`) — that guard, not this
+# file, is what wins. No other name in `known` below has a matching guard in secrets.sh yet (1
+# guard measured against 33 export lines there). So today this block's overlay is REAL protection
+# only for a name secrets.sh does not export, or a peer kind whose pane never runs a login shell —
+# for everything secrets.sh exports and guards, the guard in secrets.sh (out of scope for this
+# ticket) is what actually blocks it, not this list. An exec-time fix (winning after the login
+# shell finishes, before the agent process starts) was attempted and found to have no seam in the
+# current herdr protocol — AgentControl.start takes a fixed `kind` (herdr resolves the executable)
+# plus trailing CLI args for that binary, not an arbitrary argv or an env map; only tab.create /
+# pane.split accept `env`, and that is this same pane-creation overlay. See gitea #82 for the open
+# design question this leaves.
+#
+# DENY-BY-DEFAULT, NOT A DENY-LIST. A deny-list (name the bad ones, let everything else through) is
+# silently wrong the moment the operator's store gains a new secret — nothing would ever report it.
+# Deny-by-default inverts that: `known` bounds the blast radius to names actually enumerated below,
+# and EVERY one of them is blocked UNLESS it is also in `allow`. Omitting this block entirely (the
+# shipped default) blocks NOTHING — unlike most optional blocks in this file, absence here is a real
+# gap, not a safe "feature off". A name that is neither `known` nor `allow`-ed is not silently let
+# through either: the daemon logs a WARN naming any credential-shaped env var it finds on neither
+# list (never its value), so a secret added to the store later does not go unnoticed forever.
+#
+#   policy → "deny-by-default" (the default; also accepted spelled "deny-list") overlays each
+#            known-but-not-allowed name BEFORE the pane's login shell runs — real protection only
+#            where that shell does not re-export the name (see ROUND-2 CORRECTION above). An
+#            unrecognized value refuses to start, naming it.
+#   policy → "allow-list" (CB-633) moves the control to a per-spawn ZDOTDIR directory the daemon
+#            generates and passes through tab.create's env map. Each generated startup file sources
+#            its ~/ counterpart FIRST and then runs the scrub, so the scrub happens after the
+#            operator's whole chain and no sourced file can undo it.
+#            The scrub is sourced from BOTH the generated .zshrc and the generated .zlogin, because
+#            herdr does not open the same kind of shell everywhere: macOS panes run a LOGIN zsh (so
+#            .zlogin runs), Linux panes run a plain interactive zsh (so .zlogin never runs at all).
+#            A scrub in .zlogin alone would be a control that silently does nothing on Linux.
+#            The allow-list is DERIVED, never typed:
+#            every profile's tokenEnv/gitTokenEnv/gitHostEnv values and env-map keys, plus an
+#            infrastructure set (PATH HOME SHELL TERM LANG LC_* TMPDIR USER LOGNAME PWD SHLVL EDITOR
+#            PAGER JAVA_HOME XDG_* ZDOTDIR), plus whatever keys this spawn's own env overlay carries.
+#            Adding a profile can therefore only widen the list, never break another spawn's scrub.
+#            Under this policy `known`/`allow` below become REPORTING ONLY — they feed the gap WARN,
+#            they are no longer a control. If the member's login shell is NOT zsh, the daemon logs a
+#            loud WARN saying protection is off and falls back to deny-by-default's overlay.
+#            Each pane writes a scrub-report.txt naming how many variables it kept of how many it
+#            saw; the daemon logs that "allowed N of M" line when the pane stops. If the report is
+#            MISSING the daemon logs a WARN instead — the scrub cannot then be confirmed to have
+#            run, and a silently-dead control is exactly what this policy exists to prevent.
+#   allow  → credential names a member legitimately needs. Under deny-by-default, left OUT of the
+#            pane's env overlay entirely, so the value the pane's own (login) shell exports passes
+#            through untouched. Under allow-list: reporting only.
+#   known  → every credential name the operator's store is known to export. Under deny-by-default,
+#            every name here NOT also in `allow` is overlaid with a non-secret sentinel value before
+#            the pane's login shell runs — real protection only for names that shell does not itself
+#            re-export (see the ROUND-2 CORRECTION note above). Under allow-list: reporting only.
+#   sshAuthSock → whether SSH_AUTH_SOCK may pass through under allow-list ("allow") or must be
+#            blanked like any other non-derived name ("block", the default). This is a decision you
+#            have to make explicitly: SSH_AUTH_SOCK is a handle to YOUR ssh-agent, and a member
+#            holding it can sign with your keys — it sits in no secret file and looks like no
+#            credential, which is why it slipped past three earlier tickets (gitea #110). Blocking
+#            it breaks git over SSH inside members (push/fetch authenticate as you); use HTTPS
+#            remotes or scoped deploy keys instead of allowing it lightly.
+#
+# HOT-RELOADABLE the same way `fleet:` is (CB-559): read fresh on every spawn, so editing this list
+# and reloading config (or restarting) changes what the NEXT spawn inherits; already-running members
+# are unaffected either way.
+# memberCredentials:
+#   policy: deny-by-default        # or "deny-list", or "allow-list" (CB-633) — see above
+#   sshAuthSock: block             # allow-list only; see the sshAuthSock note above
+#   allow:
+#     - AI_GATEWAY_TOKEN     # named in a profile's tokenEnv (local/gx) — a member reaching the
+#                            # gateway is by design, not a leak
+#     - WORKER_GITEA_TOKEN   # the repo-scoped forge token a member needs to open its own PR (CB-302)
+#     - CONTEXT7_TOKEN       # already decided as allowed by CB-593
+#     - GITEA_HOST           # not a credential — a hostname, paired with the forge token above
+#   known:
+#     - AI_GATEWAY_TOKEN
+#     - BESZEL_ADMIN_EMAIL
+#     - BESZEL_ADMIN_PASSWORD
+#     - BESZEL_HUB_URL
+#     - BESZEL_KEY
+#     - BESZEL_UNIVERSAL_TOKEN
+#     - BRAIN_MCP_TOKEN
+#     - CF_ACCOUNT_ID
+#     - CF_API_TOKEN
+#     - CF_USER_TOKEN
+#     - CONFLUENCE_API_TOKEN
+#     - CONFLUENCE_USERNAME
+#     - CONTEXT7_TOKEN
+#     - GITEA_ACCESS_TOKEN
+#     - GITEA_HOST
+#     - GITLAB_OAUTH_CLIENT_SECRET
+#     - GITLAB_PERSONAL_ACCESS_TOKEN
+#     - GRAFANA_ADMIN_PASSWORD
+#     - GRAFANA_ADMIN_USER
+#     - HASS_TOKEN
+#     - HW_PASSWORD
+#     - HW_USER
+#     - LTMS_API_KEY
+#     - MEMORY_MCP_TOKEN
+#     - METRICS_PUSH_TOKEN
+#     - OPENCODE_AUTOMODE_MODEL
+#     - TELEGRAM_BOT_TOKEN
+#     - TELEGRAM_CHAT_ID
+#     - TS_API_KEY
+#     - TS_AUTHKEY
+#     - WORKER_GITEA_TOKEN
+
 # Spawn-readiness gate (CB-306). The launcher blocks until the worker's herdr status is
 # injectable (IDLE/BLOCKED/DONE) or the timeout elapses. 0 disables the gate.
 # NOTE: keys are camelCase — config is bound by plain Jackson with no naming strategy and
@@ -485,14 +657,36 @@ guard:
 # RabbitMQ speaks the same AMQP 0-9-1, so it is a URI-only swap.
 #   uri      → AMQP connection URI. No trailing slash ⇒ the default vhost "/"; an empty path ("/")
 #              is vhost "" and will NOT connect. Encode a named vhost as .../%2Fmyvhost.
+#   uriEnv   → CB-151: name of a host env var holding the AMQP URI, preferred over `uri` (wins
+#              whenever set). The URI carries `user:pass@` inline, so naming a variable keeps the
+#              password out of fleetd.yaml — same pattern as auth.tokenEnv/Profile.tokenEnv. A
+#              uriEnv that resolves to an unset or blank variable is treated as NOT configured and
+#              the daemon falls back to the in-memory inbox, warning loudly.
 #   prefetch → CB-527: consumer basicQos, capping how many unacked messages the inbox holds
 #              in-heap per owned target (the rest sits on the broker's durable queue instead of
 #              growing the JVM heap). Default 32 when omitted.
 # broker:
-#   uri: amqp://guest:guest@127.0.0.1:5672
+#   uriEnv: LAVINMQ_URI
 #   prefetch: 32
 
-# Active push-to-primary (CB-307 Stage 3). When a worker reply lands with no open bridge_send,
+# Shared cross-host LEADER coordination broker. OMIT this block to leave lead-to-lead messaging
+# off entirely (config-only in this ticket — nothing here wires it into a live LeadMailbox yet).
+# This is a SEPARATE AMQP vhost from `broker:` above: member/worker inboxes always stay on the
+# per-fleet `broker:` vhost, and this vhost carries only leader-to-leader traffic, so two fleets
+# whose members must never see each other can still share one coordination vhost for their leads.
+#   uriEnv   → name of a host env var holding the coordination AMQP URI, same convention as
+#              broker.uriEnv (keeps the credential out of fleetd.yaml). Wins over `uri` when set.
+#   selfId   → this daemon's own lead coord-id — the name its mailbox is owned under
+#              (lead.<selfId>.inbox), e.g. "mac-opus" or "fleet01-lead". Must be globally unique
+#              across every daemon sharing this vhost.
+#   prefetch → consumer basicQos, capping how many unacked messages the mailbox holds in-heap.
+#              Default 32 when omitted.
+# coordinator:
+#   uriEnv: LEAD_COORD_URI
+#   selfId: mac-opus
+#   prefetch: 32
+
+# Active push-to-primary (CB-307 Stage 3). When a worker reply lands with no open fleet_send,
 # the ReplyPushLoop injects a *drain nudge* (never the payload) into the primary's own herdr
 # pane — status-gated (only when injectable, never mid-turn) and bounded. Ack = drain: the loop
 # stops as soon as the primary's inbox is empty.
@@ -503,11 +697,11 @@ guard:
 #
 #                    REQUIRED (CB-522) if the primary itself runs inside a herdr pane. Caller
 #                    identity resolves a loopback PID to its herdr pane, and PaneLocator scans
-#                    EVERY pane — not just bridged-spawned ones — so such a primary is otherwise
+#                    EVERY pane — not just fleetd-spawned ones — so such a primary is otherwise
 #                    classified as a WORKER and refused SPAWN/SEND/STOP. That failure is
 #                    self-locking: the learned terminal is populated by the very orchestration
 #                    calls being refused, so only this pinned value can break the cycle. Read the
-#                    id off bridge_whoami (it reports the current terminal even while
+#                    id off fleet_whoami (it reports the current terminal even while
 #                    misclassified) and re-pin whenever the primary moves panes.
 #   pushReminders  → max nudges before giving up (default 5)
 #   pushBackoffMs  → delay between nudges in ms (default 15000)

fleetd/pom.xml

@@ -5,17 +5,17 @@
     <modelVersion>4.0.0</modelVersion>
 
     <groupId>dev.ltms</groupId>
-    <artifactId>bridged</artifactId>
+    <artifactId>fleetd</artifactId>
     <version>1.0.0</version>
     <packaging>jar</packaging>
 
-    <name>bridged</name>
-    <description>claude-bridge message server: sole gateway between primary/worker Claude sessions and herdr</description>
+    <name>fleetd</name>
+    <description>fleet message server: sole gateway between a lead session, its members, and herdr</description>
 
     <properties>
         <maven.compiler.release>25</maven.compiler.release>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <mainClass>dev.ltms.bridged.Bridged</mainClass>
+        <mainClass>dev.ltms.fleet.Fleetd</mainClass>
 
         <jackson.version>2.19.0</jackson.version>
         <javalin.version>6.7.0</javalin.version>
@@ -28,6 +28,7 @@
         <testcontainers.version>1.20.4</testcontainers.version>
         <commons-compress.version>1.27.1</commons-compress.version>
         <commons-lang3.version>3.18.0</commons-lang3.version>
+        <sqlite-jdbc.version>3.53.4.0</sqlite-jdbc.version>
     </properties>
 
     <!--
@@ -44,6 +45,12 @@
           3.0-rc5; bumping Jackson 3 to the patched 3.2.x breaks the SDK (annotation mismatch).
           Only the loopback /mcp endpoint parses this JSON, from trusted local Claude clients.
       The 11.0.23 -> 11.0.25 bump did clear jetty CVE-2024-8184 (5.9) and CVE-2024-6763.
+
+      fleetd #206: org.xerial:sqlite-jdbc 3.53.4.0 (added for OpenCodeSessionDiscovery) — the
+      only known advisory against this artifact is CVE-2023-32697 (RCE via an attacker-controlled
+      JDBC URL), fixed in 3.41.2.2; 3.53.4.0 is well past that fix and OSV.dev reports no open
+      advisory against it. Checked via the OSV.dev API (no Mend.io/JetBrains IDE MCP mount
+      available from this worktree) on 2026-08-31.
     -->
 
     <!-- Force the latest patched Jetty 11.x across all Javalin-pulled Jetty modules (no version
@@ -106,7 +113,7 @@
         </dependency>
 
         <!-- MCP server: the SERVER face. Streamable-HTTP servlet mounted on Javalin's Jetty at
-             /mcp, exposing bridge_send/bridge_reply/bridge_status as thin adapters over REST. -->
+             /mcp, exposing fleet_send/fleet_reply/fleet_status as thin adapters over REST. -->
         <dependency>
             <groupId>io.modelcontextprotocol.sdk</groupId>
             <artifactId>mcp</artifactId>
@@ -123,6 +130,17 @@
             <version>${amqp.version}</version>
         </dependency>
 
+        <!-- fleetd #206: opencode moved its session store from a JSON tree to SQLite
+             (opencode.db). This is the JDBC driver OpenCodeSessionDiscovery uses to read it
+             read-only. Ships bundled native libraries (linux/mac/windows, several archs), so it
+             is a heavier jar than most deps here — see the pom's dependency-security note below
+             for the size/CVE tradeoff actually measured. -->
+        <dependency>
+            <groupId>org.xerial</groupId>
+            <artifactId>sqlite-jdbc</artifactId>
+            <version>${sqlite-jdbc.version}</version>
+        </dependency>
+
         <!-- Logging -->
         <dependency>
             <groupId>org.slf4j</groupId>
@@ -161,7 +179,10 @@
     </dependencies>
 
     <build>
-        <finalName>bridged</finalName>
+        <!-- CB-634: the cutover renamed the module dir (bridged/ -> fleetd/), the jar, and the
+         launchd plist together. The installed plist names fleetd/target/fleetd.jar and
+         KeepAlive is armed, so this name, the plist, and the wrapper must move as one. -->
+        <finalName>fleetd</finalName>
         <plugins>
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
@@ -203,7 +224,7 @@
                 </configuration>
             </plugin>
 
-            <!-- Runnable fat jar: java -jar target/bridged.jar -->
+            <!-- Runnable fat jar: java -jar target/fleetd.jar -->
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-shade-plugin</artifactId>

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -1,99 +1,133 @@
-package dev.ltms.bridged;
+package dev.ltms.fleet;
 
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.config.ConfigRef;
-import dev.ltms.bridged.config.ConfigWatcher;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.HerdrClient;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.herdr.LeadTabScanner;
-import dev.ltms.bridged.lead.LeadLauncher;
-import dev.ltms.bridged.herdr.PaneLocator;
-import dev.ltms.bridged.herdr.UnixSocketHerdrClient;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.inject.CompletionResolver;
-import dev.ltms.bridged.inject.ExhaustedPatternLookup;
-import dev.ltms.bridged.inject.ExhaustionSink;
-import dev.ltms.bridged.inject.Injector;
-import dev.ltms.bridged.inject.StatusPoller;
-import dev.ltms.bridged.inject.TurnListener;
-import dev.ltms.bridged.inject.MemberPresence;
-import dev.ltms.bridged.auth.MemberRegistry;
-import dev.ltms.bridged.auth.CallerResolver;
-import dev.ltms.bridged.mcp.BridgeMcp;
-import dev.ltms.bridged.mcp.ConnectionIdentity;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.health.FleetHealthMonitor;
-import dev.ltms.bridged.mcp.PrimaryRegistry;
-import dev.ltms.bridged.mcp.LsofPeerPidLookup;
-import dev.ltms.bridged.mcp.LsofProcessCwdLookup;
-import dev.ltms.bridged.msg.AmqpReplyInbox;
-import dev.ltms.bridged.msg.InMemoryReplyInbox;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.msg.ReplyInbox;
-import dev.ltms.bridged.msg.LeadHeartbeatLoop;
-import dev.ltms.bridged.msg.ReplyPushLoop;
-import dev.ltms.bridged.rest.BridgedApp;
-import dev.ltms.bridged.session.GitWorktrees;
-import dev.ltms.bridged.session.MemberSession;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.peer.PeerLauncher;
-import dev.ltms.bridged.session.SessionReaper;
-import dev.ltms.bridged.member.ClaudeCodeLauncher;
-import dev.ltms.bridged.member.CompositePeerLauncher;
-import dev.ltms.bridged.member.HerdrPeerLauncher;
-import dev.ltms.bridged.member.OpenCodeLauncher;
-import dev.ltms.bridged.placement.BackendQuarantine;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.ConfigWatcher;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.HerdrRouter;
+import dev.ltms.fleet.herdr.LeadTabScanner;
+import dev.ltms.fleet.lead.LeadLauncher;
+import dev.ltms.fleet.herdr.PaneLocator;
+import dev.ltms.fleet.herdr.UnixSocketHerdrClient;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.CompletionResolver;
+import dev.ltms.fleet.inject.ExhaustedPatternLookup;
+import dev.ltms.fleet.inject.ExhaustionSink;
+import dev.ltms.fleet.inject.Injector;
+import dev.ltms.fleet.inject.StatusPoller;
+import dev.ltms.fleet.inject.TurnListener;
+import dev.ltms.fleet.inject.MemberPresence;
+import dev.ltms.fleet.auth.MemberRegistry;
+import dev.ltms.fleet.auth.CallerResolver;
+import dev.ltms.fleet.mcp.FleetMcp;
+import dev.ltms.fleet.mcp.ConnectionIdentity;
+import dev.ltms.fleet.metrics.FleetMetrics;
+import dev.ltms.fleet.metrics.Metrics;
+import dev.ltms.fleet.health.FleetHealthMonitor;
+import dev.ltms.fleet.mcp.PrimaryRegistry;
+import dev.ltms.fleet.mcp.LsofPeerPidLookup;
+import dev.ltms.fleet.mcp.LsofProcessCwdLookup;
+import dev.ltms.fleet.msg.AmqpReplyInbox;
+import dev.ltms.fleet.msg.InMemoryReplyInbox;
+import dev.ltms.fleet.msg.LeadChannel;
+import dev.ltms.fleet.msg.LeadCoordLoop;
+import dev.ltms.fleet.msg.LeadMailbox;
+import dev.ltms.fleet.msg.MessageService;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.msg.ReplyInbox;
+import dev.ltms.fleet.msg.LeadHeartbeatLoop;
+import dev.ltms.fleet.msg.ReplyPushLoop;
+import dev.ltms.fleet.rest.FleetApp;
+import dev.ltms.fleet.session.GitWorktrees;
+import dev.ltms.fleet.session.MemberSession;
+import dev.ltms.fleet.session.SessionManager;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.session.SessionReaper;
+import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import dev.ltms.fleet.member.CompositePeerLauncher;
+import dev.ltms.fleet.member.HerdrPeerLauncher;
+import dev.ltms.fleet.member.OpenCodeLauncher;
+import dev.ltms.fleet.placement.BackendQuarantine;
 import io.javalin.Javalin;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Objects;
 import java.util.Set;
 import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Function;
 import java.util.function.Predicate;
 import java.util.function.Supplier;
 import java.util.regex.Pattern;
-import java.util.stream.Collectors;
 
 /**
- * {@code bridged} entry point. Wires the real herdr socket client to the REST app and
+ * {@code fleetd} entry point. Wires the real herdr socket client to the REST app and
  * starts listening. Before anything else it asserts its own environment is clean —
- * {@code bridged} is not a Claude process and must never carry a base_url.
+ * {@code fleetd} is not a Claude process and must never carry a base_url.
  */
-public final class Bridged {
+public final class Fleetd {
 
-    private static final Logger log = LoggerFactory.getLogger(Bridged.class);
+    private static final Logger log = LoggerFactory.getLogger(Fleetd.class);
 
     /** CB-504: how long to wait at startup for herdr's socket before serving degraded. */
     private static final long HERDR_WAIT_SECONDS = 30;
+    /**
+     * CB-637: how often the lead coordination loop looks for peer messages. A few seconds — slow
+     * enough that an idle fleet is not polling a broker in a tight loop, fast enough that a peer
+     * lead's message is not left sitting once the local lead reaches a turn boundary. The mailbox
+     * pushes into the loop's held set on its own consumer thread, so this interval bounds only the
+     * pane delivery, never the receive.
+     */
+    private static final long LEAD_COORD_INTERVAL_MS = 3_000L;
     private static final long HERDR_WAIT_POLL_MILLIS = 500;
 
+    /**
+     * CB-632/CB-634: prefer {@code fleetd.yaml} in {@code dir}; fall back to the legacy
+     * {@code bridged.yaml} when the new name is not there. The product renamed to {@code fleetd},
+     * but a deployment whose local config file is still {@code bridged.yaml} keeps working until
+     * that file is renamed.
+     */
+    static Path chooseDefaultConfigFile(Path dir) {
+        Path fleetd = dir.resolve("fleetd.yaml");
+        if (Files.exists(fleetd)) {
+            return fleetd;
+        }
+        return dir.resolve("bridged.yaml");
+    }
+
     static void main(String[] args) {
-        Path configPath = Path.of(args.length > 0 ? args[0] : "bridged.yaml");
-        BridgedConfig cfg = BridgedConfig.load(configPath);
+        Path configPath = args.length > 0 ? Path.of(args[0]) : chooseDefaultConfigFile(Path.of(""));
+        // The config file was renamed bridged.yaml -> fleetd.yaml. Name the file we actually
+        // loaded, whichever of the two names it carries.
+        log.info("Using configuration file {}", configPath);
+        FleetConfig cfg = FleetConfig.load(configPath);
         // CB-594: report which secret env vars the config actually needs, by name, before anything
         // else can fail on a silently-empty one. A daemon started without a login shell (launchd)
         // boots fine either way — this is the only thing that says so out loud.
         reportRequiredSecrets(cfg);
+        // CB-596: an absent (or empty) memberCredentials: block blocks NOTHING — no credential
+        // name is hardcoded any more to fall back on. Say so loudly, the same way a missing
+        // secret is reported above, so upgrading past this commit never silently drops CB-592's
+        // protection.
+        reportMemberCredentialsGap(cfg);
         // CB-559: `cfg` stays the startup snapshot — every validation and every piece of one-time
         // wiring below reads it, and must, because those decisions cannot be unmade. `config` is the
         // live reference the hot paths read per use. Which keys can actually move is ConfigRef's
         // contract; adding a reader here does not make a key reloadable by itself.
         ConfigRef config = new ConfigRef(configPath, cfg);
 
-        // The primary/host env that launched bridged must not be tainted.
+        // The primary/host env that launched fleetd must not be tainted.
         SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
         guard.assertPrimaryClean(System.getenv());
 
@@ -116,14 +150,17 @@ public final class Bridged {
                 : UnixSocketHerdrClient.defaultSocketPath();
 
         UnixSocketHerdrClient herdr = UnixSocketHerdrClient.connect(socket, new com.fasterxml.jackson.databind.ObjectMapper());
-
-        AgentControl agents = new AgentControl(herdr);
-        WorkspaceControl spaces = new WorkspaceControl(herdr);
+        UnixSocketHerdrClient memberHerdr = cfg.memberHerdrSocket() != null && !cfg.memberHerdrSocket().isBlank()
+                ? UnixSocketHerdrClient.connect(Path.of(cfg.memberHerdrSocket()), new com.fasterxml.jackson.databind.ObjectMapper())
+                : herdr;
+        AtomicReference<Supplier<Map<String, String>>> leadsRef = new AtomicReference<>(Map::of);
+        HerdrRouter router = new HerdrRouter(herdr, memberHerdr,
+                target -> leadsRef.get().get().containsKey(target));
         // CB-402: one adapter per configured peer kind, fronted by a composite router. A profile's
         // `kind:` selects its adapter — claude-code (the default) and opencode partition the profile
         // set — and the composite dispatches each SPI call to the adapter that owns the profile/pane.
-        Map<String, BridgedConfig.Profile> claudeProfiles = new LinkedHashMap<>();
-        Map<String, BridgedConfig.Profile> opencodeProfiles = new LinkedHashMap<>();
+        Map<String, FleetConfig.Profile> claudeProfiles = new LinkedHashMap<>();
+        Map<String, FleetConfig.Profile> opencodeProfiles = new LinkedHashMap<>();
         cfg.profiles().forEach((name, w) -> {
             if (w.isOpenCode()) {
                 opencodeProfiles.put(name, w);
@@ -136,21 +173,23 @@ public final class Bridged {
         // bridge configured with no workers, or opencode-only, still has a well-defined base adapter)
         // unless opencode is the only kind configured.
         if (!claudeProfiles.isEmpty() || opencodeProfiles.isEmpty()) {
-            adapters.add(new ClaudeCodeLauncher(agents, spaces, guard,
+            adapters.add(new ClaudeCodeLauncher(router.memberAgents(), router.memberSpaces(), guard,
                     claudeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
                     cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
-                    () -> config.get().fleet()));
+                    () -> config.get().fleet(),
+                    () -> config.get().memberCredentials(), null, config::get));
         }
         if (!opencodeProfiles.isEmpty()) {
-            adapters.add(new OpenCodeLauncher(agents, spaces,
+            adapters.add(new OpenCodeLauncher(router.memberAgents(), router.memberSpaces(),
                     opencodeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
                     cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
-                    () -> config.get().fleet()));
+                    () -> config.get().fleet(),
+                    () -> config.get().memberCredentials(), config::get));
         }
         AtomicReference<Function<String, Integer>> liveCountRef = new AtomicReference<>(_ -> 0);
         // CB-578 stage B: one quarantine tracker for the whole daemon, shared between the launcher
         // (checked at spawn) and the exhaustion sink wired in below (written on BACKEND_EXHAUSTED).
-        // The cooldown is deferred (see BridgedConfig#quarantineCooldownSeconds): it is read once
+        // The cooldown is deferred (see FleetConfig#quarantineCooldownSeconds): it is read once
         // here, at startup, and a config reload only changes it for a daemon restart.
         BackendQuarantine quarantine = new BackendQuarantine(System::nanoTime,
                 TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()));
@@ -160,7 +199,7 @@ public final class Bridged {
                 config,
                 profileName -> liveCountRef.get().apply(profileName),
                 quarantine);
-        // CB-504: under supervision (launchd/systemd) bridged can start before herdr's socket
+        // CB-504: under supervision (launchd/systemd) fleetd can start before herdr's socket
         // exists. The client itself is lazy — it connects per call — but the orphan reap below is
         // the first thing that actually talks to herdr, so without this wait a boot-order race
         // would crash the daemon into a restart loop. Wait, then degrade rather than die: serving
@@ -219,34 +258,39 @@ public final class Bridged {
         final Supplier<Map<String, String>> leads;
         var leaders = cfg.fleet().leaders();
         if (!leaders.isEmpty()) {
-            Set<String> memberSpaces = cfg.profiles().values().stream()
-                    .map(BridgedConfig.Profile::workspace)
-                    .filter(Objects::nonNull)
-                    .collect(Collectors.toSet());
             Map<String, String> tabToName = new LinkedHashMap<>();
             leaders.forEach((name, leader) -> {
                 if (leader != null && leader.tab() != null && !leader.tab().isBlank()) {
                     tabToName.put(leader.tab(), name);
                 }
             });
+            // The lead and the members now share ONE workspace (the operator asked for a single
+            // "session" with many tabs), so no workspace can be excluded — the lead lives in the
+            // members' space by design. A lead is told from a member by its exact tab label alone:
+            // a lead carries its configured `tab`, a member its `worker: {profile} #{n}` template,
+            // and the two never collide. (The scanner still supports an exclusion set for a split
+            // layout; the fleet's policy here is simply not to use one.)
+            //
             // One shared rescan cadence: still taken from the first entry, as before — it is an
             // operational cadence, not identity, so there is no correctness reason to give every
             // lead its own scanner.
             int scanIntervalSeconds = leaders.values().iterator().next().scanIntervalSeconds();
-            leads = new LeadTabScanner(herdr, tabToName, memberSpaces,
+            // This must use the lead daemon: scanning member tabs would demote the lead to a worker.
+            leads = new LeadTabScanner(herdr, tabToName, Set.of(),
                     TimeUnit.SECONDS.toNanos(scanIntervalSeconds), System::nanoTime);
-            log.info("lead scan: tabs {} host a lead (rescan every {}s, member spaces {} excluded)",
-                    tabToName.keySet(), scanIntervalSeconds, memberSpaces);
+            log.info("lead scan: tabs {} host a lead (rescan every {}s, shared fleet space)",
+                    tabToName.keySet(), scanIntervalSeconds);
         } else {
             leads = () -> leadTerminals;
         }
+        leadsRef.set(leads);
 
         // CB-558: start any declared lead that is not already running. After the scanner is built,
         // because both read the same tab labels and the ordering makes that dependency visible; and
         // only when herdr answered, because the launcher's whole safety property is that it can
         // count live leads first — it must never guess and risk a second orchestrator.
         if (herdrUp && !leaders.isEmpty()) {
-            int launched = new LeadLauncher(agents, spaces, cfg).ensureLeads();
+            int launched = new LeadLauncher(router.leadAgents(), router.leadSpaces(), cfg).ensureLeads();
             if (launched > 0) {
                 log.info("lead auto-launch: {} lead(s) started", launched);
             }
@@ -302,6 +346,7 @@ public final class Bridged {
                                     + "BACKEND_EXHAUSTED): {}", credentialId,
                             cfg.quarantineCooldownSeconds(), profile.profile(), reason);
                 });
+        AgentControl agents = router.memberAgents();
         CompletionResolver completion = new CompletionResolver(agents, rendezvous, exhaustedPatterns, exhaustionSink);
         // CB-113: deliver only to an available worker (its MCP is connected), never its boot window.
         // CB-301: the manager's presence bridge records availability and drives SPAWNING → READY.
@@ -325,7 +370,7 @@ public final class Bridged {
             }
 
             @Override
-            public void onDelivered(String target, dev.ltms.bridged.msg.TurnToken token) {
+            public void onDelivered(String target, dev.ltms.fleet.msg.TurnToken token) {
                 completion.onDelivered(target, token);
                 sessions.onDelivered(target, token);
             }
@@ -342,23 +387,22 @@ public final class Bridged {
                 sessions.onTurnFailed(target);
             }
         };
-        Injector injector = new Injector(agents, turnListener, deliverableTo(presence, leads),
+        Predicate<String> deliverable = deliverableTo(presence, leads);
+        Injector injector = new Injector(router, turnListener, deliverable,
                 presence::forget);
-        StatusPoller poller = new StatusPoller(agents, injector, Injector.POLL_INTERVAL_MILLIS);
+        StatusPoller poller = new StatusPoller(router, injector, Injector.POLL_INTERVAL_MILLIS);
         poller.start();
 
-        // CB-307: reply inbox. A broker: block (with a uri) selects the AMQP-backed durable adapter;
-        // absent, bridged stays soft-state on the in-memory inbox. The AMQP inbox owns a broker
+        // CB-307: reply inbox. A broker: block selects the AMQP-backed durable adapter; absent (or
+        // unusable), fleetd stays soft-state on the in-memory inbox. The AMQP inbox owns a broker
         // connection, so keep the reference to close it in the ordered shutdown hook.
-        final ReplyInbox replyInbox;
-        if (cfg.broker() != null && cfg.broker().isConfigured()) {
-            replyInbox = AmqpReplyInbox.open(cfg.broker().uri(), cfg.broker().prefetchOrDefault());
-            log.info("reply inbox: AMQP broker (durable) at {} (prefetch={})",
-                    cfg.broker().uri(), cfg.broker().prefetchOrDefault());
-        } else {
-            replyInbox = new InMemoryReplyInbox();
-            log.info("reply inbox: in-memory (soft-state)");
-        }
+        final ReplyInbox replyInbox = selectReplyInbox(cfg.broker(), System.getenv(), AmqpReplyInbox::open);
+        // CB-637: this daemon's lead-to-lead mailbox on the SHARED coordination vhost — a separate
+        // broker from the reply inbox by design (see FleetConfig.Coordinator). Absent a coordinator:
+        // block this is null and every lead path below is simply not wired, which is exactly the
+        // behaviour before this ticket. It owns a broker connection, so keep the reference for the
+        // ordered shutdown hook.
+        final LeadMailbox leadMailbox = openLeadMailbox(cfg.coordinator(), System.getenv(), LeadMailbox::open);
         // CB-307: learn the primary's terminal from orchestration tool calls (or pin from config).
         // The pin also feeds CallerResolver below: a primary running inside a herdr pane would
         // otherwise resolve as a worker and be refused every orchestration tool.
@@ -374,7 +418,7 @@ public final class Bridged {
                     + "has lost the delegation map. Its pushReminders/pushBackoffMs stay valid.");
         }
         // CB-307: active push-to-primary loop — nudge the primary when replies land without an
-        // open bridge_send. Uses its own lightweight scheduled executor, separate from the injector.
+        // open fleet_send. Uses its own lightweight scheduled executor, separate from the injector.
         int maxReminders = cfg.primary() != null ? cfg.primary().remindersOrDefault() : 5;
         long backoffMs = cfg.primary() != null ? cfg.primary().backoffMsOrDefault() : 15_000L;
         var pushScheduler = Executors.newSingleThreadScheduledExecutor(r ->
@@ -382,8 +426,8 @@ public final class Bridged {
         // CB-502: the registry is built before the service and the push loop so send/reply outcomes
         // are counted at their single funnel rather than at each of the two caller-facing surfaces.
         // CB-512: the push loop takes it too, so nudge outcomes (delivered|exhausted) are counted.
-        Metrics metrics = BridgedMetrics.create(sessions, replyInbox);
-        var pushLoop = new ReplyPushLoop(primaryRegistry, agents, replyInbox,
+        Metrics metrics = FleetMetrics.create(sessions, replyInbox);
+        var pushLoop = new ReplyPushLoop(primaryRegistry, router.leadAgents(), replyInbox,
                 pushScheduler, maxReminders, backoffMs, metrics);
         // CB-551: idle-lead heartbeat. Opt-in; absent `leadHeartbeat:` this is never constructed, so
         // an upgraded daemon cannot silently start spending subscription on nudging an idle lead.
@@ -393,7 +437,7 @@ public final class Bridged {
                 Thread.ofVirtual().name("bridge-heartbeat-").unstarted(r));
         if (cfg.leadHeartbeat() != null) {
             var hb = cfg.leadHeartbeat();
-            heartbeat = new LeadHeartbeatLoop(primaryRegistry, agents, replyInbox, sessions::roster,
+            heartbeat = new LeadHeartbeatLoop(primaryRegistry, router.leadAgents(), replyInbox, sessions::roster,
                     pushLoop, heartbeatScheduler, System::nanoTime,
                     TimeUnit.SECONDS.toNanos(hb.idleAfterSeconds()), hb.backoffMs(), hb.quietNudgeCap(),
                     metrics);
@@ -402,7 +446,7 @@ public final class Bridged {
             heartbeat = null;
             heartbeatScheduler.shutdownNow();
         }
-        MessageService messages = new MessageService(agents, injector, rendezvous, replyInbox,
+        MessageService messages = new MessageService(router, injector, rendezvous, replyInbox,
                 pushLoop, metrics);
 
         // Health is a slow whole-fleet observer. Keep it separate from the 250ms delivery poller.
@@ -413,7 +457,8 @@ public final class Bridged {
             // CB-580: a member found GONE/NEVER_READY must fail whatever ticket is waiting on it,
             // through the same idempotent target-wide operation CB-516 already uses on release.
             healthMonitor = new FleetHealthMonitor(agents, sessions::roster, messages, healthScheduler,
-                    System::nanoTime, cfg.health().intervalOrDefault(), messages::abandon);
+                    System::nanoTime, cfg.health().intervalOrDefault(),
+                    cfg.health().workingSuspectAfterOrDefault(), messages::abandon);
             String coverage = FleetHealthMonitor.coverage(true,
                     cfg.health().notifications() != null && cfg.health().notifications().configured());
             if ("detection-only".equals(coverage)) {
@@ -451,10 +496,13 @@ public final class Bridged {
             primaryRegistry.forgetDelegation(detail.terminalId()); // CB-532: don't leak the lead binding
         });
 
-        // MCP server face (CB-105): bridge_send/bridge_reply/bridge_status, mounted at /mcp.
+        // MCP server face (CB-105): fleet_send/fleet_reply/fleet_status, mounted at /mcp.
         // Caller identity is resolved from the connection (peer PID → herdr pane), not arguments.
+        // CB-185: a caller's pane can live on either daemon (a lead's on the lead daemon, a
+        // member's on the member daemon) — search both, lead first. Collapses to one scan when
+        // memberHerdrSocket is unset (herdr == memberHerdr).
         ConnectionIdentity identity = new ConnectionIdentity(
-                new PaneLocator(herdr), new LsofPeerPidLookup(), new LsofProcessCwdLookup());
+                new PaneLocator(herdr, memberHerdr), new LsofPeerPidLookup(), new LsofProcessCwdLookup());
 
         // CB-501: one resolver behind both entry paths. Worker identity still comes from the
         // connection and is never token-gated, so enabling token mode cannot lock the fleet out.
@@ -463,7 +511,7 @@ public final class Bridged {
             String token = System.getenv(cfg.auth().tokenEnv());
             if (token == null || token.isBlank()) {
                 throw new IllegalStateException("auth.mode=token but env var " + cfg.auth().tokenEnv()
-                        + " is unset or empty — export it before starting bridged");
+                        + " is unset or empty — export it before starting fleetd");
             }
             callers = CallerResolver.withLeadsAndMembers(identity, true, token, leads, members);
             log.info("auth: token mode (bearer required for non-worker callers, env {})",
@@ -473,21 +521,41 @@ public final class Bridged {
             log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
         }
 
-        BridgeMcp mcp = new BridgeMcp(messages, workers, sessions, identity, presence,
-                primaryRegistry, callers, metrics, new BridgeMcp.CapacitySource(profile -> liveCountRef.get().apply(profile),
+        FleetMcp mcp = new FleetMcp(messages, workers, sessions, identity, presence,
+                primaryRegistry, callers, metrics, new FleetMcp.CapacitySource(profile -> liveCountRef.get().apply(profile),
                 profile -> {
                     var configured = config.get().profiles().get(profile);
                     return configured == null ? null : configured.maxLoad();
                 }, () -> config.get().profiles().keySet(), System::nanoTime),
-                new BridgeMcp.HealthCoverageSource(() -> {
+                new FleetMcp.HealthCoverageSource(() -> {
                     var health = config.get().health();
                     return FleetHealthMonitor.coverage(health != null && health.isEnabled(),
                             health != null && health.notifications() != null && health.notifications().configured());
                 }),
-                new BridgeMcp.QuarantineSource(profile -> {
+                new FleetMcp.QuarantineSource(profile -> {
                     var configured = config.get().profiles().get(profile);
                     return configured == null ? null : configured.effectiveCredentialId();
-                }, quarantine));
+                }, quarantine),
+                leadMailbox);
+
+        // CB-637: the receive half. Only constructed when a lead mailbox actually opened — with no
+        // coordinator (or an unreachable one) there is nothing to deliver, so no scheduler is
+        // created and no thread runs. It reads the SAME live lead supplier the injector's
+        // deliverability gate does, so a lead found by the tab scan after startup is reachable
+        // without a restart.
+        final LeadCoordLoop leadCoordLoop;
+        final ScheduledExecutorService leadCoordSchedulerRef;
+        if (leadMailbox != null) {
+            var leadCoordScheduler = Executors.newSingleThreadScheduledExecutor(r ->
+                    Thread.ofVirtual().name("bridge-leadcoord-").unstarted(r));
+            leadCoordLoop = new LeadCoordLoop(leadMailbox, router.leadAgents(), leads, leadCoordScheduler,
+                    LEAD_COORD_INTERVAL_MS);
+            leadCoordLoop.start();
+            leadCoordSchedulerRef = leadCoordScheduler;
+        } else {
+            leadCoordLoop = null;
+            leadCoordSchedulerRef = null;
+        }
 
         // CB-559: opt-in config reload. With no `configReload:` block nothing is constructed, so an
         // upgraded daemon behaves exactly as before — the file is read once at boot and never again.
@@ -508,6 +576,8 @@ public final class Bridged {
             messages.close();
             pushLoop.close();
             if (heartbeat != null) heartbeat.close(); // CB-551: stop the idle-lead heartbeat scheduler
+            if (leadCoordLoop != null) leadCoordLoop.close(); // CB-637: stop delivering peer-lead messages
+            if (leadCoordSchedulerRef != null) leadCoordSchedulerRef.shutdownNow();
             if (healthMonitor != null) healthMonitor.stop();
             if (configWatcher != null) configWatcher.stop(); // CB-559: stop polling the config file
             mcp.close();
@@ -520,13 +590,24 @@ public final class Bridged {
                     log.debug("reply inbox close: {}", e.toString());
                 }
             }
-            herdr.close();
+            // CB-637: the coordination connection goes with it — after the loop that reads it has
+            // stopped, so no tick can be mid-ack against a closed channel.
+            if (leadMailbox != null) {
+                try {
+                    leadMailbox.close();
+                } catch (Exception e) {
+                    log.debug("lead mailbox close: {}", e.toString());
+                }
+            }
+            router.close();
         }));
 
-        Javalin app = new BridgedApp(herdr, workers, sessions, messages, presence, mcp.servlet(),
-                callers, metrics).build();
+        // CB-185: give FleetApp both daemons — /healthz must require both to answer and
+        // GET /sessions must merge across both, or a down/unpolled member daemon is invisible.
+        Javalin app = new FleetApp(herdr, memberHerdr, workers, sessions, messages, presence, mcp.servlet(),
+                callers, metrics, deliverable).build();
         app.start(cfg.bind().host(), cfg.bind().port());
-        log.info("bridged listening on {}:{}, herdr socket {}",
+        log.info("fleetd listening on {}:{}, herdr socket {}",
                 cfg.bind().host(), cfg.bind().port(), socket);
     }
 
@@ -539,7 +620,7 @@ public final class Bridged {
      * hazard is a property of spawning. A lead is never spawned: the operator started it and named it
      * (or labelled its tab) only once it was up, so there is no boot window to guard.
      *
-     * <p>A lead is also never enrolled in {@link MemberPresence} — {@code BridgeMcp} marks presence
+     * <p>A lead is also never enrolled in {@link MemberPresence} — {@code FleetMcp} marks presence
      * for every spawned member (worker and architect), deliberately, since that map doubles as the
      * member roster's availability signal and a lead counted there would show up as an available
      * member. So without the second disjunct a lead is permanently un-deliverable: every
@@ -553,22 +634,169 @@ public final class Bridged {
         return target -> presence.isPresent(target) || leads.get().containsKey(target);
     }
 
+    /** Injection seam for {@link #selectReplyInbox}: production binds {@link AmqpReplyInbox#open}. */
+    @FunctionalInterface
+    interface AmqpOpener {
+        ReplyInbox open(String uri, int prefetch);
+    }
+
+    /** Injection seam for {@link #openLeadMailbox}: production binds {@link LeadMailbox#open}. */
+    @FunctionalInterface
+    interface LeadMailboxOpener {
+        LeadMailbox open(String uri, String selfCoordId, int prefetch);
+    }
+
+    /**
+     * CB-637: open this daemon's lead-to-lead mailbox, or return {@code null} to leave the feature
+     * off. Package-private and env-injected for the same reason as {@link #selectReplyInbox}: the
+     * selection is then testable without a broker or a mutable process environment.
+     *
+     * <p>Every "off" path returns {@code null}, and each says why at the level it deserves:
+     *
+     * <ul>
+     *   <li>no {@code coordinator:} block — silent. Lead coordination is opt-in; an operator who
+     *       never configured it does not need to be told it is off on every boot.</li>
+     *   <li>a block whose {@code uriEnv} does not resolve — INFO, the same "you moved to the secret
+     *       store and the variable is not there" case {@code selectReplyInbox} warns about.</li>
+     *   <li>a configured broker but no {@code selfId} — WARN. This one is a half-finished config: a
+     *       mailbox is named after the coord-id that owns it, so with no id there is no queue to own
+     *       and no {@code from} to send as. Loud, because the operator plainly intended the feature.</li>
+     *   <li>the broker refuses at boot — WARN, and carry on. Mirrors {@code openAmqpOrFallback}: a
+     *       coordination broker that is down must never take a whole fleet's daemon with it, and the
+     *       fleet still works exactly as it did before this feature existed.</li>
+     * </ul>
+     */
+    static LeadMailbox openLeadMailbox(FleetConfig.Coordinator coordinator, Map<String, String> env,
+                                       LeadMailboxOpener opener) {
+        if (coordinator == null) {
+            return null;                       // opt-in: nothing configured, nothing to say
+        }
+        String uri = coordinator.effectiveUri(env);
+        if (uri == null) {
+            log.info("lead coordination: OFF — coordinator{} has no usable broker uri",
+                    coordinator.uriEnv() == null ? "" : ".uriEnv=" + coordinator.uriEnv());
+            return null;
+        }
+        if (coordinator.selfId() == null || coordinator.selfId().isBlank()) {
+            log.warn("coordinator.selfId is unset — lead coordination is OFF. A lead mailbox is the "
+                    + "queue named after the coord-id that owns it, so with no id there is nothing to "
+                    + "own and no sender identity to publish as. Set coordinator.selfId to a name that "
+                    + "is unique across every daemon sharing {} and restart fleetd.",
+                    stripCredentials(uri));
+            return null;
+        }
+        try {
+            LeadMailbox mailbox = opener.open(uri, coordinator.selfId(), coordinator.prefetchOrDefault());
+            log.info("lead coordination: ON as coord-id {} (prefetch={})",
+                    coordinator.selfId(), coordinator.prefetchOrDefault());
+            return mailbox;
+        } catch (IllegalStateException e) {
+            log.warn("cannot reach the AMQP coordination broker ({}) — lead-to-lead messaging is OFF "
+                            + "for this process lifetime. fleet_send{{coordId}} will report it as "
+                            + "not configured, and peer messages already queued stay on the broker until "
+                            + "a restart picks them up. Reason: {}",
+                    stripCredentials(uri), reasonOf(e));
+            return null;
+        }
+    }
+
+    /**
+     * CB-151/152: pick the reply inbox. A usable broker — a literal {@code uri}, or a {@code
+     * uriEnv} whose variable resolves (both read from {@code env}) — selects the durable AMQP inbox.
+     * Everything else falls back to the in-memory inbox: no broker block, a blank {@code uri}, a
+     * {@code uriEnv} whose variable is unset or blank, or a broker unreachable at boot. The two
+     * lossy paths warn <em>loudly</em> — never silently — because what is lost is durable,
+     * cross-restart reply delivery. Package-private and env-injected so the selection is testable
+     * without a real broker or a mutable process environment.
+     */
+    static ReplyInbox selectReplyInbox(FleetConfig.Broker broker, Map<String, String> env, AmqpOpener amqp) {
+        if (broker == null) {
+            log.info("reply inbox: in-memory (soft-state)");
+            return new InMemoryReplyInbox();
+        }
+        if (broker.hasUriEnv()) {
+            // uriEnv is authoritative whenever set (CB-151): the operator moved off clear text, so
+            // it must not quietly fall back onto a stale literal uri.
+            if (broker.uri() != null && !broker.uri().isBlank()) {
+                log.info("broker.uri is ignored because broker.uriEnv={} is set", broker.uriEnv());
+            }
+            String effectiveUri = broker.effectiveUri(env);
+            if (effectiveUri == null) {
+                log.warn("broker.uriEnv={} is unset or blank — durable AMQP reply inbox DISABLED. "
+                                + "Replies are soft-state and will not survive a restart. Set {} in the "
+                                + "daemon's environment (see scripts/redeploy-fleetd.sh) and restart to "
+                                + "use the durable broker inbox.",
+                        broker.uriEnv(), broker.uriEnv());
+                log.info("reply inbox: in-memory (soft-state)");
+                return new InMemoryReplyInbox();
+            }
+            log.info("reply inbox: AMQP broker (durable) via env var {} (prefetch={})",
+                    broker.uriEnv(), broker.prefetchOrDefault());
+            return openAmqpOrFallback(effectiveUri, broker.prefetchOrDefault(), "uriEnv " + broker.uriEnv(), amqp);
+        }
+        // No uriEnv: the literal uri path (existing behaviour).
+        if (broker.effectiveUri(env) == null) {
+            log.info("reply inbox: in-memory (soft-state)");
+            return new InMemoryReplyInbox();
+        }
+        log.info("reply inbox: AMQP broker (durable) (prefetch={})", broker.prefetchOrDefault());
+        return openAmqpOrFallback(broker.uri(), broker.prefetchOrDefault(), "uri", amqp);
+    }
+
+    /**
+     * Open the AMQP inbox, falling back to the in-memory inbox for this process lifetime if the
+     * broker cannot be reached at boot (CB-152). Not silent: the warning says durable delivery is
+     * off, replies are soft-state and will not survive a restart, plus the source that failed and
+     * the URI <em>with credentials stripped</em>. Never retries in the background — a broker that
+     * drops <em>after</em> startup already self-heals via the connection factory's automatic
+     * recovery; only the boot path is changed here.
+     */
+    private static ReplyInbox openAmqpOrFallback(String effectiveUri, int prefetch, String source,
+                                                 AmqpOpener amqp) {
+        try {
+            return amqp.open(effectiveUri, prefetch);
+        } catch (IllegalStateException e) {
+            log.warn("cannot reach AMQP broker ({}, {}) — falling back to the in-memory reply inbox "
+                            + "for this process lifetime. Durable, cross-restart reply delivery is OFF; "
+                            + "replies are soft-state and will not survive a restart. Reason: {}",
+                    source, stripCredentials(effectiveUri), reasonOf(e));
+            log.info("reply inbox: in-memory (soft-state)");
+            return new InMemoryReplyInbox();
+        }
+    }
+
+    /** An AMQP URI carries {@code user:pass@} inline — show the host/port, never the credentials. */
+    static String stripCredentials(String uri) {
+        return uri == null ? null : uri.replaceAll("://[^@/]*@", "://");
+    }
+
+    /** The deepest cause's class and message — the outermost {@code IllegalStateException} echoes the URI (with password). */
+    private static String reasonOf(Throwable e) {
+        Throwable t = e;
+        while (t.getCause() != null && t.getCause() != t) {
+            t = t.getCause();
+        }
+        String msg = t.getMessage();
+        return t.getClass().getSimpleName() + (msg == null || msg.isBlank() ? "" : ": " + msg);
+    }
+
     /**
      * CB-594: which env vars the loaded config actually needs, and why — every non-{@code
      * subscription} profile's {@code tokenEnv} (a subscription profile never reads one, see
-     * {@link BridgedConfig.Profile#isSubscription()}), plus every profile's {@code gitTokenEnv}
-     * where set (opt-in). Derived from the config, not hard-coded, so a new profile is covered for
-     * free. A var required by more than one profile is one entry naming every profile that needs
-     * it. Deliberately excludes {@code auth.tokenEnv}: that one is already enforced loudly, by a
-     * startup throw in {@code main()} — about 370 lines <em>below</em> this method's call site
-     * ({@link #reportRequiredSecrets(BridgedConfig)}), not a few lines above it. That throw only
+     * {@link FleetConfig.Profile#isSubscription()}), plus every profile's {@code gitTokenEnv}
+     * where set (opt-in), plus a configured {@code broker.uriEnv} (CB-151). Derived from the
+     * config, not hard-coded, so a new profile is covered for free. A var required by more than one
+     * profile is one entry naming every profile that needs it. Deliberately excludes {@code
+     * auth.tokenEnv}: that one is already enforced loudly, by a startup throw in {@code main()} —
+     * about 370 lines <em>below</em> this method's call site
+     * ({@link #reportRequiredSecrets(FleetConfig)}), not a few lines above it. That throw only
      * fires when {@code auth.mode: token} is configured; under the default loopback-trust mode it
      * never runs, and {@code auth.tokenEnv} is simply not required.
      *
      * <p>Package-private and pure (no I/O, no logging) so the derivation is unit-testable without
-     * capturing log output; {@link #reportRequiredSecrets(BridgedConfig)} is the logging caller.
+     * capturing log output; {@link #reportRequiredSecrets(FleetConfig)} is the logging caller.
      */
-    static Map<String, List<String>> requiredSecretEnvVars(BridgedConfig cfg) {
+    static Map<String, List<String>> requiredSecretEnvVars(FleetConfig cfg) {
         Map<String, List<String>> requiredBy = new LinkedHashMap<>();
         cfg.profiles().forEach((name, profile) -> {
             if (!profile.isSubscription()) {
@@ -580,6 +808,11 @@ public final class Bridged {
                         .add("profile '" + name + "' gitTokenEnv");
             }
         });
+        FleetConfig.Broker broker = cfg.broker();
+        if (broker != null && broker.hasUriEnv()) {
+            requiredBy.computeIfAbsent(broker.uriEnv(), _ -> new ArrayList<>())
+                    .add("broker uriEnv");
+        }
         return requiredBy;
     }
 
@@ -592,7 +825,7 @@ public final class Bridged {
      * <p>A missing entry only warns — it must never refuse to start. A daemon that boots and says
      * what is wrong is strictly more useful than one that will not boot at all.
      */
-    private static void reportRequiredSecrets(BridgedConfig cfg) {
+    private static void reportRequiredSecrets(FleetConfig cfg) {
         Map<String, List<String>> requiredBy = requiredSecretEnvVars(cfg);
         if (requiredBy.isEmpty()) {
             log.info("startup secrets: no profile references a token env var — nothing to check");
@@ -606,13 +839,42 @@ public final class Bridged {
             } else {
                 log.warn("startup secret {}: MISSING ({}) — the daemon will start anyway, and this "
                                 + "failure stays invisible until a worker actually needs it. Fix "
-                                + "${SHARED_ENV}/tools/secrets.sh and restart bridged from a LOGIN "
-                                + "shell (see scripts/redeploy-bridged.sh).",
+                                + "${SHARED_ENV}/tools/secrets.sh and restart fleetd from a LOGIN "
+                                + "shell (see scripts/redeploy-fleetd.sh).",
                         varName, String.join(", ", sources));
             }
         });
     }
 
+    /**
+     * CB-596: {@code known:} empty (block absent entirely, or present but empty) means {@link
+     * FleetConfig.MemberCredentials#blockedSet()} is empty too — every member pane inherits the
+     * operator's whole secret store, unblocked, exactly the defect this ticket fixes. Unlike a
+     * missing token ({@link #reportRequiredSecrets}), there is no name to point at: the point is
+     * that the block itself is missing. Warn once at startup and say what to add; never refuse to
+     * start over it — see {@link #reportRequiredSecrets} for why a daemon that boots and says
+     * what is wrong beats one that will not boot at all.
+     *
+     * <p>Package-private so the test can capture the log directly, the same way {@link
+     * #requiredSecretEnvVars} is exposed for {@link #reportRequiredSecrets}'s own test.
+     */
+    static void reportMemberCredentialsGap(FleetConfig cfg) {
+        FleetConfig.MemberCredentials creds = cfg.memberCredentials();
+        if (creds != null && !creds.known().isEmpty()) {
+            log.info("memberCredentials: policy={}, {} known name(s), {} allowed — blocking {} on "
+                            + "every spawn{}",
+                    creds.policy(), creds.known().size(), creds.allow().size(), creds.blockedSet().size(),
+                    creds.isAllowList()
+                            ? " (allow-list: known/allow are reporting only — the control is the derived ZDOTDIR scrub)"
+                            : "");
+            return;
+        }
+        log.warn("memberCredentials: absent or empty — the daemon will start anyway, and every "
+                + "member pane inherits the operator's WHOLE secret store, unblocked (CB-592's "
+                + "protection is lost). Add a memberCredentials: block (policy/allow/known) to "
+                + "fleetd.yaml — see fleetd.example.yaml — and restart.");
+    }
+
     /**
      * Poll herdr's {@code ping} until it answers or {@link #HERDR_WAIT_SECONDS} elapses (CB-504).
      *
@@ -646,6 +908,6 @@ public final class Bridged {
         }
     }
 
-    private Bridged() {
+    private Fleetd() {
     }
 }

fleetd/src/main/java/dev/ltms/fleet/auth/AuditLog.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

fleetd/src/main/java/dev/ltms/fleet/auth/Authz.java

@@ -1,9 +1,9 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;
 
 /**
  * The authorization table (CB-505), stated once and enforced on both entry paths.
  *
- * <p>Most of these rules are already true de facto — {@code BridgeMcp} derives a worker's identity
+ * <p>Most of these rules are already true de facto — {@code FleetMcp} derives a worker's identity
  * from the connection rather than reading it from an argument, so a worker has never been able to
  * reply <em>as</em> another worker over MCP. What was missing is that the REST surface trusted the
  * session id in the URL path, and neither surface checked role at all. This class makes the

fleetd/src/main/java/dev/ltms/fleet/auth/CallerResolver.java

@@ -1,7 +1,7 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;
 
-import dev.ltms.bridged.mcp.ConnectionIdentity;
-import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.fleet.mcp.ConnectionIdentity;
+import dev.ltms.fleet.peer.MemberRole;
 
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
@@ -12,7 +12,7 @@ import java.util.function.Supplier;
 /**
  * Resolves every caller to a {@link Principal}, for both entry paths into the core (CB-501).
  *
- * <p>There are two of them and they are not layered the way the docs suggest: {@code BridgeMcp}
+ * <p>There are two of them and they are not layered the way the docs suggest: {@code FleetMcp}
  * calls the service layer directly and is mounted as a raw servlet (so it never passes through a
  * Javalin filter), while the REST routes historically resolved no identity at all. Both now
  * delegate here, so the authorization rules are stated once instead of drifting apart.
@@ -59,7 +59,7 @@ public final class CallerResolver {
      * <p>Like {@link #leadTerminals}, a supplier rather than a fixed map, so a binding injected
      * after startup — when the later spawn lifecycle establishes a live architect session, or an
      * operator pins one — takes effect without a restart. Consulted per resolve; today's wiring
-     * in {@code Bridged} reads a constant from config, which is the degenerate live case.
+     * in {@code Fleetd} reads a constant from config, which is the degenerate live case.
      */
     private final Supplier<Map<String, String>> architectTerminals;
     private final Function<String, MemberRole> memberSlotRoles;
@@ -235,7 +235,7 @@ public final class CallerResolver {
 
         // loopback-trust: same-host callers that are not workers are the primary. A non-loopback
         // caller is anonymous even here — and startup refuses that combination anyway
-        // (BridgedConfig.validateAuthExposure), so this is defence in depth, not the control.
+        // (FleetConfig.validateAuthExposure), so this is defence in depth, not the control.
         return isLoopback(remoteAddr) ? Principal.primary(c.pid()) : Principal.anonymous();
     }
 

fleetd/src/main/java/dev/ltms/fleet/auth/MemberLifecycle.java

@@ -1,6 +1,6 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;
 
-import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.fleet.peer.MemberRole;
 
 /** Optional session lifecycle hook for live member-slot bindings. */
 public interface MemberLifecycle {

fleetd/src/main/java/dev/ltms/fleet/auth/MemberRegistry.java

@@ -1,7 +1,7 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;
 
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.peer.MemberRole;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -59,7 +59,7 @@ public final class MemberRegistry implements MemberLifecycle {
     private final Map<String, String> terminalToSlot = new HashMap<>();
 
     /** Flatten every role pool in {@code fleet} into one registry. Leaders are not members. */
-    public MemberRegistry(BridgedConfig.Fleet fleet) {
+    public MemberRegistry(FleetConfig.Fleet fleet) {
         Map<String, Entry> flat = new LinkedHashMap<>();
         if (fleet != null) {
             for (MemberRole role : MemberRole.values()) {
@@ -94,7 +94,7 @@ public final class MemberRegistry implements MemberLifecycle {
      * An immutable copy of the live {@code terminal_id → slot name} bindings.
      *
      * <p>Passed to {@link CallerResolver} as the source of architect identity, and what
-     * {@code bridge_whoami}/the roster will read to say which slot a pane hosts. Empty until the
+     * {@code fleet_whoami}/the roster will read to say which slot a pane hosts. Empty until the
      * spawn lifecycle binds a slot.
      */
     public Map<String, String> snapshot() {

fleetd/src/main/java/dev/ltms/fleet/auth/Principal.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;
 
 /**
  * A resolved caller: its {@link Role}, and — for a worker — the herdr {@code terminal_id} that
@@ -39,14 +39,14 @@ public record Principal(Role role, String terminal, long pid, String name) {
      *
      * <p>Carries {@link Role#PRIMARY}: a lead <em>is</em> a primary as far as authorization goes,
      * so every existing {@code isPrimary()} gate keeps working unchanged and the role table needed
-     * no new entry. The name is reporting only — it lets {@code bridge_whoami} say <em>which</em>
+     * no new entry. The name is reporting only — it lets {@code fleet_whoami} say <em>which</em>
      * lead is asking once more than one is configured.
      *
      * <p><strong>CB-532: a lead now carries the terminal it was matched by.</strong> Under CB-530 it
      * deliberately did not, because {@code terminal} meant "which worker pane" everywhere and a
      * non-null one would have enrolled the lead in the worker presence map. That reading was what
      * made a lead unaddressable: {@link #ownsSession} could never be true for it, so
-     * {@code bridge_reply} was refused and one lead could send to another but never be answered.
+     * {@code fleet_reply} was refused and one lead could send to another but never be answered.
      * The terminal now means "which pane is this caller", the presence map keys on
      * {@link #isSpawnedMember()} instead, and a lead is a peer that can both send and receive.
      */
@@ -63,7 +63,7 @@ public record Principal(Role role, String terminal, long pid, String name) {
      * An architect (CB-548), identified by the slot it occupies and the pane bound to it.
      *
      * <p>Carries {@link Role#ARCHITECT}. {@code slotName} is reporting only — it lets
-     * {@code bridge_whoami} say <em>which</em> architect slot is asking, and it is the key the
+     * {@code fleet_whoami} say <em>which</em> architect slot is asking, and it is the key the
      * (future) spawn lifecycle reads a profile back from. Identity is the {@code terminal}: like a
      * worker's it comes from the connection and the live terminal→slot binding, so
      * {@code ownsSession} works exactly as it does for a worker — an architect acts as its own

fleetd/src/main/java/dev/ltms/fleet/auth/Role.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.auth;
+package dev.ltms.fleet.auth;
 
 /**
  * What a caller is allowed to be on the bus (CB-501).

fleetd/src/main/java/dev/ltms/fleet/config/ConfigRef.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.config;
+package dev.ltms.fleet.config;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -16,7 +16,7 @@ import java.util.function.Supplier;
 /**
  * The daemon's live configuration, re-readable without a restart (CB-559).
  *
- * <p>Consumers hold this, not a {@link BridgedConfig}, and read through {@link #get()} at the point
+ * <p>Consumers hold this, not a {@link FleetConfig}, and read through {@link #get()} at the point
  * of use. A component that captures {@code ref.get()} into a field at construction has opted out of
  * reload — which is sometimes right (see <em>deferred</em> below), but it must then be a deliberate
  * choice rather than an accident of where the field was initialised.
@@ -31,7 +31,7 @@ import java.util.function.Supplier;
  *       {@code placement:}, and an existing profile's {@code weight} / {@code maxLoad}. Those
  *       three are read through a supplier on {@code CompositePeerLauncher}, which is what makes
  *       them hot — not the fact that they are config. <strong>This does NOT include
- *       {@code fleet.leaders}</strong>: {@code Bridged.main} reads {@code cfg.fleet().leaders()}
+ *       {@code fleet.leaders}</strong>: {@code Fleetd.main} reads {@code cfg.fleet().leaders()}
  *       once at startup to build the {@code LeadTabScanner} and the {@code LeadLauncher}, and
  *       neither is reconstructed on reload — so a lead added, removed, or re-{@code tab}'d under
  *       {@code fleet.leaders} needs a restart, the same as any deferred key below.</li>
@@ -42,7 +42,7 @@ import java.util.function.Supplier;
  *       {@code guard:}, {@code worktreeRoot:}, adding or removing a profile (a new backend needs its own launcher,
  *       which is constructed once), <em>and an existing profile's launch settings</em> —
  *       {@code model}, {@code baseUrl}, {@code argv}, {@code env}, {@code mcpUrl},
- *       {@code exhaustedPattern} (CB-578 stage A — compiled once into {@code Bridged.main}'s
+ *       {@code exhaustedPattern} (CB-578 stage A — compiled once into {@code Fleetd.main}'s
  *       pattern map at startup), and the rest. {@code credentialId} (CB-578 stage B) is NOT on
  *       this list — it is read live off the config supplier at every quarantine check and
  *       exhaustion event, exactly like {@code weight} / {@code maxLoad}, so it is hot instead.
@@ -65,30 +65,30 @@ import java.util.function.Supplier;
  * running. A config file being edited is normally read once mid-save; degrading a working daemon
  * because it caught a half-written file would be a bad trade.
  */
-public final class ConfigRef implements Supplier<BridgedConfig> {
+public final class ConfigRef implements Supplier<FleetConfig> {
 
     private static final Logger log = LoggerFactory.getLogger(ConfigRef.class);
 
     /** Keys that cannot change under a running daemon — see the class doc. */
     private static final Set<String> COLD_KEYS =
-            Set.of("bind", "herdrSocket", "broker", "auth");
+             Set.of("bind", "herdrSocket", "memberHerdrSocket", "broker", "auth");
 
     private final Path path;
-    private final AtomicReference<BridgedConfig> current;
+    private final AtomicReference<FleetConfig> current;
 
-    public ConfigRef(Path path, BridgedConfig initial) {
+    public ConfigRef(Path path, FleetConfig initial) {
         this.path = path;
         this.current = new AtomicReference<>(Objects.requireNonNull(initial, "initial config"));
     }
 
     /** A fixed reference that never reloads — for tests and for wiring built from a config in code. */
-    public static ConfigRef fixed(BridgedConfig cfg) {
+    public static ConfigRef fixed(FleetConfig cfg) {
         return new ConfigRef(null, cfg);
     }
 
     /** The live configuration. Read this per use; do not cache it in a field. */
     @Override
-    public BridgedConfig get() {
+    public FleetConfig get() {
         return current.get();
     }
 
@@ -128,7 +128,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
             }
             if (!applied) {
                 return "config reload refused — these keys cannot change under a running daemon: "
-                        + String.join(", ", coldKeys) + ". Restart bridged to apply them.";
+                        + String.join(", ", coldKeys) + ". Restart fleetd to apply them.";
             }
             if (!deferred.isEmpty()) {
                 return "config reloaded; these changes need a restart to take effect: "
@@ -149,10 +149,10 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
         if (path == null) {
             return Outcome.failed("this config was built in code and has no file to reload from");
         }
-        BridgedConfig old = current.get();
-        BridgedConfig fresh;
+        FleetConfig old = current.get();
+        FleetConfig fresh;
         try {
-            fresh = BridgedConfig.load(path);
+            fresh = FleetConfig.load(path);
             // The same gate startup runs. A config that would have refused to boot must not be able
             // to slip in through a reload — that is how a daemon ends up in a state it could never
             // have started in, which is the hardest kind to debug.
@@ -182,7 +182,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
     }
 
     /** Cold keys whose value differs between the running config and the candidate. */
-    private static List<String> changedColdKeys(BridgedConfig old, BridgedConfig fresh) {
+    private static List<String> changedColdKeys(FleetConfig old, FleetConfig fresh) {
         List<String> changed = new ArrayList<>();
         if (!Objects.equals(old.bind(), fresh.bind())) {
             changed.add("bind");
@@ -190,6 +190,9 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
         if (!Objects.equals(old.herdrSocket(), fresh.herdrSocket())) {
             changed.add("herdrSocket");
         }
+        if (!Objects.equals(old.memberHerdrSocket(), fresh.memberHerdrSocket())) {
+            changed.add("memberHerdrSocket");
+        }
         if (!Objects.equals(old.broker(), fresh.broker())) {
             changed.add("broker");
         }
@@ -202,7 +205,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
     }
 
     /** Changed keys that were accepted but whose effect waits for a restart. */
-    private static List<String> changedDeferredKeys(BridgedConfig old, BridgedConfig fresh) {
+    private static List<String> changedDeferredKeys(FleetConfig old, FleetConfig fresh) {
         List<String> changed = new ArrayList<>();
         if (!Objects.equals(old.lifecycle(), fresh.lifecycle())) {
             changed.add("lifecycle");
@@ -226,9 +229,9 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
         if (!Objects.equals(old.quarantineCooldownSeconds(), fresh.quarantineCooldownSeconds())) {
             changed.add("quarantineCooldownSeconds");
         }
-        Map<String, BridgedConfig.Profile> before =
+        Map<String, FleetConfig.Profile> before =
                 old.profiles() == null ? Map.of() : old.profiles();
-        Map<String, BridgedConfig.Profile> after =
+        Map<String, FleetConfig.Profile> after =
                 fresh.profiles() == null ? Map.of() : fresh.profiles();
         // Adding or removing a profile is deferred: a new backend needs its own launcher, and
         // launchers are built once at startup.
@@ -247,7 +250,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
         // a reload can produce, because the operator has no reason to doubt it.
         List<String> relaunch = new ArrayList<>();
         before.forEach((name, was) -> {
-            BridgedConfig.Profile now = after.get(name);
+            FleetConfig.Profile now = after.get(name);
             if (now != null && !sameLaunchSettings(was, now)) {
                 relaunch.add(name);
             }
@@ -266,7 +269,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
      * {@code CompositePeerLauncher}/the CB-578 stage B exhaustion sink) and really do take effect on
      * the next spawn.
      */
-    private static boolean sameLaunchSettings(BridgedConfig.Profile a, BridgedConfig.Profile b) {
+    private static boolean sameLaunchSettings(FleetConfig.Profile a, FleetConfig.Profile b) {
         return Objects.equals(a.baseUrl(), b.baseUrl())
                 && Objects.equals(a.model(), b.model())
                 && Objects.equals(a.configDir(), b.configDir())
@@ -276,6 +279,9 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
                 && Objects.equals(a.workspace(), b.workspace())
                 && Objects.equals(a.tabLabel(), b.tabLabel())
                 && Objects.equals(a.mcpUrl(), b.mcpUrl())
+                // CB-634: the IDE MCP mount is a launch flag, fixed at spawn like mcpUrl — a
+                // reload changes it only for members spawned after, so a changed value is deferred.
+                && Objects.equals(a.ideMcpUrl(), b.ideMcpUrl())
                 && Objects.equals(a.cwd(), b.cwd())
                 && Objects.equals(a.parityOverlay(), b.parityOverlay())
                 && Objects.equals(a.gitTokenEnv(), b.gitTokenEnv())
@@ -283,7 +289,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
                 && Objects.equals(a.kind(), b.kind())
                 && Objects.equals(a.env(), b.env())
                 && Objects.equals(a.subscription(), b.subscription())
-                // CB-578 stage B: exhaustedPattern is compiled once into Bridged.main's pattern map
+                // CB-578 stage B: exhaustedPattern is compiled once into Fleetd.main's pattern map
                 // at startup (see ExhaustedPatternLookup wiring) — a reload never re-reads it, so a
                 // changed pattern must be reported as deferred, exactly like model/baseUrl/argv.
                 && Objects.equals(a.exhaustedPattern(), b.exhaustedPattern());

fleetd/src/main/java/dev/ltms/fleet/config/ConfigWatcher.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.config;
+package dev.ltms.fleet.config;
 
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -11,7 +11,7 @@ import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 
 /**
- * Polls {@code bridged.yaml}'s modified time and asks {@link ConfigRef} to reload when it moves
+ * Polls {@code fleetd.yaml}'s modified time and asks {@link ConfigRef} to reload when it moves
  * (CB-559). Opt-in through {@code configReload.enabled}.
  *
  * <p><strong>Why polling and not a filesystem watch.</strong> {@code WatchService} on macOS has no

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -1,12 +1,14 @@
-package dev.ltms.bridged.config;
+package dev.ltms.fleet.config;
 
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.core.JsonParser;
 import com.fasterxml.jackson.core.JsonToken;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
-import dev.ltms.bridged.msg.AmqpReplyInbox;
-import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.fleet.msg.AmqpReplyInbox;
+import dev.ltms.fleet.msg.LeadMailbox;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.placement.PlacementPolicies;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -24,13 +26,14 @@ import java.util.Map;
 import java.util.Set;
 
 /**
- * {@code bridged} configuration, loaded from a YAML file (see
- * {@code bridged.example.yaml}). Unknown keys are ignored so config can grow ahead
+ * {@code fleetd} configuration, loaded from a YAML file (see
+ * {@code fleetd.example.yaml}). Unknown keys are ignored so config can grow ahead
  * of the code — but an unknown <em>top-level</em> key is logged as a WARN at load (CB-530), because
  * silently dropping a whole block is indistinguishable from honouring it.
  *
  * @param bind          REST/MCP listen host:port
- * @param herdrSocket   path to herdr's Unix socket ({@code null} → client default)
+ * @param herdrSocket   path to the lead herdr Unix socket ({@code null} → client default)
+ * @param memberHerdrSocket optional member herdr Unix socket ({@code null}/blank → lead socket)
  * @param profiles      named backend profiles, keyed by profile name (multi-backend fleet). A
  *                      profile answers <em>which backend</em> — model, CLI adapter, credentials,
  *                      cost. It says nothing about what the member spawned on it is for; that is
@@ -65,11 +68,20 @@ import java.util.Set;
  *                      {@code BackendQuarantine} built at startup, so it is DEFERRED: changing it
  *                      needs a restart, and a quarantine already running keeps whatever cooldown was
  *                      live when it started.
+ * @param memberCredentials deny-by-default policy (CB-596) for which of the operator's own host
+ *                      credentials a spawned member's pane inherits. {@code null} (the block
+ *                      omitted) blocks nothing — see {@link MemberCredentials}.
+ * @param coordinator   shared cross-host leader coordination broker: a SEPARATE AMQP vhost from
+ *                      {@link #broker} used only for lead-to-lead traffic (member/worker inboxes
+ *                      stay on {@code broker}'s vhost). {@code null} → no lead mailbox is opened.
+ *                      Config parsing + accessors only — nothing here wires it into a live
+ *                      {@code LeadMailbox}; that is a separate ticket. See {@link Coordinator}.
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
-public record BridgedConfig(
+public record FleetConfig(
         Bind bind,
         String herdrSocket,
+        String memberHerdrSocket,
         Map<String, Profile> profiles,
         Guard guard,
         String worktreeRoot,
@@ -84,38 +96,63 @@ public record BridgedConfig(
         String placement,
         Auth auth,
         ConfigReload configReload,
-        Integer quarantineCooldownSeconds) {
+        Integer quarantineCooldownSeconds,
+        MemberCredentials memberCredentials,
+        Coordinator coordinator) {
+
+    /** Back-compat form before the {@code coordinator:} block was added. */
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+                         String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
+                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
+                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
+                         ConfigReload configReload, Integer quarantineCooldownSeconds,
+                         MemberCredentials memberCredentials) {
+        this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
+                configReload, quarantineCooldownSeconds, memberCredentials, null);
+    }
+
+    /** Back-compat form before the CB-596 {@code memberCredentials:} block was added. */
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+                         String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
+                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
+                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
+                         ConfigReload configReload, Integer quarantineCooldownSeconds) {
+        this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
+                configReload, quarantineCooldownSeconds, null, null);
+    }
 
     /** Default cooldown (CB-578 stage B) when {@code quarantineCooldownSeconds} is absent/non-positive. */
     public static final int DEFAULT_QUARANTINE_COOLDOWN_SECONDS = 1800;
 
     /** Back-compat 14-arg form — no {@code configReload:} block, so file watching stays off. */
-    public BridgedConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
                          String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                          Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                          LeadHeartbeat leadHeartbeat, String placement, Auth auth) {
-        this(bind, herdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
-                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, null, placement, auth, null, null);
+        this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, null, placement, auth, null, null, null, null);
     }
 
     /** Back-compat form before the optional {@code health:} block was added. */
-    public BridgedConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
                          String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                          Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                          LeadHeartbeat leadHeartbeat, String placement, Auth auth, ConfigReload configReload) {
-        this(bind, herdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
-                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, null, placement, auth, configReload, null);
+        this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, null, placement, auth, configReload, null, null, null);
     }
 
     /** Back-compat form before the CB-578 stage B {@code quarantineCooldownSeconds} field was added. */
-    public BridgedConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
+    public FleetConfig(Bind bind, String herdrSocket, Map<String, Profile> profiles, Guard guard,
                          String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
                          Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
                          LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
                          ConfigReload configReload) {
-        this(bind, herdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+        this(bind, herdrSocket, null, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
                 spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
-                configReload, null);
+                configReload, null, null, null);
     }
 
     /**
@@ -131,7 +168,7 @@ public record BridgedConfig(
      * {@code WeightedRoundRobinPolicy}), so losing it makes equal-weight placement
      * non-reproducible across restarts. Unmodifiable-wrap instead of copy-and-scramble.
      */
-    public BridgedConfig {
+    public FleetConfig {
         if (profiles != null && !profiles.isEmpty()) {
             Map<String, Profile> normalized = new LinkedHashMap<>();
             profiles.forEach((name, p) -> normalized.put(name,
@@ -161,14 +198,14 @@ public record BridgedConfig(
      * @param argv      launch command; defaults to {@code ["claude"]}
      * @param placement where a worker lands: {@code "tab"} (default — its own tab in the
      *                  worker space) or {@code "pane"} (legacy — split the focused tab)
-     * @param workspace label of the dedicated worker space; found-or-created on first
-     *                  spawn (default {@code "bridged-workers"}). A future per-session
-     *                  layout is just a distinct label here — the shared space is default.
+     * @param workspace label of the shared fleet space; found-or-created on first spawn
+     *                  (default {@code "fleet"}). The lead and every member share this one
+     *                  space so the operator sees a single "session" with many tabs.
      * @param tabLabel  template for a worker tab's label; {@code {profile}}/{@code {model}}
      *                  and {@code {n}} (per-worker number, to keep sibling tabs distinct)
      *                  are substituted (default {@code "worker: {profile} #{n}"})
      * @param mcpUrl         bridge MCP URL to provision into the worker's {@code configDir} so it
-     *                       can call {@code bridge_reply} ({@code null}/blank → no provisioning; the
+     *                       can call {@code fleet_reply} ({@code null}/blank → no provisioning; the
      *                       worker won't reply, only the fallback/timeout resolves the send)
      * @param cwd            fixed working directory for this profile's workers (CB-112 "told otherwise");
      *                       {@code null}/blank → inherit the primary's cwd, else the daemon's
@@ -183,7 +220,7 @@ public record BridgedConfig(
      *                       worktrees then accumulate with no error anywhere.
      *                       <p>Checked on 2026-08-15 (CB-581): inert as configured. Tracked overlay
      *                       files carry {@code --skip-worktree} so {@code --porcelain} cannot see them,
-     *                       {@code bridged.yaml} is gitignored, and the default pair {@code .env} /
+     *                       {@code fleetd.yaml} is gitignored, and the default pair {@code .env} /
      *                       {@code .envrc} does not exist in this repo. Note the default applies to
      *                       <em>every</em> profile, so creating either file at the repo root is enough
      *                       to make it live. Add a new overlay path to {@code .gitignore} in the same
@@ -208,7 +245,7 @@ public record BridgedConfig(
      *                       auto-select this profile": it is excluded from every automatic policy's
      *                       pool the same way a quarantined candidate is (see
      *                       {@code PlacementPolicyUtil}). This does not make the profile
-     *                       unreachable — an explicit {@code bridge_spawn{profile:"..."}} bypasses
+     *                       unreachable — an explicit {@code fleet_spawn{profile:"..."}} bypasses
      *                       placement entirely and still resolves it. Weights among the remaining
      *                       (non-excluded) candidates need not sum to 1.0; only their ratios matter.
      * @param maxLoad         max live workers allowed on this profile at one time. Absent
@@ -218,7 +255,7 @@ public record BridgedConfig(
      *                       the same way a {@code weight <= 0} profile is (see
      *                       {@code PlacementPolicyUtil.available()}, which already treats "at cap"
      *                       and "excluded" alike), and an explicit
-     *                       {@code bridge_spawn{profile:"..."}} against it is refused too (see
+     *                       {@code fleet_spawn{profile:"..."}} against it is refused too (see
      *                       {@code CompositePeerLauncher.enforceMaxLoad}) — a cap is a capacity
      *                       statement that does not stop being true just because the profile was
      *                       named directly. A negative value has no sane meaning (there is no
@@ -226,7 +263,7 @@ public record BridgedConfig(
      *                       instead, naming the profile and the key. Live means any session the
      *                       registry still owns (acquired and not yet released), in any state.
      * @param kind           which peer launcher spawns this profile: {@code "claude-code"} (default —
-     *                       the {@link dev.ltms.bridged.member.ClaudeCodeLauncher}) or {@code "opencode"}.
+     *                       the {@link dev.ltms.fleet.member.ClaudeCodeLauncher}) or {@code "opencode"}.
      *                       The {@code CompositePeerLauncher} routes {@code spawn}/reap by this value, so
      *                       each adapter drives only its own kind. Normalised to lower-case; blank ⇒ the
      *                       default. It selects the adapter, not the transport — placement, tabs, cwd, and
@@ -243,7 +280,7 @@ public record BridgedConfig(
      *                       {@code ANTHROPIC_BASE_URL} or {@code ANTHROPIC_AUTH_TOKEN} is refused at
      *                       config load (CB-542): on the subscription path no guard would vet it.
      * @param exhaustedPattern  regex matched against a completion-fallback scrape (CB-578 stage A) to
-     *                       classify a turn that ended with no {@code bridge_reply} as the backend
+     *                       classify a turn that ended with no {@code fleet_reply} as the backend
      *                       having refused on a subscription usage limit, rather than a real answer.
      *                       {@code null}/blank ⇒ the classification never fires for this profile and
      *                       today's completion-fallback behaviour is unchanged. Every backend words
@@ -259,6 +296,19 @@ public record BridgedConfig(
      *                       profile that does not opt in. Read live off the current config, so it is
      *                       HOT: a change takes effect on the next exhaustion classification / spawn,
      *                       no restart needed.
+     * @param autoCompactWindow  opt-in per-profile token window that forces a spawned member to
+     *                       auto-compact its context at (Claude Code) or within (opencode) a bound the
+     *                       operator chooses, instead of the backend's own default. {@code null} (the
+     *                       default) leaves today's behaviour exactly — opencode already forces
+     *                       {@code compaction.auto: true} unconditionally (CB-523) but has no absolute
+     *                       window, and Claude Code has neither. When set, validated at config load to
+     *                       {@code [100000, 1000000]} — the band Claude Code's own {@code --autocompact
+     *                       <tokens>} flag accepts. The two backends honour it differently: Claude Code
+     *                       compacts AT this window (a launch-time {@code --autocompact} flag);
+     *                       opencode has no such knob, so this is applied as the model's
+     *                       {@code limit.context} instead, which bounds the window opencode compacts
+     *                       <em>within</em>, and only when {@code model} resolves to a
+     *                       {@code provider/model} pair.
      */
     @JsonIgnoreProperties(ignoreUnknown = true)
     public record Profile(String profile, String baseUrl, String model,
@@ -273,9 +323,13 @@ public record BridgedConfig(
                          Integer maxLoad,
                          Boolean subscription,
                          String exhaustedPattern,
-                         String credentialId) {
+                         String credentialId,
+                         String ideMcpUrl,
+                         String ideProjectDir,
+                         String ideOpenCommand,
+                         Integer autoCompactWindow) {
 
-        /** Peer kind spawned by {@link dev.ltms.bridged.member.ClaudeCodeLauncher} (the default). */
+        /** Peer kind spawned by {@link dev.ltms.fleet.member.ClaudeCodeLauncher} (the default). */
         public static final String KIND_CLAUDE_CODE = "claude-code";
         /** Peer kind spawned by the opencode adapter (CB-402). */
         public static final String KIND_OPENCODE = "opencode";
@@ -289,9 +343,9 @@ public record BridgedConfig(
                     ? (KIND_CLAUDE_CODE.equals(k) ? List.of("claude") : List.of(k))
                     : List.copyOf(argv);
             kind = k;
-            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? "BRIDGED_WORKER_TOKEN" : tokenEnv;
+            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? "FLEETD_WORKER_TOKEN" : tokenEnv;
             placement = (placement == null || placement.isBlank()) ? "tab" : placement.toLowerCase();
-            workspace = (workspace == null || workspace.isBlank()) ? "bridged-workers" : workspace;
+            workspace = (workspace == null || workspace.isBlank()) ? "fleet" : workspace;
             // CB-557: no per-profile default any more. A label is generated from the member's ROLE
             // ("dev: sonnet #2"), which a profile cannot know, so the template lives on `fleet:` and
             // this field is only an override for a profile that wants its own. Blank ⇒ defer.
@@ -332,6 +386,21 @@ public record BridgedConfig(
             // "quarantines alone" fallback actually lives, so today's behaviour needs no defaulting
             // here at all.
             credentialId = (credentialId == null || credentialId.isBlank()) ? null : credentialId;
+            // CB-634: opt-in per profile, default off. A URL, not a boolean — host and port are
+            // host-specific, mirroring mcpUrl. When set, the member gets the IDE Index MCP mounted
+            // (pinned to its own worktree via the charter). Blank ⇒ off.
+            ideMcpUrl = (ideMcpUrl == null || ideMcpUrl.isBlank()) ? null : ideMcpUrl;
+            // CB-634 auto-open: both are only read when hasIdeMcp(). ideProjectDir is the repo-relative
+            // module dir IntelliJ must open (this repo's pom lives in `fleetd/`, not at the root), and
+            // it is also the project_path the overlay pins. Blank ⇒ the worktree root (unchanged before
+            // auto-open). ideOpenCommand is the host command that opens that dir in the IDE, with {dir}
+            // substituted; blank ⇒ no auto-open (the operator opens the module by hand).
+            ideProjectDir = (ideProjectDir == null || ideProjectDir.isBlank()) ? null : ideProjectDir;
+            ideOpenCommand = (ideOpenCommand == null || ideOpenCommand.isBlank()) ? null : ideOpenCommand;
+            // Opt-in per profile, default off (null). No clamping here — unlike ideMcpUrl/ideProjectDir
+            // there is no blank-string form to normalize (it's an Integer), and the [100000, 1000000]
+            // range is enforced eagerly at config load (rejectAutoCompactWindowOutOfRange), naming the
+            // profile, rather than silently clamped here. A profile that never sets it keeps null.
         }
 
         /**
@@ -376,7 +445,47 @@ public record BridgedConfig(
         public Profile withProfile(String p) {
             return new Profile(p, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
                     mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad, subscription,
-                    exhaustedPattern, credentialId);
+                    exhaustedPattern, credentialId, ideMcpUrl, ideProjectDir, ideOpenCommand, autoCompactWindow);
+        }
+
+        /**
+         * Backward-compatible constructor without the {@code autoCompactWindow} field — the profile
+         * leaves auto-compaction at the backend's own default (opencode's unconditional
+         * {@code compaction.auto: true}, or Claude Code's built-in threshold), exactly as before this
+         * key existed. This is the shape the canonical constructor had before the field was added —
+         * every pre-existing Java call site (and any YAML that omits the key) keeps compiling and
+         * behaving identically; Jackson binds the canonical (longest) constructor, so YAML omitting
+         * {@code autoCompactWindow:} still lands here as {@code null} via that path, not this one.
+         */
+        public Profile(String profile, String baseUrl, String model,
+                      String configDir, String tokenEnv, List<String> argv,
+                      String placement, String workspace, String tabLabel, String mcpUrl,
+                      String cwd, List<String> parityOverlay, String gitTokenEnv, String gitHostEnv,
+                      String kind, Map<String, String> env, Float weight, Integer maxLoad,
+                      Boolean subscription, String exhaustedPattern, String credentialId,
+                      String ideMcpUrl, String ideProjectDir, String ideOpenCommand) {
+            this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
+                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad,
+                    subscription, exhaustedPattern, credentialId, ideMcpUrl, ideProjectDir, ideOpenCommand,
+                    null);
+        }
+
+        /**
+         * Backward-compatible constructor without the CB-634 auto-open fields
+         * ({@code ideProjectDir}/{@code ideOpenCommand}) — a profile that opts into IDE MCP still
+         * pins the worktree root and does not auto-open. Keeps pre-auto-open call sites (and any YAML
+         * that omits the keys) compiling and behaving identically. This is the shape the canonical
+         * constructor had before the two fields were added.
+         */
+        public Profile(String profile, String baseUrl, String model,
+                      String configDir, String tokenEnv, List<String> argv,
+                      String placement, String workspace, String tabLabel, String mcpUrl,
+                      String cwd, List<String> parityOverlay, String gitTokenEnv, String gitHostEnv,
+                      String kind, Map<String, String> env, Float weight, Integer maxLoad,
+                      Boolean subscription, String exhaustedPattern, String credentialId, String ideMcpUrl) {
+            this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
+                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad,
+                    subscription, exhaustedPattern, credentialId, ideMcpUrl, null, null);
         }
 
         /** True when this profile is served by the Claude Code adapter (the default kind). */
@@ -425,7 +534,7 @@ public record BridgedConfig(
                       Boolean subscription, String exhaustedPattern) {
             this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
                     mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad,
-                    subscription, exhaustedPattern, null);
+                    subscription, exhaustedPattern, null, null);
         }
 
         /** True when this profile's CB-578 stage A backend-exhausted classification is configured. */
@@ -456,7 +565,7 @@ public record BridgedConfig(
          * {@code ANTHROPIC_AUTH_TOKEN} is injected from {@code tokenEnv}. An {@code env:} entry for
          * either is a bypass vector — it is what the subscription path would otherwise let survive
          * unguarded — so it is rejected at config load (see
-         * {@link BridgedConfig#validateSubscriptionProfiles()}).
+         * {@link FleetConfig#validateSubscriptionProfiles()}).
          */
         public boolean envCarriesAnthropicBinding() {
             return env != null
@@ -473,6 +582,19 @@ public record BridgedConfig(
             return mcpUrl != null && !mcpUrl.isBlank();
         }
 
+        /**
+         * True when the IDE Index MCP should be mounted into a spawned worker (CB-634), pinned to
+         * the worker's own worktree via the charter. Opt-in per profile, default off.
+         */
+        public boolean hasIdeMcp() {
+            return ideMcpUrl != null && !ideMcpUrl.isBlank();
+        }
+
+        /** True when this profile mounts any MCP server into its member — the bridge, the IDE, or both. */
+        public boolean mountsAnyMcp() {
+            return hasMcp() || hasIdeMcp();
+        }
+
         /**
          * Render this member's tab label (CB-557): {@code {role}}, {@code {profile}},
          * {@code {model}} and {@code {n}} are substituted.
@@ -522,6 +644,9 @@ public record BridgedConfig(
                          Integer paneProbeIntervalSeconds, Notifications notifications) {
         public boolean isEnabled() { return Boolean.TRUE.equals(enabled); }
         public int intervalOrDefault() { return Math.max(15, intervalSeconds == null ? 30 : intervalSeconds); }
+        public int workingSuspectAfterOrDefault() {
+            return Math.max(300, workingSuspectAfterSeconds == null ? 600 : workingSuspectAfterSeconds);
+        }
         public record Notifications(String mode) {
             public boolean configured() { return "webhook".equalsIgnoreCase(mode); }
         }
@@ -529,22 +654,58 @@ public record BridgedConfig(
 
     /**
      * External AMQP broker for durable, cross-restart reply delivery (CB-307 Stage 2). Its mere
-     * presence swaps the in-memory {@code ReplyInbox} for the AMQP-backed adapter; absent, bridged
+     * presence swaps the in-memory {@code ReplyInbox} for the AMQP-backed adapter; absent, fleetd
      * stays soft-state. Production default is LavinMQ; a stock RabbitMQ speaks the same AMQP 0-9-1
      * and is a URI-only swap.
      *
      * @param uri      AMQP connection URI, e.g. {@code amqp://guest:guest@127.0.0.1:5672/}. Blank/
      *                 {@code null} ⇒ the broker block is treated as absent (in-memory adapter).
+     *                 Ignored when {@code uriEnv} is set.
+     * @param uriEnv   name of a host env var holding the AMQP URI (CB-151). The URI carries its
+     *                 credentials inline, so giving the variable <em>name</em> keeps the password
+     *                 out of the config file, same as {@code auth.tokenEnv}/{@code Profile.tokenEnv}.
+     *                 Wins over {@code uri} whenever set. Blank/{@code null} ⇒ ignored.
      * @param prefetch CB-527: the consumer's {@code basicQos} prefetch count, bounding how many
      *                 unacked messages the AMQP inbox holds in-heap per owned target. {@code null}/
      *                 non-positive ⇒ {@link AmqpReplyInbox#DEFAULT_PREFETCH}.
      */
     @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Broker(String uri, Integer prefetch) {
+    public record Broker(String uri, String uriEnv, Integer prefetch) {
 
-        /** True when a usable broker URI is configured (an empty block does not enable AMQP). */
+        /** True when a {@code uriEnv} is configured by name, whether or not its variable resolves. */
+        public boolean hasUriEnv() {
+            return uriEnv != null && !uriEnv.isBlank();
+        }
+
+        /**
+         * True when a usable broker URI is configured (an empty block does not enable AMQP).
+         * Honors {@code uriEnv} first: if it names a variable that is unset or blank, the broker is
+         * <em>not</em> configured (the daemon falls back to the in-memory inbox) — a bare {@code uri}
+         * is only consulted when no {@code uriEnv} is set. Env lookup makes this process-dependent;
+         * callers already reading {@link System#getenv} are the right ones to invoke it.
+         */
         public boolean isConfigured() {
-            return uri != null && !uri.isBlank();
+            return effectiveUri() != null;
+        }
+
+        /**
+         * The effective AMQP URI to connect with. {@code uriEnv} wins when set (both over {@code uri}
+         * and alone). When {@code uriEnv} names a variable that is unset or blank, returns {@code
+         * null} rather than falling back to {@code uri} — an operator who moved to the secret store
+         * must not silently drop back onto a stale clear-text URI. Returns the literal {@code uri}
+         * when no {@code uriEnv} is configured.
+         */
+        public String effectiveUri() {
+            return effectiveUri(System.getenv());
+        }
+
+        /** As {@link #effectiveUri()}, reading the variable value from {@code env} (the injection seam). */
+        public String effectiveUri(Map<String, String> env) {
+            if (hasUriEnv()) {
+                String value = env.get(uriEnv);
+                return (value != null && !value.isBlank()) ? value : null;
+            }
+            return (uri != null && !uri.isBlank()) ? uri : null;
         }
 
         /** The prefetch to use, defaulting to {@link AmqpReplyInbox#DEFAULT_PREFETCH} when unset. */
@@ -553,6 +714,82 @@ public record BridgedConfig(
         }
     }
 
+    /**
+     * Shared cross-host leader coordination broker: a {@link LeadMailbox} lets two leads on
+     * different daemons — possibly different hosts — exchange durable messages, which a herdr pane
+     * injection (how {@code fleet_send} reaches a lead today) cannot do at all. Its mere presence is
+     * config only in this ticket: nothing here opens a live {@code LeadMailbox} yet, that wiring is
+     * a separate ticket.
+     *
+     * <p>Deliberately a SEPARATE vhost from {@link Broker}, not a reuse of it. {@link Broker} is
+     * per-fleet — its queues are named by worker session id, and two fleets sharing one broker stay
+     * isolated by vhost (see {@code Two fleets share one LavinMQ}). Leader coordination is meant to
+     * cross exactly that boundary: two independently-owned fleets' leads talking to each other. Using
+     * the same vhost would either leak member traffic across the fleet boundary this is meant to
+     * cross, or force every fleet's members onto one shared vhost to get leader coordination — a
+     * second, dedicated vhost keeps "member inboxes stay fleet-local" true while still letting leads
+     * reach across fleets.
+     *
+     * @param uri      AMQP connection URI for the coordination vhost, e.g.
+     *                 {@code amqp://guest:guest@127.0.0.1:5672/coord}. Blank/{@code null} ⇒ the
+     *                 coordinator block is treated as unconfigured. Ignored when {@code uriEnv} is set.
+     * @param uriEnv   name of a host env var holding the AMQP URI, same convention as
+     *                 {@link Broker#uriEnv()} — keeps the credential out of the config file. Wins
+     *                 over {@code uri} whenever set. Blank/{@code null} ⇒ ignored.
+     * @param selfId   this daemon's own lead coord-id — the name its {@code LeadMailbox} is owned
+     *                 under ({@code lead.<selfId>.inbox}), e.g. {@code "mac-opus"}. Blank/
+     *                 {@code null} ⇒ kept as {@code null} (no self id configured).
+     * @param prefetch the consumer's {@code basicQos} prefetch count. {@code null}/non-positive ⇒
+     *                 {@link LeadMailbox#DEFAULT_PREFETCH}.
+     */
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    public record Coordinator(String uri, String uriEnv, String selfId, Integer prefetch) {
+
+        public Coordinator {
+            selfId = (selfId == null || selfId.isBlank()) ? null : selfId;
+        }
+
+        /** True when a {@code uriEnv} is configured by name, whether or not its variable resolves. */
+        public boolean hasUriEnv() {
+            return uriEnv != null && !uriEnv.isBlank();
+        }
+
+        /**
+         * True when a usable coordination broker URI is configured (an empty block does not enable
+         * it). Honors {@code uriEnv} first: if it names a variable that is unset or blank, the
+         * coordinator is <em>not</em> configured — a bare {@code uri} is only consulted when no
+         * {@code uriEnv} is set.
+         */
+        public boolean isConfigured() {
+            return effectiveUri() != null;
+        }
+
+        /**
+         * The effective AMQP URI to connect with. {@code uriEnv} wins when set (both over
+         * {@code uri} and alone). When {@code uriEnv} names a variable that is unset or blank,
+         * returns {@code null} rather than falling back to {@code uri} — an operator who moved to
+         * the secret store must not silently drop back onto a stale clear-text URI. Returns the
+         * literal {@code uri} when no {@code uriEnv} is configured.
+         */
+        public String effectiveUri() {
+            return effectiveUri(System.getenv());
+        }
+
+        /** As {@link #effectiveUri()}, reading the variable value from {@code env} (the injection seam). */
+        public String effectiveUri(Map<String, String> env) {
+            if (hasUriEnv()) {
+                String value = env.get(uriEnv);
+                return (value != null && !value.isBlank()) ? value : null;
+            }
+            return (uri != null && !uri.isBlank()) ? uri : null;
+        }
+
+        /** The prefetch to use, defaulting to {@link LeadMailbox#DEFAULT_PREFETCH} when unset. */
+        public int prefetchOrDefault() {
+            return (prefetch != null && prefetch > 0) ? prefetch : LeadMailbox.DEFAULT_PREFETCH;
+        }
+    }
+
     /**
      * Optional pinned primary terminal config (CB-307). When present with a non-blank
      * {@code terminal}, the bridge uses this as the primary's herdr identity instead of
@@ -589,7 +826,7 @@ public record BridgedConfig(
      * work as peers — the second is silently demoted and refused every orchestration call.
      *
      * <p>{@code kind} and {@code model} are descriptive only: they document what runs in the pane
-     * and are reported back by {@code bridge_whoami}.
+     * and are reported back by {@code fleet_whoami}.
      *
      * <p><b>A lead is now also creatable (CB-557).</b> Before, nothing spawned one — a lead
      * pre-existed, which is why it had to be recognised by configuration rather than created. With
@@ -625,11 +862,12 @@ public record BridgedConfig(
                          String workspace, String cwd) {
 
         /**
-         * Where an auto-launched lead's tab is created (CB-558). It must NOT be a member workspace:
-         * {@code LeadTabScanner} excludes those wholesale, so a lead placed in one would never be
-         * discovered and the daemon would relaunch it on every boot.
+         * Where an auto-launched lead's tab is created (CB-558). It defaults to the SAME shared
+         * {@code "fleet"} space the members use, so the operator sees one "session" with many tabs.
+         * The scanner no longer excludes member spaces — it tells a lead from a member by the exact
+         * tab label, so a lead sharing the members' space is still discovered (see LeadLauncher).
          */
-        public static final String DEFAULT_WORKSPACE = "leads";
+        public static final String DEFAULT_WORKSPACE = "fleet";
 
         public Leader {
             instances = (instances == null || instances < 0) ? 1 : instances;
@@ -795,7 +1033,7 @@ public record BridgedConfig(
 
     /**
      * Opt-in idle-lead heartbeat (CB-551): when the single lead has been continuously idle past
-     * {@code idleAfterSeconds} with no open {@code bridge_send} driving it, nudge it back to work.
+     * {@code idleAfterSeconds} with no open {@code fleet_send} driving it, nudge it back to work.
      *
      * <p>Deliberately opt-in ({@code null} ⇒ off, exactly like {@code leadScan:}). The heartbeat
      * spends the operator's model subscription on its own initiative — it prompts the lead to start
@@ -828,7 +1066,7 @@ public record BridgedConfig(
     }
 
     /**
-     * Watch {@code bridged.yaml} and re-read it when it changes (CB-559).
+     * Watch {@code fleetd.yaml} and re-read it when it changes (CB-559).
      *
      * <p>Opt-in, like every other block that acts on its own initiative. A daemon that reloads
      * whenever a file is saved would apply a half-finished edit the moment an editor writes it, and
@@ -877,7 +1115,7 @@ public record BridgedConfig(
      *
      * <p>Member identity never depends on this block: a loopback peer PID that maps to a herdr
      * pane is unforgeable and is always honoured (see
-     * {@link dev.ltms.bridged.mcp.ConnectionIdentity}). This only decides what happens for
+     * {@link dev.ltms.fleet.mcp.ConnectionIdentity}). This only decides what happens for
      * <em>everyone else</em>.
      *
      * @param mode     {@code "loopback-trust"} (default) — any loopback caller that is not a known
@@ -886,7 +1124,7 @@ public record BridgedConfig(
      *                 a caller must present {@code Authorization: Bearer <token>} or it is
      *                 {@code ANONYMOUS} and authorized for nothing.
      * @param tokenEnv name of the host env var holding the bearer token; the literal value is
-     *                 never stored in config. Defaults to {@code BRIDGED_API_TOKEN}. Only read
+     *                 never stored in config. Defaults to {@code FLEETD_API_TOKEN}. Only read
      *                 when {@code mode} is {@code token}.
      */
     @JsonIgnoreProperties(ignoreUnknown = true)
@@ -899,7 +1137,7 @@ public record BridgedConfig(
 
         public Auth {
             mode = (mode == null || mode.isBlank()) ? MODE_LOOPBACK_TRUST : mode.toLowerCase();
-            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? "BRIDGED_API_TOKEN" : tokenEnv;
+            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? "FLEETD_API_TOKEN" : tokenEnv;
         }
 
         /** True when a bearer token is required of every non-worker caller. */
@@ -925,6 +1163,117 @@ public record BridgedConfig(
         }
     }
 
+    /**
+     * CB-596: which of the operator's own host credentials a spawned member's pane may inherit.
+     *
+     * <p>A herdr pane runs a login shell that re-sources the operator's own secret store, so a
+     * member inherits every credential the operator's shell holds — measured at 31 names on this
+     * host, of which only one ({@code GITEA_ACCESS_TOKEN}) used to be blocked, and that block was a
+     * single name hardcoded in {@link HerdrPeerLauncher} rather than driven by config (gitea issue
+     * #82). This record replaces that hardcoded shadow with a config-driven one.
+     *
+     * <p><b>deny-by-default, not a deny-list.</b> A deny-list (block these specific names, let
+     * everything else through) is silently wrong the moment a new secret is added to the operator's
+     * store — nothing would ever report it. Deny-by-default inverts that: {@link #known} bounds the
+     * blast radius to names the operator has actually enumerated, and every one of them is blocked
+     * UNLESS it is also in {@link #allow}. A name that shows up in neither list is not silently
+     * allowed — see {@code HerdrPeerLauncher}'s gap detector, which logs it.
+     *
+     * <p><b>CB-633: allow-list.</b> Deny-by-default's overlay is applied BEFORE the pane's login
+     * shell runs, so any file that chain sources can re-export over it — and did. The allow-list
+     * policy moves the control to a generated ZDOTDIR whose startup files run the scrub LAST, after
+     * the whole operator chain, and blank every exported variable not on an allow-list DERIVED from
+     * what the launcher itself injects (profiles' tokenEnv/gitTokenEnv/gitHostEnv/env keys plus an
+     * infrastructure set) — never hand-typed, so adding a profile cannot break a spawn. Under this
+     * policy {@link #allow} and {@link #known} stop being a control and become reporting only.
+     *
+     * @param policy how the block is computed. {@link #POLICY_DENY_BY_DEFAULT} (the default; also
+     *               accepted as {@link #POLICY_DENY_LIST}) shadows each {@code known}-but-not-allowed
+     *               name in the pane-creation env overlay — which a login shell that re-exports the
+     *               name defeats (see CB-596's round-2 correction). {@link #POLICY_ALLOW_LIST}
+     *               (CB-633) replaces the overlay with a per-spawn ZDOTDIR scrub that runs AFTER the
+     *               pane's login shell has finished sourcing everything, blanking every variable not
+     *               on the DERIVED allow-list (derived from what the launcher itself injects — never
+     *               hand-typed). Under {@code allow-list}, {@link #allow} and {@link #known} are
+     *               REPORTING ONLY: they feed the gap WARN, they are no longer a control.
+     * @param allow  credential names a member legitimately needs (e.g. the gateway token it reaches
+     *               the LLM through, the repo-scoped forge token it opens its own PR with). Under
+     *               deny-list/deny-by-default every name here is left unmentioned in the pane's env
+     *               overlay; under allow-list this list is reporting only — the control is derived,
+     *               not configured.
+     * @param known  every credential name the operator's store is known to export. Under
+     *               deny-list/deny-by-default every name here that is NOT also in {@link #allow} is
+     *               overlaid with a non-secret sentinel value. Under allow-list this list is
+     *               reporting only.
+     * @param sshAuthSock whether the member may inherit {@code SSH_AUTH_SOCK} under the allow-list
+     *               policy ({@code "allow"}) or must have it blanked ({@code "block"}, the default).
+     *               This is a DECISION, never a default: {@code SSH_AUTH_SOCK} is a handle to the
+     *               operator's ssh-agent, and a member holding it can sign with the operator's own
+     *               keys — but it appears in no secret file and is credential-shaped like nothing on
+     *               any list, which is why three earlier tickets missed it (gitea #110 / CB-607).
+     *               Blocking it breaks git over SSH inside the member; allow it only when members do
+     *               not need to authenticate as the operator over SSH. Ignored under deny-list /
+     *               deny-by-default, which never touch the name.
+     */
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    public record MemberCredentials(String policy, List<String> allow, List<String> known,
+                                    String sshAuthSock) {
+
+        /** Default policy: block every {@code known} name not in {@code allow}, via the env overlay. */
+        public static final String POLICY_DENY_BY_DEFAULT = "deny-by-default";
+
+        /** Alias of {@link #POLICY_DENY_BY_DEFAULT}, spelled the way CB-633 names the two policies. */
+        public static final String POLICY_DENY_LIST = "deny-list";
+
+        /**
+         * CB-633: derive the kept-name set from what the launcher itself injects, generate a
+         * per-spawn ZDOTDIR whose startup files blank every exported variable not on it AFTER the
+         * pane's shell has finished sourcing the operator's chain. The scrub is sourced from both
+         * the generated {@code .zshrc} and {@code .zlogin}, because herdr opens a LOGIN zsh on macOS
+         * and a plain interactive one on Linux — see {@code EnvAllowListScrub}.
+         */
+        public static final String POLICY_ALLOW_LIST = "allow-list";
+
+        /** The pre-CB-633 three-field form — {@code sshAuthSock} defaults to blocked. */
+        public MemberCredentials(String policy, List<String> allow, List<String> known) {
+            this(policy, allow, known, null);
+        }
+
+        public MemberCredentials {
+            String normalizedPolicy = (policy == null || policy.isBlank())
+                    ? POLICY_DENY_BY_DEFAULT : policy.toLowerCase(java.util.Locale.ROOT);
+            // deny-list is an alias of deny-by-default, not a third behaviour — normalize to one
+            // spelling so every isDenyList()-style check has one value to compare against.
+            policy = POLICY_DENY_LIST.equals(normalizedPolicy) ? POLICY_DENY_BY_DEFAULT : normalizedPolicy;
+            allow = allow == null ? List.of() : List.copyOf(allow);
+            known = known == null ? List.of() : List.copyOf(known);
+            sshAuthSock = (sshAuthSock != null && "allow".equalsIgnoreCase(sshAuthSock.trim()))
+                    ? "allow" : "block";
+        }
+
+        /** True when this block selects the CB-633 derived-allow-list policy. */
+        public boolean isAllowList() {
+            return POLICY_ALLOW_LIST.equals(policy);
+        }
+
+        /** True when {@code SSH_AUTH_SOCK} may pass through under the allow-list policy. Default: no. */
+        public boolean sshAuthSockAllowed() {
+            return "allow".equals(sshAuthSock);
+        }
+
+        /** {@link #allow} as a set, for membership checks. */
+        public Set<String> allowSet() {
+            return Set.copyOf(allow);
+        }
+
+        /** {@link #known} minus {@link #allow} — the names a spawn must shadow. */
+        public Set<String> blockedSet() {
+            Set<String> blocked = new java.util.LinkedHashSet<>(known);
+            blocked.removeAll(allowSet());
+            return blocked;
+        }
+    }
+
     /**
      * The candidate profiles an unqualified spawn of {@code role} chooses between, in definition
      * order (CB-557).
@@ -960,7 +1309,7 @@ public record BridgedConfig(
         return defaultProfileFor(MemberRole.DEV);
     }
 
-    private static final Logger log = LoggerFactory.getLogger(BridgedConfig.class);
+    private static final Logger log = LoggerFactory.getLogger(FleetConfig.class);
 
     private static final ObjectMapper YAML = new ObjectMapper(new YAMLFactory());
 
@@ -969,16 +1318,17 @@ public record BridgedConfig(
      * {@link #warnUnknownTopLevelKeys}. Keep in step with the record components.
      *
      * <p>Package-private (not {@code private}) so a test can assert every key here is documented in
-     * {@code bridged.example.yaml} — the only committed description of the config schema, since
-     * {@code bridged.yaml} itself is gitignored.
+     * {@code fleetd.example.yaml} — the only committed description of the config schema, since
+     * {@code fleetd.yaml} itself is gitignored.
      */
     static final Set<String> KNOWN_TOP_LEVEL_KEYS = Set.of(
-            "bind", "herdrSocket", "profiles", "guard", "worktreeRoot",
+            "bind", "herdrSocket", "memberHerdrSocket", "profiles", "guard", "worktreeRoot",
             "lifecycle", "spawnReadyTimeoutMs", "spawnReadyPollMs", "broker", "primary", "fleet",
-            "leadHeartbeat", "health", "placement", "auth", "configReload", "quarantineCooldownSeconds");
+            "leadHeartbeat", "health", "placement", "auth", "configReload", "quarantineCooldownSeconds",
+            "memberCredentials", "coordinator");
 
     /** Load and validate config from {@code path}. */
-    public static BridgedConfig load(Path path) {
+    public static FleetConfig load(Path path) {
         try {
             String yaml = Files.readString(path);
             rejectRenamedTopLevelKeys(yaml);
@@ -986,11 +1336,19 @@ public record BridgedConfig(
             warnUnknownTopLevelKeys(yaml, path);
             rejectDuplicateMemberSlots(yaml);
             rejectNegativeMaxLoad(yaml);
+            rejectAutoCompactWindowOutOfRange(yaml);
             rejectUnknownKind(yaml);
-            BridgedConfig cfg = YAML.readValue(yaml, BridgedConfig.class);
+            rejectUnknownAuthMode(yaml);
+            rejectUnknownPlacement(yaml);
+            rejectUnknownMemberCredentialsPolicy(yaml);
+            FleetConfig cfg = YAML.readValue(yaml, FleetConfig.class);
+            // CB-606: validated here, eagerly, using PlacementPolicies.fromName as the single source
+            // of truth — not lazily at first spawn (see CompositePeerLauncher's placementPolicy
+            // Supplier), where a bad name would still start a daemon that looks healthy.
+            rejectUnknownPlacementPolicy(cfg.placement());
             return cfg.withDefaults();
         } catch (IOException e) {
-            throw new UncheckedIOException("cannot read bridged config at " + path, e);
+            throw new UncheckedIOException("cannot read fleetd config at " + path, e);
         }
     }
 
@@ -1281,6 +1639,52 @@ public record BridgedConfig(
         }
     }
 
+    /** Lowest {@code autoCompactWindow} Claude Code's {@code --autocompact <tokens>} flag accepts. */
+    static final int AUTO_COMPACT_WINDOW_MIN = 100_000;
+    /** Highest {@code autoCompactWindow} Claude Code's {@code --autocompact <tokens>} flag accepts. */
+    static final int AUTO_COMPACT_WINDOW_MAX = 1_000_000;
+
+    /**
+     * Reject a profile whose {@code autoCompactWindow:} is set but outside the token band Claude
+     * Code's own {@code --autocompact <tokens>} flag accepts (100k–1M), naming both the profile and
+     * the value.
+     *
+     * <p>Unset/{@code null} means "off" and passes silently — today's behaviour for every profile
+     * that does not opt in (see {@link Profile#autoCompactWindow()}). A profile that DOES set the key
+     * is validated eagerly, at config load, rather than failing later when Claude Code itself refuses
+     * the launch flag on spawn — the same "fail loud at load, not lazily at first spawn" reasoning as
+     * {@link #rejectNegativeMaxLoad} and {@link #rejectUnknownPlacementPolicy}.
+     *
+     * @param yaml the raw config text
+     * @throws IllegalStateException when any profile's {@code autoCompactWindow} is set and outside
+     *                                {@code [100000, 1000000]}
+     */
+    static void rejectAutoCompactWindowOutOfRange(String yaml) {
+        Map<?, ?> raw;
+        try {
+            raw = YAML.readValue(yaml, Map.class);
+        } catch (IOException | IllegalArgumentException e) {
+            return; // a malformed file is reported by the real parse, not here
+        }
+        if (raw == null || !(raw.get("profiles") instanceof Map<?, ?> profiles)) {
+            return;
+        }
+        List<String> bad = profiles.entrySet().stream()
+                .filter(e -> e.getValue() instanceof Map<?, ?> p
+                        && p.get("autoCompactWindow") instanceof Number n
+                        && (n.doubleValue() < AUTO_COMPACT_WINDOW_MIN || n.doubleValue() > AUTO_COMPACT_WINDOW_MAX))
+                .map(e -> String.valueOf(e.getKey()))
+                .sorted()
+                .toList();
+        if (!bad.isEmpty()) {
+            throw new IllegalStateException("refusing to start: profile(s) [" + String.join(", ", bad)
+                    + "] set autoCompactWindow outside [" + AUTO_COMPACT_WINDOW_MIN + ", "
+                    + AUTO_COMPACT_WINDOW_MAX + "] — Claude Code's --autocompact flag accepts only "
+                    + "that band of tokens; omit the key to leave auto-compaction at each backend's "
+                    + "own default.");
+        }
+    }
+
     /** The peer kinds this build has an adapter for — {@link Profile#kind()}'s only valid values. */
     private static final Set<String> KNOWN_KINDS = Set.of(Profile.KIND_CLAUDE_CODE, Profile.KIND_OPENCODE);
 
@@ -1290,7 +1694,7 @@ public record BridgedConfig(
      *
      * <p>{@link Profile}'s compact constructor only lower-cases {@code kind} and compares it against
      * {@code KIND_OPENCODE} — anything else, including a typo like {@code opencod}, silently falls
-     * into the claude-code bucket ({@link dev.ltms.bridged.member.CompositePeerLauncher} routes by
+     * into the claude-code bucket ({@link dev.ltms.fleet.member.CompositePeerLauncher} routes by
      * exact adapter claim, not by membership in a known set). With {@code argv:} also unset, the argv
      * default special-cases only the exact string {@code "claude-code"}, so the launch command falls
      * back to {@code List.of(kind)} — the daemon then tries to run a program literally named after the
@@ -1328,6 +1732,160 @@ public record BridgedConfig(
         }
     }
 
+    /** The auth modes this build understands — {@link Auth#mode()}'s only valid values. */
+    private static final Set<String> KNOWN_AUTH_MODES = Set.of(Auth.MODE_LOOPBACK_TRUST, Auth.MODE_TOKEN);
+
+    /**
+     * Reject an {@code auth.mode} that is not one of {@link #KNOWN_AUTH_MODES} (CB-606), naming the
+     * value and the accepted set.
+     *
+     * <p>{@link Auth}'s compact constructor only lower-cases {@code mode}, and
+     * {@link Auth#tokenMode()} only compares the result against {@code MODE_TOKEN} — anything else,
+     * including a typo like {@code toekn}, silently behaves as {@code loopback-trust}. That fallback
+     * is otherwise checked only by {@link #validateAuthExposure()}, and only when the bind is
+     * non-loopback: on a loopback bind (the common case) the typo is invisible end to end — the
+     * daemon starts cleanly and authenticates nobody while the operator believes {@code token} mode
+     * is active. Refuse it here, unconditionally, at config load, rather than let it hide behind the
+     * bind check.
+     *
+     * @param yaml the raw config text
+     * @throws IllegalStateException when {@code auth.mode} is a non-blank value not in
+     *                                {@link #KNOWN_AUTH_MODES} (case-insensitive)
+     */
+    static void rejectUnknownAuthMode(String yaml) {
+        Map<?, ?> raw;
+        try {
+            raw = YAML.readValue(yaml, Map.class);
+        } catch (IOException | IllegalArgumentException e) {
+            return; // a malformed file is reported by the real parse, not here
+        }
+        if (raw == null || !(raw.get("auth") instanceof Map<?, ?> auth)) {
+            return;
+        }
+        if (!(auth.get("mode") instanceof String mode) || mode.isBlank()
+                || KNOWN_AUTH_MODES.contains(mode.toLowerCase())) {
+            return;
+        }
+        throw new IllegalStateException("refusing to start: auth.mode=" + mode
+                + " is not recognized — accepted values are "
+                + String.join(", ", KNOWN_AUTH_MODES.stream().sorted().toList())
+                + " (case-insensitive); an unrecognized mode would otherwise silently fall back to"
+                + " loopback-trust, which authenticates nobody.");
+    }
+
+    /** The per-profile placements this build understands — {@link Profile#placement()}'s only valid values. */
+    private static final Set<String> KNOWN_PLACEMENTS = Set.of("tab", "pane");
+
+    /**
+     * Reject a profile whose {@code placement:} is not one of {@link #KNOWN_PLACEMENTS} (CB-606),
+     * naming the profile, the value it set, and the accepted set.
+     *
+     * <p>{@link Profile}'s compact constructor only lower-cases {@code placement}, and
+     * {@link Profile#tabPlacement()} only compares the result against {@code "tab"} — anything else,
+     * including a typo like {@code tabb}, silently falls back to the legacy pane placement with no
+     * signal anywhere.
+     *
+     * @param yaml the raw config text
+     * @throws IllegalStateException when any profile's {@code placement} is a non-blank value not in
+     *                                {@link #KNOWN_PLACEMENTS} (case-insensitive)
+     */
+    static void rejectUnknownPlacement(String yaml) {
+        Map<?, ?> raw;
+        try {
+            raw = YAML.readValue(yaml, Map.class);
+        } catch (IOException | IllegalArgumentException e) {
+            return; // a malformed file is reported by the real parse, not here
+        }
+        if (raw == null || !(raw.get("profiles") instanceof Map<?, ?> profiles)) {
+            return;
+        }
+        List<String> bad = profiles.entrySet().stream()
+                .filter(e -> e.getValue() instanceof Map<?, ?> p
+                        && p.get("placement") instanceof String pl && !pl.isBlank()
+                        && !KNOWN_PLACEMENTS.contains(pl.toLowerCase()))
+                .map(e -> String.valueOf(e.getKey()) + "=" + ((Map<?, ?>) e.getValue()).get("placement"))
+                .sorted()
+                .toList();
+        if (!bad.isEmpty()) {
+            throw new IllegalStateException("refusing to start: profile(s) [" + String.join(", ", bad)
+                    + "] set an unrecognized placement — accepted values are "
+                    + String.join(", ", KNOWN_PLACEMENTS.stream().sorted().toList())
+                    + " (case-insensitive); an unrecognized placement would otherwise fall back to"
+                    + " legacy pane placement with no signal anywhere.");
+        }
+    }
+
+    /**
+     * The member-credential policies this build understands — {@link MemberCredentials#policy()}'s
+     * only valid values. Checked against the RAW yaml text (before {@link MemberCredentials}'s
+     * compact constructor normalizes {@code deny-list} onto {@code deny-by-default}), so the alias
+     * is listed explicitly.
+     */
+    private static final Set<String> KNOWN_MEMBER_CREDENTIALS_POLICIES =
+            Set.of(MemberCredentials.POLICY_DENY_BY_DEFAULT, MemberCredentials.POLICY_DENY_LIST,
+                    MemberCredentials.POLICY_ALLOW_LIST);
+
+    /**
+     * Reject a {@code memberCredentials.policy} that is not {@link #KNOWN_MEMBER_CREDENTIALS_POLICIES}
+     * (CB-596), naming the value and the accepted set.
+     *
+     * <p>{@link MemberCredentials}'s compact constructor only lower-cases {@code policy} and defaults
+     * a blank one to {@link MemberCredentials#POLICY_DENY_BY_DEFAULT} — nothing rejects an actual
+     * typo like {@code deny-by-defualt}. There is only one policy today, so such a typo would
+     * currently behave identically to the real value by accident; the day a second policy exists
+     * that accident becomes a silent behavior change. Refuse it now, at config load, following the
+     * same pattern as {@link #rejectUnknownAuthMode} and {@link #rejectUnknownPlacement}.
+     *
+     * @param yaml the raw config text
+     * @throws IllegalStateException when {@code memberCredentials.policy} is a non-blank value not in
+     *                                {@link #KNOWN_MEMBER_CREDENTIALS_POLICIES} (case-insensitive)
+     */
+    static void rejectUnknownMemberCredentialsPolicy(String yaml) {
+        Map<?, ?> raw;
+        try {
+            raw = YAML.readValue(yaml, Map.class);
+        } catch (IOException | IllegalArgumentException e) {
+            return; // a malformed file is reported by the real parse, not here
+        }
+        if (raw == null || !(raw.get("memberCredentials") instanceof Map<?, ?> mc)) {
+            return;
+        }
+        if (!(mc.get("policy") instanceof String policy) || policy.isBlank()
+                || KNOWN_MEMBER_CREDENTIALS_POLICIES.contains(policy.toLowerCase())) {
+            return;
+        }
+        throw new IllegalStateException("refusing to start: memberCredentials.policy=" + policy
+                + " is not recognized — accepted values are "
+                + String.join(", ", KNOWN_MEMBER_CREDENTIALS_POLICIES.stream().sorted().toList())
+                + " (case-insensitive).");
+    }
+
+    /**
+     * Reject a top-level {@code placement:} policy name {@link PlacementPolicies#fromName} does not
+     * recognize (CB-606), at config load rather than lazily at first spawn.
+     *
+     * <p>{@code CompositePeerLauncher} only calls {@link PlacementPolicies#fromName} per spawn,
+     * through a {@code Supplier} that re-reads live config (CB-559, so a hot-reloaded placement
+     * policy takes effect without a restart) — so a bad name still starts a daemon that looks
+     * healthy and fails only the first time something spawns without naming a profile. Every other
+     * field this class validates fails here, at load; this one gets the same treatment, calling
+     * {@link PlacementPolicies#fromName} itself as the single source of truth for what is valid
+     * rather than duplicating its accepted set.
+     *
+     * @param placement the raw, possibly null/blank {@code placement} value as parsed (before
+     *                   {@link #withDefaults()} runs); {@code fromName} itself treats null/blank as
+     *                   {@code fixed}, so this call changes no default
+     * @throws IllegalStateException when {@code placement} is a name {@link PlacementPolicies} does
+     *                                not recognize
+     */
+    private static void rejectUnknownPlacementPolicy(String placement) {
+        try {
+            PlacementPolicies.fromName(placement);
+        } catch (IllegalArgumentException e) {
+            throw new IllegalStateException("refusing to start: " + e.getMessage(), e);
+        }
+    }
+
     static List<String> unknownTopLevelKeys(String yaml) {
         Map<?, ?> raw;
         try {
@@ -1346,7 +1904,7 @@ public record BridgedConfig(
     }
 
     /** Fill in nested defaults so callers never see nulls for structural fields. */
-    public BridgedConfig withDefaults() {
+    public FleetConfig withDefaults() {
         Bind b = bind != null ? bind : new Bind(null, 0);
         Guard g = guard != null ? guard : new Guard(List.of());
         Lifecycle l = lifecycle != null ? lifecycle : new Lifecycle(null, null, null, false);
@@ -1372,9 +1930,22 @@ public record BridgedConfig(
         // config that never mentions it should still get a sane cooldown rather than a null one.
         Integer quarantineCooldown = (quarantineCooldownSeconds != null && quarantineCooldownSeconds > 0)
                 ? quarantineCooldownSeconds : DEFAULT_QUARANTINE_COOLDOWN_SECONDS;
-        return new BridgedConfig(b, herdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
+        // memberCredentials IS defaulted, like guard/lifecycle/auth above, so no reader ever sees a
+        // null. CB-596: an empty MemberCredentials (empty known, empty allow) blocks NOTHING — unlike
+        // guard/lifecycle, an absent block is not a safe "feature off" default here, it is a gap. It
+        // is deliberately not pre-populated with a Java-side name list (that would just reintroduce
+        // the hardcoded-list defect this record replaces); the block must be configured in
+        // fleetd.yaml to protect anything. See fleetd.example.yaml's memberCredentials: comment.
+        // CB-633: policy stays deny-by-default here — the allow-list scrub is opt-in, because it is
+        // stricter than today's behaviour (it blanks every non-derived name, not just known ones)
+        // and an upgrade must not change what a running deployment's members inherit.
+        MemberCredentials mc = memberCredentials != null ? memberCredentials
+                : new MemberCredentials(null, List.of(), List.of());
+        // coordinator is left as-is, like broker/primary above: null keeps no LeadMailbox opened,
+        // and this ticket's Coordinator is config-only anyway (nothing yet reads it at startup).
+        return new FleetConfig(b, herdrSocket, memberHerdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
                 broker, primary, f, leadHeartbeat, health, placementOrDefault, a, configReload,
-                quarantineCooldown);
+                quarantineCooldown, mc, coordinator);
     }
 
     /**
@@ -1404,11 +1975,11 @@ public record BridgedConfig(
     /**
      * Reject a lead-scan convention that a worker tab would also satisfy (CB-531).
      *
-     * <p>The scan reads a tab label and concludes "a lead lives here". bridged also <em>writes</em>
+     * <p>The scan reads a tab label and concludes "a lead lives here". fleetd also <em>writes</em>
      * tab labels — every member gets one rendered into its tab. Choose a lead {@code tabPrefix} that
      * a member template matches and the daemon starts labelling its own members as leads, promoting
-     * the entire fleet to {@link dev.ltms.bridged.auth.Role#PRIMARY} with no message and no diff.
-     * The member-space exclusion in {@link dev.ltms.bridged.herdr.LeadTabScanner} already blocks the
+     * the entire fleet to {@link dev.ltms.fleet.auth.Role#PRIMARY} with no message and no diff.
+     * The member-space exclusion in {@link dev.ltms.fleet.herdr.LeadTabScanner} already blocks the
      * realistic path, but defence that depends on one workspace label holding is not defence enough
      * for a privilege boundary.
      *

fleetd/src/main/java/dev/ltms/fleet/guard/GuardException.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.guard;
+package dev.ltms.fleet.guard;
 
 /** Thrown when the subscription boundary would be violated. Never swallow this. */
 public class GuardException extends RuntimeException {

fleetd/src/main/java/dev/ltms/fleet/guard/SubscriptionGuard.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.guard;
+package dev.ltms.fleet.guard;
 
 import java.net.URI;
 import java.net.URISyntaxException;
@@ -16,7 +16,7 @@ import java.util.Set;
  *       means its traffic would leave the subscription. That is a hard stop.</li>
  * </ul>
  *
- * Both checks throw {@link GuardException} on violation. {@code bridged} calls
+ * Both checks throw {@link GuardException} on violation. {@code fleetd} calls
  * {@link #assertWorker} before spawning a worker and {@link #assertPrimaryClean}
  * against its own environment at startup.
  */

fleetd/src/main/java/dev/ltms/fleet/health/FleetHealth.java

@@ -1,7 +1,7 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;
 
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.session.MemberSession;
 
 /**
  * Pure classifier. Collection and repair are deliberately outside this package.

fleetd/src/main/java/dev/ltms/fleet/health/FleetHealthMonitor.java

@@ -1,10 +1,11 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;
 
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.herdr.Agent;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.msg.MessageService;
+import dev.ltms.fleet.session.MemberSession;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -25,6 +26,8 @@ public final class FleetHealthMonitor {
 
     /** Bounded attempts to run {@link #failTarget} for one transition. Never retried tick-to-tick (CB-580). */
     static final int MAX_FAIL_TARGET_ATTEMPTS = 3;
+    // CB-641: Match the injector's 60s readiness gate so health allows a full first boot.
+    static final long READINESS_GRACE_NANOS = TimeUnit.SECONDS.toNanos(60);
 
     private final AgentControl agents;
     private final Supplier<List<MemberSession>> roster;
@@ -32,29 +35,48 @@ public final class FleetHealthMonitor {
     private final ScheduledExecutorService scheduler;
     private final LongSupplier clock;
     private final long intervalSeconds;
+    private final long workingSuspectAfterNanos;
     private final BiConsumer<String, String> failTarget;
     private final Map<String, HealthPrior> priors = new HashMap<>();
     private final Map<String, HealthState> states = new HashMap<>();
+    /**
+     * CB-643: consecutive ticks on which a target looked like an orphaned delegation. The fact
+     * {@link MessageService#hasOrphanedDelegation} reports is a true snapshot, but it can read true
+     * for one tick during an ordinary race — an async ticket exists before its virtual thread has
+     * reached {@code rendezvous.open()}, so for that instant nothing is accepted or queued behind
+     * it. {@code decide} maps the field straight to {@code DELEGATION_ORPHANED} with no cross-tick
+     * smoothing of its own, so a single racy read would log a fault that clears on the next tick.
+     * Requiring two consecutive observations costs one interval of latency on a real orphan and
+     * removes that false positive entirely.
+     */
+    private final Map<String, Integer> orphanStreaks = new HashMap<>();
 
-    // These facts need the evidence publishers introduced by later M4 units. They are not negatives.
-    private static final boolean NOT_YET_OBSERVED = false;
+    /** How many consecutive ticks a target must look orphaned before health reports it (CB-643). */
+    static final int ORPHAN_CONFIRM_TICKS = 2;
+
+    // CB-643: every HealthSnapshot field now carries real evidence. The NOT_YET_OBSERVED placeholder
+    // that stood in for 7 of the 12 is gone, and with it the reason 8 of the 9 fault states were
+    // unreachable — GONE and NEVER_READY included, which is what kept CB-580's failTarget from ever
+    // firing. Do not reintroduce a constant here: a field with no publisher is a dead state, and the
+    // tests pass either way, so nothing else will tell you.
 
     /**
      * @param failTarget CB-568's idempotent target-wide failure operation (e.g. {@code messages::abandon}),
      *                   invoked once when a member transitions into a terminal health state. Required —
      *                   there is deliberately no defaulting overload; a caller that does not want the
      *                   fail-tickets-on-terminal-health behavior must pass an explicit inert value (see
-     *                   {@code TestTurnTokens.inert} / {@code BridgeMcp.CapacitySource.none()} for the pattern).
+     *                   {@code TestTurnTokens.inert} / {@code FleetMcp.CapacitySource.none()} for the pattern).
      */
     public FleetHealthMonitor(AgentControl agents, Supplier<List<MemberSession>> roster, MessageService messages,
                               ScheduledExecutorService scheduler, LongSupplier clock, long intervalSeconds,
-                              BiConsumer<String, String> failTarget) {
+                              long workingSuspectAfterSeconds, BiConsumer<String, String> failTarget) {
         this.agents = agents;
         this.roster = roster;
         this.messages = messages;
         this.scheduler = scheduler;
         this.clock = clock;
         this.intervalSeconds = intervalSeconds;
+        this.workingSuspectAfterNanos = TimeUnit.SECONDS.toNanos(workingSuspectAfterSeconds);
         this.failTarget = Objects.requireNonNull(failTarget, "failTarget");
     }
 
@@ -69,28 +91,50 @@ public final class FleetHealthMonitor {
     // Package-private so tests can run one tick without waiting.
     void tick() {
         try {
-            List<Agent> agentsNow = agents.list(); // Exactly one list call for this complete observation.
             List<MemberSession> rosterNow = roster.get(); // One in-memory roster snapshot for this tick.
+            List<Agent> agentsNow;
+            boolean controlLinkDown = false;
+            try {
+                agentsNow = agents.list(); // Exactly one list call for this complete observation.
+            } catch (HerdrException error) {
+                agentsNow = List.of();
+                controlLinkDown = true;
+                log.warn("fleet health control link unavailable; classifying roster", error);
+            }
             Map<String, Agent> live = new HashMap<>();
             for (Agent agent : agentsNow) live.put(agent.terminalId(), agent);
             HashSet<String> current = new HashSet<>();
+            long nowNanos = clock.getAsLong();
             for (MemberSession session : rosterNow) {
                 current.add(session.terminalId());
                 Agent agent = live.get(session.terminalId());
                 AgentStatus status = agent == null ? AgentStatus.UNKNOWN : agent.status();
                 boolean accepted = messages.hasAcceptedDelivery(session.terminalId());
-                HealthSnapshot snapshot = new HealthSnapshot(session.state(), status, accepted, NOT_YET_OBSERVED,
-                        messages.hasInboxMessage(session.terminalId()), agent != null, NOT_YET_OBSERVED,
-                        NOT_YET_OBSERVED, NOT_YET_OBSERVED, NOT_YET_OBSERVED, NOT_YET_OBSERVED, NOT_YET_OBSERVED);
+                boolean present = agent != null;
+                boolean targetNotFound = !controlLinkDown && !present
+                        && session.state() != MemberSession.State.SPAWNING;
+                boolean readinessGraceElapsed = nowNanos - session.spawnedAtNanos() >= READINESS_GRACE_NANOS;
+                boolean stalled = session.state() == MemberSession.State.BUSY
+                        && nowNanos - session.lastActivityAtNanos() >= workingSuspectAfterNanos;
+                // CB-643: the three message-layer facts CB-640 published. Read them here rather than
+                // leaving them false — that constant is what made 8 of the 9 fault states dead.
+                boolean queuedDelivery = messages.hasQueuedDelivery(session.terminalId());
+                boolean replyStranded = messages.hasStrandedReply(session.terminalId());
+                boolean orphanedDelegation = confirmOrphan(session.terminalId(),
+                        messages.hasOrphanedDelegation(session.terminalId()));
+                HealthSnapshot snapshot = new HealthSnapshot(session.state(), status, accepted, queuedDelivery,
+                        messages.hasInboxMessage(session.terminalId()), present, targetNotFound, controlLinkDown,
+                        readinessGraceElapsed, orphanedDelegation, replyStranded, stalled);
                 HealthDecision decision = decide(snapshot, priors.getOrDefault(session.terminalId(), HealthPrior.NONE),
-                        clock.getAsLong());
+                        nowNanos);
                 priors.put(session.terminalId(), decision.prior());
                 reportTransition(session.terminalId(), decision.state());
             }
             priors.keySet().retainAll(current);
             states.keySet().retainAll(current);
+            orphanStreaks.keySet().retainAll(current);
         } catch (Throwable error) {
-            // A list failure is health evidence, and must never kill the monitor's only scheduler task.
+            // Any unclassified collection failure must never kill the monitor's only scheduler task.
             log.warn("fleet health collection failed; will retry next tick", error);
         } finally {
             if (!scheduler.isShutdown()) {
@@ -99,6 +143,20 @@ public final class FleetHealthMonitor {
         }
     }
 
+    /**
+     * Debounce {@link MessageService#hasOrphanedDelegation} across ticks (CB-643). Returns true only
+     * once {@code observed} has held for {@link #ORPHAN_CONFIRM_TICKS} consecutive ticks; a single
+     * false reading resets the streak, so a transient race never reaches the classifier.
+     */
+    private boolean confirmOrphan(String target, boolean observed) {
+        if (!observed) {
+            orphanStreaks.remove(target);
+            return false;
+        }
+        int streak = orphanStreaks.merge(target, 1, Integer::sum);
+        return streak >= ORPHAN_CONFIRM_TICKS;
+    }
+
     void reportTransition(String target, HealthState next) {
         HealthState previous = states.put(target, next);
         if (previous == next) return;

fleetd/src/main/java/dev/ltms/fleet/health/HealthDecision.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;
 
 /** Classification plus the private fact that the next pure decision needs. */
 public record HealthDecision(HealthState state, HealthPrior prior) { }

fleetd/src/main/java/dev/ltms/fleet/health/HealthPrior.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;
 
 /** Private cross-tick observation. It is deliberately not a reported health value. */
 public record HealthPrior(boolean busyButDone) {

fleetd/src/main/java/dev/ltms/fleet/health/HealthSnapshot.java

@@ -1,7 +1,7 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;
 
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.session.MemberSession;
 
 /** Read-only facts from one fleet collection tick. */
 public record HealthSnapshot(MemberSession.State sessionState, AgentStatus liveStatus,

fleetd/src/main/java/dev/ltms/fleet/health/HealthState.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;
 
 /** Health classifications reported for a member. */
 public enum HealthState {

fleetd/src/main/java/dev/ltms/fleet/health/MuteCounter.java

@@ -1,12 +1,12 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;
 
-import dev.ltms.bridged.msg.Rendezvous;
+import dev.ltms.fleet.msg.Rendezvous;
 
 import java.util.Map;
 import java.util.concurrent.ConcurrentHashMap;
 
 /**
- * Counts turns that ended via the completion fallback instead of {@code bridge_reply}.
+ * Counts turns that ended via the completion fallback instead of {@code fleet_reply}.
  * MUTE is an observation by target and profile, not a classifier state and never suppresses faults.
  */
 public final class MuteCounter {

fleetd/src/main/java/dev/ltms/fleet/health/PaneBudget.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.health;
+package dev.ltms.fleet.health;
 
 import java.util.ArrayList;
 import java.util.HashMap;

fleetd/src/main/java/dev/ltms/fleet/herdr/Agent.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 

fleetd/src/main/java/dev/ltms/fleet/herdr/AgentControl.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 
@@ -38,6 +38,11 @@ public final class AgentControl {
         this.herdr = herdr;
     }
 
+    /** The herdr daemon this control object sends its agent calls to. */
+    public HerdrClient herdr() {
+        return herdr;
+    }
+
     /** One agent-targeted call, translating a terminal id to its pane id (retrying once fresh). */
     private JsonNode agentCall(String method, String target, Map<String, Object> extra) {
         String resolved = resolveTarget(target);

fleetd/src/main/java/dev/ltms/fleet/herdr/AgentStatus.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 /**
  * A herdr agent's lifecycle state, as reported by {@code agent_status}. Drives the
@@ -32,7 +32,7 @@ public enum AgentStatus {
         };
     }
 
-    /** Whether {@code bridged} may inject a message now without stepping on a live turn. */
+    /** Whether {@code fleetd} may inject a message now without stepping on a live turn. */
     public boolean injectable() {
         return this == IDLE || this == BLOCKED || this == DONE;
     }

fleetd/src/main/java/dev/ltms/fleet/herdr/HerdrClient.java

@@ -1,17 +1,17 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 
 /**
  * Client face onto the herdr daemon (protocol 14, herdr 0.7.0).
  *
- * <p>This is the ONLY thing in {@code bridged} that speaks to herdr. Every method
+ * <p>This is the ONLY thing in {@code fleetd} that speaks to herdr. Every method
  * maps to a herdr JSON-RPC call over its Unix domain socket. Requests are
  * newline-delimited JSON with a <em>string</em> id; responses carry either a
  * {@code result} object (whose {@code type} field discriminates the payload) or an
  * {@code error} object.
  *
- * <p>Higher layers ({@code bridged}'s policy brain, REST endpoints, MCP adapters)
+ * <p>Higher layers ({@code fleetd}'s policy brain, REST endpoints, MCP adapters)
  * depend on this interface, not on the socket. Tests substitute a fake; the
  * {@code contract}-tagged suite exercises the real implementation against a running
  * herdr to catch protocol drift.

fleetd/src/main/java/dev/ltms/fleet/herdr/HerdrCodec.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.JsonNode;

fleetd/src/main/java/dev/ltms/fleet/herdr/HerdrException.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 /**
  * Raised when a herdr call fails: transport error, or an {@code error} envelope

fleetd/src/main/java/dev/ltms/fleet/herdr/HerdrRouter.java

@@ -0,0 +1,40 @@
+package dev.ltms.fleet.herdr;
+
+import java.util.Objects;
+import java.util.function.Predicate;
+
+/** Routes lead operations and member operations to their owning herdr daemon. */
+public final class HerdrRouter implements AutoCloseable {
+    private final HerdrClient lead;
+    private final HerdrClient member;
+    private final AgentControl leadAgents;
+    private final AgentControl memberAgents;
+    private final WorkspaceControl leadSpaces;
+    private final WorkspaceControl memberSpaces;
+    private final Predicate<String> isLead;
+
+    public HerdrRouter(HerdrClient lead, HerdrClient member, Predicate<String> isLead) {
+        this.lead = Objects.requireNonNull(lead, "lead");
+        this.member = member != null ? member : lead;
+        this.isLead = Objects.requireNonNull(isLead, "isLead");
+        leadAgents = new AgentControl(this.lead);
+        memberAgents = this.member == this.lead ? leadAgents : new AgentControl(this.member);
+        leadSpaces = new WorkspaceControl(this.lead);
+        memberSpaces = this.member == this.lead ? leadSpaces : new WorkspaceControl(this.member);
+    }
+
+    public AgentControl leadAgents() { return leadAgents; }
+    public WorkspaceControl leadSpaces() { return leadSpaces; }
+    public AgentControl memberAgents() { return memberAgents; }
+    public WorkspaceControl memberSpaces() { return memberSpaces; }
+    public AgentControl agentsFor(String targetId) { return isLead.test(targetId) ? leadAgents : memberAgents; }
+
+    HerdrClient leadClient() { return lead; }
+    HerdrClient memberClient() { return member; }
+
+    @Override
+    public void close() {
+        lead.close();
+        if (member != lead) member.close();
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/herdr/LeadTabScanner.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import org.slf4j.Logger;
@@ -14,7 +14,7 @@ import java.util.function.Supplier;
 
 /**
  * Discovers which panes host a lead by scanning herdr for tabs the operator labelled by convention
- * (CB-531), and hands {@link dev.ltms.bridged.auth.CallerResolver} the resulting
+ * (CB-531), and hands {@link dev.ltms.fleet.auth.CallerResolver} the resulting
  * {@code terminal_id → lead name} map.
  *
  * <p><strong>Why scan at all.</strong> A lead is never spawned — a human opens a tab and starts an
@@ -39,18 +39,18 @@ import java.util.function.Supplier;
  *   <li>Worker spaces are excluded wholesale ({@code excludedWorkspaceLabels}), so a worker cannot
  *       become a lead by being placed — as a split, say — inside a matching tab.</li>
  *   <li>A worker cannot rename a tab: {@code tab.rename} is reachable only through
- *       {@link WorkspaceControl}, which no {@code bridge_*} tool exposes. The label is writable by
+ *       {@link WorkspaceControl}, which no {@code fleet_*} tool exposes. The label is writable by
  *       the human at the terminal and by nobody the bridge is defending against.</li>
  *   <li>The label is a <em>name</em>, not a capability. What a pane may do is decided by
  *       {@code Authz} against the role {@code CallerResolver} returns; a tab that calls itself a
  *       lead still cannot act as one unless the daemon's own registry agrees.</li>
  * </ol>
  *
- * <p><strong>CB-558 — bridged now writes lead labels too.</strong> This class used to be able to say
- * that bridged never renames a lead tab, so the label was always the human's own writing and there
+ * <p><strong>CB-558 — fleetd now writes lead labels too.</strong> This class used to be able to say
+ * that fleetd never renames a lead tab, so the label was always the human's own writing and there
  * was no round-trip from the daemon's rename back into its next decision.
- * {@code dev.ltms.bridged.lead.LeadLauncher} ends that: an auto-launched lead is labelled by the
- * daemon and found again by this scan. The trust direction above is unaffected — bridged writing a
+ * {@code dev.ltms.fleet.lead.LeadLauncher} ends that: an auto-launched lead is labelled by the
+ * daemon and found again by this scan. The trust direction above is unaffected — fleetd writing a
  * name for a lead it just started is not a pane promoting itself — but <em>staleness</em> becomes
  * real: a label left behind by a session that has since died would read as a live lead forever.
  * This scanner does not solve that (its job is naming, and a stale name costs nothing here); the
@@ -58,7 +58,7 @@ import java.util.function.Supplier;
  * ever make a decision that <em>removes</em> something based on this map, add the same check.
  * The remaining hazard is an <em>operator</em> one — a worker {@code tabLabel} template that
  * happens to start with the same prefix would promote the whole fleet — and that is refused at
- * startup by {@code BridgedConfig.validateLeadTabPrefixes} rather than documented here.
+ * startup by {@code FleetConfig.validateLeadTabPrefixes} rather than documented here.
  *
  * <p><strong>Caching.</strong> {@link #get()} is on the request path (every resolve), so the scan
  * is TTL-cached and a stale-but-valid map is preferred to a herdr round-trip. A failed scan keeps

fleetd/src/main/java/dev/ltms/fleet/herdr/PaneLocator.java

@@ -0,0 +1,147 @@
+package dev.ltms.fleet.herdr;
+
+import com.fasterxml.jackson.databind.JsonNode;
+
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.OptionalLong;
+import java.util.Set;
+
+/**
+ * Resolves which herdr pane a process belongs to — the herdr half of connection-based MCP
+ * identity (CB-105). Given the PID that opened an MCP connection, {@link #terminalForPid} finds
+ * the agent pane whose process tree contains it, so {@code fleetd} can tell <em>which worker</em>
+ * is calling without the worker sending anything spoofable.
+ *
+ * <p>herdr owns the PID→pane truth: {@code pane.process_info} reports each pane's {@code shell_pid}
+ * and foreground process PIDs. A pid that is neither of those directly — e.g. a grandchild a
+ * worker spawned, such as a {@code python3} or {@code curl} helper that opens its own MCP
+ * connection — is resolved by walking its ancestry (via {@link ParentResolver}) up to the root and
+ * matching any ancestor against a pane's {@code shell_pid} or foreground pids (CB-161). Without
+ * this walk such a pid matches no pane, and the caller falls through to loopback-trust and is
+ * resolved as the primary — a worker→primary privilege escalation.
+ *
+ * <p>This scans agent panes; a spawn-time {@code pid→terminal} cache is the obvious optimization
+ * once wired into {@code ClaudeCodeLauncher}.
+ *
+ * <p>CB-185 split the fleet across two herdr daemons — lead operations on one, members on the
+ * other ({@code memberHerdrSocket}). A caller's pane can live on <em>either</em> daemon (a lead's
+ * MCP connection resolves against the lead daemon; a member's against the member daemon), so this
+ * must be able to search more than one client. {@link #PaneLocator(HerdrClient, HerdrClient)}
+ * searches the lead client first, then the member client, and collapses to a single scan when the
+ * two are the same object (the historical single-daemon deployment). The caller's ancestor set is
+ * computed once per {@link #terminalForPid} call and reused across every client searched — it
+ * does not depend on which daemon a pane happens to live on.
+ */
+public final class PaneLocator {
+
+    /**
+     * Bound on how many ancestor generations {@link #ancestorsOf} walks. This runs on every MCP
+     * call, so a cycle or a pathologically deep process tree must not hang identity resolution;
+     * 32 generations is far more than any real worker→helper process tree needs.
+     */
+    private static final int MAX_ANCESTRY_DEPTH = 32;
+
+    private final List<HerdrClient> herdrs;
+    private final ParentResolver parentResolver;
+
+    /** Search only this client — the single-daemon deployment. */
+    public PaneLocator(HerdrClient herdr) {
+        this(herdr, ParentResolver.PROCESS_HANDLE);
+    }
+
+    /** Search only this client, resolving ancestry through {@code parentResolver} — for tests. */
+    public PaneLocator(HerdrClient herdr, ParentResolver parentResolver) {
+        this.herdrs = List.of(herdr);
+        this.parentResolver = parentResolver;
+    }
+
+    /**
+     * Search {@code lead} first, then {@code member} — the two-daemon deployment (CB-185). When
+     * the caller passes the same client for both (no {@code memberHerdrSocket} configured), this
+     * collapses to one client and one scan, exactly {@link #PaneLocator(HerdrClient)}'s behaviour.
+     */
+    public PaneLocator(HerdrClient lead, HerdrClient member) {
+        this(lead, member, ParentResolver.PROCESS_HANDLE);
+    }
+
+    /** Two-daemon deployment, resolving ancestry through {@code parentResolver} — for tests. */
+    public PaneLocator(HerdrClient lead, HerdrClient member, ParentResolver parentResolver) {
+        this.herdrs = lead == member ? List.of(lead) : List.of(lead, member);
+        this.parentResolver = parentResolver;
+    }
+
+    /**
+     * The {@code terminal_id} of the agent pane whose process tree contains {@code pid}, or
+     * {@code null} if no agent pane on any searched daemon owns it (e.g. the caller is the
+     * primary, or off-host).
+     */
+    public String terminalForPid(long pid) {
+        if (pid <= 0) {
+            return null;
+        }
+        Set<Long> ancestry = ancestorsOf(pid);
+        for (HerdrClient herdr : herdrs) {
+            String terminal = terminalForPid(herdr, ancestry);
+            if (terminal != null) {
+                return terminal;
+            }
+        }
+        return null;
+    }
+
+    /**
+     * {@code pid} itself plus its ancestor chain, walked through {@link #parentResolver} up to
+     * {@link #MAX_ANCESTRY_DEPTH} generations or pid 1, whichever comes first. A vanished ancestor
+     * ({@link ParentResolver#parentOf} returning empty) ends the walk without error — it just means
+     * the chain is shorter than the bound. A cycle in a fake resolver is caught by the "already
+     * seen" check and also ends the walk, so this can never loop.
+     */
+    private Set<Long> ancestorsOf(long pid) {
+        Set<Long> ancestry = new LinkedHashSet<>();
+        long current = pid;
+        for (int depth = 0; depth < MAX_ANCESTRY_DEPTH; depth++) {
+            if (current <= 0 || !ancestry.add(current)) {
+                break; // vanished/invalid pid, or a cycle back to a pid already recorded
+            }
+            if (current == 1) {
+                break; // reached the root of the process tree
+            }
+            OptionalLong parent = parentResolver.parentOf(current);
+            if (parent.isEmpty()) {
+                break; // vanished ancestor — not an error, just the end of the chain
+            }
+            current = parent.getAsLong();
+        }
+        return ancestry;
+    }
+
+    private static String terminalForPid(HerdrClient herdr, Set<Long> ancestry) {
+        for (JsonNode pane : herdr.call("pane.list", Map.of()).path("panes")) {
+            String paneId = pane.path("pane_id").asText(null);
+            if (paneId != null && paneOwnsAnyOf(herdr, paneId, ancestry)) {
+                return pane.path("terminal_id").asText(null);
+            }
+        }
+        return null;
+    }
+
+    private static boolean paneOwnsAnyOf(HerdrClient herdr, String paneId, Set<Long> ancestry) {
+        JsonNode info;
+        try {
+            info = herdr.call("pane.process_info", Map.of("pane_id", paneId)).path("process_info");
+        } catch (HerdrException e) {
+            return false; // pane vanished mid-scan — just skip it
+        }
+        if (ancestry.contains(info.path("shell_pid").asLong(-1))) {
+            return true;
+        }
+        for (JsonNode p : info.path("foreground_processes")) {
+            if (ancestry.contains(p.path("pid").asLong(-1))) {
+                return true;
+            }
+        }
+        return false;
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/herdr/ParentResolver.java

@@ -0,0 +1,21 @@
+package dev.ltms.fleet.herdr;
+
+import java.util.OptionalLong;
+
+/**
+ * Resolves a pid's parent pid — the seam {@link PaneLocator} walks a process's ancestry through,
+ * so its tests can drive the walk from a fake pid→parent map instead of spawning real processes.
+ *
+ * <p>{@link #PROCESS_HANDLE} is the production implementation, backed by {@link ProcessHandle}.
+ */
+public interface ParentResolver {
+
+    /** The parent pid of {@code pid}, or empty if {@code pid} is gone or has no known parent. */
+    OptionalLong parentOf(long pid);
+
+    /** Production resolver: asks the JVM's {@link ProcessHandle} view of the OS process tree. */
+    ParentResolver PROCESS_HANDLE = pid -> ProcessHandle.of(pid)
+            .flatMap(ProcessHandle::parent)
+            .map(parent -> OptionalLong.of(parent.pid()))
+            .orElse(OptionalLong.empty());
+}

fleetd/src/main/java/dev/ltms/fleet/herdr/Tab.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 

fleetd/src/main/java/dev/ltms/fleet/herdr/UnixSocketHerdrClient.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;

fleetd/src/main/java/dev/ltms/fleet/herdr/Workspace.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 
@@ -7,7 +7,7 @@ import com.fasterxml.jackson.databind.JsonNode;
  * dedicated worker space so they never split or clutter the user's real work spaces.
  *
  * @param workspaceId herdr's stable id (e.g. {@code "w4"})
- * @param label       display label shown in herdr's UI (e.g. {@code "bridged-workers"})
+ * @param label       display label shown in herdr's UI (e.g. {@code "fleetd-workers"})
  * @param activeTabId the workspace's currently-focused tab, or {@code null}
  */
 public record Workspace(String workspaceId, String label, String activeTabId) {

fleetd/src/main/java/dev/ltms/fleet/herdr/WorkspaceControl.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.herdr;
+package dev.ltms.fleet.herdr;
 
 import com.fasterxml.jackson.databind.JsonNode;
 import org.slf4j.Logger;

fleetd/src/main/java/dev/ltms/fleet/inject/CompletionResolver.java

@@ -1,29 +1,31 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;
 
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.msg.TurnToken;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.msg.TurnToken;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.time.Duration;
 import java.util.List;
 import java.util.Objects;
 import java.util.Set;
 import java.util.TreeSet;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.function.LongSupplier;
 import java.util.regex.Pattern;
 
 /**
  * The CB-106 completion fallback: bridges the {@link Injector}'s turn-completion signal to the
- * {@link Rendezvous} so a blocking {@code bridge_send} resolves even when the worker finishes its
- * task without ever calling {@code bridge_reply} — the common case for a real delegated coding task.
+ * {@link Rendezvous} so a blocking {@code fleet_send} resolves even when the worker finishes its
+ * task without ever calling {@code fleet_reply} — the common case for a real delegated coding task.
  *
  * <p>On a confirmed {@code working → idle} boundary it scrapes the worker's recent transcript and
  * resolves the awaiting send with that tail (a {@link Rendezvous.Kind#COMPLETION} resolution, so the
  * caller can tell a scrape from a structured reply). It scrapes only when a send is actually waiting
  * — a fleet worker's own turns, or a send that already timed out, cost no herdr traffic. An explicit
- * {@code bridge_reply} that raced in first wins; {@link Rendezvous#resolveCompletion} is then a no-op.
+ * {@code fleet_reply} that raced in first wins; {@link Rendezvous#resolveCompletion} is then a no-op.
  *
  * <p>It also handles the CB-109 stall signal ({@link #onTurnFailed}): a worker that ran a turn then
  * wedged in an {@code unknown} state resolves the send as a failure (with the error screen as
@@ -38,7 +40,7 @@ import java.util.regex.Pattern;
  * <p><strong>Waiter-specific resolution (CB-116).</strong> On delivery we also capture the exact
  * {@link Rendezvous} waiter this turn belongs to, and the completion/failure fallbacks resolve
  * <em>that</em> waiter — never "whatever send is waiting now". A completion fallback runs on a virtual
- * thread and can land after the worker's {@code bridge_reply} already resolved the turn and the
+ * thread and can land after the worker's {@code fleet_reply} already resolved the turn and the
  * <em>next</em> send opened its own waiter on the same session; resolving the current waiter would
  * then deliver turn N's stale scrape as turn N+1's answer. Targeting the captured waiter makes a late
  * completion a harmless no-op (its waiter is already done) instead of a cross-turn stale reply.
@@ -61,13 +63,33 @@ public final class CompletionResolver implements TurnListener {
     /** Cap the scraped tail so a long transcript can't return an unbounded blob. */
     static final int MAX_SCRAPE_CHARS = 4000;
 
+    /**
+     * fleetd#164: the floor below which a {@code BUSY -> DONE} transition cannot be real work. A
+     * backend that rejects a turn outright (e.g. an HTTP 400 from the model, before the worker read
+     * a single file or produced a token) drives the exact same confirmed {@code working -> idle}
+     * transition a genuine completion does — just in about a second instead of the many seconds a
+     * real turn costs. {@link #onTurnComplete} cannot tell those two cases apart from the transition
+     * alone, so a turn that settles inside this floor is treated as a crash signature and resolved
+     * as a failure, never as a (possibly empty) success.
+     */
+    public static final long MIN_TURN_NANOS = Duration.ofSeconds(2).toNanos();
+
+    /**
+     * fleetd#164 (part 2): one stable, explicit backend-failure marker seen on a Claude Code pane
+     * when the backend itself rejected the turn (e.g. {@code "API Error: 400 invalid request body"}).
+     * Kept deliberately narrow — a growing list of ad-hoc error strings rots as backends change their
+     * wording; broader backend-error surfacing is out of scope here (fleetd#164 point 3).
+     */
+    private static final Pattern BACKEND_ERROR = Pattern.compile("(?i)\\bAPI Error\\s*:");
+
     private static final String CLIPPED_PANE_TAIL_MARKER =
-            "[Pane tail clipped: member did not call bridge_reply.]";
+            "[Pane tail clipped: member did not call fleet_reply.]";
 
     private final AgentControl agents;
     private final Rendezvous rendezvous;
     private final ExhaustedPatternLookup exhaustedPatterns;
     private final ExhaustionSink exhaustionSink;
+    private final LongSupplier nowNanos;
 
     /**
      * Per-target record of the turn currently in flight: the exact {@link Rendezvous} waiter its
@@ -79,8 +101,21 @@ public final class CompletionResolver implements TurnListener {
      * reference: a completion scrape equal to it means the worker produced no new output (the previous
      * turn's wind-down sampled as this boundary), so it is suppressed. Overwritten on each delivery;
      * cleared when the turn resolves. Package-private so tests can capture and replay a specific turn.
+     *
+     * <p>{@code deliveredAtNanos} (fleetd#164) is the {@link #nowNanos} reading taken at delivery —
+     * the other half of the {@link #MIN_TURN_NANOS} floor check, compared against a fresh reading at
+     * resolution time.
      */
-    record InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline) {
+    record InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline, long deliveredAtNanos) {
+
+        /**
+         * Convenience for tests exercising scrape/suppression logic that don't care about turn
+         * timing: back-dates the delivery far enough that {@link #MIN_TURN_NANOS} can never fire.
+         * Not used by production code — {@link #captureBaseline} always records a real reading.
+         */
+        InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline) {
+            this(waiter, baseline, Long.MIN_VALUE / 2);
+        }
     }
 
     private final ConcurrentHashMap<String, InFlight> inFlight = new ConcurrentHashMap<>();
@@ -97,10 +132,25 @@ public final class CompletionResolver implements TurnListener {
      */
     public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
                               ExhaustionSink exhaustionSink) {
+        this(agents, rendezvous, exhaustedPatterns, exhaustionSink, System::nanoTime);
+    }
+
+    /**
+     * Test constructor with an injectable clock (fleetd#164), matching the {@code LongSupplier}
+     * pattern {@link dev.ltms.fleet.session.SessionManager} and {@link dev.ltms.fleet.msg.MessageService}
+     * already use: lets a test place a turn's delivery and its resolution at an exact, controllable
+     * distance apart around the {@link #MIN_TURN_NANOS} floor, without a real sleep. Public (rather
+     * than package-private like those two) because callers that wire a full {@code MessageService}
+     * fixture — e.g. {@code MessageServiceTest} — construct this resolver directly from another
+     * package.
+     */
+    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
+                       ExhaustionSink exhaustionSink, LongSupplier nowNanos) {
         this.agents = agents;
         this.rendezvous = rendezvous;
         this.exhaustedPatterns = Objects.requireNonNull(exhaustedPatterns, "exhaustedPatterns");
         this.exhaustionSink = Objects.requireNonNull(exhaustionSink, "exhaustionSink");
+        this.nowNanos = Objects.requireNonNull(nowNanos, "nowNanos");
     }
 
     @Override
@@ -130,7 +180,7 @@ public final class CompletionResolver implements TurnListener {
             baseline = null; // fail open: no baseline ⇒ no suppression
             log.debug("delivery baseline for {} failed: {}", target, e.getMessage());
         }
-        inFlight.put(target, new InFlight(waiter, baseline));
+        inFlight.put(target, new InFlight(waiter, baseline, nowNanos.getAsLong()));
     }
 
     /** The turn currently baselined for {@code target}, or {@code null} — a test hook for the captureBaseline path. */
@@ -171,11 +221,20 @@ public final class CompletionResolver implements TurnListener {
     void resolve(String target, InFlight turn) {
         CompletableFuture<Rendezvous.Resolution> waiter = turn == null ? null : turn.waiter();
         if (waiter == null || waiter.isDone()) {
-            // Nobody is blocked on THIS turn (it had no send, or its bridge_reply already won). Skip
+            // Nobody is blocked on THIS turn (it had no send, or its fleet_reply already won). Skip
             // the scrape; resolving the current waiter here would be the CB-116 cross-turn stale reply.
             inFlight.remove(target, turn);
             return;
         }
+        // fleetd#164: a BUSY -> DONE transition inside the floor cannot be real work — it's a crash
+        // signature (e.g. a backend HTTP 400 before the worker did anything), not a fast answer. Fail
+        // it before spending a scrape on the ordinary path; the reason still carries whatever is on
+        // screen, since that is usually the backend's own error.
+        long elapsedNanos = nowNanos.getAsLong() - turn.deliveredAtNanos();
+        if (elapsedNanos < MIN_TURN_NANOS) {
+            fail(target, turn, tooFastReason(target, elapsedNanos));
+            return;
+        }
         String tail;
         String assistantBlock = null;
         int originalLength = 0;
@@ -187,49 +246,66 @@ public final class CompletionResolver implements TurnListener {
             clipped = originalLength > MAX_SCRAPE_CHARS;
             tail = clip(assistantBlock);
         } catch (RuntimeException e) {
-            // The worker finished but we couldn't read its screen — still resolve the send so the
-            // caller unblocks; an empty tail beats hanging until the caller's timeout.
-            log.warn("completion scrape for {} failed; resolving with an empty tail: {}",
-                    target, e.getMessage());
+            log.warn("completion scrape for {} failed: {}", target, e.getMessage());
             tail = "";
             scrapeFailed = true;
         }
+        // fleetd#164: a scrape nobody could read, and a scrape that read cleanly but produced nothing,
+        // both used to resolve the send as a SUCCESS carrying "" — indistinguishable from a worker that
+        // genuinely finished with nothing to say. That is the defect: fail loudly instead, naming the
+        // member, so a caller (including a lead deciding whether to delegate again) can tell a lost
+        // turn from a real empty answer.
+        if (scrapeFailed || tail.isEmpty()) {
+            fail(target, turn, emptyScrapeReason(target, scrapeFailed));
+            return;
+        }
         // Misattribution guard (CB-115): if the scrape is byte-identical to the pane content at
         // delivery, this turn produced no new output — the boundary belongs to the previous turn's
         // wind-down (common on rapid back-to-back sends). Suppress rather than resolve the send with
-        // a stale answer; the real bridge_reply (or a later genuine completion) resolves it instead.
-        // A scrape that failed to read is exempt — an empty tail there is "couldn't see", not "no change".
+        // a stale answer; the real fleet_reply (or a later genuine completion) resolves it instead.
         String baseline = turn.baseline();
-        if (!scrapeFailed && baseline != null && baseline.equals(tail)) {
+        if (baseline != null && baseline.equals(tail)) {
             log.debug("suppressing misattributed completion for {} (no output change since delivery)",
                     target);
             return; // keep the in-flight record: a later genuine completion still needs it
         }
-        // CB-578 stage A: a turn that ended with no bridge_reply AND whose scrape matches the
+        // CB-578 stage A: a turn that ended with no fleet_reply AND whose scrape matches the
         // backend's configured usage-limit pattern is a refusal, not an answer. Classify it as
         // BACKEND_EXHAUSTED rather than handing the caller a scrape that reads like a real reply.
-        if (!scrapeFailed) {
-            Pattern exhausted = exhaustedPatterns.patternFor(target);
-            String matchedLine = exhausted == null ? null : firstMatchingLine(assistantBlock, exhausted);
-            if (matchedLine != null) {
-                String reason = "backend exhausted (usage limit): " + matchedLine;
-                if (rendezvous.resolveExhausted(waiter, reason)) {
-                    inFlight.remove(target, turn);
-                    log.warn("completion for {} classified BACKEND_EXHAUSTED (no bridge_reply; scrape "
-                            + "matched the profile's exhausted pattern): {}", target, reason);
-                    // CB-578 stage B: only on the resolution that actually won the race — a late
-                    // duplicate must never quarantine a credential twice for one refusal.
-                    exhaustionSink.onExhausted(target, reason);
-                }
-                return;
+        Pattern exhausted = exhaustedPatterns.patternFor(target);
+        String matchedLine = exhausted == null ? null : firstMatchingLine(assistantBlock, exhausted);
+        if (matchedLine != null) {
+            String reason = "backend exhausted (usage limit): " + matchedLine;
+            if (rendezvous.resolveExhausted(waiter, reason)) {
+                inFlight.remove(target, turn);
+                log.warn("completion for {} classified BACKEND_EXHAUSTED (no fleet_reply; scrape "
+                        + "matched the profile's exhausted pattern): {}", target, reason);
+                // CB-578 stage B: only on the resolution that actually won the race — a late
+                // duplicate must never quarantine a credential twice for one refusal.
+                exhaustionSink.onExhausted(target, reason);
             }
+            return;
+        }
+        // fleetd#164 (part 2): a scrape that read cleanly and produced content still isn't a real
+        // reply when that content is the backend's own rejection (e.g. an HTTP 400 before the worker
+        // did any work). Classify it as a failure naming the member, rather than handing the caller a
+        // scrape that reads like a completed answer.
+        String backendError = firstMatchingLine(assistantBlock, BACKEND_ERROR);
+        if (backendError != null) {
+            // Carry the whole scrape, not just the matched line. The pattern is a heuristic: a member
+            // that forgot fleet_reply while reporting *about* a backend error matches it too. Failing
+            // is still right — the caller must not read a scrape as an answer — but dropping the rest
+            // of the pane would destroy the report, which is the same defect fleetd#164 is about.
+            fail(target, turn, "member " + target + " ended on a backend error: " + backendError
+                    + "\n--- pane tail ---\n" + tail);
+            return;
         }
         String completion = clipped ? tail + "\n" + CLIPPED_PANE_TAIL_MARKER : tail;
         if (rendezvous.resolveCompletion(waiter, completion)) {
             inFlight.remove(target, turn);
             if (clipped) {
                 log.warn("completion scrape for {} clipped from {} chars to the {} char cap; "
-                                + "member did not call bridge_reply, so the pane tail is partial",
+                                + "member did not call fleet_reply, so the pane tail is partial",
                         target, originalLength, MAX_SCRAPE_CHARS);
             }
             log.debug("resolved send to {} via turn-completion fallback ({} chars scraped)",
@@ -272,6 +348,36 @@ public final class CompletionResolver implements TurnListener {
         }
     }
 
+    /**
+     * fleetd#164: the failure reason for a turn that settled inside {@link #MIN_TURN_NANOS} — names
+     * the member and both timings, and appends whatever the pane shows (usually the backend's own
+     * error) so the caller sees the cause, not just "it failed".
+     */
+    private String tooFastReason(String target, long elapsedNanos) {
+        String scrape;
+        try {
+            scrape = clip(agents.read(target, SCRAPE_SOURCE));
+        } catch (RuntimeException e) {
+            scrape = "";
+        }
+        String reason = String.format(
+                "member %s went BUSY -> DONE in %dms (floor %dms) — too fast to be real work, most "
+                        + "likely a backend error before any work started",
+                target, elapsedNanos / 1_000_000, MIN_TURN_NANOS / 1_000_000);
+        return scrape.isBlank() ? reason : reason + ": " + scrape;
+    }
+
+    /**
+     * fleetd#164: the failure reason for a scrape that produced zero characters — names the member
+     * and says plainly that the turn produced nothing, so a caller (a lead deciding whether to
+     * delegate again included) never mistakes a lost turn for a genuinely empty reply.
+     */
+    private static String emptyScrapeReason(String target, boolean scrapeFailed) {
+        return "member " + target + " turn completed with an empty scrape (0 chars) — "
+                + (scrapeFailed ? "its pane could not be read; " : "")
+                + "treating as a lost turn, not a real answer";
+    }
+
     /**
      * The first line of {@code text} matching {@code pattern}, stripped — the CB-578 stage A
      * evidence carried in a {@code BACKEND_EXHAUSTED} reason so the operator sees the real refusal
@@ -289,7 +395,7 @@ public final class CompletionResolver implements TurnListener {
 
     /**
      * Coverage summary for the CB-578 stage A exhausted-pattern classification, logged at startup
-     * the way {@link dev.ltms.bridged.health.FleetHealthMonitor#coverage} is — so an operator can
+     * the way {@link dev.ltms.fleet.health.FleetHealthMonitor#coverage} is — so an operator can
      * see whether the classification is on, and for which profiles, without reading every
      * profile's config by hand.
      *

fleetd/src/main/java/dev/ltms/fleet/inject/ExhaustedPatternLookup.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;
 
 import java.util.regex.Pattern;
 

fleetd/src/main/java/dev/ltms/fleet/inject/ExhaustionSink.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;
 
 /**
  * Notified when {@link CompletionResolver} actually delivers a {@code BACKEND_EXHAUSTED}
@@ -8,7 +8,7 @@ package dev.ltms.bridged.inject;
  *
  * <p>{@link CompletionResolver} knows only {@code target} (a herdr terminal id); it has no notion of
  * profiles or credentials, so mapping {@code target} to whatever should be quarantined is entirely
- * the sink's job — see {@code Bridged.main}'s wiring, which resolves target → session → profile →
+ * the sink's job — see {@code Fleetd.main}'s wiring, which resolves target → session → profile →
  * {@code effectiveCredentialId()} and calls {@code BackendQuarantine.quarantine} on it.
  */
 @FunctionalInterface

fleetd/src/main/java/dev/ltms/fleet/inject/Injector.java

@@ -1,8 +1,9 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;
 
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.msg.TurnToken;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.HerdrRouter;
+import dev.ltms.fleet.msg.TurnToken;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -81,7 +82,7 @@ public final class Injector {
 
     /**
      * The single source for the injector poll cadence — how often the {@link StatusPoller} drives
-     * {@link #onStatus} at. {@code Bridged} passes this to every {@link StatusPoller} it constructs,
+     * {@link #onStatus} at. {@code Fleetd} passes this to every {@link StatusPoller} it constructs,
      * and this class reads it to state the readiness grace in seconds on the CB-562 expiry log
      * instead of hardcoding "60s". One constant, so a cadence change cannot silently desync a log
      * that claims a grace duration.
@@ -89,6 +90,7 @@ public final class Injector {
     public static final long POLL_INTERVAL_MILLIS = 250;
 
     private final AgentControl agents;
+    private final HerdrRouter router;
     private final TurnListener turnListener;
     private final Predicate<String> ready; // CB-113: a target is deliverable only when available
     private final Consumer<String> forget; // CB-114: clear a gone worker's readiness/presence
@@ -124,11 +126,25 @@ public final class Injector {
     public Injector(AgentControl agents, TurnListener turnListener, Predicate<String> ready,
                     Consumer<String> forget) {
         this.agents = agents;
+        this.router = null;
         this.turnListener = turnListener;
         this.ready = ready;
         this.forget = forget;
     }
 
+    public Injector(HerdrRouter router, TurnListener turnListener, Predicate<String> ready,
+                    Consumer<String> forget) {
+        this.agents = null;
+        this.router = router;
+        this.turnListener = turnListener;
+        this.ready = ready;
+        this.forget = forget;
+    }
+
+    private AgentControl agentsFor(String target) {
+        return router != null ? router.agentsFor(target) : agents;
+    }
+
     /** A pending message and the future that completes when it has been delivered. */
     private record Pending(String text, TurnToken token, CompletableFuture<Void> delivered) {
     }
@@ -253,7 +269,7 @@ public final class Injector {
                         if (p != null && ready.test(target)) {
                             t.notReadySincePoll = 0;
                             try {
-                                agents.send(target, p.text());
+                                agentsFor(target).send(target, p.text());
                                 t.queue.poll();
                                 t.awaitingPickup = true;
                                 t.awaitingCompletion = true;
@@ -313,7 +329,7 @@ public final class Injector {
         // thread while it holds the target lock.
         if (resubmit) {
             try {
-                agents.submit(target); // nudge a raced Enter so the pending paste submits
+                agentsFor(target).submit(target); // nudge a raced Enter so the pending paste submits
             } catch (RuntimeException e) {
                 log.debug("resubmit to {} failed (will retry next poll): {}", target, e.getMessage());
             }

fleetd/src/main/java/dev/ltms/fleet/inject/MemberPresence.java

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;
 
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.Set;

fleetd/src/main/java/dev/ltms/fleet/inject/StatusPoller.java

@@ -1,8 +1,9 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;
 
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.herdr.HerdrException;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.HerdrRouter;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -22,6 +23,7 @@ public final class StatusPoller {
     private static final Logger log = LoggerFactory.getLogger(StatusPoller.class);
 
     private final AgentControl agents;
+    private final HerdrRouter router;
     private final Injector injector;
     private final StatusRefiner refiner;
     private final long intervalMillis;
@@ -35,11 +37,24 @@ public final class StatusPoller {
     public StatusPoller(AgentControl agents, Injector injector, StatusRefiner refiner,
                         long intervalMillis) {
         this.agents = agents;
+        this.router = null;
         this.injector = injector;
         this.refiner = refiner;
         this.intervalMillis = intervalMillis;
     }
 
+    public StatusPoller(HerdrRouter router, Injector injector, long intervalMillis) {
+        this.agents = null;
+        this.router = router;
+        this.injector = injector;
+        // CB-185: this refiner's own AgentControl (member) is only a default for the legacy 2-arg
+        // refine() overload — the loop below always calls the 3-arg refine(target, raw, control)
+        // with the per-target control from router.agentsFor(target), so a lead target is refined
+        // against the LEAD daemon even though this field points at the member one.
+        this.refiner = new StatusRefiner(router.memberAgents());
+        this.intervalMillis = intervalMillis;
+    }
+
     /** Start the polling loop on a virtual thread. Idempotent. */
     public synchronized void start() {
         if (running) return;
@@ -56,7 +71,11 @@ public final class StatusPoller {
                 try {
                     // herdr's agent_status can misreport a settled worker as `unknown`; refine it
                     // against the pane content before it drives delivery/completion (CB-115).
-                    AgentStatus status = refiner.refine(target, agents.status(target));
+                    // CB-185: refine THROUGH the same control the raw status came from — a router
+                    // splits lead/member targets across two herdr daemons, and reading a lead's pane
+                    // through the (fixed) member refiner never finds it, wedging that lead at UNKNOWN.
+                    AgentControl control = router != null ? router.agentsFor(target) : agents;
+                    AgentStatus status = refiner.refine(target, control.status(target), control);
                     injector.onStatus(target, status);
                 } catch (HerdrException e) {
                     // The worker's agent is gone — stop trying and unblock its waiters.

fleetd/src/main/java/dev/ltms/fleet/inject/StatusRefiner.java

@@ -1,7 +1,7 @@
-package dev.ltms.bridged.inject;
+package dev.ltms.fleet.inject;
 
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.AgentStatus;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -41,15 +41,32 @@ public final class StatusRefiner {
     }
 
     /**
-     * Return a trustworthy status for {@code target}. Any non-{@code UNKNOWN} {@code raw} is returned
-     * unchanged; an {@code UNKNOWN} triggers a pane read and content classification. A read failure
-     * leaves it {@code UNKNOWN} (the safe default: no delivery, and the stall path still applies).
+     * Return a trustworthy status for {@code target}, reading its pane through this refiner's own
+     * {@link AgentControl}. Equivalent to {@link #refine(String, AgentStatus, AgentControl)} with
+     * that control — kept for callers that only ever talk to one herdr daemon.
      */
     public AgentStatus refine(String target, AgentStatus raw) {
+        return refine(target, raw, agents);
+    }
+
+    /**
+     * Return a trustworthy status for {@code target}. Any non-{@code UNKNOWN} {@code raw} is returned
+     * unchanged; an {@code UNKNOWN} triggers a pane read (through {@code control}) and content
+     * classification. A read failure leaves it {@code UNKNOWN} (the safe default: no delivery, and
+     * the stall path still applies).
+     *
+     * <p>CB-185: {@code control} must be the {@link AgentControl} for the <em>same</em> daemon the
+     * raw status was sampled from — a router splits lead and member targets across two herdr
+     * daemons, and reading a lead's pane through the member client (or vice versa) fails to find
+     * the pane and leaves the target wedged at {@code UNKNOWN} forever. Callers that route per
+     * target (e.g. {@code StatusPoller}) must pass that target's control explicitly rather than
+     * relying on the control fixed at construction.
+     */
+    public AgentStatus refine(String target, AgentStatus raw, AgentControl control) {
         if (raw != AgentStatus.UNKNOWN) return raw;
         String pane;
         try {
-            pane = agents.read(target, PROBE_SOURCE);
+            pane = control.read(target, PROBE_SOURCE);
         } catch (RuntimeException e) {
             log.debug("status refine read for {} failed; leaving UNKNOWN: {}", target, e.getMessage());
             return AgentStatus.UNKNOWN;