fleetd #466 scope item 2: report the quarantine repeat count, not only the seconds

Add BackendQuarantine#status(credentialId) -> Optional<Status>, a single
QuarantineState read that answers both remainingSeconds and repeatCount
together -- the same "one accessor" pattern CompositePeerLauncher.
modelGateState() already uses, so the two facts can never disagree.

fleet_profiles/REST GET /profiles and fleet_list's capacity rows
(FleetMcp.profilesView/capacityView) now call status() instead of
remainingSeconds() and add a "quarantineAttempt" field beside
"quarantinedForSeconds": 1 for a first occurrence, 2 for the second
in a row, and so on.

No change to the escalation, ceiling, or reset logic itself -- this
unit is reporting only.

.claude-plugin/marketplace.json

@@ -1,15 +1,15 @@
 {
-  "name": "claude-bridge",
+  "name": "fleetd",
   "description": "Tooling for orchestrating a fleet of delegated coding agents through the fleetd MCP gateway.",
   "owner": {
     "name": "LTMS"
   },
   "plugins": [
     {
-      "name": "claude-bridge",
+      "name": "fleet",
       "source": "./plugin",
-      "description": "Make a project bridge-ready: mount the fleetd MCP gateway and apply standard Claude Code settings so a session can orchestrate delegated workers. Ships no credentials.",
-      "version": "0.1.0",
+      "description": "Mount the fleetd MCP gateway and apply standard Claude Code settings so a session can orchestrate delegated workers. Ships no credentials.",
+      "version": "0.2.0",
       "author": {
         "name": "LTMS"
       }

.gitea/workflows/ci.yml

@@ -87,12 +87,18 @@ jobs:
           apt-get update && apt-get install -y --no-install-recommends maven
           mvn -version
 
-      # The `contract` profile clears the default-excludes group, so the @Tag("contract") AMQP test
-      # runs against the RabbitMQ service container (AMQP_URI). Pinned to the one contract test to
-      # avoid re-running the unit suite already covered by the `build` job.
+      # The `contract` profile clears the default-excludes group, so `-Dgroups=contract` runs every
+      # @Tag("contract") test and nothing from the unit suite the `build` job already covered — a
+      # tag selects the whole group, so a test added to it later runs here automatically. A prior
+      # version of this step pinned `-Dtest=AmqpReplyInboxContractTest` by class name instead: that
+      # silently excluded every other contract test (including the herdr ones) from CI, and nobody
+      # noticed until the herdr protocol drifted out from under a test that never ran here
+      # (fleetd #449). If this runner has no herdr socket, the herdr-backed tests in the group
+      # skip on their own `assumeTrue` and only the broker-backed ones actually run — check the
+      # step output rather than assuming which.
       - name: Contract tests
         working-directory: fleetd
-        run: mvn -B -Pcontract test -Dtest=AmqpReplyInboxContractTest
+        run: mvn -B -Pcontract test -Dgroups=contract
 
       - name: Failing test output
         if: failure()

CLAUDE.md

@@ -7,6 +7,14 @@
 > wiki ([Use Cases](https://git.ltms.dev/fleet/fleetd/wiki/7-Use-Cases) → *The portable
 > CLAUDE.md block*); improvements go to the template first, then out to each project. Anything
 > specific to *this* repo lives under §Project addendum below, never inline above it.
+>
+> **Anything you measure in an addendum is perishable.** Date it, give the command that
+> re-measures it and what each outcome means, and tell the reader to delete the section once
+> it stops reproducing. The four parts work together: deciding what would falsify a claim is
+> the expensive step, and a reader in the middle of another task will not pay it, so a bare
+> "verify before relying on this" costs the same space and does nothing. The case this is for
+> is a note that goes stale as a live restriction — it will tell a future session it cannot do
+> the thing at the moment doing it becomes the job.
 
 If no `fleet_*` MCP tools are mounted in this session, this section does not apply — skip it.
 
@@ -50,8 +58,9 @@ and the sender silently receives nothing. Fail toward the recoverable error.
    re-send because a call looks slow — the bridge delivers when the peer is `idle`, `blocked` or
    `done`. A spawned member must **also** have mounted the bridge MCP: until it has, it is not
    deliverable, and a send waits on that gate for ~60s and then fails without ever reaching its pane.
-5. **Never drive the terminal multiplexer directly** (no `herdr` CLI, no socket). The bridge owns
-   policy; the multiplexer owns PTYs. Going around the bridge bypasses every rule above.
+5. **Never move a fleet session, pane or peer except through the bridge.** The bridge owns policy;
+   the multiplexer owns PTYs. Any route that changes fleet state without the bridge's checks
+   bypasses every rule above — the `herdr` CLI and its socket are the usual example.
 
 ### Primary (lead) — run this on every task, in order
 
@@ -71,8 +80,11 @@ below are the procedure — run them in order, every task, not only the big ones
    the final judgment call, verification, merges, and anything that depends on context only you
    hold. Nothing else is yours by default.
 3. **Spawn every delegated unit first** — `fleet_spawn{profile, worktree:true, ticket}`, one per
-   unit, *before* sending any. Pass `profile` explicitly: profiles differ in model and cost, not in
-   tier, so the default is rarely what you want.
+   unit, *before* sending any. Pass `profile` explicitly: profiles differ in model, cost and
+   LIVENESS, not in tier, so the default is rarely what you want. The default is whatever the
+   daemon reports, and on a host where it sits on an exhausted or withdrawn credential every
+   unqualified spawn fails — sometimes loudly, sometimes as a member that spawns fine and then
+   produces nothing. `fleet_profiles` reports the default; check it once per session.
 4. **Then send them all** — `fleet_send{sessionId, content, wait:false}`. Line 1 of every brief is
    `Load the <name> skill.` naming the worker's playbook; those skills are opt-in and that line is
    what makes them reliable. Where the project ships no such skill, spell the procedure out in the
@@ -94,6 +106,18 @@ below are the procedure — run them in order, every task, not only the big ones
 8. **Adjudicate, merge, tear down — yours alone.** Read the diff yourself: fully if it is small,
    targeted at the reported findings and the risky paths if it is large. Reviewer findings direct
    your attention; they never substitute for it. Then merge, then `fleet_stop{paneId}`.
+   **If the forge refuses you the merge** — a protected branch, a token without the grant — the
+   adjudication is still yours. Read the diff, decide, and hand the operator a merge-ready queue
+   with the refusal quoted. Never report a PR as merged, and never call one "ready to merge"
+   without having read the diff yourself. A refusal is exactly when that shortcut is tempting,
+   because no action is left that forces you to look, and taking it turns this step into
+   forwarding a reviewer's verdict — which is delegating the merge by proxy, two lines above.
+   **Test a refusal; do not read it off a permissions field.** A protected branch holds its merge
+   rights separately from the repository permissions, so that field can say yes while the merge is
+   refused, and still say no after a grant makes it work. Probe instead, with a request that cannot
+   succeed on its merits, so a rejection can only mean the refusal. Treat a transport failure as a
+   third answer that proves nothing: a timeout, a DNS error or a bad URL is not a refusal, and
+   counting it as one makes you sure of something you never measured.
 
 **Steps 3 and 4 are separate on purpose** — spawning and sending in one loop is how parallel work
 silently becomes serial, and it is the most common way this layer is wasted. For the same reason,
@@ -114,7 +138,8 @@ the merge — and merging on a reviewer's word is delegating it by proxy.
 | Answer a member's `fleet_ask` | `fleet_send{turnId, content}` — **not** `sessionId` |
 | Message a **peer lead** on this host | `fleet_send{sessionId: <their terminal>, content}` — `fleet_list` → `leads` reports it. Coordination only, **never** a task |
 | Message a **peer lead** on another daemon or host | `fleet_send{coordId: <their coord-id>, content}` — needs a `coordinator:` block; your own coord-id is in `fleet_list`. Coordination only, **never** a task |
-| Answer a peer lead that messaged you | `fleet_reply{content}` — the one case a lead replies |
+| Answer a peer lead that messaged you | `fleet_send{coordId}` — or `{sessionId}` if they are on this host. **Not** `fleet_reply`: it has no peer route and the publish is refused |
+| Read your own held lead-to-lead mail (no ack) | `fleet_poll{coordId: <your own coord-id, from fleet_list's coordinator.selfId>}` — primary-only; never acks, so `fleet_list`'s `held[]` still shows it after. `fleet_list`'s `held[]` gives only a truncated preview — this is the only way to read the full body |
 | Collect a held reply | `fleet_poll{target}` · then `fleet_ack{target, msgId}` |
 | Tear down a member | `fleet_stop{paneId}` |
 
@@ -140,10 +165,21 @@ The traffic between leads is coordination and nothing else:
 3. **Verify a peer exactly as you verify yourself.** Peer status buys nothing: check the claim
    against the code, and re-run the build. A peer's correction gets the same treatment — right or
    wrong on the evidence, not on who said it. Neither of you merges the other's work unreviewed.
+   **N observations are N data points only if they differ in the axis you are trusting.** This cuts
+   both ways. N *failures* blamed on one cause are one data point when the cases share what you are
+   not varying. N *agreeing measurements* are also one data point when they share an instrument —
+   two hosts, two operators and the same formula is one formula, not two confirmations.
+4. **Ask a peer to read your project addendum.** Your addendum is instruction surface: every future
+   session on your host obeys it, and a wrong one is obeyed just as faithfully as a right one. The
+   author is the worst reader of their own qualifier placement — measured here, one addendum carried
+   two defects and a non-author found both. If you have no peer, at least re-read it asking "which
+   sentence goes false first, and would a reader reach the caveat before acting?"
 
-Being messaged by a peer does not make you its worker: answer with `fleet_reply`, and push back on
-the substance if it is wrong. A peer that simply complies has thrown away the reason there are two of
-you.
+Being messaged by a peer does not make you its worker: answer the way you would open —
+`fleet_send{coordId}` for another daemon, `fleet_send{sessionId}` on this host — and push back on
+the substance if it is wrong. `fleet_reply` resolves a member's blocked `fleet_send`; a peer's
+coord-id message is durable and non-blocking, so there is nothing for it to resolve. A peer that
+simply complies has thrown away the reason there are two of you.
 
 ### Member (worker or architect) — the turn contract
 
@@ -188,6 +224,19 @@ must obey belongs in the charter, not here.
 - **This repo is the bridge.** The daemon is `fleetd`, its MCP mount is `http://127.0.0.1:8765/mcp`,
   and the code behind the rules above is `mcp/FleetMcp` (tools), `auth/Authz` (the role table),
   `mcp/ConnectionIdentity` (connection→role), and `worker/*Launcher` (`REPLY_CHARTER`).
+- **Herdr socket tests (measured 2026-09-10).** In this repo, herdr is a subject under test. A
+  worker assigned to herdr code, and the lead, may let a test open the herdr socket directly in a
+  throwaway workspace that the test tears down. This only covers
+  `fleetd/src/test/java/dev/ltms/fleet/herdr/AgentControlContractTest.java`,
+  `fleetd/src/test/java/dev/ltms/fleet/herdr/HerdrContractTest.java`,
+  `fleetd/src/test/java/dev/ltms/fleet/herdr/PaneLocatorContractTest.java`, and
+  `fleetd/src/test/java/dev/ltms/fleet/herdr/WorkspacePlacementContractTest.java`. It is not a
+  general licence. Using the herdr CLI or socket to move a real fleet session, pane, or peer stays
+  banned. That is the control plane that invariant 5 protects. Re-measure with
+  `grep -rl 'UnixSocketHerdrClient.connect()' fleetd/src/test/java --include='*.java'`. A non-empty
+  result means tests still open the socket and this note still applies. An empty result means nobody
+  does this any more; delete this section. Canonical invariant 5 restatement is tracked in #458 and
+  is not part of this change.
 - **`fleet_profiles`/`fleet_list` report two separate outage states, and they are not the same
   thing.** *Quarantined* (CB-578) means the backend told us it is out of capacity — a long,
   1800s-default cooldown. *Cooling off* (fleetd #201/#227) means a profile's credential threw two
@@ -210,6 +259,17 @@ must obey belongs in the charter, not here.
 - **Primary-side skills** (not delegation playbooks — a worker cannot use them):
   `port-to-opencode` (make an OpenCode session a participant in this workspace) and
   `fleets-status` (report every fleet that shares one LavinMQ instance).
+- **This repo is also a Claude Code marketplace, and ships a plugin.** `.claude-plugin/marketplace.json`
+  points at `plugin/`, which carries the MCP mount and the `setup` skill
+  (`/claude-bridge:setup` — make any project bridge-ready). It was added in CB-527 and then went
+  unmentioned by every instruction file, so it drifted and a later session planned it from scratch
+  (#362). **Read `plugin/` before designing anything about onboarding a project.** Two limits are
+  structural, not bugs: a plugin cannot carry the role agent files, because
+  `ClaudeCodeLauncher.java:371` requires `<cwd>/.claude/agents/<role>.md` in the member's own
+  worktree; and a plugin cannot deliver anything to members at all, because
+  `ClaudeCodeLauncher.java:285` exports `CLAUDE_CONFIG_DIR` and every Claude profile here sets it,
+  so a member never reads the operator's plugin store. **The plugin is the lead-side surface;
+  member-facing assets travel in the worktree.**
 - **Never commit** `.mcp.json` (the primary's local copy, flagged `--skip-worktree`) or `wiki/`
   (a submodule with its own remote).
 - **A provisioned worktree neutralizes `.mcp.json`, `opencode.json` and `.autoenv`** — the repo's
@@ -333,6 +393,16 @@ print("in sync:", w[i:w.index("\n```\n", i) + 1] == block)
 PY
 ```
 
+**Only the lead can run that check (measured 2026-09-10).** A member's provisioned worktree has
+`wiki/` uninitialized, so the script dies with `FileNotFoundError: wiki/7-Use-Cases.md`. Measured
+in three worker worktrees: `git submodule status` printed a leading `-` and `wiki/` held 0
+entries; the primary's own clone printed a leading `+` and the file was there. So never make this
+check a member's acceptance criterion — it is unsatisfiable for them, and a brief that asks for it
+is asking a worker to invent a pass. A member told to check it must say it could not run it, and
+must never report it as passed. The lead runs it in the main clone before merging. Re-measure with
+`git submodule status` in a member's worktree: a leading `-` means this still applies; once it
+prints a commit with no `-`, delete this paragraph.
+
 ## IDE MCP tools & validation workflow (enforced)
 
 > **Primary only.** Workers have no IDE MCP mount — if you are a worker, skip this section and

deploy/fleetd.service

@@ -1,72 +1,80 @@
 # CB-504 — systemd unit for fleetd (Linux).
 #
-# The macOS launchd agent (deploy/dev.ltms.fleetd.plist) is the supervision target for the
-# current single-host deployment. This unit exists for the per-host gateways CB-308 introduces,
-# which will run on Linux.
+# fleetd #360: the previous version of this file started clean and broke the daemon in three ways
+# that nothing logs (see the DO NOT block and the ExecStart/PrivateTmp comments below for what and
+# why). The unit below, plus its companion deploy/herdr.service, is the version that has actually
+# run on fleet01 without those failures. Do not "improve" it back toward the old shape without
+# re-reading why each line is the way it is.
 #
 # Install (user service — fleetd drives the user's herdr, not a system daemon):
 #   mkdir -p ~/.config/systemd/user
-#   cp deploy/fleetd.service ~/.config/systemd/user/
-#   # edit ExecStart / WorkingDirectory / Environment below, then:
+#   cp deploy/fleetd.service deploy/herdr.service ~/.config/systemd/user/
+#   # edit WorkingDirectory / ExecStart below for your host's paths and java location
 #   systemctl --user daemon-reload
-#   systemctl --user enable --now fleetd
+#   systemctl --user enable --now herdr fleetd
+#   loginctl enable-linger $USER      # REQUIRED -- see below
 #   journalctl --user -u fleetd -f
+#
+# `loginctl enable-linger` is not optional and is easy to miss, because leaving it out looks like
+# success: `systemctl --user enable` reports "enabled" and both units run for as long as you stay
+# logged in. A user manager without lingering starts at your first login and stops at your last
+# logout, so the fleet simply does not come back after a reboot -- which is the whole reason to
+# use systemd here rather than the setsid scripts these units replaced. Check it with
+# `loginctl show-user $USER -p Linger`; the answer must be `Linger=yes`.
+#
+# Secrets (AI_GATEWAY_TOKEN, WORKER_GITEA_TOKEN, LAVINMQ_URI, COORD_AMQP_URI, ...) are not set
+# here and need no systemd drop-in: ExecStart runs a login shell, so they come from wherever your
+# login shell already sources them (this host: ~/.fleet/secrets.sh via ~/.zprofile). If a token is
+# missing there, fleetd still starts — the daemon reports every secret a configured profile
+# references, by name, never by value:
+#   journalctl --user -u fleetd | grep 'startup secret'
+# A resolved one logs "startup secret NAME: set (profile 'x' tokenEnv)"; a missing one logs
+# "startup secret NAME: MISSING" at WARN and the daemon starts anyway — the first visible symptom
+# is a member that cannot open a pull request, hours later and in a different component.
 
 [Unit]
-Description=fleetd — claude-bridge message server
+Description=fleetd — fleet message server
 Documentation=https://git.ltms.dev/fleet/fleetd/wiki
-# Ordering only: herdr is a user process and its socket may appear after us. This is advisory —
-# fleetd retries the herdr socket rather than exiting, which is what actually makes a late
-# socket survivable. Do NOT add Requires=: a herdr restart must not take fleetd down with it.
+# Ordering only. fleetd retries the herdr socket rather than exiting, which is what actually makes
+# a late socket survivable. Do NOT add Requires=: a herdr restart must not take fleetd down too.
 After=herdr.service
 Wants=herdr.service
 
 [Service]
 Type=simple
-WorkingDirectory=%h/src/claude-bridge/fleetd
-ExecStart=/usr/lib/jvm/temurin-25-jdk/bin/java -jar target/fleetd.jar fleetd.yaml
+WorkingDirectory=%h/LTMS/fleetd/fleetd
 
-Environment=HERDR_SOCKET_PATH=%h/.config/herdr/herdr.sock
-# PATH matters more than it looks (CB-511): fleetd propagates its own PATH to every worker it
-# spawns, so this line decides whether the fleet can run a build at all. systemd does not source a
-# login shell, so without it the daemon — and every worker — gets a bare default with no JDK/Maven.
-Environment=PATH=/usr/lib/jvm/temurin-25-jdk/bin:/usr/share/maven/bin:/usr/local/bin:/usr/bin:/bin
-# Secrets are NOT set here — this file is committed. Put ALL three tokens in a private drop-in
-# that systemd reads with restrictive permissions. In `systemctl --user edit fleetd`, add:
-#   [Service]
-#   Environment=FLEETD_API_TOKEN=...
-#   Environment=WORKER_GITEA_TOKEN=...
-#   Environment=AI_GATEWAY_TOKEN=...
-# FLEETD_API_TOKEN protects fleetd's API. WORKER_GITEA_TOKEN lets members open pull requests; if
-# it is missing, fleetd still starts, but a member fails when it later tries to open a pull request.
-# AI_GATEWAY_TOKEN authenticates gateway profiles; if it is missing, fleetd still starts, but a
-# gateway profile later returns HTTP 401. Or, put the same three variables in a 0600 file and add:
-# EnvironmentFile=%h/.config/fleetd/env
-# After starting, check which of them actually resolved. The daemon reports every secret a
-# configured profile references, by name, never by value:
-#   journalctl --user -u fleetd | grep 'startup secret'
-# A resolved one logs "startup secret NAME: set (profile 'x' tokenEnv)". A missing one logs
-# "startup secret NAME: MISSING" at WARN — and the daemon starts anyway, which is the whole
-# problem: without this grep the first sign is a member that cannot open a pull request, hours
-# later and in a different component.
-# Note what the report can and cannot tell you. It lists only names some profile actually
-# references (tokenEnv, gitTokenEnv, and the broker uriEnv). A secret nothing references is never
-# reported, because nothing needs it.
+# A LOGIN shell, not java directly. Every secret this daemon needs (AI_GATEWAY_TOKEN,
+# WORKER_GITEA_TOKEN, LAVINMQ_URI, COORD_AMQP_URI) lives in ~/.fleet/secrets.sh, which only
+# ~/.zprofile sources. systemd runs no login shell. Started any other way the daemon boots fine
+# and looks healthy, and the failure appears hours later as a member that cannot open a pull
+# request. exec keeps it one process, so systemd tracks the right PID.
+# This also avoids a SECOND copy of the secrets in a systemd drop-in: one source of truth.
+ExecStart=/bin/zsh -lc "exec java -jar target/fleetd.jar fleetd.yaml"
+
+# PrivateTmp MUST stay false -- see herdr.service. fleetd creates the member ZDOTDIR scrub dir and
+# the opencode config dir under java.io.tmpdir, and the member pane (a herdr child, a different
+# unit) has to read them. A private /tmp turns the credential scrub into a silent no-op.
+PrivateTmp=false
 
 Restart=on-failure
 RestartSec=10s
-# A bad config (e.g. a non-loopback bind without token auth) makes fleetd fail fast by design.
-# Give up rather than restart-loop on a permanent error.
+# A bad config makes fleetd fail fast by design. Give up rather than restart-loop forever.
 StartLimitBurst=5
 StartLimitIntervalSec=120
 
-# The daemon reads the repo, writes worktrees, and talks to a Unix socket — it needs no more.
+# DO NOT add ProtectSystem=, ProtectHome=, ProtectKernelTunables= or ProtectControlGroups=.
+# Measured on fleet01 2026-09-05: each of those gives the unit its own mount namespace, and
+# fleetd resolves a caller role by running lsof to find the loopback peer PID
+# (mcp/LsofPeerPidLookup). Inside such a namespace lsof returns nothing, every caller falls back
+# to ANONYMOUS, and the primary is refused every orchestration call with
+# "unauthenticated: anonymous may not SPAWN".
+# The daemon still starts, healthz still returns ok and the secrets still resolve - the only
+# symptom is that the fleet cannot be driven at all. Verified by bisecting the directives:
+#   no sandbox 3 lsof lines | ProtectSystem=strict 0 | ProtectHome=read-only 0
+#   ProtectKernelTunables 0 | ProtectControlGroups 0 | RestrictSUIDSGID 3 | NoNewPrivileges 3
+# The two below add no mount namespace and are safe.
 NoNewPrivileges=true
-PrivateTmp=true
-ProtectSystem=strict
-ProtectHome=read-write
-ProtectKernelTunables=true
-ProtectControlGroups=true
 RestrictSUIDSGID=true
 
 StandardOutput=journal

deploy/herdr-inner.sh

@@ -0,0 +1,19 @@
+#!/bin/zsh
+# fleetd #360 — template for the script deploy/herdr.service's ExecStart wraps in a pty.
+#
+# `script -qfec <this> /dev/null` needs a real command to run, and that command has to be a LOGIN
+# shell script: herdr itself needs the same secrets fleetd.service's login shell picks up (this
+# host: ~/.fleet/secrets.sh via ~/.zprofile), because members it spawns inherit its environment.
+# systemd's own Environment= lines in herdr.service are not enough for that -- they set TERM and a
+# bare PATH so the pty starts at all, nothing more.
+#
+# Copy this file to the path deploy/herdr.service's ExecStart names
+# (%h/LTMS/fleetd/fleetd-run/herdr-inner.sh by default) and `chmod +x` it. Not committed under
+# that path itself because the session name below is host-specific.
+
+# A 0x0 pty makes every pane spawn fail with "ghostty error -2" (see herdr-multi-instance-facts /
+# fleet01-headless-herdr-standup) -- give it a real size before herdr ever touches it.
+stty rows 50 cols 200
+
+# -l: login shell, so herdr and everything it spawns gets the real secrets and PATH.
+exec zsh -lc 'exec herdr --session <name>'

deploy/herdr.service

@@ -0,0 +1,40 @@
+# fleetd #360 — systemd unit for herdr (Linux), the terminal multiplexer fleetd drives.
+#
+# This is fleetd.service's companion: fleetd.service's After=/Wants=herdr.service assumes this
+# unit exists. Before this ticket it did not, so on a fresh host fleetd started against a herdr
+# that systemd never supervised at all.
+#
+# Install: see deploy/fleetd.service's header comment (both units install the same way).
+#
+# ExecStart below runs deploy/herdr-inner.sh (copy the template of that name from this directory
+# to the path in ExecStart, or point ExecStart at wherever you keep it, and make it executable).
+# It is a separate file rather than an inline command because it must itself be a login shell (see
+# its own header for why) and systemd's ExecStart does not run one.
+
+[Unit]
+Description=herdr terminal multiplexer (fleet session)
+Documentation=https://git.ltms.dev/fleet/fleetd/wiki
+
+[Service]
+Type=simple
+# script(1) gives herdr a real pty. Without it the client reports a 0x0 window and every pane
+# spawn fails with "ghostty error -2" -- which surfaces as a fleetd spawn failure, not a herdr one.
+ExecStart=/usr/bin/script -qfec %h/LTMS/fleetd/fleetd-run/herdr-inner.sh /dev/null
+StandardInput=null
+Environment=TERM=xterm-256color
+Environment=PATH=%h/.local/bin:/usr/local/bin:/usr/bin:/bin
+
+# PrivateTmp MUST stay false. fleetd writes the member ZDOTDIR scrub dir and the opencode config
+# dir under its own java.io.tmpdir, and the member pane -- a child of THIS process -- has to read
+# them. A private /tmp here silently breaks the credential scrub instead of failing loudly.
+PrivateTmp=false
+
+Restart=on-failure
+RestartSec=5s
+
+StandardOutput=journal
+StandardError=journal
+SyslogIdentifier=herdr
+
+[Install]
+WantedBy=default.target

docs/CB-5xx-Hardening.md

@@ -192,7 +192,7 @@ Deliberately small; every one maps to a failure mode we have actually hit.
 | `fleet_send_duration_seconds` | histogram | delegated turn latency |
 | `fleet_replies_total{path}` | counter | path ∈ rendezvous\|inbox — how often a reply strands (CB-307's whole reason to exist) |
 | `fleet_inbox_depth{target}` | gauge | undrained replies; steady-state should be 0 |
-| `fleet_push_nudges_total{outcome}` | counter | outcome ∈ delivered\|exhausted — a rising `exhausted` means the primary is not draining |
+| `fleet_push_nudges_total{outcome}` | counter | outcome ∈ sent\|exhausted — a rising `exhausted` means the primary is not draining. `sent` was called `delivered` until fleetd #365; it counts the herdr paste-and-submit call returning, never a confirmation the pane read it |
 | `fleet_spawns_total{kind,outcome}` | counter | outcome ∈ ready\|timeout\|guard_rejected; per peer kind (CB-402) |
 | `fleet_sessions{state}` | gauge | SPAWNING/READY/BUSY/DONE census |
 | `fleet_herdr_calls_total{method,outcome}` | counter | socket health — the dependency everything rests on |

fleetd/fleetd.example.yaml

@@ -110,6 +110,14 @@ bind:
 #   notifications:
 #     mode: disabled
 
+# Idle-sleep guard: while at least one member is live, hold an OS-level assertion against idle
+# sleep (macOS only — a `caffeinate -i` child; a no-op elsewhere or if caffeinate is missing), so
+# an unattended host does not idle-sleep out from under a member's long turn. Unlike health/
+# configReload above, this is ON BY DEFAULT — omitting the block entirely leaves it enabled, the
+# same as `enabled: true`. Uncomment only to turn it off:
+# idleSleepGuard:
+#   enabled: false
+
 # herdr Unix socket. Omit to use the client default
 # (${HERDR_SOCKET_PATH:-~/.config/herdr/herdr.sock}).
 herdrSocket: ~/.config/herdr/herdr.sock
@@ -199,8 +207,12 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      omit and this profile's completion fallback behaves exactly as before.
 #                      Every backend words its refusal differently, so this is config, never a
 #                      vendor string baked into fleetd itself.
-#                      DEFERRED: compiled once into a startup pattern map — editing it needs a
-#                      daemon restart, same as this profile's model/baseUrl/argv.
+#                      HOT (fleetd #446): read live, cached by profile name, at every
+#                      completion-fallback check AND by fleet_profiles' exhaustionDetectionArmed —
+#                      editing it and reloading arms or disarms usage-limit detection for this
+#                      profile with no daemon restart. (Before fleetd #446 this was DEFERRED,
+#                      compiled once into a startup pattern map like model/baseUrl/argv still are —
+#                      see errorPattern below, which is still deferred that way on purpose.)
 #   credentialId     → CB-578 stage B: the credential this profile quarantines WITH when a
 #                      BACKEND_EXHAUSTED classification fires. Two profiles that set the SAME
 #                      credentialId share one quarantine — the case this exists for is two models
@@ -219,8 +231,9 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      happens, just without a profile-specific match; every backend words its
 #                      failure differently, so a hardcoded sentence would only ever match one
 #                      of them.
-#                      DEFERRED: compiled once into a startup pattern map, same as exhaustedPattern
-#                      — editing it needs a daemon restart.
+#                      DEFERRED: compiled once into a startup pattern map — editing it needs a
+#                      daemon restart. Unlike exhaustedPattern above (made hot by fleetd #446),
+#                      errorPattern was scoped out of that ticket on purpose and stays deferred.
 #                      # errorPattern: "503 Service Unavailable"   # opt-in: classify a backend outage
 #
 #                      What happens once a match fires (BackendOutagePolicy, credentialId-keyed,
@@ -439,6 +452,15 @@ placement: weighted
 # seconds, before a spawn may land on it again. Applies to every profile's effective credential
 # (its own name, or its credentialId if set above) — there is no per-profile override. Default
 # 1800 (30 minutes) when omitted or non-positive.
+#
+# fleetd #466: this is now only the BASE of an escalating backoff, not a flat retry rate. A
+# credential quarantined again within one base cooldown of the previous quarantine ending (still
+# reporting exhausted — e.g. a weekly subscription limit that hasn't reset) backs off further:
+# cooldown doubles each such time, capped at 12x this value (~6 hours at the 1800s default). A
+# quarantine that starts after a base-cooldown's worth of quiet resets back to this value. Not
+# configurable per se — the multiplier and ceiling are constants in BackendQuarantine, not new
+# YAML keys; see its class doc for the exact formula and why there is no automatic probe to clear
+# it early (the operator's own design constraint — a probe spends the quota it's measuring).
 # DEFERRED: baked once into the BackendQuarantine built at startup — a running quarantine keeps
 # its original cooldown regardless; a new value only applies to a quarantine that starts after a
 # restart. Editing this needs a daemon restart to take effect.
@@ -460,9 +482,10 @@ placement: weighted
 # when the reload happens — not about how important the key is:
 #   HOT       → takes effect on the next spawn: the whole `fleet:` block (every role pool,
 #               `charters`, and `tabLabel`), `placement:`, and an existing profile's weight / maxLoad
-#               / credentialId. Those are hot because the placement policy (and, for credentialId,
-#               the CB-578 stage B quarantine check) reads them through a supplier — being config is
-#               not by itself enough to make a key hot.
+#               / credentialId / exhaustedPattern. Those are hot because the placement policy (and,
+#               for credentialId, the CB-578 stage B quarantine check; for exhaustedPattern, fleetd
+#               #446's LiveExhaustedPatterns) reads them through a supplier — being config is not by
+#               itself enough to make a key hot.
 #               EXCEPT `fleet.leaders`: Fleetd.main reads it once at startup to build the lead tab
 #               scanner and launcher, and neither is rebuilt on reload. A changed/added/removed
 #               `fleet.leaders` entry is silently accepted — the reload reports "config reloaded"
@@ -474,10 +497,10 @@ placement: weighted
 #               stage B — baked once into the quarantine tracker built at startup), ADDING or
 #               REMOVING a profile (a new backend needs its own launcher, and launchers are built
 #               once), AND an existing profile's launch settings — model, baseUrl, argv, env,
-#               configDir, mcpUrl, tabLabel, exhaustedPattern, errorPattern (fleetd #201 / #227 —
-#               compiled once into a startup pattern map the same way exhaustedPattern is). The
-#               launcher takes a copy of `profiles:` at startup and resolves every spawn out of
-#               that copy, so those never
+#               configDir, mcpUrl, tabLabel, errorPattern (fleetd #201 / #227 — compiled once into
+#               a startup pattern map; exhaustedPattern used to be compiled the same way until
+#               fleetd #446 made it hot — see above). The launcher takes a copy of `profiles:` at
+#               startup and resolves every spawn out of that copy, so those never
 #               reach a launch until you restart. The reload logs them by name rather than
 #               pretending they applied.
 #   COLD      → cannot change at all: `bind:`, `herdrSocket:`, `broker:` and `auth:`. The socket is
@@ -774,6 +797,19 @@ guard:
 # so fleetd falls back to the weaker CB-596 sentinel overlay instead (a WARN names the gap).
 # worktreeGroup: fleet-workers
 
+# fleetd #362: a directory of skill folders (each a subdirectory holding a SKILL.md, the same
+# shape as this repo's own .claude/skills/) copied into every PROVISIONED worktree's
+# .claude/skills/, so a member spawned against ANY repo — not only one that already ships its own
+# copy — can load a bridge skill (e.g. implementer). Unset (the default): no worktree is touched
+# beyond today's behaviour. A skill folder the target repo already carries under
+# .claude/skills/<name> is never overwritten — the repo's own copy always wins. Claude Code
+# members only; an opencode member reads a different path (.opencode/agent) this key does not
+# touch. Best-effort like worktreeGroup above: a missing/unreadable directory here is logged and
+# skipped, never a failed spawn. Every non-hidden subdirectory of this directory is copied
+# wholesale, with no per-file allowlist — don't park scratch files or drafts alongside the real
+# skill folders, they will be copied into every provisioned worktree too.
+# memberSkills: /path/to/fleetd/checkout/.claude/skills
+
 # Session lifecycle limits (CB-303). All knobs are opt-in; omit or set to null to keep
 # the feature disabled. By default the daemon never reaps, caps, or drains sessions.
 #   idleTtlSeconds     → reap READY/DONE sessions idle longer than this (never BUSY/SPAWNING)
@@ -821,10 +857,17 @@ guard:
 #              across every daemon sharing this vhost.
 #   prefetch → consumer basicQos, capping how many unacked messages the mailbox holds in-heap.
 #              Default 32 when omitted.
+#   peers    → fleetd #361: the coord-ids of the OTHER daemons on this vhost, declared by the
+#              operator (the daemon never guesses). fleet_list reports each one's live reachability
+#              (a passive queue check, never a presence protocol) alongside this daemon's own
+#              mailbox state. Omit, or leave empty, for a daemon with no known peers yet — an
+#              undeclared peer can still reach you and be reached by fleet_send, it just will not
+#              show up as a row in fleet_list.
 # coordinator:
 #   uriEnv: LEAD_COORD_URI
 #   selfId: mac-opus
 #   prefetch: 32
+#   peers: [fleet01-lead]
 
 # Active push-to-primary (CB-307 Stage 3). When a worker reply lands with no open fleet_send,
 # the ReplyPushLoop injects a *drain nudge* (never the payload) into the primary's own herdr
@@ -849,3 +892,32 @@ guard:
 #   terminal: term_65619bd6174568
 #   pushReminders: 5
 #   pushBackoffMs: 15000
+
+# Central allow-list of models any profiles: entry may name. Nothing checked a profile's model:
+# value before this block existed — it was a free-form string handed straight to the backend
+# adapter, and a withdrawn or misspelled name failed silently instead of at config load (opencode
+# falls back to a default model rather than erroring on an unknown -m).
+#
+# Absent, or present with an empty allow:, is OFF: no profile's model: is checked, exactly like
+# before this block existed. fleetd.yaml is gitignored on every host, so an upgrade must not force
+# every operator to enumerate their models before the daemon will start.
+#
+# The list is the authority; profiles: is checked against it, never the reverse — adding or
+# editing a profiles: entry cannot, by itself, widen what is permitted here.
+#
+# Enforcement is at CONFIG LOAD only (a bad model: fails the daemon at startup, naming both the
+# model and the profile). There is no spawn-time enforcement, no runtime on/off switch, and no
+# interaction with BackendQuarantine — those are separate, later units.
+#
+#   allow → the permitted models. Each entry is its own block (not a bare string) so a later unit
+#           can add an on/off state or a load limit per model without changing this shape.
+#     model → the model id exactly as a profiles: entry's model: field would write it. One flat,
+#             opaque-string namespace: a bare Claude id (claude-sonnet-5) and an opencode
+#             provider-prefixed id (openai/gpt-5.6-terra) both fit here unchanged — the check is a
+#             plain string match, never a parse of the provider prefix or a branch on kind:.
+# models:
+#   allow:
+#     - model: claude-sonnet-5
+#     - model: claude-opus-5
+#     - model: openai/gpt-5.6-terra
+#     - model: amazon.nova-pro-v1:0

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -18,6 +18,7 @@ import dev.ltms.fleet.inject.BackendErrorSink;
 import dev.ltms.fleet.inject.CompletionResolver;
 import dev.ltms.fleet.inject.ExhaustedPatternLookup;
 import dev.ltms.fleet.inject.ExhaustionSink;
+import dev.ltms.fleet.inject.LiveExhaustedPatterns;
 import dev.ltms.fleet.inject.Injector;
 import dev.ltms.fleet.inject.StatusPoller;
 import dev.ltms.fleet.inject.TurnListener;
@@ -55,6 +56,8 @@ import dev.ltms.fleet.member.MemberCredentialPolicyView;
 import dev.ltms.fleet.member.OpenCodeLauncher;
 import dev.ltms.fleet.placement.BackendOutagePolicy;
 import dev.ltms.fleet.placement.BackendQuarantine;
+import dev.ltms.fleet.power.CaffeinateSleepAssertionMechanism;
+import dev.ltms.fleet.power.IdleSleepGuard;
 import io.javalin.Javalin;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -63,10 +66,13 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
+import java.util.TreeSet;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
@@ -75,6 +81,7 @@ import java.util.function.Function;
 import java.util.function.Predicate;
 import java.util.function.Supplier;
 import java.util.regex.Pattern;
+import java.util.stream.Collectors;
 
 /**
  * {@code fleetd} entry point. Wires the real herdr socket client to the REST app and
@@ -121,12 +128,21 @@ public final class Fleetd {
         // else can fail on a silently-empty one. A daemon started without a login shell (launchd)
         // boots fine either way — this is the only thing that says so out loud.
         reportRequiredSecrets(cfg);
+        // fleetd #377: the git host value a member receives as GITEA_HOST is often a full URL
+        // (scheme and trailing slash), not a host name. A member that assumes a bare host then
+        // builds https://https://... and the request never leaves the machine. Report the shape
+        // next to the secret report — shape only, never the value.
+        reportGitHostShape(cfg);
         reportMemberTrustModel(cfg);
         // CB-596: an absent (or empty) memberCredentials: block blocks NOTHING — no credential
         // name is hardcoded any more to fall back on. Say so loudly, the same way a missing
         // secret is reported above, so upgrading past this commit never silently drops CB-592's
         // protection.
         reportMemberCredentialsGap(cfg);
+        // fleetd #395: an unset exhaustedPattern is a silent opt-out of usage-limit detection for
+        // that profile — say so loudly, the same way the two reports above do, rather than let an
+        // operator discover it only when a limit goes undetected.
+        reportExhaustedPatternGap(cfg);
         // CB-559: `cfg` stays the startup snapshot — every validation and every piece of one-time
         // wiring below reads it, and must, because those decisions cannot be unmade. `config` is the
         // live reference the hot paths read per use. Which keys can actually move is ConfigRef's
@@ -137,19 +153,16 @@ public final class Fleetd {
         SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
         guard.assertPrimaryClean(System.getenv());
 
-        // CB-501: refuse to start if the bind is wider than the auth mode can defend. Under
-        // loopback-trust, "not a known worker" means "the primary" — sound only because the OS
-        // refuses remote connections to a loopback socket. This throws rather than warns so the
-        // dangerous configuration cannot be reached by ignoring a log line.
-        cfg.validateAuthExposure();
-        cfg.validateLeadTabPrefixes();
-        // CB-542: a subscription:true profile whose env: reseats ANTHROPIC_BASE_URL/AUTH_TOKEN would
-        // reach an unguarded endpoint (the launcher skips SubscriptionGuard for it). Refuse at load.
-        cfg.validateSubscriptionProfiles();
-        cfg.validateCharters();
-        // CB-548: every architect slot must name a configured workers: profile — the strong-model
-        // backend the future spawn lifecycle would read. A stale reference dies here, not later.
-        cfg.validateMembers();
+        // Every FleetConfig.validateXxx() the operator's config can fail — CB-501's auth-exposure
+        // check, CB-531's lead-tab-prefix check, CB-542's subscription-profile check, the charter
+        // and member-slot checks, and the "central allow-list of usable models" check — must run
+        // here, at load, before anything below opens a socket or spawns a member. fleetd ticket
+        // "central allow-list of usable models" follow-up: mutation testing found six individual
+        // calls here with nothing proving any of them still ran (deleting one left the full suite
+        // green). validateAll() replaces them with the one call that FleetConfigValidateAllTest
+        // and the Fleetd-startup tests actually pin — see FleetConfig#validateAll's javadoc for
+        // why a name-by-name list here would have the same defect it replaces.
+        cfg.validateAll();
 
         Path socket = cfg.herdrSocket() != null && !cfg.herdrSocket().isBlank()
                 ? Path.of(cfg.herdrSocket())
@@ -209,7 +222,13 @@ public final class Fleetd {
         // (checked at spawn) and the exhaustion sink wired in below (written on BACKEND_EXHAUSTED).
         // The cooldown is deferred (see FleetConfig#quarantineCooldownSeconds): it is read once
         // here, at startup, and a config reload only changes it for a daemon restart.
-        BackendQuarantine quarantine = new BackendQuarantine(System::nanoTime,
+        // fleetd #466: escalating, not flat — a credential that keeps reporting exhaustion (e.g. a
+        // weekly subscription limit, which would otherwise be retried on every ~30-minute cooldown,
+        // about 336 times across the week) backs off further each consecutive time, capped at
+        // BackendQuarantine.DEFAULT_MAX_COOLDOWN_MULTIPLE x the base cooldown. See BackendQuarantine's
+        // class doc for the mechanism, why this never fires on cooling-off (a separate, unescalated
+        // mechanism — BackendOutagePolicy below), and the reset.
+        BackendQuarantine quarantine = BackendQuarantine.withEscalation(System::nanoTime,
                 TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()));
         // fleetd #201 Unit 5: one outage-cool-off tracker for the whole daemon, shared between the
         // launcher (checked at spawn, like `quarantine` above) and the backend-error sink wired in
@@ -223,6 +242,13 @@ public final class Fleetd {
                 profileName -> liveCountRef.get().apply(profileName),
                 quarantine,
                 outagePolicy);
+        // fleetd #422 follow-up: say which of the three model-gate states the daemon booted into —
+        // no models: block at all, a block armed with nothing off, or a block with N off — the same
+        // way exhaustedPatternCoverageLine/errorPatternCoverageLine report CB-578 stage A/fleetd
+        // #201 Unit 5 coverage just below. Read from workers.modelGateState() (never a separate
+        // config.get().models() here) so this line and fleet_profiles' modelGateArmed can never
+        // disagree about what CompositePeerLauncher's spawn gate actually enforces.
+        log.info("model gate (fleetd #422): {}", modelGateCoverageLine(workers.modelGateState()));
         // CB-504: under supervision (launchd/systemd) fleetd can start before herdr's socket
         // exists. The client itself is lazy — it connects per call — but the orphan reap below is
         // the first thing that actually talks to herdr, so without this wait a boot-order race
@@ -248,10 +274,31 @@ public final class Fleetd {
             contextCap = cfg.lifecycle().contextCap();
         }
         boolean clearAfterTurn = cfg.lifecycle() != null && cfg.lifecycle().clearAfterTurn();
-        SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot(), cfg.worktreeGroup()),
+        SessionManager sessions = new SessionManager(workers,
+                new GitWorktrees(cfg.worktreeRoot(), cfg.worktreeGroup(), cfg.memberSkills()),
                 System::nanoTime, contextCap, clearAfterTurn);
         liveCountRef.set(profileName -> liveSessionCount(sessions.roster(), profileName));
 
+        // Idle-sleep guard: hold an OS-level assertion against idle sleep while at least one
+        // member is live, so an unattended host does not idle-sleep out from under a member's
+        // long turn (see FleetConfig.IdleSleepGuard / dev.ltms.fleet.power.IdleSleepGuard for the
+        // measurement that motivated this). Opt-out via idleSleepGuard.enabled: false; on by
+        // default. Hangs off SessionManager's own onAcquire/onRelease hooks (CB-520/CB-516,
+        // previously wired only to the reply inbox) and SessionManager#size() — the exact registry
+        // fleet_list's live/capacity numbers are themselves computed from — rather than tracking
+        // members a second way. No-op (never constructed) off macOS or when idleSleepGuard.enabled
+        // is explicitly false; the mechanism itself is additionally a no-op if 'caffeinate' cannot
+        // be started, so this can never fail a spawn, a release, or startup.
+        boolean idleSleepGuardEnabled = cfg.idleSleepGuard() == null || cfg.idleSleepGuard().isEnabled();
+        final IdleSleepGuard idleSleepGuard;
+        if (idleSleepGuardEnabled) {
+            idleSleepGuard = new IdleSleepGuard(new CaffeinateSleepAssertionMechanism(), sessions::size);
+            sessions.onAcquire(_ -> idleSleepGuard.recheck());
+            sessions.onRelease(_ -> idleSleepGuard.recheck());
+        } else {
+            idleSleepGuard = null;
+        }
+
         // CB-303 part 1: idle-ttl reaper — only when configured, defaults to disabled.
         final SessionReaper reaper;
         if (cfg.lifecycle() != null
@@ -323,7 +370,11 @@ public final class Fleetd {
         // pane resolves to an architect until the later spawn lifecycle binds one. The registry is
         // what CallerResolver resolves against and what that lifecycle will read profiles from;
         // nothing here spawns a slot.
-        MemberRegistry members = new MemberRegistry(cfg.fleet());
+        // fleetd #424: MemberRegistry.live re-reads fleet.architects through `config` on every
+        // reserve/requireSlotFor call, so a reload that removes or adds an architect slot governs
+        // the next spawn with no restart — the frozen `new MemberRegistry(cfg.fleet())` this used
+        // to be let a "revoked" slot keep granting new architect spawns forever.
+        MemberRegistry members = MemberRegistry.live(() -> config.get().fleet());
         sessions.setMemberLifecycle(members);
         if (!members.slots().isEmpty()) {
             log.info("member slots: {} configured {} — none bound yet (a slot is idle until the "
@@ -337,29 +388,34 @@ public final class Fleetd {
         Rendezvous rendezvous = new Rendezvous();
         // CB-578 stage A: classify a completion-fallback scrape that matches a profile's configured
         // usage-limit refusal as BACKEND_EXHAUSTED rather than handing it back as a real answer.
-        // Compiled once at startup, keyed by profile name; a profile with no exhaustedPattern is
-        // simply absent here, so its workers keep today's completion-fallback behaviour unchanged.
-        Map<String, Pattern> exhaustedPatternsByProfile = new LinkedHashMap<>();
-        cfg.profiles().forEach((name, profile) -> {
-            if (profile.hasExhaustedPattern()) {
-                exhaustedPatternsByProfile.put(name, Pattern.compile(profile.exhaustedPattern()));
-            }
-        });
+        // fleetd #446: read live off `config` per lookup, cached by profile name — see
+        // LiveExhaustedPatterns's class doc for why this replaces the old compiled-once-at-startup
+        // map. A profile with no exhaustedPattern simply returns null here, so its workers keep
+        // today's completion-fallback behaviour unchanged.
+        LiveExhaustedPatterns liveExhaustedPatterns = new LiveExhaustedPatterns(() -> config.get().profiles());
         ExhaustedPatternLookup exhaustedPatterns = target -> sessions.roster().stream()
                 .filter(session -> target.equals(session.terminalId()))
                 .findFirst()
-                .map(session -> exhaustedPatternsByProfile.get(session.profile()))
+                .map(session -> liveExhaustedPatterns.patternFor(session.profile()))
                 .orElse(null);
+        // The startup coverage line still reports the boot-time snapshot only — it is printed once,
+        // here, and a reload no longer needs to change what it said; exhaustionDetectionArmed (via
+        // liveExhaustedPatterns.armed, wired into quarantineSource below) is what stays live.
+        Set<String> exhaustedConfiguredAtStartup = cfg.profiles().entrySet().stream()
+                .filter(e -> e.getValue().hasExhaustedPattern())
+                .map(Map.Entry::getKey)
+                .collect(Collectors.toCollection(LinkedHashSet::new));
         log.info("backend-exhausted classification (CB-578 stage A): {}",
-                CompletionResolver.coverage("exhaustedPattern", cfg.profiles().keySet(),
-                        exhaustedPatternsByProfile.keySet()));
+                exhaustedPatternCoverageLine(cfg.profiles().keySet(), exhaustedConfiguredAtStartup));
         // fleetd #201 Unit 5: classify a completion-fallback scrape that matches a profile's
         // configured backend-error refusal (a credential outage, a provider 5xx) as a backend error
-        // rather than handing it back as a real answer. Compiled once at startup, keyed by profile
-        // name, mirroring exhaustedPatternsByProfile above — a profile with no configured
-        // errorPattern is simply absent here, so CompletionResolver falls back to its built-in
-        // narrow {@code (?i)\bAPI Error\s*:} compatibility pattern for that profile's targets
-        // (BackendErrorPatternLookup#legacy's contract — see backendErrorPatterns below).
+        // rather than handing it back as a real answer. Still compiled once at startup, keyed by
+        // profile name — unlike exhaustedPattern above (fleetd #446), errorPattern was left DEFERRED
+        // on purpose: the ticket that made exhaustedPattern hot scoped errorPattern/cooling-off out
+        // explicitly. A profile with no configured errorPattern is simply absent here, so
+        // CompletionResolver falls back to its built-in narrow {@code (?i)\bAPI Error\s*:}
+        // compatibility pattern for that profile's targets (BackendErrorPatternLookup#legacy's
+        // contract — see backendErrorPatterns below).
         Map<String, Pattern> errorPatternsByProfile = new LinkedHashMap<>();
         cfg.profiles().forEach((name, profile) -> {
             if (profile.hasErrorPattern()) {
@@ -372,52 +428,25 @@ public final class Fleetd {
         BackendErrorPatternLookup backendErrorPatterns = backendErrorPatternLookup(sessions::roster,
                 errorPatternsByProfile);
         log.info("backend-error classification (fleetd #201 Unit 5): {}",
-                CompletionResolver.coverage("errorPattern", cfg.profiles().keySet(),
-                        errorPatternsByProfile.keySet()));
+                errorPatternCoverageLine(cfg.profiles().keySet(), errorPatternsByProfile.keySet()));
         // CB-578 stage B: on a classification that actually wins, quarantine the exhausted profile's
         // CREDENTIAL — not the profile name — so a profile sharing that credential (e.g. two models
         // on one OpenAI account) is refused too, not just the one that happened to report it. Reads
         // the profile config live off `config`, so a credentialId edit is hot: no restart needed.
-        //
-        // fleetd #175: this sink is now also the quarantine target for OpenCodeLauncher's
-        // model-mismatch check — it needs nothing profile-specific from the caller beyond `target`
-        // (a herdr terminal id) and `reason`, so reusing it here is exactly "the existing
-        // ExhaustionSink path", not a new mechanism.
-        //
-        // fleetd #234: that check fires from SessionAwareHandle.agentSessionId(), which runs during
-        // SessionManager.acquire() BEFORE this session is registered in sessions.roster() — so the
-        // roster-only lookup below used to find nothing, .ifPresent silently no-op'd, and the
-        // ERROR the check had just logged ("quarantining this profile's credential") was a lie:
-        // nothing was quarantined, and nothing said so. Two changes: (1) OpenCodeLauncher now
-        // passes its OWN profile name via ExhaustionSink's 3-arg overload — it already has the
-        // FleetConfig.Profile in hand and does not need the roster at all — used here as a
-        // fallback whenever the roster lookup misses; (2) if a profile still cannot be resolved
-        // (neither the roster nor the hint names a configured one), this logs loudly at ERROR
-        // instead of silently doing nothing — a control that cannot act must say so.
-        // fleetd #234, round 4: the 3-arg overload is now ExhaustionSink's single abstract method,
-        // so this is safely a lambda — there is no separate 2-arg overload left for it to bind to
-        // instead and silently drop profileHint (that was rounds 1-3's whole hazard).
-        ExhaustionSink exhaustionSink = (target, reason, profileHint) -> {
-            String profileName = sessions.roster().stream()
-                    .filter(session -> target.equals(session.terminalId()))
-                    .findFirst()
-                    .map(MemberSession::profile)
-                    .orElse(profileHint);
-            FleetConfig.Profile profile = profileName == null ? null : config.get().profiles().get(profileName);
-            if (profile == null) {
-                log.error("quarantine requested for target '{}' ({}) but no profile could be "
-                                + "resolved — the target is not (yet) in the roster, and {} — "
-                                + "credential NOT quarantined (fleetd #234)",
-                        target, reason,
-                        profileHint == null ? "no profile hint was given"
-                                : "the hinted profile '" + profileHint + "' is not configured");
-                return;
-            }
-            String credentialId = profile.effectiveCredentialId();
-            quarantine.quarantine(credentialId);
-            log.warn("credential '{}' quarantined for {}s (profile '{}'): {}", credentialId,
-                    cfg.quarantineCooldownSeconds(), profile.profile(), reason);
-        };
+        // fleetd #446 criterion 3: the backend text that triggered the most recent quarantine of
+        // each credential, so fleet_profiles can report WHY a limit was hit, not only that it was.
+        // Keyed by credential id — the same key BackendQuarantine's own remainingSeconds uses —
+        // and written at the one call site that actually quarantines (inside exhaustionSink below),
+        // so a reason can never be reported for a quarantine that never happened. Bounded the same
+        // way BackendQuarantine's own internal map is documented to be: by the number of distinct
+        // credentials ever exhausted, not by how often the config is edited.
+        Map<String, String> quarantineReasonByCredential = new ConcurrentHashMap<>();
+        // fleetd #446 follow-up (round 3): extracted into exhaustionSink(...) below — see that
+        // method's javadoc for the full fleetd #175/#234/#446 history this used to carry inline —
+        // so a dedicated test can drive the exact ExhaustionSink main() builds, not a hand-rebuilt
+        // copy of its shape.
+        ExhaustionSink exhaustionSink = exhaustionSink(sessions, config, quarantine,
+                quarantineReasonByCredential, cfg);
         // fleetd #175: point the forwarding sink handed to OpenCodeLauncher above at the real one,
         // now that `sessions` exists to resolve target -> session -> profile.
         exhaustionSinkRef.set(exhaustionSink);
@@ -556,8 +585,12 @@ public final class Fleetd {
         if (cfg.health() != null && cfg.health().isEnabled()) {
             // CB-580: a member found GONE/NEVER_READY must fail whatever ticket is waiting on it,
             // through the same idempotent target-wide operation CB-516 already uses on release.
+            // fleetd #386: System::nanoTime freezes across a macOS sleep, so the stall check also
+            // gets a wall-clock source to detect and correct for that freeze. Every other decision
+            // in FleetHealthMonitor stays on the monotonic clock, unchanged.
             healthMonitor = new FleetHealthMonitor(agents, sessions::roster, messages, healthScheduler,
-                    System::nanoTime, cfg.health().intervalOrDefault(),
+                    System::nanoTime, () -> TimeUnit.MILLISECONDS.toNanos(System.currentTimeMillis()),
+                    cfg.health().intervalOrDefault(),
                     cfg.health().workingSuspectAfterOrDefault(), messages::abandon);
             String coverage = FleetHealthMonitor.coverage(true,
                     cfg.health().notifications() != null && cfg.health().notifications().configured());
@@ -629,21 +662,16 @@ public final class Fleetd {
         // built a second time — two independently-constructed sources reading the SAME BackendQuarantine
         // / BackendOutagePolicy would still be able to drift (e.g. a future edit to the credentialIdFor
         // closure in only one of the two places), exactly the shape #284 was.
-        FleetMcp.QuarantineSource quarantineSource = new FleetMcp.QuarantineSource(profile -> {
-            var configured = config.get().profiles().get(profile);
-            return configured == null ? null : configured.effectiveCredentialId();
-        }, quarantine);
+        FleetMcp.QuarantineSource quarantineSource = quarantineSource(config, quarantine,
+                liveExhaustedPatterns, quarantineReasonByCredential);
         FleetMcp.OutageSource outageSource = new FleetMcp.OutageSource(profile -> {
             var configured = config.get().profiles().get(profile);
             return configured == null ? null : configured.effectiveCredentialId();
         }, outagePolicy);
 
         FleetMcp mcp = new FleetMcp(messages, workers, sessions, identity, presence,
-                primaryRegistry, callers, metrics, new FleetMcp.CapacitySource(profile -> liveCountRef.get().apply(profile),
-                profile -> {
-                    var configured = config.get().profiles().get(profile);
-                    return configured == null ? null : configured.maxLoad();
-                }, () -> config.get().profiles().keySet(), System::nanoTime),
+                primaryRegistry, callers, metrics,
+                capacitySource(config, cfg, profile -> liveCountRef.get().apply(profile)),
                 new FleetMcp.HealthCoverageSource(() -> {
                     var health = config.get().health();
                     return FleetHealthMonitor.coverage(health != null && health.isEnabled(),
@@ -652,7 +680,12 @@ public final class Fleetd {
                 quarantineSource,
                 leadMailbox,
                 outageSource,
-                new FleetMcp.LeadSeatSource(leadSeatLookup(() -> config.get().profiles(), leaders, leads)));
+                new FleetMcp.LeadSeatSource(leadSeatLookup(() -> config.get().profiles(), leaders, leads)),
+                // fleetd #361: the operator-declared peers this daemon's fleet_list should try to
+                // reach. Read from the SAME snapshot leadMailbox itself opened from (cfg.coordinator()),
+                // not the live config.get() — coordinator wiring is already boot-time-fixed (see
+                // leadMailbox above), so peers follows the same rule rather than half hot-reloading.
+                cfg.coordinator() == null ? List.of() : cfg.coordinator().peers());
 
         // CB-637: the receive half. Only constructed when a lead mailbox actually opened — with no
         // coordinator (or an unreachable one) there is nothing to deliver, so no scheduler is
@@ -698,6 +731,11 @@ public final class Fleetd {
             if (configWatcher != null) configWatcher.stop(); // CB-559: stop polling the config file
             mcp.close();
             if (reaper != null) reaper.stop();
+            // Idle-sleep guard: release unconditionally, even though sessions.close() above already
+            // drained every session (and each release already drove the live count to 0, which
+            // releases the guard's assertion on its own) — this is the backstop for a drain that was
+            // itself interrupted or threw, so no caffeinate child ever outlives the daemon.
+            if (idleSleepGuard != null) idleSleepGuard.close();
             // Release the broker connection last among message resources (no-op for the in-memory inbox).
             if (replyInbox instanceof AutoCloseable closeable) {
                 try {
@@ -756,6 +794,223 @@ public final class Fleetd {
         return target -> presence.isPresent(target) || leads.get().containsKey(target);
     }
 
+    /**
+     * fleetd #446 follow-up (round 3): the quarantine {@link ExhaustionSink} main() actually wires
+     * — extracted out of {@code main} for the same reason {@link #quarantineSource} below and
+     * {@link #usageLimitFixWarning}/{@link #usageLimitFixWarningNoModel} were. Round 2 pinned the
+     * WARNING text by having {@code FleetdUsageLimitFixWarningTest} call those two methods
+     * directly, but a mutation battery proved that left two gaps: nothing proved this sink's
+     * {@code log.warn} call actually uses either method (replacing the whole ternary with a
+     * literal string), and nothing proved it picks the right one for a profile WITH a configured
+     * {@code model:} versus one WITHOUT (swapping the ternary's two branches) — both mutations
+     * left round 2's full 1592-test suite green. {@code FleetdExhaustionSinkWarningTest} drives
+     * THIS factory's return value directly and asserts on the real text a {@code ListAppender}
+     * attached to this class's own logger captures — the only way to prove the caller, not just
+     * the two callees in isolation.
+     *
+     * <p>Behaviourally unchanged from the inline lambda this replaces:
+     * <ul>
+     *   <li>fleetd #175: also the quarantine target for {@code OpenCodeLauncher}'s model-mismatch
+     *       check — it needs nothing profile-specific beyond {@code target}/{@code reason}, so
+     *       reusing this sink is the existing {@code ExhaustionSink} path, not a new mechanism;</li>
+     *   <li>fleetd #234 (round 4): resolves {@code target} to a profile via the live session
+     *       roster first, falling back to {@code profileHint} — {@code
+     *       SessionAwareHandle.agentSessionId()} fires this sink during {@code
+     *       SessionManager.acquire()}, <em>before</em> that session is registered, so the
+     *       roster-only lookup alone used to silently miss it. A profile resolved neither way
+     *       logs loudly at ERROR instead of doing nothing;</li>
+     *   <li>fleetd #446 criterion 3: writes {@code quarantineReasonByCredential} at the one call
+     *       site that actually quarantines, keyed by credential id — see the field's declaration
+     *       in {@code main} for the bound on its size.</li>
+     * </ul>
+     *
+     * <p>{@code cfg} is the startup {@link FleetConfig} snapshot, read only for {@code
+     * quarantineCooldownSeconds()} in the log text — a Cold key (see {@code ConfigRef}'s class
+     * doc), so reading it off the snapshot rather than {@code config.get()} makes no observable
+     * difference and matches what the inline version already did.
+     */
+    static ExhaustionSink exhaustionSink(SessionManager sessions, ConfigRef config, BackendQuarantine quarantine,
+            Map<String, String> quarantineReasonByCredential, FleetConfig cfg) {
+        return (target, reason, profileHint) -> {
+            String profileName = sessions.roster().stream()
+                    .filter(session -> target.equals(session.terminalId()))
+                    .findFirst()
+                    .map(MemberSession::profile)
+                    .orElse(profileHint);
+            FleetConfig.Profile profile = profileName == null ? null : config.get().profiles().get(profileName);
+            if (profile == null) {
+                log.error("quarantine requested for target '{}' ({}) but no profile could be "
+                                + "resolved — the target is not (yet) in the roster, and {} — "
+                                + "credential NOT quarantined (fleetd #234)",
+                        target, reason,
+                        profileHint == null ? "no profile hint was given"
+                                : "the hinted profile '" + profileHint + "' is not configured");
+                return;
+            }
+            String credentialId = profile.effectiveCredentialId();
+            quarantine.quarantine(credentialId);
+            quarantineReasonByCredential.put(credentialId, reason);
+            log.warn("credential '{}' quarantined for {}s (profile '{}'): {}", credentialId,
+                    cfg.quarantineCooldownSeconds(), profile.profile(), reason);
+            // fleetd #446 criterion 2: name the fix, not just the fact — an operator reading this
+            // should not have to work out which of several configured models to touch.
+            String model = profile.model();
+            log.warn(model != null && !model.isBlank()
+                    ? usageLimitFixWarning(profile.profile(), model)
+                    : usageLimitFixWarningNoModel(profile.profile(), cfg.quarantineCooldownSeconds()));
+        };
+    }
+
+    /**
+     * fleetd #404, superseded by fleetd #446: production source for quarantine reporting.
+     * Credential IDs were already hot; {@code exhaustedPattern} used to be compiled once at
+     * startup for {@link CompletionResolver}, so the armed field had to read that same frozen map
+     * until restart — the exact asymmetry #446 exists to close. Both {@code exhaustedPatternArmed}
+     * here and {@link CompletionResolver}'s own classification now read the ONE live {@link
+     * LiveExhaustedPatterns} instance ({@code exhaustedPatterns.armed}/{@code .patternFor}), so a
+     * reload that arms or disarms a profile's detection is visible to both at once — never two
+     * independently-updated copies that could disagree, the fleetd #404 rule this method used to
+     * violate on purpose and now upholds.
+     *
+     * <p>{@code modelFor} and {@code reasonFor} back fleetd #446 criterion 3 — {@code
+     * fleet_profiles}'s quarantined row naming which model a quarantined profile runs
+     * ({@code modelFor}, read live off {@code config} the same way {@code credentialIdFor} already
+     * is) and the backend text that triggered the most recent quarantine of that credential
+     * ({@code reasonFor}, backed by {@code reasonByCredential} — see its call site in {@code main}
+     * for where that map is written, at the one place a credential is actually quarantined).
+     */
+    static FleetMcp.QuarantineSource quarantineSource(ConfigRef config, BackendQuarantine quarantine,
+            LiveExhaustedPatterns exhaustedPatterns, Map<String, String> reasonByCredential) {
+        return new FleetMcp.QuarantineSource(profile -> {
+            var configured = config.get().profiles().get(profile);
+            return configured == null ? null : configured.effectiveCredentialId();
+        }, quarantine, exhaustedPatterns::armed, profile -> {
+            var configured = config.get().profiles().get(profile);
+            return configured == null ? null : configured.model();
+        }, reasonByCredential::get);
+    }
+
+    /**
+     * fleetd #415 (review follow-up): package-private factory for the CB-578 stage A {@code
+     * exhaustedPattern} startup coverage line, paired explicitly with {@link
+     * CompletionResolver.UnsetMeaning#OFF} — {@code exhaustedPattern} has no fallback, so a
+     * profile with none configured really does have the classification off.
+     *
+     * <p>Extracted out of {@code main} for the same reason {@link #capacitySource} and {@link
+     * #worktreeBranchLookup} were: {@code coverage()}'s own tests ({@code CompletionResolverTest})
+     * prove it words {@code OFF} and {@link CompletionResolver.UnsetMeaning#BUILT_IN_DEFAULT}
+     * correctly when a test supplies the meaning itself — they cannot prove {@code main} pairs the
+     * right meaning with the right key, which is the actual fleetd #415 defect. <b>Measured:</b>
+     * swapping the {@code UnsetMeaning} arguments between this method and {@link
+     * #errorPatternCoverageLine} — recreating #415's defect with the two keys exchanged — compiled
+     * with 0 errors and left all 1506 existing tests green before {@code
+     * FleetdPatternCoverageLineTest} was added to catch exactly that swap.
+     */
+    /**
+     * fleetd #446 follow-up: the criterion-2 WARNING text — "name the fix, not just the fact" —
+     * for a profile whose {@code model:} is configured. Extracted out of the {@code
+     * exhaustionSink} lambda the same way {@link #exhaustedPatternCoverageLine} was extracted out
+     * of {@code main}: the inline version compiled, ran, and read correctly, but nothing pinned
+     * its text, so a later edit could silently stop naming the fix and every test would stay
+     * green (measured: renaming the leading {@code "usage-limit fix:"} tag left all 1586
+     * pre-follow-up tests passing). {@link FleetdUsageLimitFixWarningTest} asserts on the return
+     * value of this method directly, which is exactly what the caller logs — {@code log.warn} is
+     * called with this method's result as a single, already-formatted argument, so the string a
+     * test sees here is byte-identical to what {@code fleetd.out} receives.
+     *
+     * <p>Deliberately asserts on three substrings, not the whole sentence (the profile name, the
+     * model name, and the literal {@code enabled: false} / {@code models.allow} action) — see that
+     * test's class doc for why a whole-sentence pin is the wrong granularity here.
+     */
+    static String usageLimitFixWarning(String profile, String model) {
+        return "usage-limit fix: profile '" + profile + "' runs model '" + model + "' — set "
+                + "`enabled: false` on that model's entry under models.allow in fleetd.yaml to "
+                + "stop new spawns landing on it (models: is hot, no restart needed); remove the "
+                + "line again once the subscription window resets";
+    }
+
+    /**
+     * fleetd #446 follow-up: the {@link #usageLimitFixWarning} counterpart for a profile with no
+     * {@code model:} configured — {@code models.allow} gates by model name, so there is nothing
+     * for an operator to flip, and this says so instead of naming a fix that does not exist.
+     */
+    static String usageLimitFixWarningNoModel(String profile, Integer quarantineCooldownSeconds) {
+        return "usage-limit fix: profile '" + profile + "' has no model: configured, so "
+                + "models.allow cannot gate it by name — the " + quarantineCooldownSeconds
+                + "s quarantine above is the only thing keeping new spawns off it for now";
+    }
+
+    static String exhaustedPatternCoverageLine(Set<String> allProfiles, Set<String> configuredProfiles) {
+        return CompletionResolver.coverage("exhaustedPattern", CompletionResolver.UnsetMeaning.OFF,
+                allProfiles, configuredProfiles);
+    }
+
+    /**
+     * fleetd #415 (review follow-up): the {@code errorPattern} counterpart of {@link
+     * #exhaustedPatternCoverageLine}, paired explicitly with {@link
+     * CompletionResolver.UnsetMeaning#BUILT_IN_DEFAULT} — an unset {@code errorPattern} still runs
+     * backend-error classification against {@code CompletionResolver}'s built-in {@code
+     * BACKEND_ERROR} pattern, so the empty case is not "off". See {@link
+     * #exhaustedPatternCoverageLine}'s javadoc for the measured swap mutation this pairing guards
+     * against.
+     */
+    static String errorPatternCoverageLine(Set<String> allProfiles, Set<String> configuredProfiles) {
+        return CompletionResolver.coverage("errorPattern", CompletionResolver.UnsetMeaning.BUILT_IN_DEFAULT,
+                allProfiles, configuredProfiles);
+    }
+
+    /**
+     * fleetd #422 follow-up: package-private factory for the startup line reporting which of the
+     * three central {@code models.allow:} gate states the daemon booted into. Extracted the same
+     * way {@link #exhaustedPatternCoverageLine}/{@link #errorPatternCoverageLine} are, so a
+     * dedicated test can call it directly rather than parsing log output, and so {@code main}'s
+     * only source for this line is {@link PeerLauncher#modelGateState()} — never a second,
+     * independently-derived read of {@code cfg.models()} that could disagree with what {@code
+     * CompositePeerLauncher}'s spawn gate actually enforces (the fleetd #404 lesson).
+     *
+     * <p>Unlike the two pattern-key lines above, there is no {@code UnsetMeaning} choice to make
+     * here: {@link PeerLauncher.ModelGateState#configured()} already states, unambiguously, whether
+     * an empty {@link PeerLauncher.ModelGateState#off()} means "no {@code models:} block to gate
+     * with" or "a block armed and currently reporting zero off" — the exact two states a bare
+     * {@code disabledModels()} read could not tell apart before this ticket.
+     */
+    static String modelGateCoverageLine(PeerLauncher.ModelGateState state) {
+        if (!state.configured()) {
+            return "not configured (no models: block — nothing is gated, and nothing can be)";
+        }
+        Set<String> off = state.off();
+        return off.isEmpty()
+                ? "armed (models: block present; 0 models currently turned off)"
+                : "armed (" + off.size() + " model(s) turned off: " + new TreeSet<>(off) + ")";
+    }
+
+    /**
+     * fleetd #416: production source for {@code fleet_list}'s per-profile capacity facts.
+     *
+     * <p>The profile <em>set</em> ({@code configuredProfiles}) must come from {@code cfg} — the
+     * startup snapshot — not the live {@code config.get()}. {@code profiles} as a whole is a
+     * {@code DEFERRED} key ({@link ConfigRef#DEFERRED_KEYS}): {@code HerdrPeerLauncher} takes
+     * {@code Map.copyOf(profiles)} once at construction and a profile only added to the
+     * hot-reloaded map can never actually be spawned, so enumerating it live made {@code fleet_list}
+     * report a profile as available when {@code fleet_spawn} on that same profile fails with
+     * {@code unknown worker profile}. {@code fleet_list}'s own contract for {@code free} is "the
+     * same check the spawn gate itself runs" — the set the spawn gate can see is the startup one,
+     * so this must enumerate that one too, the same shape as {@code coordinator.peers} above.
+     *
+     * <p>{@code maxLoad} stays live on purpose: it is read off {@code config.get()} exactly like
+     * {@code credentialId} ({@link ConfigRef} documents both as hot), so an existing profile's
+     * {@code maxLoad} edit must still change what {@code fleet_list} reports without a restart.
+     */
+    static FleetMcp.CapacitySource capacitySource(ConfigRef config, FleetConfig cfg,
+            Function<String, Integer> liveCount) {
+        return new FleetMcp.CapacitySource(liveCount,
+                profile -> {
+                    var configured = config.get().profiles().get(profile);
+                    return configured == null ? null : configured.maxLoad();
+                },
+                cfg.profiles()::keySet, System::nanoTime);
+    }
+
     /**
      * fleetd #248: package-private factory for the member worktree/branch lookup {@link
      * CompletionResolver} uses to name a fallback report's worktree and branch (fleetd#241).
@@ -1162,6 +1417,76 @@ public final class Fleetd {
         });
     }
 
+    /**
+     * fleetd #377: the env var names holding the git host value that members receive as
+     * {@code GITEA_HOST}. {@code HerdrPeerLauncher.applyGitToken} injects {@code GITEA_HOST}
+     * only for profiles that opted in via {@code gitTokenEnv} (CB-302), reading the value from
+     * that profile's {@code gitHostEnv} (default {@code GITEA_HOST}), so the shape only matters
+     * where a git token is opted in. A var used by more than one profile is one entry naming
+     * every profile that reads it, the same shape as {@link #requiredSecretEnvVars}.
+     *
+     * <p>Package-private and pure (no I/O, no logging) so the derivation is unit-testable
+     * without capturing log output; {@link #reportGitHostShape(FleetConfig)} is the logging caller.
+     */
+    static Map<String, List<String>> gitHostEnvVars(FleetConfig cfg) {
+        Map<String, List<String>> hostsBy = new LinkedHashMap<>();
+        cfg.profiles().forEach((name, profile) -> {
+            if (profile.hasGitToken()) {
+                hostsBy.computeIfAbsent(profile.gitHostEnv(), _ -> new ArrayList<>())
+                        .add("profile '" + name + "' gitHostEnv");
+            }
+        });
+        return hostsBy;
+    }
+
+    /**
+     * True when the value already starts with a URI scheme ({@code https://...}, {@code
+     * http://...}). A bare host name and a host:port must both report {@code false} — the shape
+     * this ticket exists for is a value that <em>looks like</em> a host but is a full URL, and
+     * confusing those in the report would move the failure to the log instead of the network.
+     */
+    static boolean startsWithScheme(String value) {
+        return value.matches("[A-Za-z][A-Za-z0-9+.-]*://.*");
+    }
+
+    /**
+     * fleetd #377: log, on the same startup path as {@link #reportRequiredSecrets}, the SHAPE of
+     * each git host value that members receive as {@code GITEA_HOST}: set or unset, its length,
+     * whether it starts with a scheme, whether it ends with a slash. Never the value itself — the
+     * same discipline as {@link #reportRequiredSecrets}, which logs by name only. Either shape is
+     * legitimate: the value is passed to members unchanged, and a line that quietly rewrites it
+     * would change what works on one host and breaks on another. The shape line only tells the
+     * operator which URL form to expect from a member that builds on {@code GITEA_HOST}. An
+     * unset variable is logged at INFO — useful information, not an error — and the daemon
+     * starts on either way.
+     *
+     * <p>The env read lives in the overload below so a test can drive the line with a known
+     * value and prove that value never reaches the log.
+     */
+    static void reportGitHostShape(FleetConfig cfg) {
+        reportGitHostShape(cfg, System.getenv());
+    }
+
+    static void reportGitHostShape(FleetConfig cfg, Map<String, String> env) {
+        Map<String, List<String>> hostsBy = gitHostEnvVars(cfg);
+        if (hostsBy.isEmpty()) {
+            log.info("startup git host: no profile sets a gitTokenEnv — nothing to check");
+            return;
+        }
+        hostsBy.forEach((varName, sources) -> {
+            String value = env.get(varName);
+            if (value == null || value.isBlank()) {
+                log.info("startup git host {}: unset ({}) — a member gets GITEA_TOKEN but no "
+                        + "GITEA_HOST value", varName, String.join(", ", sources));
+            } else {
+                log.info("startup git host {}: set ({}) — length={}, startsWithScheme={}, "
+                                + "trailingSlash={}",
+                        varName, String.join(", ", sources),
+                        value.length(), startsWithScheme(value), value.endsWith("/"));
+            }
+        });
+    }
+
     /**
      * fleetd #184: state the member trust model at startup. Environment controls and worktrees do
      * not make a sandbox when fleetd and its members use the same OS user. A separate herdr may
@@ -1211,6 +1536,52 @@ public final class Fleetd {
                 + "fleetd.yaml — see fleetd.example.yaml — and restart.");
     }
 
+    /**
+     * fleetd #395: {@code exhaustedPattern} (see {@link FleetConfig.Profile#exhaustedPattern}) is
+     * deliberately opt-in — {@code null}/blank means a backend refusal on that profile is never
+     * classified as {@code BACKEND_EXHAUSTED}, so its credential is never quarantined. That is a
+     * legitimate choice (guessing the vendor's wording would be worse), but an operator who never
+     * opted a profile in should not discover the gap only when a usage limit silently goes
+     * undetected. Warn once at startup, naming every unarmed profile, exactly like {@link
+     * #reportMemberCredentialsGap} — never refuse to start over it.
+     *
+     * <p>A {@code subscription: true} profile that is unarmed gets a SECOND, louder WARN of its
+     * own: it bills the operator's metered Claude plan, the case where an undetected usage limit
+     * costs the most.
+     *
+     * <p>Package-private so a test can capture the real log via a {@link
+     * ch.qos.logback.core.read.ListAppender}, the same pattern {@link
+     * #reportMemberCredentialsGap}'s own test uses.
+     */
+    static void reportExhaustedPatternGap(FleetConfig cfg) {
+        List<String> unarmedSubscription = new ArrayList<>();
+        List<String> unarmedOther = new ArrayList<>();
+        cfg.profiles().forEach((name, profile) -> {
+            if (!profile.hasExhaustedPattern()) {
+                (profile.isSubscription() ? unarmedSubscription : unarmedOther).add(name);
+            }
+        });
+        if (unarmedSubscription.isEmpty() && unarmedOther.isEmpty()) {
+            log.info("exhaustedPattern: every configured profile has usage-limit detection armed");
+            return;
+        }
+        List<String> allUnarmed = new ArrayList<>(unarmedSubscription);
+        allUnarmed.addAll(unarmedOther);
+        allUnarmed = allUnarmed.stream().sorted().toList();
+        log.warn("exhaustedPattern: profile(s) {} have no exhaustedPattern configured — a "
+                        + "usage-limit refusal on any of them is never detected and never "
+                        + "quarantines its credential. Set exhaustedPattern (see "
+                        + "fleetd.example.yaml) to arm detection for a profile.",
+                allUnarmed);
+        if (!unarmedSubscription.isEmpty()) {
+            List<String> sortedSubscription = unarmedSubscription.stream().sorted().toList();
+            log.warn("exhaustedPattern: subscription profile(s) {} run on the operator's metered "
+                            + "Claude plan and have NO usage-limit detection armed — this is the "
+                            + "case where a missed usage limit costs the most.",
+                    sortedSubscription);
+        }
+    }
+
     /**
      * Poll herdr's {@code ping} until it answers or {@link #HERDR_WAIT_SECONDS} elapses (CB-504).
      *

fleetd/src/main/java/dev/ltms/fleet/auth/Authz.java

@@ -30,6 +30,16 @@ public final class Authz {
         DRAIN,
         /** Read-only observation: status, roster, profiles, task polling. */
         READ,
+        /**
+         * Read (never ack) this daemon's own held lead-to-lead coordination mail (fleetd #421).
+         *
+         * <p>Deliberately <strong>not</strong> folded into {@link #READ}. {@code READ}'s grant
+         * rests on "the roster carries no secrets" (see its case below) — a lead-to-lead body is
+         * not the roster; it is where leads discuss host shapes, credentials and unmerged work.
+         * Mapping this to {@code READ} would let any worker read every peer lead's mail in full
+         * and would silently falsify that comment for every other {@code READ} caller.
+         */
+        COORD_READ,
         /** Scrape the metrics endpoint. */
         METRICS
     }
@@ -68,6 +78,11 @@ public final class Authz {
             // Observation is open to every authenticated role: a worker legitimately polls its own
             // status, and the roster carries no secrets.
             case READ, METRICS -> caller.isPrimary() || caller.isWorker() || caller.isArchitect();
+
+            // fleetd #421: reading held lead-to-lead mail is the primary's alone. An architect
+            // holds READ today (CB-548), so "not primary" must mean not-architect here too — this
+            // is coordination between leads, not observation of the roster.
+            case COORD_READ -> caller.isPrimary();
         };
     }
 

fleetd/src/main/java/dev/ltms/fleet/auth/MemberRegistry.java

@@ -11,6 +11,7 @@ import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
+import java.util.function.Supplier;
 
 /**
  * The architect-slot registry (CB-548): every gateway-local architect name and the strong-model
@@ -19,16 +20,43 @@ import java.util.Objects;
  *
  * <p>Two halves, split by who owns each:
  * <ul>
- *   <li><b>slots</b> — configured once, keyed by the gateway-local unique name; each carries the
- *       {@code profile} reference the spawn lifecycle reads when it stands the slot up. A read-only
- *       snapshot taken at construction.</li>
- *   <li><b>terminal bindings</b> — owned by this registry and initially <em>empty</em>. Config
- *       declares no architect terminal, so at startup every slot is idle and nothing resolves to an
- *       architect; a session only becomes one when the spawn lifecycle {@linkplain #bind(String,
- *       String) binds} its terminal to a slot. {@link CallerResolver} reads this through
- *       {@link #snapshot()} to turn a pane into an {@link Role#ARCHITECT}.</li>
+ *   <li><b>slots</b> — read from {@code fleet.architects}/{@code developers}/{@code reviewers}
+ *       (see {@link #slots()}), each carrying the {@code profile} reference the spawn lifecycle
+ *       reads when it stands the slot up. <strong>Live, since fleetd #424</strong>: {@link #live}
+ *       re-reads {@code fleet:} on every call, through a supplier the same shape as
+ *       {@code CompositePeerLauncher}'s (see {@code ConfigRef}'s class doc) — so a config reload
+ *       that removes or adds an architect slot governs the <em>next</em> spawn with no restart.
+ *       Only {@link #MemberRegistry(FleetConfig.Fleet)} freezes the pool at construction, and that
+ *       constructor exists for tests and for the (rare) case of wiring a fixed, code-built config.</li>
+ *   <li><b>terminal bindings</b> — owned by this registry, initially <em>empty</em>, and
+ *       <strong>never</strong> touched by a reload. Config declares no architect terminal, so at
+ *       startup every slot is idle and nothing resolves to an architect; a session only becomes one
+ *       when the spawn lifecycle {@linkplain #bind(String, String) binds} its terminal to a slot.
+ *       {@link CallerResolver} reads this through {@link #snapshot()} to turn a pane into an
+ *       {@link Role#ARCHITECT}.</li>
  * </ul>
  *
+ * <p><strong>The binding rule (fleetd #424): config governs what a bound slot still grants, as
+ * well as what may be bound next.</strong> Removing a slot from config revokes it — that is the
+ * ticket's entire point ("Revoking an architect slot does not revoke it"). Revoking it means an
+ * architect already bound to that slot loses the ARCHITECT privilege on its very next request:
+ * {@link #roleForSlot} and {@link #nameForSlot} read {@link #slots()} directly, with no cache, so
+ * the moment a slot drops out of config, {@link CallerResolver#resolve} (which calls both on every
+ * request from a bound pane, {@code CallerResolver.java:220}) can no longer confirm the pane's slot
+ * is an architect slot, and the pane falls through to {@code Principal.worker(...)}. What does
+ * <em>not</em> change is the {@code terminalToSlot} <em>occupancy</em> — the binding created by
+ * {@link #bind} is untouched by a reload, on purpose: unbinding it here would double-book the slot
+ * key (a second terminal could then bind to the "freed" key while the first is still the terminal
+ * the operator actually meant to demote) and would silently break {@link #unbind}'s compare-safe
+ * contract, which needs the original {@code terminal → slot} pair intact to remove it cleanly. So
+ * the demoted session keeps occupying its slot — {@link #slotForTerminal} and {@link #snapshot()}
+ * still name it — it just no longer resolves as an architect through that occupancy, and a fresh
+ * spawn still cannot bind to the same key while it is occupied ({@link #reserve}/
+ * {@link #requireSlotFor} refuse it anyway, since it is gone from {@link #slots()}). The demoted
+ * session's own turn is unaffected: {@code fleet_reply}'s authorization
+ * ({@code Authz.Action.REPLY}) is {@code caller.ownsSession(targetSession)} — identity by terminal,
+ * not by role — so a demoted architect can still end its own turn normally.
+ *
  * <p>Spawning/lifecycle is deliberately a separate unit: this class only owns the bindings and
  * exposes the map the resolver resolves against plus the profile lookup lifecycle will call.
  * Nothing here creates or manages an architect session.
@@ -55,14 +83,42 @@ public final class MemberRegistry implements MemberLifecycle {
         }
     }
 
-    private final Map<String, Entry> slots;
+    private final Supplier<FleetConfig.Fleet> fleet;
     /** Live {@code terminal_id → qualified slot key}; guarded by {@code terminalToSlot}. */
     private final Map<String, String> terminalToSlot = new HashMap<>();
     /** Slot keys held between reservation and the terminal binding. Guarded by terminalToSlot. */
     private final java.util.Set<String> reservedSlots = new java.util.HashSet<>();
 
-    /** Flatten every role pool in {@code fleet} into one registry. Leaders are not members. */
+    /**
+     * Freeze the pool at construction — for tests, and for the rare case of wiring a fixed,
+     * code-built config. Production wiring should prefer {@link #live}, which re-reads
+     * {@code fleet:} on every call.
+     */
     public MemberRegistry(FleetConfig.Fleet fleet) {
+        this(() -> fleet);
+    }
+
+    private MemberRegistry(Supplier<FleetConfig.Fleet> fleet) {
+        this.fleet = fleet;
+    }
+
+    /**
+     * Live variant (fleetd #424): {@code fleet} is read fresh on every {@link #slots()} call — pass
+     * {@code () -> config.get().fleet()}, the same supplier shape {@code CompositePeerLauncher}
+     * already uses for placement — so a reload that adds or removes an architect slot governs the
+     * next spawn's {@link #reserve}/{@link #requireSlotFor} check with no restart. A separate,
+     * private constructor rather than a same-arity public overload of
+     * {@link #MemberRegistry(FleetConfig.Fleet)}: a {@code FleetConfig.Fleet} and a
+     * {@code Supplier<FleetConfig.Fleet>} overload are ambiguous for a literal {@code null} — the
+     * same reason {@code CallerResolver.withLeads} is a static factory rather than a fourth
+     * constructor overload.
+     */
+    public static MemberRegistry live(Supplier<FleetConfig.Fleet> fleet) {
+        return new MemberRegistry(Objects.requireNonNull(fleet, "fleet"));
+    }
+
+    /** Flatten every role pool in {@code fleet} into one map. Leaders are not members. */
+    private static Map<String, Entry> flatten(FleetConfig.Fleet fleet) {
         Map<String, Entry> flat = new LinkedHashMap<>();
         if (fleet != null) {
             for (MemberRole role : MemberRole.values()) {
@@ -74,18 +130,22 @@ public final class MemberRegistry implements MemberLifecycle {
                 });
             }
         }
-        this.slots = Collections.unmodifiableMap(flat);
+        return Collections.unmodifiableMap(flat);
     }
 
-    /** The configured slots, keyed by qualified {@link Entry#key()}. Unmodifiable snapshot. */
+    /**
+     * The configured slots, keyed by qualified {@link Entry#key()}. Unmodifiable snapshot of
+     * {@code fleet:} <em>as of this call</em> — see the class doc for which constructor makes that
+     * live versus frozen.
+     */
     public Map<String, Entry> slots() {
-        return slots;
+        return flatten(fleet.get());
     }
 
-    /** The slots belonging to {@code role}, in definition order. */
+    /** The slots belonging to {@code role}, in definition order, as of this call. */
     public Map<String, Entry> slotsFor(MemberRole role) {
         Map<String, Entry> out = new LinkedHashMap<>();
-        slots.forEach((key, e) -> {
+        slots().forEach((key, e) -> {
             if (e.role() == role) {
                 out.put(key, e);
             }
@@ -117,31 +177,49 @@ public final class MemberRegistry implements MemberLifecycle {
     }
 
     /**
-     * The strong-model profile a slot runs under — what the spawn lifecycle reads.
+     * The strong-model profile a slot runs under, as of this call.
+     *
+     * <p>Nothing in {@code src/main} calls this (fleetd #431 — grepped both the {@code
+     * .profileForSlot(} and the {@code ::profileForSlot} form). This javadoc used to say "what the
+     * spawn lifecycle reads", and that seam does not exist: the spawn lifecycle takes its profile
+     * from the {@link MemberLifecycle.SlotReservation} that {@code reserve} returns, never from
+     * here. Kept and pinned rather than deleted because it is the natural accessor for that seam
+     * if one is added; live for the same reason as {@link #roleForSlot}, so a reload cannot leave
+     * it answering for the old config.
      *
      * @return the slot's configured {@code profile}, or {@code null} if the slot is unknown or
      *         declares none
      */
     public String profileForSlot(String slotName) {
-        Entry e = slots.get(slotName);
+        Entry e = slots().get(slotName);
         return (e == null || e.profile() == null) ? null : e.profile();
     }
 
-    /** The role a qualified slot key belongs to, or {@code null} when the key is unknown. */
+    /**
+     * The role a qualified slot key belongs to, or {@code null} when the key is not currently
+     * configured. Deliberately live, with no cache (fleetd #424, see the class doc's binding rule):
+     * removing a slot from config must make {@link CallerResolver#resolve} stop granting the
+     * ARCHITECT role for it on the very next request from a terminal that was bound to it, which is
+     * the ticket's whole point — revoking a slot must actually revoke it, not just refuse the next
+     * spawn.
+     */
     public MemberRole roleForSlot(String slotName) {
-        Entry e = slots.get(slotName);
+        Entry e = slots().get(slotName);
         return e == null ? null : e.role();
     }
 
-    /** The unqualified configured name for a slot, or {@code null} if it is unknown. */
+    /**
+     * The unqualified configured name for a slot, or {@code null} if it is not currently configured.
+     * Live for the same reason as {@link #roleForSlot} — see the class doc's binding rule.
+     */
     public String nameForSlot(String slotName) {
-        Entry e = slots.get(slotName);
+        Entry e = slots().get(slotName);
         return e == null ? null : e.name();
     }
 
     /** True when {@code slotName} is a configured architect slot. */
     public boolean isSlot(String slotName) {
-        return slots.containsKey(slotName);
+        return slots().containsKey(slotName);
     }
 
     /**

fleetd/src/main/java/dev/ltms/fleet/config/ConfigRef.java

@@ -32,17 +32,49 @@ import java.util.function.Supplier;
  *       not the fact that they are config. Most of {@code fleet:} — every role pool
  *       ({@code architects}/{@code developers}/{@code reviewers}), {@code charters}, and
  *       {@code tabLabel} — is read the same live way, through the same supplier
- *       ({@code () -> config.get().fleet()}). <strong>But {@code fleet:} as a whole is NOT in this
- *       class</strong>: {@code fleet.leaders} inside the same key is frozen, which is exactly what
- *       makes {@code fleet:} split rather than hot — see below.</li>
+ *       ({@code () -> config.get().fleet()}). {@code architects} in particular is hot for
+ *       <strong>two independent consumers</strong> (fleetd #424): {@code CompositePeerLauncher}
+ *       reads it live for placement (which profile an unqualified architect spawn may land on), and
+ *       {@code MemberRegistry} separately reads it live, through its own instance of the same
+ *       supplier shape, for identity — both which slot a spawn may bind to <em>and</em> what a slot
+ *       already bound still grants. Removing an architect slot from config therefore revokes the
+ *       {@link dev.ltms.fleet.auth.Role#ARCHITECT} role on the bound pane's very next request; only
+ *       the slot <em>occupancy</em> survives, so the demoted session still holds its slot key until
+ *       it unbinds. See {@code MemberRegistry}'s class doc for that binding rule.
+ *       <strong>But {@code fleet:} as a whole is NOT in this class</strong>: {@code fleet.leaders}
+ *       inside the same key is frozen, which is exactly what makes {@code fleet:} split rather than
+ *       hot — see below. {@code models:} (fleetd #422) joined this class whole: {@link
+ *       FleetConfig#validateModels()} re-runs fully against the fresh config on every {@link
+ *       #reload()} (via {@link FleetConfig#validateAll()}), refusing a bad edit outright rather than
+ *       caching a stale copy anywhere, and the on/off half added by fleetd #422 is read live both by
+ *       {@code CompositePeerLauncher}'s spawn gate ({@code enforceModelEnabled} and its candidate
+ *       filter) and by {@code fleet_profiles}/{@code GET /profiles} (via
+ *       {@code PeerLauncher.disabledModels()}). Nothing about {@code models:} is baked into an
+ *       object built at startup, so — unlike the deferred keys below — there is no frozen half left
+ *       to report; it moved here from deferred rather than joining split. An existing profile's
+ *       {@code exhaustedPattern} (fleetd #446) joined this class the same way: it used to be
+ *       compiled once into {@code Fleetd.main}'s startup pattern map (see the Deferred bullet's old
+ *       wording, and {@code LiveExhaustedPatterns}'s class doc for the history), and is now read
+ *       live, cached by profile name, by both {@code CompletionResolver}'s classification (via
+ *       {@code LiveExhaustedPatterns.patternFor}) and {@code fleet_profiles}'s {@code
+ *       exhaustionDetectionArmed} (via {@code LiveExhaustedPatterns.armed}) — the one live object
+ *       both read, so a reload that arms or disarms a profile's usage-limit detection takes effect
+ *       on the next check with no restart. {@code errorPattern}, {@code exhaustedPattern}'s sibling
+ *       key for backend-error (not usage-limit) classification, was deliberately left OUT of this
+ *       fleetd #446 change and stays deferred below — the ticket scoped it out explicitly.</li>
  *   <li><strong>Deferred</strong> — accepted into the new snapshot, but the wiring built at startup
  *       keeps the old value until a restart: {@code lifecycle:}, {@code leadHeartbeat:},
+ *       {@code idleSleepGuard:} ({@code Fleetd.java} reads it once, at startup, to decide whether
+ *       to construct an {@code IdleSleepGuard} and wire {@code SessionManager}'s
+ *       {@code onAcquire}/{@code onRelease} hooks to it — neither is rebuilt on reload, so a
+ *       running daemon keeps whatever this was at startup regardless of a later edit),
  *       {@code spawnReadyTimeoutMs} / {@code spawnReadyPollMs}, {@code quarantineCooldownSeconds}
  *       (CB-578 stage B — baked once into the {@code BackendQuarantine} built at startup),
- *       {@code guard:}, {@code worktreeRoot:} and {@code worktreeGroup:} (both baked once into the
- *       {@code GitWorktrees} built at {@code Fleetd.java:251} and never rebuilt — fleetd #323
- *       instance 2 found {@code worktreeGroup} missing from this list and from
- *       {@link #changedDeferredKeys}), {@code primary:} (fleetd #326 — {@code Fleetd.java:506, 519,
+ *       {@code guard:}, {@code worktreeRoot:}, {@code worktreeGroup:} and {@code memberSkills:}
+ *       (all three of the latter baked once into the {@code GitWorktrees} built at
+ *       {@code Fleetd.java:251} and never rebuilt — fleetd #323 instance 2 found
+ *       {@code worktreeGroup} missing from this list and from {@link #changedDeferredKeys};
+ *       {@code memberSkills} (fleetd #362) followed the same shape), {@code primary:} (fleetd #326 — {@code Fleetd.java:506, 519,
  *       520} read {@code cfg.primary()} only off the startup snapshot to build {@code
  *       PrimaryRegistry} and size {@code ReplyPushLoop}'s reminder cap/backoff, and neither is
  *       rebuilt on reload. Say the consequence exactly: {@code primary.terminal} is DEPRECATED
@@ -59,15 +91,17 @@ import java.util.function.Supplier;
  *       (if any) simply keeps its old settings), adding or removing a profile (a new backend needs its own launcher,
  *       which is constructed once), <em>and an existing profile's launch settings</em> —
  *       {@code model}, {@code baseUrl}, {@code argv}, {@code env}, {@code mcpUrl},
- *       {@code exhaustedPattern} (CB-578 stage A — compiled once into {@code Fleetd.main}'s
- *       pattern map at startup), {@code errorPattern} (fleetd #201 Unit 5 — compiled once into
- *       {@code Fleetd.main}'s backend-error pattern map at startup, the same way),
+ *       {@code errorPattern} (fleetd #201 Unit 5 — compiled once into
+ *       {@code Fleetd.main}'s backend-error pattern map at startup; deliberately NOT made hot
+ *       alongside {@code exhaustedPattern} by fleetd #446 — that ticket scoped {@code errorPattern}
+ *       and cooling-off out explicitly),
  *       {@code ideProjectDir} / {@code ideOpenCommand} / {@code autoCompactWindow} (fleetd #323
  *       instance 1 — all three are read at spawn off the same frozen profile map and were missing
  *       from {@link #sameLaunchSettings}), and the rest of {@link #sameLaunchSettings}.
- *       {@code credentialId} (CB-578 stage B) is NOT on
- *       this list — it is read live off the config supplier at every quarantine check and
- *       exhaustion event, exactly like {@code weight} / {@code maxLoad}, so it is hot instead.
+ *       {@code credentialId} (CB-578 stage B) and {@code exhaustedPattern} (fleetd #446) are NOT on
+ *       this list — both are read live off the config supplier at every quarantine check and
+ *       exhaustion event, exactly like {@code weight} / {@code maxLoad}, so both are hot instead
+ *       (see the Hot bullet above for {@code exhaustedPattern}'s history).
  *       {@code HerdrPeerLauncher} takes {@code Map.copyOf(profiles)} at construction and resolves
  *       each spawn out of that copy, so those never reach a launch until the daemon restarts. A
  *       reload logs these rather than pretending they applied.</li>
@@ -129,15 +163,19 @@ import java.util.function.Supplier;
  *       five of COLD_KEYS" rather than re-listing them, so prose and set cannot drift again.</li>
  * </ul>
  *
- * <p><strong>The denominator, measured on 2026-09-04 (fleetd #330; recounted for fleetd #333).</strong>
- * {@code FleetConfig} has 22 top-level record components: 5 cold, 11 deferred, 3 split, 3
- * hot-excluded. Three of them are named nowhere in this file, and the reason is the same for all
- * three: {@code placement}, {@code memberCredentials} and {@code memberLoginShell} are
- * <strong>hot</strong> and correctly absent — all three are read live off {@code config.get()}
+ * <p><strong>The denominator, measured on 2026-09-04 (fleetd #330; recounted for fleetd #333);
+ * recounted again for fleetd #362, again after {@code idleSleepGuard:} was added, again after
+ * {@code models:} was added as deferred, and again for fleetd #422, which moved {@code models:}
+ * from deferred to hot-excluded once its on/off half was read live everywhere.</strong>
+ * {@code FleetConfig} has 25 top-level record components: 5 cold, 13 deferred, 3 split, 4
+ * hot-excluded. Four of them are named nowhere in this file, and the reason is the same for all
+ * four: {@code placement}, {@code memberCredentials}, {@code memberLoginShell} and {@code models}
+ * are <strong>hot</strong> and correctly absent — all four are read live off {@code config.get()}
  * (placement through the {@code CompositePeerLauncher} supplier the Hot bullet names;
  * {@code memberCredentials}/{@code memberLoginShell} at spawn time, {@code Fleetd.java:198, 205, 729}
- * and {@code HerdrPeerLauncher#configuredMemberLoginShell}), so a reload takes effect on the next
- * spawn with no entry needed here.
+ * and {@code HerdrPeerLauncher#configuredMemberLoginShell}; {@code models} the same way, through the
+ * Hot bullet's {@code models:} paragraph), so a reload takes effect on the next spawn (or, for
+ * {@code models}, the next reported status) with no entry needed here.
  * {@code health} and {@code coordinator} used to be a third kind — <strong>undecided</strong>, not
  * hot — until fleetd #330 added the <strong>split</strong> class above and gave them a home. A
  * reload touching either used to report a bare "config reloaded", which under-claimed; now it names
@@ -211,9 +249,9 @@ public final class ConfigRef implements Supplier<FleetConfig> {
      * read {@link #COLD_KEYS} and {@link #SPLIT_KEYS}.
      */
     static final Set<String> DEFERRED_KEYS = Set.of(
-            "guard", "worktreeRoot", "worktreeGroup", "primary", "configReload",
+            "guard", "worktreeRoot", "worktreeGroup", "memberSkills", "primary", "configReload",
             "leadHeartbeat", "lifecycle", "spawnReadyTimeoutMs", "spawnReadyPollMs",
-            "quarantineCooldownSeconds", "profiles");
+            "quarantineCooldownSeconds", "profiles", "idleSleepGuard");
 
     private final Path path;
     private final AtomicReference<FleetConfig> current;
@@ -316,12 +354,12 @@ public final class ConfigRef implements Supplier<FleetConfig> {
             fresh = FleetConfig.load(path);
             // The same gate startup runs. A config that would have refused to boot must not be able
             // to slip in through a reload — that is how a daemon ends up in a state it could never
-            // have started in, which is the hardest kind to debug.
-            fresh.validateAuthExposure();
-            fresh.validateLeadTabPrefixes();
-            fresh.validateSubscriptionProfiles();
-            fresh.validateCharters();
-            fresh.validateMembers();
+            // have started in, which is the hardest kind to debug. fleetd ticket "central allow-list
+            // of usable models" follow-up: this used to be six individual validateXxx() calls, and
+            // mutation testing found two of the six unpinned here even though startup pinned nothing
+            // at all — see FleetConfig#validateAll's javadoc for why the fix is one reflective call,
+            // not a longer hand-maintained list.
+            fresh.validateAll();
         } catch (RuntimeException e) {
             String msg = e.getMessage() == null ? e.toString() : e.getMessage();
             log.warn("config reload from {} refused, keeping the running config: {}", path, msg);
@@ -402,6 +440,13 @@ public final class ConfigRef implements Supplier<FleetConfig> {
         if (!Objects.equals(old.worktreeGroup(), fresh.worktreeGroup())) {
             changed.add("worktreeGroup");
         }
+        // fleetd #362: baked into the same GitWorktrees as worktreeRoot/worktreeGroup
+        // (Fleetd.java:251) and never rebuilt either — a reload that changes only memberSkills
+        // must be reported the same way, or a newly provisioned worktree keeps seeding from (or
+        // skipping) the old source directory with nothing telling the operator why.
+        if (!Objects.equals(old.memberSkills(), fresh.memberSkills())) {
+            changed.add("memberSkills");
+        }
         // fleetd #326: Fleetd.java:506, 519, 520 read cfg.primary() only off the startup snapshot
         // (PrimaryRegistry's pinned terminal, ReplyPushLoop's reminder cap and backoff) — neither is
         // rebuilt on reload, so a changed value needs a restart. Note what it does NOT mean:
@@ -418,6 +463,14 @@ public final class ConfigRef implements Supplier<FleetConfig> {
         if (!Objects.equals(old.configReload(), fresh.configReload())) {
             changed.add("configReload");
         }
+        // Fleetd.java reads cfg.idleSleepGuard() once, at startup, to decide whether to construct
+        // an IdleSleepGuard at all and wire SessionManager's onAcquire/onRelease hooks to it —
+        // neither is rebuilt on reload, so a running daemon keeps whatever this was at startup
+        // (armed or not) regardless of a later edit here. Not cold: nothing already-open goes
+        // inconsistent with the new value, an armed-or-not guard just keeps its original answer.
+        if (!Objects.equals(old.idleSleepGuard(), fresh.idleSleepGuard())) {
+            changed.add("idleSleepGuard");
+        }
         if (!Objects.equals(old.spawnReadyTimeoutMs(), fresh.spawnReadyTimeoutMs())
                 || !Objects.equals(old.spawnReadyPollMs(), fresh.spawnReadyPollMs())) {
             changed.add("spawnReady*");
@@ -492,26 +545,35 @@ public final class ConfigRef implements Supplier<FleetConfig> {
                     + "opened once and needs a restart; the broker URI env-var name kept out of a "
                     + "member's environment is read live on every spawn and already applied");
         }
-        // fleetd #333: unlike health/coordinator above, most of `fleet:` (architects, developers,
-        // reviewers, charters, tabLabel) is genuinely hot — ConfigRefTest.aHotChangeIsAppliedAndRead-
+        // fleetd #333: unlike health/coordinator above, most of `fleet:` (developers, reviewers,
+        // charters, tabLabel) is genuinely hot — ConfigRefTest.aHotChangeIsAppliedAndRead-
         // ThroughGet and aCharterChangeIsHotAndReachesTheLiveConfig prove it reaches the live config
-        // with no restart note. Only fleet.leaders is frozen (Fleetd.java:281 reads
-        // cfg.fleet().leaders() off the startup snapshot to build both the LeadTabScanner's
-        // tab-label-to-name map, wired into CallerResolver.withLeadsAndMembers at Fleetd.java:620/624,
-        // and — when herdr answered — LeadLauncher(...).ensureLeads() at Fleetd.java:315, which
-        // auto-launches each lead up to its `instances` count; neither is rebuilt on reload). So this
-        // compares fleet.leaders alone, not the whole Fleet record: comparing the whole record would
-        // report "split" for a tabLabel-only or charters-only change that is actually fully hot,
-        // which is the over-claim mirror of the under-claim bug this class exists to prevent.
+        // with no restart note. `architects` is hot too, and — since fleetd #424 — hot for BOTH of
+        // its consumers, not just the one this comment used to name: CompositePeerLauncher reads it
+        // live for PLACEMENT through the () -> config.get().fleet() supplier named in the class doc's
+        // Hot bullet, and MemberRegistry separately reads it live for IDENTITY (which slot a spawn
+        // may bind to, AND what a slot already bound still grants) through its own instance of that
+        // same supplier shape — see MemberRegistry.live and its class doc for the binding rule:
+        // removing a slot revokes ARCHITECT on the bound pane's very next request, and only the slot
+        // OCCUPANCY survives, so the demoted session keeps its slot key until it unbinds. Only
+        // fleet.leaders is frozen (Fleetd.java:281 reads cfg.fleet().leaders() off the startup
+        // snapshot to build both the LeadTabScanner's tab-label-to-name map, wired into
+        // CallerResolver.withLeadsAndMembers at Fleetd.java:620/624, and — when herdr answered —
+        // LeadLauncher(...).ensureLeads() at Fleetd.java:315, which auto-launches each lead up to its
+        // `instances` count; neither is rebuilt on reload). So this compares fleet.leaders alone, not
+        // the whole Fleet record: comparing the whole record would report "split" for a tabLabel-only
+        // or architects-only change that is actually fully hot, which is the over-claim mirror of the
+        // under-claim bug this class exists to prevent.
         if (!Objects.equals(leadersOf(old), leadersOf(fresh))) {
             changed.add("fleet: fleet.leaders (each lead's tab, workspace, cwd, profile and "
                     + "instances count) is read once at startup to build the LeadTabScanner's "
                     + "identity map and to auto-launch leads, and neither is rebuilt on reload, so a "
                     + "lead added, removed, or given a new tab: label needs a restart — until then it "
                     + "stays unrecognised, and a caller from its new tab resolves as a worker, not a "
-                    + "lead; the rest of fleet: (architects, developers, reviewers, charters, "
-                    + "tabLabel) is read live through the supplier on CompositePeerLauncher and "
-                    + "already applied");
+                    + "lead; the rest of fleet: (developers, reviewers, charters, tabLabel) is read "
+                    + "live through the supplier on CompositePeerLauncher, and architects is read "
+                    + "live through that same supplier for placement AND through a separate supplier "
+                    + "on MemberRegistry for spawn-time identity — both already applied");
         }
         // Kept in step with SPLIT_KEYS the same way changedColdKeys is kept in step with COLD_KEYS —
         // every message here must be traceable to one of the split keys the class doc documents.
@@ -533,12 +595,16 @@ public final class ConfigRef implements Supplier<FleetConfig> {
      * {@link #sameLaunchSettings} because they are read <em>live</em>, not baked in at spawn — see
      * the class doc's <em>Hot</em> bullet. {@code weight} and {@code maxLoad} are read live by the
      * placement policy on every spawn; {@code credentialId} is read live by
-     * {@code CompositePeerLauncher} and the CB-578 stage B exhaustion sink. Nothing else is
+     * {@code CompositePeerLauncher} and the CB-578 stage B exhaustion sink; {@code exhaustedPattern}
+     * (fleetd #446) is read live, cached by profile name, by {@code LiveExhaustedPatterns} — see
+     * that class's doc and the class doc's <em>Hot</em> bullet for the history (it used to be
+     * compared here, deferred, like its sibling {@code errorPattern} still is). Nothing else is
      * excluded — see {@code sameLaunchSettingsComparesEveryProfileComponentOrExcludesIt} in
      * {@code ConfigRefProfileCoverageTest}, which enumerates every {@code Profile} record component
      * by reflection and fails the build if one is neither compared below nor named here.
      */
-    static final Set<String> LAUNCH_SETTINGS_EXCLUDED = Set.of("weight", "maxLoad", "credentialId");
+    static final Set<String> LAUNCH_SETTINGS_EXCLUDED =
+            Set.of("weight", "maxLoad", "credentialId", "exhaustedPattern");
 
     /**
      * Whether two versions of a profile would launch a peer identically.
@@ -575,13 +641,15 @@ public final class ConfigRef implements Supplier<FleetConfig> {
                 && Objects.equals(a.kind(), b.kind())
                 && Objects.equals(a.env(), b.env())
                 && Objects.equals(a.subscription(), b.subscription())
-                // CB-578 stage B: exhaustedPattern is compiled once into Fleetd.main's pattern map
-                // at startup (see ExhaustedPatternLookup wiring) — a reload never re-reads it, so a
-                // changed pattern must be reported as deferred, exactly like model/baseUrl/argv.
-                && Objects.equals(a.exhaustedPattern(), b.exhaustedPattern())
+                // fleetd #446: exhaustedPattern moved to LAUNCH_SETTINGS_EXCLUDED — it is now read
+                // live, cached by profile name, through LiveExhaustedPatterns (see that class's doc
+                // and ConfigRef's class doc Hot bullet), so it must NOT be compared here any more: a
+                // reload that changes only exhaustedPattern must report "config reloaded", not
+                // "these changes need a restart".
                 // fleetd #201 Unit 5: errorPattern is compiled once into Fleetd.main's backend-error
-                // pattern map at startup (see BackendErrorPatternLookup wiring), the same way
-                // exhaustedPattern is — a reload never re-reads it either.
+                // pattern map at startup (see BackendErrorPatternLookup wiring) — unlike its sibling
+                // exhaustedPattern above (fleetd #446), a reload still never re-reads it; fleetd #446
+                // scoped errorPattern out on purpose (see the class doc's Hot bullet).
                 && Objects.equals(a.errorPattern(), b.errorPattern())
                 // fleetd #323 instance 1: ideProjectDir and ideOpenCommand are read at spawn off the
                 // same frozen profile map as ideMcpUrl above (ClaudeCodeLauncher.java:267/269,

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -16,11 +16,15 @@ import org.slf4j.LoggerFactory;
 
 import java.io.IOException;
 import java.io.UncheckedIOException;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.lang.reflect.Modifier;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
+import java.util.Comparator;
 import java.util.HashSet;
 import java.util.LinkedHashMap;
 import java.util.List;
@@ -66,12 +70,14 @@ import java.util.regex.PatternSyntaxException;
  *                      {@code fixed} (default), {@code round-robin}, or {@code weighted}
  * @param auth          API authentication mode ({@code null} → {@code loopback-trust}, the
  *                      historical behaviour), CB-501
- * @param quarantineCooldownSeconds  how long a credential stays quarantined after a
+ * @param quarantineCooldownSeconds  the BASE cooldown a credential is quarantined for after a
  *                      {@code BACKEND_EXHAUSTED} classification (CB-578 stage B); {@code null}/{@code
- *                      <=0} → {@link #DEFAULT_QUARANTINE_COOLDOWN_SECONDS}. Baked once into the
- *                      {@code BackendQuarantine} built at startup, so it is DEFERRED: changing it
- *                      needs a restart, and a quarantine already running keeps whatever cooldown was
- *                      live when it started.
+ *                      <=0} → {@link #DEFAULT_QUARANTINE_COOLDOWN_SECONDS}. Since fleetd #466 this is
+ *                      only the first occurrence's length — a credential quarantined again shortly
+ *                      after this cooldown ends backs off further, up to a ceiling; see {@code
+ *                      BackendQuarantine}'s class doc. Baked once into the {@code BackendQuarantine}
+ *                      built at startup, so it is DEFERRED: changing it needs a restart, and a
+ *                      quarantine already running keeps whatever cooldown was live when it started.
  * @param memberCredentials deny-by-default policy (CB-596) for which of the operator's own host
  *                      credentials a spawned member's pane inherits. {@code null} (the block
  *                      omitted) blocks nothing — see {@link MemberCredentials}.
@@ -106,6 +112,33 @@ import java.util.regex.PatternSyntaxException;
  *                      When {@code memberHerdrSocket} is NOT configured this field is never
  *                      consulted at all; fleetd keeps reading its own {@code $SHELL}, exactly as
  *                      before this field existed.
+ * @param memberSkills  fleetd #362: nullable directory of skill folders (each a subdirectory
+ *                      holding a {@code SKILL.md}, the same shape as this repo's own {@code
+ *                      .claude/skills/}) copied into every provisioned worktree's {@code
+ *                      .claude/skills/}, so a member spawned against ANY repo — not only one that
+ *                      already ships its own copy — can load a bridge skill such as {@code
+ *                      implementer}. {@code null}/blank ⇒ off: no worktree is touched beyond
+ *                      today's behaviour. A skill folder the target repo already carries is never
+ *                      overwritten — see {@link dev.ltms.fleet.session.GitWorktrees}. Claude Code
+ *                      members only; an opencode member's equivalent lives under a different path
+ *                      ({@code .opencode/agent}) and is not covered by this key. Every non-hidden
+ *                      subdirectory of this directory is copied wholesale, with no per-file
+ *                      allowlist — do not park scratch files or drafts alongside the real skill
+ *                      folders, they will be copied into every provisioned worktree too.
+ * @param idleSleepGuard opt-in-by-default: hold an OS-level assertion against idle sleep while at
+ *                      least one member is live, so an unattended host does not sleep out from
+ *                      under a member's long turn. {@code null} (the block omitted) behaves the
+ *                      same as an explicit {@code enabled: true}; set {@code enabled: false} to
+ *                      turn it off. See {@link dev.ltms.fleet.power.IdleSleepGuard}.
+ * @param models        central allow-list of models any {@code profiles:} entry may name. {@code
+ *                      null} or an empty {@code allow:} ⇒ off: {@link #validateModels()} checks
+ *                      nothing and every existing config keeps working exactly as it does today.
+ *                      When non-empty, a profile whose {@code model:} is not one of {@link
+ *                      Models#ids()} fails config load, naming both the model and the profile —
+ *                      see {@link #validateModels()}. This block decides what may be CONFIGURED;
+ *                      fleetd #422 added the separate on/off question — whether a configured model
+ *                      may be spawned onto RIGHT NOW ({@link Models.ModelEntry#enabled}) — enforced
+ *                      live at spawn by {@code CompositePeerLauncher}, not here. See {@link Models}.
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public record FleetConfig(
@@ -130,7 +163,52 @@ public record FleetConfig(
         MemberCredentials memberCredentials,
         Coordinator coordinator,
         String worktreeGroup,
-        String memberLoginShell) {
+        String memberLoginShell,
+        String memberSkills,
+        IdleSleepGuard idleSleepGuard,
+        Models models) {
+
+    /** Back-compat form before the {@code models:} block was added. */
+    public FleetConfig(Bind bind, String herdrSocket, String memberHerdrSocket, Map<String, Profile> profiles,
+                         Guard guard, String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
+                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
+                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
+                         ConfigReload configReload, Integer quarantineCooldownSeconds,
+                         MemberCredentials memberCredentials, Coordinator coordinator, String worktreeGroup,
+                         String memberLoginShell, String memberSkills, IdleSleepGuard idleSleepGuard) {
+        this(bind, herdrSocket, memberHerdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
+                configReload, quarantineCooldownSeconds, memberCredentials, coordinator, worktreeGroup,
+                memberLoginShell, memberSkills, idleSleepGuard, null);
+    }
+
+    /** Back-compat form before the {@code idleSleepGuard:} block was added. */
+    public FleetConfig(Bind bind, String herdrSocket, String memberHerdrSocket, Map<String, Profile> profiles,
+                         Guard guard, String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
+                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
+                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
+                         ConfigReload configReload, Integer quarantineCooldownSeconds,
+                         MemberCredentials memberCredentials, Coordinator coordinator, String worktreeGroup,
+                         String memberLoginShell, String memberSkills) {
+        this(bind, herdrSocket, memberHerdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
+                configReload, quarantineCooldownSeconds, memberCredentials, coordinator, worktreeGroup,
+                memberLoginShell, memberSkills, null);
+    }
+
+    /** Back-compat form before the {@code memberSkills} key was added. */
+    public FleetConfig(Bind bind, String herdrSocket, String memberHerdrSocket, Map<String, Profile> profiles,
+                         Guard guard, String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
+                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
+                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
+                         ConfigReload configReload, Integer quarantineCooldownSeconds,
+                         MemberCredentials memberCredentials, Coordinator coordinator, String worktreeGroup,
+                         String memberLoginShell) {
+        this(bind, herdrSocket, memberHerdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
+                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
+                configReload, quarantineCooldownSeconds, memberCredentials, coordinator, worktreeGroup,
+                memberLoginShell, null, null);
+    }
 
     /** Back-compat form before the {@code memberLoginShell} key was added. */
     public FleetConfig(Bind bind, String herdrSocket, String memberHerdrSocket, Map<String, Profile> profiles,
@@ -141,7 +219,7 @@ public record FleetConfig(
                          MemberCredentials memberCredentials, Coordinator coordinator, String worktreeGroup) {
         this(bind, herdrSocket, memberHerdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
                 spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
-                configReload, quarantineCooldownSeconds, memberCredentials, coordinator, worktreeGroup, null);
+                configReload, quarantineCooldownSeconds, memberCredentials, coordinator, worktreeGroup, null, null);
     }
 
     /** Back-compat form before the {@code worktreeGroup} key was added. */
@@ -348,6 +426,12 @@ public record FleetConfig(
      *                       {@code null}/blank ⇒ the classification never fires for this profile and
      *                       today's completion-fallback behaviour is unchanged. Every backend words
      *                       its refusal differently, so this is config, never a vendor string in code.
+     *                       Read live off the current config through {@code LiveExhaustedPatterns},
+     *                       cached by profile name (fleetd #446), so it is HOT: an operator can arm
+     *                       or disarm this profile's usage-limit detection by editing this key and
+     *                       reloading, with no restart. Before fleetd #446 this was compiled once at
+     *                       daemon startup, the same deferred shape its sibling {@code errorPattern}
+     *                       (below) still has.
      * @param credentialId   the shared account this profile authenticates as (CB-578 stage B). Two
      *                       or more profiles setting the <em>same</em> non-blank value are quarantined
      *                       together by one {@code exhaustedPattern} classification on any one of
@@ -888,12 +972,18 @@ public record FleetConfig(
      *                 {@code null} ⇒ kept as {@code null} (no self id configured).
      * @param prefetch the consumer's {@code basicQos} prefetch count. {@code null}/non-positive ⇒
      *                 {@link LeadMailbox#DEFAULT_PREFETCH}.
+     * @param peers    fleetd #361: the coord-ids the operator declares as this daemon's peers — the
+     *                 daemon never guesses who else exists. {@code fleet_list} reports each one's
+     *                 live reachability. Blank entries are dropped; {@code null} ⇒ an empty list, so
+     *                 a config written before this field existed still parses unchanged.
      */
     @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Coordinator(String uri, String uriEnv, String selfId, Integer prefetch) {
+    public record Coordinator(String uri, String uriEnv, String selfId, Integer prefetch, List<String> peers) {
 
         public Coordinator {
             selfId = (selfId == null || selfId.isBlank()) ? null : selfId;
+            peers = peers == null ? List.of()
+                    : peers.stream().filter(p -> p != null && !p.isBlank()).toList();
         }
 
         /** True when a {@code uriEnv} is configured by name, whether or not its variable resolves. */
@@ -1245,6 +1335,145 @@ public record FleetConfig(
         }
     }
 
+    /**
+     * Hold an OS-level assertion against idle sleep while at least one member is live (see
+     * {@link dev.ltms.fleet.power.IdleSleepGuard}).
+     *
+     * <p>Unlike most opt-in blocks in this file, this one defaults to <em>on</em>: an unattended
+     * host idle-sleeping mid-turn is a correctness problem (a dropped AMQP link, a frozen member),
+     * not a convenience, so the safer default is armed. An operator who wants the previous
+     * behaviour (no assertion held, ever) sets {@code enabled: false} explicitly.
+     *
+     * @param enabled {@code false} turns the guard off; {@code null} (the block omitted
+     *                entirely) or {@code true} leaves it on
+     */
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    public record IdleSleepGuard(Boolean enabled) {
+        public boolean isEnabled() {
+            return !Boolean.FALSE.equals(enabled);
+        }
+    }
+
+    /**
+     * Central allow-list of models any {@code profiles:} entry may name (fleetd ticket: "a central
+     * allow-list of usable models"). Nothing before this block checked a profile's {@code model:}
+     * against anything — it was a free-form string handed straight to the backend adapter, and a
+     * withdrawn or misspelled name failed silently (opencode falls back to a default model rather
+     * than erroring on an unknown {@code -m}) rather than at config load, where a mistake is cheap.
+     *
+     * <p><b>Absent or empty {@code allow:} is "off"</b>, on purpose: this is a large deployment
+     * with gitignored {@code fleetd.yaml} on more than one host, and a change that forced every
+     * operator to enumerate their models before the daemon would start would break every one of
+     * them on upgrade. See {@link FleetConfig#validateModels()}, which is where the allow-list is
+     * actually enforced, at config load.
+     *
+     * <p><b>The list is the authority; a {@code profiles:} entry is checked against it, never the
+     * other way around.</b> Adding or editing a {@code profiles:} entry cannot, by itself, widen
+     * the set of permitted models — only editing {@code models.allow:} itself can. This is the
+     * invariant the ticket asked for: the two blocks are validated in one direction only.
+     *
+     * <p><b>Spawn-time enforcement (fleetd #422, units 2+3) lives outside this record</b> —
+     * {@code CompositePeerLauncher.enforceModelEnabled} and its candidate-set filter read this
+     * block LIVE (through the same kind of supplier {@code weight}/{@code maxLoad} already use),
+     * so the on/off state below is hot: no restart needed. This block itself still only decides
+     * what may be CONFIGURED (membership in {@link #allow}); {@link ModelEntry#enabled} decides
+     * whether a member of that list is currently spawnable. The two questions are deliberately
+     * separate — see {@link ModelEntry}'s javadoc for why turning a model off must never mean
+     * removing it from {@link #allow}.
+     *
+     * @param allow the permitted models, each its own {@link ModelEntry} rather than a bare
+     *              string — see that record's javadoc for why. {@code null}/empty ⇒ the block is
+     *              treated as absent: {@link FleetConfig#validateModels()} checks nothing.
+     */
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    public record Models(List<ModelEntry> allow) {
+
+        public Models {
+            allow = (allow == null) ? List.of() : List.copyOf(allow);
+        }
+
+        /**
+         * One permitted model, named as a record rather than a bare string on purpose: this ticket
+         * (fleetd #422) is the "later unit" the original comment here predicted — it hangs an on/off
+         * state ({@link #enabled}) off each entry, and a bare {@code List<String>} could not have
+         * grown that field without changing the YAML shape underneath every operator who already
+         * wrote one. {@link #model()} is intentionally a single flat, opaque-string namespace — a
+         * bare Claude id ({@code claude-sonnet-5}) and an opencode provider-prefixed id
+         * ({@code openai/gpt-5.6-terra}) both fit it unchanged, because {@link
+         * FleetConfig#validateModels()} only ever compares a profile's {@code model:} value against
+         * this string for exact equality; it never parses a provider prefix or branches on a
+         * profile's {@code kind:}.
+         *
+         * @param model   the model id exactly as a {@code profiles:} entry's {@code model:} field
+         *                would name it
+         * @param enabled {@code false} turns spawning onto this model off; {@code null} (the field
+         *                omitted — every config written before fleetd #422 is this shape) or
+         *                {@code true} leaves it on. Turning a model off must NEVER remove it from
+         *                {@link Models#allow} — {@link FleetConfig#validateModels()} checks
+         *                <em>membership</em> only, never the on/off state, so an off entry stays a
+         *                valid thing for a {@code profiles:} entry to name; only
+         *                {@code CompositePeerLauncher}'s spawn-time gate reads {@link #enabled}.
+         *                Collapsing the two — turning a model off by deleting its {@code allow:}
+         *                entry — would make {@link FleetConfig#validateModels()} refuse the whole
+         *                config reload the moment a still-configured profile names it, which is
+         *                exactly the restart-to-flip-a-switch problem this field exists to avoid.
+         *                <p>A model id can be named by more than one {@code profiles:} entry (e.g.
+         *                {@code deepseek-v4-flash} backs both {@code local} and {@code
+         *                local-direct} in the live config) — turning it off disables every profile
+         *                that names it, on purpose: the model is what a subscription's rate limit
+         *                actually constrains, not any one profile alias for it.
+         */
+        @JsonIgnoreProperties(ignoreUnknown = true)
+        public record ModelEntry(String model, Boolean enabled) {
+            public ModelEntry {
+                model = (model == null || model.isBlank()) ? null : model.trim();
+            }
+
+            /**
+             * Back-compat form before {@link #enabled} was added (fleetd #422) — the model is
+             * unconditionally on, exactly as every {@code ModelEntry} behaved before this field
+             * existed. Keeps pre-#422 call sites (and any YAML that omits {@code enabled:})
+             * compiling and behaving identically.
+             */
+            public ModelEntry(String model) {
+                this(model, null);
+            }
+
+            /** {@code true} unless {@link #enabled} is explicitly {@code false} — absent means on. */
+            public boolean isEnabled() {
+                return !Boolean.FALSE.equals(enabled);
+            }
+        }
+
+        /** {@link #allow}'s model ids, as a set for membership checks. Blank/null entries are dropped. */
+        public Set<String> ids() {
+            Set<String> ids = new java.util.LinkedHashSet<>();
+            for (ModelEntry e : allow) {
+                if (e != null && e.model() != null) {
+                    ids.add(e.model());
+                }
+            }
+            return Collections.unmodifiableSet(ids);
+        }
+
+        /**
+         * Model ids currently turned off (fleetd #422: {@link ModelEntry#isEnabled()} {@code
+         * false}). Read live by {@code CompositePeerLauncher}'s spawn gate and by {@code
+         * fleet_profiles}/{@code GET /profiles} — both must read this same accessor off the same
+         * live config so the two surfaces cannot disagree about which model is off (the fleetd
+         * #404 lesson: a status field must read the source the behaviour reads).
+         */
+        public Set<String> offIds() {
+            Set<String> off = new java.util.LinkedHashSet<>();
+            for (ModelEntry e : allow) {
+                if (e != null && e.model() != null && !e.isEnabled()) {
+                    off.add(e.model());
+                }
+            }
+            return Collections.unmodifiableSet(off);
+        }
+    }
+
     /**
      * The terminal → lead-name map seeded from the legacy singular {@code primary:} pin (CB-530).
      *
@@ -1495,7 +1724,8 @@ public record FleetConfig(
             "bind", "herdrSocket", "memberHerdrSocket", "profiles", "guard", "worktreeRoot",
             "lifecycle", "spawnReadyTimeoutMs", "spawnReadyPollMs", "broker", "primary", "fleet",
             "leadHeartbeat", "health", "placement", "auth", "configReload", "quarantineCooldownSeconds",
-            "memberCredentials", "coordinator", "worktreeGroup", "memberLoginShell");
+            "memberCredentials", "coordinator", "worktreeGroup", "memberLoginShell", "memberSkills",
+            "idleSleepGuard", "models");
 
     /** Load and validate config from {@code path}. */
     public static FleetConfig load(Path path) {
@@ -2172,9 +2402,23 @@ public record FleetConfig(
         // memberLoginShell is left as-is (fleetd #213), like worktreeGroup: null/blank is "not
         // configured", and there is no sane non-null default — a member's login shell is
         // operator-specific and only meaningful when memberHerdrSocket is also set.
+        // memberSkills is left as-is (fleetd #362), like worktreeGroup/memberLoginShell: null/blank
+        // is "off", and there is no sane non-null default — the daemon may not even run from a
+        // checkout that ships its own .claude/skills/.
+        // idleSleepGuard is left as-is, like leadHeartbeat/configReload above, but for the opposite
+        // reason: it is on by default already (its own isEnabled() treats null the same as
+        // enabled: true — see its javadoc), so defaulting the block here would change nothing a
+        // reader observes and would only obscure that "block omitted" and "block present and
+        // enabled" are deliberately the same outcome.
+        // models is left as-is, like broker/primary/coordinator above: null/empty is "off", and an
+        // absent block must validate nothing (see Models's javadoc) — defaulting it here to an
+        // empty Models would be a no-op for validateModels() either way, since an empty allow-list
+        // already means "check nothing", so there is nothing to gain and one more null check to
+        // avoid by leaving it exactly as configured.
         return new FleetConfig(b, herdrSocket, memberHerdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
                 broker, primary, f, leadHeartbeat, health, placementOrDefault, a, configReload,
-                quarantineCooldown, mc, coordinator, worktreeGroup, memberLoginShell);
+                quarantineCooldown, mc, coordinator, worktreeGroup, memberLoginShell, memberSkills,
+                idleSleepGuard, models);
     }
 
     /**
@@ -2394,6 +2638,118 @@ public record FleetConfig(
         }
     }
 
+    /**
+     * Reject a {@code profiles:} entry whose {@code model:} is not on the configured {@link
+     * #models} allow-list.
+     *
+     * <p>Absent or empty {@code models.allow:} validates nothing — see {@link Models}'s javadoc:
+     * an existing config with no such block must keep working exactly as it does today. Once the
+     * operator declares at least one entry, every profile's {@code model:} (when set — a profile
+     * may legitimately leave it {@code null}, e.g. a {@code subscription: true} profile relying on
+     * the account's own default) must equal one of {@link Models#ids()} exactly. The comparison is
+     * a flat string match: a bare Claude id and an opencode {@code provider/model} id are both
+     * just opaque strings here, so nothing here needs to know which {@code kind:} a profile runs.
+     *
+     * <p>The check runs one direction only, by construction: it reads {@link #profiles} and
+     * {@link #models}, and only ever adds to {@code bad} when a profile's model is missing from
+     * the allow-list. Nothing here can be satisfied by widening a {@code profiles:} entry — only
+     * editing {@code models.allow:} itself changes what passes. That is the invariant the ticket
+     * asked for: the list is the authority, profiles are checked against it.
+     *
+     * @throws IllegalStateException when any profile names a model outside the configured
+     *                               allow-list, naming both the model and the profile that wanted it
+     */
+    public void validateModels() {
+        if (models == null || models.allow().isEmpty()) {
+            return;
+        }
+        Set<String> allowed = models.ids();
+        List<String> bad = new ArrayList<>();
+        profiles.forEach((name, p) -> {
+            String model = p.model();
+            if (model != null && !model.isBlank() && !allowed.contains(model)) {
+                bad.add("profile '" + name + "' names model '" + model + "', which is not in "
+                        + "models.allow: (have: " + allowed + ").");
+            }
+        });
+        if (!bad.isEmpty()) {
+            throw new IllegalStateException("refusing to start: " + String.join(" ", bad));
+        }
+    }
+
+    /**
+     * Runs every validator this class declares — found by reflection, not by name.
+     *
+     * <p>fleetd ticket "central allow-list of usable models", follow-up: mutation testing found
+     * that although each of the six validators above was well pinned on its own, nothing proved
+     * either real caller ({@code Fleetd.main} and {@link ConfigRef#reload()}) still
+     * invoked it — deleting a call site left the full suite green. The fix is not a seventh test
+     * per caller; a hand-maintained list of six names here would have the exact same defect its
+     * own javadoc would warn against: the seventh validator someone adds next month has no reason
+     * to be added to it. So this method does not name any validator. It sweeps {@link
+     * #getClass()}'s own public, no-argument, {@code void} methods whose name starts with {@code
+     * "validate"} (excluding itself) and invokes every one it finds, via {@link
+     * #invokeAllValidators}. A new {@code validateXxx()} method is therefore wired into both
+     * callers the moment it is written — there is no second step to forget, and so no state in
+     * which it silently never runs.
+     *
+     * <p>{@code Fleetd.main} and {@link ConfigRef#reload()} each call this one method instead of
+     * the six individually — see the comments at those two call sites for why
+     * each must run it.
+     *
+     * <p>Methods run in a fixed (alphabetical) order, so a config with more than one violation
+     * always names the same one first, on every run.
+     *
+     * @throws IllegalStateException (or whatever unchecked exception a validator itself throws),
+     *                                propagated unchanged from the first validator, in that order,
+     *                                that finds a problem
+     */
+    public void validateAll() {
+        invokeAllValidators(this);
+    }
+
+    /**
+     * The reflective sweep behind {@link #validateAll()}, kept as its own method — taking any
+     * {@code target}, not just {@code this} — so a test can prove the MECHANISM is generic (it
+     * would sweep a seventh {@code validateXxx()} method added to any class, not just something
+     * special-cased to today's six on {@link FleetConfig}) without needing to add a real, unwanted
+     * seventh validator to this class just to exercise that claim. See {@code
+     * FleetConfigValidateAllTest} for that proof.
+     *
+     * @param target an object whose public, no-argument, {@code void} methods named {@code
+     *               validateXxx} (any name starting with {@code "validate"}, excluding {@code
+     *               validateAll} itself) should all run, in alphabetical-by-name order
+     */
+    static void invokeAllValidators(Object target) {
+        List<Method> methods = new ArrayList<>();
+        for (Method m : target.getClass().getMethods()) {
+            if (Modifier.isPublic(m.getModifiers())
+                    && m.getParameterCount() == 0
+                    && m.getReturnType() == void.class
+                    && m.getName().startsWith("validate")
+                    && !m.getName().equals("validateAll")) {
+                methods.add(m);
+            }
+        }
+        methods.sort(Comparator.comparing(Method::getName));
+        for (Method m : methods) {
+            try {
+                m.invoke(target);
+            } catch (InvocationTargetException e) {
+                Throwable cause = e.getCause();
+                if (cause instanceof RuntimeException re) {
+                    throw re;
+                }
+                if (cause instanceof Error err) {
+                    throw err;
+                }
+                throw new IllegalStateException("validator " + m.getName() + " failed", cause);
+            } catch (IllegalAccessException e) {
+                throw new IllegalStateException("cannot invoke validator " + m.getName(), e);
+            }
+        }
+    }
+
     /** True for the loopback addresses and the unspecified-but-local forms we treat as same-host. */
     private static boolean isLoopbackBind(String host) {
         if (host == null || host.isBlank()) {

fleetd/src/main/java/dev/ltms/fleet/health/FleetHealthMonitor.java

@@ -38,15 +38,46 @@ public final class FleetHealthMonitor {
      */
     static final long ASK_LAPSE_RECHECK_DELAY_SECONDS = 120;
 
+    /**
+     * fleetd #386: {@code System.nanoTime()} (or whatever {@link #clock} is) does not advance while
+     * macOS sleeps, so a raw {@code nowNanos - lastActivityAtNanos} comparison freezes with the
+     * host and can never cross {@link #workingSuspectAfterNanos}. This is a second, wall-clock
+     * source used ONLY inside the stall check ({@link #stallElapsedNanos}) to detect and correct
+     * for that freeze. Nothing else in this class reads it — every other decision (readiness grace,
+     * the fault classification itself) stays exactly on {@link #clock}, as the ticket requires.
+     */
+    private static final LongSupplier DEFAULT_REALTIME_CLOCK =
+            () -> TimeUnit.MILLISECONDS.toNanos(System.currentTimeMillis());
+
     private final AgentControl agents;
     private final Supplier<List<MemberSession>> roster;
     private final MessageService messages;
     private final ScheduledExecutorService scheduler;
     private final LongSupplier clock;
+    private final LongSupplier realtimeClock;
     private final long intervalSeconds;
+    private final long tickIntervalNanos;
     private final long workingSuspectAfterNanos;
     private final BiConsumer<String, String> failTarget;
     private final Map<String, HealthPrior> priors = new HashMap<>();
+    /**
+     * fleetd #386 clock-drift bookkeeping. {@code haveClockBaseline}/{@code lastTickMonoNanos}/
+     * {@code lastTickRealNanos} track the previous tick's pair of readings so each new tick can
+     * measure how far the two clocks moved apart since then. {@code accumulatedDriftNanos} is the
+     * running total of every such divergence observed since this monitor started (never decreases —
+     * the monotonic clock can only lag real time, never lead it). {@code busyDriftBaselineNanos}/
+     * {@code busyBaselineActivityNanos} record, per target, the value of {@code accumulatedDriftNanos}
+     * at the moment this monitor first saw that target's CURRENT {@code lastActivityAtNanos} while
+     * BUSY — so {@link #stallElapsedNanos} adds back only the drift observed DURING this BUSY span,
+     * never drift from a sleep that happened before the member went busy. All five fields are touched
+     * only from {@code tick()}, like {@link #priors}.
+     */
+    private boolean haveClockBaseline = false;
+    private long lastTickMonoNanos;
+    private long lastTickRealNanos;
+    private long accumulatedDriftNanos = 0;
+    private final Map<String, Long> busyDriftBaselineNanos = new HashMap<>();
+    private final Map<String, Long> busyBaselineActivityNanos = new HashMap<>();
     /**
      * The live classification per member, and the only one of this class's three maps that more
      * than one scheduler task touches. {@code tick} writes it (and prunes it to the roster);
@@ -88,12 +119,29 @@ public final class FleetHealthMonitor {
     public FleetHealthMonitor(AgentControl agents, Supplier<List<MemberSession>> roster, MessageService messages,
                               ScheduledExecutorService scheduler, LongSupplier clock, long intervalSeconds,
                               long workingSuspectAfterSeconds, BiConsumer<String, String> failTarget) {
+        this(agents, roster, messages, scheduler, clock, DEFAULT_REALTIME_CLOCK, intervalSeconds,
+                workingSuspectAfterSeconds, failTarget);
+    }
+
+    /**
+     * @param realtimeClock fleetd #386: a wall-clock nanosecond source (e.g.
+     *                       {@code System.currentTimeMillis()} converted to nanos) that keeps
+     *                       advancing while {@code clock} is frozen by a host sleep. Used only to
+     *                       correct the stall check — see the class-level javadoc on the
+     *                       clock-drift fields.
+     */
+    public FleetHealthMonitor(AgentControl agents, Supplier<List<MemberSession>> roster, MessageService messages,
+                              ScheduledExecutorService scheduler, LongSupplier clock, LongSupplier realtimeClock,
+                              long intervalSeconds, long workingSuspectAfterSeconds,
+                              BiConsumer<String, String> failTarget) {
         this.agents = agents;
         this.roster = roster;
         this.messages = messages;
         this.scheduler = scheduler;
         this.clock = clock;
+        this.realtimeClock = Objects.requireNonNull(realtimeClock, "realtimeClock");
         this.intervalSeconds = intervalSeconds;
+        this.tickIntervalNanos = TimeUnit.SECONDS.toNanos(intervalSeconds);
         this.workingSuspectAfterNanos = TimeUnit.SECONDS.toNanos(workingSuspectAfterSeconds);
         this.failTarget = Objects.requireNonNull(failTarget, "failTarget");
     }
@@ -123,6 +171,7 @@ public final class FleetHealthMonitor {
             for (Agent agent : agentsNow) live.put(agent.terminalId(), agent);
             HashSet<String> current = new HashSet<>();
             long nowNanos = clock.getAsLong();
+            long driftBeforeThisTick = observeClockDrift(nowNanos);
             for (MemberSession session : rosterNow) {
                 current.add(session.terminalId());
                 Agent agent = live.get(session.terminalId());
@@ -133,7 +182,7 @@ public final class FleetHealthMonitor {
                         && session.state() != MemberSession.State.SPAWNING;
                 boolean readinessGraceElapsed = nowNanos - session.spawnedAtNanos() >= READINESS_GRACE_NANOS;
                 boolean stalled = session.state() == MemberSession.State.BUSY
-                        && nowNanos - session.lastActivityAtNanos() >= workingSuspectAfterNanos;
+                        && stallElapsedNanos(session, nowNanos, driftBeforeThisTick) >= workingSuspectAfterNanos;
                 // CB-643: the three message-layer facts CB-640 published. Read them here rather than
                 // leaving them false — that constant is what made 8 of the 9 fault states dead.
                 boolean queuedDelivery = messages.hasQueuedDelivery(session.terminalId());
@@ -151,6 +200,8 @@ public final class FleetHealthMonitor {
             priors.keySet().retainAll(current);
             states.keySet().retainAll(current);
             orphanStreaks.keySet().retainAll(current);
+            busyDriftBaselineNanos.keySet().retainAll(current);
+            busyBaselineActivityNanos.keySet().retainAll(current);
         } catch (Throwable error) {
             // Any unclassified collection failure must never kill the monitor's only scheduler task.
             log.warn("fleet health collection failed; will retry next tick", error);
@@ -175,6 +226,65 @@ public final class FleetHealthMonitor {
         return streak >= ORPHAN_CONFIRM_TICKS;
     }
 
+    /**
+     * fleetd #386: compare this tick's monotonic and real-time readings against the previous
+     * tick's, and fold any positive divergence into {@link #accumulatedDriftNanos} (a ratchet — it
+     * never decreases, since the monotonic clock can only fall behind real time, never ahead of
+     * it). Logs once, at WARN, when that single tick's divergence exceeds one full tick interval —
+     * the signature of a host that slept between the two ticks (a tick literally cannot run while
+     * the process itself is suspended, so the whole sleep duration lands inside one tick's gap).
+     *
+     * @return {@link #accumulatedDriftNanos} as it stood BEFORE this tick's divergence was folded
+     *         in — the baseline {@link #stallElapsedNanos} needs when a target is observed BUSY
+     *         for the first time this tick, so a sleep that happened before this member went busy
+     *         is not attributed to it.
+     */
+    private long observeClockDrift(long nowNanos) {
+        long nowRealNanos = realtimeClock.getAsLong();
+        long driftBeforeThisTick = accumulatedDriftNanos;
+        if (haveClockBaseline) {
+            long monoDelta = nowNanos - lastTickMonoNanos;
+            long realDelta = nowRealNanos - lastTickRealNanos;
+            long tickDrift = realDelta - monoDelta;
+            if (tickDrift > tickIntervalNanos) {
+                log.warn("fleet health: the monotonic clock did not advance for about {}s that the "
+                        + "real clock did since the last tick (host likely slept); the stall "
+                        + "detector could not see that time", TimeUnit.NANOSECONDS.toSeconds(tickDrift));
+            }
+            if (tickDrift > 0) {
+                accumulatedDriftNanos = driftBeforeThisTick + tickDrift;
+            }
+        }
+        lastTickMonoNanos = nowNanos;
+        lastTickRealNanos = nowRealNanos;
+        haveClockBaseline = true;
+        return driftBeforeThisTick;
+    }
+
+    /**
+     * fleetd #386: {@code nowNanos - lastActivityAtNanos} alone freezes across a host sleep, since
+     * both come from the monotonic {@link #clock}. This adds back the real-time drift observed
+     * since this BUSY span started — not the monitor's whole lifetime, so a sleep that happened
+     * before this member went busy never leaks into its stall reading (see the class-level javadoc
+     * on the drift fields). The baseline resets whenever {@code lastActivityAtNanos} changes (a new
+     * turn) or the member is not currently BUSY.
+     */
+    private long stallElapsedNanos(MemberSession session, long nowNanos, long driftBeforeThisTick) {
+        String target = session.terminalId();
+        if (session.state() != MemberSession.State.BUSY) {
+            busyDriftBaselineNanos.remove(target);
+            busyBaselineActivityNanos.remove(target);
+            return nowNanos - session.lastActivityAtNanos();
+        }
+        Long baselineActivity = busyBaselineActivityNanos.get(target);
+        if (baselineActivity == null || baselineActivity != session.lastActivityAtNanos()) {
+            busyBaselineActivityNanos.put(target, session.lastActivityAtNanos());
+            busyDriftBaselineNanos.put(target, driftBeforeThisTick);
+        }
+        long driftSinceBusyStart = accumulatedDriftNanos - busyDriftBaselineNanos.get(target);
+        return (nowNanos - session.lastActivityAtNanos()) + driftSinceBusyStart;
+    }
+
     void reportTransition(String target, HealthState next) {
         HealthState previous = states.put(target, next);
         if (previous == next) return;

fleetd/src/main/java/dev/ltms/fleet/herdr/HerdrClient.java

@@ -3,7 +3,7 @@ package dev.ltms.fleet.herdr;
 import com.fasterxml.jackson.databind.JsonNode;
 
 /**
- * Client face onto the herdr daemon (protocol 14, herdr 0.7.0).
+ * Client face onto the herdr daemon (protocol 19, herdr 0.8.0).
  *
  * <p>This is the ONLY thing in {@code fleetd} that speaks to herdr. Every method
  * maps to a herdr JSON-RPC call over its Unix domain socket. Requests are

fleetd/src/main/java/dev/ltms/fleet/herdr/HerdrCodec.java

@@ -8,7 +8,7 @@ import com.fasterxml.jackson.databind.node.ObjectNode;
 import java.nio.charset.StandardCharsets;
 
 /**
- * Wire codec for herdr's newline-delimited JSON-RPC (protocol 14).
+ * Wire codec for herdr's newline-delimited JSON-RPC (protocol 19).
  *
  * <p>Split out from the socket so the framing rules — the ones that actually bit us
  * during the spike (id MUST be a string; response carries {@code result} or

fleetd/src/main/java/dev/ltms/fleet/herdr/LeadTabScanner.java

@@ -5,6 +5,7 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
 import java.util.Collections;
+import java.util.HashSet;
 import java.util.LinkedHashMap;
 import java.util.Locale;
 import java.util.Map;
@@ -53,17 +54,40 @@ import java.util.function.Supplier;
  * daemon and found again by this scan. The trust direction above is unaffected — fleetd writing a
  * name for a lead it just started is not a pane promoting itself — but <em>staleness</em> becomes
  * real: a label left behind by a session that has since died would read as a live lead forever.
- * This scanner does not solve that (its job is naming, and a stale name costs nothing here); the
- * launcher does, by requiring a running agent in the tab before it counts the lead as live. If you
- * ever make a decision that <em>removes</em> something based on this map, add the same check.
  * The remaining hazard is an <em>operator</em> one — a worker {@code tabLabel} template that
  * happens to start with the same prefix would promote the whole fleet — and that is refused at
  * startup by {@code FleetConfig.validateLeadTabPrefixes} rather than documented here.
  *
+ * <p><strong>fleetd #359 — the staleness check this class used to skip.</strong> This used to say
+ * "a stale name costs nothing here" and leave liveness to {@code LeadLauncher}, on the theory that
+ * naming and removing are different decisions. That was wrong: {@code dev.ltms.fleet.msg.LeadCoordLoop}
+ * makes exactly the kind of removal decision the old javadoc warned about, by reading this map to
+ * pick which pane a peer message goes into — and a stale entry there is not free. On a host where
+ * {@code fleetd} had restarted more than once, a labelled-but-dead tab from a previous life was
+ * reported right alongside the live one; {@code LeadCoordLoop.resolveLocalLead()} saw more than one
+ * candidate and refused to guess (safe), but the fix the daemon's own WARN suggests — name a lead
+ * after {@code coordinator.selfId} — stops being safe once two tabs can share a label: step 1 of
+ * that resolution picks whichever matching entry it finds first, which can be the dead one, and
+ * typing a peer's message into a dead shell does not fail — it is silently gone instead of merely
+ * held. {@link #scan()} now cross-checks every labelled tab against {@code agent.list} (the same
+ * signal {@code LeadLauncher.countLeads} already trusts for the same purpose) and drops any tab
+ * with no agent running in it, so a dead tab is never in the map for a caller to pick at all.
+ *
  * <p><strong>Caching.</strong> {@link #get()} is on the request path (every resolve), so the scan
- * is TTL-cached and a stale-but-valid map is preferred to a herdr round-trip. A failed scan keeps
- * the previous answer instead of emptying it — a herdr hiccup must not silently demote a live lead
- * mid-session.
+ * is TTL-cached and a stale-but-valid map is preferred to a herdr round-trip. A failed scan (herdr
+ * throws) keeps the previous answer instead of emptying it — a herdr hiccup must not silently
+ * demote a live lead mid-session.
+ *
+ * <p><strong>fleetd #359 review, finding 2 — a successful-but-wrong scan is the same hazard.</strong>
+ * The catch above only fires when a call throws. It does nothing for a call that returns 200 with an
+ * incomplete answer — exactly what the ticket's own evidence showed {@code agent.list} can do. Once
+ * this class started trusting that signal, an empty read would otherwise get cached as fact and
+ * silently drop a lead {@code CallerResolver} had, until then, correctly resolved — turning it into a
+ * {@code Role.WORKER}, which refuses every orchestration call. So a terminal this class already
+ * reported as live is not dropped the first time {@code agent.list} loses it: {@link #scan()} grants
+ * it one grace scan (see {@code gracedTerminals}) and only drops it if a <em>later</em> scan still
+ * finds no agent. A terminal never reported live before gets no grace — that would weaken the
+ * original #359 fix itself, which this class's own test suite already pins.
  */
 public final class LeadTabScanner implements Supplier<Map<String, String>> {
 
@@ -79,6 +103,15 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
     private long scannedAtNanos;
     private boolean everScanned;
 
+    /**
+     * Terminals currently on their one grace scan: {@code cached} reported them live, the most
+     * recent {@link #scan()} found no agent for them, and they were re-included anyway. Cleared for
+     * a terminal the instant it is seen live again; a terminal still here on the <em>next</em> scan
+     * is finally dropped. Scoped separately from {@link #cached} so a graced terminal cannot renew
+     * its own grace forever just by staying in the exposed map (fleetd #359 review, finding 2).
+     */
+    private Set<String> gracedTerminals = Set.of();
+
     /**
      * @param herdr                   the herdr client to query ({@code workspace.list},
      *                                {@code tab.list}, {@code pane.list} — all read-only)
@@ -141,7 +174,7 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
         return cached;
     }
 
-    /** One full pass: labelled tabs → their panes → those panes' terminals. */
+    /** One full pass: labelled tabs → live agents in them → those panes' terminals. */
     private Map<String, String> scan() {
         Map<String, String> nameByTab = new LinkedHashMap<>();
         for (JsonNode w : herdr.call("workspace.list").path("workspaces")) {
@@ -158,17 +191,47 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
             }
         }
 
-        Map<String, String> byTerminal = new LinkedHashMap<>();
-        if (!nameByTab.isEmpty()) {
-            // One pane.list for every tab: panes carry tab_id, so the join is local.
-            for (JsonNode p : herdr.call("pane.list", Map.of()).path("panes")) {
-                String name = nameByTab.get(p.path("tab_id").asText(null));
-                String terminal = p.path("terminal_id").asText(null);
-                if (name != null && terminal != null && !terminal.isBlank()) {
-                    byTerminal.put(terminal, name);
-                }
+        if (nameByTab.isEmpty()) {
+            gracedTerminals = Set.of();
+            return Map.of();
+        }
+
+        // fleetd #359: a labelled tab is only a lead when herdr also reports a running agent in
+        // it — the same liveness signal LeadLauncher.countLeads trusts for the identical purpose.
+        // Without this, a tab left behind by a session that has since died reads as live forever.
+        Set<String> tabsWithAgent = new HashSet<>();
+        for (JsonNode a : herdr.call("agent.list").path("agents")) {
+            String tabId = a.path("tab_id").asText(null);
+            if (tabId != null) {
+                tabsWithAgent.add(tabId);
             }
         }
+
+        Map<String, String> byTerminal = new LinkedHashMap<>();
+        Set<String> stillGraced = new HashSet<>();
+        // One pane.list for every tab: panes carry tab_id, so the join is local.
+        for (JsonNode p : herdr.call("pane.list", Map.of()).path("panes")) {
+            String tabId = p.path("tab_id").asText(null);
+            String name = nameByTab.get(tabId);
+            String terminal = p.path("terminal_id").asText(null);
+            if (name == null || terminal == null || terminal.isBlank()) {
+                continue;
+            }
+            if (tabsWithAgent.contains(tabId)) {
+                byTerminal.put(terminal, name);
+                continue;
+            }
+            // No agent reported for this tab, but its tab/pane are still here — this is the
+            // ambiguous case review finding 2 named: a successful agent.list that came back short
+            // does not prove the lead is dead. Grant one grace scan to a terminal we had already
+            // reported as live; a terminal we never reported live gets none, so the original #359
+            // fix (a genuinely dead tab is never reported) is unaffected for the common case.
+            if (cached.containsKey(terminal) && !gracedTerminals.contains(terminal)) {
+                byTerminal.put(terminal, name);
+                stillGraced.add(terminal);
+            }
+        }
+        gracedTerminals = stillGraced;
         return Collections.unmodifiableMap(byTerminal);
     }
 
@@ -177,12 +240,14 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
      *
      * <p>Exact match (case-insensitive, ends stripped) against {@link #tabToName} — no prefix
      * stripping, so an operator's {@code "lead: something-else"} tab is never mistaken for a
-     * configured lead just because it shares a prefix.
+     * configured lead just because it shares a prefix. The match strips a trailing
+     * {@link PendingCloseMarker} first, so a tab {@code LeadLauncher} has flagged as maybe-dead but
+     * not yet closed keeps resolving normally while that reconcile is pending.
      */
     private String leadNameOf(String label) {
         if (label == null) {
             return null;
         }
-        return tabToName.get(label.strip().toLowerCase(Locale.ROOT));
+        return tabToName.get(PendingCloseMarker.strip(label).toLowerCase(Locale.ROOT));
     }
 }

fleetd/src/main/java/dev/ltms/fleet/herdr/PendingCloseMarker.java

@@ -0,0 +1,42 @@
+package dev.ltms.fleet.herdr;
+
+/**
+ * The suffix {@code dev.ltms.fleet.lead.LeadLauncher} appends to a lead tab's label the first time a
+ * reconcile finds no running agent in it, before it is sure enough to close the tab outright.
+ *
+ * <p><strong>fleetd #359 review, finding 1.</strong> The daemon's own evidence showed
+ * {@code agent.list} can read "no agent" for a tab that genuinely has one running — so a single such
+ * reading must never be treated as proof a tab is dead. {@code LeadLauncher} now writes this marker
+ * on the first miss, and only closes the tab if a <em>later</em>, independent reconcile still finds
+ * it dead while the marker is still there. Two consecutive misses, one restart apart, is a much
+ * stronger claim than one.
+ *
+ * <p>{@link LeadTabScanner} strips the same suffix before matching a label against a configured
+ * lead's {@code tab}, so a flagged-but-actually-still-live tab keeps resolving normally — the marker
+ * changes nothing about which pane {@code LeadCoordLoop} can reach while the flag is pending. Both
+ * classes must use exactly this suffix, which is why it lives here rather than as a private constant
+ * on either.
+ */
+public final class PendingCloseMarker {
+
+    public static final String SUFFIX = " [fleetd:pending-close]";
+
+    private PendingCloseMarker() {
+    }
+
+    /** The label with any trailing pending-close marker removed, for name matching. */
+    public static String strip(String label) {
+        if (label == null) {
+            return null;
+        }
+        String stripped = label.strip();
+        return stripped.endsWith(SUFFIX)
+                ? stripped.substring(0, stripped.length() - SUFFIX.length()).strip()
+                : stripped;
+    }
+
+    /** Whether a label currently carries the marker. */
+    public static boolean isFlagged(String label) {
+        return label != null && label.strip().endsWith(SUFFIX);
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/inject/CompletionResolver.java

@@ -548,8 +548,19 @@ public final class CompletionResolver implements TurnListener {
      * fast completion. Runs the same backend-error classification the normal and raw-scrape paths
      * apply, against whatever is on screen right now: a match together with the too-fast crash
      * signature notifies {@link #backendErrorSink} (only on the resolution that wins the race). A
-     * non-match stays the original generic too-fast failure, naming the member and both timings,
-     * with whatever the pane shows appended so the caller sees the cause, not just "it failed".
+     * non-match stays the generic too-fast failure, naming the member and both timings, with
+     * whatever the pane shows appended so the caller sees the evidence, not just "it failed".
+     *
+     * <p>fleetd#376: <strong>this path must never resolve a completion.</strong> A fast backend can
+     * genuinely answer inside the floor, so the failure is sometimes wrong — but it is wrong in the
+     * loud direction, and the fix for that is honest wording, not a guess at the pane's meaning.
+     * Reclassifying from the scrape was tried and rejected: there is no reliable positive marker for
+     * "this is a real reply" across backends. {@link #lastAssistantBlock} falls back to the entire
+     * pane when it finds no {@code ⏺} marker, so on a crash the candidate "reply" is the whole
+     * screen; and {@code ⏺} itself is a Claude Code marker that an opencode pane never carries — the
+     * very backend whose speed raised this ticket. Any weaker test (non-blank, or "contains sentence
+     * punctuation") passes on almost every crash, because a pane holding a file path, a version
+     * number or a hostname contains a full stop. That trades a loud wrong answer for a silent one.
      */
     private void failTooFast(String target, InFlight turn, CompletableFuture<Rendezvous.Resolution> waiter,
                               long elapsedNanos) {
@@ -560,13 +571,13 @@ public final class CompletionResolver implements TurnListener {
             scrape = "";
         }
         String clippedScrape = clip(scrape);
-        String baseReason = String.format(
-                "member %s went BUSY -> DONE in %dms (floor %dms) — too fast to be real work, most "
-                        + "likely a backend error before any work started",
+        String timing = String.format(
+                "member %s went BUSY -> DONE in %dms (floor %dms)",
                 target, elapsedNanos / 1_000_000, MIN_TURN_NANOS / 1_000_000);
         String backendError = firstMatchingLine(scrape, backendErrorPatternOrFallback(target));
         if (backendError != null) {
-            String reason = baseReason + ": " + clippedScrape;
+            String reason = timing + " — too fast to be real work, and the pane carries a backend "
+                    + "error: " + clippedScrape;
             if (rendezvous.resolveFailure(waiter, reason)) {
                 inFlight.remove(target, turn);
                 log.warn("failing send to {} via turn-stall fallback: {}", target, reason);
@@ -575,7 +586,14 @@ public final class CompletionResolver implements TurnListener {
             }
             return;
         }
-        fail(target, turn, clippedScrape.isBlank() ? baseReason : baseReason + ": " + clippedScrape);
+        // fleetd#376: no pattern matched, so the cause is genuinely unknown. Say that, rather than
+        // asserting a backend error the way this message used to — a fast backend really can finish
+        // inside the floor, and a reader who trusts a wrong cause stops looking at the pane.
+        String reason = timing + " — inside the floor. That is usually a backend error before any "
+                + "work started, but a fast backend can answer inside it too, and nothing here can "
+                + "tell those apart, so the turn is reported failed rather than guessed. Read the "
+                + "pane below before deciding which it was";
+        fail(target, turn, clippedScrape.isBlank() ? reason : reason + ": " + clippedScrape);
     }
 
     /**
@@ -680,17 +698,57 @@ public final class CompletionResolver implements TurnListener {
     }
 
     /**
-     * Coverage summary for the CB-578 stage A exhausted-pattern classification, logged at startup
+     * What an unset pattern key means for the classification it configures (fleetd#415).
+     * {@code coverage()} cannot infer this from the key's name — the two keys it currently
+     * describes disagree on it, and a string comparison on the name would just move the same bug
+     * to a new spot — so every caller must state it explicitly.
+     *
+     * <p><strong>This alone does not prove a caller passes the right one for its key.</strong> A
+     * test that calls {@code coverage()} directly and supplies the meaning itself only proves this
+     * enum is worded correctly, never that {@code Fleetd}'s two call sites pair each key with its
+     * true meaning — that pairing is #415's actual defect. Measured on review: swapping the two
+     * {@code UnsetMeaning} arguments at those call sites (giving {@code exhaustedPattern} the
+     * built-in-default wording and {@code errorPattern} the off wording — #415's exact defect with
+     * the keys exchanged) compiled with 0 errors and left all 1506 existing tests green. See
+     * {@code dev.ltms.fleet.Fleetd#exhaustedPatternCoverageLine}/{@code #errorPatternCoverageLine}
+     * and {@code FleetdPatternCoverageLineTest}, which exists specifically to catch that swap.
+     */
+    public enum UnsetMeaning {
+        /** No fallback exists: a profile with no configured pattern truly has this classification off. */
+        OFF,
+        /** A built-in pattern applies when unset: the classification still runs for that profile. */
+        BUILT_IN_DEFAULT
+    }
+
+    /**
+     * Coverage summary for a fleetd#201/CB-578-style pattern-key classification, logged at startup
      * the way {@link dev.ltms.fleet.health.FleetHealthMonitor#coverage} is — so an operator can
      * see whether the classification is on, and for which profiles, without reading every
      * profile's config by hand.
      *
+     * <p>fleetd#415: this method measures <em>pattern coverage</em> — how many profiles set the
+     * key — which is not the same thing as <em>feature state</em> for a key with a fallback. For
+     * {@code errorPattern}, an empty {@code configuredProfiles} still runs the classification
+     * against {@code CompletionResolver}'s built-in compatibility pattern ({@link #BACKEND_ERROR}
+     * at line ~84); for {@code exhaustedPattern} there is no fallback, so empty really does mean
+     * off. {@code unsetMeaning} is the single, required source of that fact — see
+     * {@link dev.ltms.fleet.config.FleetConfig#rejectMalformedProfilePatterns} lines ~2029-2032 for
+     * where it is documented for config authors. It is a required parameter, not a defaulted
+     * overload: a third pattern key added later must supply one to compile at all, rather than
+     * silently inheriting whichever wording this method happened to default to.
+     *
      * @param allProfiles        every configured profile name
-     * @param configuredProfiles the subset of {@code allProfiles} that carry an exhausted pattern
+     * @param configuredProfiles the subset of {@code allProfiles} that carry the pattern
      */
-    public static String coverage(String patternKey, Set<String> allProfiles, Set<String> configuredProfiles) {
+    public static String coverage(String patternKey, UnsetMeaning unsetMeaning, Set<String> allProfiles,
+                                   Set<String> configuredProfiles) {
         if (configuredProfiles.isEmpty()) {
-            return "off (no profile has an " + patternKey + " configured; profiles: " + sorted(allProfiles) + ")";
+            return switch (unsetMeaning) {
+                case OFF -> "off (no profile has an " + patternKey + " configured; profiles: "
+                        + sorted(allProfiles) + ")";
+                case BUILT_IN_DEFAULT -> "built-in default for all profiles (no profile customises "
+                        + patternKey + "; profiles: " + sorted(allProfiles) + ")";
+            };
         }
         Set<String> unconfigured = new TreeSet<>(allProfiles);
         unconfigured.removeAll(configuredProfiles);

fleetd/src/main/java/dev/ltms/fleet/inject/LiveExhaustedPatterns.java

@@ -0,0 +1,91 @@
+package dev.ltms.fleet.inject;
+
+import dev.ltms.fleet.config.FleetConfig;
+
+import java.util.Map;
+import java.util.Objects;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.function.Supplier;
+import java.util.regex.Pattern;
+
+/**
+ * fleetd #446: the single live source for "is {@code exhaustedPattern} configured for this
+ * profile, and what does it compile to". Read fresh off the config supplier on every call — the
+ * same reason {@code CompositePeerLauncher#models0} is a live supplier read rather than a value
+ * captured at construction (see that class's doc) — so an operator can arm or disarm usage-limit
+ * detection for a profile by editing {@code exhaustedPattern} and reloading, with no restart.
+ *
+ * <p>Before this class, {@code exhaustedPattern} was compiled once into a {@code Map<String,
+ * Pattern>} built inside {@code Fleetd.main} at startup ({@code ConfigRef}'s class doc used to
+ * list it under <em>Deferred</em>, CB-578 stage A) — the asymmetry fleetd #446 exists to close:
+ * an operator could turn a model off at runtime ({@code models.allow}'s {@code enabled: false},
+ * hot since fleetd #422) but could not arm the detector that would tell them to, without a
+ * restart. That was backwards for a feature whose whole point is to react while the fleet runs.
+ *
+ * <p>{@link #patternFor} is what {@link CompletionResolver} enforces on (via the {@link
+ * ExhaustedPatternLookup} production wiring in {@code Fleetd.main}); {@link #armed} is what
+ * {@code fleet_profiles}/{@code GET /profiles} report as {@code exhaustionDetectionArmed}. Both
+ * read this ONE object, so the report can never disagree with the behaviour — the same rule
+ * {@code CompositePeerLauncher#modelGateState()}'s javadoc states for the model gate's own
+ * armed/off pair (fleetd #404): "armed" and "which models are off" must come from one read of the
+ * same accessor the gate enforces on.
+ *
+ * <h2>Cache eviction</h2>
+ * Cached by profile NAME, not by pattern text. A {@code Map<String, Pattern>} keyed by the
+ * pattern STRING would grow by one entry per distinct regex ever typed for any profile across the
+ * daemon's uptime — unbounded in practice, because tuning a regex to match a backend's exact
+ * wording is exactly the kind of edit an operator makes several times while getting it right, and
+ * every edit-and-reload cycle would leave the previous attempt's compiled {@link Pattern} behind
+ * forever. Keyed by profile name instead, this cache holds at most one entry per profile name that
+ * has ever been looked up — and that key space is bounded by the (small, human-authored) set of
+ * configured profiles, which changes only on a restart: adding or removing a profile is itself a
+ * deferred key (a new backend needs its own launcher, built once — see {@code ConfigRef}'s class
+ * doc), so profile names do not churn the way pattern text does. Re-editing an EXISTING profile's
+ * {@code exhaustedPattern} — the case this class exists to make hot — simply overwrites that
+ * profile's one cache entry; it never adds a new one.
+ */
+public final class LiveExhaustedPatterns {
+
+    /** A compiled pattern paired with the source string it was compiled from, for change detection. */
+    private record Cached(String source, Pattern compiled) {
+    }
+
+    private final Supplier<Map<String, FleetConfig.Profile>> profiles;
+    private final ConcurrentHashMap<String, Cached> cache = new ConcurrentHashMap<>();
+
+    public LiveExhaustedPatterns(Supplier<Map<String, FleetConfig.Profile>> profiles) {
+        this.profiles = Objects.requireNonNull(profiles, "profiles");
+    }
+
+    /**
+     * The compiled {@code exhaustedPattern} currently configured for {@code profileName}, or
+     * {@code null} when that profile is unknown or has none configured. Recompiles only when the
+     * live pattern text differs from what is cached for this profile name; {@code
+     * FleetConfig#rejectMalformedProfilePatterns} already refuses a config (at load and at reload)
+     * whose {@code exhaustedPattern} does not compile, so this is not expected to throw in
+     * production — it is not defended against here for that reason, the same trust
+     * {@code CompositePeerLauncher#models0} places in config validation having already run.
+     */
+    public Pattern patternFor(String profileName) {
+        if (profileName == null) {
+            return null;
+        }
+        FleetConfig.Profile profile = profiles.get().get(profileName);
+        if (profile == null || !profile.hasExhaustedPattern()) {
+            return null;
+        }
+        String source = profile.exhaustedPattern();
+        Cached cached = cache.get(profileName);
+        if (cached != null && cached.source().equals(source)) {
+            return cached.compiled();
+        }
+        Cached fresh = new Cached(source, Pattern.compile(source));
+        cache.put(profileName, fresh);
+        return fresh.compiled();
+    }
+
+    /** Whether {@code profileName} currently has a usage-limit pattern configured (live). */
+    public boolean armed(String profileName) {
+        return patternFor(profileName) != null;
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/lead/LeadLauncher.java

@@ -4,6 +4,7 @@ import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.HerdrException;
+import dev.ltms.fleet.herdr.PendingCloseMarker;
 import dev.ltms.fleet.herdr.Tab;
 import dev.ltms.fleet.herdr.Workspace;
 import dev.ltms.fleet.herdr.WorkspaceControl;
@@ -12,9 +13,11 @@ import org.slf4j.LoggerFactory;
 
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
+import java.util.Set;
 import dev.ltms.fleet.peer.PeerLauncher;
 
 /**
@@ -44,8 +47,33 @@ import dev.ltms.fleet.peer.PeerLauncher;
  * privilege escalation (the tab label never granted anything a pane could take for itself; see that
  * class's javadoc), but <em>staleness</em>: a label left behind by a crashed session would otherwise
  * read as a live lead forever, and the lead would never be relaunched. So a lead counts as live only
- * when herdr also reports a <em>running agent</em> in that tab — see {@link #liveLeads}. A labelled
+ * when herdr also reports a <em>running agent</em> in that tab — see {@link #countLeads}. A labelled
  * tab with no agent in it is not a lead.
+ *
+ * <p><strong>fleetd #359 — a stale label used to pile up, not just mislead.</strong> Finding "not
+ * live" here used to mean only one thing: launch another. The old label was left exactly where it
+ * was, so a daemon that restarted enough times — or hit one herdr read that missed a genuinely
+ * running agent — accumulated one more identically-labelled dead tab per occurrence, and
+ * {@code LeadTabScanner} (before its own #359 fix) reported every one of them as a lead.
+ *
+ * <p><strong>Review finding 1 — closing on one reading is worse than the bug.</strong> The first
+ * version of this fix closed a name's dead tabs the moment a single {@link #countLeads} reading
+ * called them dead. The ticket's own live evidence rules that out: on a real host, {@code
+ * agent.list} was seen reporting "0 live" for a tab that a plain {@code ps} confirmed was running a
+ * real session. Closing on that reading would have destroyed the operator's actual lead — a worse
+ * failure than the extra tab it replaces. So {@link #ensureLeads()} now needs the same dead reading
+ * <em>twice</em>, one restart apart, before it closes anything: the first time a labelled tab reads
+ * dead, it is only flagged ({@link PendingCloseMarker}), left running, untouched; it is closed only
+ * if a <em>later</em>, independently-connected reconcile still finds it dead while the flag is
+ * still there. A transient miss self-heals — the next reconcile sees the agent again and clears the
+ * flag (see {@code toUnflag} below) — so the worst case for a single bad reading is one extra tab
+ * surviving one more restart, never a live session destroyed. Two alternatives were considered and
+ * rejected: corroborating {@code agent.list} against a second, truly independent signal was dropped
+ * because nothing else herdr exposes proves "is a process attached to this pane" any better — a
+ * second call to the same unreliable source is not independent evidence; capping the close to "all
+ * but the most recent dead tab" was dropped because "most recent" has no reliable ordering across
+ * tab ids and would leave the true failure mode (a name that is <em>never</em> reconfirmed) growing
+ * by one tab per bad reading forever, which is the exact defect this ticket exists to fix.
  */
 public final class LeadLauncher {
 
@@ -79,9 +107,9 @@ public final class LeadLauncher {
             return 0;
         }
 
-        Map<String, Integer> live;
+        Map<String, LeadCount> live;
         try {
-            live = liveLeads(leaders);
+            live = countLeads(leaders);
         } catch (HerdrException e) {
             // Counting is the whole safety mechanism against double-spawning. If we cannot count, we
             // must not guess — spawning a second orchestrator is worse than starting none.
@@ -93,9 +121,53 @@ public final class LeadLauncher {
         for (Map.Entry<String, FleetConfig.Leader> e : leaders.entrySet()) {
             String name = e.getKey();
             FleetConfig.Leader lead = e.getValue();
-            int running = live.getOrDefault(name, 0);
+            LeadCount state = live.getOrDefault(name, LeadCount.NONE);
+            int running = state.running();
             int wanted = lead.instances();
 
+            // fleetd #359 review finding 1: a tab already flagged pending-close, still labelled for
+            // this lead, and STILL hosting no agent on this separate reconcile — two independent
+            // readings agree, so close it. A tab found dead for the first time is only flagged below,
+            // never closed on the spot.
+            for (String tabId : state.toClose()) {
+                log.info("lead '{}': closing tab {} — flagged pending-close on a previous reconcile "
+                        + "and still no agent running in it", name, tabId);
+                try {
+                    spaces.closeTab(tabId);
+                } catch (RuntimeException cleanup) {
+                    log.warn("could not close stale tab {} for lead '{}': {}",
+                            tabId, name, cleanup.getMessage());
+                }
+            }
+            // A tab labelled for this lead, with no agent running in it, seen dead for the first
+            // time — flag it rather than closing it. One reading of `agent.list` is not enough
+            // evidence to destroy a tab that might genuinely be live (see the class javadoc).
+            for (String tabId : state.toFlag()) {
+                String flagged = lead.tabLabel() + PendingCloseMarker.SUFFIX;
+                log.info("lead '{}': tab {} has no agent running in it this reconcile — flagging it "
+                        + "'{}' rather than closing; it is only closed if a later reconcile still "
+                        + "finds it dead", name, tabId, flagged);
+                try {
+                    spaces.renameTab(tabId, flagged);
+                } catch (RuntimeException cleanup) {
+                    log.warn("could not flag stale tab {} for lead '{}': {}",
+                            tabId, name, cleanup.getMessage());
+                }
+            }
+            // A previously-flagged tab that is running an agent again — the miss that flagged it was
+            // transient. Clear the flag so a future, unrelated miss starts its own two-reading count
+            // rather than closing on the strength of this one's already-spent flag.
+            for (String tabId : state.toUnflag()) {
+                log.info("lead '{}': tab {} is running an agent again — clearing its pending-close flag",
+                        name, tabId);
+                try {
+                    spaces.renameTab(tabId, lead.tabLabel());
+                } catch (RuntimeException cleanup) {
+                    log.warn("could not clear the pending-close flag on tab {} for lead '{}': {}",
+                            tabId, name, cleanup.getMessage());
+                }
+            }
+
             if (running >= wanted) {
                 log.info("lead '{}': {} live, {} wanted — nothing to start", name, running, wanted);
                 continue;
@@ -126,18 +198,29 @@ public final class LeadLauncher {
     }
 
     /**
-     * How many live leads exist per configured name: a running agent in a tab labelled with that
-     * lead's exact {@code tab} (CB-579). Member workspaces are excluded, exactly as the scanner
-     * excludes them: a member must not be counted as a lead because it happens to sit in a matching
-     * tab.
+     * How many live leads exist per configured name, and which of that name's labelled tabs are
+     * <em>not</em> live: a running agent in a tab labelled with that lead's exact {@code tab}
+     * (CB-579). Member workspaces are excluded, exactly as the scanner excludes them: a member must
+     * not be counted as a lead because it happens to sit in a matching tab.
      *
      * <p>There used to be a second path here — a running agent on the terminal a
      * {@code fleet.leaders.<name>.terminal} pin named, for a lead opened and pinned by hand. That
      * pin is retired: {@code tab} is now the only field identity depends on, and {@link Agent}
      * already carries {@link Agent#tabId()} directly, so a hand-opened lead is found the same way an
      * auto-launched one is — by labelling its tab to match.
+     *
+     * <p>fleetd #359 review finding 1: a labelled tab with nothing running in it is split into
+     * {@code toClose} (already flagged pending-close by a previous reconcile, and still dead — two
+     * independent readings agree) and {@code toFlag} (dead for the first time — not enough evidence
+     * to close yet). {@code toUnflag} is the reverse: a tab flagged pending-close that is running an
+     * agent again, so the flag it carries no longer means anything and {@link #ensureLeads()} clears
+     * it.
      */
-    private Map<String, Integer> liveLeads(Map<String, FleetConfig.Leader> leaders) {
+    private record LeadCount(int running, List<String> toClose, List<String> toFlag, List<String> toUnflag) {
+        static final LeadCount NONE = new LeadCount(0, List.of(), List.of(), List.of());
+    }
+
+    private Map<String, LeadCount> countLeads(Map<String, FleetConfig.Leader> leaders) {
         // A lead and the members share ONE workspace now (the operator asked for a single "session"
         // with many tabs), so a workspace can no longer be excluded wholesale — the lead lives in the
         // member workspace by design. The sole discriminator is the exact tab label: a lead carries
@@ -145,6 +228,7 @@ public final class LeadLauncher {
         // profile's `worker: {profile} #{n}` template. These never collide, so an exact-label match
         // separates them without needing to know which workspace anyone is in.
         Map<String, String> nameByTab = new LinkedHashMap<>();
+        Set<String> flaggedTabIds = new LinkedHashSet<>();
         for (Workspace ws : spaces.listWorkspaces()) {
             if (ws.workspaceId() == null) {
                 continue;
@@ -153,31 +237,65 @@ public final class LeadLauncher {
                 String declared = leadNameOf(tab.label(), leaders);
                 if (declared != null && tab.tabId() != null) {
                     nameByTab.put(tab.tabId(), declared);
+                    if (PendingCloseMarker.isFlagged(tab.label())) {
+                        flaggedTabIds.add(tab.tabId());
+                    }
                 }
             }
         }
 
+        Set<String> liveTabIds = new LinkedHashSet<>();
         Map<String, Integer> counts = new LinkedHashMap<>();
         for (Agent a : agents.list()) {
             String name = nameByTab.get(a.tabId());
             if (name != null) {
                 counts.merge(name, 1, Integer::sum);
+                liveTabIds.add(a.tabId());
             }
         }
-        return counts;
+
+        Map<String, List<String>> toCloseByName = new LinkedHashMap<>();
+        Map<String, List<String>> toFlagByName = new LinkedHashMap<>();
+        Map<String, List<String>> toUnflagByName = new LinkedHashMap<>();
+        nameByTab.forEach((tabId, name) -> {
+            boolean live = liveTabIds.contains(tabId);
+            boolean flagged = flaggedTabIds.contains(tabId);
+            if (live) {
+                if (flagged) {
+                    toUnflagByName.computeIfAbsent(name, k -> new ArrayList<>()).add(tabId);
+                }
+                return;
+            }
+            if (flagged) {
+                toCloseByName.computeIfAbsent(name, k -> new ArrayList<>()).add(tabId);
+            } else {
+                toFlagByName.computeIfAbsent(name, k -> new ArrayList<>()).add(tabId);
+            }
+        });
+
+        Map<String, LeadCount> out = new LinkedHashMap<>();
+        for (String name : leaders.keySet()) {
+            out.put(name, new LeadCount(counts.getOrDefault(name, 0),
+                    toCloseByName.getOrDefault(name, List.of()),
+                    toFlagByName.getOrDefault(name, List.of()),
+                    toUnflagByName.getOrDefault(name, List.of())));
+        }
+        return out;
     }
 
     /**
      * The configured lead a tab label names, or {@code null} for a label that names none.
      *
      * <p>Matched exactly (case-insensitively) against each lead's configured {@code tab}, so an
-     * operator's {@code "lead: something-else"} tab is not mistaken for a configured lead.
+     * operator's {@code "lead: something-else"} tab is not mistaken for a configured lead. A
+     * trailing {@link PendingCloseMarker} is stripped first, so a tab this class flagged on a
+     * previous reconcile is still recognised as the same lead's tab on this one.
      */
     private String leadNameOf(String label, Map<String, FleetConfig.Leader> leaders) {
         if (label == null) {
             return null;
         }
-        String l = label.strip();
+        String l = PendingCloseMarker.strip(label);
         for (Map.Entry<String, FleetConfig.Leader> e : leaders.entrySet()) {
             String tab = e.getValue().tabLabel();
             if (tab != null && l.equalsIgnoreCase(tab.strip())) {

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -37,6 +37,7 @@ import io.modelcontextprotocol.spec.McpSchema;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import jakarta.servlet.http.HttpServlet;
 
+import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
@@ -44,6 +45,7 @@ import java.util.Objects;
 import java.util.Set;
 import java.util.UUID;
 import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.TimeUnit;
 import java.util.function.BiFunction;
 import java.util.function.Function;
 import java.util.function.LongSupplier;
@@ -101,6 +103,8 @@ public final class FleetMcp {
     private final LeadSeatSource leadSeats;
     /** CB-637: this daemon's lead-to-lead channel; {@code null} when no coordinator is configured. */
     private final LeadChannel leadChannel;
+    /** fleetd #361: {@code coordinator.peers} — see {@link CoordinationSource}. Empty when unset. */
+    private final List<String> peers;
 
     /** Capacity facts used by {@code fleet_list}; production must supply the placement live count. */
     public record CapacitySource(Function<String, Integer> liveCount, Function<String, Integer> maxLoad,
@@ -116,9 +120,57 @@ public final class FleetMcp {
     /**
      * CB-578 stage B quarantine facts used by {@code fleet_profiles}: a profile → credential id
      * lookup, plus the shared {@link BackendQuarantine} to read remaining cooldowns off.
+     *
+     * @param exhaustedPatternArmed fleetd #395, made live by fleetd #446: profile → whether that
+     *                      profile's {@code exhaustedPattern} is configured right now (see {@code
+     *                      FleetConfig.Profile#hasExhaustedPattern}), i.e. whether a backend refusal
+     *                      on it can EVER be classified {@code BACKEND_EXHAUSTED} and quarantine its
+     *                      credential. Bundled here, not a separate Source, because it answers the
+     *                      exact question {@code fleet_profiles}'s quarantine facts already answer
+     *                      for a QUARANTINED profile — "can this profile's usage limit ever be
+     *                      caught?" — just for every profile, not only one currently caught. In
+     *                      production this reads {@link dev.ltms.fleet.inject.LiveExhaustedPatterns#armed} —
+     *                      the SAME live accessor {@link dev.ltms.fleet.inject.CompletionResolver}
+     *                      enforces on — so a reload that arms or disarms detection is reported
+     *                      correctly on the very next call, no restart (see that class's doc).
+     * @param modelFor      fleetd #446 criterion 3: profile → the {@code model:} it runs, or
+     *                      {@code null} when the profile names none. Read live off the current
+     *                      config, the same way {@code credentialIdFor} already is. Used to name,
+     *                      in a QUARANTINED profile's row, which of the operator's configured models
+     *                      the fix (\"set {@code enabled: false} on it under {@code models.allow}\")
+     *                      actually applies to.
+     * @param reasonFor     fleetd #446 criterion 3: credential id → the backend text that triggered
+     *                      its most recent quarantine, or {@code null} when none is known (e.g. an
+     *                      inert source, or a quarantine recorded before this field existed). Never
+     *                      consulted on its own to decide whether a credential is quarantined —
+     *                      callers gate on {@link BackendQuarantine#remainingSeconds} first, exactly
+     *                      like {@code credentialId} itself, so a stale reason left behind after a
+     *                      quarantine expires is never surfaced.
      */
-    public record QuarantineSource(Function<String, String> credentialIdFor, BackendQuarantine quarantine) {
-        /** Inert source — no profile is ever reported quarantined. Explicit stand-in, not a default. */
+    public record QuarantineSource(Function<String, String> credentialIdFor, BackendQuarantine quarantine,
+                                    Function<String, Boolean> exhaustedPatternArmed,
+                                    Function<String, String> modelFor,
+                                    Function<String, String> reasonFor) {
+        /**
+         * Backward-compatible 3-arg form, before fleetd #446 added {@code modelFor}/{@code
+         * reasonFor} — neither is ever reported. Keeps every pre-existing call site (production and
+         * test) compiling and behaving identically for the quarantine facts they actually asked for.
+         */
+        public QuarantineSource(Function<String, String> credentialIdFor, BackendQuarantine quarantine,
+                                 Function<String, Boolean> exhaustedPatternArmed) {
+            this(credentialIdFor, quarantine, exhaustedPatternArmed, _ -> null, _ -> null);
+        }
+
+        /**
+         * Backward-compatible 2-arg form, before fleetd #395 added {@code exhaustedPatternArmed} —
+         * reports every profile unarmed. Keeps every pre-existing call site (production and test)
+         * compiling and behaving identically for the quarantine facts they actually asked for.
+         */
+        public QuarantineSource(Function<String, String> credentialIdFor, BackendQuarantine quarantine) {
+            this(credentialIdFor, quarantine, _ -> false);
+        }
+
+        /** Inert source — no profile is ever reported quarantined or armed. Explicit stand-in, not a default. */
         public static QuarantineSource none() { return new QuarantineSource(_ -> null, BackendQuarantine.none()); }
     }
 
@@ -164,6 +216,32 @@ public final class FleetMcp {
         public static LeadSeatSource none() { return new LeadSeatSource(_ -> 0); }
     }
 
+    /**
+     * fleetd #361: peer-visibility facts for {@code fleet_list}'s {@code coordinator} row — this
+     * daemon's own {@link LeadChannel} (for its self mailbox state and held messages) plus the
+     * coord-ids the operator has declared as peers ({@code coordinator.peers}). Bundled as its own
+     * Source, the same idiom as {@link OutageSource}/{@link QuarantineSource}/{@link LeadSeatSource},
+     * so {@code listFleet}'s already-long overload chain gains exactly one new required parameter
+     * instead of a further bare positional argument.
+     *
+     * <p>Every mailbox look this triggers goes through {@link LeadChannel#inspect}, which is
+     * specified to run on its own disposable channel — never the channel {@link LeadChannel#publish}
+     * or the consume loop depends on — so a peer that happens to be down, or the coordination broker
+     * itself being unreachable, can never take {@code fleet_send}/{@code LeadCoordLoop}'s own path
+     * down with it. See {@code FleetMcp.probe} for the additional timeout bound on top of that.
+     *
+     * @param leadChannel this daemon's own channel, or {@code null} when no coordinator is configured
+     * @param peers       the coord-ids declared under {@code coordinator.peers}, or empty
+     */
+    public record CoordinationSource(LeadChannel leadChannel, List<String> peers) {
+        public CoordinationSource {
+            peers = peers == null ? List.of() : List.copyOf(peers);
+        }
+
+        /** Inert source — no coordinator row is ever reported. */
+        public static CoordinationSource none() { return new CoordinationSource(null, List.of()); }
+    }
+
     /**
      * @param callers resolves each call's {@link Principal}; {@code null} disables authorization.
      *                This surface needs its own enforcement: {@code /mcp} is a raw servlet on
@@ -211,19 +289,34 @@ public final class FleetMcp {
     }
 
     /**
-     * As above, with fleetd #176 lead-seat facts (see {@link LeadSeatSource}). This is what
-     * {@code Fleetd.main} actually wires up.
-     *
-     * @param leadSeats required — pass {@link LeadSeatSource#none()} for a caller that does not want
-     *                  the feature, never a defaulting overload (the same rule {@code quarantine} and
-     *                  {@code outage} follow).
+     * As above, with fleetd #176 lead-seat facts (see {@link LeadSeatSource}).
      */
     public FleetMcp(MessageService messages, PeerLauncher workers, SessionManager sessions,
                      ConnectionIdentity identity, MemberPresence presence, PrimaryRegistry primaryRegistry,
                       CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
                       QuarantineSource quarantine, LeadChannel leadChannel, OutageSource outage,
                       LeadSeatSource leadSeats) {
+        this(messages, workers, sessions, identity, presence, primaryRegistry, callers, metrics, capacity,
+                healthCoverage, quarantine, leadChannel, outage, leadSeats, List.of());
+    }
+
+    /**
+     * As above, with fleetd #361 {@code coordinator.peers} (see {@link CoordinationSource}). This is
+     * what {@code Fleetd.main} actually wires up.
+     *
+     * @param leadSeats required — pass {@link LeadSeatSource#none()} for a caller that does not want
+     *                  the feature, never a defaulting overload (the same rule {@code quarantine} and
+     *                  {@code outage} follow).
+     * @param peers     the coord-ids declared under {@code coordinator.peers}; empty when unset or
+     *                  when {@code leadChannel} is {@code null}.
+     */
+    public FleetMcp(MessageService messages, PeerLauncher workers, SessionManager sessions,
+                     ConnectionIdentity identity, MemberPresence presence, PrimaryRegistry primaryRegistry,
+                      CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
+                      QuarantineSource quarantine, LeadChannel leadChannel, OutageSource outage,
+                      LeadSeatSource leadSeats, List<String> peers) {
         this.leadChannel = leadChannel;
+        this.peers = peers == null ? List.of() : List.copyOf(peers);
         this.capacity = capacity;
         this.quarantine = Objects.requireNonNull(quarantine, "quarantine");
         this.outage = Objects.requireNonNull(outage, "outage");
@@ -302,7 +395,7 @@ public final class FleetMcp {
                     String self = callerTerminal(exchange);
                     McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_reply", req.arguments()), self);
                     if (denied != null) return denied;
-                    return reply(messages, self, str(req.arguments(), "content"));
+                    return reply(messages, self, principal(exchange).role(), str(req.arguments(), "content"));
                 };
         // fleet_ask (CB-205): a worker's mid-turn question — identity from the CONNECTION.
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> askHandler =
@@ -322,10 +415,11 @@ public final class FleetMcp {
                 (exchange, req) -> {
                     Map<String, Object> a = req.arguments();
                     String target = str(a, "target");
+                    String coordId = str(a, "coordId");
                     // The action depends on the ARGUMENTS, not on the tool name -- see pollAction.
                     McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_poll", a), target);
                     if (denied != null) return denied;
-                    return poll(messages, str(a, "ticket"), target);
+                    return poll(messages, leadChannel, str(a, "ticket"), target, coordId);
                 };
         // CB-307 Increment 3: per-msgId ack (not needed in v1 but supported by the inbox).
         // Acking removes a reply from the inbox, so it is a drain, not a read.
@@ -361,7 +455,8 @@ public final class FleetMcp {
                     return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, outage,
                             leadSeats, callers == null ? Map.of() : callers.leads(),
                             callerTerminal(exchange),
-                            leadChannel == null ? null : leadChannel.selfCoordId());
+                            new CoordinationSource(leadChannel, peers),
+                            coordinatorVisibleTo(principal(exchange)));
                 };
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> stopHandler =
                 (exchange, req) -> {
@@ -514,6 +609,20 @@ public final class FleetMcp {
         }
     }
 
+    /**
+     * fleetd #439: only the primary may read {@code fleet_list}'s {@code coordinator} row —
+     * lead-to-lead coordination state (coord-ids, mailbox facts, held-message previews), never the
+     * roster. Split out of the {@code fleet_list} handler, same reason as {@link #denyFor} and
+     * {@link #recordPrimarySingleton}: the decision must be unit-testable without fabricating an
+     * SDK {@code McpSyncServerExchange}, and the handler must call this named predicate rather than
+     * inlining the check, so a future edit cannot silently pass a literal instead of asking who
+     * called ({@code FleetMcpAuthzTest.theFleetListHandlerActuallyConsultsCoordinatorVisibleTo}
+     * reads the source and asserts the handler calls this method by name, not a literal).
+     */
+    static boolean coordinatorVisibleTo(Principal caller) {
+        return caller.isPrimary();
+    }
+
     /** The worker identity resolved from this call's connection, or {@code null} if the primary. */
     private static String callerTerminal(McpSyncServerExchange exchange) {
         Object v = exchange.transportContext().get(CALLER_TERMINAL);
@@ -697,6 +806,15 @@ public final class FleetMcp {
      * turned into a tool error naming the coord-id. It is never allowed to escape as a crash: an
      * unreachable peer is an ordinary outcome of addressing a fleet you do not control.
      *
+     * <p><strong>fleetd #361: the success text is honest about what "durably confirmed" does and
+     * does not mean.</strong> The broker's publisher confirm proves the message is durably queued —
+     * it says nothing about whether the peer's pane has, or ever will, receive it. After a
+     * successful publish this looks at the target mailbox's consumer count (via
+     * {@link LeadChannel#inspect}, bounded and never allowed to fail the call — see {@link #probe})
+     * and appends a warning when it is zero: that is the observable form of "nobody is reading this
+     * right now". A zero-consumer publish is still reported as a SUCCESS, never an error — the
+     * message is safely queued and will be read once a daemon owning that coord-id connects.
+     *
      * @param leadChannel this daemon's channel, or {@code null} when no coordinator is configured
      */
     static McpSchema.CallToolResult sendToLead(LeadChannel leadChannel, String coordId, String content,
@@ -724,34 +842,56 @@ public final class FleetMcp {
                     + ". Check that a daemon is running with coordinator.selfId=\"" + coordId
                     + "\" and is connected to the same coordination broker.");
         }
-        return text("delivered to peer lead " + coordId + " (msgId " + msg.msgId() + ")");
+        String result = "published to peer lead \"" + coordId + "\"'s mailbox and durably confirmed "
+                + "by the broker (msgId " + msg.msgId() + ").";
+        LeadChannel.MailboxState state = probe(leadChannel, coordId);
+        if (state.exists() && state.consumers() == 0) {
+            result += " Warning: that mailbox currently has NO consumers attached — nobody is reading "
+                    + "it right now. The message is safely queued and will be delivered once a daemon "
+                    + "with coordinator.selfId=\"" + coordId + "\" is running and connected; until then "
+                    + "it will not reach that lead's pane.";
+        }
+        return text(result);
     }
 
     /**
      * Which authorization action a {@code fleet_poll} call needs, decided by its arguments
-     * (fleetd #272).
+     * (fleetd #272, widened by fleetd #421).
      *
-     * <p>{@code fleet_poll} is <strong>two operations behind one tool name</strong>. With {@code
-     * ticket} it observes an async delegation and changes nothing, which is a {@link
+     * <p>{@code fleet_poll} is now <strong>three operations behind one tool name</strong>. With
+     * {@code ticket} it observes an async delegation and changes nothing, which is a {@link
      * Authz.Action#READ}. With {@code target} it calls {@link MessageService#drainReplies} on that
      * session -- the replies are removed from the inbox and a second call returns nothing -- so it
      * is a {@link Authz.Action#DRAIN}, the same gate {@code fleet_ack} already uses for removing a
-     * single message, and the same one the REST path uses at {@code FleetApp.drainReplies}.
+     * single message, and the same one the REST path uses at {@code FleetApp.drainReplies}. With
+     * {@code coordId} it reads (never acks) this daemon's own held lead-to-lead mail, which is a
+     * {@link Authz.Action#COORD_READ} -- <strong>not</strong> {@code READ}, even though nothing is
+     * consumed: {@code READ}'s grant is open to every authenticated role on the premise that the
+     * roster carries no secrets, and a lead-to-lead body is not the roster. Mapping a non-destructive
+     * peer-mail read to {@code READ} would let any worker read every peer lead's mail in full.
      *
-     * <p>Until this method existed the handler passed a constant {@code READ} for both branches.
-     * {@code READ} is open to every authenticated role, so any worker could read a peer's id out of
-     * {@code fleet_list} and destroy the replies that peer had queued for the primary. The gate
-     * failed open, and it did so because the required action is a function of the arguments while
-     * the handler chose it before looking at them.
+     * <p>Before this method existed (fleetd #272) the handler passed a constant {@code READ} for
+     * both of the original branches. {@code READ} is open to every authenticated role, so any
+     * worker could read a peer's id out of {@code fleet_list} and destroy the replies that peer had
+     * queued for the primary. The gate failed open, and it did so because the required action is a
+     * function of the arguments while the handler chose it before looking at them.
      *
      * <p>The choice lives in this method, and not inline in the handler, so that a test can assert
      * the mapping the handler actually uses. {@code FleetMcpAuthzTest} already checked every
      * {@link Authz.Action} against every {@link Role} and passed throughout -- it tested the policy
      * table, which was correct, while the defect was in which action the caller handed it.
      *
-     * @param target the {@code target} argument of the call, or {@code null}/blank when absent
+     * <p>Checked first, and exclusively of {@code target}: a call naming {@code coordId} is reading
+     * a different inbox entirely (this daemon's own lead channel, never a worker's), so it takes
+     * priority over whatever {@code target} might also say.
+     *
+     * @param target  the {@code target} argument of the call, or {@code null}/blank when absent
+     * @param coordId the {@code coordId} argument of the call, or {@code null}/blank when absent
      */
-    static Authz.Action pollAction(String target) {
+    static Authz.Action pollAction(String target, String coordId) {
+        if (!isBlank(coordId)) {
+            return Authz.Action.COORD_READ;
+        }
         return isBlank(target) ? Authz.Action.READ : Authz.Action.DRAIN;
     }
 
@@ -766,7 +906,7 @@ public final class FleetMcp {
             case "fleet_reply" -> Authz.Action.REPLY;
             case "fleet_ask" -> Authz.Action.ASK;
             case "fleet_status", "fleet_list", "fleet_profiles", "fleet_whoami" -> Authz.Action.READ;
-            case "fleet_poll" -> pollAction(str(arguments, "target"));
+            case "fleet_poll" -> pollAction(str(arguments, "target"), str(arguments, "coordId"));
             case "fleet_ack" -> Authz.Action.DRAIN;
             case "fleet_spawn" -> Authz.Action.SPAWN;
             case "fleet_stop" -> Authz.Action.STOP;
@@ -776,6 +916,21 @@ public final class FleetMcp {
 
     /** {@code fleet_poll}: check an async delegation by ticket, or drain a worker's inbox by target. */
     static McpSchema.CallToolResult poll(MessageService messages, String ticket, String target) {
+        return poll(messages, null, ticket, target, null);
+    }
+
+    /**
+     * As above, plus (fleetd #421) a held-peer-mail read when {@code coordId} is present: returns
+     * this daemon's own held lead-to-lead messages, in full, without acking them. Checked first and
+     * exclusively of {@code ticket}/{@code target} — see {@link #pollAction}'s javadoc for why this
+     * is a different inbox (this daemon's own {@link LeadChannel}) that authorizes differently
+     * ({@link Authz.Action#COORD_READ}, primary-only) from either of the original two branches.
+     */
+    static McpSchema.CallToolResult poll(MessageService messages, LeadChannel leadChannel, String ticket,
+                                         String target, String coordId) {
+        if (!isBlank(coordId)) {
+            return pollHeldPeerMail(leadChannel, coordId);
+        }
         if (!isBlank(target)) {
             var replies = messages.drainReplies(target);
             if (replies.isEmpty()) {
@@ -803,17 +958,69 @@ public final class FleetMcp {
         };
     }
 
+    /**
+     * fleetd #421: a lead's own held lead-to-lead mail, read without consuming it.
+     *
+     * <p>{@link LeadChannel#peek} is non-destructive, so calling this twice returns the same
+     * bodies, and {@code fleet_list}'s {@code coordinator.held[]} is unaffected — this adds a
+     * read, it never acks. Never let this short-circuit the delivery contract: {@code
+     * LeadCoordLoop}'s javadoc explains why a message must stay unacked until actually delivered,
+     * and that is unchanged here.
+     *
+     * <p>{@code coordId} must be THIS daemon's own coord-id ({@code fleet_list}'s
+     * {@code coordinator.selfId}) — there is no route here to read a PEER's outbound mail, only
+     * your own inbound mail. Requiring the caller to echo its own id catches the exact confusion
+     * that opened fleetd #421: the original failed attempt passed a PEER's id ("fleet01") as
+     * {@code fleet_poll}'s {@code target}, expecting to read that peer's messages, and got the same
+     * silent {@code []} as a genuinely empty worker inbox. This refuses the same mistake here with a
+     * reason, instead of a second silent wrong answer.
+     */
+    static McpSchema.CallToolResult pollHeldPeerMail(LeadChannel leadChannel, String coordId) {
+        if (leadChannel == null) {
+            return error("lead coordination is not configured (no coordinator: block) — there is "
+                    + "no held peer mail to read.");
+        }
+        String selfId = leadChannel.selfCoordId();
+        if (!coordId.equals(selfId)) {
+            return error("coordId \"" + coordId + "\" is not this daemon's own coord-id (\"" + selfId
+                    + "\"). fleet_poll reads only YOUR OWN held mail — pass your own coordId "
+                    + "(fleet_list's coordinator.selfId), not a peer's.");
+        }
+        return text(json(leadChannel.peek().stream().map(FleetMcp::heldMailView).toList()));
+    }
+
+    /** The full body of one held lead-to-lead message — never truncated, unlike {@link #heldView}. */
+    private static Map<String, Object> heldMailView(LeadMessage m) {
+        Map<String, Object> row = new LinkedHashMap<>();
+        row.put("msgId", m.msgId());
+        row.put("from", m.from());
+        row.put("content", m.content());
+        return row;
+    }
+
     /**
      * {@code fleet_reply}: the worker returns its structured answer, resolving the awaiting send
      * or — when no send is open — queueing the reply in the inbox for later drain (CB-307).
-     * {@code callerTerminal} is resolved from the connection (never an argument); a {@code null}
-     * means the caller is not a known worker (e.g. the primary called it by mistake).
+     * {@code callerTerminal} and {@code callerRole} are resolved from the connection (never an
+     * argument). A {@code null} terminal means the caller is not a known worker. A PRIMARY with a
+     * terminal is a lead and must use {@code fleet_send}, because reply has no peer-lead route.
+     *
+     * <p>fleetd #365: the result text names which of those actually happened
+     * ({@link MessageService.ReplyOutcome#description()}) instead of the single word "delivered"
+     * for both — a queued reply is a real success, but it is not the same fact as one that resolved
+     * a live waiter, and the caller could not previously tell them apart.
      */
-    static McpSchema.CallToolResult reply(MessageService messages, String callerTerminal, String content) {
+    static McpSchema.CallToolResult reply(MessageService messages, String callerTerminal, Role callerRole, String content) {
         if (callerTerminal == null) {
             return error("fleet_reply is for workers only — could not identify the calling worker "
                     + "from the connection");
         }
+        if (callerRole == Role.PRIMARY) {
+            return error("fleet_reply has no route to a peer lead. Use fleet_send{coordId: ...} for a peer on another "
+                    + "daemon or fleet_send{sessionId: ...} for a peer on this host. fleet_reply resolves a member's "
+                    + "blocked fleet_send, and a peer's coord-id message is durable and non-blocking, so there is "
+                    + "nothing for it to resolve.");
+        }
         // fleetd #302: isBlank, not == null, to match fleet_send's own guard above. MessageService
         // .reply now REJECTS blank content, and this handler is a bare BiFunction with no try/catch
         // around it — so a whitespace-only fleet_reply would leave here as an uncaught
@@ -822,8 +1029,8 @@ public final class FleetMcp {
         if (isBlank(content)) {
             return error("content is required");
         }
-        messages.reply(callerTerminal, content);
-        return text("delivered");
+        MessageService.ReplyOutcome outcome = messages.reply(callerTerminal, content);
+        return text(outcome.description());
     }
 
     /** {@code fleet_ack}: acknowledge (remove) a specific reply from the inbox. */
@@ -831,7 +1038,11 @@ public final class FleetMcp {
         if (isBlank(target) || isBlank(msgId)) {
             return error("target and msgId are required");
         }
-        messages.ackReply(target, msgId);
+        if (!messages.ackReply(target, msgId)) {
+            return error(msgId + " is not in " + target + "'s reply inbox (wrong id, wrong target, "
+                    + "or already acked). Held lead-to-lead (peer) mail cannot be acked this way — "
+                    + "read it with fleet_poll{coordId}.");
+        }
         return text("acknowledged " + msgId);
     }
 
@@ -1042,6 +1253,29 @@ public final class FleetMcp {
      * not the other, and the two then disagree about a live outage. That is exactly what fleetd
      * #284 was, where one rule computed in two places was widened in only one and a single response
      * contradicted itself. Shared inputs do not make duplicated computation safe.
+     *
+     * <p>fleetd #395, made live by fleetd #446: also reports {@code exhaustionDetectionArmed}, one
+     * boolean per configured profile — {@code true} when that profile's {@code exhaustedPattern} is
+     * set RIGHT NOW, {@code false} when it is not, so an operator can tell "this profile is
+     * healthy" from "nothing can ever quarantine this profile" without reading {@code fleetd.yaml}.
+     * Unlike {@code quarantined}/{@code coolingOff}, this map always names every profile: an
+     * unarmed profile never enters a transient state to be absent from, so silence here would read
+     * as "healthy" rather than "not being watched at all". Hot since fleetd #446: a reload that
+     * arms or disarms a profile's {@code exhaustedPattern} changes this map's answer on the very
+     * next call, no restart — see {@link dev.ltms.fleet.inject.LiveExhaustedPatterns}'s class doc.
+     *
+     * <p>fleetd #446 criterion 3: each {@code quarantined} row also names {@code model} (the
+     * profile's configured {@code model:}, omitted when the profile names none) and {@code reason}
+     * (the backend text that triggered the most recent quarantine of that credential, omitted when
+     * none is known) — so a lead can see WHICH model to turn off and WHY, without reading the
+     * daemon log.
+     *
+     * <p>fleetd #466 scope item 2: each {@code quarantined} row also names {@code
+     * quarantineAttempt} — 1 for a first-time exhaustion, 2 for the second in a row, and so on — so
+     * an operator sees "this is the 5th time" instead of inferring it from {@code
+     * quarantinedForSeconds} alone. Read off {@link BackendQuarantine#status(String)}, the same
+     * one-call accessor {@code quarantinedForSeconds} itself comes from here (see its doc) — never a
+     * separately derived count.
      */
     public static Map<String, Object> profilesView(PeerLauncher workers, QuarantineSource quarantine, OutageSource outage) {
         Map<String, Object> result = new LinkedHashMap<>();
@@ -1049,13 +1283,27 @@ public final class FleetMcp {
         result.put("default", workers.defaultProfile() == null ? "" : workers.defaultProfile());
         Map<String, Object> quarantined = new LinkedHashMap<>();
         Map<String, Object> coolingOff = new LinkedHashMap<>();
+        Map<String, Object> exhaustionDetectionArmed = new LinkedHashMap<>();
         for (String profile : workers.profiles()) {
+            exhaustionDetectionArmed.put(profile, quarantine.exhaustedPatternArmed().apply(profile));
             String credentialId = quarantine.credentialIdFor().apply(profile);
             if (credentialId != null) {
-                quarantine.quarantine().remainingSeconds(credentialId).ifPresent(remaining -> {
+                // fleetd #466 scope item 2: quarantinedForSeconds and quarantineAttempt come off the
+                // ONE BackendQuarantine#status(credentialId) call — never a second, independent read
+                // for the attempt count — so the two can never disagree about which streak this is.
+                quarantine.quarantine().status(credentialId).ifPresent(status -> {
                     Map<String, Object> row = new LinkedHashMap<>();
                     row.put("credentialId", credentialId);
-                    row.put("quarantinedForSeconds", remaining);
+                    row.put("quarantinedForSeconds", status.remainingSeconds());
+                    row.put("quarantineAttempt", status.repeatCount());
+                    String model = quarantine.modelFor().apply(profile);
+                    if (model != null && !model.isBlank()) {
+                        row.put("model", model);
+                    }
+                    String reason = quarantine.reasonFor().apply(credentialId);
+                    if (reason != null && !reason.isBlank()) {
+                        row.put("reason", reason);
+                    }
                     quarantined.put(profile, row);
                 });
             }
@@ -1069,12 +1317,30 @@ public final class FleetMcp {
                 });
             }
         }
+        result.put("exhaustionDetectionArmed", exhaustionDetectionArmed);
         if (!quarantined.isEmpty()) {
             result.put("quarantined", quarantined);
         }
         if (!coolingOff.isEmpty()) {
             result.put("coolingOff", coolingOff);
         }
+        // fleetd #422: read the exact same accessor CompositePeerLauncher's spawn gate reads
+        // (PeerLauncher.modelGateState(), which for the composite is models0() read live) — never a
+        // separately-derived answer, so this status can never overstate or understate what the gate
+        // actually enforces (the fleetd #404 lesson).
+        //
+        // fleetd #422 follow-up: "armed" and "off" come from the ONE modelGateState() call below,
+        // never two independent reads of the gate — a reload landing between two separate reads
+        // could otherwise make them disagree. modelGateArmed is reported unconditionally (never
+        // omitted like quarantined/coolingOff above) precisely so a lead can tell "no models: block
+        // at all" (false) apart from "a models: block with nothing currently off" (true, with
+        // modelsOff simply absent below) — the two states PeerLauncher.disabledModels() alone
+        // cannot distinguish, both reporting an empty set.
+        PeerLauncher.ModelGateState modelGate = workers.modelGateState();
+        result.put("modelGateArmed", modelGate.configured());
+        if (!modelGate.off().isEmpty()) {
+            result.put("modelsOff", new ArrayList<>(modelGate.off()));
+        }
         return result;
     }
 
@@ -1110,7 +1376,8 @@ public final class FleetMcp {
     static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions, MessageService messages,
                                                CapacitySource capacity, HealthCoverageSource healthCoverage,
                                                QuarantineSource quarantine, Map<String, String> leads, String selfTerm) {
-        return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, leads, selfTerm, null);
+        return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, leads, selfTerm,
+                CoordinationSource.none());
     }
 
     /** As above, plus fleetd #201 Unit 5 cool-off facts (see {@link OutageSource}). */
@@ -1119,41 +1386,77 @@ public final class FleetMcp {
                                                QuarantineSource quarantine, OutageSource outage,
                                                Map<String, String> leads, String selfTerm) {
         return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, outage,
-                LeadSeatSource.none(), leads, selfTerm, null);
+                LeadSeatSource.none(), leads, selfTerm, CoordinationSource.none());
     }
 
     /**
-     * As above, additionally reporting this daemon's own lead coordination id (CB-637) when one is
-     * configured and its channel opened. There is no peer-discovery surface yet — a lead addresses a
-     * peer by a coord-id it was told — so this row exists to answer the one question the operator
-     * cannot answer any other way: what is MY coord-id, the one a peer must use to reach me. It is
-     * omitted entirely when no coordinator is configured, so an ordinary fleet's output is unchanged.
+     * As above, additionally reporting this daemon's own lead coordination state (CB-637, fleetd
+     * #361) when a coordinator is configured and its channel opened — see {@link #coordinatorView}
+     * for the shape. Omitted entirely when no coordinator is configured, so an ordinary fleet's
+     * output is unchanged.
      *
-     * @param selfCoordId this daemon's coord-id, or {@code null} when lead coordination is off
+     * @param coordination this daemon's lead channel plus its declared peers, or
+     *                      {@link CoordinationSource#none()} when lead coordination is off
      */
     static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions, MessageService messages,
                                                CapacitySource capacity, HealthCoverageSource healthCoverage,
                                                QuarantineSource quarantine, Map<String, String> leads, String selfTerm,
-                                               String selfCoordId) {
+                                               CoordinationSource coordination) {
         return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, OutageSource.none(),
-                LeadSeatSource.none(), leads, selfTerm, selfCoordId);
+                LeadSeatSource.none(), leads, selfTerm, coordination);
     }
 
     /** As above, plus fleetd #201 Unit 5 cool-off facts (see {@link OutageSource}). */
     static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions, MessageService messages,
                                                CapacitySource capacity, HealthCoverageSource healthCoverage,
                                                QuarantineSource quarantine, OutageSource outage,
-                                               Map<String, String> leads, String selfTerm, String selfCoordId) {
+                                               Map<String, String> leads, String selfTerm, CoordinationSource coordination) {
         return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, outage,
-                LeadSeatSource.none(), leads, selfTerm, selfCoordId);
+                LeadSeatSource.none(), leads, selfTerm, coordination);
     }
 
-    /** As above, plus fleetd #176 lead-seat facts (see {@link LeadSeatSource}). */
+    /**
+     * As above, plus fleetd #176 lead-seat facts (see {@link LeadSeatSource}).
+     *
+     * <p>Assumes the caller is <strong>not</strong> the primary (fleetd #463) — every wrapper
+     * overload above delegates here without carrying a caller identity, which is exactly right for
+     * them: they exist for call sites (and unit tests) that have no {@link Principal} to hand over,
+     * and a missing identity should fail closed rather than fail open onto lead-to-lead state. A
+     * test that wants the {@code coordinator} row must call the canonical overload below with an
+     * explicit {@code true}. The one call site that has a real caller ({@code fleet_list}'s MCP
+     * handler) uses {@link #listFleet(PeerLauncher, SessionManager, MessageService, CapacitySource,
+     * HealthCoverageSource, QuarantineSource, OutageSource, LeadSeatSource, Map, String,
+     * CoordinationSource, boolean)} instead, so it can pass the true answer.
+     */
     static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions, MessageService messages,
                                                CapacitySource capacity, HealthCoverageSource healthCoverage,
                                                QuarantineSource quarantine, OutageSource outage,
                                                LeadSeatSource leadSeats, Map<String, String> leads, String selfTerm,
-                                               String selfCoordId) {
+                                               CoordinationSource coordination) {
+        return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, outage,
+                leadSeats, leads, selfTerm, coordination, false);
+    }
+
+    /**
+     * As above, gated by the caller's role (fleetd #439). The {@code coordinator} row is
+     * lead-to-lead coordination state — coordination between orchestrators, not roster
+     * observation — so it is assembled and included only when {@code callerIsPrimary} is
+     * {@code true}. A worker or an architect gets a result with the {@code coordinator} key
+     * <strong>absent</strong>, never an empty or redacted one, and never pays the cost of
+     * {@link #coordinatorView} probing peer mailboxes for a row it will not receive.
+     *
+     * @param callerIsPrimary whether the {@code fleet_list} caller is the primary; only the MCP
+     *                        handler computes this from the real connection (see
+     *                        {@code Principal#isPrimary()}) — every other overload passes
+     *                        {@code false} (fleetd #463: a forgotten argument fails closed, not
+     *                        open), so a test that wants the {@code coordinator} row must pass
+     *                        an explicit {@code true}
+     */
+    static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions, MessageService messages,
+                                               CapacitySource capacity, HealthCoverageSource healthCoverage,
+                                               QuarantineSource quarantine, OutageSource outage,
+                                               LeadSeatSource leadSeats, Map<String, String> leads, String selfTerm,
+                                               CoordinationSource coordination, boolean callerIsPrimary) {
         try {
             Map<String, Agent> live = workers.list().stream()
                     .map(Agent.class::cast)
@@ -1175,8 +1478,14 @@ public final class FleetMcp {
             Map<String, Object> result = new LinkedHashMap<>();
             result.put("leads", leadRows); result.put("members", out);
             result.put("healthCoverage", healthCoverage.value().get());
-            if (selfCoordId != null && !selfCoordId.isBlank()) {
-                result.put("coordinator", Map.of("selfId", selfCoordId, "configured", true));
+            // fleetd #439: coordinator/coordinatorView is lead-to-lead coordination state and must
+            // never reach a worker or an architect -- gate BEFORE assembling it, not after, so the
+            // key is absent rather than present-and-empty.
+            if (callerIsPrimary) {
+                Map<String, Object> coordinatorRow = coordinatorView(coordination);
+                if (coordinatorRow != null) {
+                    result.put("coordinator", coordinatorRow);
+                }
             }
             if (capacity.available()) result.put("capacity", profiles.stream()
                     .map(profile -> capacityView(profile, capacity.liveCount(), capacity.maxLoad(), roster, messages,
@@ -1187,6 +1496,153 @@ public final class FleetMcp {
         }
     }
 
+    /**
+     * fleetd #361: the {@code coordinator} row — this daemon's own coord-id and mailbox state, the
+     * messages currently held for it, and the live reachability of every operator-declared peer.
+     * {@code null} (the row is then omitted entirely) when lead coordination is off, so an ordinary
+     * fleet's {@code fleet_list} output is byte-identical to before this feature existed.
+     *
+     * <p>Every peer/self mailbox look goes through {@link #probe}, which bounds each
+     * {@link LeadChannel#inspect} call to {@link #PEER_PROBE_TIMEOUT_MS} and never lets it throw —
+     * a coordination broker that is down or slow degrades this row toward "unreachable"/"unknown"
+     * counts, it can never make {@code fleet_list} itself slow or fail. {@code held} comes from
+     * {@link LeadChannel#peek}, a pure in-memory read with no broker round trip, so it is never
+     * subject to that bound.
+     *
+     * <p><strong>fleetd #421: {@code heldCount}/{@code heldDurable} fix the "pending: 0" trap.</strong>
+     * {@code mailbox.pending} counts only broker-<em>ready</em> messages; a held message is already
+     * an unacked delivery sitting with this consumer, so the normal, healthy state of a blocked lead
+     * is {@code "pending": 0} next to a non-empty {@code held[]} — which invites the false reading
+     * "these are only in memory, a restart will lose them". {@code heldCount} is the honest second
+     * number beside {@code pending} ({@code held.size()}, not left for the reader to count the
+     * array). {@code heldDurable} comes straight from {@link LeadChannel#heldDurable}, which the
+     * channel implementation derives from what it actually did when it declared and consumed its own
+     * queue (fleetd #440) — this method never asserts the fact itself.
+     */
+    private static Map<String, Object> coordinatorView(CoordinationSource coordination) {
+        LeadChannel channel = coordination.leadChannel();
+        if (channel == null) {
+            return null;
+        }
+        String selfId = channel.selfCoordId();
+        List<LeadMessage> held = channel.peek();
+        Map<String, Object> row = new LinkedHashMap<>();
+        row.put("selfId", selfId);
+        row.put("configured", true);
+        row.put("mailbox", mailboxView(probe(channel, selfId)));
+        row.put("heldCount", held.size());
+        row.put("heldDurable", channel.heldDurable());
+        row.put("held", held.stream().map(FleetMcp::heldView).toList());
+        row.put("peers", coordination.peers().stream().map(p -> peerView(channel, p)).toList());
+        return row;
+    }
+
+    /**
+     * fleetd #361: render a {@link LeadChannel.MailboxState} without ever presenting an unmeasured
+     * fact as a measured one. {@code status} is the tri-state itself — {@code "exists"},
+     * {@code "absent"} (the broker positively confirmed no such queue), or {@code "unknown"} (the
+     * probe could not determine either way: down, unreachable, or timed out). {@code pending}/
+     * {@code consumers} are included ONLY when {@code status == "exists"} — a reader must never see
+     * them default to {@code 0} for a mailbox this call never actually measured. This is the fix for
+     * the review finding that a collapsed {@code absent()} rendered a self-probe timeout as
+     * "pending: 0, consumers: 0", indistinguishable from an actually-empty, actually-unread mailbox.
+     */
+    private static Map<String, Object> mailboxView(LeadChannel.MailboxState state) {
+        Map<String, Object> row = new LinkedHashMap<>();
+        row.put("status", state.exists() ? "exists" : state.known() ? "absent" : "unknown");
+        if (state.exists()) {
+            row.put("pending", state.pending());
+            row.put("consumers", state.consumers());
+        }
+        return row;
+    }
+
+    /** One held-for-me message: enough to identify it and see roughly what it says, never the whole body. */
+    private static Map<String, Object> heldView(LeadMessage m) {
+        Map<String, Object> row = new LinkedHashMap<>();
+        row.put("msgId", m.msgId());
+        row.put("from", m.from());
+        row.put("preview", preview(m.content()));
+        return row;
+    }
+
+    /** Cap a held message's content to a short preview — {@code fleet_list} must never dump a full body. */
+    private static final int HELD_PREVIEW_MAX_CHARS = 80;
+
+    private static String preview(String content) {
+        if (content == null) {
+            return "";
+        }
+        return content.length() <= HELD_PREVIEW_MAX_CHARS
+                ? content
+                : content.substring(0, HELD_PREVIEW_MAX_CHARS) + "…";
+    }
+
+    /**
+     * One declared peer's row: its coord-id, then the same tri-state {@link #mailboxView} shape.
+     * Deliberately no boolean "reachable" field — that collapsed "confirmed gone" and "could not
+     * check" into the same {@code false}, which is exactly the review finding this row now avoids:
+     * an operator reading {@code status} can tell "fleet01 is down" (a {@code coordinator.selfId}
+     * nobody has ever run) apart from "my own broker is slow or unreachable right now".
+     */
+    private static Map<String, Object> peerView(LeadChannel channel, String coordId) {
+        Map<String, Object> row = new LinkedHashMap<>();
+        row.put("coordId", coordId);
+        row.putAll(mailboxView(probe(channel, coordId)));
+        return row;
+    }
+
+    /**
+     * fleetd #361: how long {@code fleet_list} waits on any single {@link LeadChannel#inspect} call
+     * before giving up on it — see {@link #probe}.
+     */
+    private static final long PEER_PROBE_TIMEOUT_MS = 1_500L;
+
+    /**
+     * Dedicated pool for {@link LeadChannel#inspect} calls so a slow one blocks only its own virtual
+     * thread, never the MCP request thread calling {@code fleet_list}. Not a <em>bounded</em> pool —
+     * {@code newThreadPerTaskExecutor} starts a fresh virtual thread per call with no cap on how many
+     * run at once; virtual threads make that cheap, not bounded. What actually keeps a hung probe
+     * from accumulating forever is the {@link Future#cancel} in {@link #probe}, not a pool limit.
+     */
+    private static final java.util.concurrent.ExecutorService PEER_PROBE_POOL =
+            java.util.concurrent.Executors.newThreadPerTaskExecutor(Thread.ofVirtual().name("fleet-peer-probe-", 0).factory());
+
+    /**
+     * fleetd #361: {@link LeadChannel#inspect}, bounded to {@link #PEER_PROBE_TIMEOUT_MS} and never
+     * allowed to throw or hang the caller — a coordination broker that is unreachable or slow
+     * degrades to {@link LeadChannel.MailboxState#unknown} (never {@code absent}: a timeout proves
+     * nothing about whether the mailbox exists) rather than making {@code fleet_list} slow or
+     * failing it. {@code inspect} itself is already specified to never throw, but this is the seam
+     * that also survives an implementation that does, or one that blocks indefinitely on a dead
+     * connection.
+     *
+     * <p><strong>A timeout cancels the orphaned task</strong> rather than abandoning it. Before this,
+     * {@code get(timeout)} on a hung {@code inspect} left the submitted task running forever on its
+     * own virtual thread, holding the AMQP channel it had already opened — against a broker that
+     * hangs rather than fails fast, every {@code fleet_list} call would orphan one more channel until
+     * the connection's channel-max (2047 by default) was exhausted, which would break {@link
+     * LeadChannel#publish} too. {@link Future#cancel(boolean) cancel(true)} interrupts the orphaned
+     * task's thread; {@link LeadMailbox#inspect} has no interruptible wait of its own to catch that,
+     * but the underlying AMQP RPC continuation does block on one, so the interrupt reaches it and the
+     * task's {@code finally} still closes the probe channel it opened rather than leaking it forever.
+     */
+    private static LeadChannel.MailboxState probe(LeadChannel channel, String coordId) {
+        return probe(channel, coordId, PEER_PROBE_TIMEOUT_MS);
+    }
+
+    /** As {@link #probe(LeadChannel, String)}, with an explicit timeout — a seam for tests. */
+    static LeadChannel.MailboxState probe(LeadChannel channel, String coordId, long timeoutMs) {
+        java.util.concurrent.Future<LeadChannel.MailboxState> future =
+                PEER_PROBE_POOL.submit(() -> channel.inspect(coordId));
+        try {
+            return future.get(timeoutMs, TimeUnit.MILLISECONDS);
+        } catch (Exception e) {
+            future.cancel(true); // best-effort: don't leave a hung probe (and its channel) running forever
+            return LeadChannel.MailboxState.unknown(coordId);
+        }
+    }
+
     /**
      * Capacity is advisory only. {@code reclaimable} says there is no bridge work, not that fleetd
      * may stop the member: the bridge has capacity facts but no work list, and choosing work needs
@@ -1279,10 +1735,13 @@ public final class FleetMcp {
         }
         String credentialId = quarantine.credentialIdFor().apply(profile);
         if (credentialId != null) {
-            quarantine.quarantine().remainingSeconds(credentialId).ifPresent(remaining -> {
+            // fleetd #466 scope item 2: same one-call status() read as profilesView above — see its
+            // comment for why this must not become two separate lookups.
+            quarantine.quarantine().status(credentialId).ifPresent(status -> {
                 row.put("free", 0);
                 row.put("credentialId", credentialId);
-                row.put("quarantinedForSeconds", remaining);
+                row.put("quarantinedForSeconds", status.remainingSeconds());
+                row.put("quarantineAttempt", status.repeatCount());
             });
         }
         String outageCredentialId = outage.credentialIdFor().apply(profile);
@@ -1377,8 +1836,12 @@ public final class FleetMcp {
                                 + "routes your answer back into the same turn (omit for a normal delegation)"),
                         "coordId", stringProp("A peer LEAD's coordination id — delivers content to that "
                                 + "lead's durable mailbox on the shared coordination broker, which works "
-                                + "across hosts. Mutually exclusive with sessionId and turnId. Your own "
-                                + "coordId is reported by fleet_list.")),
+                                + "across hosts. Mutually exclusive with sessionId and turnId. Success means "
+                                + "the message is durably queued and confirmed by the broker, with a warning "
+                                + "if that mailbox has no consumers attached right now (queued, but nobody is "
+                                + "reading it yet) — it does not mean the peer's pane has seen it. Your own "
+                                + "coordId, this daemon's mailbox state, and every coordinator.peers entry's "
+                                + "live reachability are reported by fleet_list's coordinator row.")),
                         List.of("content")));
     }
 
@@ -1401,10 +1864,18 @@ public final class FleetMcp {
                 "Check an async delegation (a fleet_send with wait:false) by its ticket: "
                         + "pending, done (with the worker's reply), or failed. When target (a worker "
                         + "session id) is present instead of ticket, drain that worker's inbox of "
-                        + "replies delivered when no send was open.",
+                        + "replies delivered when no send was open. When coordId is present instead, "
+                        + "read (never consume) your own held lead-to-lead mail — primary-only.",
                 objectSchema(Map.of(
                         "ticket", stringProp("The ticket returned by fleet_send wait:false"),
-                        "target", stringProp("Worker session id to drain pending replies from (optional)")),
+                        "target", stringProp("Worker session id to drain pending replies from (optional)"),
+                        "coordId", stringProp("Your own coord-id (fleet_list's coordinator.selfId) — "
+                                + "reads every message currently held[] for you in full, without "
+                                + "acking. Read twice, get the same bodies both times; fleet_list's "
+                                + "held[] still reports them afterward. Primary-only, and this can "
+                                + "read only YOUR OWN mailbox — there is no route to a peer's outbound "
+                                + "mail, so passing a peer's coordId here is refused rather than "
+                                + "silently returning the wrong thing (or nothing).")),
                         List.of()));
     }
 
@@ -1414,7 +1885,10 @@ public final class FleetMcp {
                         + "has processed a reply and wants to confirm it, leaving other pending replies "
                         + "in the inbox for later drain.",
                 objectSchema(Map.of(
-                        "target", stringProp("Worker session id whose inbox to ack from"),
+                        "target", stringProp("Worker session id whose inbox to ack from. Must name a "
+                                + "reply actually queued for it — an id in no inbox, or a coord-id "
+                                + "(peer held mail, read with fleet_poll{coordId} instead), errors "
+                                + "rather than reporting a false success"),
                         "msgId", stringProp("The message id to acknowledge")),
                         List.of("target", "msgId")));
     }
@@ -1456,7 +1930,16 @@ public final class FleetMcp {
                 "List the configured worker profiles (backends) and which one fleet_spawn uses by "
                         + "default. A 'quarantined' map is present when a backend-exhausted refusal put "
                         + "a profile's credential on cooldown — fleet_spawn onto it is refused until "
-                        + "quarantinedForSeconds elapses; a profile sharing that credential is listed too.",
+                        + "quarantinedForSeconds elapses; a profile sharing that credential is listed too, "
+                        + "each row naming 'model' (the model that profile runs, when configured) and "
+                        + "'reason' (the backend text that triggered the quarantine, when known) — the fix "
+                        + "is usually `enabled: false` on that model under models.allow. "
+                        + "'exhaustionDetectionArmed' reports, per profile, whether a usage-limit refusal "
+                        + "on it can EVER be classified and quarantined (its exhaustedPattern is "
+                        + "configured) — false means that profile's credential can never be quarantined "
+                        + "by this mechanism, however many usage-limit refusals it sees. Both "
+                        + "exhaustedPattern and models.allow's on/off state are hot: editing fleetd.yaml "
+                        + "and reloading arms/disarms detection or flips a model off with no restart.",
                 objectSchema(Map.of(), List.of()));
     }
 
@@ -1486,7 +1969,13 @@ public final class FleetMcp {
                         + "for a quarantined profile's credential (see fleet_profiles), whatever its "
                         + "maxLoad/live — with credentialId and quarantinedForSeconds naming the "
                         + "quarantine, so 'free: 0, busy' can be told apart from 'free: 0, refusing "
-                        + "for N seconds'.",
+                        + "for N seconds'. When lead-to-lead coordination is configured, a 'coordinator' "
+                        + "object reports this daemon's own coord-id ('selfId') and mailbox state "
+                        + "('mailbox': pending/consumers), the messages currently held for it ('held': "
+                        + "msgId/from/preview, never the full body), and one row per coordinator.peers "
+                        + "coord-id ('peers': coordId/reachable, plus pending/consumers when reachable) — "
+                        + "this is peer DISCOVERY for cross-host leads, distinct from the local 'leads' "
+                        + "array above. It is omitted entirely when no coordinator is configured.",
                 objectSchema(Map.of(), List.of()));
     }
 

fleetd/src/main/java/dev/ltms/fleet/member/CompositePeerLauncher.java

@@ -14,6 +14,7 @@ import dev.ltms.fleet.placement.BackendOutagePolicy;
 import dev.ltms.fleet.placement.BackendQuarantine;
 import dev.ltms.fleet.placement.PlacementCandidate;
 import dev.ltms.fleet.placement.PlacementContext;
+import dev.ltms.fleet.placement.PlacementDecision;
 import dev.ltms.fleet.placement.PlacementException;
 import dev.ltms.fleet.placement.PlacementPolicies;
 import dev.ltms.fleet.placement.PlacementPolicy;
@@ -90,6 +91,19 @@ public final class CompositePeerLauncher implements PeerLauncher {
     private final Supplier<Map<String, FleetConfig.Profile>> profileConfigs;
     private final Supplier<PlacementPolicy> placementPolicy;
 
+    /**
+     * fleetd #422: the central model allow-list's on/off state, read live per spawn — same reason
+     * {@link #profileConfigs} is a supplier rather than a captured map (see the class doc above and
+     * {@link #enforceModelEnabled}). A caller with no {@code models:} block to read from (the
+     * simpler, map-based constructors used throughout this class's own tests) wires this to a
+     * constant {@code null}, which {@link #models0} treats as "nothing configured, gate never
+     * fires" — the pre-#422 behaviour.
+     */
+    private final Supplier<FleetConfig.Models> models;
+
+    /** The value {@link #models0} normalizes a {@code null} supplier result to. */
+    private static final FleetConfig.Models NO_MODELS_CONFIGURED = new FleetConfig.Models(List.of());
+
     /** CB-578 stage B: credential cooldown, checked before an explicit spawn and filtered into placement. */
     private final BackendQuarantine quarantine;
 
@@ -205,12 +219,44 @@ public final class CompositePeerLauncher implements PeerLauncher {
                                  FleetConfig.Fleet fleet,
                                  BackendQuarantine quarantine,
                                  BackendOutagePolicy outagePolicy) {
+        // No models: block to read from a plain profiles Map — fleetd #422's gate is wired to a
+        // constant null (see enforceModelEnabled/models0), the pre-#422 behaviour for every caller
+        // of this overload. Use the 9-arg overload below to test the gate against a LIVE supplier.
+        this(delegates, defaultProfile, profileConfigs, placementPolicy, liveCount, fleet, quarantine,
+                outagePolicy, constant(null));
+    }
+
+    /**
+     * As above, plus a LIVE model-gate source (fleetd #422). The 8-arg overload above wires
+     * {@code models} to a constant {@code null} because it has only a static {@code Map<String,
+     * Profile>}, never a full {@code FleetConfig}, to read one from; this overload exists so a test
+     * can prove {@link #enforceModelEnabled} and its candidate filter re-read {@link
+     * FleetConfig.Models} on every call rather than a value captured once at construction — the
+     * exact distinction fleetd #422 exists to get right (see the class doc's CB-559 note on {@link
+     * #profileConfigs}, which this follows). Production wiring uses the
+     * {@code Supplier<FleetConfig>} constructor below instead, which already threads a live
+     * {@code config.get().models()} through.
+     *
+     * @param models required — pass a supplier returning {@code null} for a caller that has no
+     *               {@code models:} block to gate against, never a defaulting overload (the same
+     *               "explicit opt-out, never a silent default" rule {@code quarantine}/
+     *               {@code outagePolicy} already follow).
+     */
+    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
+                                 String defaultProfile,
+                                 Map<String, FleetConfig.Profile> profileConfigs,
+                                 PlacementPolicy placementPolicy,
+                                 Function<String, Integer> liveCount,
+                                 FleetConfig.Fleet fleet,
+                                 BackendQuarantine quarantine,
+                                 BackendOutagePolicy outagePolicy,
+                                 Supplier<FleetConfig.Models> models) {
         // LinkedHashMap, not Map.copyOf: candidates() promises definition order and the weighted
         // policy breaks exact-weight ties on it, so a salted iteration order would make placement
         // differ from one JVM run to the next.
         this(delegates, defaultProfile,
                 constant(Collections.unmodifiableMap(new LinkedHashMap<>(profileConfigs))),
-                constant(placementPolicy), liveCount, constant(fleet), quarantine, outagePolicy);
+                constant(placementPolicy), liveCount, constant(fleet), quarantine, outagePolicy, models);
     }
 
     /**
@@ -250,7 +296,10 @@ public final class CompositePeerLauncher implements PeerLauncher {
                 liveCount,
                 () -> config.get().fleet(),
                 quarantine,
-                outagePolicy);
+                outagePolicy,
+                // fleetd #422: read live, same as profiles/placement/fleet above — a models.allow
+                // edit (on/off or otherwise) is visible to the very next spawn, no restart needed.
+                () -> config.get().models());
     }
 
     /** The all-suppliers form every other constructor funnels into. */
@@ -261,7 +310,8 @@ public final class CompositePeerLauncher implements PeerLauncher {
                                   Function<String, Integer> liveCount,
                                   Supplier<FleetConfig.Fleet> fleet,
                                   BackendQuarantine quarantine,
-                                  BackendOutagePolicy outagePolicy) {
+                                  BackendOutagePolicy outagePolicy,
+                                  Supplier<FleetConfig.Models> models) {
         this.fleet = fleet;
         this.quarantine = Objects.requireNonNull(quarantine, "quarantine");
         this.outagePolicy = Objects.requireNonNull(outagePolicy, "outagePolicy");
@@ -273,6 +323,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
         this.profileConfigs = profileConfigs;
         this.placementPolicy = placementPolicy;
         this.liveCount = liveCount;
+        this.models = Objects.requireNonNull(models, "models");
         Map<String, HerdrPeerLauncher> index = new LinkedHashMap<>();
         for (HerdrPeerLauncher d : this.delegates) {
             for (String profile : d.profiles()) {
@@ -303,6 +354,16 @@ public final class CompositePeerLauncher implements PeerLauncher {
         return m == null ? Map.of() : m;
     }
 
+    /**
+     * The currently-configured {@code models:} block, never null (fleetd #422). Read fresh on
+     * every call, the same reason {@link #profiles0} is — a config reload's on/off edit must reach
+     * the very next spawn.
+     */
+    private FleetConfig.Models models0() {
+        FleetConfig.Models m = models.get();
+        return m == null ? NO_MODELS_CONFIGURED : m;
+    }
+
     /** The adapter owning {@code profileName} (null/blank → the default). Throws on an unknown profile. */
     private HerdrPeerLauncher route(String profileName) {
         String resolved = (profileName == null || profileName.isBlank()) ? defaultProfile : profileName;
@@ -332,6 +393,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
             enforceNotQuarantined(requestedProfile);
             enforceNotCoolingOff(requestedProfile);
             enforceMaxLoad(requestedProfile);
+            enforceModelEnabled(requestedProfile);
             PeerHandle handle = d.spawn(req);
             spawnedBy.put(handle.id(), d);
             return handle;
@@ -341,18 +403,10 @@ public final class CompositePeerLauncher implements PeerLauncher {
         // the whole profile list. An EXPLICIT profile (above) is left alone on purpose — it is the
         // operator overriding, and refusing it would break `fleet_spawn{profile:"opus"}`, which
         // carries no role and so would be judged against the dev pool it was never meant for.
-        List<PlacementCandidate> candidates = candidates(req.role());
-        String roleDefault = defaultProfileFor(req.role());
         Set<String> unreachable = new HashSet<>();
-        // CB-578 stage B: computed once up front — a quarantine's expiry cannot pass within one spawn
-        // call, so re-deriving it per retry would only cost work, never change the answer.
-        Set<String> quarantined = quarantinedProfiles(candidates);
-        // fleetd #201 Unit 5: a distinct set from quarantined — see PlacementContext.coolingOff.
-        Set<String> coolingOff = coolingOffProfiles(candidates);
-        PlacementContext ctx = new PlacementContext(roleDefault, candidates, liveCount, unreachable,
-                quarantined, coolingOff);
+        PlacementContext ctx = placementContextFor(req.role(), unreachable);
 
-        int maxAttempts = candidates.isEmpty() ? 1 : candidates.size();
+        int maxAttempts = ctx.candidates().isEmpty() ? 1 : ctx.candidates().size();
         for (int attempt = 0; attempt < maxAttempts; attempt++) {
             // Deliberately uncaught: when no candidate is left (all at cap, or all unreachable) the
             // policy already throws a clear message. Catching it to rethrow a generic
@@ -369,8 +423,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
             // CB-547a: route the chosen profile but keep the caller's session identity — dropping it
             // here would silently sever the resume handle on every policy-routed spawn. CB-557: the
             // role rides along for the same reason, or a routed spawn would be labelled as a dev.
-            SpawnRequest routedReq = new SpawnRequest(chosen.profile(), req.requestedCwd(), req.callerCwd(),
-                    req.sessionName(), req.resumeSessionId(), req.role());
+            SpawnRequest routedReq = req.withProfile(chosen.profile());
             try {
                 PeerHandle handle = d.spawn(routedReq);
                 spawnedBy.put(handle.id(), d);
@@ -380,8 +433,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
                         chosen.profile(), e.getMessage());
                 unreachable.add(chosen.profile());
                 // Update the context for the next selection so the policy excludes this profile.
-                ctx = new PlacementContext(roleDefault, candidates, liveCount, unreachable,
-                        quarantined, coolingOff);
+                ctx = placementContextFor(req.role(), unreachable);
             }
         }
 
@@ -493,6 +545,49 @@ public final class CompositePeerLauncher implements PeerLauncher {
         }
     }
 
+    /**
+     * Refuse an explicit-profile spawn whose {@code model:} the operator has turned off in the
+     * central {@code models.allow:} list (fleetd #422). Deliberately worded apart from {@link
+     * #enforceNotQuarantined} and {@link #enforceNotCoolingOff}: those two report a BACKEND-reported
+     * outage (exhaustion, repeated errors); this one reports an OPERATOR decision, so the message
+     * says "turned off" and names the model, never "quarantined" or "cooling off". A FOURTH,
+     * independent reason to refuse a spawn — never layered onto {@code BackendQuarantine} or {@code
+     * BackendOutagePolicy}, which would misattribute an operator's own choice to the backend.
+     *
+     * <p>Reads {@link #models0()} fresh on every call — the same liveness {@link #profiles0()}
+     * already has — so flipping {@code enabled: false} and reloading takes effect on the very next
+     * spawn, no restart (criterion 4). A profile naming no model, or a model absent from {@code
+     * models.allow:} entirely (nothing to gate against), is never refused here.
+     *
+     * @throws PlacementException naming the model and the profile, distinct from quarantine/cool-off
+     */
+    private void enforceModelEnabled(String profile) {
+        FleetConfig.Profile cfg = profiles0().get(profile);
+        String model = (cfg == null) ? null : cfg.model();
+        if (model == null) {
+            return;
+        }
+        if (models0().offIds().contains(model)) {
+            throw new PlacementException("worker profile '" + profile + "' names model '" + model
+                    + "', which the operator has turned off in models.allow — refusing spawn");
+        }
+    }
+
+    /** The subset of {@code candidates} whose {@code model:} is currently turned off (fleetd #422). */
+    private Set<String> modelOffProfiles(List<PlacementCandidate> candidates) {
+        Set<String> off = models0().offIds();
+        if (off.isEmpty()) {
+            return Set.of();
+        }
+        return candidates.stream()
+                .map(PlacementCandidate::profile)
+                .filter(p -> {
+                    FleetConfig.Profile cfg = profiles0().get(p);
+                    return cfg != null && cfg.model() != null && off.contains(cfg.model());
+                })
+                .collect(Collectors.toSet());
+    }
+
     /**
      * The profile names {@code role} may be placed on, in definition order.
      *
@@ -509,8 +604,23 @@ public final class CompositePeerLauncher implements PeerLauncher {
         return known.isEmpty() ? List.copyOf(configured.keySet()) : known;
     }
 
-    /** The profile an unqualified spawn for {@code role} falls back to under {@code fixed} placement. */
-    private String defaultProfileFor(MemberRole role) {
+    /**
+     * {@inheritDoc}
+     *
+     * <p>Live: reads {@link #poolFor}, which reads {@link #profileConfigs} and {@link #fleet} fresh
+     * on every call, so a config reload is visible without a restart (fleetd #425) — unlike {@link
+     * #defaultProfile}, the field captured once at construction, which this falls back to only when
+     * {@link #poolFor} has nothing to offer at all (no profiles configured for this composite).
+     *
+     * <p>Exact only under the {@code fixed} placement policy — the one that reads this value
+     * ({@code FixedPlacementPolicy}, package-private, hence not linked) as its first, preferred
+     * candidate. {@code weighted}/{@code round-robin} placement can choose a different candidate
+     * from {@code role}'s pool even on the very first spawn; this method does not simulate that
+     * choice, matching what the {@code defaultProfile:}-derived reporting this replaces has always
+     * done.
+     */
+    @Override
+    public String defaultProfileFor(MemberRole role) {
         List<String> pool = poolFor(role);
         return pool.isEmpty() ? defaultProfile : pool.getFirst();
     }
@@ -527,6 +637,142 @@ public final class CompositePeerLauncher implements PeerLauncher {
         return out;
     }
 
+    /**
+     * Build the {@link PlacementContext} an unqualified spawn of {@code role} would be judged
+     * against right now — the single source both {@link #spawn} and {@link #place} read, so the two
+     * can never disagree about which conditions (quarantine, cool-off, model-off) apply to which
+     * candidate (fleetd #425 rework: round 1 duplicated this into a second, blind resolver —
+     * {@link #defaultProfileFor} — which is why it regressed; round 2 found that even a single
+     * shared resolver is not enough on its own if the CALLER re-resolves through an explicit
+     * profile afterwards — see {@link PlacementDecision}).
+     *
+     * @param unreachable the caller's mutable unreachable set; {@link #spawn} grows this across
+     *                    retries and rebuilds the context from it, {@link #place} passes a fresh
+     *                    empty one since it never retries
+     */
+    private PlacementContext placementContextFor(MemberRole role, Set<String> unreachable) {
+        List<PlacementCandidate> candidates = candidates(role);
+        String roleDefault = defaultProfileFor(role);
+        // CB-578 stage B: computed once up front — a quarantine's expiry cannot pass within one spawn
+        // call, so re-deriving it per retry would only cost work, never change the answer.
+        Set<String> quarantined = quarantinedProfiles(candidates);
+        // fleetd #201 Unit 5: a distinct set from quarantined — see PlacementContext.coolingOff.
+        Set<String> coolingOff = coolingOffProfiles(candidates);
+        // fleetd #422: read live per spawn, same as quarantined/coolingOff above — a config reload
+        // that flips a model's enabled state is visible to the very next unqualified spawn.
+        Set<String> modelOff = modelOffProfiles(candidates);
+        return new PlacementContext(roleDefault, candidates, liveCount, unreachable,
+                quarantined, coolingOff, modelOff);
+    }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>fleetd #425 rework, round 2: runs the exact same selection {@link #spawn} uses for a
+     * blank-profile request — {@link #placementContextFor} plus one {@link PlacementPolicy#select}
+     * — rather than {@link #defaultProfileFor}'s blind "pool's first entry", so a quarantined,
+     * cooling-off, or model-off pool-first candidate is routed around here exactly as it would be
+     * by a real spawn. Unlike {@link #spawn}, this never retries on {@link
+     * PeerUnreachableException}: there is no spawn attempt to fail, so "unreachable" never grows
+     * past the empty set it starts with, and a single {@link PlacementPolicy#select} call already
+     * reflects the live quarantine/cool-off/model-off state.
+     *
+     * <p>Deliberately does <em>not</em> apply {@link #enforceMaxLoad} (or any of the other three
+     * {@code enforce*} checks): those belong to {@link #spawn}'s EXPLICIT-profile branch, the
+     * operator-override path, and this method answers a different question — "where would an
+     * UNQUALIFIED spawn land". That is not the same as {@code select} ignoring these conditions —
+     * every condition {@code select} filters on (quarantine, cooling off, {@code maxLoad} under
+     * every placement policy including the default {@code fixed}, since fleetd #435, model-off,
+     * unreachable, weight-0) is already reflected in the {@link PlacementDecision} this method
+     * returns, because {@code select} walked past every excluded candidate to find it. What this
+     * method's caller must not do is take that resolved name and hand it back to {@link
+     * #spawn(SpawnRequest)} as an explicit profile: the explicit-profile branch treats the same
+     * exclusion conditions as a reason to REFUSE, where {@code select} had already treated them as
+     * a reason to fall through — round 1 of this fix did exactly that, turning a fall-through this
+     * method had already resolved around into a refusal one call later. Round 2 fixes that at the
+     * caller: {@link #spawn(SpawnRequest, PlacementDecision)} carries this exact decision to the
+     * spawn without re-resolving or re-checking it, through the same routing path {@code select}
+     * itself was consulted from.
+     *
+     * @throws PlacementException if no candidate in {@code role}'s pool is currently placeable
+     *                            (mirrors what an actual unqualified spawn would throw)
+     */
+    @Override
+    public PlacementDecision place(MemberRole role) {
+        PlacementContext ctx = placementContextFor(role, new HashSet<>());
+        return new PlacementDecision(placementPolicy.get().select(ctx).profile());
+    }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>Delegates to {@link #place}, so the two can never disagree about the answer for the same
+     * {@code role} at the same instant — kept as a convenience for a caller that only wants the
+     * resolved name (a status report, a log line), never for a caller that will act on it by
+     * spawning: that caller must hold the {@link PlacementDecision} itself and pass it to {@link
+     * #spawn(SpawnRequest, PlacementDecision)} — see {@link PlacementDecision}'s javadoc for why
+     * resolving here and spawning separately, with the name fed back in as an explicit profile,
+     * regressed fleetd #425 twice.
+     */
+    @Override
+    public String routedProfileFor(MemberRole role) {
+        return place(role).profile();
+    }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>Routes {@code decision.profile()} directly to its owning delegate — the identical
+     * {@code d.spawn(routedReq)} call {@link #spawn(SpawnRequest)}'s blank-profile branch makes for
+     * its first pick — WITHOUT re-running {@link #enforceNotQuarantined}, {@link
+     * #enforceNotCoolingOff}, {@link #enforceMaxLoad}, or {@link #enforceModelEnabled}: those are
+     * the EXPLICIT-profile branch's checks, and {@code decision} did not come from an operator
+     * naming a profile — it came from {@link #place}, which already applied whichever of these
+     * conditions {@link PlacementPolicy#select} actually filters on (fleetd #425 rework, round 2).
+     *
+     * <p>The two branches disagree on purpose about what an excluded profile means, and that
+     * disagreement is not what this method removes. The blank-profile routing branch (and
+     * {@link #place}) treats a quarantined/cooling-off/at-cap/model-off/unreachable/weight-0 profile
+     * as a reason to fall through to the next candidate; the EXPLICIT-profile branch treats naming
+     * that same profile as a reason to refuse outright — someone who names a profile should get a
+     * refusal, not a silent substitution onto a different backend. That is still correct after
+     * fleetd #435. What round 1 got wrong, and what this method exists to stop happening again, is
+     * turning a fall-through into a refusal by accident: resolving a name via {@link #place} and
+     * then handing that same name back to {@link #spawn(SpawnRequest)} as an explicit profile takes
+     * the refusing branch on a decision the routing branch had already approved by falling through
+     * past everything else.
+     *
+     * <p>Before fleetd #435, this exact accident was reachable through {@code maxLoad} specifically:
+     * {@code FixedPlacementPolicy} — the default policy — did not evaluate {@code maxLoad} at all
+     * for automatic selection, so {@link #place} could approve an at-cap profile that {@link
+     * #enforceMaxLoad} would then refuse one call later. fleetd #435 closed that: {@code
+     * FixedPlacementPolicy} now walks past an at-cap candidate exactly like {@code weighted}/
+     * {@code round-robin} already did, so {@link #place} can no longer return one, and this specific
+     * failure — an approved placement dying at {@code enforceMaxLoad} — cannot happen any more.
+     * What this method still buys, now that {@code maxLoad} can no longer cause it: it never
+     * re-evaluates a condition {@link #place} already decided, and it closes the window between
+     * that decision and the spawn in which the underlying state (another spawn landing on the same
+     * profile, a config reload) could otherwise move and make a stale explicit re-check wrong.
+     *
+     * <p>Deliberately does not retry on {@link PeerUnreachableException} across candidates the way
+     * {@link #spawn(SpawnRequest)}'s blank-profile branch does: retrying here would silently
+     * re-place the caller onto a different profile than the one {@code decision} named, behind the
+     * back of a caller that may already have provisioned something (a worktree's {@code repoRoot},
+     * parity overlay) specifically for that name. A caller that wants the composite's own failover
+     * should call {@link #spawn(SpawnRequest)} with a blank profile directly, not resolve through
+     * {@link #place} first. Losing that retry on a resolve-then-spawn path is an accepted, unrelated
+     * cost — see {@code SessionManager.acquireWithWorktree}'s own comment on it — never widened by
+     * this round to include {@code maxLoad}, which is what round 1 actually lost.
+     */
+    @Override
+    public PeerHandle spawn(SpawnRequest req, PlacementDecision decision) {
+        HerdrPeerLauncher d = route(decision.profile());
+        SpawnRequest routedReq = req.withProfile(decision.profile());
+        PeerHandle handle = d.spawn(routedReq);
+        spawnedBy.put(handle.id(), d);
+        return handle;
+    }
+
     @Override
     public String effectiveCwd(SpawnRequest req) {
         return route(req.profileName()).effectiveCwd(req);
@@ -537,6 +783,32 @@ public final class CompositePeerLauncher implements PeerLauncher {
         return route(profileName).parityOverlay(profileName);
     }
 
+    /**
+     * fleetd #422 follow-up: the single live read that answers both "is the models.allow: gate
+     * armed" and "which models are off", off the exact same accessor ({@link #models0()}) {@link
+     * #enforceModelEnabled} and {@link #modelOffProfiles} read — so {@code fleet_profiles}/{@code
+     * GET /profiles} (via {@link PeerLauncher#disabledModels()}, which now delegates here) can
+     * never report a different answer than the gate enforces (the fleetd #404 lesson), and the
+     * startup log line built from this can never disagree with either.
+     *
+     * <p>{@link #models0()} itself normalizes a {@code null} {@link #models} read to the shared
+     * {@link #NO_MODELS_CONFIGURED} sentinel — deliberately the one object no config-supplied
+     * {@code Models} instance can ever be identical to, since it is private to this class — so
+     * comparing by reference here recovers exactly the fact {@code models0()}'s normalization
+     * would otherwise erase: whether the live source was {@code null} (no {@code models:} block,
+     * armed = false) or a real, config-supplied block (armed = true, even one whose {@code allow:}
+     * is itself empty or absent — {@link FleetConfig.Models}'s "absent or empty allow: is off"
+     * wording governs config-load validation, a distinct question from whether this gate is armed
+     * for reporting).
+     */
+    @Override
+    public PeerLauncher.ModelGateState modelGateState() {
+        FleetConfig.Models m = models0();
+        return m == NO_MODELS_CONFIGURED
+                ? PeerLauncher.ModelGateState.notConfigured()
+                : PeerLauncher.ModelGateState.armed(m.offIds());
+    }
+
     @Override
     public void stop(String id) {
         HerdrPeerLauncher d = spawnedBy.get(id);
@@ -648,9 +920,21 @@ public final class CompositePeerLauncher implements PeerLauncher {
         return byProfile.keySet();
     }
 
+    /**
+     * {@inheritDoc}
+     *
+     * <p>fleetd #425: reports the <em>live</em> {@code dev} pool's first entry — the same value
+     * {@link #defaultProfileFor} computes for {@link MemberRole#DEV} — not the {@link
+     * #defaultProfile} field captured at construction. An unqualified {@code fleet_spawn} defaults
+     * to {@code MemberRole#DEV} (see {@link dev.ltms.fleet.peer.SpawnRequest}), so "the dev pool's
+     * live first entry" is exactly the profile such a spawn actually lands on right now — the
+     * question {@code fleet_profiles}' {@code "default"} field exists to answer. The frozen field is
+     * a role-agnostic fallback used only when {@link #poolFor} has nothing to report at all (no
+     * profiles configured), which {@link #defaultProfileFor} already handles.
+     */
     @Override
     public String defaultProfile() {
-        return defaultProfile;
+        return defaultProfileFor(MemberRole.DEV);
     }
 
     /**

fleetd/src/main/java/dev/ltms/fleet/member/EnvAllowListScrub.java

@@ -13,6 +13,7 @@ import java.nio.file.attribute.PosixFilePermissions;
 import java.time.Duration;
 import java.time.Instant;
 import java.util.ArrayList;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Set;
 import java.util.stream.Stream;
@@ -28,33 +29,85 @@ import java.util.stream.Stream;
  * control lacked: herdr applies that overlay BEFORE the shell starts, so any sourced file can undo
  * it — and did.
  *
- * <p><b>Which file is last depends on the platform, so the scrub runs from two of them.</b> zsh
+ * <p><b>zsh reads its four startup files under three different conditions, so no single file is
+ * guaranteed to run — the scrub has to cover the gap between them, not just the platforms.</b> zsh
  * reads {@code .zshenv} always, {@code .zprofile} and {@code .zlogin} only for a LOGIN shell, and
- * {@code .zshrc} only for an INTERACTIVE one. herdr does not open the same kind of shell
- * everywhere — measured on herdr 0.8.0: macOS panes run {@code -zsh} (login, so {@code .zlogin}
- * runs), Linux panes run a plain {@code /usr/bin/zsh} (interactive but NOT login, so
- * {@code .zlogin} never runs at all). A scrub in {@code .zlogin} alone is therefore a control that
- * silently does nothing on Linux — the exact failure this class exists to remove, one platform
- * over.
+ * {@code .zshrc} only for an INTERACTIVE one. A pane shell that is at least one of login or
+ * interactive is covered by sourcing the scrub from {@code .zshrc} and {@code .zlogin} (below), but
+ * a pane shell that is NEITHER reads only {@code .zshenv} and stops — fleetd #388, measured: a herdr
+ * pane can be neither login nor interactive, and such a pane read {@code .zshenv}, never reached
+ * {@code scrub.zsh}, and left no report at all. A bare {@code argv[0]} of {@code /usr/bin/zsh}
+ * proves the shell is NOT a login shell; it says nothing about whether it is interactive, so it
+ * must never be read as "therefore interactive" — that wrong inference is what let #388 ship.
  *
- * <p>So both {@code .zshrc} and {@code .zlogin} source the same generated {@code scrub.zsh} after
- * sourcing their {@code $HOME} counterpart. On Linux only the first fires; on macOS both do, and
- * the second pass is deliberate rather than merely harmless — it re-scrubs anything the operator's
- * own {@code ~/.zlogin} exported after {@code .zshrc} had finished. Re-running is idempotent: a
- * name already blank is blanked again, and the report is rewritten with the same counts.
+ * <p>So {@code .zshenv} carries a THIRD pass, guarded by the exact condition that defines the gap:
+ * {@code [[ ! -o login && ! -o interactive ]]}. That guard is why this pass cannot double-scrub a
+ * pane that {@code .zshrc} or {@code .zlogin} will also cover — one of {@code -o login}/
+ * {@code -o interactive} is always true there, so the {@code .zshenv} pass never fires for them, and
+ * their own unconditional sourcing is untouched. The guard also carries a sentinel
+ * ({@value #SCRUB_SENTINEL}) so it fires once per PANE and not once per PROCESS: {@code .zshenv} is
+ * read by every zsh a member's own tooling forks (a plain {@code zsh -c '...'} for a single
+ * command is itself neither login nor interactive), and those children inherit variables their
+ * parent deliberately set for them (git hooks get {@code GIT_DIR}, a venv gets
+ * {@code VIRTUAL_ENV}, a build tool gets {@code NODE_OPTIONS} or {@code JAVA_TOOL_OPTIONS}).
+ * Re-scrubbing every such child would blank all of that, and would also make the pane's own
+ * {@code scrub-report.txt} — rewritten on every pass — describe whichever child exited last
+ * instead of the pane. The sentinel is exported only AFTER {@code scrub.zsh} runs, so the pass
+ * that sets it never sees it and cannot blank it; it must also be on the scrub's own allow-list
+ * (see {@link #generate(Path, Set)}) so a later pass, in the same pane, cannot blank it back to
+ * empty — an exported-but-empty sentinel reads as unset to the {@code -z} guard and would silently
+ * re-enable scrubbing for every subsequent child of that pane.
+ *
+ * <p>So all three of {@code .zshenv} (gap only, guarded), {@code .zshrc}, and {@code .zlogin}
+ * source the same generated {@code scrub.zsh} after sourcing their {@code $HOME} counterpart. A
+ * login-and-interactive pane runs the {@code .zshrc} and {@code .zlogin} passes, and the second is
+ * deliberate rather than merely harmless — it re-scrubs anything the operator's own
+ * {@code ~/.zlogin} exported after {@code .zshrc} had finished. A pane that is neither runs only the
+ * {@code .zshenv} pass. Re-running is idempotent: a name already blank is blanked again, and the
+ * report is rewritten with the same counts.
  *
  * <p>Each generated file sources its {@code $HOME} counterpart FIRST, so {@code PATH} and every
- * toolchain binary still resolve exactly as the operator configured them; only afterwards does
- * {@code .zlogin} run the scrub: every EXPORTED variable not on the derived allow-list is re-exported
+ * toolchain binary still resolve exactly as the operator configured them; only afterwards does the
+ * scrub run: every EXPORTED variable not on the derived allow-list is re-exported
  * blank. Blank, not credential-shaped-pattern-filtered: a pattern list ({@code *TOKEN*}, …) is an
  * enumeration and misses what it did not think of — a username is the other half of a credential and
  * is shaped like none. Credential-SHAPED names among the blanked set go to the WARN log only,
  * never to the control.
  *
  * <p>The scrub also writes {@code scrub-report.txt} into its own directory: one {@code allowed N of
- * M} line (N = exports left untouched, M = exports present when the scrub ran), then the blanked
- * NAMES — never values. The launcher reads this back at teardown and logs it, because a blocked
- * count next to an unknown denominator is not a finding.
+ * M failed F} line (N = exports left untouched, M = exports present when the scrub ran, F = names
+ * the scrub attempted to blank but could not), then the NAMES — blanked ones bare, unblankable ones
+ * {@code !}-prefixed — never values. The launcher reads this back at teardown and logs it, because a
+ * blocked count next to an unknown denominator is not a finding.
+ *
+ * <p><b>fleetd #394:</b> plain {@code export "$n="} is a FATAL error for a zsh read-only or special
+ * parameter (for example {@code UID}) — it aborts the whole sourced file, so every name still to
+ * come is never blanked and the report above is never written at all. The blanking loop instead
+ * routes each attempt through {@code eval}, which contains that error to the single iteration: the
+ * loop always finishes, and a name that could not be blanked is counted as {@code failed} and
+ * listed {@code !}-prefixed rather than silently disappearing. This is deliberately not a skip-list
+ * of known-bad names — every enumerated name is still attempted, so a name nobody has thought of
+ * yet still gets tried and, if it fails, still gets counted.
+ *
+ * <p>The blanking loop also re-asserts, on its own, the same {@code [A-Za-z_][A-Za-z0-9_]*} shape
+ * check the enumeration loop already applied. Before {@code eval} was introduced a non-conforming
+ * name reaching {@code export "$n="} was harmless either way — the quoting made it inert. With
+ * {@code eval}, the name is spliced into a string and interpreted as shell syntax, so the enumeration
+ * loop's check is no longer sufficient on its own to keep that call site safe — it is a guard on a
+ * different loop, and the two must not silently drift apart. Re-checking right before the
+ * {@code eval} keeps that call site safe by its own reading, independent of whatever the enumeration
+ * loop does or stops doing in a later change.
+ *
+ * <p><b>fleetd #400:</b> {@code eval}'s exit status is not proof that the blank actually happened.
+ * zsh coerces a bare {@code NAME=} assignment on an integer special parameter (measured on macOS zsh
+ * 5.9: {@code SECONDS}, {@code RANDOM}, {@code SHLVL}, {@code HISTSIZE}, {@code COLUMNS},
+ * {@code LINES}, {@code USERNAME}) to a number instead of failing — {@code eval} returns success,
+ * the value is untouched, and a status-based classification reports it as blanked when it was not.
+ * The fix classifies on the observed effect instead: after the attempt, the name's value is read
+ * back with the {@code (P)} indirection flag and the decision is made from whether that is now
+ * empty. This one check covers all three shapes a name can take at this point — a genuine blank, a
+ * fatal read-only error {@code eval} merely contained, and this silent no-op — and the exit status
+ * plays no part in the decision at all.
  */
 public final class EnvAllowListScrub {
 
@@ -63,7 +116,11 @@ public final class EnvAllowListScrub {
     /** Name of the report file written into the generated directory by the scrub itself. */
     static final String REPORT_FILE = "scrub-report.txt";
 
-    /** The scrub body, generated once and sourced from both {@code .zshrc} and {@code .zlogin}. */
+    /**
+     * The scrub body, generated once and sourced from {@code .zshrc} and {@code .zlogin}
+     * unconditionally, and from {@code .zshenv} when the pane shell is neither login nor
+     * interactive (fleetd #388) — see the class javadoc.
+     */
     static final String SCRUB_FILE = "scrub.zsh";
 
     /** Prefix of every generated directory — also what {@link #reapOrphans} matches on. */
@@ -79,14 +136,42 @@ public final class EnvAllowListScrub {
     private static final String SOURCE_SCRUB =
             "source \"$ZDOTDIR/" + SCRUB_FILE + "\"\n";
 
+    /**
+     * fleetd #388: marks a pane, not a process, as already scrubbed. Set only by the guarded
+     * {@code .zshenv} pass (see {@link #NEITHER_LOGIN_NOR_INTERACTIVE_SCRUB}) after
+     * {@code scrub.zsh} has run, so it must also be folded into that pass's own allow-list — see
+     * the class javadoc's "must also be on the scrub's own allow-list" paragraph.
+     */
+    static final String SCRUB_SENTINEL = "_CB633_SCRUBBED";
+
+    /**
+     * Appended to {@code .zshenv}, after its {@code $HOME} source: the third pass, guarded on the
+     * exact condition that defines the gap {@code .zshrc}/{@code .zlogin} do not cover — a shell
+     * that is neither login nor interactive. The sentinel export happens only once the scrub has
+     * already run, and only for as long as the current pane's environment has not been rebuilt from
+     * scratch (a fresh {@code env -i} child would not inherit it — that is out of scope here, since
+     * such a child is no longer running under the pane's own environment at all).
+     */
+    private static final String NEITHER_LOGIN_NOR_INTERACTIVE_SCRUB =
+            "if [[ ! -o login && ! -o interactive && -z \"${" + SCRUB_SENTINEL + ":-}\" ]]; then\n"
+            + "  " + SOURCE_SCRUB
+            + "  export " + SCRUB_SENTINEL + "=1\n"
+            + "fi\n";
+
     private EnvAllowListScrub() {
     }
 
     /**
-     * A parsed {@code scrub-report.txt}: how many exported variables existed when the scrub ran,
-     * how many were left untouched (allowed), and the NAMES that were blanked. Values never appear.
+     * A parsed {@code scrub-report.txt}: how many exported variables existed when the scrub ran
+     * ({@code total}), how many were left untouched ({@code allowed}), how many the scrub attempted
+     * to blank but could not ({@code failed} — fleetd #394: a zsh read-only/special parameter such
+     * as {@code UID} fatally errors on plain {@code export NAME=}, so those attempts go through
+     * {@code eval} instead so the loop keeps going and the failure is counted rather than left
+     * invisible), and the NAMES in each of the latter two categories. {@code allowed +
+     * blanked.size() + unblankable.size() == total}, and {@code unblankable.size() == failed}.
+     * Values never appear.
      */
-    record ScrubReport(int allowed, int total, List<String> blanked) {
+    record ScrubReport(int allowed, int total, int failed, List<String> blanked, List<String> unblankable) {
     }
 
     /**
@@ -105,11 +190,16 @@ public final class EnvAllowListScrub {
             reapOrphans(parentDir);
             Path dir = Files.createTempDirectory(parentDir, DIR_PREFIX);
             dir.toFile().deleteOnExit();
-            // The report is written by zsh, after these hooks are registered, so register its path
-            // too — otherwise the directory is non-empty at JVM exit and cannot be removed at all.
-            dir.resolve(REPORT_FILE).toFile().deleteOnExit();
-            write(dir, SCRUB_FILE, scrubScript(allowedNames));
-            write(dir, ".zshenv", homeSourcingFile(".zshenv"));
+            // zsh truncates this pre-created receipt after these hooks are registered. Register its
+            // path too — otherwise the directory is non-empty at JVM exit and cannot be removed.
+            Files.createFile(dir.resolve(REPORT_FILE)).toFile().deleteOnExit();
+            // fleetd #388: scrub.zsh's OWN allow-list must also keep SCRUB_SENTINEL, or a later
+            // pass in the same pane blanks it back to empty and the .zshenv guard below thinks it
+            // was never scrubbed — see the class javadoc.
+            Set<String> namesForScrubScript = new HashSet<>(allowedNames);
+            namesForScrubScript.add(SCRUB_SENTINEL);
+            write(dir, SCRUB_FILE, scrubScript(namesForScrubScript));
+            write(dir, ".zshenv", homeSourcingFile(".zshenv") + NEITHER_LOGIN_NOR_INTERACTIVE_SCRUB);
             write(dir, ".zprofile", homeSourcingFile(".zprofile"));
             write(dir, ".zshrc", homeSourcingFile(".zshrc") + SOURCE_SCRUB);
             write(dir, ".zlogin", homeSourcingFile(".zlogin") + SOURCE_SCRUB);
@@ -147,12 +237,11 @@ public final class EnvAllowListScrub {
      * into it: owner keeps full access, {@code group} gets traverse+read on the directory ({@code
      * rwxr-x---}, so a member process — a login shell reading it via {@code ZDOTDIR}, or another
      * process simply opening a file under it — running under that group can find and read the
-     * files) and read-only on each file ({@code rw-r-----}) — deliberately no group WRITE anywhere,
-     * since a member never needs to add or change what fleetd generated. (For the ZDOTDIR scrub
-     * specifically, this also means the scrub script's own report write inside the pane fails
-     * closed rather than open — see {@code scrub.zsh}'s trailing {@code 2>/dev/null} — which {@link
-     * dev.ltms.fleet.member.HerdrPeerLauncher#releaseZdotdir} already treats as "cannot be
-     * confirmed to have run" rather than success.)
+     * files) and read-only on each file ({@code rw-r-----}), except the pre-created ZDOTDIR
+     * {@code scrub-report.txt}. That receipt gets group write ({@code rw-rw----}), so
+     * {@code scrub.zsh} can truncate and write it without granting group write on the directory.
+     * If its optional permission change fails, the member cannot write a receipt and the launcher
+     * keeps its existing WARN rather than failing the spawn.
      *
      * <p>Package-private and named generically on purpose: fleetd #213 built this for the ZDOTDIR
      * scrub directory, and fleetd #219 reuses it verbatim for {@link
@@ -167,7 +256,15 @@ public final class EnvAllowListScrub {
             setGroupAndPermissions(dir, principal, "rwxr-x---");
             try (Stream<Path> entries = Files.list(dir)) {
                 for (Path file : entries.toList()) {
-                    setGroupAndPermissions(file, principal, "rw-r-----");
+                    if (REPORT_FILE.equals(file.getFileName().toString())) {
+                        try {
+                            setGroupAndPermissions(file, principal, "rw-rw----");
+                        } catch (IOException | UnsupportedOperationException ignored) {
+                            // The receipt is optional. Its absence keeps the existing WARN path.
+                        }
+                    } else {
+                        setGroupAndPermissions(file, principal, "rw-r-----");
+                    }
                 }
             }
         } catch (IOException e) {
@@ -245,11 +342,13 @@ public final class EnvAllowListScrub {
         }
         return """
                 # generated by fleetd (CB-633 memberCredentials policy=allow-list) — do not edit.
-                # Sourced from .zshrc and again from .zlogin, each time AFTER that file has sourced
-                # its $HOME counterpart — so this runs after everything the operator sourced, on a
-                # login shell (macOS panes) and on a plain interactive one (Linux panes) alike.
-                # Running twice is idempotent and deliberate: the second pass catches anything
-                # ~/.zlogin exported after ~/.zshrc had finished.
+                # Sourced unconditionally from .zshrc and again from .zlogin, each time AFTER that
+                # file has sourced its $HOME counterpart — so this runs after everything the
+                # operator sourced, on any pane that is login and/or interactive. Running twice is
+                # idempotent and deliberate: the second pass catches anything ~/.zlogin exported
+                # after ~/.zshrc had finished. Also sourced, once, from a guarded pass in .zshenv
+                # (fleetd #388) when the pane shell is NEITHER login nor interactive — the one gap
+                # those two files do not cover.
 
                 typeset -A _cb633_allowed
                 for _cb633_n in %s; do _cb633_allowed[$_cb633_n]=1; done
@@ -271,15 +370,57 @@ public final class EnvAllowListScrub {
                   _cb633_blank+=("$_cb633_n")
                 done
 
-                { for _cb633_n in "${_cb633_blank[@]}"; do export "$_cb633_n="; done; } 2>/dev/null
+                # fleetd #394: plain `export "$n="` is FATAL for a zsh read-only/special parameter
+                # (e.g. UID) and aborts this whole sourced file — every name still to come is never
+                # blanked, and the report below is never written, silently. `eval` contains that
+                # error to the single iteration instead: it still fails for that one name, but the
+                # loop continues and we can tell allowed / blanked / unblankable apart afterwards.
+                # This is not a skip-list of known-bad names (that would miss the next one nobody
+                # thought of) — every name in _cb633_blank is still attempted, unconditionally.
+                # Every name reaching this loop already passed the identical identifier check in the
+                # enumeration loop above — but that guard is 20 lines away in a different loop, and
+                # this line is about to splice the name into a string handed to `eval`. Before this
+                # fix the name only ever reached `export` quoted ("$n="), which is inert on a
+                # non-identifier string either way; `eval` makes THIS line the only thing standing
+                # between such a string and code execution in the member's pane, so it re-asserts the
+                # same check on its own rather than trusting a guard it does not own. Under normal
+                # operation this can never fire (the enumeration guard already filtered everything
+                # reaching _cb633_blank), so a name caught here is counted as unblankable rather than
+                # silently dropped — it is real evidence that the upstream guard was bypassed.
+                #
+                # fleetd #400: the attempt's own exit status is NOT proof of its effect. zsh coerces
+                # a bare `NAME=` assignment on an integer special parameter (SECONDS, RANDOM, SHLVL,
+                # HISTSIZE, COLUMNS, LINES, USERNAME on this host) to a number instead of failing —
+                # `eval` returns 0, the value is untouched, and the old exit-status check reported it
+                # as blanked when it was not. Classify on the observed effect instead: attempt the
+                # export, then read the name's value back with the `(P)` indirection flag and decide
+                # from whether it is now empty. One check then covers all three shapes a name can
+                # take here — a genuine blank, a fatal read-only error `eval` merely contained, and
+                # this silent no-op — without the exit status entering the decision at all.
+                typeset -a _cb633_ok _cb633_unblankable
+                _cb633_ok=()
+                _cb633_unblankable=()
+                for _cb633_n in "${_cb633_blank[@]}"; do
+                  if [[ ! "$_cb633_n" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
+                    _cb633_unblankable+=("$_cb633_n")
+                    continue
+                  fi
+                  eval "export ${_cb633_n}=" 2>/dev/null
+                  if [[ -z "${(P)_cb633_n}" ]]; then
+                    _cb633_ok+=("$_cb633_n")
+                  else
+                    _cb633_unblankable+=("$_cb633_n")
+                  fi
+                done
 
                 integer _cb633_kept=$(( _cb633_total - ${#_cb633_blank} ))
                 {
-                  print -r -- "allowed $_cb633_kept of $_cb633_total"
-                  for _cb633_n in "${_cb633_blank[@]}"; do print -r -- "$_cb633_n"; done
+                  print -r -- "allowed $_cb633_kept of $_cb633_total failed ${#_cb633_unblankable}"
+                  for _cb633_n in "${_cb633_ok[@]}"; do print -r -- "$_cb633_n"; done
+                  for _cb633_n in "${_cb633_unblankable[@]}"; do print -r -- "!$_cb633_n"; done
                 } > "$ZDOTDIR/%s" 2>/dev/null
 
-                unset _cb633_allowed _cb633_names _cb633_blank _cb633_n _cb633_total _cb633_kept
+                unset _cb633_allowed _cb633_names _cb633_blank _cb633_ok _cb633_unblankable _cb633_n _cb633_total _cb633_kept
                 """.formatted(names, MemberEnvAllowList.zshCasePattern(), REPORT_FILE);
     }
 
@@ -293,6 +434,11 @@ public final class EnvAllowListScrub {
      * Read and parse {@link #REPORT_FILE} out of a generated ZDOTDIR directory. Returns {@code null}
      * when absent or unreadable (the pane may have been torn down before its login shell ever got to
      * the scrub) — callers treat that as "no measurement available", never as success.
+     *
+     * <p>First line is {@code "allowed <N> of <M> failed <F>"} (fleetd #394 added the trailing
+     * {@code failed <F>} — a count of names the scrub attempted to blank but could not, e.g. a zsh
+     * read-only/special parameter). Every following non-blank line is a name: a bare name was
+     * blanked, a {@code !}-prefixed name was attempted and failed. Values never appear on either.
      */
     static ScrubReport readReport(Path zdotdir) {
         Path report = zdotdir.resolve(REPORT_FILE);
@@ -305,17 +451,24 @@ public final class EnvAllowListScrub {
                 return null;
             }
             String[] parts = lines.getFirst().substring("allowed ".length()).trim().split("\\s+");
-            if (parts.length != 3 || !"of".equals(parts[1])) {
+            if (parts.length != 5 || !"of".equals(parts[1]) || !"failed".equals(parts[3])) {
                 return null;
             }
             List<String> blanked = new ArrayList<>();
+            List<String> unblankable = new ArrayList<>();
             for (int i = 1; i < lines.size(); i++) {
-                if (!lines.get(i).isBlank()) {
-                    blanked.add(lines.get(i));
+                String line = lines.get(i);
+                if (line.isBlank()) {
+                    continue;
+                }
+                if (line.startsWith("!")) {
+                    unblankable.add(line.substring(1));
+                } else {
+                    blanked.add(line);
                 }
             }
             return new ScrubReport(Integer.parseInt(parts[0]), Integer.parseInt(parts[2]),
-                    List.copyOf(blanked));
+                    Integer.parseInt(parts[4]), List.copyOf(blanked), List.copyOf(unblankable));
         } catch (IOException | NumberFormatException e) {
             return null;
         }

fleetd/src/main/java/dev/ltms/fleet/member/HerdrPeerLauncher.java

@@ -17,6 +17,7 @@ import dev.ltms.fleet.peer.PeerHandle;
 import dev.ltms.fleet.peer.PeerLauncher;
 import dev.ltms.fleet.peer.PeerUnreachableException;
 import dev.ltms.fleet.peer.SpawnRequest;
+import dev.ltms.fleet.placement.PlacementDecision;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -594,6 +595,23 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
                 req.sessionName(), spawned.agentSessionId(), spawned.receipt());
     }
 
+    /**
+     * {@inheritDoc}
+     *
+     * <p>fleetd #450: re-enters {@link #spawn(SpawnRequest)} with {@code decision}'s profile named
+     * explicitly. This is the re-entering form the interface javadoc describes for a launcher with
+     * no placement concept of its own — an instance of this class spawns a single adapter's own
+     * profile set by explicit name only ({@link #place}/{@link #defaultProfileFor} are unoverridden
+     * here and just wrap {@link #defaultProfile()}); it does no quarantine/cool-off/maxLoad/model-off
+     * filtering of its own to re-apply. That filtering lives one layer up, in {@code
+     * CompositePeerLauncher}, which is the launcher that routes across more than one profile and
+     * therefore overrides this method with the routing form instead.
+     */
+    @Override
+    public PeerHandle spawn(SpawnRequest req, PlacementDecision decision) {
+        return spawn(req.withProfile(decision.profile()));
+    }
+
     /** The herdr daemon that owns this launcher's pane coordinates. */
     public HerdrClient herdr() {
         return agents.herdr();
@@ -1643,11 +1661,19 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
             log.warn("memberCredentials allow-list: pane {} left no scrub report in {} — the "
                     + "environment scrub cannot be confirmed to have run. Either the pane ended "
                     + "before its shell finished starting, or its shell never read our generated "
-                    + "startup files, in which case that member saw the full host environment.",
+                    + "startup files. Either way, we cannot tell from here whether the scrub ran, "
+                    + "so we do not know what that member's environment contained.",
                     paneId, dir);
         } else {
             log.info("memberCredentials allow-list: pane {} allowed {} of {} environment variables",
                     paneId, report.allowed(), report.total());
+            if (report.failed() > 0) {
+                log.warn("memberCredentials allow-list: pane {} could not blank {} environment "
+                        + "variable(s) — {} (likely a zsh read-only/special parameter) — those "
+                        + "names were left in the member's environment. Confirm none of them is a "
+                        + "credential.",
+                        paneId, report.failed(), report.unblankable());
+            }
             List<String> shaped = report.blanked().stream()
                     .filter(name -> CREDENTIAL_SHAPED_NAME.matcher(name).matches())
                     .toList();

fleetd/src/main/java/dev/ltms/fleet/metrics/FleetMetrics.java

@@ -56,10 +56,13 @@ public final class FleetMetrics {
         m.describe(REPLIES, "counter",
                 "Worker replies by delivery path (rendezvous=resolved an open send, inbox=stranded and held).");
         m.describe(PUSH_NUDGES, "counter",
-                "CB-307 push-loop nudges to the primary (delivered|exhausted).");
+                "CB-307 push-loop nudges to the primary (sent|exhausted). fleetd #365: \"sent\" means "
+                        + "the herdr paste-and-submit call succeeded, not that the pane read it — this "
+                        + "layer has no read-receipt concept.");
         m.describe(HEARTBEAT_NUDGES, "counter",
-                "CB-551 idle-lead heartbeat nudges (delivered|failed|exhausted). Quiet-cap exhaustion "
-                        + "means the lead idled with nothing pending and was told to stand down.");
+                "CB-551 idle-lead heartbeat nudges (sent|failed|exhausted). Quiet-cap exhaustion "
+                        + "means the lead idled with nothing pending and was told to stand down. "
+                        + "fleetd #365: \"sent\" means the herdr call succeeded, not that the lead read it.");
         m.describe(SPAWNS, "counter",
                 "Worker spawn attempts by peer kind and outcome (ready|timeout|guard_rejected).");
         m.describe(HERDR_CALLS, "counter",

fleetd/src/main/java/dev/ltms/fleet/msg/AmqpReplyInbox.java

@@ -394,17 +394,17 @@ public final class AmqpReplyInbox implements ReplyInbox, AutoCloseable {
     }
 
     @Override
-    public void ack(String target, String msgId) {
+    public boolean ack(String target, String msgId) {
         var perTarget = held.get(target);
         if (perTarget == null || perTarget == RELEASED) {
-            return;
+            return false;
         }
         Held h;
         synchronized (perTarget) {
             h = perTarget.remove(msgId);
         }
         if (h == null) {
-            return;                                // never held (or already acked) — no-op
+            return false;                          // never held (or already acked) — no-op
         }
         try {
             synchronized (channelLock) {
@@ -418,6 +418,7 @@ public final class AmqpReplyInbox implements ReplyInbox, AutoCloseable {
             }
             throw new IllegalStateException("cannot ack reply " + msgId + " on " + queueName(target), e);
         }
+        return true;
     }
 
     private DeliverCallback deliverCallback(String target) {

fleetd/src/main/java/dev/ltms/fleet/msg/InMemoryReplyInbox.java

@@ -59,16 +59,17 @@ public final class InMemoryReplyInbox implements ReplyInbox {
     }
 
     @Override
-    public void ack(String target, String msgId) {
+    public boolean ack(String target, String msgId) {
         if (!owned.contains(target)) {
-            return;
+            return false;
         }
         var perTarget = store.get(target);
-        if (perTarget != null) {
-            //noinspection SynchronizationOnLocalVariableOrMethodParameter
-            synchronized (perTarget) {
-                perTarget.remove(msgId);
-            }
+        if (perTarget == null) {
+            return false;
+        }
+        //noinspection SynchronizationOnLocalVariableOrMethodParameter
+        synchronized (perTarget) {
+            return perTarget.remove(msgId) != null;
         }
     }
 }

fleetd/src/main/java/dev/ltms/fleet/msg/LeadChannel.java

@@ -4,8 +4,8 @@ import java.util.List;
 
 /**
  * The lead-to-lead message channel this daemon speaks, as its callers need it — one lead's own
- * mailbox: publish to a peer's coord-id, look at what has arrived for me, and ack what I have
- * delivered.
+ * mailbox: publish to a peer's coord-id, look at what has arrived for me, ack what I have
+ * delivered, and (fleetd #361) inspect any coord-id's mailbox from the outside without owning it.
  *
  * <p>Extracted from {@link LeadMailbox} purely as a seam. {@code LeadMailbox} is the one production
  * implementation and owns a live AMQP connection, so a test that wanted to exercise the routing in
@@ -32,9 +32,99 @@ public interface LeadChannel {
     /** Non-destructive FIFO snapshot of the messages held for this daemon's own coord-id. */
     List<LeadMessage> peek();
 
-    /** Drop {@code msgId} from the held set and ack it on the broker. A no-op if it is not held. */
+    /**
+     * Drop {@code msgId} from the held set and ack it on the broker. A repeated ack that this
+     * connection already completed may be a no-op. Any other unknown msgId must throw rather than
+     * report an ack that did not reach the broker.
+     */
     void ack(String msgId);
 
     /** This daemon's own lead coordination id — the mailbox it owns, and the {@code from} it sends as. */
     String selfCoordId();
+
+    /**
+     * Whether a message sitting in {@link #peek}'s held set (fetched but not yet {@link #ack}ed) is
+     * still safe if this daemon crashes or restarts right now — the conclusion of two independent
+     * facts about how this channel owns its own queue: the queue was declared <em>durable</em>, and
+     * the consumer that filled {@code held} uses <em>manual ack</em>, so an unacked delivery is still
+     * owned by the broker rather than only in this process's memory. Both must hold for {@code true};
+     * an implementation must derive this from what it actually did when it declared and consumed its
+     * queue, never return a literal — fleetd #440 found {@code FleetMcp}'s {@code heldDurable} field
+     * doing exactly that, unable to ever report {@code false} even after the fact stopped being true.
+     */
+    boolean heldDurable();
+
+    /**
+     * A non-destructive look at {@code coordId}'s mailbox — does it exist, how many messages are
+     * waiting on it, and how many consumers are attached — without owning, consuming, or otherwise
+     * changing it. {@code consumers == 0} on an existing mailbox is the observable form of "nobody
+     * is reading this right now": a publish to it will sit queued rather than reach a pane.
+     *
+     * <p><strong>Never throws</strong> — this is a best-effort fact-finding call, not an operation a
+     * caller must handle failing. But it must never turn "I could not check" into a false negative:
+     * {@link MailboxState#absent(String)} means the broker positively confirmed there is no such
+     * queue, and {@link MailboxState#unknown(String)} — a distinct value — means the look could not
+     * be completed at all (broker unreachable, timed out, connection closed). A caller that
+     * collapses those two into one, as fleetd #361 initially did, cannot tell "that peer is down"
+     * from "I could not check", and a reader of {@code pending}/{@code consumers} cannot tell a
+     * measured zero from a zero standing in for "not measured".
+     *
+     * <p><strong>Must never share fate with {@link #publish} or {@link #peek}/{@link #ack}.</strong>
+     * fleetd #361: in AMQP 0-9-1 a passive queue declare of a queue that does not exist closes the
+     * channel it was declared on with a 404. An implementation backed by a real broker connection
+     * must inspect on a channel it can afford to lose — never the channel {@link #publish} or the
+     * consume loop depends on — so that looking at a peer that happens to be down can never break
+     * this daemon's own send or receive path.
+     */
+    MailboxState inspect(String coordId);
+
+    /**
+     * The result of {@link #inspect}. {@code presence} tells apart three states a caller must not
+     * conflate: a confirmed-existing mailbox ({@link Presence#EXISTS}, the only case where
+     * {@code pending}/{@code consumers} are measured facts), a confirmed-absent one
+     * ({@link Presence#ABSENT} — the broker positively said "no such queue"), and one this call
+     * simply could not determine ({@link Presence#UNKNOWN} — broker unreachable, timed out,
+     * connection closed). {@code pending}/{@code consumers} are always {@code 0} and meaningless
+     * outside {@link Presence#EXISTS}; a renderer must gate on {@link #exists()} (or {@code
+     * presence} directly), never present them as measured otherwise.
+     *
+     * @param coordId   the coord-id inspected
+     * @param presence  whether the mailbox is confirmed to exist, confirmed absent, or unknown
+     * @param pending   messages ready for delivery but not yet in a consumer's hands (0 unless EXISTS)
+     * @param consumers how many consumers are attached (0 unless EXISTS)
+     */
+    record MailboxState(String coordId, Presence presence, int pending, int consumers) {
+
+        /** Whether {@link #inspect} was able to reach a definite answer, of either kind. */
+        public enum Presence { EXISTS, ABSENT, UNKNOWN }
+
+        /** {@code true} only when the broker confirmed this exact queue is currently declared. */
+        public boolean exists() {
+            return presence == Presence.EXISTS;
+        }
+
+        /**
+         * {@code true} when {@link #inspect} reached a definite answer (exists or confirmed
+         * absent); {@code false} when it could not determine either way. A caller must never treat
+         * {@code !known()} the same as a confirmed absence — the mailbox may well exist.
+         */
+        public boolean known() {
+            return presence != Presence.UNKNOWN;
+        }
+
+        /** The broker confirmed this queue exists, with these measured counts. */
+        public static MailboxState exists(String coordId, int pending, int consumers) {
+            return new MailboxState(coordId, Presence.EXISTS, pending, consumers);
+        }
+
+        /** The broker positively confirmed there is no such queue (e.g. a 404 on passive declare). */
+        public static MailboxState absent(String coordId) {
+            return new MailboxState(coordId, Presence.ABSENT, 0, 0);
+        }
+
+        /** The look could not be completed — broker unreachable, timed out, or connection closed. */
+        public static MailboxState unknown(String coordId) {
+            return new MailboxState(coordId, Presence.UNKNOWN, 0, 0);
+        }
+    }
 }

fleetd/src/main/java/dev/ltms/fleet/msg/LeadCoordLoop.java

@@ -5,6 +5,7 @@ import dev.ltms.fleet.herdr.AgentStatus;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.concurrent.ScheduledExecutorService;
@@ -43,6 +44,9 @@ public final class LeadCoordLoop {
 
     private static final Logger log = LoggerFactory.getLogger(LeadCoordLoop.class);
 
+    /** A bounded window is enough: redelivery can only follow a recent failed ack or recovery. */
+    private static final int RECENT_DELIVERY_LIMIT = 1_024;
+
     /** How an arriving peer message is rendered into the lead's pane — the sender's coord-id, then its text. */
     static final String DELIVERY_FORMAT = "[lead %s] %s";
 
@@ -51,6 +55,8 @@ public final class LeadCoordLoop {
     private final Supplier<Map<String, String>> leads;
     private final ScheduledExecutorService scheduler;
     private final long intervalMs;
+    /** msgIds already written to the pane, so recovery redelivery is acked without another pane write. */
+    private final LinkedHashMap<String, Boolean> delivered = new LinkedHashMap<>();
 
     private volatile boolean running;
 
@@ -117,6 +123,13 @@ public final class LeadCoordLoop {
         if (held.isEmpty()) {
             return;
         }
+        LeadMessage msg = held.getFirst();
+        if (wasDelivered(msg.msgId())) {
+            // This lives here, rather than in LeadMailbox, because only this loop knows a pane write
+            // happened. The mailbox only knows broker delivery tags and must still redeliver after a crash.
+            ackDelivered(msg);
+            return;
+        }
         String lead = resolveLocalLead();
         if (lead == null) {
             // Left unacked on purpose: the broker keeps holding it until a lead pane exists.
@@ -136,7 +149,6 @@ public final class LeadCoordLoop {
                     lead, status, held.size());
             return;
         }
-        LeadMessage msg = held.getFirst();
         try {
             agents.send(lead, DELIVERY_FORMAT.formatted(msg.from(), msg.content()));
         } catch (RuntimeException e) {
@@ -145,6 +157,13 @@ public final class LeadCoordLoop {
                     msg.msgId(), msg.from(), lead, e.toString());
             return;
         }
+        rememberDelivered(msg.msgId());
+        if (ackDelivered(msg)) {
+            log.debug("lead coordination: delivered message {} from {} to lead {}", msg.msgId(), msg.from(), lead);
+        }
+    }
+
+    private boolean ackDelivered(LeadMessage msg) {
         try {
             channel.ack(msg.msgId());
         } catch (RuntimeException e) {
@@ -152,9 +171,24 @@ public final class LeadCoordLoop {
             // deliberate direction of this trade.
             log.warn("lead coordination: delivered message {} but could not ack it: {}",
                     msg.msgId(), e.toString());
-            return;
+            return false;
+        }
+        return true;
+    }
+
+    private boolean wasDelivered(String msgId) {
+        synchronized (delivered) {
+            return delivered.containsKey(msgId);
+        }
+    }
+
+    private void rememberDelivered(String msgId) {
+        synchronized (delivered) {
+            delivered.put(msgId, Boolean.TRUE);
+            if (delivered.size() > RECENT_DELIVERY_LIMIT) {
+                delivered.remove(delivered.keySet().iterator().next());
+            }
         }
-        log.debug("lead coordination: delivered message {} from {} to lead {}", msg.msgId(), msg.from(), lead);
     }
 
     /**

fleetd/src/main/java/dev/ltms/fleet/msg/LeadHeartbeatLoop.java

@@ -96,7 +96,14 @@ public final class LeadHeartbeatLoop {
         this.metrics = metrics;
     }
 
-    /** Count one nudge outcome when a registry is wired; a no-op in unit tests. */
+    /**
+     * Count one nudge outcome when a registry is wired; a no-op in unit tests.
+     *
+     * <p>fleetd #365: the {@code "sent"} outcome (renamed from {@code "delivered"}) records only
+     * that {@link #injectNudge} — a one-way herdr {@code agent.prompt} paste-and-submit — returned
+     * without throwing, not that the lead's pane actually read or acted on the text. This layer has
+     * no read-receipt concept, so "sent" is the honest word for what this call can ever establish.
+     */
     private void countNudge(String outcome) {
         if (metrics != null) {
             metrics.inc(FleetMetrics.HEARTBEAT_NUDGES, "outcome", outcome);
@@ -245,7 +252,7 @@ public final class LeadHeartbeatLoop {
             agents.send(leadTerminal, fleet.nudgeText());
             log.debug("idle-heartbeat: nudge sent to lead {} (quiet nudges so far in this stretch: {})",
                     leadTerminal, quietCount);
-            countNudge("delivered");
+            countNudge("sent");
         } catch (RuntimeException e) {
             log.warn("idle-heartbeat: failed to nudge lead {}: {}", leadTerminal, e.toString());
             countNudge("failed");

fleetd/src/main/java/dev/ltms/fleet/msg/LeadMailbox.java

@@ -10,6 +10,7 @@ import com.rabbitmq.client.DeliverCallback;
 import com.rabbitmq.client.Recoverable;
 import com.rabbitmq.client.RecoveryListener;
 import com.rabbitmq.client.Return;
+import com.rabbitmq.client.ShutdownSignalException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -58,7 +59,8 @@ import java.util.concurrent.TimeoutException;
  * <p><strong>Recovery.</strong> The connection is opened with automatic + topology recovery
  * enabled, mirroring {@code AmqpReplyInbox}: on reconnect the broker hands out fresh delivery tags,
  * so the held snapshot is cleared (dedup by {@code msgId} still prevents any double-queue on
- * redelivery) and any publish still awaiting its confirm is failed rather than left to idle out
+ * redelivery). {@link LeadCoordLoop} separately deduplicates pane writes, since it alone knows
+ * which messages reached a lead. Any publish still awaiting its confirm is failed rather than left to idle out
  * the confirm timeout against a sequence number that means nothing on the new channel.
  */
 public final class LeadMailbox implements LeadChannel, AutoCloseable {
@@ -84,6 +86,16 @@ public final class LeadMailbox implements LeadChannel, AutoCloseable {
     private final Object channelLock = new Object();
     /** msgId → held delivery, for this mailbox's own queue only (there is exactly one). */
     private final LinkedHashMap<String, Held> held = new LinkedHashMap<>();
+    /**
+     * fleetd #440: the answer to {@link #heldDurable()}, set once by {@link #own()} from the exact
+     * booleans it passed to {@code queueDeclare}/{@code basicConsume} — never a separate literal that
+     * could drift from what those calls actually did.
+     */
+    private boolean heldDurable;
+    /** Successful broker acks on this connection, retained only to make a repeated caller ack quiet. */
+    private final LinkedHashMap<String, Boolean> recentlyAcked = new LinkedHashMap<>();
+    /** Bounds {@link #recentlyAcked}: it is only an idempotency aid, never delivery state. */
+    private static final int RECENT_ACK_LIMIT = 1_024;
 
     /**
      * A dedicated channel for {@link #publish}, kept separate from {@link #channel} (consume + ack)
@@ -161,16 +173,15 @@ public final class LeadMailbox implements LeadChannel, AutoCloseable {
         }
         // On automatic recovery the broker redelivers unacked messages with FRESH delivery-tags; the
         // tags we were holding are now stale. Drop the held snapshot so the re-attached consumer
-        // repopulates it with valid tags (dedup by msgId still prevents any double-queue). Any publish
+        // repopulates it with valid tags (dedup by msgId still prevents any double-queue). LeadCoordLoop
+        // remembers successful pane writes separately, so that redelivery cannot write a pane twice. Any publish
         // confirm still in flight when the connection dropped is equally stale — fail it now rather
         // than let it silently ride out CONFIRM_TIMEOUT_MS.
         if (connection instanceof Recoverable recoverable) {
             recoverable.addRecoveryListener(new RecoveryListener() {
                 @Override
                 public void handleRecovery(Recoverable recoverable) {
-                    synchronized (held) {
-                        held.clear();
-                    }
+                    clearHeldForRecovery();
                     failPendingPublishesOnRecovery();
                     log.info("AMQP lead mailbox connection recovered; cleared held messages for fresh redelivery");
                 }
@@ -186,13 +197,22 @@ public final class LeadMailbox implements LeadChannel, AutoCloseable {
     /** Declare + consume this daemon's own {@code lead.<selfCoordId>.inbox}. Called once, at construction. */
     private void own() throws IOException {
         String queue = queueName(selfCoordId);
+        boolean durableQueue = true; // durable, non-exclusive, keep on idle
+        boolean autoAck = false; // manual ack
         synchronized (channelLock) {
-            channel.queueDeclare(queue, true, false, false, null); // durable, non-exclusive, keep on idle
-            channel.basicConsume(queue, false, deliverCallback(), _ -> { }); // autoAck=false: manual ack
+            channel.queueDeclare(queue, durableQueue, false, false, null);
+            channel.basicConsume(queue, autoAck, deliverCallback(), _ -> { });
         }
+        // fleetd #440: held mail is durable only while both hold — a durable queue AND manual ack.
+        this.heldDurable = durableQueue && !autoAck;
         log.debug("lead mailbox owns queue {} for coord-id {}", queue, selfCoordId);
     }
 
+    @Override
+    public boolean heldDurable() {
+        return heldDurable;
+    }
+
     /**
      * Publish {@code msg} to {@code toCoordId}'s mailbox and block until the broker's publisher
      * confirm for it lands. Does <em>not</em> imply owning or consuming {@code toCoordId}'s queue.
@@ -259,6 +279,89 @@ public final class LeadMailbox implements LeadChannel, AutoCloseable {
         }
     }
 
+    /**
+     * fleetd #361: look at {@code coordId}'s mailbox on a fresh, immediately-closed throwaway
+     * channel — never {@link #channel} (consume/ack) or {@link #publishChannel} (publish). A
+     * passive queue declare of a queue that does not exist closes the channel it was declared on
+     * with a 404; using a disposable probe channel means that closure can never touch either
+     * long-lived channel this instance depends on for {@link #publish} or the consume loop.
+     *
+     * <p>Classifies failures rather than collapsing them, both measured against a real broker in
+     * {@code LeadMailboxTest} rather than assumed from the AMQP 0-9-1 spec text:
+     * <ul>
+     *   <li>a genuine 404 — an {@link IOException} wrapping a {@link ShutdownSignalException} whose
+     *       {@link AMQP.Channel.Close#getReplyCode()} is {@code 404} — reports
+     *       {@link MailboxState#absent}; every other declare failure reports
+     *       {@link MailboxState#unknown} instead of quietly becoming the same "absent" value;
+     *   <li>{@code catch (RuntimeException e)} on both attempts matters as much as the checked
+     *       catches: a connection that is already closed makes {@link Connection#createChannel()}
+     *       throw {@link com.rabbitmq.client.AlreadyClosedException} (a {@link RuntimeException},
+     *       not an {@link IOException}) — an {@code inspect} that only caught {@code IOException}
+     *       would let that escape, breaking the "never throws" contract this method promises.
+     * </ul>
+     *
+     * <p><strong>Honesty about which catch is measured and which is defensive:</strong> the
+     * {@code createChannel()} catch above is exercised end-to-end against a real broker by
+     * {@code LeadMailboxTest.inspectReportsUnknownRatherThanThrowingWhenTheConnectionIsAlreadyClosed}.
+     * The second {@code catch (RuntimeException e)}, around the passive declare itself — for the
+     * narrower race where the connection drops <em>between</em> {@code createChannel()} succeeding
+     * and the declare landing — has no such test; reaching it needs a connection that dies at that
+     * exact instant, which is not a scenario this suite drives on purpose. It stays purely
+     * defensive: correct by the same reasoning as the first catch, but unproven the way the first
+     * one is proven.
+     */
+    @Override
+    public MailboxState inspect(String coordId) {
+        String queue = queueName(coordId);
+        Channel probe;
+        try {
+            probe = connection.createChannel();
+        } catch (IOException | RuntimeException e) {
+            log.debug("lead mailbox inspect: cannot open a probe channel for {}: {}", coordId, e.toString());
+            return MailboxState.unknown(coordId);
+        }
+        try {
+            AMQP.Queue.DeclareOk declared = probe.queueDeclarePassive(queue);
+            return MailboxState.exists(coordId, declared.getMessageCount(), declared.getConsumerCount());
+        } catch (IOException e) {
+            // The broker (or the client library) has already closed `probe` for us either way; only
+            // a confirmed 404 means "no such queue" — anything else (a different declare failure) is
+            // "could not determine", never silently reported as the same value as a genuine absence.
+            return isMissingQueue(e) ? MailboxState.absent(coordId) : MailboxState.unknown(coordId);
+        } catch (RuntimeException e) {
+            // E.g. the connection dropped between createChannel() and the declare landing.
+            log.debug("lead mailbox inspect: declare failed unexpectedly for {}: {}", coordId, e.toString());
+            return MailboxState.unknown(coordId);
+        } finally {
+            try {
+                if (probe.isOpen()) {
+                    probe.close();
+                }
+            } catch (Exception e) {
+                log.debug("lead mailbox inspect: probe channel close for {}: {}", coordId, e.toString());
+            }
+        }
+    }
+
+    /**
+     * {@code true} only for the specific shape a missing-queue passive declare actually produces —
+     * measured against a real broker, not assumed from the spec text (see {@code
+     * LeadMailboxTest.passiveDeclareOfAMissingQueueThrowsAnIOExceptionWrappingA404ShutdownSignal}):
+     * an {@link IOException} whose cause is a {@link ShutdownSignalException} carrying an
+     * {@link AMQP.Channel.Close} reason with {@code replyCode == 404}. Any other shape (a different
+     * reply code, a {@code ShutdownSignalException} cause whose reason is not a
+     * {@code Channel.Close}, or no cause at all) is a declare failure of some other kind and must
+     * not be read as "confirmed absent" — pinned hermetically, with no broker needed, by
+     * {@code LeadMailboxIsMissingQueueTest} for exactly those three false shapes. Package-private
+     * (not {@code private}) so that test can call it directly.
+     */
+    static boolean isMissingQueue(IOException e) {
+        if (!(e.getCause() instanceof ShutdownSignalException sse)) {
+            return false;
+        }
+        return sse.getReason() instanceof AMQP.Channel.Close close && close.getReplyCode() == AMQP.NOT_FOUND;
+    }
+
     /** Convenience: {@link #peek} the current snapshot, then {@link #ack} every message in it. */
     public List<LeadMessage> drain() {
         List<LeadMessage> snapshot = peek();
@@ -266,15 +369,26 @@ public final class LeadMailbox implements LeadChannel, AutoCloseable {
         return snapshot;
     }
 
-    /** Remove the held message {@code msgId} and ack it on the broker. No-op if not held. */
+    /**
+     * Remove the held message {@code msgId} and ack it on the broker.
+     *
+     * <p>A repeated ack that this connection already completed is a no-op, tracked in the bounded
+     * {@link #recentlyAcked} set. Any other missing entry throws: recovery clears {@link #held} while
+     * the broker still owns the unacked delivery, and quiet success there would hide a required retry.
+     * The set is bounded because it only distinguishes a recent duplicate caller ack from an unknown
+     * delivery; it is not a substitute for broker state across a reconnect.
+     */
     @Override
     public void ack(String msgId) {
         Held h;
         synchronized (held) {
             h = held.remove(msgId);
+            if (h == null && recentlyAcked.containsKey(msgId)) {
+                return;
+            }
         }
         if (h == null) {
-            return;                                // never held (or already acked) — no-op
+            throw new IllegalStateException("cannot ack lead message " + msgId + ": it is not held");
         }
         try {
             synchronized (channelLock) {
@@ -288,6 +402,19 @@ public final class LeadMailbox implements LeadChannel, AutoCloseable {
             }
             throw new IllegalStateException("cannot ack lead message " + msgId, e);
         }
+        synchronized (held) {
+            recentlyAcked.put(msgId, Boolean.TRUE);
+            if (recentlyAcked.size() > RECENT_ACK_LIMIT) {
+                recentlyAcked.remove(recentlyAcked.keySet().iterator().next());
+            }
+        }
+    }
+
+    /** Clear stale delivery tags after recovery; package-private so the recovery contract test drives this exact path. */
+    void clearHeldForRecovery() {
+        synchronized (held) {
+            held.clear();
+        }
     }
 
     private DeliverCallback deliverCallback() {

fleetd/src/main/java/dev/ltms/fleet/msg/MessageService.java

@@ -138,6 +138,53 @@ public final class MessageService {
     public record AskResult(AskOutcome outcome, String answer) {
     }
 
+    /**
+     * How a worker's {@code fleet_reply} ({@link #reply(String, String)}) actually landed
+     * (fleetd #365) — the two doors that expose it, {@code fleet_reply} and {@code POST
+     * /sessions/{id}/reply}, both used to report the single word "delivered" whichever of these
+     * happened, so a caller could not tell an active handoff from a reply merely held for later
+     * drain. Both are successes; they are not the same fact.
+     */
+    public enum ReplyOutcome {
+        /** Resolved a {@code fleet_send}/{@code fleet_ask} that was actively waiting on this reply. */
+        RESOLVED_SEND("resolved_send", true,
+                "delivered — resolved the fleet_send that was waiting for it"),
+        /**
+         * No live waiter was open, but the reply completed a parked async ticket directly
+         * ({@link #askAnsweredAsyncTasks}) — a {@code fleet_poll} caller sees it immediately.
+         */
+        RESOLVED_ASYNC_TICKET("resolved_async_ticket", true,
+                "delivered — resolved a pending async ticket (visible to fleet_poll)"),
+        /** Nothing was waiting; the reply was queued in the inbox for a later drain (CB-307). */
+        QUEUED("queued", false,
+                "queued — no send or ticket was waiting; held in the inbox for a later drain");
+
+        private final String wireName;
+        private final boolean delivered;
+        private final String description;
+
+        ReplyOutcome(String wireName, boolean delivered, String description) {
+            this.wireName = wireName;
+            this.delivered = delivered;
+            this.description = description;
+        }
+
+        /** Stable machine-readable name for a JSON/metrics label (REST's {@code outcome} field). */
+        public String wireName() {
+            return wireName;
+        }
+
+        /** Whether something was actively waiting and received this reply right now. */
+        public boolean delivered() {
+            return delivered;
+        }
+
+        /** Shared human-readable text — the one place both {@code fleet_reply} and REST word this. */
+        public String description() {
+            return description;
+        }
+    }
+
     /** Lifecycle phase of an async delegation ticket. */
     public enum Phase {
         /** Delegated and in flight — queued for the worker or being worked. */
@@ -439,16 +486,15 @@ public final class MessageService {
      * @throws IllegalArgumentException if {@code content} is {@code null} or blank — the caller must
      *         report this as a client error (REST: 400 {@code bad_request}) rather than resolve
      *         anything
-     * @return always {@code true} — the reply resolved a live send, completed a parked ticket, or
-     *         was queued
+     * @return which of the three ways (fleetd #365) the reply actually landed — never {@code null}
      */
-    public boolean reply(String session, String content) {
+    public ReplyOutcome reply(String session, String content) {
         if (content == null || content.isBlank()) {
             throw new IllegalArgumentException("content is required");
         }
         if (rendezvous.resolve(session, content)) {
             count(FleetMetrics.REPLIES, "path", "rendezvous");
-            return true;                       // a live send took it — unchanged fast path
+            return ReplyOutcome.RESOLVED_SEND; // a live send took it — unchanged fast path
         }
         // #137/fleetd #307: no live rendezvous waiter, but this may be the worker's real fleet_reply resuming
         // a turn that either answer() (#137) or ask() (fleetd #307) already gave up waiting on:
@@ -480,7 +526,7 @@ public final class MessageService {
                     asyncTasksByTurn.remove(turnId, orphan);
                 }
                 count(FleetMetrics.REPLIES, "path", "async-recovered");
-                return true;                   // the ticket itself took it — no inbox stranding at all
+                return ReplyOutcome.RESOLVED_ASYNC_TICKET; // the ticket itself took it — no inbox stranding
             }
         } else if (candidates.size() > 1) {
             List<String> tickets = candidates.stream().map(t -> t.ticket).toList();
@@ -498,7 +544,7 @@ public final class MessageService {
         if (pushLoop != null) {
             pushLoop.onReplyQueued(session);
         }
-        return true;                           // held, not lost
+        return ReplyOutcome.QUEUED;             // held, not lost — but not delivered either
     }
 
     /**
@@ -780,9 +826,13 @@ public final class MessageService {
     /**
      * Acknowledge a specific reply by {@code msgId} for {@code target}. Removes it from the inbox
      * so that a subsequent drain or peek no longer returns it.
+     *
+     * @return {@code true} if an entry was actually removed, {@code false} if {@code msgId} was not
+     *     in {@code target}'s inbox (wrong id, wrong target, or already acked). The caller —
+     *     {@link dev.ltms.fleet.mcp.FleetMcp#ack} — must not report success on {@code false}.
      */
-    public void ackReply(String target, String msgId) {
-        inbox.ack(target, msgId);
+    public boolean ackReply(String target, String msgId) {
+        return inbox.ack(target, msgId);
     }
 
     /**
@@ -1271,6 +1321,27 @@ public final class MessageService {
         return new TaskView(ticket, Phase.FAILED, null, null, detail, null);
     }
 
+    /**
+     * Test seam only — carries no production behaviour, and nothing in this class calls it;
+     * {@link #pruneTerminalTickets} still reads {@link Task#completedNanos} directly.
+     *
+     * <p>Reports whether {@code ticket}'s completion hook (the {@code whenComplete} registered in
+     * {@link Task}'s constructor) has actually run yet. Exists because {@link #poll} can report
+     * {@link Phase#DONE} for a ticket before that hook fires: {@code CompletableFuture.complete()}
+     * publishes its result and only afterwards runs dependent actions such as {@code whenComplete}
+     * (fleetd #399), so a caller that observes the future done via {@link #poll} is not thereby
+     * guaranteed to also observe {@link Task#completedNanos} stamped. A test that must order both
+     * events — e.g. before advancing an injected clock past the TTL, to avoid stamping the
+     * *advanced* time and masking a real eviction bug — waits on this instead of on
+     * {@link Phase#DONE}.
+     *
+     * @return {@code false} for an unknown ticket or one whose completion hook has not run yet
+     */
+    boolean isCompletionStampedForTest(String ticket) {
+        Task task = tasks.get(ticket);
+        return task != null && task.completedNanos != null;
+    }
+
     /** Best-effort live worker status for a pending poll; never throws (a lookup error is just noise). */
     private String liveStatus(String target) {
         try {

fleetd/src/main/java/dev/ltms/fleet/msg/ReplyInbox.java

@@ -46,6 +46,13 @@ public interface ReplyInbox {
     /** Non-destructive snapshot of pending replies for {@code target} (FIFO), empty list if none. */
     List<InboxMessage> peek(String target);
 
-    /** Remove the reply {@code msgId} for {@code target} once the primary has taken it. No-op if absent. */
-    void ack(String target, String msgId);
+    /**
+     * Remove the reply {@code msgId} for {@code target} once the primary has taken it.
+     *
+     * @return {@code true} if an entry was actually removed, {@code false} if there was nothing to
+     *     remove (unknown {@code target}, unowned {@code target}, or a {@code msgId} not held for
+     *     it). A {@code false} is not an error — acking a {@code target} this daemon does not own is
+     *     part of the normal contract, not a failure.
+     */
+    boolean ack(String target, String msgId);
 }

fleetd/src/main/java/dev/ltms/fleet/msg/ReplyPushLoop.java

@@ -2,6 +2,7 @@ package dev.ltms.fleet.msg;
 
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.fleet.herdr.HerdrException;
 import dev.ltms.fleet.mcp.PrimaryRegistry;
 import dev.ltms.fleet.metrics.FleetMetrics;
 import dev.ltms.fleet.metrics.Metrics;
@@ -13,6 +14,7 @@ import java.util.Collection;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ScheduledExecutorService;
@@ -130,7 +132,15 @@ public final class ReplyPushLoop {
         this.metrics = metrics;
     }
 
-    /** Count one nudge outcome when a registry is wired; a no-op in unit tests. */
+    /**
+     * Count one nudge outcome when a registry is wired; a no-op in unit tests.
+     *
+     * <p>fleetd #365: the {@code "sent"} outcome (renamed from {@code "delivered"}) records only
+     * that {@code agents.send} — a one-way herdr {@code agent.prompt} paste-and-submit — returned
+     * without throwing. Nothing in this loop, or anywhere downstream of it, confirms the pane
+     * actually read or acted on the text; there is no read-receipt concept at this layer. "Sent"
+     * says exactly that; "delivered" claimed more than this call can ever establish.
+     */
     private void countNudge(String outcome) {
         if (metrics != null) {
             metrics.inc(FleetMetrics.PUSH_NUDGES, "outcome", outcome);
@@ -220,6 +230,26 @@ public final class ReplyPushLoop {
                 .collect(Collectors.toUnmodifiableSet());
     }
 
+    /**
+     * Test seam only (fleetd #418): carries no production behaviour, and nothing in this class
+     * calls it. Exposes {@link #pendingQuestionTurnIdsFor} — the exact state {@link #decide} reads
+     * to decide whether a question keeps a lead's schedule alive.
+     *
+     * <p>{@code MessageService.ask()} does three things in order before a question is fully open to
+     * this loop: it flips the ticket's {@code poll()} phase to {@code Phase.ASKING}, then resolves
+     * the reverse-rendezvous waiter, then calls {@link #onQuestionOpened}, which is what actually
+     * populates {@link #pendingQuestions}. A test that barriers on {@code Phase.ASKING} observes only
+     * the first of those three steps — under load the asker thread can be descheduled between steps
+     * one and three, so the barrier releases before this method's underlying map is populated, and
+     * {@link #decide} correctly reports nothing pending yet. A test that must order itself after the
+     * state {@link #decide} actually reads waits on this instead of on the phase.
+     *
+     * @return an unmodifiable snapshot; empty for a lead with no open questions
+     */
+    Set<String> pendingQuestionTurnIdsForTest(String lead) {
+        return pendingQuestionTurnIdsFor(lead);
+    }
+
     private List<PendingIncident> pendingIncidentsFor(String lead) {
         return pendingIncidents.values().stream().filter(i -> lead.equals(i.key().lead())).toList();
     }
@@ -375,6 +405,80 @@ public final class ReplyPushLoop {
         return Action.WAIT_BUSY;
     }
 
+    /**
+     * Resolve who to nudge about {@code target}, the way every public entry point below wants it:
+     * {@link PrimaryRegistry#nudgeTargetFor}, but only after checking the delegating lead it names
+     * is still actually there (fleetd #368).
+     *
+     * <p><strong>The bug this closes.</strong> {@code PrimaryRegistry.forgetDelegation} is wired to
+     * exactly one event — a worker's release — because that is the only teardown the daemon already
+     * observes for a session in this map. Nothing removes a binding when the LEAD half goes away: a
+     * lead that is closed, crashes, or is relaunched leaves {@code leadByTarget} entries pointing at
+     * a terminal that no longer exists. {@code nudgeTargetFor} falls back to the single known
+     * primary only when the map holds nothing for {@code target} — a stale non-null entry beats the
+     * fallback every time, which is exactly backwards: the fallback's own javadoc argues it is safe
+     * precisely in the case a stale entry now hides.
+     *
+     * <p><strong>The fix.</strong> Before trusting a recorded delegation, probe the lead the same
+     * way {@link #decide} already does every tick ({@code agents.status}) — cheap, since it is a
+     * local herdr round-trip, and it is the same signal {@code AgentControl.paneByTerminal} already
+     * trusts to tell a genuinely dead target from a live one. A lead that fails the probe is treated
+     * as if it had never been recorded: the stale entry is forgotten (self-healing, exactly like
+     * {@code AgentControl.paneByTerminal} already does on {@code agent_not_found}) and resolution is
+     * retried, which now reaches the fallback {@code nudgeTargetFor} was built to reach — the same
+     * empty-map state its javadoc already argues is correct.
+     *
+     * <p><strong>fleetd #368 review — only a positive "gone" reading forgets the binding.</strong>
+     * The first version of this method treated <em>any</em> {@code RuntimeException} from the probe
+     * as death, which is the #359 mistake repeated: a transient socket blip or a codec error on a
+     * perfectly live lead would silently and permanently unbind it, with no re-record ever coming.
+     * That is destructive on one bad reading, exactly what #359 shipped a two-reading guard to avoid
+     * for the analogous lead-tab-liveness question. {@link #isLive} now matches
+     * {@code AgentControl.agentCall}'s own narrower rule (see its {@code agent_not_found} check): only
+     * that specific, affirmative "herdr has no such agent" signal counts as gone. Every other failure
+     * — timeout, transport error, a decode error — is treated as still live and the binding is left
+     * alone, because guessing wrong here is unrecoverable while guessing "live" merely costs one more
+     * retry on the next tick, which {@link #decide} already tolerates.
+     */
+    private Optional<String> resolveLiveLead(String target) {
+        Optional<String> lead = primaryRegistry.nudgeTargetFor(target);
+        if (lead.isEmpty() || isLive(lead.get())) {
+            return lead;
+        }
+        log.debug("push: lead {} delegated to for {} is no longer live, forgetting the stale binding "
+                + "and falling back", lead.get(), target);
+        primaryRegistry.forgetDelegation(target);
+        return primaryRegistry.nudgeTargetFor(target);
+    }
+
+    /**
+     * Whether {@code lead} should still be trusted: {@code false} only when herdr affirmatively
+     * reports the terminal gone ({@code agent_not_found}), never on a merely inconclusive failure.
+     *
+     * <p>fleetd #368 review: an earlier version returned {@code false} for any {@code RuntimeException},
+     * which made a transient herdr hiccup on a live lead indistinguishable from the lead actually
+     * being dead — and the caller's response to {@code false} ({@code forgetDelegation}) is
+     * destructive and permanent. Narrowed to the one code {@code AgentControl.agentCall} itself
+     * already treats as a genuine, resolvable absence (see its {@code agent_not_found} handling) —
+     * every other {@code RuntimeException} is treated as "still live" and the binding survives to be
+     * probed again next time, which costs nothing worse than one more retry.
+     */
+    private boolean isLive(String lead) {
+        try {
+            agents.status(lead);
+            return true;
+        } catch (RuntimeException e) {
+            boolean gone = e instanceof HerdrException he && "agent_not_found".equals(he.code());
+            if (gone) {
+                log.debug("push: lead {} no longer exists ({})", lead, e.toString());
+            } else {
+                log.debug("push: liveness check for lead {} was inconclusive ({}); treating as live "
+                        + "rather than risk destroying a live binding", lead, e.toString());
+            }
+            return !gone;
+        }
+    }
+
     // --- public entrypoints ----------------------------------------------------------------------
 
     /**
@@ -385,7 +489,7 @@ public final class ReplyPushLoop {
      * backstop until a lead is recorded.
      */
     public void onReplyQueued(String target) {
-        var lead = primaryRegistry.nudgeTargetFor(target);
+        var lead = resolveLiveLead(target);
         if (lead.isEmpty()) {
             log.debug("push: no lead is known to be waiting on {}, skipping reminder", target);
             return;
@@ -413,7 +517,7 @@ public final class ReplyPushLoop {
      * @param failed whether the ticket ended in a failure phase rather than {@code DONE}
      */
     public void onTicketTerminal(String ticket, String target, boolean failed) {
-        var lead = primaryRegistry.nudgeTargetFor(target);
+        var lead = resolveLiveLead(target);
         if (lead.isEmpty()) {
             log.debug("push: no lead is known to be waiting on ticket {} (target {}), skipping nudge",
                     ticket, target);
@@ -448,7 +552,7 @@ public final class ReplyPushLoop {
      * @param question the question text
      */
     public void onQuestionOpened(String ticket, String target, String turnId, String question) {
-        var lead = primaryRegistry.nudgeTargetFor(target);
+        var lead = resolveLiveLead(target);
         if (lead.isEmpty()) {
             log.debug("push: no lead is known to be waiting on {}'s question (turnId {}), skipping nudge",
                     target, turnId);
@@ -476,7 +580,7 @@ public final class ReplyPushLoop {
                                   Collection<String> profiles, int remainingCoolOffSeconds) {
         Map<String, List<String>> targetsByLead = new ConcurrentHashMap<>();
         for (String target : targets) {
-            var lead = primaryRegistry.nudgeTargetFor(target);
+            var lead = resolveLiveLead(target);
             if (lead.isEmpty()) {
                 log.warn("push: backend incident {} has no known lead for target {}", incidentId, target);
                 continue;
@@ -498,7 +602,7 @@ public final class ReplyPushLoop {
      * Without an owning lead, emit a warning because no control can act on the target.
      */
     public void onBackendTargetUnmapped(String target, String reason) {
-        var lead = primaryRegistry.nudgeTargetFor(target);
+        var lead = resolveLiveLead(target);
         if (lead.isEmpty()) {
             log.warn("push: backend target {} could not map to a credential: {}", target, reason);
             return;
@@ -654,7 +758,7 @@ public final class ReplyPushLoop {
                     lead, replyReminderCount + 1, maxReminders, ticketReminderCount + 1, maxReminders,
                     questionReminderCount + 1, maxReminders,
                     replyTargets.size(), tickets.size(), questions.size());
-            countNudge("delivered");
+            countNudge("sent");
             for (PendingIncident incident : incidents) {
                 if (pendingIncidents.remove(incident.key(), incident)) {
                     deliveredIncidents.add(incident.key());

fleetd/src/main/java/dev/ltms/fleet/peer/PeerLauncher.java

@@ -1,5 +1,7 @@
 package dev.ltms.fleet.peer;
 
+import dev.ltms.fleet.placement.PlacementDecision;
+
 import java.nio.file.Path;
 import java.util.List;
 import java.util.Set;
@@ -143,9 +145,160 @@ public interface PeerLauncher {
 
     /**
      * The profile a no-argument {@link #spawn(SpawnRequest)} uses, or {@code null} if none is configured.
+     *
+     * <p>fleetd #425: for an implementation with role pools (a no-argument spawn is read as {@link
+     * MemberRole#DEV}, see {@link SpawnRequest}), this must be the profile a live spawn of that role
+     * would actually be placed on right now, not a value captured once at startup — a caller such as
+     * {@code fleet_profiles} relies on this to report a live, not frozen, fact.
      */
     String defaultProfile();
 
+    /**
+     * The profile an unqualified spawn of {@code role} would resolve to right now — the role-aware,
+     * live counterpart of {@link #defaultProfile()} (fleetd #425).
+     *
+     * <p>A caller that must provision something profile-specific (working directory, parity overlay
+     * files) <em>before</em> the actual spawn — {@code SessionManager.acquireWithWorktree} is the one
+     * that exists today — needs the exact profile that spawn will use, for the caller's real role,
+     * not a role-agnostic guess. Calling {@link #defaultProfile()} for that purpose reads {@code
+     * MemberRole#DEV}'s answer regardless of the caller's actual role, which is wrong for any other
+     * role and can provision for a profile the spawn never lands on.
+     *
+     * <p>Default implementation returns {@link #defaultProfile()}, ignoring {@code role} — the right
+     * answer for a launcher with no role-pool concept of its own (e.g. a single {@code
+     * HerdrPeerLauncher} adapter, which is never reached this way in production: {@code
+     * CompositePeerLauncher} always fronts it and resolves roles itself).
+     *
+     * <p>fleetd #453: this default is deliberately <em>not</em> abstract — unlike {@link
+     * #spawn(SpawnRequest, PlacementDecision)} (fleetd #450), there is no live defect in inheriting
+     * it today, and the only current single-adapter implementer ({@code HerdrPeerLauncher}) is
+     * correct to do so. But it stays correct only as long as that holds: <strong>if a launcher ever
+     * routes more than one profile per role, it MUST override this method</strong>, or every role
+     * silently resolves to {@link #defaultProfile()} with no error and no log line. {@code
+     * HerdrPeerLauncher.spawn(SpawnRequest, PlacementDecision)} — the override in {@code
+     * dev.ltms.fleet.member}, not the declaration below — names this method and {@link #place}
+     * explicitly as "unoverridden here" for exactly this reason. Read it before adding role-pool
+     * routing to any {@code HerdrPeerLauncher} subclass.
+     *
+     * <p>Who is forced to read which paragraph, because it is not symmetric. A new class that
+     * implements this interface directly must write a body for {@link #spawn(SpawnRequest,
+     * PlacementDecision)}, which is abstract here, so it lands on this javadoc. A subclass of
+     * {@code HerdrPeerLauncher} does not: that class already implements the method, and the
+     * subclass inherits the body. So for a subclass this paragraph is advice, not a gate.
+     */
+    default String defaultProfileFor(MemberRole role) {
+        return defaultProfile();
+    }
+
+    /**
+     * The profile an <em>unqualified</em> spawn of {@code role} would actually be routed to right
+     * now — the same candidate list, the same {@code quarantined}/{@code coolingOff}/{@code
+     * modelOff} filtering, and the same {@code PlacementPolicy} that {@link #spawn} itself
+     * consults for a blank-profile request (fleetd #425 rework).
+     *
+     * <p>This is <em>not</em> {@link #defaultProfileFor}: that method answers "what is first in
+     * {@code role}'s pool", blind to quarantine, cool-off, and the model on/off gate — the right
+     * answer for a role-agnostic, best-effort report ({@code fleet_profiles}' {@code "default"}
+     * field), but the wrong one for a caller that needs the profile a spawn will actually land on.
+     * A quarantined or model-off pool-first profile makes {@link #defaultProfileFor} return a name
+     * an unqualified spawn will never be routed to.
+     *
+     * <p>Just the resolved name, not the full {@link PlacementDecision} — a caller that only wants
+     * to know the answer (a status report, a log line) can call this; a caller that will later
+     * <em>act</em> on the answer by spawning — provisioning a worktree for a specific profile
+     * before the peer exists is the one that matters — must call {@link #place} and carry the
+     * {@link PlacementDecision} itself through to {@link #spawn(SpawnRequest, PlacementDecision)}
+     * instead of calling this method and feeding the string back in as an explicit profile. Doing
+     * that re-enters {@link #spawn(SpawnRequest)}'s explicit-profile branch, which disagrees with
+     * the routing branch on purpose about what an excluded profile means: the routing branch (and
+     * {@link #place}) falls through a quarantined/cooling-off/at-cap/model-off/unreachable/weight-0
+     * profile to the next candidate, while the explicit branch refuses outright — correct for an
+     * operator who named that profile on purpose, wrong for a name that only ever came from placement
+     * itself. That accidental refusal is exactly the regression fleetd #425 rework round 2 fixes:
+     * the default implementation below delegates to {@link #place}, so the two can never drift apart,
+     * but a caller that resolves through this method alone and spawns separately can still recreate
+     * the round-1 defect for itself. (Before fleetd #435, this accident was also reachable through
+     * {@code maxLoad} specifically, because {@code FixedPlacementPolicy} — the default policy — did
+     * not evaluate it at all for automatic selection; #435 closed that gap, so a placement decision
+     * can no longer be at cap in the first place. The refusal-vs-fall-through disagreement above is
+     * the part that was never about {@code maxLoad} and is still real.)
+     *
+     * @throws RuntimeException (implementation-specific, typically a placement exception) if no
+     *                          candidate in {@code role}'s pool is currently placeable
+     */
+    default String routedProfileFor(MemberRole role) {
+        return place(role).profile();
+    }
+
+    /**
+     * Resolve, <em>without spawning</em>, the {@link PlacementDecision} an unqualified spawn of
+     * {@code role} would make right now — the same candidate list, the same {@code
+     * quarantined}/{@code coolingOff}/{@code modelOff} filtering, and the same {@code
+     * PlacementPolicy} {@link #spawn(SpawnRequest)}'s blank-profile branch itself consults (fleetd
+     * #425 rework).
+     *
+     * <p>Pair this with {@link #spawn(SpawnRequest, PlacementDecision)}, never with {@link
+     * #spawn(SpawnRequest)} fed the decision's profile as an explicit name — see {@link
+     * PlacementDecision}'s own javadoc for why that second form regressed.
+     *
+     * <p>Default implementation wraps {@link #defaultProfile()}, ignoring {@code role} and every
+     * placement condition — the right answer for a launcher with no pool or placement-policy
+     * concept of its own, matching {@link #defaultProfileFor}'s own default.
+     *
+     * <p>fleetd #453: same reasoning as {@link #defaultProfileFor}'s own #453 note — this default
+     * is deliberately not abstract (no live defect today, correct for the sole single-adapter
+     * implementer), but <strong>a launcher that ever routes more than one profile per role MUST
+     * override this method too</strong>, or placement silently ignores {@code role} for it. See
+     * {@code HerdrPeerLauncher.spawn(SpawnRequest, PlacementDecision)}'s javadoc, which names this
+     * method as "unoverridden here" and why that is correct only for a single-profile adapter.
+     *
+     * @throws RuntimeException (implementation-specific, typically a placement exception) if no
+     *                          candidate in {@code role}'s pool is currently placeable
+     */
+    default PlacementDecision place(MemberRole role) {
+        return new PlacementDecision(defaultProfile());
+    }
+
+    /**
+     * Spawn against an already-resolved {@link PlacementDecision} from {@link #place}, honoring it
+     * completely: none of the conditions {@link #place} already applied — quarantine, cooling off,
+     * {@code maxLoad} (evaluated by every placement policy including the default {@code fixed},
+     * since fleetd #435), model-off — are re-evaluated here; {@code decision} already reflects them.
+     * This is not skipping a check {@code place} left undone; it is not repeating one {@code place}
+     * already did, and not re-opening the window between that decision and this spawn in which the
+     * underlying state could otherwise move. This is what lets a resolve-then-spawn caller
+     * ({@code SessionManager.acquireWithWorktree}, which must know the profile before it can
+     * provision a worktree for it) and a plain blank-profile {@link #spawn(SpawnRequest)} caller
+     * land on the exact same outcome for the exact same placement state (fleetd #425 rework,
+     * round 2).
+     *
+     * <p>{@code req}'s own {@link SpawnRequest#profileName()} is ignored in favor of {@code
+     * decision.profile()} — the caller is expected to have built {@code req} with a blank or
+     * matching profile; passing a request that names a <em>different</em>, explicit profile than
+     * the decision it is paired with is a caller bug this method does not attempt to detect.
+     *
+     * <p>No default implementation (fleetd #450): the two correct bodies disagree on purpose, so an
+     * implementer must choose one rather than silently inherit whichever this interface happened to
+     * provide. An implementer with no placement concept of its own — spawns a single profile, e.g.
+     * {@code HerdrPeerLauncher} — should delegate to {@link #spawn(SpawnRequest)} with the decision's
+     * profile named explicitly, since there is no separate routing path to honor there: the
+     * explicit-profile branch it re-enters and the routing branch {@link #place} would have used are
+     * the same thing. <strong>A launcher that routes across more than one profile — the way {@code
+     * CompositePeerLauncher} routes across every configured adapter — MUST NOT re-enter {@link
+     * #spawn(SpawnRequest)}.</strong> Doing so re-applies that single-argument method's
+     * explicit-profile checks ({@code enforceNotQuarantined}, {@code enforceNotCoolingOff}, {@code
+     * enforceMaxLoad}, {@code enforceModelEnabled} in {@code CompositePeerLauncher}), which can
+     * refuse the very profile {@link #place} just chose, if the underlying placement state moved in
+     * the window between the {@link #place} call and this one — the exact window this method and
+     * {@link PlacementDecision} exist to close (fleetd #444). Before #450 this was a {@code default}
+     * method that only {@code CompositePeerLauncher} overrode; a future placement-doing launcher
+     * could have inherited the re-entering body silently and never known. Making it abstract turns
+     * that silent inheritance into a compile error.
+     *
+     * @throws IllegalArgumentException if the decision names an unknown profile
+     */
+    PeerHandle spawn(SpawnRequest req, PlacementDecision decision);
+
     /**
      * Resolve the effective working directory for a spawn {@code req} without actually spawning.
      * Resolution order: requestedCwd → profile cwd → callerCwd → daemon cwd.
@@ -192,4 +345,66 @@ public interface PeerLauncher {
      * @return {@code true} when a reset was sent and its status transition must settle before reuse
      */
     boolean clearContext(String id);
+
+    /**
+     * Model ids the operator has currently turned off in the central {@code models.allow:} list
+     * (fleetd #422) — empty for a launcher with nothing to gate against. {@code fleet_profiles}/
+     * {@code GET /profiles} (via {@code FleetMcp.profilesView}) call this to report which models
+     * are off, and MUST read this exact accessor rather than deriving their own answer: the fleetd
+     * #404 lesson is that a status field reading a different source than the behaviour it describes
+     * can drift from what the gate ({@code CompositePeerLauncher.enforceModelEnabled} and its
+     * candidate filter) actually enforces. A default of {@code Set.of()} keeps every other {@link
+     * PeerLauncher} implementer (the herdr adapters, and the two test-fake implementers) unchanged.
+     *
+     * <p>fleetd #422 follow-up: this alone cannot tell "no {@code models:} block at all" from "a
+     * {@code models:} block where nothing is currently off" — both report an empty set here. Delegates
+     * to {@link #modelGateState()} so the two facts always come from the one read {@link
+     * #modelGateState()}'s implementer makes; do not override this method separately from that one.
+     */
+    default Set<String> disabledModels() {
+        return modelGateState().off();
+    }
+
+    /**
+     * Whether the central {@code models.allow:} gate (fleetd #422) is armed at all, together with
+     * which model ids are currently off — fleetd #422 follow-up. {@link #disabledModels()} alone
+     * cannot distinguish two states that both report an empty set: a host with no {@code models:}
+     * block (nothing is gated, and nothing can be) and a host WITH a {@code models:} block where
+     * nothing is currently turned off (the gate is armed and reporting zero). This method exists so
+     * a caller — the startup log, {@code fleet_profiles}/{@code GET /profiles} — can tell the two
+     * apart, the same reason {@code CompletionResolver.UnsetMeaning} exists: an accessor that can
+     * legitimately report "empty" must never let a caller guess why.
+     *
+     * <p>Default {@link ModelGateState#notConfigured()} — every launcher without a {@code models:}
+     * block to read from (the herdr adapters, and the two test-fake implementers), matching {@link
+     * #disabledModels()}'s own default of an empty set.
+     */
+    default ModelGateState modelGateState() {
+        return ModelGateState.notConfigured();
+    }
+
+    /**
+     * fleetd #422 follow-up: the result of {@link #modelGateState()} — see that method's javadoc
+     * for why "armed" and "off" must be reported together from one read rather than as two
+     * separately-derived facts that a reload landing between them could make disagree.
+     *
+     * @param configured {@code true} when a {@code models:} block exists at all (armed), regardless
+     *                   of whether anything in it is currently turned off; {@code false} when there
+     *                   is no block to gate against
+     * @param off        the model ids currently turned off; always empty when {@code configured} is
+     *                   {@code false}
+     */
+    record ModelGateState(boolean configured, Set<String> off) {
+        public ModelGateState {
+            off = Set.copyOf(off);
+        }
+
+        public static ModelGateState notConfigured() {
+            return new ModelGateState(false, Set.of());
+        }
+
+        public static ModelGateState armed(Set<String> off) {
+            return new ModelGateState(true, off);
+        }
+    }
 }

fleetd/src/main/java/dev/ltms/fleet/peer/SpawnRequest.java

@@ -29,4 +29,9 @@ public record SpawnRequest(String profileName, String requestedCwd, String calle
                         String sessionName, String resumeSessionId) {
         this(profileName, requestedCwd, callerCwd, sessionName, resumeSessionId, null);
     }
+
+    /** Return a copy of this request with {@code profileName} replaced by {@code profile}. */
+    public SpawnRequest withProfile(String profile) {
+        return new SpawnRequest(profile, requestedCwd, callerCwd, sessionName, resumeSessionId, role);
+    }
 }

fleetd/src/main/java/dev/ltms/fleet/placement/BackendQuarantine.java

@@ -3,6 +3,7 @@ package dev.ltms.fleet.placement;
 import java.util.LinkedHashMap;
 import java.util.Map;
 import java.util.Objects;
+import java.util.Optional;
 import java.util.OptionalLong;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.function.LongSupplier;
@@ -21,46 +22,158 @@ import java.util.function.LongSupplier;
  * <p>The clock is injected ({@link LongSupplier}, conventionally {@code System::nanoTime} like
  * {@code FleetHealthMonitor}), never read inline, so a quarantine's expiry is testable without a
  * real sleep.
+ *
+ * <h2>Escalation (fleetd #466)</h2>
+ * A flat cooldown does not fit every exhaustion. A backend that reports "out of capacity for the
+ * rest of the hour" recovers in one cooldown; a weekly subscription limit does not — it keeps
+ * reporting exhausted on every attempt made before the window resets, so a flat 30-minute cooldown
+ * (the default {@code cooldownNanos}) means roughly 336 pointless spawn attempts across a week, one
+ * every cooldown.
+ *
+ * <p><strong>This class only ever sees the exhaustion signal.</strong> Its only production caller is
+ * {@code Fleetd.exhaustionSink}, wired to fire on a {@code BACKEND_EXHAUSTED} classification alone.
+ * The daemon's other outage state — a credential "cooling off" after repeated non-exhaustion
+ * backend errors (an HTTP 5xx storm, say) — is a separate mechanism, {@code BackendOutagePolicy},
+ * with its own short fixed 60s cooldown and no repeat tracking. The two are never merged: escalating
+ * on a cooling-off signal would turn a transient 5xx storm into a multi-hour backoff, which is
+ * exactly the failure this ticket is not asking for. Confirmed by reading every call site of
+ * {@link #quarantine} — {@code BackendOutagePolicy} has its own {@code coolOff} method and never
+ * calls this one.
+ *
+ * <p><strong>Mechanism</strong> — the {@link #withEscalation} constructors track, per credential, how
+ * many times in a row {@link #quarantine} has been called without an intervening "quiet" gap.
+ * Each call computes {@code cooldownNanos * backoffMultiplier ^ (repeatCount - 1)}, capped at
+ * {@code maxCooldownNanos}. A call counts as a continuation of the same streak — {@code repeatCount}
+ * increments — when it arrives no more than one base {@code cooldownNanos} after the previous
+ * quarantine's deadline (this covers both "still quarantined" and "quarantine just expired and it
+ * was exhausted again immediately"); otherwise the streak resets and this call is treated as a fresh
+ * first occurrence at the base cooldown.
+ *
+ * <p><strong>Reset, honestly stated.</strong> The ideal reset signal is "the cooldown expired and the
+ * next attempt succeeded" — but nothing in this codebase reports a spawn success back to this class
+ * (checked: {@code SessionManager} and {@code CompositePeerLauncher} never call any method here
+ * except {@link #quarantine}/{@link #isQuarantined}/{@link #remainingSeconds}, none of which is a
+ * success hook). Lacking that signal, the reset used here is a time-based proxy: a base-cooldown's
+ * worth of quiet — no exhaustion report for that credential — since the last quarantine ended. It is
+ * not proof the credential started working again, only the best available evidence without adding an
+ * active probe, which is out of scope by the operator's own design constraint (no automatic probing
+ * of a limited backend).
+ *
+ * <p><strong>Ceiling.</strong> {@code maxCooldownNanos} bounds the growth — an unbounded backoff is a
+ * permanent, unrecoverable-without-a-restart outage, which would be worse than the flat-rate bug this
+ * escalation fixes. {@link #withEscalation(LongSupplier, long)} defaults the ceiling to
+ * {@value #DEFAULT_MAX_COOLDOWN_MULTIPLE}x the base cooldown (12x the 1800s default ≈ 6 hours), so a
+ * chronically exhausted credential still gets re-tried roughly every 6 hours instead of every 30
+ * minutes — about a dozen attempts a week instead of ~336.
+ *
+ * <p><strong>Backward compatibility.</strong> The original two-argument {@link #BackendQuarantine(
+ * LongSupplier, long)} constructor is unchanged in behaviour: it is exactly {@code
+ * withEscalation}'s mechanism with {@code backoffMultiplier = 1.0} and {@code maxCooldownNanos =
+ * cooldownNanos}, which collapses the formula back to the original flat {@code now + cooldownNanos}
+ * on every call regardless of history. Every existing call site (roughly 20 across the test suite,
+ * plus {@link #none()}) keeps its current shape and behaviour unchanged.
  */
 public final class BackendQuarantine {
 
-    private final ConcurrentHashMap<String, Long> quarantinedUntilNanos = new ConcurrentHashMap<>();
+    /** Default growth per consecutive exhaustion streak — see the class doc's Mechanism section. */
+    static final double DEFAULT_BACKOFF_MULTIPLIER = 2.0;
+    /** Default ceiling, expressed as a multiple of the base cooldown — see the class doc's Ceiling section. */
+    static final long DEFAULT_MAX_COOLDOWN_MULTIPLE = 12;
+
+    private final ConcurrentHashMap<String, QuarantineState> quarantines = new ConcurrentHashMap<>();
     private final LongSupplier nowNanos;
     private final long cooldownNanos;
+    private final double backoffMultiplier;
+    private final long maxCooldownNanos;
     /** True only for {@link #none()}. See {@link #quarantine} for why this exists. */
     private final boolean inert;
 
+    /** How many consecutive exhaustion reports a credential is on, and when the resulting cooldown ends. */
+    private record QuarantineState(int repeatCount, long deadlineNanos) {
+    }
+
     /**
+     * Flat cooldown, unchanged from before fleetd #466 — every {@link #quarantine} call blocks the
+     * credential for exactly {@code cooldownNanos}, regardless of how many times it was called
+     * before. Equivalent to {@link #withEscalation} with no growth ({@code backoffMultiplier = 1.0})
+     * and a ceiling equal to the base cooldown, so it degrades to the identical {@code now +
+     * cooldownNanos} formula every call. Kept for the existing call sites that want a fixed cooldown
+     * (and for tests exercising the fixed-cooldown shape in isolation); production wiring uses
+     * {@link #withEscalation} instead.
+     *
      * @param nowNanos      monotonic clock, injected for testability
      * @param cooldownNanos how long a fresh {@link #quarantine} call blocks the credential for;
      *                      must be positive
      */
     public BackendQuarantine(LongSupplier nowNanos, long cooldownNanos) {
-        this(nowNanos, cooldownNanos, false);
+        this(nowNanos, cooldownNanos, 1.0, cooldownNanos, false);
     }
 
-    private BackendQuarantine(LongSupplier nowNanos, long cooldownNanos, boolean inert) {
+    /**
+     * Escalating cooldown (fleetd #466) — see the class doc's Mechanism/Reset/Ceiling sections.
+     *
+     * @param nowNanos          monotonic clock, injected for testability
+     * @param cooldownNanos     base cooldown, applied to a fresh (non-streak) exhaustion; must be
+     *                          positive
+     * @param backoffMultiplier growth per consecutive exhaustion; must be {@code >= 1.0} ({@code 1.0}
+     *                          disables growth and is exactly the flat two-argument constructor)
+     * @param maxCooldownNanos  ceiling on the escalated cooldown; must be {@code >= cooldownNanos}
+     */
+    public BackendQuarantine(LongSupplier nowNanos, long cooldownNanos, double backoffMultiplier,
+            long maxCooldownNanos) {
+        this(nowNanos, cooldownNanos, backoffMultiplier, maxCooldownNanos, false);
+    }
+
+    private BackendQuarantine(LongSupplier nowNanos, long cooldownNanos, double backoffMultiplier,
+            long maxCooldownNanos, boolean inert) {
         this.nowNanos = Objects.requireNonNull(nowNanos, "nowNanos");
         if (cooldownNanos <= 0) {
             throw new IllegalArgumentException("cooldownNanos must be positive: " + cooldownNanos);
         }
+        if (backoffMultiplier < 1.0) {
+            throw new IllegalArgumentException("backoffMultiplier must be >= 1.0: " + backoffMultiplier);
+        }
+        if (maxCooldownNanos < cooldownNanos) {
+            throw new IllegalArgumentException(
+                    "maxCooldownNanos must be >= cooldownNanos: " + maxCooldownNanos + " < " + cooldownNanos);
+        }
         this.cooldownNanos = cooldownNanos;
+        this.backoffMultiplier = backoffMultiplier;
+        this.maxCooldownNanos = maxCooldownNanos;
         this.inert = inert;
     }
 
+    /**
+     * Escalating cooldown with the fleetd #466 default shape: cooldown doubles
+     * ({@value #DEFAULT_BACKOFF_MULTIPLIER}x) per consecutive exhaustion streak, capped at
+     * {@value #DEFAULT_MAX_COOLDOWN_MULTIPLE}x the base cooldown. This is what production wiring
+     * ({@code Fleetd.main}) uses.
+     *
+     * @param nowNanos      monotonic clock, injected for testability
+     * @param cooldownNanos base cooldown, applied to a fresh (non-streak) exhaustion; must be positive
+     */
+    public static BackendQuarantine withEscalation(LongSupplier nowNanos, long cooldownNanos) {
+        return new BackendQuarantine(nowNanos, cooldownNanos, DEFAULT_BACKOFF_MULTIPLIER,
+                cooldownNanos * DEFAULT_MAX_COOLDOWN_MULTIPLE, false);
+    }
+
     /**
      * Inert quarantine — {@link #quarantine} does nothing on this instance, so nothing is ever
      * quarantined. The explicit stand-in a caller (or a test not exercising this feature) passes
      * instead of a defaulting overload, exactly like {@code ExhaustedPatternLookup.none()}.
      */
     public static BackendQuarantine none() {
-        return new BackendQuarantine(() -> 0L, 1, true);
+        return new BackendQuarantine(() -> 0L, 1, 1.0, 1, true);
     }
 
     /**
-     * Quarantine {@code credentialId} for the configured cooldown, starting now. A repeat call while
-     * already quarantined restarts the cooldown at full length — a fresh refusal is fresh evidence the
-     * account is still exhausted, not a reason to let an earlier, shorter wait stand.
+     * Quarantine {@code credentialId} starting now. On a flat instance (the two-argument
+     * constructor) this always blocks for exactly {@code cooldownNanos}, restarting the cooldown at
+     * full length on every call — a fresh refusal is fresh evidence the account is still exhausted,
+     * not a reason to let an earlier, shorter wait stand. On an escalating instance ({@link
+     * #withEscalation}) the cooldown grows with each call that arrives within one base cooldown of
+     * the previous deadline, and resets to the base cooldown once a call arrives after a longer gap
+     * — see the class doc.
      *
      * <p>On {@link #none()} this is a no-op. It has to be: that instance holds a clock frozen at 0,
      * so recording a deadline would produce a quarantine that never expires — a credential locked out
@@ -73,7 +186,13 @@ public final class BackendQuarantine {
         if (inert) {
             return;
         }
-        quarantinedUntilNanos.put(credentialId, nowNanos.getAsLong() + cooldownNanos);
+        long now = nowNanos.getAsLong();
+        quarantines.compute(credentialId, (id, prev) -> {
+            int repeatCount = (prev == null || now - prev.deadlineNanos() > cooldownNanos)
+                    ? 1
+                    : prev.repeatCount() + 1;
+            return new QuarantineState(repeatCount, now + escalatedCooldownNanos(repeatCount));
+        });
     }
 
     /** Whether {@code credentialId} is quarantined right now. */
@@ -87,6 +206,49 @@ public final class BackendQuarantine {
         return remaining > 0 ? OptionalLong.of(toSecondsRoundedUp(remaining)) : OptionalLong.empty();
     }
 
+    /**
+     * Remaining seconds together with which consecutive exhaustion this is (fleetd #466 scope item
+     * 2) — {@code repeatCount} 1 for a first occurrence, 2 for the second in a row, and so on; see
+     * {@link #quarantine}'s class-doc Mechanism section for exactly when a call continues a streak
+     * versus starts a fresh one.
+     *
+     * <p><strong>Read together, off the one {@link QuarantineState} entry {@link #quarantine} itself
+     * wrote</strong> — a single {@code quarantines.get(credentialId)}, never a separate lookup or a
+     * value re-derived from {@code remainingSeconds} (e.g. inverting {@link
+     * #escalatedCooldownNanos}). That inversion is not just extra work to avoid: once a streak has
+     * hit {@code maxCooldownNanos}, every further consecutive exhaustion reports the identical
+     * cooldown, so a derivation that starts from the cooldown value cannot tell the 4th repeat from
+     * the 9th — only the stored {@code repeatCount} can. This is the same rule {@code
+     * CompositePeerLauncher.modelGateState()} documents for its own gate/report pair: the report
+     * reads the exact accessor the behaviour reads, so it can never disagree with what actually
+     * happened (the fleetd #404/#422 lesson). {@code fleet_profiles}/{@code fleet_list}/{@code GET
+     * /profiles} all call this — never {@link #remainingSeconds} plus a second, independent count —
+     * for exactly that reason.
+     *
+     * @return empty when {@code credentialId} is not currently quarantined (including on {@link
+     *         #none()}, which quarantines nothing)
+     */
+    public Optional<Status> status(String credentialId) {
+        QuarantineState state = quarantines.get(credentialId);
+        if (state == null) {
+            return Optional.empty();
+        }
+        long remaining = state.deadlineNanos() - nowNanos.getAsLong();
+        return remaining > 0
+                ? Optional.of(new Status(toSecondsRoundedUp(remaining), state.repeatCount()))
+                : Optional.empty();
+    }
+
+    /**
+     * @param remainingSeconds seconds left on the quarantine, identical to {@link
+     *                          #remainingSeconds(String)}'s answer for the same credential at the
+     *                          same instant
+     * @param repeatCount       1 for a first occurrence, 2 for the second consecutive one, etc. —
+     *                          see {@link #status(String)}
+     */
+    public record Status(long remainingSeconds, int repeatCount) {
+    }
+
     /**
      * Every currently-quarantined credential id and its remaining seconds (CB-578 stage B fleet
      * reporting) — expired entries are never included. Not pruned from the backing map here: it stays
@@ -95,8 +257,8 @@ public final class BackendQuarantine {
      */
     public Map<String, Long> activeRemainingSeconds() {
         Map<String, Long> out = new LinkedHashMap<>();
-        quarantinedUntilNanos.forEach((credentialId, deadline) -> {
-            long remaining = deadline - nowNanos.getAsLong();
+        quarantines.forEach((credentialId, state) -> {
+            long remaining = state.deadlineNanos() - nowNanos.getAsLong();
             if (remaining > 0) {
                 out.put(credentialId, toSecondsRoundedUp(remaining));
             }
@@ -105,8 +267,14 @@ public final class BackendQuarantine {
     }
 
     private long remainingNanos(String credentialId) {
-        Long deadline = quarantinedUntilNanos.get(credentialId);
-        return deadline == null ? 0L : deadline - nowNanos.getAsLong();
+        QuarantineState state = quarantines.get(credentialId);
+        return state == null ? 0L : state.deadlineNanos() - nowNanos.getAsLong();
+    }
+
+    /** {@code cooldownNanos * backoffMultiplier ^ (repeatCount - 1)}, capped at {@code maxCooldownNanos}. */
+    private long escalatedCooldownNanos(int repeatCount) {
+        double raw = cooldownNanos * Math.pow(backoffMultiplier, repeatCount - 1);
+        return raw >= (double) maxCooldownNanos ? maxCooldownNanos : (long) raw;
     }
 
     private static long toSecondsRoundedUp(long nanos) {

fleetd/src/main/java/dev/ltms/fleet/placement/FixedPlacementPolicy.java

@@ -5,14 +5,12 @@ import java.util.List;
 
 /**
  * Backward-compatible placement: an unqualified spawn always resolves to the configured default
- * profile, exactly as {@code CompositePeerLauncher} did before CB-518. This ignores caps
- * ({@code maxLoad}) so that a pre-existing config behaves identically after upgrade — capacity
- * gating for automatic placement is deliberately out of scope for {@code fixed}, exactly as it
- * always has been. Reachability is a narrower exception (fleetd #315, below): a profile is never
- * checked for reachability up front, only skipped once it has already failed in <em>this same</em>
- * spawn call's retry loop — see the unreachable case below.
+ * profile, exactly as {@code CompositePeerLauncher} did before CB-518. Reachability is a narrower
+ * exception (fleetd #315, below): a profile is never checked for reachability up front, only
+ * skipped once it has already failed in <em>this same</em> spawn call's retry loop — see the
+ * unreachable case below.
  *
- * <p>Four exceptions walk past the default instead of returning it unconditionally:
+ * <p>Six exceptions walk past the default instead of returning it unconditionally:
  * <ul>
  *   <li>Quarantine (CB-578 stage B): a quarantined default is a credential that just refused on
  *       a usage limit, not a transient capacity or reachability concern.
@@ -20,6 +18,24 @@ import java.util.List;
  *       ({@code BackendOutagePolicy}) — a separate, shorter-lived source from quarantine. When a
  *       profile is both quarantined and cooling off, only the quarantine reason is reported
  *       (exhaustion takes priority), matching {@code CompositePeerLauncher}'s explicit-spawn order.
+ *   <li>At cap (fleetd #435): a profile whose live count has reached its {@code maxLoad}
+ *       ({@link PlacementPolicyUtil#atCap}) — a documented, unconditional capacity limit (see
+ *       {@code FleetConfig.Profile#maxLoad}), so {@code fixed} must gate on it exactly as {@code
+ *       weighted}/{@code round-robin} already do via {@link PlacementPolicyUtil#available}. Before
+ *       this fix {@code fixed} built its own {@link PlacementCandidate} for the default with {@code
+ *       maxLoad} forced to {@code null}, so a capped default was chosen anyway on every unqualified
+ *       spawn — the cap was advisory, not enforced, for the one placement policy every config uses
+ *       by default. Reported only when quarantine and cooling off are both absent, matching {@code
+ *       CompositePeerLauncher}'s explicit-spawn check order (quarantine, then cooling off, then max
+ *       load, then model-off).
+ *   <li>Model off (fleetd #422): a profile whose {@code model:} the operator has turned off in
+ *       {@code models.allow:} — an operator decision, never a backend-reported outage, so it is a
+ *       fifth, independent source from quarantine, cooling off, and at-cap (never merged with any
+ *       of them), exactly as {@code CompositePeerLauncher.enforceModelEnabled} and {@link
+ *       PlacementPolicyUtil#available} treat it. When a profile is model-off <em>and</em> quarantined,
+ *       cooling off, or at cap, only the higher-priority reason is reported, matching {@code
+ *       CompositePeerLauncher}'s explicit-spawn check order (quarantine, then cooling off, then max
+ *       load, then model-off).
  *   <li>Unreachable (fleetd #315): {@code CompositePeerLauncher.spawn} retries a failed candidate
  *       on the next one and rebuilds the {@link PlacementContext} so {@code ctx.unreachable()}
  *       names every profile that already failed with {@code PeerUnreachableException} in this same
@@ -32,9 +48,10 @@ import java.util.List;
  *       {@code weighted}/{@code round-robin} skip it — an explicit {@code fleet_spawn} naming
  *       the profile is unaffected, only this automatic fallback walk.
  * </ul>
- * A fleet where nothing is ever quarantined, cooling off, unreachable, or weight-0 never exercises
- * any of these paths, so today's behaviour is unchanged — in particular, the very first selection
- * of a spawn call always sees an empty {@code unreachable} set, so the first choice is untouched.
+ * A fleet where nothing is ever quarantined, cooling off, at cap, model-off, unreachable, or
+ * weight-0 never exercises any of these paths, so today's behaviour is unchanged — in particular,
+ * the very first selection of a spawn call always sees an empty {@code unreachable} set, so the
+ * first choice is untouched.
  */
 final class FixedPlacementPolicy implements PlacementPolicy {
 
@@ -42,12 +59,14 @@ final class FixedPlacementPolicy implements PlacementPolicy {
     public PlacementCandidate select(PlacementContext ctx) {
         String d = ctx.defaultProfile();
         if (d != null && !d.isBlank() && !ctx.quarantined().contains(d) && !ctx.coolingOff().contains(d)
-                && !ctx.unreachable().contains(d) && !weightExcluded(ctx, d)) {
+                && !ctx.modelOff().contains(d) && !ctx.unreachable().contains(d) && !weightExcluded(ctx, d)
+                && !capExcluded(ctx, d)) {
             return new PlacementCandidate(d, null, 1.0f, null);
         }
         for (PlacementCandidate c : ctx.candidates()) {
             if (!ctx.quarantined().contains(c.profile()) && !ctx.coolingOff().contains(c.profile())
-                    && !ctx.unreachable().contains(c.profile()) && !c.excluded()) {
+                    && !ctx.modelOff().contains(c.profile()) && !ctx.unreachable().contains(c.profile())
+                    && !c.excluded() && !PlacementPolicyUtil.atCap(ctx, c)) {
                 return new PlacementCandidate(c.profile(), null, c.weight(), c.maxLoad());
             }
         }
@@ -56,9 +75,18 @@ final class FixedPlacementPolicy implements PlacementPolicy {
             // Exhaustion quarantine takes priority: reported only when quarantine is absent, so the
             // message never claims "cooling off" for a profile that is really backend-exhausted.
             boolean dCoolingOff = !dQuarantined && ctx.coolingOff().contains(d);
+            // fleetd #435: at-cap sits between cooling off and model-off, matching
+            // CompositePeerLauncher's explicit-spawn check order (quarantine, cooling off, max load,
+            // then model-off) — reported only when quarantine/cooling-off are both absent.
+            boolean dAtCap = !dQuarantined && !dCoolingOff && capExcluded(ctx, d);
+            // fleetd #422: model-off is a fifth, independent source (an operator decision) — but
+            // quarantine/cooling-off/at-cap still take priority when more than one applies, matching
+            // CompositePeerLauncher's explicit-spawn check order (quarantine, cooling off, max load,
+            // then model-off).
+            boolean dModelOff = !dQuarantined && !dCoolingOff && !dAtCap && ctx.modelOff().contains(d);
             boolean dUnreachable = ctx.unreachable().contains(d);
             boolean dWeightExcluded = weightExcluded(ctx, d);
-            if (dQuarantined || dCoolingOff || dUnreachable || dWeightExcluded) {
+            if (dQuarantined || dCoolingOff || dAtCap || dModelOff || dUnreachable || dWeightExcluded) {
                 List<String> reasons = new ArrayList<>();
                 if (dQuarantined) {
                     reasons.add("is quarantined (backend exhausted)");
@@ -66,6 +94,14 @@ final class FixedPlacementPolicy implements PlacementPolicy {
                 if (dCoolingOff) {
                     reasons.add("is cooling off after repeated backend errors");
                 }
+                if (dAtCap) {
+                    PlacementCandidate c = candidateFor(ctx, d);
+                    int live = ctx.liveCount().apply(d);
+                    reasons.add("is at maxLoad (" + live + " live >= " + c.maxLoad() + " cap)");
+                }
+                if (dModelOff) {
+                    reasons.add("names a model the operator has turned off in models.allow");
+                }
                 if (dUnreachable) {
                     reasons.add("is unreachable");
                 }
@@ -78,18 +114,38 @@ final class FixedPlacementPolicy implements PlacementPolicy {
         }
         if (!ctx.candidates().isEmpty()) {
             throw new PlacementException("all worker profiles are excluded from automatic "
-                    + "selection (quarantined, cooling off, unreachable, or weight-0)");
+                    + "selection (quarantined, cooling off, at cap, model-off, unreachable, or weight-0)");
         }
         throw new PlacementException("no worker profiles configured");
     }
 
     /** Whether {@code profile} carries {@code weight <= 0} (CB-554) among {@code ctx}'s candidates. */
     private static boolean weightExcluded(PlacementContext ctx, String profile) {
+        PlacementCandidate c = candidateFor(ctx, profile);
+        return c != null && c.excluded();
+    }
+
+    /**
+     * Whether {@code profile} has reached its {@code maxLoad} cap (fleetd #435), using the shared
+     * {@link PlacementPolicyUtil#atCap} definition — the same one {@code weighted}/{@code
+     * round-robin} already consult via {@link PlacementPolicyUtil#available}. Looked up by name,
+     * the same way {@link #weightExcluded} is: the default fast path above builds its own {@link
+     * PlacementCandidate} with {@code maxLoad} forced to {@code null} (it carries no cap of its
+     * own), so the candidate actually configured for {@code profile} has to be found in {@code
+     * ctx.candidates()} first.
+     */
+    private static boolean capExcluded(PlacementContext ctx, String profile) {
+        PlacementCandidate c = candidateFor(ctx, profile);
+        return c != null && PlacementPolicyUtil.atCap(ctx, c);
+    }
+
+    /** The configured candidate named {@code profile} in {@code ctx}, or {@code null} if none. */
+    private static PlacementCandidate candidateFor(PlacementContext ctx, String profile) {
         for (PlacementCandidate c : ctx.candidates()) {
             if (c.profile().equals(profile)) {
-                return c.excluded();
+                return c;
             }
         }
-        return false;
+        return null;
     }
 }

fleetd/src/main/java/dev/ltms/fleet/placement/PlacementContext.java

@@ -22,11 +22,29 @@ import java.util.function.Function;
  *                       the two apart so its refusal message says "cooling off", not "exhausted",
  *                       when only this one is active. A profile can be in both sets at once; when it
  *                       is, exhaustion quarantine is reported (it takes priority).
+ * @param modelOff       profiles whose {@code model:} is currently turned off in {@code
+ *                       models.allow:} (fleetd #422) — an operator decision, not a backend-reported
+ *                       outage, so a SEPARATE, independent source from both {@code quarantined} and
+ *                       {@code coolingOff}. A profile can be in this set together with either (or
+ *                       both) of the others; {@link PlacementPolicyUtil} counts it into its own
+ *                       bucket rather than merging it into theirs, the same reason
+ *                       {@code coolingOff} is kept apart from {@code quarantined}.
  */
 public record PlacementContext(String defaultProfile,
                                List<PlacementCandidate> candidates,
                                Function<String, Integer> liveCount,
                                Set<String> unreachable,
                                Set<String> quarantined,
-                               Set<String> coolingOff) {
+                               Set<String> coolingOff,
+                               Set<String> modelOff) {
+
+    /**
+     * Back-compat form before the fleetd #422 model on/off gate was added — no candidate's model
+     * is off. Keeps pre-#422 call sites (tests included) compiling and behaving identically.
+     */
+    public PlacementContext(String defaultProfile, List<PlacementCandidate> candidates,
+                            Function<String, Integer> liveCount, Set<String> unreachable,
+                            Set<String> quarantined, Set<String> coolingOff) {
+        this(defaultProfile, candidates, liveCount, unreachable, quarantined, coolingOff, Set.of());
+    }
 }

fleetd/src/main/java/dev/ltms/fleet/placement/PlacementDecision.java

@@ -0,0 +1,49 @@
+package dev.ltms.fleet.placement;
+
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.peer.SpawnRequest;
+
+/**
+ * An already-completed placement choice — the outcome of one {@link PeerLauncher#place} call,
+ * carried forward so a later {@link PeerLauncher#spawn(SpawnRequest, PlacementDecision)} can honor
+ * it directly instead of re-resolving the profile a second time (fleetd #425 rework, round 2).
+ *
+ * <p>The problem this exists to close: a caller that must know the profile <em>before</em> it can
+ * spawn — {@code SessionManager.acquireWithWorktree} provisions a worktree's {@code repoRoot} and
+ * parity overlay for a specific profile before the peer process exists — used to resolve that name
+ * with {@code PeerLauncher.routedProfileFor(role)} and then hand the SAME string back to {@link
+ * PeerLauncher#spawn(SpawnRequest)} as an EXPLICIT profile. That re-resolution is not free: naming
+ * a profile explicitly makes {@code CompositePeerLauncher.spawn} take its THROWING branch
+ * ({@code enforceNotQuarantined}/{@code enforceNotCoolingOff}/{@code enforceMaxLoad}/{@code
+ * enforceModelEnabled}), while an unqualified spawn's ROUTING branch never runs those checks at
+ * all — it instead FALLS THROUGH to the next candidate on exactly the same conditions the throwing
+ * branch refuses on. That disagreement is deliberate: an operator who names a profile should get a
+ * refusal, not a silent substitution. The bug is turning the fall-through into a refusal by
+ * accident — resolving a name through the routing side and then re-entering the refusing side with
+ * it, for a decision the routing side had already approved by walking past everything else.
+ * Before fleetd #435, this accident was also reachable through {@code maxLoad} specifically: the
+ * default {@code fixed} placement policy did not evaluate {@code maxLoad} at all for automatic
+ * selection, so a profile placement itself just approved could still die at {@code enforceMaxLoad}
+ * one call later, purely because the caller's route to the spawn passed through an explicit
+ * profile name instead of the routing branch — a failure a worktree-less unqualified spawn would
+ * never hit. fleetd #435 closed that specific gap ({@code fixed} now evaluates {@code maxLoad}
+ * exactly like every other placement policy), so a {@link PlacementDecision} can no longer be
+ * at-cap in the first place — but the refusal-vs-fall-through disagreement above was never about
+ * {@code maxLoad}, and resolving a name and re-entering the refusing branch with it is still wrong
+ * for every OTHER condition placement filters on.
+ *
+ * <p>{@link PeerLauncher#spawn(SpawnRequest, PlacementDecision)} closes that by spawning through
+ * the identical code path the routing branch itself uses, keyed off the SAME decision {@link
+ * PeerLauncher#place} returned — no re-checking of any condition placement already evaluated. A
+ * resolve-then-spawn caller and a blank-profile {@link PeerLauncher#spawn(SpawnRequest)} caller can
+ * then never disagree about which conditions apply to the same placement state, and neither one
+ * re-opens the window between the placement decision and the spawn in which the underlying state
+ * could otherwise move.
+ *
+ * @param profile the profile this decision resolved to (may be {@code null} only when no profile is
+ *                configured at all — the same corner case {@link PeerLauncher#defaultProfile()}
+ *                already tolerates)
+ */
+public record PlacementDecision(String profile) {
+}

fleetd/src/main/java/dev/ltms/fleet/placement/PlacementPolicyUtil.java

@@ -11,28 +11,40 @@ final class PlacementPolicyUtil {
     private PlacementPolicyUtil() {
     }
 
+    /**
+     * True when {@code c} has reached its {@code maxLoad} cap: {@code liveCount(c.profile()) >=
+     * c.maxLoad()}. A {@code null} maxLoad means unlimited, so it is never at cap.
+     *
+     * <p>Extracted as the single shared definition of "at cap" (fleetd #435): before this fix it
+     * was computed inline in both {@link #available} and {@link #emptyException}, and {@code
+     * FixedPlacementPolicy} — not a caller of either — quietly kept its own {@code select} free of
+     * any cap check at all, so a capped default profile was chosen anyway under the default
+     * placement policy. Every automatic policy must call this, not re-derive it.
+     */
+    static boolean atCap(PlacementContext ctx, PlacementCandidate c) {
+        Integer cap = c.maxLoad();
+        return cap != null && ctx.liveCount().apply(c.profile()) >= cap;
+    }
+
     /**
      * Candidates that are not weight-excluded (CB-554: explicit {@code weight <= 0}, checked
      * first because it is a static config choice rather than transient state), not
      * known-unreachable, not quarantined (CB-578 stage B), not cooling off after repeated backend
-     * errors (fleetd #201 Unit 5 — a separate, shorter-lived source from quarantine), and have not
-     * reached their maxLoad. A {@code null} maxLoad means unlimited.
+     * errors (fleetd #201 Unit 5 — a separate, shorter-lived source from quarantine), not naming a
+     * model the operator has turned off (fleetd #422 — a third, independent source: an operator
+     * decision, never a backend-reported outage), and have not reached their maxLoad (see {@link
+     * #atCap}). A {@code null} maxLoad means unlimited.
      */
     static List<PlacementCandidate> available(PlacementContext ctx) {
         List<PlacementCandidate> out = new ArrayList<>();
         for (PlacementCandidate c : ctx.candidates()) {
             if (c.excluded() || ctx.unreachable().contains(c.profile())
                     || ctx.quarantined().contains(c.profile())
-                    || ctx.coolingOff().contains(c.profile())) {
+                    || ctx.coolingOff().contains(c.profile())
+                    || ctx.modelOff().contains(c.profile())
+                    || atCap(ctx, c)) {
                 continue;
             }
-            Integer cap = c.maxLoad();
-            if (cap != null) {
-                int live = ctx.liveCount().apply(c.profile());
-                if (live >= cap) {
-                    continue;
-                }
-            }
             out.add(c);
         }
         return out;
@@ -40,12 +52,13 @@ final class PlacementPolicyUtil {
 
     /**
      * Build a clear exception describing why every candidate was dropped: all weight-0, all
-     * quarantined, all cooling off, all at capacity, all unreachable, or a mix. Each candidate is
-     * counted into exactly one bucket (weight-excluded first, then quarantined, then cooling off)
-     * so a candidate excluded for more than one reason is never double-counted — a candidate that is
-     * both quarantined (CB-578 stage B, backend exhausted) and cooling off (fleetd #201 Unit 5,
-     * repeated backend errors) counts only as quarantined, matching {@code CompositePeerLauncher}'s
-     * explicit-spawn ordering: exhaustion quarantine takes priority when both are active.
+     * quarantined, all cooling off, all model-off, all at capacity, all unreachable, or a mix. Each
+     * candidate is counted into exactly one bucket (weight-excluded first, then quarantined, then
+     * cooling off, then model-off) so a candidate excluded for more than one reason is never
+     * double-counted — a candidate that is both quarantined (CB-578 stage B, backend exhausted) and
+     * cooling off (fleetd #201 Unit 5, repeated backend errors) counts only as quarantined, matching
+     * {@code CompositePeerLauncher}'s explicit-spawn ordering: exhaustion quarantine takes priority
+     * when more than one applies.
      */
     static PlacementException emptyException(PlacementContext ctx) {
         int weightExcluded = 0;
@@ -53,17 +66,19 @@ final class PlacementPolicyUtil {
         int unreachable = 0;
         int quarantined = 0;
         int coolingOff = 0;
+        int modelOff = 0;
         for (PlacementCandidate c : ctx.candidates()) {
-            Integer cap = c.maxLoad();
             if (c.excluded()) {
                 weightExcluded++;
             } else if (ctx.quarantined().contains(c.profile())) {
                 quarantined++;
             } else if (ctx.coolingOff().contains(c.profile())) {
                 coolingOff++;
+            } else if (ctx.modelOff().contains(c.profile())) {
+                modelOff++;
             } else if (ctx.unreachable().contains(c.profile())) {
                 unreachable++;
-            } else if (cap != null && ctx.liveCount().apply(c.profile()) >= cap) {
+            } else if (atCap(ctx, c)) {
                 atCap++;
             }
         }
@@ -83,6 +98,10 @@ final class PlacementPolicyUtil {
             return new PlacementException(
                     "all worker profiles are cooling off after repeated backend errors");
         }
+        if (modelOff == total) {
+            return new PlacementException(
+                    "all worker profiles name a model the operator has turned off");
+        }
         if (atCap == total) {
             return new PlacementException("all worker profiles are at maxLoad");
         }
@@ -92,8 +111,9 @@ final class PlacementPolicyUtil {
         return new PlacementException("no worker profile available: " + atCap + " at maxLoad, "
                 + unreachable + " unreachable, " + quarantined + " quarantined, "
                 + coolingOff + " cooling off, "
+                + modelOff + " model-off, "
                 + weightExcluded + " weight-0, "
-                + (total - atCap - unreachable - quarantined - coolingOff - weightExcluded)
+                + (total - atCap - unreachable - quarantined - coolingOff - modelOff - weightExcluded)
                 + " remaining");
     }
 }

fleetd/src/main/java/dev/ltms/fleet/power/CaffeinateSleepAssertionMechanism.java

@@ -0,0 +1,93 @@
+package dev.ltms.fleet.power;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.util.Locale;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+/**
+ * Holds macOS idle sleep off by keeping a {@code caffeinate -i} child process alive for the life
+ * of the returned {@link SleepAssertion}.
+ *
+ * <p>{@code -i} asserts only against <em>idle</em> sleep — it does not stop the lid closing or an
+ * operator-requested sleep from taking effect. That is deliberate: this class exists to stop an
+ * unattended host from sleeping out from under a member's long turn, never to override the
+ * operator. {@code -s}/{@code -d} (which also block system/display sleep on demand) are
+ * intentionally not used here.
+ *
+ * <p>{@link #acquire()} never throws. It returns {@code null} — a no-op — off macOS, and again if
+ * starting the {@code caffeinate} child fails for any reason (binary missing, process table full,
+ * …); either case is logged once at INFO, not on every occurrence, so a daemon that runs for
+ * weeks with the tool unavailable does not fill its log.
+ */
+public final class CaffeinateSleepAssertionMechanism implements SleepAssertionMechanism {
+
+    private static final Logger log = LoggerFactory.getLogger(CaffeinateSleepAssertionMechanism.class);
+
+    private final AtomicBoolean loggedOnce = new AtomicBoolean(false);
+
+    /** {@code true} when running on macOS, the only platform {@code caffeinate} ships on. */
+    public static boolean isSupportedPlatform() {
+        return isSupportedPlatform(System.getProperty("os.name"));
+    }
+
+    /** Package-visible so a test can drive the platform check without touching a real property. */
+    static boolean isSupportedPlatform(String osName) {
+        return osName != null && osName.toLowerCase(Locale.ROOT).contains("mac");
+    }
+
+    @Override
+    public SleepAssertion acquire() {
+        if (!isSupportedPlatform()) {
+            logOnce("not running on macOS (os.name={}); the idle-sleep guard is a no-op on this platform",
+                    System.getProperty("os.name"));
+            return null;
+        }
+        try {
+            Process process = new ProcessBuilder("caffeinate", "-i")
+                    .redirectOutput(ProcessBuilder.Redirect.DISCARD)
+                    .redirectError(ProcessBuilder.Redirect.DISCARD)
+                    .start();
+            return new CaffeinateAssertion(process);
+        } catch (IOException | RuntimeException e) {
+            logOnce("could not start 'caffeinate -i' ({}); the host may idle-sleep while members are live",
+                    e.toString());
+            return null;
+        }
+    }
+
+    private void logOnce(String format, Object arg) {
+        if (loggedOnce.compareAndSet(false, true)) {
+            log.info("idle-sleep guard: " + format, arg);
+        }
+    }
+
+    /** Wraps the live {@code caffeinate} child; {@link #close} force-destroys it, idempotently. */
+    private static final class CaffeinateAssertion implements SleepAssertion {
+
+        private final Process process;
+
+        CaffeinateAssertion(Process process) {
+            this.process = process;
+        }
+
+        @Override
+        public void close() {
+            if (!process.isAlive()) {
+                return;
+            }
+            process.destroy();
+            try {
+                if (!process.waitFor(2, TimeUnit.SECONDS)) {
+                    process.destroyForcibly();
+                }
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+                process.destroyForcibly();
+            }
+        }
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/power/IdleSleepGuard.java

@@ -0,0 +1,105 @@
+package dev.ltms.fleet.power;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.function.IntSupplier;
+
+/**
+ * Holds an OS-level assertion against idle sleep for exactly as long as at least one fleet
+ * member is live.
+ *
+ * <p><strong>Why this exists:</strong> a fleetd host was measured idle-sleeping after as little
+ * as one minute of inactivity (its {@code pmset -g custom} reports {@code sleep 1} on battery).
+ * Overnight the daemon's AMQP link to the broker dropped 13 times, and cross-checking every drop
+ * minute against {@code pmset -g log} found a sleep or wake event in the same minute or the one
+ * before, every time. The AMQP churn is only the visible symptom — the real problem is that a
+ * member mid-turn freezes with the host, and a long turn with nobody typing is exactly the case
+ * that goes idle.
+ *
+ * <p><strong>How it tracks "live":</strong> this is driven by {@code SessionManager}'s existing
+ * {@code onAcquire}/{@code onRelease} lifecycle hooks (added for CB-520/CB-516, previously wired
+ * to nothing but the reply inbox) rather than a second member count kept in parallel. Wire it as:
+ * <pre>{@code
+ * IdleSleepGuard guard = new IdleSleepGuard(mechanism, sessions::size);
+ * sessions.onAcquire(_ -> guard.recheck());
+ * sessions.onRelease(_ -> guard.recheck());
+ * }</pre>
+ * Every acquire/release event re-reads {@code SessionManager#size()} — the same registry {@code
+ * fleet_list}'s live/capacity numbers are themselves computed from — and only an actual 0→1 or
+ * 1→0 crossing touches the OS. A listener exception is already caught and logged by {@code
+ * SessionManager} itself (it must never let a listener failure block the acquire/release it is
+ * reacting to), so {@link #recheck()} does not need its own top-level try/catch to honor that.
+ *
+ * <p><strong>Failure posture:</strong> every method here is safe to call whether or not {@link
+ * SleepAssertionMechanism#acquire()} actually works. A mechanism that returns {@code null} (wrong
+ * platform, missing tool, spawn failure) simply means this guard never holds anything — it never
+ * throws and never blocks a spawn, a release, or shutdown.
+ */
+public final class IdleSleepGuard implements AutoCloseable {
+
+    private static final Logger log = LoggerFactory.getLogger(IdleSleepGuard.class);
+
+    private final SleepAssertionMechanism mechanism;
+    private final IntSupplier liveCount;
+    private final Object lock = new Object();
+    private SleepAssertion held;
+
+    public IdleSleepGuard(SleepAssertionMechanism mechanism, IntSupplier liveCount) {
+        this.mechanism = mechanism;
+        this.liveCount = liveCount;
+    }
+
+    /**
+     * Re-read the live count and acquire or release the held assertion to match: nothing held and
+     * at least one member live ⇒ acquire; something held and no member live ⇒ release. A steady
+     * count (still zero, still positive) is a no-op either way, so a single spawn or release only
+     * ever touches the OS on the crossing, not on every call.
+     */
+    public void recheck() {
+        synchronized (lock) {
+            int live = liveCount.getAsInt();
+            if (live > 0 && held == null) {
+                held = mechanism.acquire();
+                if (held != null) {
+                    log.debug("idle-sleep guard armed: {} live member(s)", live);
+                }
+            } else if (live == 0 && held != null) {
+                releaseHeldLocked();
+            }
+        }
+    }
+
+    /** {@code true} while an assertion is actually held. Exposed for tests. */
+    boolean isHeld() {
+        synchronized (lock) {
+            return held != null;
+        }
+    }
+
+    /**
+     * Release whatever is held, if anything. Idempotent and safe to call at any time, including
+     * repeatedly — a daemon shutdown hook calls this unconditionally so no assertion (and no
+     * {@code caffeinate} child) survives the process, even if the drain that would otherwise have
+     * driven the live count to zero was itself interrupted or threw.
+     */
+    @Override
+    public void close() {
+        synchronized (lock) {
+            if (held != null) {
+                releaseHeldLocked();
+            }
+        }
+    }
+
+    /** Caller must hold {@link #lock}. */
+    private void releaseHeldLocked() {
+        try {
+            held.close();
+        } catch (RuntimeException e) {
+            log.warn("idle-sleep guard: failed to release its assertion cleanly: {}", e.toString());
+        } finally {
+            held = null;
+        }
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/power/SleepAssertion.java

@@ -0,0 +1,11 @@
+package dev.ltms.fleet.power;
+
+/**
+ * A held OS-level assertion against idle sleep. {@link #close} must be idempotent — safe to call
+ * more than once — and must never throw, matching {@link IdleSleepGuard}'s "never break the
+ * fleet" contract.
+ */
+public interface SleepAssertion extends AutoCloseable {
+    @Override
+    void close();
+}

fleetd/src/main/java/dev/ltms/fleet/power/SleepAssertionMechanism.java

@@ -0,0 +1,21 @@
+package dev.ltms.fleet.power;
+
+/**
+ * The OS mechanism {@link IdleSleepGuard} uses to hold and release an idle-sleep assertion. This
+ * is the seam a test exercises instead of the real effect (a live {@code caffeinate} child) — see
+ * {@code IdleSleepGuardTest}.
+ *
+ * <p>Implementations must never throw. Every failure — wrong platform, missing tool, a spawn
+ * error — must show up as {@link #acquire()} returning {@code null}, so a caller can treat "no
+ * assertion held" and "the mechanism could not be used" identically and the fleet keeps running
+ * either way.
+ */
+public interface SleepAssertionMechanism {
+
+    /**
+     * Acquire a fresh assertion against idle sleep, or {@code null} when this mechanism is not
+     * usable right now (wrong platform, the tool is missing, the child process could not start).
+     * Never throws.
+     */
+    SleepAssertion acquire();
+}

fleetd/src/main/java/dev/ltms/fleet/rest/FleetApp.java

@@ -696,6 +696,10 @@ public final class FleetApp {
     /**
      * The worker's structured reply ({@code fleet_reply}) — resolves the blocking send awaiting
      * on this session, or queues the reply in the inbox when no send is open (CB-307).
+     *
+     * <p>fleetd #365: the response body's {@code delivered} field used to be unconditionally
+     * {@code true} for either case; it now reports whether a send/ticket was actually resolved,
+     * with {@code outcome} naming which (see {@link MessageService.ReplyOutcome}).
      */
     private void replyMessage(Context ctx) {
         String id = ctx.pathParam("id");
@@ -719,13 +723,19 @@ public final class FleetApp {
         // a WRONG value instead of failing loudly. The check lives in MessageService.reply so both
         // this door and FleetMcp.reply inherit the same rule; this catch only translates it into the
         // {error, detail} envelope this file uses everywhere else.
+        MessageService.ReplyOutcome outcome;
         try {
-            messages.reply(id, content);
+            outcome = messages.reply(id, content);
         } catch (IllegalArgumentException e) {
             ctx.status(400).json(Map.of("error", "bad_request", "detail", e.getMessage()));
             return;
         }
-        ctx.status(200).json(Map.of("sessionId", id, "delivered", true));
+        // fleetd #365: "delivered": true used to be unconditional here, whether the reply resolved
+        // a waiting send or was merely queued in the inbox for a later drain — the same gap
+        // FleetMcp.reply had over MCP. `delivered` now reflects which actually happened, and
+        // `outcome` names the specific case (see MessageService.ReplyOutcome).
+        ctx.status(200).json(Map.of("sessionId", id, "delivered", outcome.delivered(),
+                "outcome", outcome.wireName()));
     }
 
     /**

fleetd/src/main/java/dev/ltms/fleet/session/GitWorktrees.java

@@ -92,6 +92,15 @@ public final class GitWorktrees implements Worktrees {
     private final String configuredRoot;
     /** OS group name for {@link #shareWithGroup} (fleetd #185 stage 3); {@code null} ⇒ feature off. */
     private final String group;
+    /** Source directory of skill folders for {@link #seedSkills} (fleetd #362, {@code memberSkills:}
+     *  in config); {@code null} ⇒ feature off, no worktree is touched beyond today's behaviour. */
+    private final String memberSkillsSource;
+    /** Extra environment merged into every {@code git} subprocess this instance runs. Always {@code
+     *  Map.of()} from every production constructor. Test seam only (fleetd #362 review fix): lets
+     *  {@code GitWorktreesTest} point {@code GIT_CONFIG_GLOBAL} at an isolated temp file so it can
+     *  drive the real {@link #add} path against a controlled "operator's global git config" and
+     *  prove the excludesFile composition below without ever touching the real machine's config. */
+    private final Map<String, String> gitEnv;
     private final Consumer<String> afterWorktreeAdded;
     /** How the initial {@code git worktree add} command runs. Package-private test seam for an
      *  interrupted command after Git has made worktree state. */
@@ -125,7 +134,20 @@ public final class GitWorktrees implements Worktrees {
      *                       config); null/blank ⇒ {@link #shareWithGroup} is a no-op.
      */
     public GitWorktrees(String configuredRoot, String group) {
-        this(configuredRoot, group, _ -> {});
+        this(configuredRoot, group, (String) null);
+    }
+
+    /**
+     * @param configuredRoot     nullable absolute or relative path; null/blank derives a sibling of
+     *                           the repo root.
+     * @param group              optional OS group name (fleetd #185 stage 3, {@code worktreeGroup:}
+     *                           in config); null/blank ⇒ {@link #shareWithGroup} is a no-op.
+     * @param memberSkillsSource fleetd #362: optional directory of skill folders ({@code
+     *                           memberSkills:} in config) copied into every provisioned worktree's
+     *                           {@code .claude/skills/}; null/blank ⇒ {@link #seedSkills} is a no-op.
+     */
+    public GitWorktrees(String configuredRoot, String group, String memberSkillsSource) {
+        this(configuredRoot, group, _ -> {}, null, null, memberSkillsSource);
     }
 
     /** Test seam for changing a real worktree between its creation and its security check. */
@@ -135,13 +157,20 @@ public final class GitWorktrees implements Worktrees {
 
     /** Test seam combining a configurable {@code group} with {@link #afterWorktreeAdded}. */
     GitWorktrees(String configuredRoot, String group, Consumer<String> afterWorktreeAdded) {
-        this(configuredRoot, group, afterWorktreeAdded, null, null);
+        this(configuredRoot, group, afterWorktreeAdded, null, null, null);
     }
 
     /** Test seam for changing how {@link #shareWithGroup}'s processes run. */
     GitWorktrees(String configuredRoot, String group, Consumer<String> afterWorktreeAdded,
                   Function<String[], String> shareGroupRunner) {
-        this(configuredRoot, group, afterWorktreeAdded, shareGroupRunner, null);
+        this(configuredRoot, group, afterWorktreeAdded, shareGroupRunner, null, null);
+    }
+
+    /** Test seam for changing how the initial {@code git worktree add} command runs, with no
+     *  {@code memberSkillsSource} configured. */
+    GitWorktrees(String configuredRoot, String group, Consumer<String> afterWorktreeAdded,
+                  Function<String[], String> shareGroupRunner, Function<String[], String> worktreeAddRunner) {
+        this(configuredRoot, group, afterWorktreeAdded, shareGroupRunner, worktreeAddRunner, null);
     }
 
     /**
@@ -151,11 +180,30 @@ public final class GitWorktrees implements Worktrees {
      *
      * @param shareGroupRunner {@code null} ⇒ the real {@link #exec(String...)}.
      * @param worktreeAddRunner {@code null} ⇒ the real {@link #exec(String...)}.
+     * @param memberSkillsSource {@code null}/blank ⇒ {@link #seedSkills} is a no-op.
      */
     GitWorktrees(String configuredRoot, String group, Consumer<String> afterWorktreeAdded,
-                  Function<String[], String> shareGroupRunner, Function<String[], String> worktreeAddRunner) {
+                  Function<String[], String> shareGroupRunner, Function<String[], String> worktreeAddRunner,
+                  String memberSkillsSource) {
+        this(configuredRoot, group, afterWorktreeAdded, shareGroupRunner, worktreeAddRunner,
+                memberSkillsSource, Map.of());
+    }
+
+    /**
+     * Full test seam, plus {@code gitEnv} (fleetd #362 review fix, verification only): extra
+     * environment merged into every {@code git} subprocess this instance runs, so a test can isolate
+     * something like {@code GIT_CONFIG_GLOBAL} from the real machine while still driving the real
+     * {@link #add} path end to end. Every production constructor above delegates here with {@code
+     * Map.of()}.
+     */
+    GitWorktrees(String configuredRoot, String group, Consumer<String> afterWorktreeAdded,
+                  Function<String[], String> shareGroupRunner, Function<String[], String> worktreeAddRunner,
+                  String memberSkillsSource, Map<String, String> gitEnv) {
         this.configuredRoot = configuredRoot;
         this.group = (group == null || group.isBlank()) ? null : group;
+        this.memberSkillsSource = (memberSkillsSource == null || memberSkillsSource.isBlank())
+                ? null : memberSkillsSource;
+        this.gitEnv = gitEnv == null ? Map.of() : gitEnv;
         this.afterWorktreeAdded = afterWorktreeAdded == null ? _ -> {} : afterWorktreeAdded;
         this.shareGroupRunner = shareGroupRunner != null ? shareGroupRunner : this::exec;
         this.worktreeAddRunner = worktreeAddRunner != null ? worktreeAddRunner : this::exec;
@@ -184,6 +232,7 @@ public final class GitWorktrees implements Worktrees {
             configureEnvironmentCredentialHelper(repoRoot, wt);
             configureHttpsUrlRewriteForSshOrigin(repoRoot, wt);
             isolateToolSurface(wt);
+            seedSkills(wt);
         } catch (RuntimeException e) {
             cleanupAfterAddFailure(repoRoot, wt, branch, e);
             throw e;
@@ -574,6 +623,310 @@ public final class GitWorktrees implements Worktrees {
         return true;
     }
 
+    /**
+     * fleetd #362: copy each skill folder from the configured {@link #memberSkillsSource} directory
+     * into {@code <worktreePath>/.claude/skills/}, so a member spawned against ANY repo — not only
+     * one that already ships its own {@code .claude/skills/} — can load a bridge skill such as
+     * {@code implementer}. Every brief this fleet sends starts with {@code "Load the <name>
+     * skill."}; outside a repo carrying its own copy that line was previously a no-op.
+     *
+     * <p><b>No-op — nothing read, nothing written, nothing logged</b> — when {@link
+     * #memberSkillsSource} is null/blank (today's default), the same off-switch shape as
+     * {@link #shareWithGroup}.
+     *
+     * <p><b>Invariant 1 — a repo's own skill wins.</b> A skill folder already present at
+     * {@code <worktreePath>/.claude/skills/<name>} — because the just-checked-out branch commits its
+     * own copy — is left completely untouched: never overwritten, and never even opened.
+     *
+     * <p><b>Invariant 2 — a seeded skill can never end up in a worker's commit.</b> Every path this
+     * writes is untracked in the target repo (that is the whole reason it is being seeded), so
+     * {@code git status} would otherwise show each one as a new, addable, committable path. The
+     * repo-wide {@code .git/info/exclude} is NOT used for this: measured against a real linked
+     * worktree, that file resolves to the repository's COMMON git dir even from a worktree (the
+     * same file {@link dev.ltms.fleet.member.ClaudeCodeLauncher#writeIdeOverlay writeIdeOverlay}
+     * appends {@code CLAUDE.local.md} to), so an entry written there would hide the seeded skill
+     * from {@code git status} in the PRIMARY's own checkout and every sibling worktree too — not
+     * only this one. Instead, {@link #excludeSeededSkillsFromGitStatus} points {@code
+     * core.excludesFile} at a file scoped {@code --worktree} (the same {@code
+     * extensions.worktreeConfig} mechanism {@link #configureEnvironmentCredentialHelper} already
+     * relies on) that itself lives under this worktree's own private git dir ({@code
+     * .git/worktrees/<nonce>/}, OUTSIDE the working tree) — invisible to this worktree's {@code git
+     * status} and structurally impossible for this worktree to commit, with no effect on any other
+     * worktree or the primary checkout. Proven with a real {@code git status --porcelain} in
+     * {@code GitWorktreesTest}, not by reasoning.
+     *
+     * <p><b>Compose, don't replace.</b> {@code core.excludesFile} is single-valued: the first cut of
+     * this method pointed it at fleetd's own file with {@code --replace-all}, which SHADOWS whatever
+     * the operator's own (global, or repo-local) {@code core.excludesFile} was already resolving to
+     * inside this worktree, rather than adding to it. Measured concretely: this repo's own {@code
+     * .gitignore} does not ignore {@code target/} — only an operator's global excludesFile does — so
+     * every worker's {@code mvn clean install} would otherwise make {@code target/} appear as
+     * untracked, and {@link #hasUncommitted}'s deliberately-untracked-inclusive {@code git status
+     * --porcelain} (CB-576) would then read every such worktree as dirty forever, so it is never
+     * cleaned up. {@link #excludeSeededSkillsFromGitStatus} now reads whatever {@code
+     * core.excludesFile} resolves to BEFORE writing anything (falling back to git's own documented
+     * default, {@code $XDG_CONFIG_HOME/git/ignore} or {@code $HOME/.config/git/ignore}, when the key
+     * is unset entirely — see {@code gitignore(5)}), and writes that content into its OWN exclude
+     * file ahead of the seeded skill patterns, so every operator-configured pattern keeps applying
+     * inside the seeded worktree exactly as it did before seeding ran.
+     *
+     * <p>Instead of using worktree-scoped-config as an add-then-append (a second key does not exist
+     * for {@code core.excludesFile} — it takes exactly one value), an actual second exclude source
+     * was ruled out because git resolves only ONE {@code core.excludesFile}; concatenating the prior
+     * content into fleetd's own file is what "compose" reduces to for a single-valued key.
+     *
+     * <p>Proven the same way as invariant 2's own leak check: {@code
+     * GitWorktreesTest#seedSkillsComposesWithAnAlreadyEffectiveGlobalExcludesFile} isolates a
+     * synthetic "operator's global config" via {@code GIT_CONFIG_GLOBAL} (never the real machine's),
+     * seeds a skill, and asserts {@code git status --porcelain} is still empty for a file matching
+     * that global config's own ignore pattern.
+     *
+     * <p><b>Invariant 3 — best-effort.</b> A missing/unreadable {@link #memberSkillsSource}, or a
+     * copy/exclude failure, is logged and skipped — it must never fail the spawn, the same contract
+     * {@link #overlayParity} and {@link #isolateToolSurface} already hold.
+     *
+     * <p>Recorded for the worker itself the same way fleetd #134 records {@code
+     * fleet.neutralizedConfig}: {@code fleet.seededSkills} (one value per seeded skill folder) and
+     * {@code fleet.seededSkillsNote}, readable with {@code git config --worktree --get-all
+     * fleet.seededSkills}.
+     *
+     * <p><b>Claude Code specific by construction, not by a backend check here.</b> Only {@code
+     * .claude/skills/<name>/SKILL.md} is a path any launcher reads today (opencode's equivalent is a
+     * different shape under {@code .opencode/agent}, out of scope — see issue #362). This method
+     * only copies files; like {@link #isolateToolSurface} — which neutralizes BOTH {@code .mcp.json}
+     * and {@code opencode.json} unconditionally — it runs the same for every worktree regardless of
+     * which backend ultimately spawns into it, because the backend is not yet chosen at {@link #add}
+     * time. A seeded {@code .claude/skills/} directory in an opencode member's worktree is simply
+     * never read by that launcher.
+     */
+    private void seedSkills(String worktreePath) {
+        if (memberSkillsSource == null) {
+            return;
+        }
+        Path source = Path.of(memberSkillsSource).toAbsolutePath().normalize();
+        if (!Files.isDirectory(source)) {
+            log.warn("memberSkills source '{}' is not a directory — skipping skill seeding for worktree {}",
+                    source, worktreePath);
+            return;
+        }
+        Path skillsRoot = Path.of(worktreePath).resolve(".claude").resolve("skills");
+        List<String> seeded = new ArrayList<>();
+        List<String> kept = new ArrayList<>();
+        try (var candidates = Files.list(source)) {
+            for (Path candidate : candidates
+                    .filter(Files::isDirectory)
+                    .filter(p -> !p.getFileName().toString().startsWith("."))
+                    .sorted()
+                    .toList()) {
+                String name = candidate.getFileName().toString();
+                Path dst = skillsRoot.resolve(name);
+                if (Files.exists(dst)) {
+                    kept.add(name);
+                    continue;
+                }
+                copySkillDirectory(candidate, dst);
+                seeded.add(name);
+            }
+        } catch (IOException | RuntimeException e) {
+            log.warn("failed to seed skills into worktree {} from memberSkills source '{}': {}",
+                    worktreePath, source, e.getMessage());
+            return;
+        }
+        String detail = seeded.isEmpty() ? "" : "seeded: " + String.join(", ", seeded);
+        if (!kept.isEmpty()) {
+            detail += (detail.isEmpty() ? "" : "; ") + "kept the repo's own copy of: " + String.join(", ", kept);
+        }
+        if (detail.isEmpty()) {
+            detail = "no skill folders found under " + source;
+        }
+        log.info("skill seeding: {} of {} candidate(s) from {} into {}/.claude/skills — {}",
+                seeded.size(), seeded.size() + kept.size(), source, worktreePath, detail);
+        if (seeded.isEmpty()) {
+            return;
+        }
+        try {
+            excludeSeededSkillsFromGitStatus(worktreePath, seeded);
+            recordSeededSkillsForWorker(worktreePath, seeded);
+        } catch (RuntimeException e) {
+            log.warn("seeded skill(s) {} into {} but could not hide them from git status: {} — "
+                    + "they may show as untracked; never commit them", seeded, worktreePath, e.getMessage());
+        }
+    }
+
+    /** Recursively copy a skill folder ({@code src}) into a fresh destination ({@code dst}) that
+     *  {@link #seedSkills} has already confirmed does not exist, preserving the directory structure
+     *  (e.g. {@code implementer/SKILL.md}, {@code implementer/references/...}). */
+    private static void copySkillDirectory(Path src, Path dst) {
+        try (var walk = Files.walk(src)) {
+            for (Path path : walk.sorted().toList()) {
+                Path target = dst.resolve(src.relativize(path).toString());
+                if (Files.isDirectory(path)) {
+                    Files.createDirectories(target);
+                } else {
+                    Files.createDirectories(target.getParent());
+                    Files.copy(path, target, StandardCopyOption.COPY_ATTRIBUTES);
+                }
+            }
+        } catch (IOException e) {
+            throw new WorktreeException("cannot copy skill directory " + src + " -> " + dst + ": "
+                    + e.getMessage(), e);
+        }
+    }
+
+    /**
+     * Make every path in {@code seededSkillNames} (each a name under {@code .claude/skills/})
+     * invisible to {@code git status} in THIS worktree only — see the invariant-2 discussion on
+     * {@link #seedSkills}. Sets {@code core.excludesFile} scoped {@code --worktree} to a file
+     * written under this worktree's own private git dir ({@code git rev-parse
+     * --absolute-git-dir}), which lives outside the working tree, so the exclude file itself can
+     * never be committed either.
+     *
+     * <p><b>Compose, don't replace.</b> {@code core.excludesFile} is single-valued, so pointing it at
+     * fleetd's own file would otherwise SHADOW whatever excludesFile this worktree was already
+     * resolving (an operator's global config, most commonly) rather than add to it — see the
+     * "Compose, don't replace" discussion on {@link #seedSkills}. {@link
+     * #previouslyEffectiveExcludesFileContent} is read BEFORE this method's own {@code --worktree}
+     * write below, so it still sees whatever was effective beforehand; that content is written into
+     * fleetd's own exclude file ahead of the seeded skill patterns, and the worktree-scoped override
+     * then points at that combined file — so every pattern the operator's own configuration already
+     * applied keeps applying, plus the seeded skill paths.
+     *
+     * <p><b>Assumes a fresh worktree — not idempotent.</b> {@link #seedSkills} only ever calls this
+     * from {@link #add}, which always creates a brand-new worktree, so {@code core.excludesFile} is
+     * never already worktree-scoped-set to fleetd's own file when this runs. A hypothetical second
+     * call on the SAME worktree would read fleetd's own already-composed file back as "previously
+     * effective" (worktree scope now wins) and append the seeded patterns a second time — harmless
+     * to {@code git status} (duplicate exclude lines are a no-op), but not something to rely on. No
+     * guard is added for this because the path does not exist today; if a future caller ever seeds
+     * the same worktree twice, it will need one.
+     */
+    private void excludeSeededSkillsFromGitStatus(String worktreePath, List<String> seededSkillNames) {
+        exec("git", "-C", worktreePath, "config", "extensions.worktreeConfig", "true");
+        String previouslyEffective = previouslyEffectiveExcludesFileContent(worktreePath);
+        String gitDir = exec("git", "-C", worktreePath, "rev-parse", "--absolute-git-dir").trim();
+        Path excludeFile = Path.of(gitDir, "fleet-seeded-skills-exclude");
+        StringBuilder patterns = new StringBuilder();
+        if (!previouslyEffective.isEmpty()) {
+            patterns.append(previouslyEffective);
+        }
+        for (String name : seededSkillNames) {
+            patterns.append("/.claude/skills/").append(name).append('/').append(System.lineSeparator());
+        }
+        try {
+            Files.writeString(excludeFile, patterns.toString());
+        } catch (IOException e) {
+            throw new WorktreeException("cannot write skills exclude file " + excludeFile + ": "
+                    + e.getMessage(), e);
+        }
+        exec("git", "-C", worktreePath, "config", "--worktree", "--replace-all", "core.excludesFile",
+                excludeFile.toString());
+    }
+
+    /**
+     * The content of whatever {@code core.excludesFile} resolves to for {@code worktreePath} right
+     * now — BEFORE {@link #excludeSeededSkillsFromGitStatus} points that key at fleetd's own file —
+     * so it can be carried forward instead of shadowed. {@code --type=path} makes git itself perform
+     * {@code ~}/{@code ~user} expansion the same way it would when actually reading the key to build
+     * exclude rules, rather than handing back a raw, unexpanded config string.
+     *
+     * <p>When the key is unset entirely (exit code non-zero), falls back to git's own documented
+     * default excludes file — {@code $XDG_CONFIG_HOME/git/ignore}, or {@code
+     * $HOME/.config/git/ignore} when that variable is unset — per {@code gitignore(5)}: git applies
+     * that file even with no {@code core.excludesFile} configured at all, so skipping it here would
+     * silently drop patterns an operator never had to configure to get.
+     *
+     * <p>Never throws: a missing, unreadable, or unresolvable file is treated as "nothing to carry
+     * forward" (empty string) — this is a best-effort read in service of {@link #seedSkills}'s own
+     * invariant 3, not a new way for skill seeding to fail a spawn.
+     *
+     * <p><b>Review fix, finding 2.</b> The XDG-fallback branch below does not go through {@code git}
+     * at all, so a first cut of it read {@code XDG_CONFIG_HOME}/{@code HOME} straight from the JVM's
+     * own environment ({@link System#getenv} / {@code user.home}) — unlike every other value this
+     * class resolves, which goes through a {@code git} subprocess and therefore already honours
+     * {@link #gitEnv}. That meant no test could make this branch hermetic, and on any machine
+     * carrying a real {@code ~/.config/git/ignore} (this repo's own dev machine does), every
+     * skill-seeding test silently composed with that real file — correct in production, but
+     * machine-dependent in the test suite, and a future broader pattern in that real file could
+     * silently change what a seeded worktree's {@code git status} reports depending on whose home
+     * directory ran the test. {@link #resolveEnv} now checks {@link #gitEnv} first for both
+     * variables, falling back to the JVM's real environment only when the seam does not supply
+     * them — production behaviour (empty {@link #gitEnv}) is unchanged, and a test can now isolate
+     * this branch exactly as it already isolates every {@code git} subprocess call.
+     *
+     * <p><b>Snapshot, not a reference.</b> The content below is read once, at seeding time, and
+     * copied into fleetd's own exclude file. If the operator edits their global excludesFile
+     * afterward, an already-seeded worktree keeps the old copy — acceptable for a worktree's
+     * expected lifetime, but worth knowing before reading a stale pattern as a bug.
+     *
+     * @return the file's content, trailing-newline-normalized, or {@code ""} when there is nothing
+     *         to compose with.
+     */
+    private String previouslyEffectiveExcludesFileContent(String worktreePath) {
+        String resolvedPath;
+        if (exitCode("git", "-C", worktreePath, "config", "--get", "--type=path", "core.excludesFile") == 0) {
+            resolvedPath = exec("git", "-C", worktreePath, "config", "--get", "--type=path",
+                    "core.excludesFile").trim();
+        } else {
+            String xdgConfigHome = resolveEnv("XDG_CONFIG_HOME");
+            Path fallback = (xdgConfigHome != null && !xdgConfigHome.isBlank())
+                    ? Path.of(xdgConfigHome, "git", "ignore")
+                    : Path.of(resolveHome(), ".config", "git", "ignore");
+            resolvedPath = fallback.toString();
+        }
+        if (resolvedPath.isBlank()) {
+            return "";
+        }
+        Path file = Path.of(resolvedPath);
+        if (!Files.isRegularFile(file) || !Files.isReadable(file)) {
+            return "";
+        }
+        try {
+            String content = Files.readString(file);
+            return content.isBlank() ? "" : content.stripTrailing() + System.lineSeparator();
+        } catch (IOException e) {
+            log.warn("could not read previously-effective excludesFile {} while seeding skills into "
+                    + "{}: {} — its patterns will not carry forward into the seeded worktree",
+                    file, worktreePath, e.getMessage());
+            return "";
+        }
+    }
+
+    /**
+     * Resolve environment variable {@code name} for {@link #previouslyEffectiveExcludesFileContent}'s
+     * XDG fallback, checking {@link #gitEnv} FIRST so a test can isolate this the same way it
+     * already isolates every {@code git} subprocess this class runs, and falling back to the JVM's
+     * real environment only when the seam does not supply it (always the case in production, where
+     * {@link #gitEnv} is {@code Map.of()}).
+     */
+    private String resolveEnv(String name) {
+        String fromSeam = gitEnv.get(name);
+        return fromSeam != null ? fromSeam : System.getenv(name);
+    }
+
+    /** Same as {@link #resolveEnv(String)}, for {@code HOME} — falls back to {@code user.home}
+     *  (rather than {@code System.getenv("HOME")}) when the seam does not supply it, matching this
+     *  class's pre-existing behaviour for every other home-directory resolution. */
+    private String resolveHome() {
+        String fromSeam = gitEnv.get("HOME");
+        return fromSeam != null ? fromSeam : System.getProperty("user.home");
+    }
+
+    /**
+     * The worker-readable half of fleetd #362, mirroring {@link #recordNeutralizedConfigForWorker}:
+     * record which skill folders were seeded where the worker itself can read it, without a
+     * working-tree file that would show up in {@code git status}.
+     */
+    private void recordSeededSkillsForWorker(String worktreePath, List<String> seeded) {
+        exec("git", "-C", worktreePath, "config", "extensions.worktreeConfig", "true");
+        for (String name : seeded) {
+            exec("git", "-C", worktreePath, "config", "--worktree", "--add", "fleet.seededSkills", name);
+        }
+        exec("git", "-C", worktreePath, "config", "--worktree", "fleet.seededSkillsNote",
+                "each fleet.seededSkills value names a skill folder fleetd copied into "
+                        + ".claude/skills/ because this repo did not already ship it; it is excluded "
+                        + "from git status (core.excludesFile, worktree-scoped) and must never be committed");
+    }
+
     @Override
     public void remove(String repoRoot, String worktreePath) {
         Path p = Path.of(worktreePath);
@@ -1084,6 +1437,9 @@ public final class GitWorktrees implements Worktrees {
         Process p;
         try {
             ProcessBuilder pb = new ProcessBuilder(command).redirectErrorStream(true);
+            if (!gitEnv.isEmpty()) {
+                pb.environment().putAll(gitEnv);
+            }
             if (extraEnv != null && !extraEnv.isEmpty()) {
                 pb.environment().putAll(extraEnv);
             }
@@ -1119,7 +1475,11 @@ public final class GitWorktrees implements Worktrees {
     private int exitCode(String... command) {
         Process p;
         try {
-            p = new ProcessBuilder(command).redirectErrorStream(true).start();
+            ProcessBuilder pb = new ProcessBuilder(command).redirectErrorStream(true);
+            if (!gitEnv.isEmpty()) {
+                pb.environment().putAll(gitEnv);
+            }
+            p = pb.start();
         } catch (IOException e) {
             throw new WorktreeException("failed to start " + command[0] + ": " + e.getMessage(), e);
         }

fleetd/src/main/java/dev/ltms/fleet/session/SessionManager.java

@@ -10,6 +10,7 @@ import dev.ltms.fleet.peer.MemberRole;
 import dev.ltms.fleet.peer.PeerHandle;
 import dev.ltms.fleet.peer.PeerLauncher;
 import dev.ltms.fleet.peer.SpawnRequest;
+import dev.ltms.fleet.placement.PlacementDecision;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -584,8 +585,65 @@ public final class SessionManager implements TurnListener {
                                               String ownerTerminal, WorktreeRequest wt,
                                                String sessionName, String resumeSessionId,
                                                MemberLifecycle.SlotReservation reservation) {
-        String preResolvedProfile = (profile == null || profile.isBlank())
-                ? launcher.defaultProfile() : profile;
+        // fleetd #425 rework (round 2): resolved through launcher.place(memberRole) — the same
+        // candidate list, quarantine/cool-off/model-off filtering, and PlacementPolicy an unqualified
+        // spawn of this role is actually judged against right now — never launcher.defaultProfile()
+        // (MemberRole.DEV only, wrong for any other role) and never launcher.defaultProfileFor()
+        // (the role's pool FIRST entry, blind to quarantine/cool-off/model-off: a first-round fix
+        // used exactly this and regressed fleetd #429's "the fleet keeps working when a model is
+        // turned off" guarantee — a quarantined or model-off pool-first profile made this throw
+        // instead of routing around it, which an unqualified spawn is supposed to do). This same
+        // resolved decision is reused below for repoRoot, parityOverlay, AND the spawn itself so the
+        // worktree is always provisioned for the profile the member actually runs on — the two could
+        // disagree before fleetd #425: this name picked repoRoot/overlay, but the spawn below passed
+        // the ORIGINAL (blank) profile through to placement, which re-resolves live and can pick a
+        // different profile if the pool changed between the two reads, or a genuinely different one
+        // under weighted/round-robin placement.
+        //
+        // Round 1 of this rework fed the resolved name back into launcher.spawn(SpawnRequest) as an
+        // EXPLICIT profile. That was a mistake this round corrects, and the mistake is not that the
+        // two branches apply different checks — they are SUPPOSED to disagree: the routing branch a
+        // blank spawn takes treats a quarantined/cooling-off/at-cap/model-off/unreachable/weight-0
+        // profile as a reason to fall through to the next candidate, while CompositePeerLauncher's
+        // THROWING branch (enforceNotQuarantined/enforceNotCoolingOff/enforceMaxLoad/
+        // enforceModelEnabled) treats naming that same profile explicitly as a reason to refuse
+        // outright. That is correct: an operator who names a profile should get a refusal, not a
+        // silent substitution onto a different backend. The mistake was turning a fall-through into
+        // a refusal by accident — resolving a name via the routing side and then re-entering the
+        // refusing side with it, for a placement the routing side had already approved by walking
+        // past everything else.
+        //
+        // Before fleetd #435, this accident was reachable through maxLoad specifically: the default
+        // `fixed` placement policy did not evaluate maxLoad at all for automatic selection, so an
+        // at-cap pool-first profile that placement itself would have picked for a plain unqualified
+        // spawn could die at enforceMaxLoad one call later, purely because this method's route to
+        // the spawn passed through an explicit profile name — a failure a worktree-less unqualified
+        // spawn never hit. fleetd #435 closed that gap (`fixed` now evaluates maxLoad exactly like
+        // every other placement policy), so that specific failure can no longer happen — a
+        // PlacementDecision this method resolves can no longer be at-cap in the first place. What
+        // this round's fix still buys, now that maxLoad can no longer cause the accident: it keeps
+        // the PlacementDecision from place() and hands it to launcher.spawn(SpawnRequest,
+        // PlacementDecision) for an unqualified request, which spawns through the SAME routing
+        // branch a blank spawn uses — no enforce* check is newly applied, and the window between the
+        // placement decision and the spawn (in which the pool, a config reload, or another spawn
+        // landing on the same profile could otherwise move the state) never reopens. An
+        // explicitly-named profile still goes through launcher.spawn(SpawnRequest) and its throwing
+        // branch, unchanged — that caller asked for one profile by name and still gets everything
+        // enforceNotQuarantined/enforceNotCoolingOff/enforceMaxLoad/enforceModelEnabled decide about
+        // it, refusal included.
+        //
+        // The one cost that remains, unchanged from round 1: an unqualified worktree-provisioned
+        // spawn does not get CompositePeerLauncher's cross-candidate retry on a live
+        // PeerUnreachableException raised by the backend itself at spawn time (a transport-level
+        // failure placement cannot see in advance) — spawn(req, decision) commits to the one profile
+        // place() already chose, the same way an explicit-profile spawn commits to its one name. That
+        // trade is deliberate: a worktree provisioned for the wrong backend (the #425 hazard) is worse
+        // than a spawn that fails cleanly and can be retried by the caller. Nothing else is lost:
+        // maxLoad, quarantine, cool-off and model-off all behave identically whether or not a
+        // worktree was requested — that agreement is the invariant this rework exists to hold.
+        boolean unqualifiedProfile = profile == null || profile.isBlank();
+        PlacementDecision decision = unqualifiedProfile ? launcher.place(memberRole) : new PlacementDecision(profile);
+        String preResolvedProfile = decision.profile();
         // CB-507: resolve through the launcher's CB-112 chain (requested → profile cwd → caller →
         // daemon cwd → "."), never the raw args. A plain REST spawn supplies neither a requested
         // nor a caller cwd, so taking the first non-blank of those two yielded null and put
@@ -608,7 +666,15 @@ public final class SessionManager implements TurnListener {
             // copies more files into the worktree after add() returns, so sharing the group any earlier
             // leaves those overlay files operator-owned and read-only for a different-uid member.
             worktrees.shareWithGroup(repoRoot, path);
-            handle = launcher.spawn(new SpawnRequest(profile, path, callerCwd, sessionName, resumeSessionId, memberRole));
+            // fleetd #425: preResolvedProfile, not the original (possibly blank) profile — see the
+            // comment above where it is resolved. The overlay/repoRoot above and the spawn here must
+            // name the same profile. An unqualified request stays unqualified here and is honored via
+            // the PlacementDecision already captured above (spawn(req, decision) — the routing branch,
+            // no enforce* re-check); an explicitly-named profile still goes through the single-arg
+            // spawn(req) and its throwing branch, exactly as before this rework.
+            SpawnRequest spawnReq = new SpawnRequest(unqualifiedProfile ? null : preResolvedProfile,
+                    path, callerCwd, sessionName, resumeSessionId, memberRole);
+            handle = unqualifiedProfile ? launcher.spawn(spawnReq, decision) : launcher.spawn(spawnReq);
         } catch (RuntimeException e) {
             log.warn("spawn failed for profile={} role={} branch={} path={}: {}",
                     preResolvedProfile, memberRole, branch, path, e.getMessage());
@@ -636,7 +702,7 @@ public final class SessionManager implements TurnListener {
             }
             throw e;
         }
-        String resolvedProfile = resolveProfile(handle, profile);
+        String resolvedProfile = resolveProfile(handle, preResolvedProfile);
         String cwd = launcher.effectiveCwd(new SpawnRequest(resolvedProfile, path, callerCwd));
         long now = nowNanos.getAsLong();
         // CB-619: see the no-worktree path above — bind before recording, and store the returned

fleetd/src/test/java/dev/ltms/fleet/ExhaustedPatternGapReportTest.java

@@ -0,0 +1,150 @@
+package dev.ltms.fleet;
+
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
+import dev.ltms.fleet.config.FleetConfig;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.slf4j.LoggerFactory;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #395: {@code exhaustedPattern} (see {@link FleetConfig.Profile#exhaustedPattern}) is
+ * deliberately opt-in — an unset one leaves usage-limit detection silently OFF for that profile,
+ * and nothing quarantines its credential. {@link Fleetd#reportExhaustedPatternGap} must say so at
+ * startup, naming every unarmed profile, and must never fire when every profile is armed. Mirrors
+ * {@link MemberCredentialsGapReportTest}'s pattern, capturing the real log via a
+ * {@link ListAppender}.
+ *
+ * <p>The 8-profile shape in {@link #theLiveEightProfileShapeWarnsExactlyTheSixUnarmedProfiles} is
+ * the live {@code fleetd.yaml} shape measured 2026-09-10 (fleetd #395's own ticket): 6 of 8
+ * profiles unarmed, 2 of those 6 ({@code opus}, {@code sonnet}) running on the operator's Claude
+ * subscription. {@code fleetd.yaml} itself is gitignored and unavailable to this test, so the
+ * shape is reproduced as a throwaway config in a {@code @TempDir} rather than read off disk.
+ */
+class ExhaustedPatternGapReportTest {
+
+    private static FleetConfig load(Path dir, String yaml) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml);
+        return FleetConfig.load(f);
+    }
+
+    private static ListAppender<ILoggingEvent> attach() {
+        Logger logger = (Logger) LoggerFactory.getLogger(Fleetd.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        return appender;
+    }
+
+    private static void detach(ListAppender<ILoggingEvent> appender) {
+        ((Logger) LoggerFactory.getLogger(Fleetd.class)).detachAppender(appender);
+    }
+
+    /** Every profile name mentioned by a WARN-level log line, across every WARN this call produced. */
+    private static List<String> warnMessages(ListAppender<ILoggingEvent> appender) {
+        return appender.list.stream()
+                .filter(e -> e.getLevel() == Level.WARN)
+                .map(ILoggingEvent::getFormattedMessage)
+                .toList();
+    }
+
+    @Test
+    void theLiveEightProfileShapeWarnsExactlyTheSixUnarmedProfiles(@TempDir Path dir) throws Exception {
+        // Reproduces the live shape measured 2026-09-10: 8 profiles, 2 armed (sol, terra), 6
+        // unarmed (local, local-direct, gx, opus, sonnet, xf) — 2 of the unarmed 6 (opus, sonnet)
+        // are subscription: true.
+        FleetConfig cfg = load(dir, """
+                profiles:
+                  local:
+                    baseUrl: http://gx00.gw:8000
+                  local-direct:
+                    baseUrl: http://gx01.gw:8000
+                  gx:
+                    kind: opencode
+                    baseUrl: https://llm.ltms.dev/v1
+                  opus:
+                    subscription: true
+                    model: claude-opus-5
+                  sonnet:
+                    subscription: true
+                    model: claude-sonnet-5
+                  sol:
+                    baseUrl: https://llm.ltms.dev/v1
+                    exhaustedPattern: "The usage limit has been reached"
+                  terra:
+                    baseUrl: https://llm.ltms.dev/v1
+                    exhaustedPattern: "The usage limit has been reached"
+                  xf:
+                    baseUrl: https://llm.ltms.dev/v1
+                """);
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            Fleetd.reportExhaustedPatternGap(cfg);
+        } finally {
+            detach(appender);
+        }
+
+        List<String> warns = warnMessages(appender);
+        assertFalse(warns.isEmpty(), "6 of 8 profiles are unarmed — at least one WARN must fire");
+
+        // Exactly one WARN aggregates every unarmed profile, naming all 6 and none of the 2 armed.
+        String aggregate = warns.stream()
+                .filter(m -> m.contains("no exhaustedPattern configured"))
+                .findFirst()
+                .orElseThrow(() -> new AssertionError("expected an aggregate unarmed-profiles WARN: " + warns));
+        for (String unarmed : List.of("local", "local-direct", "gx", "opus", "sonnet", "xf")) {
+            assertTrue(aggregate.contains(unarmed), "aggregate WARN must name '" + unarmed + "': " + aggregate);
+        }
+        for (String armed : List.of("sol", "terra")) {
+            assertFalse(aggregate.contains(armed), "aggregate WARN must NOT name armed profile '" + armed + "': " + aggregate);
+        }
+
+        // A second, louder WARN calls out the subscription profiles specifically.
+        String subscriptionWarn = warns.stream()
+                .filter(m -> m.contains("metered Claude plan"))
+                .findFirst()
+                .orElseThrow(() -> new AssertionError("expected a subscription-specific WARN: " + warns));
+        assertTrue(subscriptionWarn.contains("opus"), subscriptionWarn);
+        assertTrue(subscriptionWarn.contains("sonnet"), subscriptionWarn);
+        assertFalse(subscriptionWarn.contains("local-direct"),
+                "the subscription WARN must not name a non-subscription profile: " + subscriptionWarn);
+    }
+
+    @Test
+    void everyProfileArmedProducesNoWarningAtAll(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = load(dir, """
+                profiles:
+                  sol:
+                    baseUrl: https://llm.ltms.dev/v1
+                    exhaustedPattern: "The usage limit has been reached"
+                  terra:
+                    baseUrl: https://llm.ltms.dev/v1
+                    exhaustedPattern: "The usage limit has been reached"
+                  opus:
+                    subscription: true
+                    model: claude-opus-5
+                    exhaustedPattern: "5-hour limit reached"
+                """);
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            Fleetd.reportExhaustedPatternGap(cfg);
+        } finally {
+            detach(appender);
+        }
+
+        assertTrue(warnMessages(appender).isEmpty(),
+                "every profile is armed — a checker that warns anyway always fires: " + warnMessages(appender));
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdBackendErrorSinkTest.java

@@ -20,6 +20,7 @@ import dev.ltms.fleet.peer.PeerLauncher;
 import dev.ltms.fleet.peer.SpawnRequest;
 import dev.ltms.fleet.placement.BackendOutagePolicy;
 import dev.ltms.fleet.placement.BackendQuarantine;
+import dev.ltms.fleet.placement.PlacementDecision;
 import dev.ltms.fleet.placement.PlacementPolicies;
 import dev.ltms.fleet.session.MemberSession;
 import dev.ltms.fleet.session.SessionManager;
@@ -123,6 +124,11 @@ class FleetdBackendErrorSinkTest {
             throw new UnsupportedOperationException("not reachable — this test never acquires a session");
         }
 
+        @Override
+        public PeerHandle spawn(SpawnRequest req, PlacementDecision decision) {
+            throw new UnsupportedOperationException("not reachable — this test never acquires a session");
+        }
+
         @Override
         public Set<String> profiles() {
             return Set.of();

fleetd/src/test/java/dev/ltms/fleet/FleetdBackendQuarantineWiringTest.java

@@ -0,0 +1,65 @@
+package dev.ltms.fleet;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #466 follow-up: {@code Fleetd.main} builds the daemon's one {@code BackendQuarantine}
+ * from {@link dev.ltms.fleet.placement.BackendQuarantine#withEscalation(java.util.function.LongSupplier,
+ * long)} — the escalating factory — rather than the plain two-argument constructor, which is still a
+ * flat cooldown (kept for backward compatibility, see that class's doc). {@code
+ * BackendQuarantineTest} proves {@code withEscalation} itself escalates, is ceilinged, and resets;
+ * it says nothing about which one {@code main} actually calls.
+ *
+ * <p>Measured directly: reverting {@code main} to {@code new BackendQuarantine(System::nanoTime,
+ * TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()))} — the pre-#466 flat call — compiles
+ * with 0 errors and leaves the entire 1608-test suite (including every {@code BackendQuarantineTest}
+ * case) green, because no other test constructs its {@code BackendQuarantine} through {@code main};
+ * every one of them builds its own instance directly. That silent regression is exactly the shape
+ * {@link FleetdLeadSeatWiringTest} and {@link FleetdCompletionResolverWiringTest} already guard
+ * against for their own constructor arguments — this is the same class of gap for fleetd #466's
+ * factory choice, following their approach.
+ *
+ * <p><b>This test checks source text, not runtime behaviour.</b> It never constructs a {@code
+ * BackendQuarantine} and never runs {@code main} — a green result here proves only that the exact
+ * text {@code main} calls {@code BackendQuarantine.withEscalation(...)} rather than the flat
+ * constructor. It does not prove that call actually executes at startup (no test here starts the
+ * daemon), and it does not prove the escalation reaches a real backend or credential — only
+ * {@code BackendQuarantineTest} proves the factory's own behaviour, and only a live daemon proves
+ * the wiring runs.
+ */
+class FleetdBackendQuarantineWiringTest {
+
+    private static String fleetdSource() throws Exception {
+        return Files.readString(Path.of("src/main/java/dev/ltms/fleet/Fleetd.java"));
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] main's BackendQuarantine local is still built from BackendQuarantine.withEscalation(...)")
+    void mainStillWiresTheEscalatingQuarantineFactory() throws Exception {
+        String source = fleetdSource();
+        assertTrue(source.contains(
+                        "BackendQuarantine quarantine = BackendQuarantine.withEscalation(System::nanoTime,\n"
+                                + "                TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()));"),
+                "Fleetd.main's BackendQuarantine local must still be built from "
+                        + "BackendQuarantine.withEscalation(System::nanoTime, "
+                        + "TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds())). Reverting to the flat "
+                        + "two-argument constructor (fleetd #466's measured regression) compiles with 0 errors "
+                        + "and leaves the whole suite green, including every BackendQuarantineTest case that "
+                        + "proves the escalation itself works — this source check is what must go red instead. "
+                        + "A reverted daemon would go back to retrying a weekly subscription limit on every "
+                        + "flat ~30-minute cooldown, about 336 times across the week.");
+
+        // Negative form of the same check: the pre-#466 flat call, if it ever reappears at this
+        // declaration, must not be mistaken for the escalating one by a looser positive-only check.
+        assertFalse(source.contains(
+                        "BackendQuarantine quarantine = new BackendQuarantine(System::nanoTime,\n"
+                                + "                TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()));"),
+                "main's BackendQuarantine local must never regress to the flat two-argument constructor");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdCapacitySourceWiringTest.java

@@ -0,0 +1,155 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.mcp.FleetMcp;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * fleetd #416: {@code fleet_list}'s {@code CapacitySource.configuredProfiles} must enumerate the
+ * <em>startup</em> profile set, not the live, hot-reloaded one.
+ *
+ * <p>{@code profiles} as a whole is a {@code DEFERRED} key ({@link ConfigRef#DEFERRED_KEYS}):
+ * {@code HerdrPeerLauncher} takes {@code Map.copyOf(profiles)} once at construction, so a profile
+ * only added to the hot-reloaded map can never actually be spawned. Before this fix, {@code
+ * Fleetd.main} built {@code CapacitySource} with {@code () -> config.get().profiles().keySet()} —
+ * the live map — so {@code fleet_list} would report a freshly hot-reloaded profile as available
+ * ({@code free > 0}) while {@code fleet_spawn} on that same profile failed with
+ * {@code unknown worker profile}. Measured on another host: adding a throwaway profile and letting
+ * it hot-reload gave {@code fleet_list} -> {@code free: 3} and {@code fleet_spawn} ->
+ * {@code error: unknown worker profile}.
+ *
+ * <p>This test needs a reload, the same reason {@link FleetdExhaustionDetectionArmedWiringTest}
+ * does: at startup the two snapshots agree, so a test of only a newly started daemon would not
+ * detect a live {@code config.get()} lookup for the set.
+ *
+ * <p><b>maxLoad must stay hot.</b> It is read off {@code config.get()} exactly like
+ * {@code credentialId} ({@link ConfigRef} documents both as hot, "read live off the config
+ * supplier ... exactly like weight/maxLoad"), so a reload that only changes an existing profile's
+ * {@code maxLoad} — no add/remove — must still change what {@code fleet_list} reports without a
+ * restart. A fix that freezes the whole {@code CapacitySource} against {@code cfg} (rather than
+ * only its {@code configuredProfiles} set) would trade this bug for its mirror image and is pinned
+ * wrong by {@link #reloadedMaxLoadStillChangesWhatFleetListReports}.
+ */
+class FleetdCapacitySourceWiringTest {
+
+    private static final String STARTUP = """
+            bind:
+              host: 127.0.0.1
+              port: 8765
+            herdrSocket: ~/.config/herdr/herdr.sock
+            profiles:
+              terra:
+                baseUrl: http://gx00.gw:8000
+                model: terra
+                maxLoad: 3
+            guard:
+              offSubscriptionHosts:
+                - gx00.gw
+            """;
+
+    private static final String WITH_NEW_PROFILE = """
+            bind:
+              host: 127.0.0.1
+              port: 8765
+            herdrSocket: ~/.config/herdr/herdr.sock
+            profiles:
+              terra:
+                baseUrl: http://gx00.gw:8000
+                model: terra
+                maxLoad: 3
+              ghost404:
+                baseUrl: http://gx00.gw:8001
+                model: ghost404
+                maxLoad: 3
+            guard:
+              offSubscriptionHosts:
+                - gx00.gw
+            """;
+
+    private static final String WITH_CHANGED_MAX_LOAD = """
+            bind:
+              host: 127.0.0.1
+              port: 8765
+            herdrSocket: ~/.config/herdr/herdr.sock
+            profiles:
+              terra:
+                baseUrl: http://gx00.gw:8000
+                model: terra
+                maxLoad: 9
+            guard:
+              offSubscriptionHosts:
+                - gx00.gw
+            """;
+
+    @Test
+    @DisplayName("a profile present only in the live (hot-reloaded) config is NOT listed")
+    void liveOnlyProfileIsNotListed(@TempDir Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, STARTUP);
+        FleetConfig cfg = FleetConfig.load(file);
+        ConfigRef config = new ConfigRef(file, cfg);
+
+        Files.writeString(file, WITH_NEW_PROFILE);
+        assertTrue(config.reload().applied());
+        // The live snapshot now has the new profile — proves the reload really happened and this
+        // test is not accidentally passing because nothing changed.
+        assertTrue(config.get().profiles().containsKey("ghost404"));
+
+        FleetMcp.CapacitySource source = Fleetd.capacitySource(config, cfg, _ -> 0);
+
+        assertFalse(source.configuredProfiles().get().contains("ghost404"),
+                "a profile added only to the hot-reloaded config must not be listed by fleet_list — "
+                        + "HerdrPeerLauncher never learns about it until a restart, so fleet_spawn on it "
+                        + "would fail with 'unknown worker profile' while fleet_list claimed it free");
+    }
+
+    @Test
+    @DisplayName("a profile present in the startup set IS listed")
+    void startupProfileIsListed(@TempDir Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, STARTUP);
+        FleetConfig cfg = FleetConfig.load(file);
+        ConfigRef config = new ConfigRef(file, cfg);
+
+        FleetMcp.CapacitySource source = Fleetd.capacitySource(config, cfg, _ -> 0);
+
+        // fleetd #416, both-directions requirement: a test that only ever passes an empty/absent
+        // startup set (the case above) cannot tell a correct lookup from one that is permanently
+        // empty (e.g. a mutation replacing the supplier with Set::of). This is the direction that
+        // fails if the fix regresses to reporting nothing at all.
+        assertTrue(source.configuredProfiles().get().contains("terra"),
+                "a profile present in the startup snapshot must still be listed by fleet_list");
+    }
+
+    @Test
+    @DisplayName("a hot maxLoad edit still changes what fleet_list reports")
+    void reloadedMaxLoadStillChangesWhatFleetListReports(@TempDir Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, STARTUP);
+        FleetConfig cfg = FleetConfig.load(file);
+        ConfigRef config = new ConfigRef(file, cfg);
+
+        FleetMcp.CapacitySource source = Fleetd.capacitySource(config, cfg, _ -> 0);
+        assertEquals(3, source.maxLoad().apply("terra"),
+                "sanity: maxLoad reads 3 from the startup config before any reload");
+
+        Files.writeString(file, WITH_CHANGED_MAX_LOAD);
+        assertTrue(config.reload().applied());
+
+        assertEquals(9, source.maxLoad().apply("terra"),
+                "maxLoad must stay hot — the SAME CapacitySource instance must reflect a reloaded "
+                        + "maxLoad without a restart, exactly like credentialId. Freezing the whole "
+                        + "CapacitySource against the startup snapshot (rather than only its "
+                        + "configuredProfiles set) would trade fleetd #416 for its mirror image.");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdExhaustionDetectionArmedWiringTest.java

@@ -0,0 +1,137 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.inject.LiveExhaustedPatterns;
+import dev.ltms.fleet.mcp.FleetMcp;
+import dev.ltms.fleet.placement.BackendQuarantine;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #446: {@code exhaustionDetectionArmed} must describe the LIVE config, not a startup
+ * snapshot — the opposite of what fleetd #404 asked for. #404 pinned {@code exhaustedPattern} as
+ * compiled once at startup (matching {@code CompletionResolver}'s then-frozen behaviour); #446's
+ * whole point is that both sides — the classification {@code CompletionResolver} enforces and the
+ * {@code exhaustionDetectionArmed} field this reports — now read the SAME live {@link
+ * LiveExhaustedPatterns} instance, so a reload arms or disarms detection with no restart, and the
+ * report can never disagree with the behaviour (the fleetd #404 rule, now upheld for real instead
+ * of by freezing both sides).
+ *
+ * <p>This test needs a reload. At startup the two snapshots agree, so a test of only a newly
+ * started daemon would not detect a live {@code config.get()} lookup in the report field.
+ *
+ * <p><b>The hotness proof criterion 1 demands:</b> run this against the fixed code (green) and
+ * against the pre-#446 compile site — {@code Fleetd.main}'s {@code exhaustedPatternsByProfile}
+ * compiled once into a {@code Map<String, Pattern>} at startup, handed to {@code quarantineSource}
+ * — and show it fails there. See the class doc history above: that shape is exactly what
+ * {@code reloadedPatternArmsDetectionWithNoRestart} below is written to catch, and it is the test
+ * that used to assert the opposite (see git history for this file's pre-#446 version, which
+ * asserted {@code assertFalse(...)} on the identical scenario this now asserts {@code assertTrue}
+ * on).
+ */
+class FleetdExhaustionDetectionArmedWiringTest {
+
+    private static final String NO_PATTERN = """
+            bind:
+              host: 127.0.0.1
+              port: 8765
+            herdrSocket: ~/.config/herdr/herdr.sock
+            profiles:
+              terra:
+                baseUrl: http://gx00.gw:8000
+                model: terra
+            guard:
+              offSubscriptionHosts:
+                - gx00.gw
+            """;
+
+    private static final String WITH_PATTERN = """
+            bind:
+              host: 127.0.0.1
+              port: 8765
+            herdrSocket: ~/.config/herdr/herdr.sock
+            profiles:
+              terra:
+                baseUrl: http://gx00.gw:8000
+                model: terra
+                exhaustedPattern: "usage limit"
+            guard:
+              offSubscriptionHosts:
+                - gx00.gw
+            """;
+
+    @Test
+    @DisplayName("reloading a profile's exhaustedPattern IN arms exhaustionDetectionArmed, no restart")
+    void reloadedPatternArmsDetectionWithNoRestart(@TempDir Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, NO_PATTERN);
+        ConfigRef config = new ConfigRef(file, FleetConfig.load(file));
+
+        FleetMcp.QuarantineSource before = Fleetd.quarantineSource(config, BackendQuarantine.none(),
+                new LiveExhaustedPatterns(() -> config.get().profiles()), Map.of());
+        assertFalse(before.exhaustedPatternArmed().apply("terra"),
+                "no exhaustedPattern configured yet — must report unarmed");
+
+        Files.writeString(file, WITH_PATTERN);
+        assertTrue(config.reload().applied());
+        assertTrue(config.get().profiles().get("terra").hasExhaustedPattern());
+
+        // Re-read exhaustedPatternArmed off the SAME QuarantineSource built BEFORE the reload — no
+        // new object, no new wiring — to prove the field itself is live, not merely that a freshly
+        // built source would be. This is the exact axis the pre-#446 code fails on: the same
+        // Function<String,Boolean> lambda, called again after a reload, sees the new answer only if
+        // it re-reads config.get() on every call rather than a value captured earlier.
+        assertTrue(before.exhaustedPatternArmed().apply("terra"),
+                "exhaustionDetectionArmed must read the LIVE config on every call — fleetd #446 made "
+                        + "this hot; it must reflect a reload with no restart and no new QuarantineSource");
+    }
+
+    @Test
+    @DisplayName("reloading exhaustedPattern OUT disarms exhaustionDetectionArmed, no restart")
+    void reloadedPatternRemovalDisarmsDetectionWithNoRestart(@TempDir Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, WITH_PATTERN);
+        ConfigRef config = new ConfigRef(file, FleetConfig.load(file));
+
+        FleetMcp.QuarantineSource source = Fleetd.quarantineSource(config, BackendQuarantine.none(),
+                new LiveExhaustedPatterns(() -> config.get().profiles()), Map.of());
+        assertTrue(source.exhaustedPatternArmed().apply("terra"),
+                "exhaustedPattern is configured from the start — must report armed");
+
+        Files.writeString(file, NO_PATTERN);
+        assertTrue(config.reload().applied());
+
+        assertFalse(source.exhaustedPatternArmed().apply("terra"),
+                "removing exhaustedPattern and reloading must disarm detection with no restart — an "
+                        + "operator turning detection off (e.g. while debugging a false positive) "
+                        + "must see that reflected immediately, exactly like arming it is");
+    }
+
+    @Test
+    @DisplayName("a profile with no exhaustedPattern configured is reported unarmed")
+    void aProfileWithNoPatternIsUnarmed(@TempDir Path dir) throws Exception {
+        // fleetd #404's second direction, carried forward: this test alone fails if
+        // exhaustedPatternArmed degenerates to a constant `profile -> true` — it needs at least one
+        // profile that is genuinely unarmed to catch that.
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, WITH_PATTERN);
+        ConfigRef config = new ConfigRef(file, FleetConfig.load(file));
+
+        FleetMcp.QuarantineSource source = Fleetd.quarantineSource(config, BackendQuarantine.none(),
+                new LiveExhaustedPatterns(() -> config.get().profiles()), Map.of());
+
+        assertTrue(source.exhaustedPatternArmed().apply("terra"),
+                "a profile whose exhaustedPattern is configured must report armed");
+        assertFalse(source.exhaustedPatternArmed().apply("sonnet"),
+                "a profile absent from config entirely must not report armed");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdExhaustionSinkWarningTest.java

@@ -0,0 +1,175 @@
+package dev.ltms.fleet;
+
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.inject.ExhaustionSink;
+import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import dev.ltms.fleet.placement.BackendQuarantine;
+import dev.ltms.fleet.session.SessionManager;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.slf4j.LoggerFactory;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.TimeUnit;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #446 follow-up (round 3): round 2's {@link FleetdUsageLimitFixWarningTest} calls {@link
+ * Fleetd#usageLimitFixWarning}/{@link Fleetd#usageLimitFixWarningNoModel} directly, which pins
+ * the two methods' TEXT but cannot see whether {@link Fleetd#exhaustionSink}'s {@code log.warn}
+ * call actually invokes either one, or invokes the right one. A mutation battery run against
+ * round 2's merge (1592 green tests) proved both gaps real:
+ *
+ * <ul>
+ *   <li><b>Cell A</b> — replacing the whole ternary result with a literal string
+ *       ({@code "usage-limit fix: MUTANT"}) left every test green;</li>
+ *   <li><b>Cell B</b> — swapping the ternary's two branches, so a profile WITH a {@code model:}
+ *       gets the no-model fallback message and vice versa, was measured unmeasured by the lead
+ *       but the existing test file shows no call that would notice it either.</li>
+ * </ul>
+ *
+ * <p>This class drives {@link Fleetd#exhaustionSink} — the actual factory {@code main} wires,
+ * since round 3's extraction pulled it out of the inline lambda for exactly this reason — and
+ * asserts on the REAL text a {@link ListAppender} attached to {@code Fleetd}'s own logger
+ * captures, mirroring {@code ExhaustedPatternGapReportTest}'s idiom. Chosen over a source-text
+ * assertion (the {@code FleetMcpAuthzTest} {@code everyRegisteredToolHasItsHandlerActionPinned}
+ * idiom) because that route can prove Cell A (the ternary is still there, still built from the
+ * two named methods) but not Cell B (which branch a given profile actually reaches) — this route
+ * answers both from one mechanism, since it reads what the sink actually logged for each shape of
+ * profile.
+ *
+ * <p>Each test filters for the WARN line starting {@code "usage-limit fix:"} specifically — {@link
+ * Fleetd#exhaustionSink} also logs a separate {@code "credential '...' quarantined for..."} WARN
+ * on every call, and asserting against the wrong one would pass or fail for the wrong reason. That
+ * prefix survives even under the M5 mutation above (the mutant keeps the tag, only the body
+ * becomes {@code "MUTANT"}), so the filter itself is not what either mutation defeats.
+ */
+class FleetdExhaustionSinkWarningTest {
+
+    private static final String YAML = """
+            bind:
+              host: 127.0.0.1
+              port: 8765
+            herdrSocket: ~/.config/herdr/herdr.sock
+            profiles:
+              terra:
+                baseUrl: http://gx00.gw:8000
+                model: claude-opus-5
+              gx:
+                baseUrl: http://gx00.gw:8000
+            guard:
+              offSubscriptionHosts:
+                - gx00.gw
+            """;
+
+    private static SessionManager emptyRosterSessions() {
+        FakeHerdr h = new FakeHerdr();
+        FleetConfig.Profile dummy = new FleetConfig.Profile(
+                "dummy", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN", null,
+                "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
+        ClaudeCodeLauncher launcher = new ClaudeCodeLauncher(new AgentControl(h), new WorkspaceControl(h),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(dummy.profile(), dummy), dummy.profile(), _ -> "tok");
+        // Never acquires a session — exhaustionSink's roster lookup is expected to miss and fall
+        // back to the profileHint argument, exactly like OpenCodeLauncher's real call site does
+        // (fleetd #234) — so the sink under test never needs a populated roster.
+        return new SessionManager(launcher);
+    }
+
+    private static ListAppender<ILoggingEvent> attach() {
+        Logger logger = (Logger) LoggerFactory.getLogger(Fleetd.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        return appender;
+    }
+
+    private static void detach(ListAppender<ILoggingEvent> appender) {
+        ((Logger) LoggerFactory.getLogger(Fleetd.class)).detachAppender(appender);
+    }
+
+    /** The one WARN line {@code exhaustionSink} builds from the ternary under test, or {@code null}. */
+    private static String fixWarning(ListAppender<ILoggingEvent> appender) {
+        List<String> warns = appender.list.stream()
+                .filter(e -> e.getLevel() == Level.WARN)
+                .map(ILoggingEvent::getFormattedMessage)
+                .filter(m -> m.startsWith("usage-limit fix:"))
+                .toList();
+        assertTrue(warns.size() == 1,
+                "expected exactly one 'usage-limit fix:' WARN per onExhausted call, got " + warns.size()
+                        + ": " + warns);
+        return warns.getFirst();
+    }
+
+    @Test
+    @DisplayName("a profile WITH a configured model gets the actionable models.allow fix, not the fallback")
+    void profileWithModelGetsTheActionableFix(@TempDir Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, YAML);
+        FleetConfig cfg = FleetConfig.load(file);
+        ConfigRef config = ConfigRef.fixed(cfg);
+        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
+        Map<String, String> reasonByCredential = new HashMap<>();
+        ExhaustionSink sink = Fleetd.exhaustionSink(emptyRosterSessions(), config, quarantine,
+                reasonByCredential, cfg);
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            sink.onExhausted("term_x", "The usage limit has been reached", "terra");
+        } finally {
+            detach(appender);
+        }
+
+        String warning = fixWarning(appender);
+        assertTrue(warning.contains("terra"), "must name the profile: " + warning);
+        assertTrue(warning.contains("claude-opus-5"), "must name the model: " + warning);
+        assertTrue(warning.contains("enabled: false"), "must name the action: " + warning);
+        assertTrue(warning.contains("models.allow"), "must name where the action goes: " + warning);
+        assertFalse(warning.contains("has no model: configured"),
+                "a profile WITH a model must not get the no-model fallback text: " + warning);
+    }
+
+    @Test
+    @DisplayName("a profile with NO configured model gets the fallback, never a fix that does not exist")
+    void profileWithNoModelGetsTheFallbackNotAFix(@TempDir Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, YAML);
+        FleetConfig cfg = FleetConfig.load(file);
+        ConfigRef config = ConfigRef.fixed(cfg);
+        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
+        Map<String, String> reasonByCredential = new HashMap<>();
+        ExhaustionSink sink = Fleetd.exhaustionSink(emptyRosterSessions(), config, quarantine,
+                reasonByCredential, cfg);
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            sink.onExhausted("term_y", "The usage limit has been reached", "gx");
+        } finally {
+            detach(appender);
+        }
+
+        String warning = fixWarning(appender);
+        assertTrue(warning.contains("gx"), "must name the profile: " + warning);
+        assertTrue(warning.contains("has no model: configured"),
+                "must say there is no model to gate by name: " + warning);
+        assertFalse(warning.contains("enabled: false"),
+                "a profile with no model: configured has no models.allow entry to flip — must "
+                        + "not claim one exists: " + warning);
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadMailboxSelectionTest.java

@@ -80,7 +80,7 @@ class FleetdLeadMailboxSelectionTest {
     @Test
     void opensTheMailboxWhenAUriAndSelfIdAreConfigured() {
         var opener = new RecordingOpener();
-        var coordinator = new FleetConfig.Coordinator(RESOLVED_URI, null, "mac-opus", null);
+        var coordinator = new FleetConfig.Coordinator(RESOLVED_URI, null, "mac-opus", null, null);
 
         Fleetd.openLeadMailbox(coordinator, Map.of(), opener);
 
@@ -94,7 +94,7 @@ class FleetdLeadMailboxSelectionTest {
     void honoursUriEnvOverALiteralUri() {
         var opener = new RecordingOpener();
         var coordinator = new FleetConfig.Coordinator("amqp://stale:stale@old:5672/x", "COORD_URI",
-                "mac-opus", 8);
+                "mac-opus", 8, null);
 
         Fleetd.openLeadMailbox(coordinator, Map.of("COORD_URI", RESOLVED_URI), opener);
 
@@ -105,7 +105,7 @@ class FleetdLeadMailboxSelectionTest {
     @Test
     void turnsOffWhenUriEnvDoesNotResolve() {
         var opener = new RecordingOpener();
-        var coordinator = new FleetConfig.Coordinator(null, "COORD_URI", "mac-opus", null);
+        var coordinator = new FleetConfig.Coordinator(null, "COORD_URI", "mac-opus", null, null);
 
         assertNull(Fleetd.openLeadMailbox(coordinator, Map.of(), opener));
 
@@ -116,7 +116,7 @@ class FleetdLeadMailboxSelectionTest {
     void warnsAndStaysOffWhenSelfIdIsMissing() {
         var appender = captureFleetdLogs();
         var opener = new RecordingOpener();
-        var coordinator = new FleetConfig.Coordinator(RESOLVED_URI, null, null, null);
+        var coordinator = new FleetConfig.Coordinator(RESOLVED_URI, null, null, null, null);
 
         assertNull(Fleetd.openLeadMailbox(coordinator, Map.of(), opener));
 
@@ -131,7 +131,7 @@ class FleetdLeadMailboxSelectionTest {
         var appender = captureFleetdLogs();
         var opener = new RecordingOpener();
         opener.unreachable = true;
-        var coordinator = new FleetConfig.Coordinator(RESOLVED_URI, null, "mac-opus", null);
+        var coordinator = new FleetConfig.Coordinator(RESOLVED_URI, null, "mac-opus", null, null);
 
         assertNull(Fleetd.openLeadMailbox(coordinator, Map.of(), opener),
                 "a down coordination broker turns the feature off; it must never take the daemon down");

fleetd/src/test/java/dev/ltms/fleet/FleetdModelGateCoverageLineTest.java

@@ -0,0 +1,62 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.peer.PeerLauncher;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.Set;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+
+/**
+ * fleetd #422 follow-up: {@code Fleetd.modelGateCoverageLine} is the startup-log counterpart of
+ * {@code exhaustedPatternCoverageLine}/{@code errorPatternCoverageLine} — see {@code
+ * FleetdPatternCoverageLineTest} for the identical shape this follows — except here there is no
+ * {@code UnsetMeaning} choice for a caller to get backwards: {@link
+ * PeerLauncher.ModelGateState#configured()} already states, unambiguously, whether an empty
+ * {@link PeerLauncher.ModelGateState#off()} means "no {@code models:} block to gate with at all"
+ * or "a block armed and currently reporting zero off". This class proves {@code
+ * modelGateCoverageLine} words those two states — plus the third, N off — distinctly, so a
+ * mutation that made it ignore {@code configured()} either way is caught here.
+ */
+class FleetdModelGateCoverageLineTest {
+
+    @Test
+    @DisplayName("no models: block reports not configured, distinct from armed-with-zero")
+    void noModelsBlockReportsNotConfigured() {
+        String line = Fleetd.modelGateCoverageLine(PeerLauncher.ModelGateState.notConfigured());
+        assertEquals("not configured (no models: block — nothing is gated, and nothing can be)", line);
+    }
+
+    @Test
+    @DisplayName("a models: block armed with nothing off reports armed, distinct from not configured")
+    void armedWithNothingOffReportsArmed() {
+        String line = Fleetd.modelGateCoverageLine(PeerLauncher.ModelGateState.armed(Set.of()));
+        assertEquals("armed (models: block present; 0 models currently turned off)", line);
+    }
+
+    @Test
+    @DisplayName("a models: block with N off names the off models")
+    void armedWithModelsOffNamesThem() {
+        String line = Fleetd.modelGateCoverageLine(
+                PeerLauncher.ModelGateState.armed(Set.of("deepseek-v4-flash", "claude-opus-9000")));
+        assertEquals("armed (2 model(s) turned off: [claude-opus-9000, deepseek-v4-flash])", line);
+    }
+
+    @Test
+    @DisplayName("the three states produce pairwise-distinct wording for the same empty-looking input")
+    void theThreeStatesProduceDistinctWording() {
+        String notConfigured = Fleetd.modelGateCoverageLine(PeerLauncher.ModelGateState.notConfigured());
+        String armedZero = Fleetd.modelGateCoverageLine(PeerLauncher.ModelGateState.armed(Set.of()));
+        String armedOne = Fleetd.modelGateCoverageLine(PeerLauncher.ModelGateState.armed(Set.of("x")));
+
+        // Pinned individually above; restated here so this test alone still catches a regression
+        // even if one of the three tests above were ever deleted — the exact FleetdPatternCoverageLineTest
+        // pattern, adapted from "two keys" to "three states of one gate".
+        assertNotEquals(notConfigured, armedZero,
+                "collapsing 'no models: block' into 'armed, zero off' is fleetd #422 follow-up's exact defect");
+        assertNotEquals(armedZero, armedOne);
+        assertNotEquals(notConfigured, armedOne);
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdPatternCoverageLineTest.java

@@ -0,0 +1,67 @@
+package dev.ltms.fleet;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.Set;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+
+/**
+ * fleetd #415 (review follow-up): {@code CompletionResolverTest} proves {@code coverage()} words
+ * {@code UnsetMeaning.OFF} and {@code UnsetMeaning.BUILT_IN_DEFAULT} correctly — but every one of
+ * those tests supplies the meaning itself. That proves the enum's wording, never that {@code
+ * Fleetd} pairs the right meaning with the right pattern key. That pairing is #415's actual
+ * defect: {@code coverage()} had no way to know what unset meant for its key, so the fix moved
+ * the fact to the caller — and nothing yet proved the caller states it correctly.
+ *
+ * <p><b>Measured or it didn't happen:</b> swapping the two {@code UnsetMeaning} arguments at
+ * {@code Fleetd}'s two coverage call sites — giving {@code exhaustedPattern} the built-in-default
+ * wording and {@code errorPattern} the off wording, #415's exact defect with the keys exchanged —
+ * compiled with 0 errors and left all 1506 existing tests green. This class exists to turn that
+ * swap red.
+ *
+ * <p>It calls {@link Fleetd#exhaustedPatternCoverageLine} and {@link Fleetd#errorPatternCoverageLine}
+ * directly rather than reading {@code Fleetd.java} as source text (the shape {@code
+ * FleetdCompletionResolverWiringTest} uses for a different wiring gap): those two methods are the
+ * extracted call sites {@code main} actually invokes, following the same {@code static} factory +
+ * dedicated-test pattern as {@link Fleetd#capacitySource} and {@link Fleetd#worktreeBranchLookup}.
+ */
+class FleetdPatternCoverageLineTest {
+
+    private static final Set<String> PROFILES = Set.of("terra", "gx10");
+
+    @Test
+    @DisplayName("exhaustedPatternCoverageLine says off when no profile configures exhaustedPattern")
+    void exhaustedPatternCoverageLineSaysOffWhenNoProfileConfiguresIt() {
+        assertEquals("off (no profile has an exhaustedPattern configured; profiles: [gx10, terra])",
+                Fleetd.exhaustedPatternCoverageLine(PROFILES, Set.of()));
+    }
+
+    @Test
+    @DisplayName("errorPatternCoverageLine says built-in default when no profile configures errorPattern")
+    void errorPatternCoverageLineSaysBuiltInDefaultWhenNoProfileConfiguresIt() {
+        assertEquals("built-in default for all profiles (no profile customises errorPattern; "
+                        + "profiles: [gx10, terra])",
+                Fleetd.errorPatternCoverageLine(PROFILES, Set.of()));
+    }
+
+    @Test
+    @DisplayName("the two keys produce different wording for the identical empty-coverage input")
+    void theTwoKeysProduceDifferentWordingForTheSameEmptyInput() {
+        String exhaustedLine = Fleetd.exhaustedPatternCoverageLine(PROFILES, Set.of());
+        String errorLine = Fleetd.errorPatternCoverageLine(PROFILES, Set.of());
+
+        // Pinned individually above; restated here so this test alone still catches a swap even
+        // if one of the two tests above were ever deleted.
+        assertEquals("off (no profile has an exhaustedPattern configured; profiles: [gx10, terra])",
+                exhaustedLine);
+        assertEquals("built-in default for all profiles (no profile customises errorPattern; "
+                        + "profiles: [gx10, terra])", errorLine);
+        assertNotEquals(exhaustedLine, errorLine,
+                "swapping which UnsetMeaning pairs with which pattern key at Fleetd's call sites "
+                        + "must be caught here — that pairing, not coverage()'s own wording in isolation, "
+                        + "is fleetd #415's actual defect");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdStartupReportTest.java

@@ -0,0 +1,79 @@
+package dev.ltms.fleet;
+
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
+import dev.ltms.fleet.config.FleetConfig;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.slf4j.LoggerFactory;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Proves {@link Fleetd#main(String[])} calls every startup report before validation aborts startup.
+ * The invalid non-loopback bind makes {@link FleetConfig#validateAll()} throw before {@code main}
+ * can open the herdr socket or bind a port. The fixture also triggers every report, so removing any
+ * one call from {@code main} leaves its expected log line absent.
+ */
+class FleetdStartupReportTest {
+
+    private static Level originalLevel;
+
+    private static ListAppender<ILoggingEvent> attach() {
+        Logger logger = (Logger) LoggerFactory.getLogger(Fleetd.class);
+        originalLevel = logger.getLevel();
+        logger.setLevel(Level.INFO);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        return appender;
+    }
+
+    private static void detach(ListAppender<ILoggingEvent> appender) {
+        Logger logger = (Logger) LoggerFactory.getLogger(Fleetd.class);
+        logger.detachAppender(appender);
+        logger.setLevel(originalLevel);
+    }
+
+    private static boolean contains(ListAppender<ILoggingEvent> appender, String fragment) {
+        return appender.list.stream()
+                .map(ILoggingEvent::getFormattedMessage)
+                .anyMatch(message -> message.contains(fragment));
+    }
+
+    @Test
+    void mainReportsEveryStartupGapBeforeValidationAborts(@TempDir Path dir) throws Exception {
+        Path config = dir.resolve("fleetd.yaml");
+        Files.writeString(config, """
+                bind:
+                  host: 0.0.0.0
+                  port: 8765
+                profiles:
+                  worker:
+                    baseUrl: https://llm.ltms.dev/v1
+                    gitTokenEnv: GITEA_TOKEN
+                """);
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            assertThrows(IllegalStateException.class, () -> Fleetd.main(new String[]{config.toString()}));
+        } finally {
+            detach(appender);
+        }
+
+        assertTrue(contains(appender, "startup git host GITEA_HOST:"),
+                "Fleetd.main must report the git host shape");
+        assertTrue(contains(appender, "member trust model: members run as the same OS user"),
+                "Fleetd.main must report the member trust model");
+        assertTrue(contains(appender, "memberCredentials: absent or empty"),
+                "Fleetd.main must report an absent memberCredentials policy");
+        assertTrue(contains(appender, "exhaustedPattern: profile(s) [worker] have no exhaustedPattern configured"),
+                "Fleetd.main must report profiles without exhaustedPattern");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdStartupValidationTest.java

@@ -0,0 +1,132 @@
+package dev.ltms.fleet;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * Proves the one thing no test proved before this ticket's follow-up: that {@code Fleetd.main}
+ * ITSELF — not a copy of its logic, not the validator called directly — still refuses to start on
+ * a bad config. Mutation testing found that deleting {@code cfg.validateAll();} (née six
+ * individual {@code cfg.validateXxx();} calls) from {@code Fleetd.main} left the full 1478-test
+ * suite green; every existing test called a validator directly and none exercised {@code
+ * Fleetd.main} as the caller. See {@code FleetConfigValidateAllTest} for why the fix collapses
+ * those six calls into one reflective {@link FleetConfig#validateAll()}, and {@code
+ * ConfigRefTest} for the equivalent proof on the {@link
+ * dev.ltms.fleet.config.ConfigRef#reload()} path.
+ *
+ * <p>This is deliberately the real {@code static void main(String[] args)} — package-private, so
+ * only a test in this package can call it, which is exactly what makes this proof strong: it is
+ * not a helper extracted for testability, it is the literal method {@code java -jar fleetd.jar}
+ * invokes. Every fixture below is otherwise-valid and fails exactly one validator, and — because
+ * {@link FleetConfig#validateAll()} runs immediately after {@code SubscriptionGuard.
+ * assertPrimaryClean}, before {@code main} opens the herdr socket, binds Javalin, or touches
+ * anything else with a real side effect — calling {@code Fleetd.main} with one of these configs is
+ * safe: it is guaranteed to throw before reaching any of that, precisely because the config is
+ * deliberately invalid.
+ */
+class FleetdStartupValidationTest {
+
+    private static void assertMainRefuses(Path dir, String fileName, String yaml,
+                                           String mustContain) throws Exception {
+        Path f = dir.resolve(fileName);
+        Files.writeString(f, yaml);
+        IllegalStateException e = assertThrows(IllegalStateException.class,
+                () -> Fleetd.main(new String[]{f.toString()}),
+                fileName + ": Fleetd.main must refuse this config before doing anything else");
+        assertTrue(e.getMessage().contains(mustContain),
+                fileName + ": expected message to contain \"" + mustContain + "\" but was: "
+                        + e.getMessage());
+    }
+
+    @Test
+    void mainRefusesANonLoopbackBindWithoutTokenMode(@TempDir Path dir) throws Exception {
+        assertMainRefuses(dir, "auth-exposure.yaml", """
+                bind:
+                  host: 0.0.0.0
+                  port: 8765
+                """, "auth.mode: token");
+    }
+
+    @Test
+    void mainRefusesALeadTabPrefixCollision(@TempDir Path dir) throws Exception {
+        assertMainRefuses(dir, "lead-tab-prefixes.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                fleet:
+                  tabLabel: "lead: {role} {profile}"
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """, "fleet.tabLabel");
+    }
+
+    @Test
+    void mainRefusesASubscriptionProfileThatReseatsAnthropicBaseUrl(@TempDir Path dir)
+            throws Exception {
+        assertMainRefuses(dir, "subscription-profiles.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                profiles:
+                  sonnet:
+                    subscription: true
+                    argv: ["ccs", "sonnet"]
+                    env:
+                      ANTHROPIC_BASE_URL: http://anything-not-on-the-allowlist
+                """, "ANTHROPIC_BASE_URL");
+    }
+
+    @Test
+    void mainRefusesAnUnknownCharterKey(@TempDir Path dir) throws Exception {
+        assertMainRefuses(dir, "charters.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                fleet:
+                  charters:
+                    architetc: text
+                """, "architetc");
+    }
+
+    @Test
+    void mainRefusesAnArchitectSlotNamingAnUnconfiguredProfile(@TempDir Path dir) throws Exception {
+        assertMainRefuses(dir, "members.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                profiles:
+                  gx10:
+                    baseUrl: http://gx10.gw:8000
+                fleet:
+                  architects:
+                    lead-designer:
+                      profile: sonnet
+                """, "lead-designer");
+    }
+
+    @Test
+    void mainRefusesAProfileNamingAModelOutsideTheAllowList(@TempDir Path dir) throws Exception {
+        assertMainRefuses(dir, "models.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                profiles:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                    model: claude-sonnet-5
+                  rogue:
+                    baseUrl: http://gx11.gw:8000
+                    model: claude-opus-9000
+                models:
+                  allow:
+                    - model: claude-sonnet-5
+                """, "rogue");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdUsageLimitFixWarningTest.java

@@ -0,0 +1,75 @@
+package dev.ltms.fleet;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #446 follow-up (criterion 2): {@code exhaustionSink} used to build the "name the fix"
+ * WARNING inline with two SLF4J {@code {}}-placeholder {@code log.warn} calls. Nothing pinned
+ * that text — a mutation battery run against the merged PR #457 proved it: renaming the leading
+ * {@code "usage-limit fix:"} tag to {@code "MUTANT no fix named:"} at both call sites left all
+ * 1586 existing tests green. This class is what makes that mutation red.
+ *
+ * <p>{@link Fleetd#usageLimitFixWarning} and {@link Fleetd#usageLimitFixWarningNoModel} are the
+ * extracted call sites {@code exhaustionSink} actually invokes — {@code log.warn} is called with
+ * each method's return value as a single, already-formatted argument, so the string these tests
+ * assert on is byte-identical to what {@code fleetd.out} receives. Same extracted-static-method +
+ * dedicated-test idiom as {@link Fleetd#exhaustedPatternCoverageLine} /
+ * {@link FleetdPatternCoverageLineTest}, chosen over the {@link ch.qos.logback.core.read.ListAppender}
+ * idiom {@code ExhaustedPatternGapReportTest} uses — this warning is built once, at one call site,
+ * from a single method with no branching inside the message itself, so there is no real log
+ * plumbing left to prove; capturing an appender would only add setup/teardown around the same
+ * assertion.
+ *
+ * <p>Each assertion below checks for a specific substring — the leading {@code "usage-limit fix:"}
+ * tag an operator would grep the log for, the profile name, the model name, and the literal
+ * action ({@code enabled: false} under {@code models.allow}) — rather than the whole sentence.
+ * Criterion 2 promised those facts, not a particular wording of the prose that carries them; a
+ * whole-sentence {@code assertEquals} breaks on every copy-edit of that surrounding prose and
+ * teaches the next person to delete the test rather than read why it failed. The leading tag is
+ * pinned on purpose, unlike the rest of the sentence: it is the identifying label the fleetd #446
+ * follow-up's own mutation battery renamed ({@code "usage-limit fix:"} → {@code "MUTANT no fix
+ * named:"}) to prove this class did not yet catch a tag rename — only the three-fact substrings
+ * above would have missed it, since none of them mention the tag itself.
+ */
+class FleetdUsageLimitFixWarningTest {
+
+    @Test
+    @DisplayName("usageLimitFixWarning names the profile, the model, and the models.allow fix")
+    void usageLimitFixWarningNamesProfileModelAndFix() {
+        String warning = Fleetd.usageLimitFixWarning("terra", "claude-opus-5");
+
+        assertTrue(warning.startsWith("usage-limit fix:"),
+                "must carry the grep-able identifying tag: " + warning);
+        assertTrue(warning.contains("terra"), "must name the profile: " + warning);
+        assertTrue(warning.contains("claude-opus-5"), "must name the model: " + warning);
+        assertTrue(warning.contains("enabled: false"), "must name the action: " + warning);
+        assertTrue(warning.contains("models.allow"), "must name where the action goes: " + warning);
+    }
+
+    @Test
+    @DisplayName("usageLimitFixWarning does not cross-name a different profile or model")
+    void usageLimitFixWarningDoesNotCrossName() {
+        String warning = Fleetd.usageLimitFixWarning("terra", "claude-opus-5");
+
+        // Guards against the mutation of swapping the two profile/model arguments at the call
+        // site — a test that only checks "some name appears" cannot catch that.
+        assertTrue(!warning.contains("sonnet"), "must not name an unrelated model: " + warning);
+    }
+
+    @Test
+    @DisplayName("usageLimitFixWarningNoModel names the profile but no fix, since none exists")
+    void usageLimitFixWarningNoModelNamesProfileNotAFix() {
+        String warning = Fleetd.usageLimitFixWarningNoModel("gx", 1800);
+
+        assertTrue(warning.startsWith("usage-limit fix:"),
+                "must carry the grep-able identifying tag: " + warning);
+        assertTrue(warning.contains("gx"), "must name the profile: " + warning);
+        assertTrue(warning.contains("1800"), "must name the quarantine duration it falls back to: " + warning);
+        assertTrue(!warning.contains("enabled: false"),
+                "a profile with no model: configured has no models.allow entry to flip — the "
+                        + "fallback message must not claim one exists: " + warning);
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/GitHostShapeReportTest.java

@@ -0,0 +1,241 @@
+package dev.ltms.fleet;
+
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
+import dev.ltms.fleet.config.FleetConfig;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.slf4j.LoggerFactory;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #377: the startup git host line must report the <em>shape</em> of the value a
+ * member receives as GITEA_HOST — set or unset, length, scheme, trailing slash — and the
+ * value itself must never reach the log.
+ */
+class GitHostShapeReportTest {
+
+    /** A profile that opts in to the git-forge token, so GITEA_HOST is the var that matters. */
+    private static final String GIT_TOKEN_CONFIG = """
+            profiles:
+              local:
+                baseUrl: http://gx00.gw:8000
+                gitTokenEnv: WORKER_GITEA_TOKEN
+            """;
+
+    private static FleetConfig load(Path dir, String yaml) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml);
+        return FleetConfig.load(f);
+    }
+
+    /**
+     * The level this logger had before {@link #attach()} raised it, so {@link #detach} can put it
+     * back. {@code null} is a real value here — it means "inherit from the parent" — and that is
+     * exactly the state this logger starts in, so it must be restored as {@code null} rather than
+     * as some concrete level.
+     */
+    private static Level originalLevel;
+
+    /**
+     * fleetd #377: the shape lines are logged at INFO, and {@code logback-test.xml} sets
+     * {@code dev.ltms.fleet} to WARN — so INFO events are dropped by the level check BEFORE any
+     * appender sees them. Attaching an appender is therefore not enough: without raising the level
+     * the list stays empty and every assertion below fails against correct production code. The
+     * sibling report tests do the same thing at each call site (see
+     * {@code MemberTrustModelReportTest}); doing it here keeps it in one place.
+     */
+    private static ListAppender<ILoggingEvent> attach() {
+        Logger logger = (Logger) LoggerFactory.getLogger(Fleetd.class);
+        originalLevel = logger.getLevel();
+        logger.setLevel(Level.INFO);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        return appender;
+    }
+
+    private static void detach(ListAppender<ILoggingEvent> appender) {
+        Logger logger = (Logger) LoggerFactory.getLogger(Fleetd.class);
+        logger.detachAppender(appender);
+        logger.setLevel(originalLevel);
+    }
+
+    private static List<String> messages(ListAppender<ILoggingEvent> appender) {
+        return appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList();
+    }
+
+    @Test
+    void setLineReportsLengthSchemeAndTrailingSlash(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = load(dir, GIT_TOKEN_CONFIG);
+        String value = "https://git.example.test/";
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            Fleetd.reportGitHostShape(cfg, Map.of("GITEA_HOST", value));
+        } finally {
+            detach(appender);
+        }
+
+        String expected = "startup git host GITEA_HOST: set (profile 'local' gitHostEnv) — "
+                + "length=" + value.length() + ", startsWithScheme=true, trailingSlash=true";
+        assertTrue(messages(appender).contains(expected),
+                "a value with a scheme and a trailing slash must be reported by shape only: "
+                        + "its length, startsWithScheme=true, trailingSlash=true");
+    }
+
+    @Test
+    void bareHostLineReportsNoSchemeNoTrailingSlash(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = load(dir, GIT_TOKEN_CONFIG);
+        String value = "git.example.test";
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            Fleetd.reportGitHostShape(cfg, Map.of("GITEA_HOST", value));
+        } finally {
+            detach(appender);
+        }
+
+        String expected = "startup git host GITEA_HOST: set (profile 'local' gitHostEnv) — "
+                + "length=" + value.length() + ", startsWithScheme=false, trailingSlash=false";
+        assertTrue(messages(appender).contains(expected),
+                "a bare host name must report startsWithScheme=false, trailingSlash=false");
+    }
+
+    @Test
+    void unsetVariableIsLoggedAtInfoAndDoesNotThrow(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = load(dir, GIT_TOKEN_CONFIG);
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            // GITEA_HOST absent from the map entirely — the unset case must not throw.
+            Fleetd.reportGitHostShape(cfg, Map.of());
+        } finally {
+            detach(appender);
+        }
+
+        assertTrue(appender.list.stream().anyMatch(e ->
+                        e.getLevel() == Level.INFO
+                                && e.getFormattedMessage()
+                                    .startsWith("startup git host GITEA_HOST: unset (profile 'local' gitHostEnv)")),
+                "an unset git host is useful information, not an error — say it at INFO level");
+    }
+
+    /**
+     * The important test: the value must NEVER appear in the log output. This test fails if the
+     * line is ever changed to include the value, because it drives the real logging path with a
+     * value that carries a marker no shape field could contain.
+     */
+    @Test
+    void theValueNeverAppearsInLogOutput(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = load(dir, GIT_TOKEN_CONFIG);
+        String marker = "never-logged-host-shape-377";
+        String value = "https://" + marker + "/";
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            Fleetd.reportGitHostShape(cfg, Map.of("GITEA_HOST", value));
+        } finally {
+            detach(appender);
+        }
+
+        List<String> msgs = messages(appender);
+        assertFalse(msgs.stream().anyMatch(m -> m.contains(value)),
+                "the full GITEA_HOST value must never reach the log");
+        assertFalse(msgs.stream().anyMatch(m -> m.contains(marker)),
+                "no fragment of the value may reach the log — a line that embeds the value"
+                        + " would leak at least this marker");
+        assertTrue(msgs.stream().anyMatch(m -> m.contains("startsWithScheme=true")
+                        && m.contains("trailingSlash=true")),
+                "the shape must still be reported although the value is not");
+    }
+
+    @Test
+    void unsetReportAlsoCarriesNoValue(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = load(dir, GIT_TOKEN_CONFIG);
+        // A blank value is not injected either (putIfPresent skips it), so it must report unset
+        // without echoing anything of it.
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            Fleetd.reportGitHostShape(cfg, Map.of("GITEA_HOST", "  "));
+        } finally {
+            detach(appender);
+        }
+
+        assertTrue(messages(appender).stream().anyMatch(m ->
+                        m.startsWith("startup git host GITEA_HOST: unset")),
+                "a blank value is skipped by the launcher, so the line reports unset");
+    }
+
+    @Test
+    void defaultGitHostEnvIsGITEA_HOST(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = load(dir, GIT_TOKEN_CONFIG);
+
+        assertEquals(Map.of("GITEA_HOST", List.of("profile 'local' gitHostEnv")),
+                Fleetd.gitHostEnvVars(cfg));
+    }
+
+    @Test
+    void explicitGitHostEnvReportsUnderItsOwnName(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = load(dir, """
+                profiles:
+                  local:
+                    baseUrl: http://gx00.gw:8000
+                    gitTokenEnv: WORKER_GITEA_TOKEN
+                    gitHostEnv: MY_FORGE_HOST
+                """);
+        String value = "https://forge.example.test/";
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            Fleetd.reportGitHostShape(cfg, Map.of("MY_FORGE_HOST", value));
+        } finally {
+            detach(appender);
+        }
+
+        assertTrue(messages(appender).contains(
+                        "startup git host MY_FORGE_HOST: set (profile 'local' gitHostEnv) — "
+                                + "length=" + value.length()
+                                + ", startsWithScheme=true, trailingSlash=true"),
+                "an explicitly named gitHostEnv is reported under that name");
+    }
+
+    @Test
+    void noGitTokenMeansNoHostLineIsNeeded(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = load(dir, """
+                profiles:
+                  local:
+                    baseUrl: http://gx00.gw:8000
+                """);
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            Fleetd.reportGitHostShape(cfg, Map.of());
+        } finally {
+            detach(appender);
+        }
+
+        assertEquals(List.of("startup git host: no profile sets a gitTokenEnv — nothing to check"),
+                messages(appender));
+    }
+
+    @Test
+    void aHostWithAPortIsNotTreatedAsAScheme() {
+        assertFalse(Fleetd.startsWithScheme("git.example.test"));
+        assertFalse(Fleetd.startsWithScheme("git.example.test:3000"));
+        assertFalse(Fleetd.startsWithScheme("git.example.test:3000/"));
+        assertTrue(Fleetd.startsWithScheme("https://git.example.test"));
+        assertTrue(Fleetd.startsWithScheme("https://git.example.test:3000/"));
+        assertTrue(Fleetd.startsWithScheme("ssh://git.example.test"));
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/auth/AuthzTest.java

@@ -113,6 +113,20 @@ class AuthzTest {
         assertTrue(Authz.permits(WORKER_A, METRICS, null));
     }
 
+    /**
+     * fleetd #421 — unlike READ (the case above), COORD_READ (a lead's own held peer mail) is the
+     * primary's alone. A worker or an architect reading it would disclose lead-to-lead
+     * coordination bodies, not the secret-free roster READ is open about.
+     */
+    @Test
+    void coordReadIsThePrimarysAloneNotAWidenedRead() {
+        assertTrue(Authz.permits(PRIMARY, COORD_READ, null));
+        assertFalse(Authz.permits(WORKER_A, COORD_READ, null),
+                "a worker must not read held lead-to-lead mail");
+        assertFalse(Authz.permits(ARCH_DESIGN, COORD_READ, null),
+                "an architect holds READ today, but not-primary must mean not-architect here too");
+    }
+
     @Test
     void unauthenticatedIsDistinguishedFromMerelyForbidden() {
         // Drives the 401-vs-403 split: a missing credential is fixable by the caller, a wrong role

fleetd/src/test/java/dev/ltms/fleet/auth/MemberRegistryLiveTest.java

@@ -0,0 +1,360 @@
+package dev.ltms.fleet.auth;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.PaneLocator;
+import dev.ltms.fleet.mcp.ConnectionIdentity;
+import dev.ltms.fleet.peer.MemberRole;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * fleetd #424 — revoking (or granting) an architect slot must take effect on the next spawn with
+ * no restart. A session already bound to a slot keeps its <em>binding</em> (the {@code
+ * terminalToSlot} occupancy) even after that slot drops out of config, but NOT the ARCHITECT
+ * <em>privilege</em> the slot used to grant — that is revoked on the bound session's very next
+ * request. See {@link MemberRegistry}'s class doc for the exact rule: "config governs what a
+ * bound slot still grants, as well as what may be bound next."
+ *
+ * <p>Every test here drives a REAL {@link ConfigRef#reload()} against a {@code @TempDir} file and
+ * asserts {@link ConfigRef.Outcome#applied()}, rather than comparing two frozen
+ * {@code MemberRegistry} instances in memory — the defect this ticket fixes is specifically that
+ * {@link MemberRegistry} used to ignore a live reload, so a test that never reloads cannot tell the
+ * fixed registry from the broken one. {@code requireSlotFor} and {@code reserve} are pinned in
+ * separate tests, in both directions (removed and added), so a registry that simply refuses (or
+ * simply allows) everything cannot pass by accident — see {@link MemberRegistryTest} for the
+ * registry's other invariants (bind/unbind cardinality, thread-safety), which are unaffected by
+ * this ticket and still exercised against the frozen constructor.
+ */
+class MemberRegistryLiveTest {
+
+    private static String yaml(String fleetBlock) {
+        return """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                herdrSocket: ~/.config/herdr/herdr.sock
+                profiles:
+                  sonnet:
+                    baseUrl: http://gx00.gw:8000
+                    model: sonnet
+                  opus:
+                    baseUrl: http://gx00.gw:8001
+                    model: opus
+                guard:
+                  offSubscriptionHosts:
+                    - gx00.gw
+                """ + fleetBlock;
+    }
+
+    private static final String WITH_SONNET_SLOT = """
+            fleet:
+              architects:
+                designer:
+                  profile: sonnet
+            """;
+
+    /** No architect pool at all — developers is unrelated dead data for this registry (#424 out of scope). */
+    private static final String WITHOUT_ARCHITECT_SLOTS = """
+            fleet:
+              developers:
+                dev1:
+                  profile: sonnet
+            """;
+
+    /** Same slot name ({@code designer}) as {@link #WITH_SONNET_SLOT}, repointed to a different profile. */
+    private static final String WITH_OPUS_SLOT = """
+            fleet:
+              architects:
+                designer:
+                  profile: opus
+            """;
+
+    /** Same profile ({@code sonnet}) as {@link #WITH_SONNET_SLOT}, but the pool key is renamed. */
+    private static final String WITH_RENAMED_SLOT = """
+            fleet:
+              architects:
+                architect-lead:
+                  profile: sonnet
+            """;
+
+    private static ConfigRef refFor(Path f) {
+        return new ConfigRef(f, FleetConfig.load(f));
+    }
+
+    // ── requireSlotFor is live (criteria 1, 2, 4) ──────────────────────────────────────────────
+
+    @Test
+    void requireSlotForRefusesAProfileWhoseSlotWasRemovedByReload(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml(WITH_SONNET_SLOT));
+        ConfigRef ref = refFor(f);
+        MemberRegistry registry = MemberRegistry.live(() -> ref.get().fleet());
+
+        assertDoesNotThrow(() -> registry.requireSlotFor(MemberRole.ARCHITECT, "sonnet"),
+                "the slot is configured before the reload");
+
+        Files.writeString(f, yaml(WITHOUT_ARCHITECT_SLOTS));
+        ConfigRef.Outcome out = ref.reload();
+        assertTrue(out.applied(), "the reload must actually take effect: " + out.summary());
+
+        assertThrows(IllegalArgumentException.class,
+                () -> registry.requireSlotFor(MemberRole.ARCHITECT, "sonnet"),
+                "revoking the slot must refuse the NEXT spawn that names it");
+    }
+
+    @Test
+    void requireSlotForAllowsAProfileWhoseSlotWasAddedByReload(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml(WITHOUT_ARCHITECT_SLOTS));
+        ConfigRef ref = refFor(f);
+        MemberRegistry registry = MemberRegistry.live(() -> ref.get().fleet());
+
+        assertThrows(IllegalArgumentException.class,
+                () -> registry.requireSlotFor(MemberRole.ARCHITECT, "sonnet"),
+                "no architect slot is configured yet");
+
+        Files.writeString(f, yaml(WITH_SONNET_SLOT));
+        ConfigRef.Outcome out = ref.reload();
+        assertTrue(out.applied(), "the reload must actually take effect: " + out.summary());
+
+        assertDoesNotThrow(() -> registry.requireSlotFor(MemberRole.ARCHITECT, "sonnet"),
+                "a slot added by reload must be usable with no restart");
+    }
+
+    // ── reserve is live too — tested separately from requireSlotFor (criteria 1, 2, 4) ────────
+
+    @Test
+    void reserveRefusesAProfileWhoseSlotWasRemovedByReload(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml(WITH_SONNET_SLOT));
+        ConfigRef ref = refFor(f);
+        MemberRegistry registry = MemberRegistry.live(() -> ref.get().fleet());
+
+        MemberLifecycle.SlotReservation before = registry.reserve(MemberRole.ARCHITECT, "sonnet");
+        assertEquals("architect:designer", before.slot());
+        registry.release(before); // free it back up so the reload-side reserve below starts clean
+
+        Files.writeString(f, yaml(WITHOUT_ARCHITECT_SLOTS));
+        ConfigRef.Outcome out = ref.reload();
+        assertTrue(out.applied(), "the reload must actually take effect: " + out.summary());
+
+        assertThrows(IllegalArgumentException.class,
+                () -> registry.reserve(MemberRole.ARCHITECT, "sonnet"),
+                "revoking the slot must refuse the NEXT reservation for it");
+    }
+
+    @Test
+    void reserveAllowsAProfileWhoseSlotWasAddedByReload(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml(WITHOUT_ARCHITECT_SLOTS));
+        ConfigRef ref = refFor(f);
+        MemberRegistry registry = MemberRegistry.live(() -> ref.get().fleet());
+
+        assertThrows(IllegalArgumentException.class,
+                () -> registry.reserve(MemberRole.ARCHITECT, "sonnet"),
+                "no architect slot is configured yet");
+
+        Files.writeString(f, yaml(WITH_SONNET_SLOT));
+        ConfigRef.Outcome out = ref.reload();
+        assertTrue(out.applied(), "the reload must actually take effect: " + out.summary());
+
+        MemberLifecycle.SlotReservation after = registry.reserve(MemberRole.ARCHITECT, "sonnet");
+        assertEquals("architect:designer", after.slot(),
+                "a slot added by reload must be reservable with no restart");
+    }
+
+    // ── profileForSlot, isSlot and nameForSlot are live too (fleetd #431) ─────────────────────────
+    // #424 pinned roleForSlot against a live reload but left these three untested — proved by
+    // mutating each to read a snapshot flattened once at construction: the full suite stayed green
+    // for all three.
+    //
+    // The three differ in how much production behaviour depends on them, and the ticket first got
+    // this ranking wrong. nameForSlot is wired: CallerResolver passes members::nameForSlot, next to
+    // members::roleForSlot. isSlot is reached through bind, which calls it to refuse an unknown
+    // slot. profileForSlot has NO caller in src/main at all — grepped both the ".profileForSlot("
+    // and the "::profileForSlot" form — so there is no seam to drive its test through beyond the
+    // accessor itself, and its own javadoc ("what the spawn lifecycle reads") describes a caller
+    // that does not exist. These tests pin the accessors as they are; whether profileForSlot should
+    // be wired or deleted is a separate question.
+
+    @Test
+    void profileForSlotReflectsAProfileChangedByReload(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml(WITH_SONNET_SLOT));
+        ConfigRef ref = refFor(f);
+        MemberRegistry registry = MemberRegistry.live(() -> ref.get().fleet());
+
+        assertEquals("sonnet", registry.profileForSlot("architect:designer"),
+                "the slot's profile before the reload");
+
+        Files.writeString(f, yaml(WITH_OPUS_SLOT));
+        ConfigRef.Outcome out = ref.reload();
+        assertTrue(out.applied(), "the reload must actually take effect: " + out.summary());
+
+        assertEquals("opus", registry.profileForSlot("architect:designer"),
+                "repointing the slot to a different profile must take effect with no restart");
+    }
+
+    @Test
+    void isSlotStopsReportingASlotRemovedByReload(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml(WITH_SONNET_SLOT));
+        ConfigRef ref = refFor(f);
+        MemberRegistry registry = MemberRegistry.live(() -> ref.get().fleet());
+
+        assertTrue(registry.isSlot("architect:designer"), "the slot is configured before the reload");
+
+        Files.writeString(f, yaml(WITHOUT_ARCHITECT_SLOTS));
+        ConfigRef.Outcome out = ref.reload();
+        assertTrue(out.applied(), "the reload must actually take effect: " + out.summary());
+
+        assertFalse(registry.isSlot("architect:designer"),
+                "removing the slot from config must make isSlot say so on the very next call, "
+                        + "with no restart");
+    }
+
+    @Test
+    void isSlotStartsReportingASlotAddedByReload(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml(WITHOUT_ARCHITECT_SLOTS));
+        ConfigRef ref = refFor(f);
+        MemberRegistry registry = MemberRegistry.live(() -> ref.get().fleet());
+
+        assertFalse(registry.isSlot("architect:designer"), "no architect slot is configured yet");
+
+        Files.writeString(f, yaml(WITH_SONNET_SLOT));
+        ConfigRef.Outcome out = ref.reload();
+        assertTrue(out.applied(), "the reload must actually take effect: " + out.summary());
+
+        assertTrue(registry.isSlot("architect:designer"),
+                "a slot added by reload must be visible to isSlot with no restart");
+    }
+
+    @Test
+    void nameForSlotReflectsANameChangedByReload(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml(WITH_SONNET_SLOT));
+        ConfigRef ref = refFor(f);
+        MemberRegistry registry = MemberRegistry.live(() -> ref.get().fleet());
+
+        assertEquals("designer", registry.nameForSlot("architect:designer"),
+                "the configured name before the reload");
+
+        Files.writeString(f, yaml(WITH_RENAMED_SLOT));
+        ConfigRef.Outcome out = ref.reload();
+        assertTrue(out.applied(), "the reload must actually take effect: " + out.summary());
+
+        assertNull(registry.nameForSlot("architect:designer"),
+                "the old key no longer names a configured slot — it was renamed away by the reload");
+        assertEquals("architect-lead", registry.nameForSlot("architect:architect-lead"),
+                "the new name must be visible under its new qualified key with no restart");
+    }
+
+    // ── a bound architect is demoted, but the binding itself is not touched (fleetd #424) ───────
+    // The lead's corrected ruling: the PRIVILEGE a slot grants is revoked on the bound session's
+    // very next request, but the terminalToSlot BINDING itself is untouched by a reload — dropping
+    // it would double-book the slot key and break unbind's compare-safe contract. See the class
+    // doc's binding rule.
+
+    /** A caller identity resolving the one canned pane (terminal {@code term_a}) in {@link FakeHerdr}. */
+    private static ConnectionIdentity boundPaneIdentity() {
+        return new ConnectionIdentity(new PaneLocator(new FakeHerdr()), _ -> FakeHerdr.WORKER_PID);
+    }
+
+    @Test
+    void anArchitectAlreadyBoundToASlotIsDemotedByReload(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml(WITH_SONNET_SLOT));
+        ConfigRef ref = refFor(f);
+        MemberRegistry registry = MemberRegistry.live(() -> ref.get().fleet());
+
+        MemberLifecycle.SlotReservation reservation = registry.reserve(MemberRole.ARCHITECT, "sonnet");
+        assertTrue(registry.bind(reservation, "term_a"));
+        assertEquals("architect:designer", registry.slotForTerminal("term_a"));
+
+        // Drive the real caller path, not the roleForSlot seam directly: CallerResolver.resolve is
+        // what a live request actually goes through (CallerResolver.java:220), and a resolver that
+        // ignored roleForSlot entirely would still pass a test that only checked the seam.
+        CallerResolver resolver = CallerResolver.withLeadsAndMembers(
+                boundPaneIdentity(), false, null, Map::of, registry);
+
+        Principal before = resolver.resolve("127.0.0.1", 42, null);
+        assertEquals(Role.ARCHITECT, before.role(), "sanity check: the harness binds term_a as an architect");
+        assertEquals("designer", before.name());
+
+        Files.writeString(f, yaml(WITHOUT_ARCHITECT_SLOTS));
+        ConfigRef.Outcome out = ref.reload();
+        assertTrue(out.applied(), "the reload must actually take effect: " + out.summary());
+
+        Principal after = resolver.resolve("127.0.0.1", 42, null);
+        assertEquals(Role.WORKER, after.role(),
+                "removing the slot from config must demote the bound session to worker on its "
+                        + "NEXT request — this is the ticket's whole point");
+        assertEquals("term_a", after.terminal(), "same pane, same terminal — only the role changed");
+    }
+
+    @Test
+    void theOriginalBindingStillOccupiesTheRemovedSlotSoASecondTerminalCannotClaimIt(@TempDir Path dir)
+            throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml(WITH_SONNET_SLOT));
+        ConfigRef ref = refFor(f);
+        MemberRegistry registry = MemberRegistry.live(() -> ref.get().fleet());
+
+        MemberLifecycle.SlotReservation reservation = registry.reserve(MemberRole.ARCHITECT, "sonnet");
+        assertTrue(registry.bind(reservation, "term_a"));
+
+        Files.writeString(f, yaml(WITHOUT_ARCHITECT_SLOTS));
+        ConfigRef.Outcome removed = ref.reload();
+        assertTrue(removed.applied(), "the reload must actually take effect: " + removed.summary());
+
+        // The binding survives the removal untouched.
+        assertEquals("architect:designer", registry.slotForTerminal("term_a"),
+                "a live binding must never be retroactively unbound by a config edit");
+        assertEquals(Map.of("term_a", "architect:designer"), registry.snapshot());
+
+        // Bring the slot back into config. If the binding had been silently dropped by the removal
+        // (rather than merely losing the privilege it grants), a second terminal could now claim
+        // the "freed" key — the exact double-booking the class doc's binding rule rules out.
+        Files.writeString(f, yaml(WITH_SONNET_SLOT));
+        ConfigRef.Outcome restored = ref.reload();
+        assertTrue(restored.applied(), "the reload must actually take effect: " + restored.summary());
+
+        assertFalse(registry.bind("architect:designer", "term_b"),
+                "the slot is still occupied by term_a — a second terminal must not bind to it");
+        assertThrows(IllegalArgumentException.class,
+                () -> registry.reserve(MemberRole.ARCHITECT, "sonnet"),
+                "the slot is still occupied by term_a — a fresh reservation must not find it free");
+        assertEquals("architect:designer", registry.slotForTerminal("term_a"),
+                "the original binding is unchanged throughout");
+    }
+
+    @Test
+    void unbindStillSucceedsForTheOriginalTerminalAfterItsSlotIsRemoved(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml(WITH_SONNET_SLOT));
+        ConfigRef ref = refFor(f);
+        MemberRegistry registry = MemberRegistry.live(() -> ref.get().fleet());
+
+        MemberLifecycle.SlotReservation reservation = registry.reserve(MemberRole.ARCHITECT, "sonnet");
+        assertTrue(registry.bind(reservation, "term_a"));
+
+        Files.writeString(f, yaml(WITHOUT_ARCHITECT_SLOTS));
+        ConfigRef.Outcome out = ref.reload();
+        assertTrue(out.applied(), "the reload must actually take effect: " + out.summary());
+
+        assertTrue(registry.unbind("architect:designer", "term_a"),
+                "unbind must still work for a slot that config has since removed, or a session "
+                        + "that outlives its slot's removal could never release it");
+        assertNull(registry.slotForTerminal("term_a"));
+        assertEquals(Map.of(), registry.snapshot());
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/config/ConfigRefProfileCoverageTest.java

@@ -161,7 +161,15 @@ class ConfigRefProfileCoverageTest {
         // the #323 bug. Only ideProjectDir and worktreeGroup were saved by a behavioural test in
         // ConfigRefTest; the other two had none. So: growing this set now requires editing this
         // line as well, which is a visible, deliberate diff rather than a quiet one.
-        assertEquals(Set.of("weight", "maxLoad", "credentialId"), excluded,
+        //
+        // fleetd #446: "exhaustedPattern" joined the set legitimately — it moved from compiled
+        // once at Fleetd.main startup to read live, cached by profile name, through
+        // LiveExhaustedPatterns (see that class's doc and ConfigRef's class doc). Unlike the #323
+        // hazard this comment warns about, it is pinned by its OWN behavioural tests:
+        // FleetdExhaustionDetectionArmedWiringTest proves the reload takes effect with no restart,
+        // and the same test rerun against the pre-#446 compile site (see that ticket's report) is
+        // what proves the assertion would have failed before the fix.
+        assertEquals(Set.of("weight", "maxLoad", "credentialId", "exhaustedPattern"), excluded,
                 "ConfigRef.LAUNCH_SETTINGS_EXCLUDED changed. A component belongs in it ONLY if it "
                         + "is read live off the config supplier, not baked into a launcher at "
                         + "startup. If you are adding one to silence this test, that is fleetd #323 "

fleetd/src/test/java/dev/ltms/fleet/config/ConfigRefTest.java

@@ -339,12 +339,18 @@ class ConfigRefTest {
     }
 
     /**
-     * CB-578 stage B: exhaustedPattern is compiled once into Fleetd.main's pattern map at startup
-     * (see ExhaustedPatternLookup), so a reload never re-reads it — a changed pattern must be
-     * reported deferred exactly like model/baseUrl, not silently claimed as applied.
+     * fleetd #446: exhaustedPattern moved from deferred to hot — {@code LiveExhaustedPatterns}
+     * reads {@code config.get()} fresh on every lookup, cached by profile name (not baked into a
+     * frozen map inside {@code Fleetd.main} any more, the way it was before this ticket, and the
+     * way its sibling {@code errorPattern} still is — see
+     * {@code changingAProfilesErrorPatternIsReportedAsDeferred} right below for the contrast).
+     * So a reload that changes ONLY exhaustedPattern must report a plain "config reloaded", with
+     * nothing deferred — the opposite of what this test asserted before fleetd #446, when
+     * ConfigRef.sameLaunchSettings still compared exhaustedPattern and this reload reported it as
+     * one of the changes needing a restart.
      */
     @Test
-    void changingAProfilesExhaustedPatternIsReportedAsDeferred(@TempDir Path dir) throws Exception {
+    void changingAProfilesExhaustedPatternTakesEffectWithNoRestart(@TempDir Path dir) throws Exception {
         Path f = dir.resolve("fleetd.yaml");
         Files.writeString(f, """
                 bind:
@@ -379,17 +385,21 @@ class ConfigRefTest {
         ConfigRef.Outcome out = ref.reload();
 
         assertTrue(out.applied());
-        assertEquals(1, out.deferred().size(), out.deferred().toString());
-        assertTrue(out.deferred().getFirst().contains("sonnet"), out.deferred().toString());
-        assertTrue(out.deferred().getFirst().contains("launch settings"), out.deferred().toString());
-        // The snapshot still carries the new value — a restart is what makes it take effect.
+        assertEquals(0, out.deferred().size(),
+                "exhaustedPattern is hot since fleetd #446 — changing only this key must not be "
+                        + "reported as needing a restart: " + out.deferred());
+        assertEquals(0, out.split().size(), out.split().toString());
+        assertEquals("config reloaded", out.summary());
+        // The snapshot carries the new value immediately — this IS the live value now, not
+        // merely what a restart would eventually pick up.
         assertEquals("rate limit exceeded", ref.get().profiles().get("sonnet").exhaustedPattern());
     }
 
     /**
      * fleetd #201 Unit 5: errorPattern is compiled once into Fleetd.main's backend-error pattern
-     * map at startup (see BackendErrorPatternLookup), the same way exhaustedPattern is above — a
-     * reload never re-reads it either, so a changed value must be reported deferred.
+     * map at startup (see BackendErrorPatternLookup) — unlike its sibling exhaustedPattern above,
+     * which fleetd #446 made hot, errorPattern was scoped OUT of that ticket on purpose and stays
+     * deferred: a reload still never re-reads it, so a changed value must be reported deferred.
      */
     @Test
     void changingAProfilesErrorPatternIsReportedAsDeferred(@TempDir Path dir) throws Exception {

fleetd/src/test/java/dev/ltms/fleet/config/ConfigRefTopLevelCoverageTest.java

@@ -79,6 +79,14 @@ class ConfigRefTopLevelCoverageTest {
      *   <li>{@code memberCredentials} — read live at {@code Fleetd.java:198, 205, 729}.</li>
      *   <li>{@code memberLoginShell} — read live at
      *       {@code HerdrPeerLauncher#configuredMemberLoginShell}.</li>
+     *   <li>{@code models} (fleetd #422) — membership is re-validated in full against the fresh
+     *       config on every {@code ConfigRef.reload()} (via {@code FleetConfig#validateAll()}), so
+     *       a bad edit is refused, never cached stale; the on/off half is read live by {@code
+     *       CompositePeerLauncher.enforceModelEnabled} and its candidate filter, and by {@code
+     *       fleet_profiles}/{@code GET /profiles} through {@code PeerLauncher.disabledModels()}.
+     *       Unlike {@code fleet} below, nothing about {@code models} is baked into a startup-built
+     *       object anywhere — there is no frozen half, so it belongs here whole rather than in
+     *       {@code SPLIT_KEYS}.</li>
      * </ul>
      *
      * <p>{@code fleet} used to sit here too, on the strength of most of it (role pools, charters,
@@ -93,7 +101,7 @@ class ConfigRefTopLevelCoverageTest {
      * while this test stayed green throughout.</p>
      */
     private static final Set<String> HOT_EXCLUDED_TOP_LEVEL_KEYS =
-            Set.of("placement", "memberCredentials", "memberLoginShell");
+            Set.of("placement", "memberCredentials", "memberLoginShell", "models");
 
     @Test
     void everyTopLevelComponentIsAccountedForInExactlyOneClass() {
@@ -120,7 +128,7 @@ class ConfigRefTopLevelCoverageTest {
 
         // The escape hatch is pinned. Growing it requires editing this line — a visible, deliberate
         // diff, not a quiet one. See the field javadoc above for what "belongs here" actually means.
-        assertEquals(Set.of("placement", "memberCredentials", "memberLoginShell"), hot,
+        assertEquals(Set.of("placement", "memberCredentials", "memberLoginShell", "models"), hot,
                 "HOT_EXCLUDED_TOP_LEVEL_KEYS changed. A component belongs here ONLY if it is read "
                         + "live off the config supplier, never because adding it makes this test "
                         + "pass. If you are adding one to silence this test, that is fleetd #323 "

fleetd/src/test/java/dev/ltms/fleet/config/ConfigRefTopLevelReportingCoverageTest.java

@@ -104,9 +104,13 @@ class ConfigRefTopLevelReportingCoverageTest {
         v.put("configReload", new FleetConfig.ConfigReload(true, 10));
         v.put("quarantineCooldownSeconds", 1800);
         v.put("memberCredentials", null);
-        v.put("coordinator", new FleetConfig.Coordinator("amqp://coord-a", null, "self-a", 1));
+        v.put("coordinator", new FleetConfig.Coordinator("amqp://coord-a", null, "self-a", 1, null));
         v.put("worktreeGroup", "group-a");
         v.put("memberLoginShell", null);
+        v.put("memberSkills", "/skills/a");
+        v.put("idleSleepGuard", new FleetConfig.IdleSleepGuard(true));
+        v.put("models", new FleetConfig.Models(
+                List.of(new FleetConfig.Models.ModelEntry("model-a"))));
         assertNamesMatchComponents(v);
         return v;
     }
@@ -144,9 +148,13 @@ class ConfigRefTopLevelReportingCoverageTest {
         v.put("configReload", new FleetConfig.ConfigReload(false, 20));
         v.put("quarantineCooldownSeconds", 3600);
         v.put("memberCredentials", null);
-        v.put("coordinator", new FleetConfig.Coordinator("amqp://coord-b", null, "self-b", 2));
+        v.put("coordinator", new FleetConfig.Coordinator("amqp://coord-b", null, "self-b", 2, null));
         v.put("worktreeGroup", "group-b");
         v.put("memberLoginShell", null);
+        v.put("memberSkills", "/skills/b");
+        v.put("idleSleepGuard", new FleetConfig.IdleSleepGuard(false));
+        v.put("models", new FleetConfig.Models(
+                List.of(new FleetConfig.Models.ModelEntry("model-b"))));
         assertNamesMatchComponents(v);
         return v;
     }

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigProfileWithProfilePreservesEveryComponentTest.java

@@ -0,0 +1,172 @@
+package dev.ltms.fleet.config;
+
+import org.junit.jupiter.api.Test;
+
+import java.lang.reflect.Constructor;
+import java.lang.reflect.RecordComponent;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.TreeSet;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * Fleetd #358, the same "defect factory" #357 guarded on {@code FleetConfig.withDefaults()}
+ * (see {@code FleetConfigWithDefaultsPreservesEveryComponentTest}), reproduced here on
+ * {@link FleetConfig.Profile}. {@code Profile} carries a long back-compat constructor ladder — 8
+ * constructors, re-counted directly against the source rather than trusted from the ticket, at
+ * arities 25, 24, 22, 20, 18, 15, 14 and 12, against a canonical arity of 26 — and exactly ONE
+ * rebuild site, {@link FleetConfig.Profile#withProfile(String)}, whose own
+ * {@code return new Profile(...)} call is written at a literal 26-arg count. Add a 27th component
+ * and its established back-compat constructor at the old (26-arg) arity, and {@code withProfile}'s
+ * own call becomes a legal match for that new overload — silently dropping the new component every
+ * time a profile's name is defaulted from its {@code workers:} key.
+ *
+ * <p>Builds one {@link FleetConfig.Profile} through the TRUE canonical constructor — resolved by
+ * the record's own component types via {@code getDeclaredConstructor}, never by argument count —
+ * with a real, distinctive, non-null value in every component, calls {@link
+ * FleetConfig.Profile#withProfile(String)}, and asserts every component except {@code profile}
+ * itself survives unchanged, while {@code profile} comes back as the new name it was given.
+ *
+ * <p>Every value here is chosen so {@code Profile}'s own compact constructor (which normalizes
+ * several components — defaults {@code argv}/{@code kind}/{@code placement}/{@code workspace}/
+ * {@code gitHostEnv}, nulls a handful of blank-checked strings, clamps {@code weight}, coerces
+ * {@code subscription}) leaves it unchanged: every String is non-blank and already in the shape the
+ * compact constructor would otherwise coerce it to (e.g. {@code placement} is already lowercase),
+ * and every collection is non-empty. That is what makes "must survive unchanged" a valid assertion
+ * for every component below, the same reasoning {@code FleetConfigWithDefaultsPreservesEveryComponentTest}
+ * documents for {@code withDefaults()}.
+ *
+ * <p>{@link #EXCLUDED_FROM_SURVIVAL_CHECK} is kept deliberately empty and size-pinned by
+ * {@link #exclusionListSizeIsPinned()} — a checker whose escape hatch can grow to silence a failure
+ * is not a checker. Every one of {@code Profile}'s 26 current components has a real, non-null,
+ * non-blank value here and none is excluded.
+ */
+class FleetConfigProfileWithProfilePreservesEveryComponentTest {
+
+    private static final RecordComponent[] COMPONENTS = FleetConfig.Profile.class.getRecordComponents();
+
+    /** Deliberately empty today; grow it only with a matching justification, and re-pin the size. */
+    private static final Set<String> EXCLUDED_FROM_SURVIVAL_CHECK = Set.of();
+
+    /** One real, distinctive, non-null value per component, chosen to survive the compact ctor. */
+    private static Map<String, Object> baseValues() {
+        Map<String, Object> v = new LinkedHashMap<>();
+        v.put("profile", "profile-guard");
+        v.put("baseUrl", "https://guard.example/base");
+        v.put("model", "model-guard");
+        v.put("configDir", "/config/guard");
+        v.put("tokenEnv", "GUARD_TOKEN");
+        v.put("argv", List.of("guard-cmd"));
+        v.put("placement", "guard-placement");
+        v.put("workspace", "workspace-guard");
+        v.put("tabLabel", "tab-guard");
+        v.put("mcpUrl", "https://mcp.guard/");
+        v.put("cwd", "/cwd/guard");
+        v.put("parityOverlay", List.of(".guardrc"));
+        v.put("gitTokenEnv", "GUARD_GIT_TOKEN");
+        v.put("gitHostEnv", "GUARD_GIT_HOST");
+        v.put("kind", "claude-code");
+        v.put("env", Map.of("GUARD_ENV", "1"));
+        v.put("weight", 2.5f);
+        v.put("maxLoad", 4);
+        v.put("subscription", Boolean.TRUE);
+        v.put("exhaustedPattern", "pattern-guard");
+        v.put("credentialId", "cred-guard");
+        v.put("ideMcpUrl", "https://ide.guard/");
+        v.put("ideProjectDir", "ide-project-guard");
+        v.put("ideOpenCommand", "open-guard {dir}");
+        v.put("autoCompactWindow", 150_000);
+        v.put("errorPattern", "error-pattern-guard");
+        assertNamesMatchComponents(v);
+        return v;
+    }
+
+    /**
+     * Guards {@link #baseValues()} itself against drifting from the record's real shape — forgetting
+     * to add a new component here fails this assertion by name, rather than silently checking one
+     * component fewer than the record has.
+     */
+    private static void assertNamesMatchComponents(Map<String, Object> values) {
+        Set<String> names = new TreeSet<>();
+        for (RecordComponent rc : COMPONENTS) {
+            names.add(rc.getName());
+        }
+        assertEquals(names, new TreeSet<>(values.keySet()),
+                "this test's value map has drifted from FleetConfig.Profile's actual components — "
+                        + "update baseValues() alongside the record");
+    }
+
+    /**
+     * Builds a {@link FleetConfig.Profile} through the TRUE canonical constructor — resolved by the
+     * record's own component types, not by argument count — so this never accidentally exercises a
+     * back-compat overload the way a literal {@code new Profile(...)} call risks doing.
+     */
+    private static FleetConfig.Profile profileOf(Map<String, Object> values) throws ReflectiveOperationException {
+        Class<?>[] types = Arrays.stream(COMPONENTS).map(RecordComponent::getType).toArray(Class<?>[]::new);
+        Object[] args = Arrays.stream(COMPONENTS).map(rc -> values.get(rc.getName())).toArray();
+        Constructor<FleetConfig.Profile> ctor = FleetConfig.Profile.class.getDeclaredConstructor(types);
+        return ctor.newInstance(args);
+    }
+
+    @Test
+    void exclusionListSizeIsPinned() {
+        assertEquals(0, EXCLUDED_FROM_SURVIVAL_CHECK.size(),
+                "EXCLUDED_FROM_SURVIVAL_CHECK grew from 0 — every entry needs a justification in "
+                        + "this test class's javadoc AND this assertion re-pinned to the new size; a "
+                        + "growing exclusion list that silences failures on its own is not a guard");
+    }
+
+    /**
+     * The mutation this is built to catch: make {@code withProfile(String)}'s final constructor call
+     * literal at some arg count, add one more component to the record with a new back-compat
+     * constructor at the old arity, and the stale call silently rebinds. Every component here is real
+     * and non-null/non-blank, so none of it should be replaced by {@code withProfile}, except
+     * {@code profile} itself, which the method is documented to replace.
+     */
+    @Test
+    void withProfilePreservesEveryOtherComponent() throws ReflectiveOperationException {
+        Map<String, Object> base = baseValues();
+        FleetConfig.Profile profile = profileOf(base);
+        FleetConfig.Profile renamed = profile.withProfile("renamed-profile-guard");
+
+        List<String> dropped = new ArrayList<>();
+        int checked = 0;
+        for (RecordComponent rc : COMPONENTS) {
+            String name = rc.getName();
+            if (EXCLUDED_FROM_SURVIVAL_CHECK.contains(name)) {
+                continue;
+            }
+            checked++;
+            Object expected = "profile".equals(name) ? "renamed-profile-guard" : base.get(name);
+            Object actual;
+            try {
+                actual = rc.getAccessor().invoke(renamed);
+            } catch (ReflectiveOperationException e) {
+                throw new RuntimeException("failed to read FleetConfig.Profile." + name + "()", e);
+            }
+            if (!Objects.equals(expected, actual)) {
+                dropped.add(String.format(Locale.ROOT,
+                        "%s: withProfile() was expected to carry (%s) for '%s' but returned %s — a "
+                                + "component silently dropped by withProfile(), the shape of the "
+                                + "defect this test exists to catch (its final \"return new "
+                                + "Profile(...)\" call binding to a back-compat constructor instead "
+                                + "of the true canonical one)",
+                        name, expected, name, actual));
+            }
+        }
+
+        System.out.printf(Locale.ROOT,
+                "FleetConfig.Profile.withProfile() component-survival coverage — %d components, %d "
+                        + "checked, %d excluded, %d survived%n",
+                COMPONENTS.length, checked, EXCLUDED_FROM_SURVIVAL_CHECK.size(), checked - dropped.size());
+        assertEquals(List.of(), dropped,
+                "withProfile() silently dropped these components: " + dropped);
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java

@@ -1189,7 +1189,7 @@ class FleetConfigTest {
     @Test
     void coordinatorEffectiveUriHonorsUriEnv() {
         FleetConfig.Coordinator withEnv = new FleetConfig.Coordinator(
-                "amqp://stale-clear-text@127.0.0.1:5672/coord", "LEAD_COORD_URI", "fleet01-lead", null);
+                "amqp://stale-clear-text@127.0.0.1:5672/coord", "LEAD_COORD_URI", "fleet01-lead", null, null);
 
         assertEquals("amqp://from-env@127.0.0.1:5672/coord",
                 withEnv.effectiveUri(Map.of("LEAD_COORD_URI", "amqp://from-env@127.0.0.1:5672/coord")),
@@ -1200,12 +1200,61 @@ class FleetConfigTest {
                 "a blank uriEnv variable must not fall back to the literal uri");
 
         FleetConfig.Coordinator noEnv = new FleetConfig.Coordinator(
-                "amqp://guest:guest@127.0.0.1:5672/coord", null, null, null);
+                "amqp://guest:guest@127.0.0.1:5672/coord", null, null, null, null);
         assertEquals("amqp://guest:guest@127.0.0.1:5672/coord", noEnv.effectiveUri(Map.of()),
                 "the literal uri is used when no uriEnv is configured");
         assertEquals(LeadMailbox.DEFAULT_PREFETCH, noEnv.prefetchOrDefault());
     }
 
+    /**
+     * fleetd #361: the live block ships as just {@code uriEnv} + {@code selfId} (see
+     * {@code Fleetd.example.yaml} / the operator's real {@code fleetd.yaml}, gitignored). That exact
+     * shape, with no {@code peers:} key at all, must keep parsing unchanged after this field is added.
+     */
+    @Test
+    void coordinatorBlockWithNoPeersKeyStillParses(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("coordinator-no-peers.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                coordinator:
+                  uriEnv: COORD_AMQP_URI
+                  selfId: mac
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertNotNull(cfg.coordinator());
+        assertEquals("mac", cfg.coordinator().selfId());
+        assertEquals(List.of(), cfg.coordinator().peers(), "no peers: key means no configured peers, never null");
+    }
+
+    @Test
+    void coordinatorPeersParsesAndDropsBlankEntries(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("coordinator-peers.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                coordinator:
+                  selfId: mac
+                  uri: amqp://guest:guest@127.0.0.1:5672/coord
+                  peers:
+                    - fleet01
+                    - ""
+                    - fleet02
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertEquals(List.of("fleet01", "fleet02"), cfg.coordinator().peers(),
+                "a blank peer entry must be dropped, never kept as an empty coord-id");
+    }
+
+    @Test
+    void coordinatorPeersDefaultsToEmptyWhenConstructedWithNull() {
+        FleetConfig.Coordinator c = new FleetConfig.Coordinator(
+                "amqp://guest:guest@127.0.0.1:5672/coord", null, "mac", null, null);
+        assertEquals(List.of(), c.peers(), "a null peers list must default to empty, never NPE downstream");
+    }
+
     @Test
     void absentWorktreeGroupLeavesItNull(@TempDir Path dir) throws Exception {
         Path f = dir.resolve("no-worktree-group.yaml");
@@ -2580,4 +2629,391 @@ class FleetConfigTest {
                 "with no pool to choose from, every configured profile is a candidate and the "
                         + "first one wins");
     }
+
+    // ── idle-sleep guard: default-on config block ───────────────────────────────────────────────
+
+    @Test
+    void idleSleepGuardIsOnByDefaultWhenTheBlockIsEntirelyAbsent(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8080
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertNull(cfg.idleSleepGuard(), "an absent block parses to null, unlike most other blocks here");
+        // The block itself is absent, but the FEATURE stays on: Fleetd treats a null block the
+        // same as enabled: true (see FleetConfig.idleSleepGuard's javadoc) — this test only pins
+        // the parse result, the on-by-default behaviour is Fleetd's own null check.
+    }
+
+    @Test
+    void idleSleepGuardExplicitlyEnabledIsOn(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                idleSleepGuard:
+                  enabled: true
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertTrue(cfg.idleSleepGuard().isEnabled());
+    }
+
+    @Test
+    void idleSleepGuardExplicitlyDisabledIsOff(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                idleSleepGuard:
+                  enabled: false
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertFalse(cfg.idleSleepGuard().isEnabled());
+    }
+
+    @Test
+    void idleSleepGuardBlockPresentButEmptyDefaultsToEnabled(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                idleSleepGuard: {}
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertTrue(cfg.idleSleepGuard().isEnabled(),
+                "unlike ConfigReload/Health, this block defaults to ON even when present but empty");
+    }
+
+    // --- models: central allow-list of usable models -----------------------------------------
+
+    /**
+     * An absent {@code models:} block is today's behaviour exactly: no profile's {@code model:} is
+     * checked against anything, whatever it says. This is the "existing config keeps working"
+     * invariant — an operator on a gitignored {@code fleetd.yaml} that predates this feature must
+     * not be broken by upgrading the daemon.
+     */
+    @Test
+    void absentModelsBlockValidatesNothing(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    baseUrl: http://gx10.gw:8000
+                    model: totally-unheard-of-model-xyz
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertDoesNotThrow(cfg::validateModels);
+    }
+
+    /**
+     * {@code models:} present but with an empty (or absent) {@code allow:} must behave exactly like
+     * the block being absent — an operator adding the block for the first time with nothing in it
+     * yet must not be surprised by every profile suddenly refusing to start.
+     */
+    @Test
+    void modelsBlockPresentButEmptyValidatesNothing(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    baseUrl: http://gx10.gw:8000
+                    model: whatever-the-operator-typed
+                models:
+                  allow: []
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertDoesNotThrow(cfg::validateModels);
+    }
+
+    /**
+     * The core of the ticket: a profile naming a model outside the configured allow-list fails
+     * config load, naming both the model and the profile that wanted it.
+     */
+    @Test
+    void aProfileNamingAModelOutsideTheAllowListRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                    model: claude-sonnet-5
+                  rogue:
+                    baseUrl: http://gx11.gw:8000
+                    model: claude-opus-9000
+                models:
+                  allow:
+                    - model: claude-sonnet-5
+                    - model: claude-haiku-5
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateModels);
+        assertTrue(e.getMessage().contains("rogue"), "the refusal names the offending profile");
+        assertTrue(e.getMessage().contains("claude-opus-9000"), "the refusal names the offending model");
+        assertFalse(e.getMessage().contains("'sonnet'"),
+                "the profile whose model IS allowed must not be reported");
+    }
+
+    /** A profile whose {@code model:} is on the allow-list loads fine. */
+    @Test
+    void aProfileNamingAModelOnTheAllowListLoadsFine(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                    model: claude-sonnet-5
+                models:
+                  allow:
+                    - model: claude-sonnet-5
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertDoesNotThrow(cfg::validateModels);
+    }
+
+    /**
+     * A profile that never sets {@code model:} (a {@code subscription: true} profile relying on the
+     * account's own default is the live example) must not be refused just because an allow-list is
+     * active — there is nothing to check it against.
+     */
+    @Test
+    void aProfileWithNoModelPassesEvenWithAnActiveAllowList(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  opus:
+                    subscription: true
+                models:
+                  allow:
+                    - model: claude-sonnet-5
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertDoesNotThrow(cfg::validateModels);
+    }
+
+    /**
+     * Reproduces the live config shape this ticket measured: a mix of {@code amazon-bedrock},
+     * {@code opencode} and {@code openai}-backed profiles, some naming a bare Claude id and some a
+     * provider-prefixed opencode id, in ONE allow-list. Both forms are just opaque strings compared
+     * for exact equality — proves the shape decision holds against the shape actually seen live,
+     * not just against a synthetic single-provider example.
+     */
+    @Test
+    void aBareClaudeIdAndAnOpencodeProviderPrefixedIdBothFitOneAllowList(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                    model: claude-sonnet-5
+                  terra:
+                    kind: opencode
+                    model: openai/gpt-5.6-terra
+                  nova:
+                    kind: opencode
+                    model: amazon-bedrock/amazon.nova-pro-v1:0
+                models:
+                  allow:
+                    - model: claude-sonnet-5
+                    - model: openai/gpt-5.6-terra
+                    - model: amazon-bedrock/amazon.nova-pro-v1:0
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertDoesNotThrow(cfg::validateModels);
+    }
+
+    /** The same live shape, but one opencode profile's model is missing from the allow-list. */
+    @Test
+    void anUnlistedOpencodeProviderPrefixedModelRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                    model: claude-sonnet-5
+                  terra:
+                    kind: opencode
+                    model: openai/gpt-5.6-terra-withdrawn
+                models:
+                  allow:
+                    - model: claude-sonnet-5
+                    - model: openai/gpt-5.6-terra
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateModels);
+        assertTrue(e.getMessage().contains("terra"), "the refusal names the offending profile");
+        assertTrue(e.getMessage().contains("openai/gpt-5.6-terra-withdrawn"),
+                "the refusal names the offending model, with its provider prefix intact");
+    }
+
+    /**
+     * Editing a {@code profiles:} entry alone must never be able to widen what is permitted — only
+     * editing {@code models.allow:} itself can. This is the invariant the ticket states explicitly;
+     * this test pins it by giving a profile a plausible-looking model that was never added to the
+     * allow-list and confirming it is still refused.
+     */
+    @Test
+    void addingAProfileCannotWidenTheAllowListByItself(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                    model: claude-sonnet-5
+                  brand-new:
+                    baseUrl: http://gx12.gw:8000
+                    model: claude-sonnet-6-preview
+                models:
+                  allow:
+                    - model: claude-sonnet-5
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateModels);
+        assertTrue(e.getMessage().contains("brand-new"));
+        assertTrue(e.getMessage().contains("claude-sonnet-6-preview"));
+    }
+
+    /** {@code models} is a brand-new top-level key and must be recognized, not WARN-ed as unknown. */
+    @Test
+    void modelsIsAKnownTopLevelKey() {
+        assertTrue(FleetConfig.KNOWN_TOP_LEVEL_KEYS.contains("models"));
+    }
+
+    // --- fleetd #422: model on/off (spawn-time gate + hot reload) -----------------------------
+
+    /**
+     * Criterion 3: an {@code allow:} entry written before {@code enabled:} existed — no such key in
+     * the YAML at all — must behave exactly as it always did: on, and absent from {@link
+     * FleetConfig.Models#offIds()}. This is the old-style fixture the ticket asks for, proven
+     * through a real YAML load rather than only through the {@code ModelEntry(String)} back-compat
+     * constructor.
+     */
+    @Test
+    void anOldStyleAllowEntryWithNoEnabledFieldStaysOn(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                    model: claude-sonnet-5
+                models:
+                  allow:
+                    - model: claude-sonnet-5
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertDoesNotThrow(cfg::validateModels);
+        assertTrue(cfg.models().ids().contains("claude-sonnet-5"), "membership is unaffected");
+        assertTrue(cfg.models().offIds().isEmpty(), "no enabled: field ⇒ nothing is off");
+    }
+
+    /**
+     * Criterion 7 (the whole point of the ticket, mirroring criterion 3's shape): a profile naming a
+     * model that is turned off ({@code enabled: false}) must still be VALID config —
+     * {@code validateModels()} checks membership only, never the on/off state, so it must not throw.
+     * Collapsing "off" into "removed from allow:" would make this test fail, which is exactly the
+     * design trap the ticket calls out.
+     */
+    @Test
+    void anOffModelIsStillValidConfigForValidateModels(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  local:
+                    baseUrl: http://local.gw:8000
+                    model: deepseek-v4-flash
+                models:
+                  allow:
+                    - model: deepseek-v4-flash
+                      enabled: false
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertDoesNotThrow(cfg::validateModels,
+                "an off model must stay a valid allow-list member — only the spawn gate reads enabled");
+        assertTrue(cfg.models().ids().contains("deepseek-v4-flash"));
+        assertTrue(cfg.models().offIds().contains("deepseek-v4-flash"));
+    }
+
+    /**
+     * Criterion 8: one {@code enabled: false} entry names a model, not a profile — every profile
+     * naming that model is off, on purpose (the live example: {@code deepseek-v4-flash} backs both
+     * {@code local} and {@code local-direct}). Proven here at the {@code Models}/config-load level;
+     * {@code CompositePeerLauncherTest} proves the spawn-time consequence for both profiles.
+     */
+    @Test
+    void turningOffOneModelIsIndependentOfHowManyProfilesNameIt(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  local:
+                    baseUrl: http://local.gw:8000
+                    model: deepseek-v4-flash
+                  local-direct:
+                    baseUrl: http://local.gw:8001
+                    model: deepseek-v4-flash
+                models:
+                  allow:
+                    - model: deepseek-v4-flash
+                      enabled: false
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertDoesNotThrow(cfg::validateModels);
+        // One allow-list entry, one off id — the fan-out to both profiles happens at the reader
+        // (CompositePeerLauncher), not by duplicating the entry per profile.
+        assertEquals(Set.of("deepseek-v4-flash"), cfg.models().offIds());
+        assertEquals("deepseek-v4-flash", cfg.profiles().get("local").model());
+        assertEquals("deepseek-v4-flash", cfg.profiles().get("local-direct").model());
+    }
+
+    /** An {@code enabled: true} entry (explicit, not just absent) also stays on — not just null. */
+    @Test
+    void explicitlyEnabledTrueStaysOn(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                    model: claude-sonnet-5
+                models:
+                  allow:
+                    - model: claude-sonnet-5
+                      enabled: true
+                """);
+
+        FleetConfig cfg = FleetConfig.load(f);
+        assertTrue(cfg.models().offIds().isEmpty());
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigValidateAllTest.java

@@ -0,0 +1,358 @@
+package dev.ltms.fleet.config;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.lang.reflect.Method;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+import java.util.TreeSet;
+
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * The gap this class exists to close: mutation testing on the fleetd ticket "central allow-list
+ * of usable models" found that although {@link FleetConfig#validateModels()}'s own logic was well
+ * pinned, nothing proved either real caller ({@code Fleetd.main} and {@link ConfigRef#reload()})
+ * still invoked it — deleting the call site left the full suite green (1478/0/0/0). A follow-up
+ * measurement (same technique — remove one call site, run the suite, not read the code) found the
+ * SAME gap for all five of {@link FleetConfig}'s other validators at startup, and for four of the
+ * six inside {@link ConfigRef#reload()}. This is a class of gap, not one line's mistake: every one
+ * of those thirteen tests called the validator itself directly, never the real caller that was
+ * supposed to.
+ *
+ * <p>The fix replaces the six individual {@code cfg.validateXxx()} calls at each of the two real
+ * call sites with one {@link FleetConfig#validateAll()}, which reaches every validator by
+ * reflection rather than by a hand-maintained list of names. A hand-maintained list of six names
+ * would have exactly the defect it replaces: the seventh validator someone adds next month has no
+ * reason to be added to it, and nothing would say so. This class proves TWO separate claims, and
+ * keeps them separate on purpose:
+ *
+ * <ol>
+ *   <li>{@link #theSweepMechanismIsGenericNotHardcodedToFleetConfigsSixNames()} and its neighbours
+ *       prove the reflective sweep itself ({@link FleetConfig#invokeAllValidators}) is a general
+ *       mechanism — it runs whatever public, no-arg, void {@code validateXxx()} methods a class
+ *       happens to declare today, including a class with more of them than {@link FleetConfig}
+ *       has right now. This is the proof that a future, real seventh validator on {@link
+ *       FleetConfig} would be swept automatically, without needing to add a real (unwanted)
+ *       seventh validator just to exercise the claim.</li>
+ *   <li>{@link #validateAllReachesEveryOneOfTodaysSixValidators()} proves {@link
+ *       FleetConfig#validateAll()} itself is wired to that same generic mechanism and genuinely
+ *       reaches each of today's six real validators — reusing the exact minimal failing
+ *       configurations {@code FleetConfigTest} already established for each one directly, so a
+ *       single call to {@code validateAll()} is shown to reproduce every one of those six
+ *       failures.</li>
+ * </ol>
+ *
+ * <p>Together with the direct-{@code Fleetd.main}-invocation tests in {@code
+ * FleetdStartupValidationTest} (which prove the real startup call site still calls {@code
+ * validateAll()}) and the {@code ConfigRefTest} reload tests (which prove the same for {@link
+ * ConfigRef#reload()}), removing {@code cfg.validateAll();} from either real call site now fails
+ * a test in this module.
+ *
+ * <p><b>What is NOT pinned, measured rather than assumed.</b> Reverting {@link
+ * FleetConfig#validateAll()} to a hardcoded list of today's six method calls leaves the whole
+ * suite green (measured at review: 1491 tests, 0 failures). Nothing ties {@code validateAll()} to
+ * the generic sweep — claim 1 proves {@link FleetConfig#invokeAllValidators} is generic, and claim
+ * 2 proves {@code validateAll()} reaches today's six, and a hardcoded list satisfies both. So the
+ * reflective sweep is a convenience, not the guarantee. The guarantee is {@link
+ * #fleetConfigDeclaresExactlyTheseSixValidatorsToday()}: it fails the moment a seventh validator
+ * is declared, which forces whoever adds it to look at this file.
+ */
+class FleetConfigValidateAllTest {
+
+    // ── Claim 1: the reflective sweep is a general mechanism, not six names in disguise ──────────
+
+    /**
+     * A throwaway fixture class, unrelated to {@link FleetConfig} in every way except shape: three
+     * public, no-arg, void methods named {@code validateXxx}. Proves the sweep works on ANY class
+     * with this shape, not on something special-cased to {@link FleetConfig}.
+     */
+    static class ThreeValidators {
+        final List<String> ran = new ArrayList<>();
+
+        public void validateAlpha() {
+            ran.add("validateAlpha");
+        }
+
+        public void validateBeta() {
+            ran.add("validateBeta");
+        }
+
+        public void validateGamma() {
+            ran.add("validateGamma");
+        }
+    }
+
+    @Test
+    void theSweepMechanismIsGenericNotHardcodedToFleetConfigsSixNames() {
+        ThreeValidators target = new ThreeValidators();
+        FleetConfig.invokeAllValidators(target);
+        assertEquals(List.of("validateAlpha", "validateBeta", "validateGamma"), target.ran,
+                "every validateXxx() method on this unrelated class must run, in alphabetical "
+                        + "order — the sweep reads the class's own shape, not a name FleetConfig "
+                        + "happens to know about");
+    }
+
+    /**
+     * The core of the "self-maintaining" requirement: the exact same class shape as {@link
+     * ThreeValidators}, plus one more method — standing in for "a developer adds a validator next
+     * month". Nothing about the sweep changes to pick it up; the new method is invoked purely
+     * because it exists and matches the shape. This is what makes adding a seventh real validator
+     * to {@link FleetConfig} safe without touching {@link FleetConfig#validateAll()} or either
+     * call site — there is no "wire it in" step left to forget.
+     */
+    static class FourValidators {
+        final List<String> ran = new ArrayList<>();
+
+        public void validateAlpha() {
+            ran.add("validateAlpha");
+        }
+
+        public void validateBeta() {
+            ran.add("validateBeta");
+        }
+
+        public void validateGamma() {
+            ran.add("validateGamma");
+        }
+
+        public void validateDelta() {
+            ran.add("validateDelta");
+        }
+    }
+
+    @Test
+    void addingAFourthValidatorMethodGetsSweptWithNoOtherChange() {
+        FourValidators target = new FourValidators();
+        FleetConfig.invokeAllValidators(target);
+        assertEquals(List.of("validateAlpha", "validateBeta", "validateDelta", "validateGamma"),
+                sorted(target.ran),
+                "the fourth method must be reached automatically — proving a class can grow the "
+                        + "set of things it validates with no change to the sweep itself");
+    }
+
+    private static List<String> sorted(List<String> in) {
+        List<String> copy = new ArrayList<>(in);
+        copy.sort(String::compareTo);
+        return copy;
+    }
+
+    @Test
+    void aFailingValidatorStopsTheSweepAndPropagatesUnchanged() {
+        class OneFails {
+            @SuppressWarnings("unused")
+            public void validateOk() {
+                // passes
+            }
+
+            public void validateBoom() {
+                throw new IllegalStateException("refusing to start: boom");
+            }
+        }
+        IllegalStateException e = assertThrows(IllegalStateException.class,
+                () -> FleetConfig.invokeAllValidators(new OneFails()));
+        assertEquals("refusing to start: boom", e.getMessage(),
+                "the real exception must propagate unchanged, not be wrapped or swallowed");
+    }
+
+    /**
+     * Every rule the sweep's filter applies, proven independently: only public, no-arg, void
+     * methods whose name starts with {@code "validate"} run, {@code validateAll} itself is
+     * excluded (so a class that declares one of its own — as {@link FleetConfig} does — cannot
+     * recurse into itself), and a same-shaped-but-wrongly-named or wrongly-shaped method never
+     * runs. A reader who "simplifies" the filter in {@link FleetConfig#invokeAllValidators} in a
+     * way that widens or narrows it breaks one of these.
+     */
+    static class FilterEdgeCases {
+        final List<String> ran = new ArrayList<>();
+
+        public void validateReal() {
+            ran.add("validateReal");
+        }
+
+        /** Wrong name — must not run. */
+        public void checkSomething() {
+            ran.add("checkSomething");
+        }
+
+        /** Wrong shape — takes an argument. */
+        public void validateWithArg(String ignored) {
+            ran.add("validateWithArg");
+        }
+
+        /** Wrong shape — returns something. */
+        public boolean validateReturnsBoolean() {
+            ran.add("validateReturnsBoolean");
+            return true;
+        }
+
+        /** Excluded by name on purpose, so the sweep cannot call itself. */
+        public void validateAll() {
+            ran.add("validateAll");
+        }
+    }
+
+    @Test
+    void onlyPublicNoArgVoidValidateNamedMethodsRun() {
+        FilterEdgeCases target = new FilterEdgeCases();
+        FleetConfig.invokeAllValidators(target);
+        assertEquals(List.of("validateReal"), target.ran,
+                "checkSomething (wrong name), validateWithArg (wrong shape), "
+                        + "validateReturnsBoolean (wrong shape), and validateAll (excluded by "
+                        + "name) must all be skipped");
+    }
+
+    // ── Claim 2: FleetConfig.validateAll() is wired to that mechanism and reaches all six today ──
+
+    /**
+     * Reflectively enumerates {@link FleetConfig}'s own public, no-arg, void {@code validateXxx()}
+     * methods (excluding {@code validateAll} itself) — the exact same filter {@link
+     * FleetConfig#invokeAllValidators} applies. This is not the mechanism proof (that is claim 1,
+     * above, on an unrelated class) — it is a visible denominator: today there are six, named
+     * here, so a reader adding a seventh sees this assertion name the new count rather than a
+     * silent pass at the old one.
+     */
+    @Test
+    void fleetConfigDeclaresExactlyTheseSixValidatorsToday() {
+        Set<String> names = new TreeSet<>();
+        for (Method m : FleetConfig.class.getMethods()) {
+            if (java.lang.reflect.Modifier.isPublic(m.getModifiers())
+                    && m.getParameterCount() == 0
+                    && m.getReturnType() == void.class
+                    && m.getName().startsWith("validate")
+                    && !m.getName().equals("validateAll")) {
+                names.add(m.getName());
+            }
+        }
+        assertEquals(new TreeSet<>(Set.of("validateAuthExposure", "validateLeadTabPrefixes",
+                "validateSubscriptionProfiles", "validateCharters", "validateMembers",
+                "validateModels")), names,
+                "FleetConfig's public validate*() methods changed. Do TWO things, in this "
+                        + "order. First confirm validateAll() still delegates to "
+                        + "invokeAllValidators(this) — a hardcoded list there passes every other "
+                        + "test in this class, so this assertion is the only place that will ever "
+                        + "make you check. Only then update the expected set to match.");
+    }
+
+    /** A minimal, otherwise-valid file — same shape FleetConfigTest and ConfigRefTest use. */
+    private static String minimalValidYaml() {
+        return """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                profiles:
+                  sonnet:
+                    baseUrl: http://gx00.gw:8000
+                    model: sonnet
+                """;
+    }
+
+    @Test
+    void aFullyValidConfigPassesValidateAll(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, minimalValidYaml());
+        assertDoesNotThrow(() -> FleetConfig.load(f).validateAll());
+    }
+
+    /**
+     * The heart of claim 2: for each of today's six real validators, a minimal file that fails
+     * ONLY that one — the exact fixtures {@code FleetConfigTest} uses to test each validator
+     * directly — must also fail through {@link FleetConfig#validateAll()}. If a future edit to
+     * {@code validateAll()} silently dropped one validator from the sweep (e.g. a typo'd name
+     * filter), exactly one of these six would start passing when it must not.
+     */
+    @Test
+    void validateAllReachesEveryOneOfTodaysSixValidators(@TempDir Path dir) throws Exception {
+        // validateAuthExposure: a non-loopback bind without token mode.
+        assertValidateAllRefuses(dir, "auth-exposure.yaml", """
+                bind:
+                  host: 0.0.0.0
+                  port: 8765
+                """, "auth.mode: token");
+
+        // validateLeadTabPrefixes: a fleet-wide tabLabel that starts with a lead's own tabPrefix.
+        assertValidateAllRefuses(dir, "lead-tab-prefixes.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                fleet:
+                  tabLabel: "lead: {role} {profile}"
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """, "fleet.tabLabel");
+
+        // validateSubscriptionProfiles: subscription: true with env: reseating ANTHROPIC_BASE_URL.
+        assertValidateAllRefuses(dir, "subscription-profiles.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                profiles:
+                  sonnet:
+                    subscription: true
+                    argv: ["ccs", "sonnet"]
+                    env:
+                      ANTHROPIC_BASE_URL: http://anything-not-on-the-allowlist
+                """, "ANTHROPIC_BASE_URL");
+
+        // validateCharters: a charter key that is not a role wire name.
+        assertValidateAllRefuses(dir, "charters.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                fleet:
+                  charters:
+                    architetc: text
+                """, "architetc");
+
+        // validateMembers: an architect slot naming an unconfigured profile.
+        assertValidateAllRefuses(dir, "members.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                profiles:
+                  gx10:
+                    baseUrl: http://gx10.gw:8000
+                fleet:
+                  architects:
+                    lead-designer:
+                      profile: sonnet
+                """, "lead-designer");
+
+        // validateModels: a profile naming a model outside the configured allow-list.
+        assertValidateAllRefuses(dir, "models.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                profiles:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                    model: claude-sonnet-5
+                  rogue:
+                    baseUrl: http://gx11.gw:8000
+                    model: claude-opus-9000
+                models:
+                  allow:
+                    - model: claude-sonnet-5
+                """, "rogue");
+    }
+
+    private static void assertValidateAllRefuses(Path dir, String fileName, String yaml,
+                                                  String mustContain) throws Exception {
+        Path f = dir.resolve(fileName);
+        Files.writeString(f, yaml);
+        FleetConfig cfg = FleetConfig.load(f);
+        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateAll,
+                fileName + ": validateAll() must refuse this config");
+        assertTrue(e.getMessage().contains(mustContain),
+                fileName + ": expected message to contain \"" + mustContain + "\" but was: "
+                        + e.getMessage());
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigWithDefaultsPreservesEveryComponentTest.java

@@ -45,8 +45,8 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
  * <p>Why this is a valid check for every component, not just some: {@link #withDefaults()}'s own
  * comments document that it only ever REPLACES a component when the incoming value is {@code null}
  * (or blank, for {@code placement}) — {@code broker}/{@code primary}/{@code leadHeartbeat}/
- * {@code configReload}/{@code coordinator}/{@code worktreeGroup}/{@code memberLoginShell} are left
- * as-is unconditionally, and {@code bind}/{@code guard}/{@code lifecycle}/{@code auth}/
+ * {@code configReload}/{@code coordinator}/{@code worktreeGroup}/{@code memberLoginShell}/
+ * {@code memberSkills}/{@code idleSleepGuard} are left as-is unconditionally, and {@code bind}/{@code guard}/{@code lifecycle}/{@code auth}/
  * {@code fleet}/{@code quarantineCooldownSeconds}/{@code memberCredentials}/{@code placement} are
  * replaced only on null/blank input. A value that is never null or blank going in must therefore
  * never change coming out, for every current component. No exclusion is needed today.
@@ -92,9 +92,13 @@ class FleetConfigWithDefaultsPreservesEveryComponentTest {
         v.put("memberCredentials", new FleetConfig.MemberCredentials(
                 FleetConfig.MemberCredentials.POLICY_DENY_BY_DEFAULT,
                 List.of("git"), List.of("git", "ssh"), null));
-        v.put("coordinator", new FleetConfig.Coordinator("amqp://coord-guard", null, "self-guard", 3));
+        v.put("coordinator", new FleetConfig.Coordinator("amqp://coord-guard", null, "self-guard", 3, null));
         v.put("worktreeGroup", "group-guard");
         v.put("memberLoginShell", "/bin/zsh");
+        v.put("memberSkills", "/skills/guard");
+        v.put("idleSleepGuard", new FleetConfig.IdleSleepGuard(true));
+        v.put("models", new FleetConfig.Models(
+                List.of(new FleetConfig.Models.ModelEntry("model-guard"))));
         assertNamesMatchComponents(v);
         return v;
     }

fleetd/src/test/java/dev/ltms/fleet/deploy/SystemdUnitSafetyTest.java

@@ -0,0 +1,232 @@
+package dev.ltms.fleet.deploy;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.regex.Pattern;
+import java.util.stream.Stream;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #360: {@code deploy/fleetd.service} started clean on fleet01 and broke the daemon in
+ * three ways that nothing logs at startup.
+ *
+ * <ul>
+ *   <li>{@code ProtectSystem=}, {@code ProtectHome=}, {@code ProtectKernelTunables=} and
+ *       {@code ProtectControlGroups=} each give the unit its own mount namespace. fleetd resolves
+ *       a caller's role by running {@code lsof} to find the loopback peer PID (see
+ *       {@code mcp/LsofPeerPidLookup}). Inside such a namespace {@code lsof} returns nothing,
+ *       every caller falls back to ANONYMOUS, and the primary is refused every orchestration call
+ *       with "unauthenticated: anonymous may not SPAWN" -- while healthz still reports ok.
+ *       Measured by bisection on fleet01 2026-09-05 (lsof line count): no sandbox 3,
+ *       {@code ProtectSystem=strict} 0, {@code ProtectHome=read-only} 0,
+ *       {@code ProtectKernelTunables} 0, {@code ProtectControlGroups} 0,
+ *       {@code RestrictSUIDSGID} 3, {@code NoNewPrivileges} 3 -- so only the first four are
+ *       forbidden.
+ *   <li>{@code PrivateTmp=true} gives the unit its own {@code /tmp}. fleetd writes the member
+ *       ZDOTDIR credential-scrub directory and the opencode config directory under
+ *       {@code java.io.tmpdir}, and the member pane -- a child of a *different* unit
+ *       (herdr.service) -- has to read them back. A private {@code /tmp} on either unit turns the
+ *       credential scrub into a silent no-op.
+ *   <li>Running {@code java} directly from {@code ExecStart} skips the login shell. Every secret
+ *       fleetd needs (AI_GATEWAY_TOKEN, WORKER_GITEA_TOKEN, LAVINMQ_URI, COORD_AMQP_URI) lives in
+ *       a file only the login shell sources; systemd runs no login shell on its own. Started that
+ *       way the daemon boots fine with empty credentials, and the failure appears hours later as a
+ *       member that cannot open a pull request.
+ * </ul>
+ *
+ * <p>Review round 2 on fleetd #360 found the same shape one file further down the chain:
+ * {@code herdr.service}'s {@code ExecStart} only names {@code deploy/herdr-inner.sh}, so that
+ * script is the ONLY place two more of these properties live, and nothing was reading it.
+ *
+ * <ul>
+ *   <li>If the script does not exec a login shell, herdr -- and every member pane it spawns as a
+ *       child -- starts with none of the secrets only a login shell sources, the same silent
+ *       empty-credentials failure as fleetd.service's {@code ExecStart}, one process further away.
+ *   <li>If the script does not set a real, non-zero pty size before starting herdr (with
+ *       {@code stty}), herdr reports a 0x0 window and every pane spawn fails with
+ *       "ghostty error -2" -- which surfaces as a fleetd spawn failure, not a herdr one.
+ * </ul>
+ *
+ * <p>None of these five failures makes the unit (or the script) fail to start, or makes
+ * {@code /healthz} report unhealthy, so nothing short of reading the files catches a regression.
+ * This test is that read.
+ *
+ * <p><b>It checks source text, not behaviour</b> -- it cannot start systemd or fork an mount
+ * namespace in a build sandbox. It parses the same two files an operator would install and fails
+ * if a forbidden directive is active, exactly the way {@code McpContractDocTest} guards
+ * {@code docs/MCP-Contract.md} against naming a tool that does not exist.
+ */
+class SystemdUnitSafetyTest {
+
+    /** Tests run with the module directory (fleetd/) as cwd; deploy/ is the repo-root sibling. */
+    private static final Path FLEETD_SERVICE = Path.of("../deploy/fleetd.service");
+    private static final Path HERDR_SERVICE = Path.of("../deploy/herdr.service");
+    private static final Path HERDR_INNER_SCRIPT = Path.of("../deploy/herdr-inner.sh");
+
+    private static final List<String> NAMESPACING_DIRECTIVES = List.of(
+            "ProtectSystem", "ProtectHome", "ProtectKernelTunables", "ProtectControlGroups");
+
+    /**
+     * A shell invoked with a login flag, e.g. {@code zsh -lc '...'} or {@code /bin/sh -l}. The
+     * property under test is the {@code -l}, not the specific shell or the rest of its flags, so
+     * this matches a token ending in "sh" followed by a flag cluster containing "l" -- tighter
+     * than a bare {@code contains("-lc")}, which a "-lc" anywhere in the line would also satisfy.
+     */
+    private static final Pattern LOGIN_SHELL_INVOCATION =
+            Pattern.compile("(?:^|\\s)\\S*sh\\s+-[A-Za-z]*l[A-Za-z]*\\b");
+
+    private static final Pattern POSITIVE_ROWS = Pattern.compile("\\brows\\s+([1-9]\\d*)\\b");
+    private static final Pattern POSITIVE_COLS = Pattern.compile("\\bcols\\s+([1-9]\\d*)\\b");
+
+    static Stream<Path> bothUnits() {
+        return Stream.of(FLEETD_SERVICE, HERDR_SERVICE);
+    }
+
+    private static boolean invokesALoginShell(List<String> activeLines) {
+        return activeLines.stream().anyMatch(l -> LOGIN_SHELL_INVOCATION.matcher(l).find());
+    }
+
+    /** An active {@code stty} line naming both a positive row count and a positive column count. */
+    private static boolean setsANonZeroPtySize(List<String> activeLines) {
+        return activeLines.stream()
+                .filter(l -> l.startsWith("stty"))
+                .anyMatch(l -> POSITIVE_ROWS.matcher(l).find() && POSITIVE_COLS.matcher(l).find());
+    }
+
+    /** Lines that are actually in force: comments and blank lines don't count. */
+    private static List<String> activeLines(Path unit) throws Exception {
+        List<String> active = new ArrayList<>();
+        for (String line : Files.readAllLines(unit)) {
+            String stripped = line.strip();
+            if (!stripped.isEmpty() && !stripped.startsWith("#")) {
+                active.add(stripped);
+            }
+        }
+        return active;
+    }
+
+    @ParameterizedTest
+    @MethodSource("bothUnits")
+    @DisplayName("[SOURCE TEXT] no active mount-namespacing directive -- it blinds lsof and turns every caller ANONYMOUS")
+    void doesNotActivateAMountNamespace(Path unit) throws Exception {
+        List<String> active = activeLines(unit);
+
+        for (String directive : NAMESPACING_DIRECTIVES) {
+            Pattern activeDirective = Pattern.compile("^" + Pattern.quote(directive) + "\\s*=");
+            List<String> hits = active.stream().filter(l -> activeDirective.matcher(l).find()).toList();
+            assertTrue(hits.isEmpty(),
+                    unit + " sets " + directive + " (" + hits + "). That directive gives the unit its "
+                            + "own mount namespace; inside it, fleetd's lsof-based caller lookup "
+                            + "(mcp/LsofPeerPidLookup) returns nothing, so every MCP caller falls back to "
+                            + "ANONYMOUS and the primary is refused every orchestration call with "
+                            + "\"unauthenticated: anonymous may not SPAWN\" -- while the daemon still "
+                            + "starts and /healthz still reports ok. Measured on fleet01 2026-09-05 "
+                            + "(fleetd #360). A commented-out mention in the file's own DO-NOT-add block "
+                            + "is fine; an active directive is not.");
+        }
+    }
+
+    @ParameterizedTest
+    @MethodSource("bothUnits")
+    @DisplayName("[SOURCE TEXT] PrivateTmp is not true -- it silently no-ops the credential scrub")
+    void privateTmpIsNotTrue(Path unit) throws Exception {
+        List<String> active = activeLines(unit);
+        Pattern privateTmpTrue = Pattern.compile("^PrivateTmp\\s*=\\s*true\\b");
+
+        boolean hasPrivateTmpTrue = active.stream().anyMatch(l -> privateTmpTrue.matcher(l).find());
+        assertFalse(hasPrivateTmpTrue,
+                unit + " sets PrivateTmp=true. fleetd writes the member ZDOTDIR credential-scrub "
+                        + "directory and the opencode config directory under java.io.tmpdir, and the "
+                        + "member pane -- a child of a DIFFERENT unit -- has to read them back. A "
+                        + "private /tmp on either unit turns the credential scrub into a silent no-op: "
+                        + "no error, no log line, the scrub just never happens (fleetd #360).");
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] fleetd.service's ExecStart goes through a login shell -- otherwise every secret is empty")
+    void execStartUsesALoginShell() throws Exception {
+        List<String> active = activeLines(FLEETD_SERVICE);
+        List<String> execStartLines = active.stream().filter(l -> l.startsWith("ExecStart=")).toList();
+
+        assertTrue(execStartLines.size() == 1,
+                FLEETD_SERVICE + " must have exactly one active ExecStart= line; found "
+                        + execStartLines.size() + ": " + execStartLines);
+
+        String execStart = execStartLines.get(0);
+        assertTrue(LOGIN_SHELL_INVOCATION.matcher(execStart).find(),
+                FLEETD_SERVICE + "'s ExecStart (" + execStart + ") does not run a login shell (a shell "
+                        + "invoked with a \"-l\" flag, e.g. \"zsh -lc\"). Every secret fleetd needs "
+                        + "(AI_GATEWAY_TOKEN, WORKER_GITEA_TOKEN, LAVINMQ_URI, COORD_AMQP_URI) lives in a "
+                        + "file only the login shell sources; systemd runs no login shell on its own. "
+                        + "Running java directly boots fine with every credential empty, and the failure "
+                        + "surfaces hours later as a member that cannot open a pull request (fleetd #360).");
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] herdr-inner.sh execs a login shell -- otherwise herdr and every member it spawns start with empty credentials")
+    void herdrInnerScriptUsesALoginShell() throws Exception {
+        List<String> active = activeLines(HERDR_INNER_SCRIPT);
+
+        assertTrue(invokesALoginShell(active),
+                HERDR_INNER_SCRIPT + " does not exec a login shell (a shell invoked with a \"-l\" flag, "
+                        + "e.g. \"zsh -lc\"). herdr.service's ExecStart only names this script, so this "
+                        + "is the ONLY place herdr's login-shell property lives. Without it, herdr -- and "
+                        + "every member pane it spawns as a child of herdr -- starts with none of the "
+                        + "secrets that only a login shell sources (this host: ~/.fleet/secrets.sh via "
+                        + "~/.zprofile), and the failure surfaces hours later as a member with no "
+                        + "credentials at all, not just fleetd (fleetd #360).");
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] herdr-inner.sh sets a non-zero pty size before starting herdr -- otherwise every pane spawn fails with \"ghostty error -2\"")
+    void herdrInnerScriptSetsANonZeroPtySize() throws Exception {
+        List<String> active = activeLines(HERDR_INNER_SCRIPT);
+
+        assertTrue(setsANonZeroPtySize(active),
+                HERDR_INNER_SCRIPT + " does not run \"stty rows N cols M\" with both N and M positive "
+                        + "before starting herdr. Without a real pty size, herdr reports a 0x0 window and "
+                        + "every pane spawn fails with \"ghostty error -2\" -- which surfaces as a fleetd "
+                        + "spawn failure, not a herdr one, and gives no hint that the actual cause is this "
+                        + "script (fleetd #360).");
+    }
+
+    /**
+     * The denominator guard, same shape as {@code McpContractDocTest}'s: a check that scans for a
+     * forbidden pattern passes trivially if it is handed nothing to scan. Pin that all three files
+     * exist, are non-trivial, and that the DO-NOT block's commented mentions are still there -- so
+     * the "comment survives, directive doesn't" distinction above is actually being exercised.
+     */
+    @Test
+    @DisplayName("[SOURCE TEXT] the namespacing check is not vacuous -- all three files exist and the DO-NOT block still mentions every forbidden directive in a comment")
+    void theCheckActuallyHasSomethingToCheck() throws Exception {
+        assertTrue(Files.size(FLEETD_SERVICE) > 200,
+                FLEETD_SERVICE + " is missing or unexpectedly small -- the checks above would pass "
+                        + "vacuously against an empty or absent file");
+        assertTrue(Files.size(HERDR_SERVICE) > 200,
+                HERDR_SERVICE + " is missing or unexpectedly small -- the checks above would pass "
+                        + "vacuously against an empty or absent file");
+        assertTrue(Files.size(HERDR_INNER_SCRIPT) > 50,
+                HERDR_INNER_SCRIPT + " is missing or unexpectedly small -- the login-shell and "
+                        + "pty-size checks above would either pass vacuously or fail with an opaque "
+                        + "\"file not found\" instead of naming the actual consequence (empty "
+                        + "credentials / \"ghostty error -2\") against an empty or absent file");
+
+        String fleetdService = Files.readString(FLEETD_SERVICE);
+        for (String directive : NAMESPACING_DIRECTIVES) {
+            assertTrue(fleetdService.contains(directive),
+                    FLEETD_SERVICE + " no longer mentions " + directive + " anywhere, not even in the "
+                            + "DO-NOT-add comment block that explains why it must stay out. That comment "
+                            + "is the whole point of fleetd #360 -- it is what stops the next edit from "
+                            + "re-adding the directive without knowing why.");
+        }
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/health/FleetHealthMonitorTest.java

@@ -30,6 +30,7 @@ import java.util.concurrent.ScheduledFuture;
 import java.util.concurrent.ScheduledThreadPoolExecutor;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
+import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.BiConsumer;
 import java.util.function.LongSupplier;
 
@@ -206,6 +207,139 @@ class FleetHealthMonitorTest {
                 .workingSuspectAfterOrDefault());
     }
 
+    // --- fleetd #386: a stall detector whose only clock freezes with a sleeping host is worse
+    // than a silent one — it reports "quiet" for a member that was genuinely busy for hours.
+
+    @Test void monotonicClockFrozenPastThresholdOnRealClockStillReportsStallSuspected() {
+        Logger logger = (Logger) LoggerFactory.getLogger(FleetHealthMonitor.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            AtomicLong mono = new AtomicLong(0);
+            AtomicLong real = new AtomicLong(0);
+            FakeHerdr herdr = new FakeHerdr().withAgent("busy", "term_busy", "pane_busy", "tab_busy");
+            var scheduler = Executors.newSingleThreadScheduledExecutor();
+            FleetHealthMonitor monitor = monitorWithClocks(herdr,
+                    List.of(member("term_busy", MemberSession.State.BUSY, 0, 0)), scheduler,
+                    mono::get, real::get, 60, 600, (_, _) -> { });
+
+            monitor.tick(); // establishes the clock baseline; nothing has diverged yet
+            assertEquals(0, appender.list.stream().filter(event -> event.getFormattedMessage()
+                    .contains("state=STALL_SUSPECTED")).count());
+
+            // The host "sleeps": the monotonic clock stands completely still while the real clock
+            // keeps moving, past the 600s stall threshold.
+            real.set(TimeUnit.SECONDS.toNanos(700));
+            monitor.tick();
+            monitor.stop();
+
+            assertTrue(appender.list.stream().anyMatch(event -> event.getFormattedMessage()
+                            .contains("member=term_busy state=STALL_SUSPECTED")),
+                    "the real clock crossed the stall threshold even though the monotonic clock never moved");
+        } finally {
+            logger.detachAppender(appender);
+        }
+    }
+
+    @Test void clockDivergenceIsLoggedOnceNotOncePerTick() {
+        Logger logger = (Logger) LoggerFactory.getLogger(FleetHealthMonitor.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            AtomicLong mono = new AtomicLong(0);
+            AtomicLong real = new AtomicLong(0);
+            var scheduler = Executors.newSingleThreadScheduledExecutor();
+            FleetHealthMonitor monitor = monitorWithClocks(new FakeHerdr(), List.of(), scheduler,
+                    mono::get, real::get, 60, 600, (_, _) -> { });
+
+            monitor.tick(); // baseline: no divergence possible yet
+
+            // One sleep gap: the monotonic clock is frozen while the real clock jumps far past one
+            // tick interval (60s).
+            real.set(TimeUnit.SECONDS.toNanos(700));
+            monitor.tick();
+
+            // The host is awake again: both clocks advance together from here, so no more divergence.
+            mono.set(TimeUnit.SECONDS.toNanos(10));
+            real.set(TimeUnit.SECONDS.toNanos(710));
+            monitor.tick();
+            mono.set(TimeUnit.SECONDS.toNanos(20));
+            real.set(TimeUnit.SECONDS.toNanos(720));
+            monitor.tick();
+            monitor.stop();
+
+            assertEquals(1, appender.list.stream().filter(event -> event.getFormattedMessage()
+                            .contains("the monotonic clock did not advance"))
+                    .count(), "one sleep gap must produce exactly one divergence line, not one per tick");
+        } finally {
+            logger.detachAppender(appender);
+        }
+    }
+
+    /**
+     * fleetd #386 follow-up, added on merge. The fix carries a PER-MEMBER drift baseline, so drift
+     * from a sleep that happened BEFORE a member went busy is never charged to that member. The
+     * two tests shipped with the fix both start with the member already BUSY, so a single global
+     * baseline passes them — this one fails without the per-member map.
+     *
+     * <p>Order matters: the host sleeps while nothing is busy, and only then does a member take a
+     * turn. Its stall clock must start at zero.
+     */
+    @Test void driftFromASleepBeforeAMemberWentBusyIsNotChargedToThatMember() {
+        Logger logger = (Logger) LoggerFactory.getLogger(FleetHealthMonitor.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            AtomicLong mono = new AtomicLong(0);
+            AtomicLong real = new AtomicLong(0);
+            AtomicReference<List<MemberSession>> roster = new AtomicReference<>(List.of());
+            FakeHerdr herdr = new FakeHerdr().withAgent("busy", "term_busy", "pane_busy", "tab_busy");
+            var scheduler = Executors.newSingleThreadScheduledExecutor();
+            AgentControl agents = new AgentControl(herdr);
+            FleetHealthMonitor monitor = new FleetHealthMonitor(agents, roster::get,
+                    new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
+                    scheduler, mono::get, real::get, 60, 600, (_, _) -> { });
+
+            monitor.tick();                                   // baseline, no members yet
+
+            // The host sleeps for 700s with nobody busy: the monotonic clock stands still.
+            real.set(TimeUnit.SECONDS.toNanos(700));
+            monitor.tick();
+
+            // Awake again. Only NOW does a member start a turn, with a fresh activity stamp taken
+            // from the monotonic clock. Both clocks advance together from here.
+            mono.set(TimeUnit.SECONDS.toNanos(10));
+            real.set(TimeUnit.SECONDS.toNanos(710));
+            roster.set(List.of(member("term_busy", MemberSession.State.BUSY,
+                    0, TimeUnit.SECONDS.toNanos(10))));
+            monitor.tick();
+
+            mono.set(TimeUnit.SECONDS.toNanos(20));
+            real.set(TimeUnit.SECONDS.toNanos(720));
+            monitor.tick();
+            monitor.stop();
+
+            assertEquals(0, appender.list.stream().filter(event -> event.getFormattedMessage()
+                            .contains("member=term_busy state=STALL_SUSPECTED")).count(),
+                    "the member has been busy for 10s, not 710s — the earlier sleep is not its stall");
+        } finally {
+            logger.detachAppender(appender);
+        }
+    }
+
+    private static FleetHealthMonitor monitorWithClocks(FakeHerdr herdr, List<MemberSession> roster,
+            java.util.concurrent.ScheduledExecutorService scheduler, LongSupplier clock,
+            LongSupplier realtimeClock, long intervalSeconds, long workingSuspectAfterSeconds,
+            BiConsumer<String, String> failTarget) {
+        AgentControl agents = new AgentControl(herdr);
+        return new FleetHealthMonitor(agents, () -> roster,
+                new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
+                scheduler, clock, realtimeClock, intervalSeconds, workingSuspectAfterSeconds, failTarget);
+    }
+
     @Test void goneMemberRecoveryLogsOnceWithoutRefiringTargetFailure() {
         Logger logger = (Logger) LoggerFactory.getLogger(FleetHealthMonitor.class);
         Level previousLevel = logger.getLevel();

fleetd/src/test/java/dev/ltms/fleet/herdr/AgentControlContractTest.java

@@ -17,15 +17,105 @@ import static org.junit.jupiter.api.Assumptions.assumeTrue;
  * SHELL directly (never {@code claude}, so no subscription/token involvement) and always tears
  * the throwaway space down.
  *
+ * <p>The seed shell's own startup (restoring its session, printing its banner) is asynchronous
+ * and its length is not a fleetd contract — measured here at ~2.5s on one host (fleetd #449).
+ * The old version used two fixed sleeps: 1000ms before typing, then 800ms before reading. It
+ * failed, and the pane showed the typed line followed by the startup banner with no command
+ * output at all — which looks, at a glance, exactly like the env map never reaching the shell.
+ * So this polls for a real signal instead of guessing a sleep length.
+ *
+ * <p><strong>What was measured, and what was not.</strong> Polling fixes it: 5 standalone runs
+ * green. The load-bearing half is {@link #waitForText}, and one cell proves it. Keep the old
+ * 1000ms write sleep and change only the read — the 800ms fixed sleep becomes a 5s poll — and
+ * the test goes from 0 of 3 passing to 3 of 3. Removing the write wait instead
+ * ({@link #SHELL_READY_TIMEOUT_MS} set to 0, so input is typed at once) also passes 3 of 3. So
+ * the cause is the 800ms READ deadline, not the 1000ms write delay. The old version fails every
+ * time, not sometimes, so "race" is the wrong word for it. The earlier explanation — that input
+ * typed before the prompt is swallowed by the shell's startup — is not supported by anything
+ * measured here. Please do not repeat it: if it were true, typing at 0ms would be worse than
+ * typing at 1000ms, and it is not.
+ *
+ * <p><strong>Where this was measured.</strong> A 12-core macOS host, load average 2.6 to 5.9,
+ * on commit 20c1094. The same four cells were also run under load, with 8 spinners on 12 cores.
+ * The failure and the passes from that run are not worth the same. The cells ran in a fixed
+ * order while the load climbed from 7 to 50. The old version ran last, at the top of that climb,
+ * so it has a free explanation for failing and its 0 of 3 is discarded. A pass has no such free
+ * explanation: a cell that survives a worse condition than a fair order would have given it is
+ * evidence in the safe direction. So keep the three passes, each with the load it ran at: the
+ * fixed version 3 of 3 at load 7.42 to 18.42, the 0ms-write cell 3 of 3 at 18.42 to 23.65, the
+ * 1000ms-write cell 3 of 3 at 23.65 to 46.40. Above about load 20 everything here is slow for
+ * reasons that have nothing to do with this seam, so read the positive claim — that the read
+ * deadline was the whole cause — as "measured near idle on a 12-core host", and nothing
+ * stronger. Do not carry that raw load average to another host either: load average counts
+ * differently per core and per operating system, so only load per core compares. If this test
+ * fails on a smaller or busier machine, raise {@link #OUTPUT_TIMEOUT_MS} before you suspect the
+ * seam.
+ *
+ * <p>{@link #waitUntilSettled} is kept as cheap insurance against that swallow case, not because
+ * anyone showed it was needed. The cell that tests the swallow case head-on is the one with
+ * {@link #SHELL_READY_TIMEOUT_MS} at 0: input is typed at once, which is the worst case for
+ * "typed before the prompt is ready". It passed 3 of 3 at load 18.42 to 23.65. The wider read
+ * window cannot explain that pass away, because a swallowed keystroke is LOST, not late — the
+ * command never runs, so no amount of polling makes its output appear. So the swallow mechanism
+ * was tested and did not show up. If you want to delete this call, that is the cell to re-run.
+ *
  * <p>Tagged {@code contract}; run with {@code mvn test -Pcontract}.
  */
 @Tag("contract")
 class AgentControlContractTest {
 
+    private static final long POLL_INTERVAL_MS = 150;
+    /** Bound for the seed shell to settle: observed ~2.5s three times running; this leaves headroom. */
+    private static final long SHELL_READY_TIMEOUT_MS = 8_000;
+    /** Bound for the typed command's output to appear once the shell is ready: observed ~0.2s. */
+    private static final long OUTPUT_TIMEOUT_MS = 5_000;
+
     private boolean noSocket() {
         return !Files.exists(UnixSocketHerdrClient.defaultSocketPath());
     }
 
+    private static String readPane(UnixSocketHerdrClient herdr, String paneId) {
+        return herdr.call("pane.read", Map.of("pane_id", paneId, "source", "visible"))
+                .path("read").path("text").asText("");
+    }
+
+    /**
+     * Poll {@code pane.read} until two consecutive reads come back identical — the shell's own
+     * startup output (restore banner, prompt) has stopped changing — or {@code timeoutMs} elapses.
+     * Never asserts by itself; the caller's own assertion is what actually verifies the outcome.
+     * Setting {@code timeoutMs} to 0 skips the wait entirely and the test still passes here, so
+     * treat this as insurance rather than as the fix — see the class javadoc.
+     */
+    private static String waitUntilSettled(UnixSocketHerdrClient herdr, String paneId, long timeoutMs)
+            throws InterruptedException {
+        long deadline = System.currentTimeMillis() + timeoutMs;
+        String previous = null;
+        while (System.currentTimeMillis() < deadline) {
+            Thread.sleep(POLL_INTERVAL_MS);
+            String current = readPane(herdr, paneId);
+            if (current.equals(previous) && !current.isBlank()) {
+                return current;
+            }
+            previous = current;
+        }
+        return previous == null ? "" : previous;
+    }
+
+    /** Poll {@code pane.read} until {@code needle} appears or {@code timeoutMs} elapses. */
+    private static String waitForText(UnixSocketHerdrClient herdr, String paneId, String needle, long timeoutMs)
+            throws InterruptedException {
+        long deadline = System.currentTimeMillis() + timeoutMs;
+        String last = "";
+        while (System.currentTimeMillis() < deadline) {
+            last = readPane(herdr, paneId);
+            if (last.contains(needle)) {
+                return last;
+            }
+            Thread.sleep(POLL_INTERVAL_MS);
+        }
+        return last;
+    }
+
     @Test
     void tabCreateInjectsEnvIntoTheSeedShell() throws Exception {
         assumeTrue(!noSocket(), "no herdr socket — skipping");
@@ -36,15 +126,13 @@ class AgentControlContractTest {
                     Map.of("ANTHROPIC_BASE_URL", "http://gx00.gw:8000"));
             try {
                 assertNotNull(tab.rootPaneId(), "tab.create must return the seed pane");
-                Thread.sleep(1000); // let the seed shell reach its prompt
+                waitUntilSettled(herdr, tab.rootPaneId(), SHELL_READY_TIMEOUT_MS);
                 herdr.call("pane.send_input", Map.of(
                         "pane_id", tab.rootPaneId(),
                         "text", "printf 'PROBE_BASE=[%s]\\n' \"$ANTHROPIC_BASE_URL\"",
                         "keys", List.of("enter")));
-                Thread.sleep(800);
-                String visible = herdr.call("pane.read",
-                                Map.of("pane_id", tab.rootPaneId(), "source", "visible"))
-                        .path("read").path("text").asText("");
+                String visible = waitForText(herdr, tab.rootPaneId(),
+                        "PROBE_BASE=[http://gx00.gw:8000]", OUTPUT_TIMEOUT_MS);
                 assertTrue(visible.contains("PROBE_BASE=[http://gx00.gw:8000]"),
                         "env map must reach the seed shell; saw: " + visible);
             } finally {

fleetd/src/test/java/dev/ltms/fleet/herdr/HerdrContractTest.java

@@ -14,7 +14,7 @@ import static org.junit.jupiter.api.Assumptions.assumeTrue;
  * Contract test against a REAL running herdr. Tagged {@code contract} so it is
  * excluded from {@code mvn test}; run it with {@code mvn test -Pcontract}. It fails
  * loudly if herdr drifts from the protocol {@code fleetd} was built against
- * (0.7.0, protocol 14) — catching breakage that unit tests with canned frames cannot.
+ * (0.8.0, protocol 19) — catching breakage that unit tests with canned frames cannot.
  */
 @Tag("contract")
 class HerdrContractTest {
@@ -24,13 +24,13 @@ class HerdrContractTest {
     }
 
     @Test
-    void pingReturnsProtocol14() {
+    void pingReturnsProtocol19() {
         assumeTrue(Files.exists(socket()), "no herdr socket at " + socket() + " — skipping");
         try (UnixSocketHerdrClient herdr = UnixSocketHerdrClient.connect()) {
             JsonNode pong = herdr.call("ping");
             assertEquals("pong", pong.get("type").asText());
-            assertEquals(14, pong.get("protocol").asInt(),
-                    "fleetd is built against herdr protocol 14");
+            assertEquals(19, pong.get("protocol").asInt(),
+                    "fleetd is built against herdr protocol 19");
             assertFalse(pong.get("version").asText().isBlank());
         }
     }

fleetd/src/test/java/dev/ltms/fleet/herdr/LeadTabScannerTest.java

@@ -6,6 +6,7 @@ import org.junit.jupiter.api.Test;
 
 import java.util.ArrayList;
 import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
@@ -35,6 +36,12 @@ class LeadTabScannerTest {
         final Map<String, String[]> tabs = new LinkedHashMap<>();
         /** pane_id → [tab_id, terminal_id]. */
         final Map<String, String[]> panes = new LinkedHashMap<>();
+        /**
+         * tab_id → whether herdr reports a running agent there. Defaults to {@code true} for every
+         * tab that has a pane, so every existing fixture keeps meaning "a live lead" unless a test
+         * says otherwise via {@link #deadAgent}.
+         */
+        final Set<String> deadTabs = new LinkedHashSet<>();
         int calls;
         boolean failing;
 
@@ -53,6 +60,18 @@ class LeadTabScannerTest {
             return this;
         }
 
+        /** Mark {@code tabId} as labelled but agent-less — a dead lead's leftover tab (fleetd #359). */
+        TopologyHerdr deadAgent(String tabId) {
+            deadTabs.add(tabId);
+            return this;
+        }
+
+        /** Undo {@link #deadAgent} — models {@code agent.list} reporting the tab live again. */
+        TopologyHerdr reviveAgent(String tabId) {
+            deadTabs.remove(tabId);
+            return this;
+        }
+
         @Override
         public JsonNode call(String method, Object params) {
             calls++;
@@ -83,6 +102,19 @@ class LeadTabScannerTest {
                                     .formatted(id, p[0], p[1])));
                     return read("{\"panes\":[%s]}".formatted(String.join(",", items)));
                 }
+                case "agent.list" -> {
+                    // One agent per distinct tab that has a pane and isn't marked dead — mirrors
+                    // AgentControl.list()'s "agents" shape closely enough for the scanner's join,
+                    // which only reads tab_id off each entry.
+                    Set<String> seen = new LinkedHashSet<>();
+                    panes.forEach((paneId, p) -> {
+                        String tabId = p[0];
+                        if (!deadTabs.contains(tabId) && seen.add(tabId)) {
+                            items.add("{\"tab_id\":\"%s\"}".formatted(tabId));
+                        }
+                    });
+                    return read("{\"agents\":[%s]}".formatted(String.join(",", items)));
+                }
                 default -> throw new AssertionError("unexpected herdr call: " + method);
             }
         }
@@ -208,6 +240,114 @@ class LeadTabScannerTest {
                 scanner(herdr, twoLeadsConfigured(), new AtomicLong()).get().get("term_opus_split"));
     }
 
+    // ── fleetd #359: a labelled tab is only a lead when something is running in it ─────────────────
+
+    /**
+     * The core invariant this ticket restores: {@code get()} must never report a terminal for a
+     * lead whose pane no longer runs an agent. Before this fix the scanner joined labelled tabs to
+     * panes with no liveness check at all, so a tab left behind by a crashed/relaunched lead (see
+     * {@code LeadLauncher}'s own staleness handling) was reported as live forever — which is exactly
+     * what let duplicate lead tabs make {@code LeadCoordLoop.resolveLocalLead()} permanently unable
+     * to pick one. Mutate this away (drop the {@code agent.list} cross-check in {@link
+     * LeadTabScanner#scan()}) and this test must fail.
+     */
+    @Test
+    void aLabelledTabWithNoRunningAgentIsNotReported() {
+        TopologyHerdr herdr = twoLeads().deadAgent("w1:t1"); // opus-5.0's tab is labelled but dead
+
+        Map<String, String> leads = scanner(herdr, twoLeadsConfigured(), new AtomicLong()).get();
+
+        assertFalse(leads.containsKey("term_opus"),
+                "a labelled tab with no running agent must never be reported as a live lead");
+        assertEquals("gpt-sol-5.6", leads.get("term_gpt"),
+                "the other, genuinely live lead must be unaffected");
+    }
+
+    /**
+     * The other direction, pinned separately so a fix cannot satisfy the test above by simply
+     * returning nothing: a labelled tab that DOES have a running agent must still be reported. A
+     * scanner that always comes back empty is worse than the bug it fixes.
+     */
+    @Test
+    void aLabelledTabWithARunningAgentIsStillReported() {
+        Map<String, String> leads = scanner(twoLeads(), twoLeadsConfigured(), new AtomicLong()).get();
+
+        assertEquals("opus-5.0", leads.get("term_opus"));
+        assertEquals("gpt-sol-5.6", leads.get("term_gpt"));
+    }
+
+    /**
+     * fleetd #359 review, finding 2 — the exact scenario the ticket's own evidence showed:
+     * {@code agent.list} can come back successfully but short, without the herdr call ever throwing.
+     * A lead this class already reported as live must not be dropped on the strength of one such
+     * read: {@link LeadTabScanner#get()}'s "keep the cache on failure" contract only fires on an
+     * exception, so without a fix a single short {@code agent.list} silently empties the cached map —
+     * which would resolve that lead's pane as {@code Role.WORKER} downstream, refusing every
+     * orchestration call. Mutate this away (drop the one-scan grace in {@link
+     * LeadTabScanner#scan()}) and this test must fail.
+     */
+    @Test
+    void aTransientAgentListMissDoesNotDemoteALeadAlreadyKnownLive() {
+        TopologyHerdr herdr = twoLeads();
+        AtomicLong clock = new AtomicLong();
+        LeadTabScanner s = scanner(herdr, twoLeadsConfigured(), clock);
+        assertTrue(s.get().containsKey("term_opus"), "opus must be known live before the miss");
+
+        // One scan where agent.list comes back without opus's tab, even though the tab and pane are
+        // completely unchanged — the tab/pane are still there, only the liveness read is short.
+        herdr.deadAgent("w1:t1");
+        clock.addAndGet(TTL);
+
+        assertTrue(s.get().containsKey("term_opus"),
+                "a single missed detection must not empty the cached map for a lead already known live");
+        assertEquals("gpt-sol-5.6", s.get().get("term_gpt"), "the unaffected lead is unchanged");
+    }
+
+    /**
+     * The other half of finding 2, so the grace above cannot be mistaken for permanent amnesty: the
+     * original #359 invariant (a genuinely dead tab is not reported forever) must still hold once a
+     * SECOND, independent scan agrees the agent is gone.
+     */
+    @Test
+    void aLeadMissingFromAgentListOnTwoConsecutiveScansIsFinallyDropped() {
+        TopologyHerdr herdr = twoLeads();
+        AtomicLong clock = new AtomicLong();
+        LeadTabScanner s = scanner(herdr, twoLeadsConfigured(), clock);
+        assertTrue(s.get().containsKey("term_opus"));
+
+        herdr.deadAgent("w1:t1");
+        clock.addAndGet(TTL);
+        assertTrue(s.get().containsKey("term_opus"), "first miss is a grace period, not a verdict");
+
+        clock.addAndGet(TTL); // a second, independent scan — still no agent
+        assertFalse(s.get().containsKey("term_opus"),
+                "a second consecutive miss for the same terminal must finally drop it");
+    }
+
+    /** A lead that recovers between the two misses keeps its grace spent, not renewed for free. */
+    @Test
+    void aLeadThatRecoversBetweenMissesIsReportedNormallyAndResetsItsGrace() {
+        TopologyHerdr herdr = twoLeads();
+        AtomicLong clock = new AtomicLong();
+        LeadTabScanner s = scanner(herdr, twoLeadsConfigured(), clock);
+        assertTrue(s.get().containsKey("term_opus"));
+
+        herdr.deadAgent("w1:t1");
+        clock.addAndGet(TTL);
+        assertTrue(s.get().containsKey("term_opus"), "graced on the first miss");
+
+        herdr.reviveAgent("w1:t1"); // the miss really was transient
+        clock.addAndGet(TTL);
+        assertTrue(s.get().containsKey("term_opus"), "found live again — reported normally");
+
+        // A later, unrelated miss must get its own fresh grace scan rather than being dropped
+        // immediately because the earlier miss had already "used up" a slot for this terminal.
+        herdr.deadAgent("w1:t1");
+        clock.addAndGet(TTL);
+        assertTrue(s.get().containsKey("term_opus"),
+                "a miss after a genuine recovery is a new event and deserves its own grace scan");
+    }
+
     /**
      * CB-579 acceptance (6): this is the bug the ticket closes. A stale pin used to be merged back
      * over every scan and never expire; now a scan is the whole answer, so a lead whose tab is gone

fleetd/src/test/java/dev/ltms/fleet/inject/CompletionResolverTest.java

@@ -20,6 +20,7 @@ import java.util.regex.Pattern;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 /** Unit behaviour of the CB-106 completion resolver in isolation from the injector. */
@@ -357,6 +358,54 @@ class CompletionResolverTest {
                 "the failure carries whatever was on screen: " + waiter.getNow(null).text());
     }
 
+    @Test
+    void aPlausibleLookingReplyInsideTheFloorStillFails() {
+        // fleetd#376 guard. A fix was attempted that inspected the pane inside the floor and resolved
+        // a COMPLETION when the text "looked like a real reply". Every cheap test for that is unsafe:
+        // lastAssistantBlock falls back to the WHOLE pane when there is no ⏺ marker, and a crash pane
+        // almost always contains sentence punctuation — in a file path, a version, or a hostname.
+        // This pane is the trap: it reads like a finished answer and it is a backend failure.
+        FakeHerdr herdr = new FakeHerdr().readText(
+                "Error: connection reset while loading src/main/java/Foo.java v1.2.3\n❯ ");
+        Rendezvous rendezvous = new Rendezvous();
+        long[] clock = {10_000_000_000L};
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous,
+                ExhaustedPatternLookup.none(), ExhaustionSink.none(), () -> clock[0]);
+
+        var waiter = rendezvous.open("term_a");
+        var turn = new CompletionResolver.InFlight(waiter, null, clock[0]);
+        clock[0] += CompletionResolver.MIN_TURN_NANOS - 1; // inside the floor
+
+        resolver.resolve("term_a", turn);
+
+        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind(),
+                "inside the floor the verdict is always FAILED — never guess a completion from pane text");
+    }
+
+    @Test
+    void theTooFastFailureDoesNotAssertACauseItCannotKnow() {
+        // fleetd#376: the message used to say "most likely a backend error before any work started".
+        // When no error pattern matches, that cause is a guess, and a reader who believes it stops
+        // looking at the pane. The verdict stays FAILED; only the claim about WHY is withdrawn.
+        FakeHerdr herdr = new FakeHerdr().readText("I am running on opencode/mimo-v2.5-free.\n❯ ");
+        Rendezvous rendezvous = new Rendezvous();
+        long[] clock = {10_000_000_000L};
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous,
+                ExhaustedPatternLookup.none(), ExhaustionSink.none(), () -> clock[0]);
+
+        var waiter = rendezvous.open("term_a");
+        var turn = new CompletionResolver.InFlight(waiter, null, clock[0]);
+        clock[0] += CompletionResolver.MIN_TURN_NANOS - 1; // inside the floor
+
+        resolver.resolve("term_a", turn);
+
+        String text = waiter.getNow(null).text();
+        assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind(), "still fails, still loud");
+        assertFalse(text.contains("most likely a backend error"),
+                "an unmatched fast turn must not assert a backend error: " + text);
+        assertTrue(text.contains("mimo-v2.5-free"), "the pane is still carried: " + text);
+    }
+
     @Test
     void aBusyToDoneTransitionJustOutsideTheFloorResolvesNormally() {
         FakeHerdr herdr = new FakeHerdr().readText("⏺ a real, if quick, answer\n❯ ");
@@ -836,19 +885,22 @@ class CompletionResolverTest {
     @Test
     void coverageIsOffWhenNoProfileHasAPatternConfigured() {
         assertEquals("off (no profile has an exhaustedPattern configured; profiles: [terra])",
-                CompletionResolver.coverage("exhaustedPattern", Set.of("terra"), Set.of()));
+                CompletionResolver.coverage("exhaustedPattern", CompletionResolver.UnsetMeaning.OFF,
+                        Set.of("terra"), Set.of()));
     }
 
     @Test
     void coverageIsFullWhenEveryProfileHasAPatternConfigured() {
         assertEquals("full (all profiles configured: [gx10, terra])",
-                CompletionResolver.coverage("exhaustedPattern", Set.of("terra", "gx10"), Set.of("terra", "gx10")));
+                CompletionResolver.coverage("exhaustedPattern", CompletionResolver.UnsetMeaning.OFF,
+                        Set.of("terra", "gx10"), Set.of("terra", "gx10")));
     }
 
     @Test
     void coverageIsPartialAndNamesWhichProfilesAreConfigured() {
         assertEquals("partial (configured: [terra]; not configured: [gx10])",
-                CompletionResolver.coverage("exhaustedPattern", Set.of("terra", "gx10"), Set.of("terra")));
+                CompletionResolver.coverage("exhaustedPattern", CompletionResolver.UnsetMeaning.OFF,
+                        Set.of("terra", "gx10"), Set.of("terra")));
     }
 
     /**
@@ -862,11 +914,42 @@ class CompletionResolverTest {
      *
      * <p>Every earlier test here passed the exhaustion case only, so none of them could see it. This
      * one pins that the message names the key the caller actually meant.
+     *
+     * <p>fleetd#415: the expected wording changed here too. {@code errorPattern} has a built-in
+     * fallback ({@link CompletionResolver#BACKEND_ERROR}), so an empty {@code configuredProfiles}
+     * for it is not "off" — see {@link #coverageDistinguishesOffFromBuiltInDefaultForTheSameEmptyInput}
+     * for the test built specifically to pin that distinction.
      */
     @Test
     void coverageNamesTheConfigKeyItsCallerMeansRatherThanAlwaysSayingExhaustedPattern() {
-        assertEquals("off (no profile has an errorPattern configured; profiles: [gx10, terra])",
-                CompletionResolver.coverage("errorPattern", Set.of("terra", "gx10"), Set.of()));
+        assertEquals("built-in default for all profiles (no profile customises errorPattern; "
+                        + "profiles: [gx10, terra])",
+                CompletionResolver.coverage("errorPattern", CompletionResolver.UnsetMeaning.BUILT_IN_DEFAULT,
+                        Set.of("terra", "gx10"), Set.of()));
+    }
+
+    /**
+     * fleetd#415: {@code coverage()} measures pattern coverage (how many profiles set the key), but
+     * for {@code errorPattern} the empty case is not the feature-off state — a profile with no
+     * configured {@code errorPattern} still runs the classification against
+     * {@link CompletionResolver#BACKEND_ERROR}. For {@code exhaustedPattern} there is no fallback,
+     * so empty really is off. Same shape of input (empty {@code configuredProfiles}, one profile),
+     * different {@link CompletionResolver.UnsetMeaning} — the wording must differ, or this method is
+     * back to conflating pattern coverage with feature state for the one key where they disagree.
+     */
+    @Test
+    void coverageDistinguishesOffFromBuiltInDefaultForTheSameEmptyInput() {
+        String exhaustedLine = CompletionResolver.coverage("exhaustedPattern",
+                CompletionResolver.UnsetMeaning.OFF, Set.of("gx10", "terra"), Set.of());
+        String errorLine = CompletionResolver.coverage("errorPattern",
+                CompletionResolver.UnsetMeaning.BUILT_IN_DEFAULT, Set.of("gx10", "terra"), Set.of());
+
+        assertEquals("off (no profile has an exhaustedPattern configured; profiles: [gx10, terra])",
+                exhaustedLine);
+        assertEquals("built-in default for all profiles (no profile customises errorPattern; "
+                        + "profiles: [gx10, terra])", errorLine);
+        assertNotEquals(exhaustedLine, errorLine,
+                "the same empty-coverage input must not read as the same feature state for both keys");
     }
 
     // --- fleetd#201 Unit 1: target-keyed backend-error pattern + typed sink ----------------------
@@ -1117,8 +1200,16 @@ class CompletionResolverTest {
         assertTrue(waiter.isDone());
         assertEquals(Rendezvous.Kind.FAILED, waiter.getNow(null).kind(),
                 "still a failure — the floor itself, not the pattern, is why");
-        assertTrue(waiter.getNow(null).text().contains("too fast to be real work"),
-                "a non-match inside the floor stays the generic too-fast reason: " + waiter.getNow(null).text());
+        // fleetd#376: this used to assert the phrase "too fast to be real work", which carried the
+        // claim "most likely a backend error before any work started". With no pattern matched that
+        // cause is a guess, so the wording was withdrawn. What this test really guards is unchanged:
+        // the floor alone still fails the turn, it stays generic, and it never notifies the sink.
+        String reason = waiter.getNow(null).text();
+        assertTrue(reason.contains("inside the floor"),
+                "a non-match inside the floor stays the generic floor reason: " + reason);
+        assertFalse(reason.contains("most likely a backend error"),
+                "a non-match must not assert a cause it did not establish: " + reason);
+        assertTrue(reason.contains("still starting up"), "the pane is still carried: " + reason);
         assertTrue(notified.isEmpty(), "a non-match must never notify the typed sink");
     }
 }

fleetd/src/test/java/dev/ltms/fleet/inject/LiveExhaustedPatternsTest.java

@@ -0,0 +1,138 @@
+package dev.ltms.fleet.inject;
+
+import dev.ltms.fleet.config.FleetConfig;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+import java.util.regex.Pattern;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotSame;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #446: {@code LiveExhaustedPatterns} is the mechanism that makes {@code exhaustedPattern}
+ * hot — read fresh off a config supplier per lookup, cached by profile name. This is the direct,
+ * minimal unit test of that mechanism: read the pattern once, mutate the backing "config", read
+ * again, and assert the second read saw the new value — the exact hotness proof shape.
+ *
+ * <p>This class alone does not prove {@code Fleetd.main} actually wires the live source into
+ * production — {@link dev.ltms.fleet.FleetdExhaustionDetectionArmedWiringTest} and {@code
+ * CompletionResolverTest}'s {@code ExhaustedPatternLookup} tests do that at the wiring level. What
+ * this class proves is that the mechanism itself is genuinely live and genuinely cached, not that
+ * it is used.
+ */
+class LiveExhaustedPatternsTest {
+
+    private static FleetConfig.Profile profileWithPattern(String pattern) {
+        return new FleetConfig.Profile("terra", "http://gx00.gw:8000", "terra",
+                null, null, null, "tab", "fleetd-workers", "w #{n}", null, null, null,
+                null, null, null, null, null, null, null, pattern);
+    }
+
+    /** Simple mutable holder standing in for {@code ConfigRef} — swapped, never mutated in place. */
+    private static final class MutableProfiles {
+        private volatile Map<String, FleetConfig.Profile> profiles;
+
+        MutableProfiles(Map<String, FleetConfig.Profile> initial) {
+            this.profiles = initial;
+        }
+
+        Map<String, FleetConfig.Profile> get() {
+            return profiles;
+        }
+
+        void set(Map<String, FleetConfig.Profile> fresh) {
+            this.profiles = fresh;
+        }
+    }
+
+    @Test
+    @DisplayName("patternFor reads the live config: read, change, read again, see the change — no restart")
+    void patternForIsHotAcrossAConfigChange() {
+        MutableProfiles live = new MutableProfiles(Map.of("terra", profileWithPattern("usage limit")));
+        LiveExhaustedPatterns patterns = new LiveExhaustedPatterns(live::get);
+
+        Pattern before = patterns.patternFor("terra");
+        assertTrue(before.matcher("your usage limit has been reached").find());
+
+        // Change the "config" — the exact thing a reload does to ConfigRef in production.
+        live.set(Map.of("terra", profileWithPattern("rate limit exceeded")));
+
+        Pattern after = patterns.patternFor("terra");
+        assertTrue(after.matcher("429: rate limit exceeded, try later").find(),
+                "the second read must see the NEW pattern text with no restart");
+        assertFalse(after.matcher("your usage limit has been reached").find(),
+                "the second read must have actually recompiled — not just reused a stale match");
+    }
+
+    @Test
+    @DisplayName("armed follows the same live read: on, then off, after a config change — no restart")
+    void armedIsHotAcrossAConfigChange() {
+        MutableProfiles live = new MutableProfiles(Map.of("terra", profileWithPattern("usage limit")));
+        LiveExhaustedPatterns patterns = new LiveExhaustedPatterns(live::get);
+
+        assertTrue(patterns.armed("terra"));
+
+        live.set(Map.of("terra", profileWithPattern(null)));
+
+        assertFalse(patterns.armed("terra"),
+                "removing exhaustedPattern and 'reloading' must disarm detection with no restart");
+    }
+
+    @Test
+    @DisplayName("an unchanged pattern string is not recompiled — the cache is reused")
+    void unchangedPatternTextReusesTheCompiledInstance() {
+        MutableProfiles live = new MutableProfiles(Map.of("terra", profileWithPattern("usage limit")));
+        LiveExhaustedPatterns patterns = new LiveExhaustedPatterns(live::get);
+
+        Pattern first = patterns.patternFor("terra");
+        // A NEW Profile object, same pattern text — a reload of an unrelated key produces a fresh
+        // FleetConfig even though this profile's own text did not change.
+        live.set(Map.of("terra", profileWithPattern("usage limit")));
+        Pattern second = patterns.patternFor("terra");
+
+        assertSame(first, second,
+                "identical pattern text must reuse the cached compiled Pattern, not recompile it — "
+                        + "recompiling a regex on every check is exactly the cost the cache exists to avoid");
+    }
+
+    @Test
+    @DisplayName("a changed pattern string is recompiled, not silently reused from the cache")
+    void changedPatternTextIsRecompiled() {
+        MutableProfiles live = new MutableProfiles(Map.of("terra", profileWithPattern("usage limit")));
+        LiveExhaustedPatterns patterns = new LiveExhaustedPatterns(live::get);
+
+        Pattern first = patterns.patternFor("terra");
+        live.set(Map.of("terra", profileWithPattern("rate limit")));
+        Pattern second = patterns.patternFor("terra");
+
+        assertNotSame(first, second, "changed pattern text must produce a freshly compiled Pattern");
+    }
+
+    @Test
+    void unknownProfileReturnsNullAndUnarmed() {
+        LiveExhaustedPatterns patterns = new LiveExhaustedPatterns(Map::of);
+        assertNull(patterns.patternFor("nope"));
+        assertFalse(patterns.armed("nope"));
+    }
+
+    @Test
+    void nullProfileNameReturnsNullAndUnarmed() {
+        LiveExhaustedPatterns patterns = new LiveExhaustedPatterns(
+                () -> Map.of("terra", profileWithPattern("usage limit")));
+        assertNull(patterns.patternFor(null));
+        assertFalse(patterns.armed(null));
+    }
+
+    @Test
+    void profileWithNoPatternConfiguredReturnsNull() {
+        LiveExhaustedPatterns patterns = new LiveExhaustedPatterns(
+                () -> Map.of("terra", profileWithPattern(null)));
+        assertNull(patterns.patternFor("terra"));
+        assertFalse(patterns.armed("terra"));
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/lead/LeadLauncherTest.java

@@ -9,6 +9,7 @@ import org.junit.jupiter.api.Test;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 
 import static org.junit.jupiter.api.Assertions.*;
 
@@ -106,6 +107,7 @@ class LeadLauncherTest {
 
         assertEquals(0, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads());
         assertFalse(herdr.called("agent.start"), "the live lead must not be duplicated");
+        assertFalse(herdr.called("tab.close"), "a labelled tab WITH a live agent must never be closed");
     }
 
     /**
@@ -122,6 +124,121 @@ class LeadLauncherTest {
                 "a stale label is not a lead; the lead must be relaunched");
     }
 
+    /**
+     * fleetd #359 review finding 1 — the exact scenario the ticket's own live evidence produced: on a
+     * real host, {@code agent.list} reported "0 live" for a tab a plain {@code ps} confirmed was
+     * running a real session. A single such reading must never close the tab outright — that would
+     * destroy the operator's actual lead, a worse failure than the stale-tab bug this ticket exists
+     * to fix. The first dead reading only flags the tab; mutate this away (make the first reading
+     * close instead of flag) and this test must fail.
+     */
+    @Test
+    void aStaleLabelledTabIsFlaggedRatherThanClosedOnTheFirstReconcile() {
+        FakeHerdr herdr = new FakeHerdr()
+                .withWorkspace("wL", "fleet")
+                .withTab("wL", "wL:t1", "lead: opus"); // label only, first look — could be a live session agent.list missed
+
+        assertEquals(1, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads());
+
+        assertFalse(herdr.called("tab.close"),
+                "one missed reading must never close a tab that might be hosting a live session");
+        assertTrue(flaggedTabIds(herdr).contains("wL:t1"),
+                "the stale tab must be flagged pending-close so a later reconcile can confirm it");
+    }
+
+    /**
+     * The operator's own trace on fleet01 (#359): a daemon that restarted several times, each
+     * occasion finding "0 live" for whatever reason, had left several identically-labelled dead
+     * tabs sitting side by side. Every one of them is flagged on its first dead reading, not closed —
+     * none is more or less trustworthy than another.
+     */
+    @Test
+    void allStaleLabelledTabsAreFlaggedRatherThanClosedOnTheFirstReconcile() {
+        FakeHerdr herdr = new FakeHerdr()
+                .withWorkspace("wL", "fleet")
+                .withTab("wL", "wL:t1", "lead: opus")
+                .withTab("wL", "wL:t2", "lead: opus")
+                .withTab("wL", "wL:t3", "lead: opus"); // three restarts' worth of debris, none confirmed twice yet
+
+        assertEquals(1, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads());
+
+        assertFalse(herdr.called("tab.close"), "no tab may be closed on its first dead reading");
+        assertEquals(Set.of("wL:t1", "wL:t2", "wL:t3"), flaggedTabIds(herdr),
+                "every dead labelled tab must be flagged, not just the first one found");
+    }
+
+    /**
+     * fleetd #359 review finding 1, the other half — a tab already flagged pending-close by an
+     * earlier reconcile, and STILL dead on this one, has now been read dead on two independent,
+     * separately-connected reconciles. That is strong enough evidence to actually close it. Mutate
+     * this away (never close a flagged tab) and this test must fail — the original #359 growth bug
+     * would come back for good.
+     */
+    @Test
+    void aTabAlreadyFlaggedPendingCloseIsClosedWhenStillDeadOnALaterReconcile() {
+        FakeHerdr herdr = new FakeHerdr()
+                .withWorkspace("wL", "fleet")
+                .withTab("wL", "wL:t1", "lead: opus [fleetd:pending-close]"); // flagged last reconcile, still dead
+
+        assertEquals(1, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads());
+
+        assertTrue(herdr.called("tab.close"),
+                "a tab dead on two independent reconciles must finally be closed");
+        assertEquals("wL:t1", ((Map<?, ?>) herdr.lastCall("tab.close").params()).get("tab_id"));
+    }
+
+    /** All of several already-flagged, still-dead tabs are closed — not just the first found. */
+    @Test
+    void allTabsAlreadyFlaggedPendingCloseAreClosedWhenStillDead() {
+        FakeHerdr herdr = new FakeHerdr()
+                .withWorkspace("wL", "fleet")
+                .withTab("wL", "wL:t1", "lead: opus [fleetd:pending-close]")
+                .withTab("wL", "wL:t2", "lead: opus [fleetd:pending-close]")
+                .withTab("wL", "wL:t3", "lead: opus [fleetd:pending-close]");
+
+        assertEquals(1, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads());
+
+        List<Object> closedTabIds = herdr.calls.stream()
+                .filter(c -> c.method().equals("tab.close"))
+                .<Object>map(c -> ((Map<?, ?>) c.params()).get("tab_id"))
+                .toList();
+        assertEquals(3, closedTabIds.size(),
+                "every confirmed-dead labelled tab must be closed, not just the first one found");
+        assertEquals(Set.of("wL:t1", "wL:t2", "wL:t3"), Set.copyOf(closedTabIds));
+    }
+
+    /**
+     * A tab flagged pending-close on a previous reconcile that is running an agent again — the miss
+     * that flagged it was transient. It must never be closed, and its flag must be cleared so a
+     * future, unrelated miss starts its own two-reading count from zero.
+     */
+    @Test
+    void aFlaggedTabRunningAnAgentAgainHasItsFlagClearedInsteadOfBeingClosed() {
+        FakeHerdr herdr = new FakeHerdr()
+                .withWorkspace("wL", "fleet")
+                .withTab("wL", "wL:t1", "lead: opus [fleetd:pending-close]")
+                .withAgent("lead-opus", "term_lead", "wL:p1", "wL:t1"); // it recovered — really alive now
+
+        assertEquals(0, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads(),
+                "the lead is live again — nothing to relaunch");
+
+        assertFalse(herdr.called("tab.close"), "a tab running an agent again must never be closed");
+        assertFalse(herdr.called("agent.start"), "the lead is live again — nothing to relaunch");
+        assertEquals("wL:t1", ((Map<?, ?>) herdr.lastCall("tab.rename").params()).get("tab_id"));
+        assertEquals("lead: opus", ((Map<?, ?>) herdr.lastCall("tab.rename").params()).get("label"),
+                "the pending-close flag must be cleared once the tab is confirmed live again");
+    }
+
+    /** Every {@code tab.rename} call whose label carries the pending-close marker, by tab id. */
+    private static Set<String> flaggedTabIds(FakeHerdr herdr) {
+        return herdr.calls.stream()
+                .filter(c -> c.method().equals("tab.rename"))
+                .filter(c -> String.valueOf(((Map<?, ?>) c.params()).get("label"))
+                        .endsWith("[fleetd:pending-close]"))
+                .map(c -> String.valueOf(((Map<?, ?>) c.params()).get("tab_id")))
+                .collect(java.util.stream.Collectors.toUnmodifiableSet());
+    }
+
     /**
      * A lead the operator opened by hand is live once its tab carries the configured `tab:` label —
      * CB-579 retired the `terminal:` pin, so a hand-opened lead is found the same way an

fleetd/src/test/java/dev/ltms/fleet/mcp/CharterToolSurfaceTest.java

@@ -0,0 +1,72 @@
+package dev.ltms.fleet.mcp;
+
+import dev.ltms.fleet.config.FleetConfig;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.LinkedHashSet;
+import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/** fleetd #464: launch charters must not name MCP tools the server does not register. */
+class CharterToolSurfaceTest {
+
+    private static final Path MCP_SOURCE = Path.of("src/main/java/dev/ltms/fleet/mcp/FleetMcp.java");
+
+    private static Set<String> matches(String text, String regex) {
+        Matcher m = Pattern.compile(regex).matcher(text);
+        Set<String> found = new LinkedHashSet<>();
+        while (m.find()) {
+            found.add(m.group(1));
+        }
+        return found;
+    }
+
+    /** Every {@code fleet_*} or legacy {@code bridge_*} token in the configured launch charters. */
+    private static Set<String> toolsNamedIn(FleetConfig config) {
+        return matches(String.join("\n", config.fleet().charters().values()),
+                "(fleet_[a-z_]+|bridge_[a-z_]+)");
+    }
+
+    /** Every tool {@link FleetMcp} registers, read from its {@code tool("…")} calls. */
+    private static Set<String> toolsTheServerRegisters() throws Exception {
+        return matches(Files.readString(MCP_SOURCE), "tool\\(\\\"(fleet_[a-z_]+)\\\"");
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] every tool named in a configured charter is registered by the server")
+    void configuredChartersNameOnlyRegisteredTools(@TempDir Path dir) throws Exception {
+        Path configFile = dir.resolve("charters.yaml");
+        Files.writeString(configFile, """
+                fleet:
+                  charters:
+                    dev: |
+                      Send the final handoff through fleet_reply.
+                    reviewer: |
+                      Use fleet_ask only for the lead's decision.
+                """);
+
+        FleetConfig config = FleetConfig.load(configFile);
+        Set<String> named = toolsNamedIn(config);
+        Set<String> registered = toolsTheServerRegisters();
+
+        assertTrue(!named.isEmpty(),
+                "the charter fixture named no fleet_* or bridge_* tool. This test would check nothing; "
+                        + "add charter text that names a tool before changing the extraction.");
+        assertTrue(!registered.isEmpty(),
+                "the FleetMcp registration scrape found no tools. This test would check nothing; "
+                        + "repair the tool(\"…\") extraction before changing the assertion.");
+
+        Set<String> unknown = new LinkedHashSet<>(named);
+        unknown.removeAll(registered);
+        assertTrue(unknown.isEmpty(),
+                "configured charter text names " + unknown + ", but FleetMcp does not register it. "
+                        + "Checked " + named + " against " + registered + ". Fix the charter text or "
+                        + "register the tool; do NOT weaken this test.");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpAuthzTest.java

@@ -187,6 +187,71 @@ class FleetMcpAuthzTest {
                 "no CallerResolver supplied ⇒ authorization not enforced (legacy behaviour)");
     }
 
+    // --- fleetd #439: who may see fleet_list's coordinator row ----------------------------------
+
+    /**
+     * fleetd #439: {@link FleetMcp#coordinatorVisibleTo} is the whole policy decision for
+     * {@code fleet_list}'s {@code coordinator} row — lead-to-lead coordination state, not roster
+     * observation. Only the primary may see it; a worker, an architect, and (the case the previous
+     * pass of this ticket did not cover) an anonymous caller must all be refused.
+     */
+    @Test
+    void onlyThePrimaryMaySeeTheCoordinatorRow() {
+        assertTrue(FleetMcp.coordinatorVisibleTo(PRIMARY), "the primary must see its own coordination state");
+        assertFalse(FleetMcp.coordinatorVisibleTo(WORKER_A), "a worker must not see lead-to-lead coordination state");
+        assertFalse(FleetMcp.coordinatorVisibleTo(ARCH_DESIGN),
+                "an architect holds READ today, but that must not extend to coordinator");
+        assertFalse(FleetMcp.coordinatorVisibleTo(ANON), "authenticated as nothing must not see it either");
+    }
+
+    /**
+     * fleetd #439 / PR #462 review finding M2: the predicate above can be perfectly correct while
+     * the one production call site (the {@code fleet_list} MCP handler) never actually asks it —
+     * a literal {@code true} compiles, and the whole suite stayed green under that mutation because
+     * every existing test drives {@link FleetMcp#listFleet} directly and supplies the boolean
+     * itself. This test reads {@code FleetMcp.java}'s own source (same idiom as {@link
+     * #toolsTheServerRegisters()} / {@link #everyRegisteredToolHasItsHandlerActionPinned()}) and
+     * asserts the handler's call passes {@code coordinatorVisibleTo(principal(exchange))} — not a
+     * literal {@code true} or {@code false} — as {@code listFleet}'s trailing argument.
+     *
+     * <p>Anchored on argument position, not a bare substring search: {@code true} appears many
+     * times elsewhere in this file for unrelated reasons, so a plain {@code contains("true")}
+     * check would prove nothing. The pattern requires the literal text immediately before the
+     * closing {@code );} of the {@code listFleet(} call inside the handler block to be exactly
+     * {@code coordinatorVisibleTo(principal(exchange))}.
+     */
+    @Test
+    void theFleetListHandlerActuallyConsultsCoordinatorVisibleTo() throws Exception {
+        String source = Files.readString(MCP_SOURCE);
+
+        // Isolate the fleet_list handler block: from its declaration up to the next handler's
+        // declaration. A change to variable naming would break this scrape loudly (see the control
+        // assertion just below), rather than silently reporting "no violation found".
+        int start = source.indexOf("listHandler =");
+        assertTrue(start >= 0, "could not find the fleet_list handler (listHandler) in " + MCP_SOURCE
+                + " -- the scrape has stopped matching, fix the anchor before trusting this test");
+        int end = source.indexOf("stopHandler =", start);
+        assertTrue(end > start, "could not find the handler declared after listHandler to bound the scrape");
+        String handlerBlock = source.substring(start, end);
+
+        // CONTROL: the block we scraped really does contain a call to listFleet(...) -- if this
+        // fails, the anchors above moved and the assertion below would otherwise pass on nothing.
+        assertTrue(handlerBlock.contains("listFleet("),
+                "control failed: the scraped listHandler block contains no listFleet( call at all -- "
+                        + "the anchors have drifted, this test is not testing what it claims to");
+
+        Pattern trailingArg = Pattern.compile(
+                "listFleet\\([^;]*?,\\s*(coordinatorVisibleTo\\(principal\\(exchange\\)\\)|true|false)\\s*\\)\\s*;",
+                Pattern.DOTALL);
+        Matcher m = trailingArg.matcher(handlerBlock);
+        assertTrue(m.find(), "could not locate listFleet(...)'s trailing boolean argument in the "
+                + "listHandler block -- the call shape changed, update this test's anchor: " + handlerBlock);
+        String trailing = m.group(1);
+        assertEquals("coordinatorVisibleTo(principal(exchange))", trailing,
+                "the fleet_list handler must ask coordinatorVisibleTo(principal(exchange)) who is "
+                        + "calling, not pass a literal boolean -- found: " + trailing);
+    }
+
     // --- which action each tool hands the gate (fleetd #272) ------------------------------------
 
     /**
@@ -201,14 +266,34 @@ class FleetMcpAuthzTest {
      */
     @Test
     void pollingByTargetIsADrainAndPollingByTicketIsARead() {
-        assertEquals(Authz.Action.DRAIN, FleetMcp.pollAction("term_b"),
+        assertEquals(Authz.Action.DRAIN, FleetMcp.pollAction("term_b", null),
                 "poll by target removes the replies — that is a drain, not an observation");
-        assertEquals(Authz.Action.READ, FleetMcp.pollAction(null),
+        assertEquals(Authz.Action.READ, FleetMcp.pollAction(null, null),
                 "poll by ticket changes nothing");
-        assertEquals(Authz.Action.READ, FleetMcp.pollAction("  "),
+        assertEquals(Authz.Action.READ, FleetMcp.pollAction("  ", null),
                 "a blank target is an absent target");
     }
 
+    /**
+     * fleetd #421: a coordId branch is a THIRD operation behind fleet_poll's one name, and it must
+     * map to {@link Authz.Action#COORD_READ} — never {@link Authz.Action#READ}, even though this
+     * branch also consumes nothing. READ's grant is open to every authenticated role on the premise
+     * that the roster carries no secrets; a lead-to-lead body is not the roster, so folding this
+     * branch into READ would let any worker read every peer lead's mail in full. coordId also takes
+     * priority over target when both happen to be present — it addresses a different inbox entirely.
+     */
+    @Test
+    void pollingByCoordIdIsACoordReadNeverAPlainRead() {
+        assertEquals(Authz.Action.COORD_READ, FleetMcp.pollAction(null, "mac-opus"),
+                "reading held peer mail must not be mapped to the everyone-readable READ action");
+        assertEquals(Authz.Action.COORD_READ, FleetMcp.pollAction("  ", "mac-opus"),
+                "a blank target must not fall through to READ/DRAIN when coordId is present");
+        assertEquals(Authz.Action.READ, FleetMcp.pollAction(null, "  "),
+                "a blank coordId is an absent coordId, same as target/ticket");
+        assertEquals(Authz.Action.COORD_READ, FleetMcp.pollAction("term_b", "mac-opus"),
+                "coordId takes priority over target — this is a different inbox, not a drain");
+    }
+
     @Test
     void everyRegisteredToolHasItsHandlerActionPinned() {
         Set<String> registered = toolsTheServerRegisters();
@@ -230,6 +315,8 @@ class FleetMcpAuthzTest {
         assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_whoami", Map.of()));
         assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_poll", Map.of("ticket", "task")));
         assertEquals(Authz.Action.DRAIN, FleetMcp.toolAction("fleet_poll", Map.of("target", "term_b")));
+        assertEquals(Authz.Action.COORD_READ,
+                FleetMcp.toolAction("fleet_poll", Map.of("coordId", "mac-opus")));
     }
 
     private static Set<String> toolsTheServerRegisters() {
@@ -249,11 +336,11 @@ class FleetMcpAuthzTest {
     void aWorkerMayNotDrainAnotherSessionsInboxByPolling() {
         FleetMcp m = mcp(true);
 
-        assertNotNull(m.denyFor(WORKER_A, FleetMcp.pollAction("term_b"), "term_b"),
+        assertNotNull(m.denyFor(WORKER_A, FleetMcp.pollAction("term_b", null), "term_b"),
                 "a worker draining a peer's inbox would destroy replies queued for the primary");
-        assertNotNull(m.denyFor(ARCH_DESIGN, FleetMcp.pollAction("term_b"), "term_b"),
+        assertNotNull(m.denyFor(ARCH_DESIGN, FleetMcp.pollAction("term_b", null), "term_b"),
                 "an architect has no lifecycle rights either — same gate as fleet_ack");
-        assertNull(m.denyFor(PRIMARY, FleetMcp.pollAction("term_b"), "term_b"),
+        assertNull(m.denyFor(PRIMARY, FleetMcp.pollAction("term_b", null), "term_b"),
                 "collecting a held reply is the primary's job");
     }
 
@@ -265,11 +352,33 @@ class FleetMcpAuthzTest {
     void pollingAnOwnTicketStaysOpenToWorkersAndArchitects() {
         FleetMcp m = mcp(true);
 
-        assertNull(m.denyFor(WORKER_A, FleetMcp.pollAction(null), null));
-        assertNull(m.denyFor(ARCH_DESIGN, FleetMcp.pollAction(null), null),
+        assertNull(m.denyFor(WORKER_A, FleetMcp.pollAction(null, null), null));
+        assertNull(m.denyFor(ARCH_DESIGN, FleetMcp.pollAction(null, null), null),
                 "an architect delegates with wait:false, so it must be able to poll its ticket");
     }
 
+    /**
+     * fleetd #421 acceptance: the whole ticket, pinned at the policy-table layer. A worker must be
+     * refused the coordId branch, the primary must be allowed, and (CB-548) an architect — which
+     * holds READ today — must be refused too, because "not primary" means not-architect here.
+     */
+    @Test
+    void aWorkerAndAnArchitectMayNotReadHeldPeerMailOnlyThePrimaryMay() {
+        FleetMcp m = mcp(true);
+        Authz.Action coordRead = FleetMcp.pollAction(null, "mac-opus");
+
+        McpSchema.CallToolResult workerDenied = m.denyFor(WORKER_A, coordRead, null);
+        assertNotNull(workerDenied, "a worker must not read held lead-to-lead mail");
+        assertTrue(workerDenied.isError());
+
+        McpSchema.CallToolResult archDenied = m.denyFor(ARCH_DESIGN, coordRead, null);
+        assertNotNull(archDenied, "an architect holds READ today, but not-primary must mean "
+                + "not-architect here too");
+        assertTrue(archDenied.isError());
+
+        assertNull(m.denyFor(PRIMARY, coordRead, null), "reading its own held mail is the primary's job");
+    }
+
     // --- identity reconstruction from the transport context ------------------------------------
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpLeadCoordTest.java

@@ -1,6 +1,7 @@
 package dev.ltms.fleet.mcp;
 
 import dev.ltms.fleet.msg.FakeLeadChannel;
+import dev.ltms.fleet.msg.LeadChannel;
 import dev.ltms.fleet.msg.LeadMessage;
 import io.modelcontextprotocol.spec.McpSchema;
 import org.junit.jupiter.api.Test;
@@ -93,4 +94,56 @@ class FleetMcpLeadCoordTest {
         assertTrue(FleetMcp.sendToLead(channel, PEER, "   ", null, null).isError());
         assertEquals(0, channel.published().size());
     }
+
+    /**
+     * fleetd #361: "delivered" overstated what publish actually proves — the broker's confirm means
+     * durably queued, not read. A zero-consumer target is the observable form of "this will not
+     * reach a pane right now", so the (still-successful) result must say so.
+     */
+    @Test
+    void warnsWhenThePeerMailboxHasNoConsumersButStillReportsSuccess() {
+        var channel = new FakeLeadChannel(SELF)
+                .withMailbox(PEER, LeadChannel.MailboxState.exists(PEER, 0, 0));
+
+        McpSchema.CallToolResult res = FleetMcp.sendToLead(channel, PEER, "hi", null, null);
+
+        assertFalse(res.isError(), "a zero-consumer mailbox is still a successful, durably-queued publish");
+        String out = textOf(res);
+        assertTrue(out.contains("durably confirmed"), out);
+        assertTrue(out.toLowerCase().contains("no consumers"), () -> "must warn nobody is reading it: " + out);
+    }
+
+    @Test
+    void staysQuietAboutConsumersWhenThePeerMailboxHasOne() {
+        var channel = new FakeLeadChannel(SELF)
+                .withMailbox(PEER, LeadChannel.MailboxState.exists(PEER, 0, 1));
+
+        McpSchema.CallToolResult res = FleetMcp.sendToLead(channel, PEER, "hi", null, null);
+
+        assertFalse(res.isError());
+        String out = textOf(res);
+        assertTrue(out.contains("durably confirmed"), out);
+        assertFalse(out.toLowerCase().contains("no consumers"), () -> "a consumer IS attached: " + out);
+    }
+
+    /**
+     * fleetd #361 review finding 1: an unmeasured fact must never render as a definite one. When
+     * the post-publish probe could not determine the mailbox's consumer count at all (broker slow,
+     * unreachable, or the probe timed out — {@link LeadChannel.MailboxState#unknown}), the result
+     * must stay just as quiet as the has-a-consumer case — never assert "no consumers" for a mailbox
+     * this call never actually measured.
+     */
+    @Test
+    void staysQuietAboutConsumersWhenThePeerMailboxStateIsUnknown() {
+        var channel = new FakeLeadChannel(SELF)
+                .withMailbox(PEER, LeadChannel.MailboxState.unknown(PEER));
+
+        McpSchema.CallToolResult res = FleetMcp.sendToLead(channel, PEER, "hi", null, null);
+
+        assertFalse(res.isError(), "an unresolved post-publish probe must never turn a durably-confirmed publish into an error");
+        String out = textOf(res);
+        assertTrue(out.contains("durably confirmed"), out);
+        assertFalse(out.toLowerCase().contains("no consumers"),
+                () -> "an unmeasured fact must never be reported as a definite zero-consumer mailbox: " + out);
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpTest.java

@@ -3,6 +3,7 @@ package dev.ltms.fleet.mcp;
 import dev.ltms.fleet.auth.CallerResolver;
 import dev.ltms.fleet.auth.MemberRegistry;
 import dev.ltms.fleet.auth.Principal;
+import dev.ltms.fleet.auth.Role;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.AgentControl;
@@ -10,6 +11,9 @@ import dev.ltms.fleet.herdr.FakeHerdr;
 import dev.ltms.fleet.herdr.PaneLocator;
 import dev.ltms.fleet.herdr.WorkspaceControl;
 import dev.ltms.fleet.inject.Injector;
+import dev.ltms.fleet.msg.FakeLeadChannel;
+import dev.ltms.fleet.msg.LeadChannel;
+import dev.ltms.fleet.msg.LeadMessage;
 import dev.ltms.fleet.msg.MessageService;
 import dev.ltms.fleet.msg.Rendezvous;
 import dev.ltms.fleet.session.FakeWorktrees;
@@ -25,6 +29,7 @@ import dev.ltms.fleet.placement.BackendQuarantine;
 import dev.ltms.fleet.placement.PlacementPolicies;
 import io.modelcontextprotocol.spec.McpSchema;
 import dev.ltms.fleet.msg.InMemoryReplyInbox;
+import dev.ltms.fleet.msg.ReplyInbox;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
@@ -34,7 +39,9 @@ import java.util.Map;
 import java.util.EnumSet;
 import java.util.Set;
 import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.function.Function;
 
 import static org.junit.jupiter.api.Assertions.*;
@@ -72,7 +79,7 @@ class FleetMcpTest {
             Thread.sleep(5);
         }
         assertTrue(rendezvous.isWaiting(target), "send should be accepted for " + target);
-        FleetMcp.reply(messages, target, "received");
+        FleetMcp.reply(messages, target, Role.WORKER, "received");
         assertEquals("received", textOf(send.get(6, TimeUnit.SECONDS)));
     }
 
@@ -103,8 +110,10 @@ class FleetMcpTest {
         }
         assertTrue(rendezvous.isWaiting("term_a"), "send should have opened its waiter");
 
-        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", "LGTM");
-        assertEquals("delivered", textOf(reply));
+        // fleetd #365: a resolved live send must read distinctly from a merely-queued reply —
+        // see replyWithNoPendingSendIsQueuedNotError below for the other case.
+        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", Role.WORKER, "LGTM");
+        assertEquals(MessageService.ReplyOutcome.RESOLVED_SEND.description(), textOf(reply));
 
         McpSchema.CallToolResult res = send.get(6, TimeUnit.SECONDS);
         assertNotEquals(Boolean.TRUE, res.isError());
@@ -129,8 +138,8 @@ class FleetMcpTest {
         }
         assertTrue(rendezvous.isWaiting("term_a"), "send should have opened its waiter");
 
-        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", "async LGTM");
-        assertEquals("delivered", textOf(reply));
+        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", Role.WORKER, "async LGTM");
+        assertEquals(MessageService.ReplyOutcome.RESOLVED_SEND.description(), textOf(reply));
 
         // Poll until the async send completes and reports the reply.
         McpSchema.CallToolResult polled = FleetMcp.poll(messages, ticket, null);
@@ -176,7 +185,7 @@ class FleetMcpTest {
             Thread.sleep(5);
         }
         assertTrue(rendezvous.isWaiting("term_a"));
-        FleetMcp.reply(messages, "term_a", "done");
+        FleetMcp.reply(messages, "term_a", Role.WORKER, "done");
         assertEquals("done", textOf(answer.get(6, TimeUnit.SECONDS)));
 
         McpSchema.CallToolResult done = FleetMcp.poll(messages, ticket, null);
@@ -208,7 +217,7 @@ class FleetMcpTest {
         // fleet_poll{ticket} stuck PENDING forever and later force-failed with a false "session
         // released before it replied" reason. This used to land in the inbox instead (see the old
         // assertion this replaced: messages.drainReplies("term_a").getFirst()...) — that was the bug.
-        FleetMcp.reply(messages, "term_a", "finished after timeout");
+        FleetMcp.reply(messages, "term_a", Role.WORKER, "finished after timeout");
         assertEquals("finished after timeout", textOf(FleetMcp.poll(messages, ticket, null)));
         assertTrue(messages.drainReplies("term_a").isEmpty(),
                 "the reply completed its own ticket directly and never touched the inbox");
@@ -262,7 +271,7 @@ class FleetMcpTest {
         }
         assertEquals(MessageService.Phase.FAILED, second.phase());
 
-        FleetMcp.reply(messages, "term_a", "late reply");
+        FleetMcp.reply(messages, "term_a", Role.WORKER, "late reply");
         assertEquals("late reply", messages.drainReplies("term_a").getFirst().content());
 
         CompletableFuture<McpSchema.CallToolResult> answer = CompletableFuture.supplyAsync(
@@ -271,7 +280,7 @@ class FleetMcpTest {
         while (!rendezvous.isWaiting("term_a") && System.currentTimeMillis() < deadline) {
             Thread.sleep(5);
         }
-        FleetMcp.reply(messages, "term_a", "done");
+        FleetMcp.reply(messages, "term_a", Role.WORKER, "done");
         assertEquals("done", textOf(answer.get(6, TimeUnit.SECONDS)));
     }
 
@@ -323,9 +332,10 @@ class FleetMcpTest {
     @Test
     void replyWithNoPendingSendIsQueuedNotError() {
         // CB-307: a reply with no open send is now queued in the inbox, not an error.
-        McpSchema.CallToolResult res = FleetMcp.reply(messages, "term_a", "orphan");
+        // fleetd #365: it must also no longer claim "delivered" — nothing was waiting for it.
+        McpSchema.CallToolResult res = FleetMcp.reply(messages, "term_a", Role.WORKER, "orphan");
         assertNotEquals(Boolean.TRUE, res.isError(), "a queued reply is not an error");
-        assertEquals("delivered", textOf(res));
+        assertEquals(MessageService.ReplyOutcome.QUEUED.description(), textOf(res));
 
         // The reply is drainable by target.
         var drained = messages.drainReplies("term_a");
@@ -333,6 +343,40 @@ class FleetMcpTest {
         assertEquals("orphan", drained.getFirst().content());
     }
 
+    @Test
+    void replyFromLeadIsRefusedBeforeItCanPublishToTheWorkerInbox() {
+        ReplyInbox inboxThatRejectsPublishes = new ReplyInbox() {
+            @Override public void own(String target) { }
+            @Override public void release(String target) { }
+            @Override public void publish(String target, String msgId, String content) {
+                fail("a lead fleet_reply must not publish to the worker inbox");
+            }
+            @Override public List<InboxMessage> peek(String target) { return List.of(); }
+            @Override public boolean ack(String target, String msgId) { return false; }
+        };
+        MessageService leadMessages = new MessageService(agents, new Injector(agents), new Rendezvous(),
+                inboxThatRejectsPublishes);
+
+        McpSchema.CallToolResult res = assertDoesNotThrow(
+                () -> FleetMcp.reply(leadMessages, "term_lead", Role.PRIMARY, "peer reply"));
+
+        assertTrue(res.isError());
+        assertEquals("fleet_reply has no route to a peer lead. Use fleet_send{coordId: ...} for a peer on another "
+                        + "daemon or fleet_send{sessionId: ...} for a peer on this host. fleet_reply resolves a member's "
+                        + "blocked fleet_send, and a peer's coord-id message is durable and non-blocking, so there is "
+                        + "nothing for it to resolve.",
+                textOf(res));
+    }
+
+    @Test
+    void replyFromUnidentifiedCallerKeepsItsOwnError() {
+        McpSchema.CallToolResult res = FleetMcp.reply(messages, null, Role.PRIMARY, "reply");
+
+        assertTrue(res.isError());
+        assertEquals("fleet_reply is for workers only — could not identify the calling worker from the connection",
+                textOf(res));
+    }
+
     @Test
     void replyWithBlankContentIsACleanToolErrorNotAnUncaughtException() {
         // fleetd #302: MessageService.reply now REJECTS blank content by throwing. fleet_reply's
@@ -343,7 +387,7 @@ class FleetMcpTest {
         // has always used isBlank for exactly this reason.
         for (String blank : new String[] {null, "", "   ", "\n\t"}) {
             McpSchema.CallToolResult res = assertDoesNotThrow(
-                    () -> FleetMcp.reply(messages, "term_a", blank),
+                    () -> FleetMcp.reply(messages, "term_a", Role.WORKER, blank),
                     "blank content must be refused as a tool error, never thrown out of the handler");
             assertEquals(Boolean.TRUE, res.isError(), "blank content is an error result");
             assertTrue(textOf(res).contains("content is required"),
@@ -356,7 +400,7 @@ class FleetMcpTest {
     @Test
     void bridgePollWithTargetDrainsReplies() {
         // A reply with no open send queues it in the inbox.
-        FleetMcp.reply(messages, "term_a", "queued-msg");
+        FleetMcp.reply(messages, "term_a", Role.WORKER, "queued-msg");
 
         // fleet_poll with target drains the inbox.
         McpSchema.CallToolResult res = FleetMcp.poll(messages, null, "term_a");
@@ -407,8 +451,8 @@ class FleetMcpTest {
             Thread.sleep(5);
         }
         assertTrue(rendezvous.isWaiting("term_a"), "the answer should have reopened a waiter");
-        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", "done");
-        assertEquals("delivered", textOf(reply));
+        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", Role.WORKER, "done");
+        assertEquals(MessageService.ReplyOutcome.RESOLVED_SEND.description(), textOf(reply));
         assertEquals("done", textOf(answer.get(6, TimeUnit.SECONDS)));
     }
 
@@ -530,6 +574,38 @@ class FleetMcpTest {
         assertTrue(out.contains("\"quarantinedForSeconds\":1800"), out);
     }
 
+    /**
+     * fleetd #466 scope item 2: {@code fleet_profiles} must carry the repeat count beside the
+     * remaining seconds, and the two must come off the one {@link BackendQuarantine#status} call so
+     * they can never disagree about which streak this is (see {@code profilesView}'s javadoc).
+     */
+    @Test
+    void profilesReportsQuarantineAttemptBesideRemainingSeconds() {
+        FakeHerdr h = new FakeHerdr();
+        java.util.concurrent.atomic.AtomicLong now = new java.util.concurrent.atomic.AtomicLong(0L);
+        BackendQuarantine quarantine = BackendQuarantine.withEscalation(now::get, TimeUnit.MINUTES.toNanos(30));
+        quarantine.quarantine("shared-openai"); // attempt 1: 1800s
+        now.set(TimeUnit.MINUTES.toNanos(30));
+        quarantine.quarantine("shared-openai"); // attempt 2: 3600s
+        FleetMcp.QuarantineSource source = new FleetMcp.QuarantineSource(
+                profile -> "ltms-local".equals(profile) ? "shared-openai" : null, quarantine);
+        McpSchema.CallToolResult res = FleetMcp.profiles(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), source);
+        String out = textOf(res);
+        assertTrue(out.contains("\"quarantinedForSeconds\":3600"), out);
+        assertTrue(out.contains("\"quarantineAttempt\":2"), out);
+    }
+
+    /** A never-quarantined profile must not carry {@code quarantineAttempt} either. */
+    @Test
+    void profilesOmitsQuarantineAttemptWhenNotQuarantined() {
+        FakeHerdr h = new FakeHerdr();
+        McpSchema.CallToolResult res = FleetMcp.profiles(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), FleetMcp.QuarantineSource.none());
+        String out = textOf(res);
+        assertFalse(out.contains("quarantineAttempt"), out);
+    }
+
     /** fleetd #201 Unit 5: {@code coolingOff} is a SEPARATE map from {@code quarantined}. */
     @Test
     void profilesReportsACoolingOffCredentialInASeparateMap() {
@@ -576,17 +652,48 @@ class FleetMcpTest {
     void listReportsThisDaemonsOwnCoordIdWhenLeadCoordinationIsOn() {
         FakeHerdr h = new FakeHerdr();
         SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        FakeLeadChannel channel = new FakeLeadChannel("mac-opus")
+                .withMailbox("mac-opus", LeadChannel.MailboxState.exists("mac-opus", 0, 1));
 
         McpSchema.CallToolResult res = FleetMcp.listFleet(
                 workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, null,
                 FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
-                FleetMcp.QuarantineSource.none(), Map.of(), "", "mac-opus");
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), FleetMcp.LeadSeatSource.none(),
+                Map.of(), "", new FleetMcp.CoordinationSource(channel, List.of()), true);
 
         String out = textOf(res);
-        // There is no peer-discovery surface yet, so this row answers the one question an operator
-        // cannot answer any other way: which coord-id a peer must use to reach ME.
+        // fleetd #361: reports both which coord-id a peer must use to reach ME, and this daemon's
+        // own mailbox state (a self-diagnosis: is my own consumer actually attached?).
         assertTrue(out.contains("\"coordinator\""), out);
         assertTrue(out.contains("\"selfId\":\"mac-opus\""), out);
+        assertTrue(out.contains("\"mailbox\":{\"status\":\"exists\",\"pending\":0,\"consumers\":1}"), out);
+        assertTrue(out.contains("\"held\":[]"), out);
+        assertTrue(out.contains("\"peers\":[]"), out);
+    }
+
+    /**
+     * fleetd #361 review finding 1: a self-probe that could not complete (broker unreachable, timed
+     * out) must never render the same as a measured "0 pending, 0 consumers" — that was exactly the
+     * bug: a reader could not tell "my mailbox is empty and idle" from "I could not check", and the
+     * second one is the far more alarming state.
+     */
+    @Test
+    void listReportsAnUnresolvedSelfProbeAsUnknownNeverAsAMeasuredZero() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        FakeLeadChannel channel = new FakeLeadChannel("mac-opus")
+                .withMailbox("mac-opus", LeadChannel.MailboxState.unknown("mac-opus"));
+
+        McpSchema.CallToolResult res = FleetMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, null,
+                FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), FleetMcp.LeadSeatSource.none(),
+                Map.of(), "", new FleetMcp.CoordinationSource(channel, List.of()), true);
+
+        String out = textOf(res);
+        assertTrue(out.contains("\"mailbox\":{\"status\":\"unknown\"}"), out);
+        assertFalse(out.contains("\"pending\""), "an unresolved probe must never carry a pending count at all: " + out);
+        assertFalse(out.contains("\"consumers\""), "an unresolved probe must never carry a consumers count at all: " + out);
     }
 
     @Test
@@ -601,6 +708,334 @@ class FleetMcpTest {
                 "an ordinary fleet's output must be unchanged by this feature");
     }
 
+    /**
+     * fleetd #463: a compat overload called with no {@code callerIsPrimary} argument at all must
+     * fail closed, not open. Before this fix the hidden default was {@code true}, so a caller that
+     * forgot the argument silently got lead-to-lead coordination state. Lead coordination is fully
+     * configured here (a real channel, a real mailbox) specifically so this is not conflated with
+     * {@link #listOmitsTheCoordinatorRowWhenLeadCoordinationIsOff} -- the row is capable of being
+     * assembled, and the missing argument is the only reason it is not.
+     */
+    @Test
+    void listCompatOverloadWithNoCallerIsPrimaryArgumentOmitsTheCoordinatorKey() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        FakeLeadChannel channel = new FakeLeadChannel("mac-opus")
+                .withMailbox("mac-opus", LeadChannel.MailboxState.exists("mac-opus", 0, 1));
+
+        McpSchema.CallToolResult res = FleetMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, null,
+                FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), Map.of(), "",
+                new FleetMcp.CoordinationSource(channel, List.of()));
+
+        String out = textOf(res);
+        assertFalse(out.contains("\"coordinator\""),
+                "no callerIsPrimary argument must fail closed (absent), not open (present): " + out);
+    }
+
+    /**
+     * fleetd #439: a worker calling {@code fleet_list} must get a result with the {@code
+     * coordinator} key <strong>absent</strong> -- not an empty object, not a redacted one -- even
+     * though lead coordination is fully configured and would otherwise report a row. This drives
+     * the same {@code callerIsPrimary} value the MCP handler computes ({@code
+     * Principal.worker(...).isPrimary()}), so it pins the real production boolean, not a literal.
+     */
+    @Test
+    void listOmitsTheCoordinatorKeyEntirelyForAWorkerEvenWhenLeadCoordinationIsOn() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        FakeLeadChannel channel = new FakeLeadChannel("mac-opus")
+                .withMailbox("mac-opus", LeadChannel.MailboxState.exists("mac-opus", 0, 1));
+        boolean callerIsPrimary = Principal.worker("term_a", 1).isPrimary();
+
+        McpSchema.CallToolResult res = FleetMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, null,
+                FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), FleetMcp.LeadSeatSource.none(),
+                Map.of(), "", new FleetMcp.CoordinationSource(channel, List.of()), callerIsPrimary);
+
+        String out = textOf(res);
+        assertFalse(out.contains("\"coordinator\""), "a worker must never see the coordinator key at all: " + out);
+        assertFalse(out.contains("mac-opus"), "no fragment of the coordinator row may leak either: " + out);
+        assertTrue(out.contains("\"leads\""), "the rest of the result must still be present: " + out);
+        assertTrue(out.contains("\"members\""), out);
+        assertTrue(out.contains("\"healthCoverage\""), out);
+    }
+
+    /**
+     * fleetd #439 acceptance criterion 2: an architect gets exactly the same treatment as a worker.
+     * This is a real, executed test (not just reasoning by analogy) -- it drives the actual
+     * {@code Principal.architect(...).isPrimary()} value the production handler would compute for
+     * an architect caller, through the same gate a worker's call goes through.
+     */
+    @Test
+    void listOmitsTheCoordinatorKeyEntirelyForAnArchitectToo() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        FakeLeadChannel channel = new FakeLeadChannel("mac-opus")
+                .withMailbox("mac-opus", LeadChannel.MailboxState.exists("mac-opus", 0, 1));
+        boolean callerIsPrimary = Principal.architect("lead-designer", "term_design", 400).isPrimary();
+
+        McpSchema.CallToolResult res = FleetMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, null,
+                FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), FleetMcp.LeadSeatSource.none(),
+                Map.of(), "", new FleetMcp.CoordinationSource(channel, List.of()), callerIsPrimary);
+
+        String out = textOf(res);
+        assertFalse(out.contains("\"coordinator\""), "an architect must never see the coordinator key either: " + out);
+    }
+
+    /**
+     * fleetd #439 acceptance criterion 3: an explicitly-primary caller sees the coordinator row
+     * fully assembled, with the same content #439 always produced for a primary.
+     *
+     * <p>fleetd #463 flipped the compat overloads' hidden default from {@code true} to
+     * {@code false} (fail closed), so the old "pre-#439 overload" this test used to compare
+     * against no longer stands in for a primary caller -- it is now exactly the implicit-default
+     * path #463 closes. Verifying the primary path means calling the canonical overload with an
+     * explicit {@code callerIsPrimary=true} directly, as the production {@code fleet_list} handler
+     * does.
+     */
+    @Test
+    void listIsByteForByteUnchangedForThePrimaryCaller() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        FakeLeadChannel channel = new FakeLeadChannel("mac-opus")
+                .withMailbox("mac-opus", LeadChannel.MailboxState.exists("mac-opus", 0, 1));
+
+        String gatedAsPrimary = textOf(FleetMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, null,
+                FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), FleetMcp.LeadSeatSource.none(),
+                Map.of(), "", new FleetMcp.CoordinationSource(channel, List.of()), true));
+
+        assertTrue(gatedAsPrimary.contains("\"coordinator\""), gatedAsPrimary);
+        assertTrue(gatedAsPrimary.contains("\"selfId\":\"mac-opus\""), gatedAsPrimary);
+        assertTrue(gatedAsPrimary.contains("\"mailbox\""), gatedAsPrimary);
+        assertTrue(gatedAsPrimary.contains("\"heldCount\""), gatedAsPrimary);
+        assertTrue(gatedAsPrimary.contains("\"heldDurable\""), gatedAsPrimary);
+        assertTrue(gatedAsPrimary.contains("\"held\""), gatedAsPrimary);
+        assertTrue(gatedAsPrimary.contains("\"peers\""), gatedAsPrimary);
+    }
+
+    @Test
+    void listReportsHeldMessagesWithATruncatedPreviewNeverTheFullBody() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        // A homogeneous "x".repeat(200) body would not pin the exact 80-char boundary: a preview
+        // widened by one (81 chars) still CONTAINS "x".repeat(80) + "…" as a substring one position
+        // later, because every character is 'x'. Put a sentinel ("Y") exactly at index 80 — the
+        // first character a widened cap would leak — so any preview past 80 chars is caught.
+        String longContent = "x".repeat(80) + "Y" + "z".repeat(119);
+        FakeLeadChannel channel = new FakeLeadChannel("mac-opus")
+                .hold(new LeadMessage("m1", "fleet01-lead", "mac-opus", longContent));
+
+        McpSchema.CallToolResult res = FleetMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, null,
+                FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), FleetMcp.LeadSeatSource.none(),
+                Map.of(), "", new FleetMcp.CoordinationSource(channel, List.of()), true);
+
+        String out = textOf(res);
+        assertTrue(out.contains("\"msgId\":\"m1\""), out);
+        assertTrue(out.contains("\"from\":\"fleet01-lead\""), out);
+        assertFalse(out.contains(longContent), "fleet_list must never dump a held message's full body: " + out);
+        assertFalse(out.contains("Y"),
+                "the sentinel at index 80 must never appear — a preview past 80 chars leaked it: " + out);
+        assertTrue(out.contains("x".repeat(80) + "…"), "expected an 80-char preview with an ellipsis: " + out);
+    }
+
+    /**
+     * fleetd #421: {@code mailbox.pending} counts only broker-ready messages, so a blocked lead's
+     * normal, healthy state is {@code "pending": 0} next to a non-empty {@code held[]} — which
+     * invites the false reading that held mail is in-memory-only. {@code heldCount}/{@code
+     * heldDurable} put an honest second number and fact beside {@code pending} instead of leaving it
+     * as the only one.
+     */
+    @Test
+    void listReportsAnHonestHeldCountAndDurabilityNotJustPendingZero() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        FakeLeadChannel channel = new FakeLeadChannel("mac-opus")
+                .withMailbox("mac-opus", LeadChannel.MailboxState.exists("mac-opus", 0, 1))
+                .hold(new LeadMessage("m1", "fleet01-lead", "mac-opus", "one"))
+                .hold(new LeadMessage("m2", "fleet01-lead", "mac-opus", "two"))
+                .hold(new LeadMessage("m3", "fleet01-lead", "mac-opus", "three"));
+
+        McpSchema.CallToolResult res = FleetMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, null,
+                FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), FleetMcp.LeadSeatSource.none(),
+                Map.of(), "", new FleetMcp.CoordinationSource(channel, List.of()), true);
+
+        String out = textOf(res);
+        assertTrue(out.contains("\"pending\":0"), out);
+        assertTrue(out.contains("\"heldCount\":3"),
+                "the honest count beside pending: 0 — three messages really are held: " + out);
+        assertTrue(out.contains("\"heldDurable\":true"),
+                "must state the durability fact, not leave pending as the only number next to held[]: " + out);
+    }
+
+    /**
+     * fleetd #440: {@code heldDurable} must be a derived fact, not a literal — so it can report
+     * {@code false} when the channel behind it says held mail is not durable (a non-durable queue,
+     * or a consumer running with {@code autoAck=true}). A test that only ever asserts {@code true}
+     * repeats the defect this ticket fixes.
+     */
+    @Test
+    void listReportsHeldDurableFalseWhenTheChannelSaysMailIsNotDurable() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        FakeLeadChannel channel = new FakeLeadChannel("mac-opus")
+                .withMailbox("mac-opus", LeadChannel.MailboxState.exists("mac-opus", 0, 1))
+                .withHeldDurable(false)
+                .hold(new LeadMessage("m1", "fleet01-lead", "mac-opus", "one"));
+
+        McpSchema.CallToolResult res = FleetMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, null,
+                FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), FleetMcp.LeadSeatSource.none(),
+                Map.of(), "", new FleetMcp.CoordinationSource(channel, List.of()), true);
+
+        String out = textOf(res);
+        assertTrue(out.contains("\"heldDurable\":false"),
+                "heldDurable must follow the channel, not a hardcoded true: " + out);
+    }
+
+    // ── fleetd #421: a lead reads (never consumes) its own held peer mail ──────────────────────
+
+    @Test
+    void pollWithCoordIdReturnsTheFullBodyWithoutAckingAndLeavesItHeld() {
+        FakeLeadChannel channel = new FakeLeadChannel("mac-opus")
+                .hold(new LeadMessage("m1", "fleet01-lead", "mac-opus", "x".repeat(200)));
+
+        McpSchema.CallToolResult first = FleetMcp.poll(messages, channel, null, null, "mac-opus");
+        assertNotEquals(Boolean.TRUE, first.isError(), textOf(first));
+        String out1 = textOf(first);
+        assertTrue(out1.contains("\"msgId\":\"m1\""), out1);
+        assertTrue(out1.contains("\"from\":\"fleet01-lead\""), out1);
+        assertTrue(out1.contains("\"content\":\"" + "x".repeat(200) + "\""),
+                "the coordId route must return the FULL body, unlike fleet_list's preview: " + out1);
+
+        // Read again: identical bodies, and nothing was acked — peek() still holds it.
+        McpSchema.CallToolResult second = FleetMcp.poll(messages, channel, null, null, "mac-opus");
+        assertEquals(out1, textOf(second), "peek is non-destructive — reading twice must return the same bodies");
+        assertTrue(channel.acked().isEmpty(), "a read must never ack — that is the whole point of the ticket");
+        assertEquals(1, channel.peek().size(), "the message must still be held after being read");
+    }
+
+    @Test
+    void pollWithCoordIdRefusesAPeersCoordIdInsteadOfReturningTheWrongMailOrNothing() {
+        FakeLeadChannel channel = new FakeLeadChannel("mac-opus")
+                .hold(new LeadMessage("m1", "fleet01-lead", "mac-opus", "secret coordination body"));
+
+        // The ORIGINAL fleetd #421 confusion: passing a PEER's id where a self-address was meant.
+        McpSchema.CallToolResult res = FleetMcp.poll(messages, channel, null, null, "fleet01-lead");
+
+        assertEquals(Boolean.TRUE, res.isError());
+        String out = textOf(res);
+        assertFalse(out.contains("secret coordination body"),
+                "a refused read must never leak the body it refused to return: " + out);
+        assertTrue(out.contains("mac-opus"), "the error must name this daemon's own coordId: " + out);
+    }
+
+    @Test
+    void pollWithCoordIdErrorsHonestlyWhenLeadCoordinationIsNotConfigured() {
+        McpSchema.CallToolResult res = FleetMcp.poll(messages, null, null, null, "mac-opus");
+
+        assertEquals(Boolean.TRUE, res.isError());
+        assertTrue(textOf(res).toLowerCase().contains("coordinat"), textOf(res));
+    }
+
+    @Test
+    void listReportsEachDeclaredPeersLiveReachability() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        FakeLeadChannel channel = new FakeLeadChannel("mac-opus")
+                .withMailbox("fleet01-lead", LeadChannel.MailboxState.exists("fleet01-lead", 2, 1))
+                .withMailbox("fleet03-lead", LeadChannel.MailboxState.unknown("fleet03-lead"));
+        // "fleet02-lead" is declared as a peer but never configured on the fake — inspect() falls
+        // back to MailboxState.absent, exactly as a real down (never-run) peer would report.
+        // "fleet03-lead" IS configured, as unknown — a broker that could not be reached in time,
+        // which review finding 1 says must render distinctly from "fleet02-lead"'s confirmed absence.
+
+        McpSchema.CallToolResult res = FleetMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, null,
+                FleetMcp.CapacitySource.none(), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), FleetMcp.LeadSeatSource.none(),
+                Map.of(), "",
+                new FleetMcp.CoordinationSource(channel, List.of("fleet01-lead", "fleet02-lead", "fleet03-lead")), true);
+
+        String out = textOf(res);
+        assertTrue(out.contains("\"coordId\":\"fleet01-lead\",\"status\":\"exists\",\"pending\":2,\"consumers\":1"), out);
+        assertTrue(out.contains("\"coordId\":\"fleet02-lead\",\"status\":\"absent\""), out);
+        assertTrue(out.contains("\"coordId\":\"fleet03-lead\",\"status\":\"unknown\""), out);
+        assertFalse(out.contains("\"coordId\":\"fleet02-lead\",\"status\":\"absent\",\"pending\""),
+                "pending/consumers must be omitted, not faked as zero, for a confirmed-absent peer: " + out);
+        assertFalse(out.contains("\"coordId\":\"fleet03-lead\",\"status\":\"unknown\",\"pending\""),
+                "pending/consumers must be omitted, not faked as zero, for an unresolved peer probe: " + out);
+    }
+
+    /**
+     * fleetd #361 review finding 2: {@code get(timeout)} alone times out the CALLER but leaves the
+     * submitted {@link LeadChannel#inspect} task running forever on its own virtual thread — against
+     * a hung (not down) broker every probe would orphan one more thread holding an AMQP channel
+     * until the connection's channel-max is exhausted, which would break {@code publish} too. This
+     * proves {@link FleetMcp#probe(LeadChannel, String, long)} does not merely give up on a slow
+     * task: it interrupts it, so the task does not go on running unbounded after the caller has
+     * already moved on. No hung broker needed — a {@link LeadChannel} fake that blocks until
+     * interrupted is enough to observe the same mechanism.
+     */
+    @Test
+    void aTimedOutProbeInterruptsTheOrphanedTaskRatherThanAbandoningIt() throws Exception {
+        CountDownLatch started = new CountDownLatch(1);
+        AtomicBoolean wasInterrupted = new AtomicBoolean(false);
+        LeadChannel hangs = new LeadChannel() {
+            @Override
+            public void publish(String toCoordId, LeadMessage m) { }
+
+            @Override
+            public List<LeadMessage> peek() { return List.of(); }
+
+            @Override
+            public void ack(String msgId) { }
+
+            @Override
+            public String selfCoordId() { return "mac-opus"; }
+
+            @Override
+            public boolean heldDurable() { return true; }
+
+            @Override
+            public MailboxState inspect(String coordId) {
+                started.countDown();
+                try {
+                    Thread.sleep(60_000);
+                } catch (InterruptedException e) {
+                    wasInterrupted.set(true);
+                    Thread.currentThread().interrupt();
+                }
+                return MailboxState.unknown(coordId);
+            }
+        };
+
+        LeadChannel.MailboxState result = FleetMcp.probe(hangs, "fleet01-lead", 100L);
+
+        assertFalse(result.exists(), "a timed-out probe must never claim the mailbox exists");
+        assertFalse(result.known(), "a timed-out probe proves nothing either way — it must report unknown");
+        assertTrue(started.await(2, TimeUnit.SECONDS), "the probe task must actually have started");
+        // The interrupt is delivered asynchronously to the orphaned task's own thread — poll briefly
+        // rather than assume it has already landed the instant probe() returns.
+        long deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(2);
+        while (!wasInterrupted.get() && System.nanoTime() < deadline) {
+            Thread.sleep(20);
+        }
+        assertTrue(wasInterrupted.get(),
+                "probe() must cancel the orphaned task (interrupt it) instead of leaving it to run forever");
+    }
+
     @Test
     void capacityUsesThePlacementLiveCount() {
         FakeHerdr h = new FakeHerdr();
@@ -718,6 +1153,35 @@ class FleetMcpTest {
         assertTrue(out.contains("\"quarantinedForSeconds\":1200"), out);
     }
 
+    /**
+     * fleetd #466 scope item 2: {@code fleet_list}'s capacity rows (CB-583: they reuse quarantine)
+     * must carry {@code quarantineAttempt} beside {@code quarantinedForSeconds}, off the same
+     * {@link BackendQuarantine#status} call as {@code fleet_profiles} -- see {@code capacityView}'s
+     * comment pointing back to {@code profilesView}.
+     */
+    @Test
+    void capacityRowReportsQuarantineAttemptBesideRemainingSeconds() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        java.util.concurrent.atomic.AtomicLong now = new java.util.concurrent.atomic.AtomicLong(0L);
+        BackendQuarantine quarantine = BackendQuarantine.withEscalation(now::get, TimeUnit.MINUTES.toNanos(20));
+        quarantine.quarantine("shared-openai"); // attempt 1
+        now.set(TimeUnit.MINUTES.toNanos(20));
+        quarantine.quarantine("shared-openai"); // attempt 2
+        now.set(TimeUnit.MINUTES.toNanos(60));
+        quarantine.quarantine("shared-openai"); // attempt 3
+        FleetMcp.QuarantineSource source = new FleetMcp.QuarantineSource(
+                profile -> "terra".equals(profile) ? "shared-openai" : null, quarantine);
+
+        String out = textOf(FleetMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
+                sessions, null, new FleetMcp.CapacitySource(profile -> 0, profile -> 2,
+                () -> Set.of("terra"), () -> 0), new FleetMcp.HealthCoverageSource(() -> "off"),
+                source, Map.of(), ""));
+
+        assertTrue(out.contains("\"credentialId\":\"shared-openai\""), out);
+        assertTrue(out.contains("\"quarantineAttempt\":3"), out);
+    }
+
     @Test
     void everyProfileSharingTheQuarantinedCredentialReportsZeroFree() {
         FakeHerdr h = new FakeHerdr();
@@ -911,7 +1375,8 @@ class FleetMcpTest {
         String out = textOf(FleetMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
                 sessions, null, new FleetMcp.CapacitySource(profile -> 2, profile -> 3,
                 () -> Set.of("sonnet"), () -> 0), new FleetMcp.HealthCoverageSource(() -> "off"),
-                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), leadSeats, Map.of(), "", null));
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), leadSeats, Map.of(), "",
+                FleetMcp.CoordinationSource.none()));
 
         assertTrue(out.contains("\"maxLoad\":3"), "maxLoad itself must be left untouched: " + out);
         assertTrue(out.contains("\"live\":2"), out);
@@ -934,7 +1399,8 @@ class FleetMcpTest {
         String out = textOf(FleetMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
                 sessions, null, new FleetMcp.CapacitySource(profile -> 0, profile -> 3,
                 () -> Set.of("sonnet"), () -> 0), new FleetMcp.HealthCoverageSource(() -> "off"),
-                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), leadSeats, Map.of(), "", null));
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), leadSeats, Map.of(), "",
+                FleetMcp.CoordinationSource.none()));
 
         assertTrue(out.contains("\"live\":0"), out);
         assertTrue(out.contains("\"free\":3"), "the real gate never subtracts the lead's seat: " + out);
@@ -988,7 +1454,7 @@ class FleetMcpTest {
         String out = textOf(FleetMcp.listFleet(composite, sm, null,
                 new FleetMcp.CapacitySource(liveCount, p -> profiles.get(p).maxLoad(), profiles::keySet, () -> 0),
                 new FleetMcp.HealthCoverageSource(() -> "off"), FleetMcp.QuarantineSource.none(),
-                FleetMcp.OutageSource.none(), leadSeats, Map.of(), "", null));
+                FleetMcp.OutageSource.none(), leadSeats, Map.of(), "", FleetMcp.CoordinationSource.none()));
         int reportedFree = extractInt(out, "free");
 
         for (int i = 0; i < reportedFree; i++) {
@@ -1017,7 +1483,7 @@ class FleetMcpTest {
                 sessions, null, new FleetMcp.CapacitySource(profile -> 0, profile -> 2,
                 () -> Set.of("terra"), () -> 0), new FleetMcp.HealthCoverageSource(() -> "off"),
                 FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), FleetMcp.LeadSeatSource.none(),
-                Map.of(), "", null));
+                Map.of(), "", FleetMcp.CoordinationSource.none()));
 
         assertTrue(out.contains("\"free\":2"), out);
         assertFalse(out.contains("leadSeats"), "no lead shares this profile's credential: " + out);
@@ -1094,6 +1560,10 @@ class FleetMcpTest {
 
     @Test
     void bridgeAckReturnsConfirmationForValidArgs() {
+        // fleet_ack only reports success for a msgId actually queued in the target's inbox
+        // (fleetd #437) — publish one via the inbox directly rather than asserting on a
+        // fabricated id nothing ever queued.
+        inbox.publish("term_a", "msg-1", "queued reply");
         McpSchema.CallToolResult res = FleetMcp.ack(messages, "term_a", "msg-1");
         assertNotEquals(Boolean.TRUE, res.isError());
         assertTrue(textOf(res).contains("msg-1"), "response should mention the msgId");
@@ -1106,21 +1576,51 @@ class FleetMcpTest {
         assertTrue(FleetMcp.ack(messages, "  ", "msg-1").isError());
     }
 
+    @Test
+    void bridgeAckOfAnIdInNoInboxIsAnError() {
+        // fleetd #437: fleet_ack used to say "acknowledged <msgId>" for a message it never
+        // touched, because nothing in the chain reported hit vs. miss. "never-queued" is in no
+        // inbox at all, so this must error rather than claim success.
+        McpSchema.CallToolResult res = FleetMcp.ack(messages, "term_a", "never-queued");
+        assertTrue(res.isError());
+        assertTrue(textOf(res).contains("never-queued"), textOf(res));
+    }
+
+    @Test
+    void bridgeAckOfACoordIdTargetIsAnErrorNamingFleetPoll() {
+        // A coord-id names a peer lead's held mailbox (LeadChannel/LeadMailbox), never a
+        // worker's ReplyInbox — fleet_ack has no route to it and must say so, pointing at
+        // fleet_poll{coordId} instead of reporting a false "acknowledged".
+        McpSchema.CallToolResult res = FleetMcp.ack(messages, "coord-some-peer", "msg-1");
+        assertTrue(res.isError());
+        assertTrue(textOf(res).contains("fleet_poll{coordId}"), textOf(res));
+    }
+
     @Test
     void bridgeAckRemovesSpecificReply() {
         // Queue a reply and capture its msgId.
-        FleetMcp.reply(messages, "term_a", "orphan");
+        FleetMcp.reply(messages, "term_a", Role.WORKER, "orphan");
         var before = messages.drainReplies("term_a");
         assertEquals(1, before.size(), "one reply in the inbox");
         String msgId = before.getFirst().msgId();
 
         // Publish the same reply again and ack it via fleet_ack surface.
-        FleetMcp.reply(messages, "term_a", "orphan-again");
+        FleetMcp.reply(messages, "term_a", Role.WORKER, "orphan-again");
         var peeked = messages.drainReplies("term_a");
         assertEquals(1, peeked.size(), "one fresh reply in the inbox");
 
-        // ackReply works (no-op since published with a different UUID, but callable).
-        assertDoesNotThrow(() -> messages.ackReply("term_a", msgId));
+        // fleetd #437: msgId was already drained above (a fresh UUID each publish), so it is no
+        // longer in the inbox — ackReply must now report that miss instead of pretending to ack.
+        assertFalse(messages.ackReply("term_a", msgId));
+    }
+
+    @Test
+    void bridgeAckRemovingARealQueuedReplyReportsSuccessAndRemovesIt() {
+        // The worker path must not change behaviour: acking a reply that IS still in the inbox
+        // still succeeds and still removes it (fleetd #437).
+        inbox.publish("term_a", "real-1", "still queued");
+        assertTrue(messages.ackReply("term_a", "real-1"), "ack of a real queued reply must report true");
+        assertTrue(inbox.peek("term_a").isEmpty(), "the acked reply must be gone from the inbox");
     }
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetProfilesArmedFieldTest.java

@@ -0,0 +1,62 @@
+package dev.ltms.fleet.mcp;
+
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import dev.ltms.fleet.peer.PeerLauncher;
+import io.modelcontextprotocol.spec.McpSchema;
+import org.junit.jupiter.api.Test;
+
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Set;
+
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #395: {@code fleet_profiles} must let an operator tell "this profile's usage-limit
+ * detection is armed" from "nothing can ever quarantine this profile" — see {@link
+ * FleetMcp.QuarantineSource#exhaustedPatternArmed()} and {@link
+ * FleetMcp#profilesView(PeerLauncher, FleetMcp.QuarantineSource, FleetMcp.OutageSource)}.
+ */
+class FleetProfilesArmedFieldTest {
+
+    private static PeerLauncher twoProfileLauncher(FakeHerdr h) {
+        FleetConfig.Profile armed = new FleetConfig.Profile(
+                "armed-profile", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN", null,
+                "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
+        FleetConfig.Profile unarmed = new FleetConfig.Profile(
+                "unarmed-profile", "http://gx01.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN", null,
+                "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
+        Map<String, FleetConfig.Profile> profiles = new LinkedHashMap<>();
+        profiles.put(armed.profile(), armed);
+        profiles.put(unarmed.profile(), unarmed);
+        return new ClaudeCodeLauncher(new AgentControl(h), new WorkspaceControl(h),
+                new SubscriptionGuard(Set.of("gx00.gw", "gx01.gw")), profiles, armed.profile(), _ -> "tok");
+    }
+
+    private static String textOf(McpSchema.CallToolResult r) {
+        return ((McpSchema.TextContent) r.content().getFirst()).text();
+    }
+
+    @Test
+    void armedProfileReportsArmedAndUnarmedReportsUnarmed() {
+        FakeHerdr h = new FakeHerdr();
+        PeerLauncher workers = twoProfileLauncher(h);
+        FleetMcp.QuarantineSource source = new FleetMcp.QuarantineSource(
+                _ -> null, dev.ltms.fleet.placement.BackendQuarantine.none(),
+                profile -> "armed-profile".equals(profile));
+
+        McpSchema.CallToolResult res = FleetMcp.profiles(workers, source);
+        assertNotEquals(Boolean.TRUE, res.isError());
+        String out = textOf(res);
+
+        assertTrue(out.contains("\"exhaustionDetectionArmed\""), out);
+        assertTrue(out.contains("\"armed-profile\":true"), out);
+        assertTrue(out.contains("\"unarmed-profile\":false"), out);
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetProfilesLiveDefaultTest.java

@@ -0,0 +1,114 @@
+package dev.ltms.fleet.mcp;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import dev.ltms.fleet.member.CompositePeerLauncher;
+import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.peer.SpawnRequest;
+import dev.ltms.fleet.placement.BackendQuarantine;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #425: {@code fleet_profiles}' {@code "default"} field was captured once at boot
+ * ({@code cfg.effectiveDefaultProfile()}, frozen into {@code CompositePeerLauncher.defaultProfile}
+ * at construction) while an unqualified spawn resolves the same underlying key
+ * ({@code fleet.developers}' first entry) live, on every call. Reordering {@code fleet.developers}
+ * and reloading changed where a spawn landed without ever changing what {@code fleet_profiles}
+ * reported — a lead following {@code CLAUDE.md}'s "check {@code fleet_profiles} once per session"
+ * instruction was told a stale answer.
+ *
+ * <p>This test drives the exact caller {@code fleet_profiles} uses —
+ * {@link FleetMcp#profilesView(PeerLauncher, FleetMcp.QuarantineSource, FleetMcp.OutageSource)} —
+ * against a real, reloadable {@link ConfigRef}, so it fails if the reporting path is ever recoupled
+ * to a frozen value instead of {@link CompositePeerLauncher#defaultProfile()}'s live answer.
+ */
+class FleetProfilesLiveDefaultTest {
+
+    /** A minimal fleetd.yaml whose dev pool is {@code profilesInOrder}, in that definition order. */
+    private static String yamlWithDevPool(String... profilesInOrder) {
+        StringBuilder devPool = new StringBuilder();
+        for (int i = 0; i < profilesInOrder.length; i++) {
+            devPool.append("    slot").append(i).append(":\n      profile: ")
+                    .append(profilesInOrder[i]).append('\n');
+        }
+        return """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                herdrSocket: ~/.config/herdr/herdr.sock
+                profiles:
+                  opus:
+                    baseUrl: http://gx00.gw:8000
+                    model: opus-coder
+                  sonnet:
+                    baseUrl: http://gx00.gw:8000
+                    model: sonnet-coder
+                guard:
+                  offSubscriptionHosts:
+                    - gx00.gw
+                fleet:
+                  developers:
+                """ + devPool;
+    }
+
+    @Test
+    void fleetProfilesDefaultTracksALiveDevPoolReorderAfterReload(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yamlWithDevPool("opus", "sonnet"));
+        ConfigRef ref = new ConfigRef(f, FleetConfig.load(f));
+
+        Map<String, FleetConfig.Profile> profiles = Map.of(
+                "opus", new FleetConfig.Profile("opus", "http://gx00.gw:8000", "opus-coder", null,
+                        "FLEETD_WORKER_TOKEN", List.of("claude"), "tab", "fleetd-workers",
+                        "worker: {profile} #{n}", null, null, null),
+                "sonnet", new FleetConfig.Profile("sonnet", "http://gx00.gw:8000", "sonnet-coder", null,
+                        "FLEETD_WORKER_TOKEN", List.of("claude"), "tab", "fleetd-workers",
+                        "worker: {profile} #{n}", null, null, null));
+        FakeHerdr herdr = new FakeHerdr();
+        ClaudeCodeLauncher adapter = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), profiles, "opus", _ -> null);
+        PeerLauncher workers = new CompositePeerLauncher(
+                List.of(adapter), "opus", ref, _ -> 0, BackendQuarantine.none());
+
+        assertReportedDefaultMatchesAnUnqualifiedSpawn(workers, "opus");
+
+        Files.writeString(f, yamlWithDevPool("sonnet", "opus"));
+        ConfigRef.Outcome out = ref.reload();
+        assertTrue(out.applied(), () -> "reload should apply cleanly: " + out.error());
+
+        assertReportedDefaultMatchesAnUnqualifiedSpawn(workers, "sonnet");
+    }
+
+    /**
+     * Asserts BOTH that {@code fleet_profiles}' {@code "default"} equals {@code expected}, AND that
+     * it equals what a real unqualified {@code MemberRole#DEV} spawn actually gets placed on right
+     * now — the two facts fleetd #425 found disagreeing.
+     */
+    private static void assertReportedDefaultMatchesAnUnqualifiedSpawn(PeerLauncher workers, String expected) {
+        Map<String, Object> view = FleetMcp.profilesView(
+                workers, FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none());
+        assertEquals(expected, view.get("default"),
+                "fleet_profiles' \"default\" must be the live dev-pool answer, not a boot-time snapshot");
+
+        String placed = workers.spawn(
+                new SpawnRequest(null, null, null, null, null, MemberRole.DEV)).profile();
+        assertEquals(expected, placed,
+                "sanity: the profile an unqualified dev spawn actually lands on");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetProfilesModelGateStateTest.java

@@ -0,0 +1,109 @@
+package dev.ltms.fleet.mcp;
+
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import dev.ltms.fleet.member.CompositePeerLauncher;
+import dev.ltms.fleet.member.HerdrPeerLauncher;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.placement.BackendOutagePolicy;
+import dev.ltms.fleet.placement.BackendQuarantine;
+import dev.ltms.fleet.placement.PlacementPolicies;
+import org.junit.jupiter.api.Test;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+
+/**
+ * fleetd #422 follow-up: {@code fleet_profiles}/{@code GET /profiles} — the reporting surface a
+ * lead actually reads — must let it tell apart the three states {@link
+ * dev.ltms.fleet.peer.PeerLauncher#disabledModels()} alone collapses into one empty set: no
+ * {@code models:} block at all, a block armed with nothing currently off, and a block with N
+ * models off. See {@link dev.ltms.fleet.peer.PeerLauncher.ModelGateState}'s javadoc for why a
+ * bare {@code disabledModels()} read cannot make this distinction, and {@link
+ * FleetMcp#profilesView} for where {@code modelGateArmed} is added alongside the existing {@code
+ * modelsOff} key.
+ *
+ * <p>Every assertion here goes through {@link FleetMcp#profilesView}, never {@code
+ * PeerLauncher.modelGateState()} directly — {@code CompositePeerLauncherTest} already proves the
+ * accessor itself; this class proves the surface a lead reads (fleet_profiles / GET /profiles)
+ * renders what that accessor reports.
+ */
+class FleetProfilesModelGateStateTest {
+
+    private static FleetConfig.Profile profile(String name, String model) {
+        return new FleetConfig.Profile(name, "http://gx00.gw:8000", model, null, "FLEETD_WORKER_TOKEN",
+                null, "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
+    }
+
+    private static FleetMcp.QuarantineSource noQuarantine() {
+        return new FleetMcp.QuarantineSource(_ -> null, BackendQuarantine.none(), _ -> false);
+    }
+
+    private static HerdrPeerLauncher claudeAdapter(FakeHerdr h, Map<String, FleetConfig.Profile> profiles) {
+        return new ClaudeCodeLauncher(new AgentControl(h), new WorkspaceControl(h),
+                new SubscriptionGuard(Set.of("gx00.gw")), profiles, "local", _ -> "tok");
+    }
+
+    /**
+     * State 1: no {@code models:} block at all — a plain {@code ClaudeCodeLauncher} (no {@code
+     * models:} supplier exists for it to read) has nothing to gate against, matching the fleet01
+     * host measured for this ticket: {@code grep -c '^models:' fleetd.yaml} returns 0 there.
+     */
+    @Test
+    void noModelsBlockReportsGateNotArmed() {
+        FakeHerdr h = new FakeHerdr();
+        Map<String, FleetConfig.Profile> profiles = Map.of("local", profile("local", "deepseek-v4-flash"));
+        PeerLauncher workers = claudeAdapter(h, profiles);
+
+        Map<String, Object> view = FleetMcp.profilesView(workers, noQuarantine(), FleetMcp.OutageSource.none());
+
+        assertEquals(Boolean.FALSE, view.get("modelGateArmed"),
+                "no models: block to read from — nothing is gated, and nothing can be");
+        assertFalse(view.containsKey("modelsOff"), "nothing configured, so no off set to report either");
+    }
+
+    /** State 2: a {@code models:} block is present, but nothing in it is currently turned off. */
+    @Test
+    void modelsBlockWithNothingOffReportsGateArmedAndZeroOff() {
+        FakeHerdr h = new FakeHerdr();
+        Map<String, FleetConfig.Profile> profiles = Map.of("local", profile("local", "deepseek-v4-flash"));
+        FleetConfig.Models models = new FleetConfig.Models(
+                List.of(new FleetConfig.Models.ModelEntry("deepseek-v4-flash", true)));
+        PeerLauncher workers = new CompositePeerLauncher(List.of(claudeAdapter(h, profiles)), "local", profiles,
+                PlacementPolicies.fixed(), _ -> 0, null, BackendQuarantine.none(),
+                new BackendOutagePolicy(System::nanoTime), () -> models);
+
+        Map<String, Object> view = FleetMcp.profilesView(workers, noQuarantine(), FleetMcp.OutageSource.none());
+
+        assertEquals(Boolean.TRUE, view.get("modelGateArmed"),
+                "a models: block is present, so the gate is armed even though nothing is off yet");
+        assertFalse(view.containsKey("modelsOff"),
+                "nothing is off, so the key stays absent — an empty list here would be indistinguishable "
+                        + "from today's modelsOff omission, exactly the ambiguity modelGateArmed exists to remove");
+    }
+
+    /** State 3: a {@code models:} block is present with one model currently turned off. */
+    @Test
+    void modelsBlockWithModelsOffReportsGateArmedAndTheOffSet() {
+        FakeHerdr h = new FakeHerdr();
+        Map<String, FleetConfig.Profile> profiles = Map.of("local", profile("local", "deepseek-v4-flash"));
+        FleetConfig.Models models = new FleetConfig.Models(
+                List.of(new FleetConfig.Models.ModelEntry("deepseek-v4-flash", false)));
+        PeerLauncher workers = new CompositePeerLauncher(List.of(claudeAdapter(h, profiles)), "local", profiles,
+                PlacementPolicies.fixed(), _ -> 0, null, BackendQuarantine.none(),
+                new BackendOutagePolicy(System::nanoTime), () -> models);
+
+        Map<String, Object> view = FleetMcp.profilesView(workers, noQuarantine(), FleetMcp.OutageSource.none());
+
+        assertEquals(Boolean.TRUE, view.get("modelGateArmed"));
+        assertEquals(List.of("deepseek-v4-flash"), view.get("modelsOff"));
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetProfilesQuarantineModelReasonFieldsTest.java

@@ -0,0 +1,111 @@
+package dev.ltms.fleet.mcp;
+
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.AgentControl;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.member.ClaudeCodeLauncher;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.placement.BackendQuarantine;
+import io.modelcontextprotocol.spec.McpSchema;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.TimeUnit;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #446 follow-up (criterion 3): a mutation battery run against the merged PR #457 proved
+ * that deleting either {@code row.put("model", model);} or {@code row.put("reason", reason);}
+ * from {@link FleetMcp#profilesView} left all 1586 existing tests green — nothing exercised a
+ * {@link FleetMcp.QuarantineSource} whose {@code modelFor}/{@code reasonFor} actually return a
+ * value. This class is what makes both deletions red, and also pins the two "must be omitted, not
+ * emitted as null/blank" branches those two {@code if} guards exist for — {@link
+ * FleetMcpTest#profilesReportsAQuarantinedCredential} covers the credential/quarantine-duration
+ * shape but supplies neither function, so it cannot distinguish "the field is missing" from "the
+ * field was never asked for".
+ */
+class FleetProfilesQuarantineModelReasonFieldsTest {
+
+    private static final String PROFILE = "terra";
+    private static final String CREDENTIAL = "cred-terra";
+
+    private static PeerLauncher launcher(FakeHerdr h) {
+        FleetConfig.Profile profile = new FleetConfig.Profile(
+                PROFILE, "http://gx00.gw:8000", "claude-opus-5", null, "FLEETD_WORKER_TOKEN", null,
+                "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
+        return new ClaudeCodeLauncher(new AgentControl(h), new WorkspaceControl(h),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(PROFILE, profile), PROFILE, _ -> "tok");
+    }
+
+    private static BackendQuarantine quarantined(String credentialId) {
+        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
+        quarantine.quarantine(credentialId);
+        return quarantine;
+    }
+
+    private static String textOf(McpSchema.CallToolResult r) {
+        return ((McpSchema.TextContent) r.content().getFirst()).text();
+    }
+
+    @Test
+    void quarantinedRowNamesTheModelAndTheReason() {
+        FakeHerdr h = new FakeHerdr();
+        FleetMcp.QuarantineSource source = new FleetMcp.QuarantineSource(
+                _ -> CREDENTIAL, quarantined(CREDENTIAL), _ -> true,
+                _ -> "claude-opus-5", _ -> "The usage limit has been reached");
+
+        McpSchema.CallToolResult res = FleetMcp.profiles(launcher(h), source);
+        assertNotEquals(Boolean.TRUE, res.isError());
+        String out = textOf(res);
+
+        assertTrue(out.contains("\"quarantined\""), out);
+        assertTrue(out.contains("\"model\":\"claude-opus-5\""),
+                "the quarantined row must name the model the fix applies to: " + out);
+        assertTrue(out.contains("\"reason\":\"The usage limit has been reached\""),
+                "the quarantined row must name why it was quarantined: " + out);
+    }
+
+    @Test
+    void quarantinedRowOmitsModelWhenNoneIsConfigured() {
+        FakeHerdr h = new FakeHerdr();
+        // null and "" (blank) both exercise the same production guard (`!model.isBlank()`) —
+        // covered together since both must produce the identical outcome: the key absent.
+        for (String noModel : new String[] {null, "", "   "}) {
+            FleetMcp.QuarantineSource source = new FleetMcp.QuarantineSource(
+                    _ -> CREDENTIAL, quarantined(CREDENTIAL), _ -> true,
+                    _ -> noModel, _ -> "some reason");
+
+            McpSchema.CallToolResult res = FleetMcp.profiles(launcher(h), source);
+            String out = textOf(res);
+
+            assertTrue(out.contains("\"quarantined\""), out);
+            assertFalse(out.contains("\"model\""),
+                    "modelFor returned " + (noModel == null ? "null" : "'" + noModel + "'")
+                            + " — the key must be ABSENT, not emitted as null or an empty string: " + out);
+        }
+    }
+
+    @Test
+    void quarantinedRowOmitsReasonWhenNoneIsKnown() {
+        FakeHerdr h = new FakeHerdr();
+        for (String noReason : new String[] {null, "", "  "}) {
+            FleetMcp.QuarantineSource source = new FleetMcp.QuarantineSource(
+                    _ -> CREDENTIAL, quarantined(CREDENTIAL), _ -> true,
+                    _ -> "claude-opus-5", _ -> noReason);
+
+            McpSchema.CallToolResult res = FleetMcp.profiles(launcher(h), source);
+            String out = textOf(res);
+
+            assertTrue(out.contains("\"quarantined\""), out);
+            assertFalse(out.contains("\"reason\""),
+                    "reasonFor returned " + (noReason == null ? "null" : "'" + noReason + "'")
+                            + " — the key must be ABSENT, not emitted as null or an empty string: " + out);
+        }
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/member/CompositePeerLauncherTest.java

@@ -3,6 +3,7 @@ package dev.ltms.fleet.member;
 import ch.qos.logback.classic.Logger;
 import ch.qos.logback.classic.spi.ILoggingEvent;
 import ch.qos.logback.core.read.ListAppender;
+import dev.ltms.fleet.config.ConfigRef;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.Agent;
@@ -19,11 +20,15 @@ import dev.ltms.fleet.peer.PeerUnreachableException;
 import dev.ltms.fleet.peer.SpawnRequest;
 import dev.ltms.fleet.placement.BackendOutagePolicy;
 import dev.ltms.fleet.placement.BackendQuarantine;
+import dev.ltms.fleet.placement.PlacementDecision;
 import dev.ltms.fleet.placement.PlacementException;
 import dev.ltms.fleet.placement.PlacementPolicies;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
 import org.slf4j.LoggerFactory;
 
+import java.nio.file.Files;
+import java.nio.file.Path;
 import java.util.EnumSet;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
@@ -141,6 +146,13 @@ class CompositePeerLauncherTest {
                 null, null, credentialId, null);
     }
 
+    /** Like {@link #stubWorker(String)}, but with an explicit {@code model:} for fleetd #422 tests. */
+    private static FleetConfig.Profile stubWorkerModel(String profile, String model) {
+        return new FleetConfig.Profile(profile, "http://gx00.gw:8000", model,
+                null, "FLEETD_WORKER_TOKEN", List.of("claude"), "tab", "fleetd-workers",
+                "w #{n}", null, null, null, null, null, null, null, null, null);
+    }
+
     /**
      * An <em>order-preserving</em> profile map. Never {@code Map.of} here: its iteration order is
      * salted per JVM run, and the weighted policy breaks an exact-weight tie on candidate order —
@@ -525,6 +537,31 @@ class CompositePeerLauncherTest {
         assertEquals("claude", h.profile(), "the returned handle carries the resolved default profile");
     }
 
+    /**
+     * fleetd #435: {@code FixedPlacementPolicy} — the default placement policy every config uses
+     * unless {@code placement:} is set — never consulted {@code maxLoad}, so an unqualified spawn
+     * (a blank profile, the normal delegation path) landed on a capped default anyway. Measured on
+     * 7667727: a single dev profile at {@code maxLoad: 1} with 1 live, under {@code fixed()},
+     * returned "SPAWNED on profile=a". This test goes through {@code CompositePeerLauncher.spawn}
+     * with a blank profile, not the policy in isolation, so it proves the caller actually reaches
+     * the fixed default's new cap check rather than only the {@code select} method.
+     */
+    @Test
+    void fixedPolicyGatesDefaultProfileAtMaxLoadOnUnqualifiedSpawn() {
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, FleetConfig.Profile> profiles = ordered(
+                "a", stubWorker("a", 1.0f, 1),
+                "b", stubWorker("b", 1.0f, null));
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of());
+        CompositePeerLauncher composite = new CompositePeerLauncher(
+                List.of(adapter), "a", profiles, PlacementPolicies.fixed(), name -> "a".equals(name) ? 1 : 0);
+
+        PeerHandle h = composite.spawn(new SpawnRequest(null, null, null));
+        assertEquals("b", h.profile(),
+                "the default profile a is at maxLoad, so fixed placement must fall through to b");
+        assertEquals(0, adapter.spawnCount("a"), "a is never spawned — it is already at cap");
+    }
+
     @Test
     void weightedPolicyGatesProfileAtMaxLoad() {
         FakeHerdr herdr = new FakeHerdr();
@@ -908,6 +945,89 @@ class CompositePeerLauncherTest {
         assertTrue(e.getMessage().contains("maxLoad"), e.getMessage());
     }
 
+    // ── fleetd #425: defaultProfile()/defaultProfileFor() must track a live reload ─────────────
+
+    /** A minimal fleetd.yaml whose dev pool is {@code profilesInOrder}, in that definition order. */
+    private static String yamlWithDevPool(String... profilesInOrder) {
+        StringBuilder devPool = new StringBuilder();
+        for (int i = 0; i < profilesInOrder.length; i++) {
+            devPool.append("    slot").append(i).append(":\n      profile: ")
+                    .append(profilesInOrder[i]).append('\n');
+        }
+        return """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                herdrSocket: ~/.config/herdr/herdr.sock
+                profiles:
+                  opus:
+                    baseUrl: http://gx00.gw:8000
+                    model: opus-coder
+                  sonnet:
+                    baseUrl: http://gx00.gw:8000
+                    model: sonnet-coder
+                guard:
+                  offSubscriptionHosts:
+                    - gx00.gw
+                fleet:
+                  developers:
+                """ + devPool;
+    }
+
+    /**
+     * Criterion 1 (fleetd #425): reorder {@code fleet.developers}, reload, and assert the reported
+     * default ({@link CompositePeerLauncher#defaultProfile()} — what {@code fleet_profiles}' {@code
+     * "default"} is built from, see {@code FleetMcp.profilesView}) matches what an unqualified
+     * {@code MemberRole#DEV} spawn is actually placed on, both before and after the reorder. Asserts
+     * {@code applied()} so the test proves the reload actually took, not that nothing changed.
+     */
+    @Test
+    void defaultProfileTracksALiveDevPoolReorderAfterReload(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yamlWithDevPool("opus", "sonnet"));
+        ConfigRef ref = new ConfigRef(f, FleetConfig.load(f));
+
+        FakeHerdr herdr = new FakeHerdr();
+        StubLauncher adapter = new StubLauncher("claude", herdr, threeProfiles(), "opus", Set.of());
+        CompositePeerLauncher composite = new CompositePeerLauncher(
+                List.of(adapter), "opus", ref, _ -> 0, BackendQuarantine.none());
+
+        assertEquals("opus", composite.defaultProfile(),
+                "reported default starts at the dev pool's first entry");
+        assertEquals("opus", composite.spawn(
+                        new SpawnRequest(null, null, null, null, null, MemberRole.DEV)).profile(),
+                "an unqualified dev spawn must land on the same profile that was just reported");
+
+        Files.writeString(f, yamlWithDevPool("sonnet", "opus"));
+        ConfigRef.Outcome out = ref.reload();
+        assertTrue(out.applied(), () -> "reload should apply cleanly: " + out.error());
+
+        assertEquals("sonnet", composite.defaultProfile(),
+                "the reported default must follow the reorder with no daemon restart");
+        assertEquals("sonnet", composite.spawn(
+                        new SpawnRequest(null, null, null, null, null, MemberRole.DEV)).profile(),
+                "and it must still be exactly what an unqualified spawn actually gets");
+    }
+
+    /**
+     * Criterion 2 — the mirror, and the load-bearing half (fleetd #425): with NOTHING configured (no
+     * profiles at all, hence an empty pool for every role), the frozen {@code defaultProfile} field
+     * is still what gets reported. A fix that always returns {@code poolFor(role).getFirst()} with no
+     * empty-pool fallback throws or returns the wrong thing here even though criterion 1 above still
+     * passes — this is the test that catches it.
+     */
+    @Test
+    void defaultProfileFallsBackToTheFrozenFieldWhenNothingIsConfiguredAtAll() {
+        FakeHerdr herdr = new FakeHerdr();
+        StubLauncher adapter = new StubLauncher("claude", herdr, Map.of(), "opus", Set.of());
+        CompositePeerLauncher composite = new CompositePeerLauncher(
+                List.of(adapter), "opus", Map.of(), PlacementPolicies.fixed(), _ -> 0);
+
+        assertEquals("opus", composite.defaultProfile(),
+                "with no profiles configured at all, the frozen field is the only answer available");
+        assertEquals("opus", composite.defaultProfileFor(MemberRole.DEV));
+    }
+
     // ── CB-578 stage B: a BACKEND_EXHAUSTED classification quarantines the credential ──────────
 
     @Test
@@ -974,6 +1094,98 @@ class CompositePeerLauncherTest {
         assertEquals(0, adapter.spawnCount("sol"));
     }
 
+    /**
+     * fleetd #425 rework, acceptance 1: {@link CompositePeerLauncher#routedProfileFor} must apply
+     * the SAME quarantine filtering {@link CompositePeerLauncher#spawn} does, under {@code fixed()}
+     * — the DEFAULT placement policy, deliberately not {@code weighted()} (which the regressed
+     * round's own tests all used, and which never exercises {@code FixedPlacementPolicy}'s own
+     * inline filter). This is the exact defect: the previous round's {@code defaultProfileFor}
+     * blindly returns the pool's first entry ("sol", quarantined here) with no awareness of
+     * quarantine at all, which is what turned a routine unqualified spawn into a hard throw once
+     * {@code acquireWithWorktree} pre-resolved through it.
+     */
+    @Test
+    void routedProfileForSkipsAQuarantinedPoolFirstProfileUnderFixedPolicy() {
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, FleetConfig.Profile> profiles = ordered(
+                "sol", stubWorker("sol", "shared-openai"),
+                "b", stubWorker("b"));
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "sol", Set.of());
+        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
+        quarantine.quarantine("shared-openai");
+        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "sol", profiles,
+                PlacementPolicies.fixed(), _ -> 0, null, quarantine);
+
+        assertEquals("b", composite.routedProfileFor(MemberRole.DEV),
+                "sol (the pool's first entry) is quarantined, so the routed answer must be b");
+        assertEquals("sol", composite.defaultProfileFor(MemberRole.DEV),
+                "sanity: defaultProfileFor stays blind to quarantine — that's the gap routedProfileFor closes");
+        assertEquals(0, adapter.spawnCount("sol"), "routedProfileFor never spawns anything");
+        assertEquals(0, adapter.spawnCount("b"), "routedProfileFor never spawns anything");
+    }
+
+    /**
+     * fleetd #444: {@link PlacementDecision} exists to close the window between {@link
+     * CompositePeerLauncher#place} and {@link CompositePeerLauncher#spawn(SpawnRequest,
+     * PlacementDecision)} — the placement state must be free to move in that window without the
+     * held decision being re-checked against the new state. Every quarantine test above resolves
+     * and spawns in one call, so none of them ever open that window; this test is the one that
+     * does: "sol" is placed FIRST, while nothing is quarantined yet, and only THEN is its
+     * credential quarantined, before the held decision is spawned.
+     *
+     * <p>This is the test that tells the real override apart from the alternative body the ticket
+     * measured: routing {@code decision.profile()} straight to its adapter (the real override)
+     * never re-runs {@code enforceNotQuarantined}, so the spawn against the held decision still
+     * succeeds on sol. Re-entering {@code spawn(req.withProfile(decision.profile()))} instead
+     * lands in the explicit-profile branch, which refuses a now-quarantined sol outright — before
+     * this test existed, replacing the real override's body with that re-entering call left the
+     * whole suite green.
+     */
+    @Test
+    void spawnHonorsAPlacementDecisionEvenAfterItsProfileIsQuarantinedInTheWindowAfterPlace() {
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, FleetConfig.Profile> profiles = ordered(
+                "sol", stubWorker("sol", "shared-openai"),
+                "b", stubWorker("b"));
+        // The adapter's OWN fallback default is "b", deliberately different from the profile place()
+        // decides ("sol") — see the note below on why this must not be "sol" too.
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "b", Set.of());
+        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
+        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "sol", profiles,
+                PlacementPolicies.fixed(), _ -> 0, null, quarantine);
+
+        // 1. Resolve BEFORE anything is quarantined — sol (definition order first, fixed policy) wins.
+        // composite's own defaultProfile ("sol", the constructor arg above) never enters this: the
+        // pool poolFor(DEV) resolves to is never empty here, so place() only ever reads that field as
+        // a fallback for an empty pool, which this test does not exercise.
+        PlacementDecision decision = composite.place(MemberRole.DEV);
+        assertEquals("sol", decision.profile(), "sanity: nothing is quarantined yet, so sol is placed");
+
+        // 2. Move the placement state IN THE WINDOW between place() and spawn() — sol's credential
+        // is now quarantined. A fresh place()/spawn(req) pair would fall through to b instead; the
+        // held decision must not be re-evaluated against this new state at all.
+        quarantine.quarantine("shared-openai");
+
+        // 3. Spawn against the HELD decision, not a fresh resolve.
+        SpawnRequest req = new SpawnRequest(null, null, null, null, null, MemberRole.DEV);
+        PeerHandle handle = composite.spawn(req, decision);
+
+        assertEquals("sol", handle.profile(),
+                "the decision from place() is honored even though sol is now quarantined");
+        // A fixture whose adapter falls back to "sol" too would let an UNSTAMPED request (one
+        // routed but never given req.withProfile("sol")) land on spawnCount("sol") == 1 by
+        // COINCIDENCE, since StubLauncher.spawn falls back to its own defaultProfile whenever
+        // req.profileName() is blank. Giving the adapter "b" as its fallback instead means only an
+        // actually-stamped request can produce this count — an unstamped one would count against
+        // "b" and this assertion would fail.
+        assertEquals(1, adapter.spawnCount("sol"),
+                "the request that reached the delegate actually carried sol as its profile "
+                        + "(the adapter's own fallback default is 'b', so this can't happen by accident)");
+        assertEquals(0, adapter.spawnCount("b"),
+                "b must never be touched — neither as the decision's profile nor as an unstamped "
+                        + "request's accidental fallback");
+    }
+
     @Test
     void aQuarantineLiftsOnTheInjectedClockAndTheProfileBecomesSpawnableAgain() {
         FakeHerdr herdr = new FakeHerdr();
@@ -1189,4 +1401,415 @@ class CompositePeerLauncherTest {
         assertDoesNotThrow(() -> composite.spawn(new SpawnRequest("claude", null, null)));
         assertDoesNotThrow(() -> composite.spawn(new SpawnRequest("gemini", null, null)));
     }
+
+    // ── fleetd #422: the model on/off gate — a FOURTH, independent reason to refuse a spawn ──────
+    // ── (an operator decision, never a backend-reported outage) — never merged with quarantine ────
+    // ── or cool-off above ─────────────────────────────────────────────────────────────────────────
+
+    private static final BackendOutagePolicy NO_OUTAGE = new BackendOutagePolicy(() -> 0L);
+
+    /** Criterion 1: an explicit spawn onto a profile whose model is off is refused. */
+    @Test
+    void explicitSpawnOntoAnOffModelProfileIsRefused() {
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, FleetConfig.Profile> profiles = ordered(
+                "local", stubWorkerModel("local", "deepseek-v4-flash"),
+                "sonnet", stubWorkerModel("sonnet", "claude-sonnet-5"));
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "local", Set.of());
+        FleetConfig.Models models = new FleetConfig.Models(List.of(
+                new FleetConfig.Models.ModelEntry("deepseek-v4-flash", false)));
+        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "local", profiles,
+                PlacementPolicies.fixed(), _ -> 0, null, BackendQuarantine.none(), NO_OUTAGE,
+                () -> models);
+
+        PlacementException e = assertThrows(PlacementException.class,
+                () -> composite.spawn(new SpawnRequest("local", null, null)));
+        assertTrue(e.getMessage().contains("local"), "message names the profile: " + e.getMessage());
+        assertTrue(e.getMessage().contains("deepseek-v4-flash"),
+                "message names the model: " + e.getMessage());
+        assertTrue(e.getMessage().contains("operator") && e.getMessage().contains("turned off"),
+                "wording says the OPERATOR turned it off: " + e.getMessage());
+        // Distinct from quarantine/cool-off wording (criterion 1's explicit requirement).
+        assertFalse(e.getMessage().contains("quarantined"), "must not read like quarantine: " + e.getMessage());
+        assertFalse(e.getMessage().contains("cooling off"), "must not read like cool-off: " + e.getMessage());
+        assertEquals(0, adapter.spawnCount("local"), "the off-model profile is never delegated to");
+    }
+
+    /** A profile whose model is NOT off spawns normally even while another model is off. */
+    @Test
+    void explicitSpawnOntoAnEnabledModelProfileSucceedsWhileAnotherModelIsOff() {
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, FleetConfig.Profile> profiles = ordered(
+                "local", stubWorkerModel("local", "deepseek-v4-flash"),
+                "sonnet", stubWorkerModel("sonnet", "claude-sonnet-5"));
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "local", Set.of());
+        FleetConfig.Models models = new FleetConfig.Models(List.of(
+                new FleetConfig.Models.ModelEntry("deepseek-v4-flash", false)));
+        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "local", profiles,
+                PlacementPolicies.fixed(), _ -> 0, null, BackendQuarantine.none(), NO_OUTAGE,
+                () -> models);
+
+        assertDoesNotThrow(() -> composite.spawn(new SpawnRequest("sonnet", null, null)));
+        assertEquals(1, adapter.spawnCount("sonnet"));
+    }
+
+    /**
+     * Criterion 8: one {@code enabled: false} entry disables EVERY profile naming that model — the
+     * live example, {@code deepseek-v4-flash} backing both {@code local} and {@code local-direct}.
+     */
+    @Test
+    void turningOffOneModelRefusesEveryProfileThatNamesIt() {
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, FleetConfig.Profile> profiles = ordered(
+                "local", stubWorkerModel("local", "deepseek-v4-flash"),
+                "local-direct", stubWorkerModel("local-direct", "deepseek-v4-flash"));
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "local", Set.of());
+        FleetConfig.Models models = new FleetConfig.Models(List.of(
+                new FleetConfig.Models.ModelEntry("deepseek-v4-flash", false)));
+        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "local", profiles,
+                PlacementPolicies.fixed(), _ -> 0, null, BackendQuarantine.none(), NO_OUTAGE,
+                () -> models);
+
+        assertThrows(PlacementException.class, () -> composite.spawn(new SpawnRequest("local", null, null)));
+        assertThrows(PlacementException.class,
+                () -> composite.spawn(new SpawnRequest("local-direct", null, null)),
+                "local-direct shares local's model, so it must be refused too");
+        assertEquals(0, adapter.spawnCount("local"));
+        assertEquals(0, adapter.spawnCount("local-direct"));
+    }
+
+    /** Criterion 3: an old-style entry with no {@code enabled} field never refuses a spawn. */
+    @Test
+    void anEntryWithNoEnabledFieldNeverRefusesASpawn() {
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, FleetConfig.Profile> profiles = Map.of("local", stubWorkerModel("local", "deepseek-v4-flash"));
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "local", Set.of());
+        // The back-compat single-arg ModelEntry constructor — no enabled field in the shape at all.
+        FleetConfig.Models models = new FleetConfig.Models(
+                List.of(new FleetConfig.Models.ModelEntry("deepseek-v4-flash")));
+        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "local", profiles,
+                PlacementPolicies.fixed(), _ -> 0, null, BackendQuarantine.none(), NO_OUTAGE,
+                () -> models);
+
+        assertDoesNotThrow(() -> composite.spawn(new SpawnRequest("local", null, null)));
+        assertEquals(1, adapter.spawnCount("local"));
+    }
+
+    /** A model absent from {@code models.allow:} entirely (nothing to gate against) is never refused. */
+    @Test
+    void aModelNotConfiguredInTheAllowListIsNeverGated() {
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, FleetConfig.Profile> profiles = Map.of("local", stubWorkerModel("local", "unlisted-model"));
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "local", Set.of());
+        FleetConfig.Models models = new FleetConfig.Models(List.of(
+                new FleetConfig.Models.ModelEntry("deepseek-v4-flash", false)));
+        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "local", profiles,
+                PlacementPolicies.fixed(), _ -> 0, null, BackendQuarantine.none(), NO_OUTAGE,
+                () -> models);
+
+        assertDoesNotThrow(() -> composite.spawn(new SpawnRequest("local", null, null)));
+    }
+
+    /** Criterion 2: an unqualified spawn skips an off-model candidate and lands on another one. */
+    @Test
+    void placementSkipsAnOffModelProfileAndRoutesToAnotherOne() {
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, FleetConfig.Profile> profiles = ordered(
+                "local", stubWorkerModel("local", "deepseek-v4-flash"),
+                "sonnet", stubWorkerModel("sonnet", "claude-sonnet-5"));
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "local", Set.of());
+        FleetConfig.Models models = new FleetConfig.Models(List.of(
+                new FleetConfig.Models.ModelEntry("deepseek-v4-flash", false)));
+        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "local", profiles,
+                PlacementPolicies.weighted(), _ -> 0, null, BackendQuarantine.none(), NO_OUTAGE,
+                () -> models);
+
+        PeerHandle h = composite.spawn(new SpawnRequest(null, null, null));
+        assertEquals("sonnet", h.profile(), "local's model is off, so an unqualified spawn must land on sonnet");
+        assertEquals(0, adapter.spawnCount("local"));
+    }
+
+    /**
+     * Criterion 2's second half: when EVERY candidate's model is off, the placement exception must
+     * name that as the cause — not a generic "no candidates" message.
+     */
+    @Test
+    void automaticPlacementNamesModelOffWhenEveryCandidateIsOffModel() {
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, FleetConfig.Profile> profiles = ordered(
+                "local", stubWorkerModel("local", "deepseek-v4-flash"),
+                "local-direct", stubWorkerModel("local-direct", "deepseek-v4-flash"));
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "local", Set.of());
+        FleetConfig.Models models = new FleetConfig.Models(List.of(
+                new FleetConfig.Models.ModelEntry("deepseek-v4-flash", false)));
+        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "local", profiles,
+                PlacementPolicies.weighted(), _ -> 0, null, BackendQuarantine.none(), NO_OUTAGE,
+                () -> models);
+
+        PlacementException e = assertThrows(PlacementException.class,
+                () -> composite.spawn(new SpawnRequest(null, null, null)),
+                "both candidates share the off model — nothing is available");
+        assertTrue(e.getMessage().contains("model") && e.getMessage().contains("turned off"),
+                "message names model-off as the cause, not a generic no-candidates message: "
+                        + e.getMessage());
+    }
+
+    /**
+     * fleetd #422 follow-up: {@code fixed} is the DEFAULT placement policy ({@code
+     * PlacementPolicies.fromName} returns it for an absent/blank name), and it built its own inline
+     * candidate filter instead of calling {@code PlacementPolicyUtil.available()} — so it never
+     * checked {@code modelOff()}. Mirrors {@code placementSkipsAnOffModelProfileAndRoutesToAnotherOne}
+     * above with only the policy swapped, to prove the gate now fires on the path most fleets use.
+     */
+    @Test
+    void fixedPlacementSkipsAnOffModelProfileToo() {
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, FleetConfig.Profile> profiles = ordered(
+                "local", stubWorkerModel("local", "deepseek-v4-flash"),
+                "sonnet", stubWorkerModel("sonnet", "claude-sonnet-5"));
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "local", Set.of());
+        FleetConfig.Models models = new FleetConfig.Models(List.of(
+                new FleetConfig.Models.ModelEntry("deepseek-v4-flash", false)));
+        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "local", profiles,
+                PlacementPolicies.fixed(), _ -> 0, null, BackendQuarantine.none(), NO_OUTAGE,
+                () -> models);
+
+        PeerHandle h = composite.spawn(new SpawnRequest(null, null, null));
+        assertEquals("sonnet", h.profile(), "local's model is off, so an unqualified spawn must land on sonnet");
+        assertEquals(0, adapter.spawnCount("local"));
+    }
+
+    /**
+     * fleetd #425 rework, acceptance 2: same shape as {@link #fixedPlacementSkipsAnOffModelProfileToo}
+     * above, but through {@link CompositePeerLauncher#routedProfileFor} rather than an actual
+     * {@link CompositePeerLauncher#spawn} — the exact call {@code SessionManager.acquireWithWorktree}
+     * makes to pre-resolve a profile for provisioning. This is the fleetd #429 case named in the
+     * ticket: an operator turns a model off, and an unqualified worktree spawn must still route
+     * around it instead of throwing "names model, which the operator has turned off" — the throw
+     * {@link CompositePeerLauncher#enforceModelEnabled} raises only on the EXPLICIT-profile branch,
+     * which is exactly the branch the regressed round accidentally routed every worktree spawn onto.
+     */
+    @Test
+    void routedProfileForSkipsAModelOffPoolFirstProfileUnderFixedPolicy() {
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, FleetConfig.Profile> profiles = ordered(
+                "local", stubWorkerModel("local", "deepseek-v4-flash"),
+                "sonnet", stubWorkerModel("sonnet", "claude-sonnet-5"));
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "local", Set.of());
+        FleetConfig.Models models = new FleetConfig.Models(List.of(
+                new FleetConfig.Models.ModelEntry("deepseek-v4-flash", false)));
+        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "local", profiles,
+                PlacementPolicies.fixed(), _ -> 0, null, BackendQuarantine.none(), NO_OUTAGE,
+                () -> models);
+
+        assertEquals("sonnet", composite.routedProfileFor(MemberRole.DEV),
+                "local (the pool's first entry) names an off model, so the routed answer must be sonnet");
+        assertEquals("local", composite.defaultProfileFor(MemberRole.DEV),
+                "sanity: defaultProfileFor stays blind to model-off — that's the gap routedProfileFor closes");
+        assertEquals(0, adapter.spawnCount("local"), "routedProfileFor never spawns anything");
+        assertEquals(0, adapter.spawnCount("sonnet"), "routedProfileFor never spawns anything");
+    }
+
+    /**
+     * Criterion 4: turning a model off/on is HOT — no restart — proven through a REAL
+     * {@code ConfigRef.reload()}, not a hand-rolled supplier swap. Also proves {@code models} is
+     * correctly reclassified: the reload's {@link ConfigRef.Outcome#applied()} is {@code true} and
+     * {@code "models"} never appears in {@link ConfigRef.Outcome#deferred()}.
+     */
+    @Test
+    void modelOnOffIsHotReloadedThroughARealConfigRef(@TempDir Path dir) throws Exception {
+        Path yaml = dir.resolve("fleetd.yaml");
+        Files.writeString(yaml, """
+                bind:
+                  port: 8080
+                profiles:
+                  local:
+                    baseUrl: http://local.gw:8000
+                    model: deepseek-v4-flash
+                models:
+                  allow:
+                    - model: deepseek-v4-flash
+                """);
+        FleetConfig initial = FleetConfig.load(yaml);
+        ConfigRef configRef = new ConfigRef(yaml, initial);
+
+        FakeHerdr herdr = new FakeHerdr();
+        StubLauncher adapter = new StubLauncher("claude", herdr,
+                Map.of("local", stubWorker("local")), "local", Set.of());
+        CompositePeerLauncher composite = new CompositePeerLauncher(
+                List.of(adapter), "local", configRef, _ -> 0, BackendQuarantine.none(), NO_OUTAGE);
+
+        assertDoesNotThrow(() -> composite.spawn(new SpawnRequest("local", null, null)),
+                "the model starts enabled");
+        assertEquals(1, adapter.spawnCount("local"));
+
+        Files.writeString(yaml, """
+                bind:
+                  port: 8080
+                profiles:
+                  local:
+                    baseUrl: http://local.gw:8000
+                    model: deepseek-v4-flash
+                models:
+                  allow:
+                    - model: deepseek-v4-flash
+                      enabled: false
+                """);
+        ConfigRef.Outcome outcome = configRef.reload();
+        assertTrue(outcome.applied(), "a models.allow on/off edit must apply live, never be refused");
+        assertFalse(outcome.deferred().contains("models"),
+                "models is hot-excluded now — it must never be reported as a deferred key");
+
+        PlacementException e = assertThrows(PlacementException.class,
+                () -> composite.spawn(new SpawnRequest("local", null, null)),
+                "the very next spawn must see the reload, with no restart");
+        assertTrue(e.getMessage().contains("deepseek-v4-flash"));
+        assertEquals(1, adapter.spawnCount("local"), "still just the one successful spawn from before");
+
+        // And back on, still hot, still no restart.
+        Files.writeString(yaml, """
+                bind:
+                  port: 8080
+                profiles:
+                  local:
+                    baseUrl: http://local.gw:8000
+                    model: deepseek-v4-flash
+                models:
+                  allow:
+                    - model: deepseek-v4-flash
+                      enabled: true
+                """);
+        ConfigRef.Outcome reEnabled = configRef.reload();
+        assertTrue(reEnabled.applied());
+        assertDoesNotThrow(() -> composite.spawn(new SpawnRequest("local", null, null)));
+        assertEquals(2, adapter.spawnCount("local"));
+    }
+
+    /**
+     * fleetd #422 follow-up, acceptance criterion 2: {@link CompositePeerLauncher#modelGateState()}
+     * is LIVE — no restart — proven through a REAL {@link ConfigRef#reload()}, exactly like {@link
+     * #modelOnOffIsHotReloadedThroughARealConfigRef} above proves for the on/off gate itself. This
+     * single reload sequence walks through all three states the ticket asks for: no {@code models:}
+     * block, a block armed with nothing off, and a block with one model off — so a reload that flips
+     * between any of the three is proven live, not just the on/off edit within an already-armed block.
+     */
+    @Test
+    void modelGateStateIsHotReloadedThroughARealConfigRef(@TempDir Path dir) throws Exception {
+        Path yaml = dir.resolve("fleetd.yaml");
+        Files.writeString(yaml, """
+                bind:
+                  port: 8080
+                profiles:
+                  local:
+                    baseUrl: http://local.gw:8000
+                    model: deepseek-v4-flash
+                """);
+        FleetConfig initial = FleetConfig.load(yaml);
+        ConfigRef configRef = new ConfigRef(yaml, initial);
+
+        FakeHerdr herdr = new FakeHerdr();
+        StubLauncher adapter = new StubLauncher("claude", herdr,
+                Map.of("local", stubWorker("local")), "local", Set.of());
+        CompositePeerLauncher composite = new CompositePeerLauncher(
+                List.of(adapter), "local", configRef, _ -> 0, BackendQuarantine.none(), NO_OUTAGE);
+
+        PeerLauncher.ModelGateState notConfigured = composite.modelGateState();
+        assertFalse(notConfigured.configured(), "no models: block in the config at all");
+        assertEquals(Set.of(), notConfigured.off());
+
+        Files.writeString(yaml, """
+                bind:
+                  port: 8080
+                profiles:
+                  local:
+                    baseUrl: http://local.gw:8000
+                    model: deepseek-v4-flash
+                models:
+                  allow:
+                    - model: deepseek-v4-flash
+                      enabled: false
+                """);
+        assertTrue(configRef.reload().applied(), "adding a models: block must apply live, no restart");
+        PeerLauncher.ModelGateState armedWithOneOff = composite.modelGateState();
+        assertTrue(armedWithOneOff.configured(), "a models: block now exists — the gate is armed");
+        assertEquals(Set.of("deepseek-v4-flash"), armedWithOneOff.off());
+
+        Files.writeString(yaml, """
+                bind:
+                  port: 8080
+                profiles:
+                  local:
+                    baseUrl: http://local.gw:8000
+                    model: deepseek-v4-flash
+                models:
+                  allow:
+                    - model: deepseek-v4-flash
+                      enabled: true
+                """);
+        assertTrue(configRef.reload().applied(), "flipping the entry back on must apply live too");
+        PeerLauncher.ModelGateState armedWithZeroOff = composite.modelGateState();
+        assertTrue(armedWithZeroOff.configured(),
+                "the block is still present — armed and reporting zero, not the same as no block at all");
+        assertEquals(Set.of(), armedWithZeroOff.off());
+    }
+
+    /**
+     * fleetd #422 follow-up, acceptance criterion 3: the invariant is that an absent {@code
+     * models:} block stays permitted and must never be fatal. Proved, not assumed — a config
+     * without one loads, validates, reports the gate as not configured, AND still spawns normally
+     * (no {@link PlacementException} from a gate that has nothing to check against), using the same
+     * production-shaped {@code Supplier<FleetConfig>} wiring {@code Fleetd.main} actually uses.
+     */
+    @Test
+    void noModelsBlockConfigStillLoadsAndSpawnsNormally(@TempDir Path dir) throws Exception {
+        Path yaml = dir.resolve("fleetd.yaml");
+        Files.writeString(yaml, """
+                bind:
+                  port: 8080
+                profiles:
+                  local:
+                    baseUrl: http://local.gw:8000
+                    model: deepseek-v4-flash
+                """);
+        FleetConfig cfg = FleetConfig.load(yaml);
+        assertDoesNotThrow(cfg::validateAll, "a config with no models: block must load and validate cleanly");
+        ConfigRef configRef = new ConfigRef(yaml, cfg);
+
+        FakeHerdr herdr = new FakeHerdr();
+        StubLauncher adapter = new StubLauncher("claude", herdr,
+                Map.of("local", stubWorker("local")), "local", Set.of());
+        CompositePeerLauncher composite = new CompositePeerLauncher(
+                List.of(adapter), "local", configRef, _ -> 0, BackendQuarantine.none(), NO_OUTAGE);
+
+        assertFalse(composite.modelGateState().configured());
+        assertDoesNotThrow(() -> composite.spawn(new SpawnRequest("local", null, null)),
+                "no models: block means nothing to gate against — the spawn must go through");
+        assertEquals(1, adapter.spawnCount("local"));
+    }
+
+    /** {@code fleet_profiles}/{@code GET /profiles} must read the exact same live source the gate reads. */
+    @Test
+    void disabledModelsReportsWhatTheGateActuallyEnforces() {
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, FleetConfig.Profile> profiles = ordered(
+                "local", stubWorkerModel("local", "deepseek-v4-flash"),
+                "sonnet", stubWorkerModel("sonnet", "claude-sonnet-5"));
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "local", Set.of());
+        FleetConfig.Models models = new FleetConfig.Models(List.of(
+                new FleetConfig.Models.ModelEntry("deepseek-v4-flash", false),
+                new FleetConfig.Models.ModelEntry("claude-sonnet-5", true)));
+        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "local", profiles,
+                PlacementPolicies.fixed(), _ -> 0, null, BackendQuarantine.none(), NO_OUTAGE,
+                () -> models);
+
+        assertEquals(Set.of("deepseek-v4-flash"), composite.disabledModels());
+    }
+
+    /** A caller with no {@code models:} block (the map-based constructors) reports nothing off. */
+    @Test
+    void disabledModelsIsEmptyWithNoModelsConfigured() {
+        FakeHerdr herdr = new FakeHerdr();
+        PeerLauncher composite = composite(herdr);
+        assertEquals(Set.of(), composite.disabledModels());
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/member/EnvAllowListScrubTest.java

@@ -8,6 +8,7 @@ import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ArrayList;
+import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -17,6 +18,7 @@ import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -45,6 +47,15 @@ class EnvAllowListScrubTest {
     /** Env var names appearing in command output; anything else (prompts, wrapped lines) is noise. */
     private static final Pattern ENV_NAME = Pattern.compile("^([A-Za-z_][A-Za-z0-9_]*)$");
 
+    /**
+     * fleetd #388: the sentinel name the generated {@code .zshenv} guard uses, kept here as a
+     * literal rather than referencing {@link EnvAllowListScrub#SCRUB_SENTINEL} — the two tests that
+     * use it must still compile and run against the pre-fix production class (which has no such
+     * constant), so the revert-and-prove-it-fails step exercises a real assertion instead of a
+     * compilation error.
+     */
+    private static final String SCRUB_SENTINEL_NAME = "_CB633_SCRUBBED";
+
     /**
      * The equality test. Expected survivors = baseline exports ∩ allowed — i.e. every survivor is
      * allowed AND every allowed name that existed survives. The operator's own secret-store exports
@@ -108,6 +119,230 @@ class EnvAllowListScrubTest {
                 "allowed N of M with N <= M — the denominator is always reported");
     }
 
+    /**
+     * fleetd #394: the actual defect. Plain {@code export "$n="} is FATAL for a zsh read-only or
+     * special parameter (e.g. {@code UID}) and aborts the whole sourced file — every name still to
+     * come is never blanked, and the {@code scrub-report.txt} below is never written at all,
+     * silently ({@code 2>/dev/null} swallows the error). This plants an unblankable, exported,
+     * read-only variable in the MIDDLE of the names the scrub attempts to blank, with two more
+     * names after it, and asserts that both of those later names are STILL blanked and the report
+     * is STILL written with the failure counted — a test that only checked names BEFORE the failure
+     * point would pass today and prove nothing.
+     *
+     * <p>The planted name is a made-up one ({@code FLEETD_TEST_UNBLANKABLE}), not {@code UID} or
+     * any other name a skip-list might already know about — invariant 1 is that the loop survives
+     * ANY unblankable name, not a known one, so the test must not lean on one either.
+     *
+     * <p>Exercises the real artefact: {@link EnvAllowListScrub#scrubScript} is run verbatim under a
+     * real {@code /bin/zsh}, not just asserted on as a Java string. The four planted names are
+     * exported one at a time via {@code typeset -x}/{@code typeset -rx} immediately before the
+     * script runs, in a fixed order — zsh's {@code export}/{@code typeset -x} appends to the
+     * process's environment table in call order (verified empirically: a freshly-exported name
+     * always sorts after every inherited one and after every earlier freshly-exported name in
+     * {@code command env}'s own output), which is what makes the "middle" position deterministic
+     * here, unlike relying on the OS's own inherited-environment order.
+     */
+    @Test
+    void unblankableNameInTheMiddleDoesNotAbortNamesAfterIt(@TempDir Path tmp) throws Exception {
+        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+
+        // Only ZDOTDIR is allowed — it must survive the scrub itself, since the report is written
+        // to "$ZDOTDIR/..." AFTER the blanking loop runs; if ZDOTDIR were blanked as a side effect,
+        // the report write would silently go to the wrong place instead of testing anything.
+        String script = EnvAllowListScrub.scrubScript(Set.of("ZDOTDIR"));
+        String setup = """
+                typeset -x FLEETD_TEST_BEFORE=1
+                typeset -rx FLEETD_TEST_UNBLANKABLE=1
+                typeset -x FLEETD_TEST_AFTER_A=1
+                typeset -x FLEETD_TEST_AFTER_B=1
+                """;
+
+        ProcessBuilder pb = new ProcessBuilder("/bin/zsh");
+        pb.environment().clear();
+        pb.environment().put("PATH", "/usr/bin:/bin");
+        pb.environment().put("ZDOTDIR", tmp.toAbsolutePath().toString());
+        pb.redirectError(ProcessBuilder.Redirect.DISCARD);
+        Process zsh = pb.start();
+        zsh.getOutputStream().write((setup + script).getBytes(StandardCharsets.UTF_8));
+        zsh.getOutputStream().flush();
+        zsh.getOutputStream().close();
+        assertTrue(zsh.waitFor(60, java.util.concurrent.TimeUnit.SECONDS),
+                "the scrub script did not exit within 60s");
+        assertEquals(0, zsh.exitValue(),
+                "the scrub script itself must never abort — an unblankable name must not kill the "
+                        + "sourced file");
+
+        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(tmp);
+        assertNotNull(report, "the report must still be written even though one name could not be "
+                + "blanked — a report that silently never appears is the #394 bug");
+        assertTrue(report.blanked().contains("FLEETD_TEST_BEFORE"),
+                "sanity: the name before the unblankable one must be blanked");
+        assertTrue(report.blanked().contains("FLEETD_TEST_AFTER_A"),
+                "the FIRST name AFTER the unblankable one must still be blanked — before the fix, "
+                        + "the whole loop aborted at the unblankable name and every later name was "
+                        + "silently left untouched");
+        assertTrue(report.blanked().contains("FLEETD_TEST_AFTER_B"),
+                "the SECOND name after the unblankable one must also still be blanked");
+        assertTrue(report.unblankable().contains("FLEETD_TEST_UNBLANKABLE"),
+                "the unblankable name is reported by name, not silently dropped");
+        // fleetd #400 note: zsh itself auto-exports SHLVL on every shell start (measured: it appears
+        // in `command env` even from a fully cleared parent), and a bare assignment to it is coerced
+        // rather than failing — exactly the shape #400 fixes. Before that fix, eval's exit status
+        // alone silently misclassified SHLVL as blanked, so this test's old "exactly one" assertion
+        // passed by accident: it never actually proved SHLVL was absent from the candidates, only
+        // that the old bug hid it. Now that classification reads the value back, SHLVL and
+        // FLEETD_TEST_UNBLANKABLE both correctly land in unblankable() — real, unplanted evidence
+        // the #400 fix works, not just the synthetic case in the dedicated #400 test above.
+        assertTrue(report.unblankable().contains("SHLVL"),
+                "fleetd #400: zsh's own auto-exported SHLVL must also be reported unblankable, not "
+                        + "silently miscounted as blanked");
+        assertEquals(report.unblankable().size(), report.failed(),
+                "the failed count must equal the number of names actually reported unblankable");
+    }
+
+    /**
+     * fleetd #400: {@code eval}'s exit status is not proof that a name was actually blanked. zsh
+     * coerces a bare {@code NAME=} assignment on an integer special parameter to a number instead of
+     * failing, so {@code eval} reports success while the value stays non-empty — a status-based
+     * classification calls that "blanked" when it was not. This drives all three shapes a name can
+     * take through the real {@code scrubScript} in ONE run: a normal, genuinely blankable name; a
+     * fatal one ({@code LINENO} — deliberately not {@code UID}, so this test does not depend on the
+     * harness's uid); and the silent-no-op one the ticket is about ({@code SECONDS}, rc 0 but
+     * unchanged). Under the pre-#400 exit-status check, {@code SECONDS} would land in
+     * {@code blanked()} — that is the exact false receipt this fix removes.
+     *
+     * <p>Criterion 3: a cleared {@code ProcessBuilder} parent does not, by itself, give the child
+     * zsh any of these names — {@code SECONDS}/{@code LINENO} are zsh's own built-in parameters and
+     * only become CANDIDATES the enumeration loop can see (i.e. show up in {@code command env}) when
+     * they arrive via the process's own environment table, not merely by existing as zsh parameters
+     * inside the shell. So each is put into {@code pb.environment()} explicitly, after
+     * {@code clear()} — confirmed empirically first (a throwaway probe piping
+     * {@code env -i PATH=... SECONDS=999 LINENO=999 FLEETD_TEST_NORMAL=1 zsh -c 'command env | cut
+     * -d= -f1'}) that all three names really appear in {@code command env}'s output under exactly
+     * this construction, not relying on whatever the test-runner's own ambient environment happens
+     * to contain.
+     */
+    @Test
+    void classifiesByObservedValueNotExitStatusAcrossAllThreeShapes(@TempDir Path tmp) throws Exception {
+        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+
+        String script = EnvAllowListScrub.scrubScript(Set.of("ZDOTDIR"));
+
+        ProcessBuilder pb = new ProcessBuilder("/bin/zsh");
+        pb.environment().clear();
+        pb.environment().put("PATH", "/usr/bin:/bin");
+        pb.environment().put("ZDOTDIR", tmp.toAbsolutePath().toString());
+        // Explicitly placed in the child's environment table — see the javadoc above on why a
+        // cleared parent alone does not put these on the enumeration loop's candidate list.
+        pb.environment().put("SECONDS", "999");   // rc 0, value coerced/unchanged — the #400 bug
+        pb.environment().put("LINENO", "999");    // fatal on assignment, eval rc != 0, contained
+        pb.environment().put("FLEETD_TEST_NORMAL", "1"); // genuinely blankable, the control case
+        pb.redirectError(ProcessBuilder.Redirect.DISCARD);
+        Process zsh = pb.start();
+        zsh.getOutputStream().write(script.getBytes(StandardCharsets.UTF_8));
+        zsh.getOutputStream().flush();
+        zsh.getOutputStream().close();
+        assertTrue(zsh.waitFor(60, java.util.concurrent.TimeUnit.SECONDS),
+                "the scrub script did not exit within 60s");
+        assertEquals(0, zsh.exitValue(),
+                "the scrub script must still reach its end with both a fatal name and a silent "
+                        + "no-op name among the candidates");
+
+        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(tmp);
+        assertNotNull(report, "the report must still be written");
+        assertTrue(report.blanked().contains("FLEETD_TEST_NORMAL"),
+                "the control case: an ordinary name is genuinely blankable and must be reported so");
+        assertTrue(report.unblankable().contains("LINENO"),
+                "a name fatal to assign to must be reported unblankable — sanity check that "
+                        + "containment still works under the new classification");
+        assertTrue(report.unblankable().contains("SECONDS"),
+                "the #400 defect: eval returns rc 0 for SECONDS (zsh coerces the assignment instead "
+                        + "of failing) but the value is left non-empty — classifying on the observed "
+                        + "value catches this; classifying on eval's exit status would have called "
+                        + "this \"blanked\" and produced a false receipt");
+        assertFalse(report.blanked().contains("SECONDS"),
+                "SECONDS must never appear as blanked — it was never actually emptied");
+    }
+
+    /**
+     * fleetd #394 follow-up: the blanking loop's {@code eval "export ${n}="} splices {@code n} into
+     * a string that zsh then interprets as shell syntax. That is only safe because every name
+     * reaching {@code _cb633_blank} already passed an identifier check in the ENUMERATION loop
+     * (20 lines away, in a different loop) — so the fix re-asserts the identical check immediately
+     * before the {@code eval} call, rather than trusting that distant guard to keep holding.
+     *
+     * <p>This test plants a value with an embedded newline, exploiting the exact "junk from
+     * multi-line values" gap the enumeration loop's own comment already documents: {@code command
+     * env}'s text output is read line-by-line, so a value's second line becomes a spurious extra
+     * "name" that was never a real exported variable. The fragment used here ({@code
+     * junk.fragment}) is merely non-conforming (it contains a dot) — never command-shaped; this
+     * test must never demonstrate command execution and plants no command-shaped payload.
+     *
+     * <p>Exercises the real artefact end-to-end: {@link EnvAllowListScrub#scrubScript} runs
+     * verbatim under a real {@code /bin/zsh}, exactly as {@code generate()} would produce it — this
+     * is not a synthetic call into just the blanking loop.
+     */
+    @Test
+    void nonIdentifierJunkFromAMultilineValueIsSkippedNotBlankedOrUnblankable(@TempDir Path tmp)
+            throws Exception {
+        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+
+        String script = EnvAllowListScrub.scrubScript(Set.of("ZDOTDIR"));
+
+        ProcessBuilder pb = new ProcessBuilder("/bin/zsh");
+        pb.environment().clear();
+        pb.environment().put("PATH", "/usr/bin:/bin");
+        pb.environment().put("ZDOTDIR", tmp.toAbsolutePath().toString());
+        // Embedded newline: `command env`'s own text output splits this into two lines, and the
+        // second ("junk.fragment") has no "=" at all, so `cut -d= -f1` returns it unchanged as a
+        // spurious candidate "name" — it was never an actual exported variable by that name.
+        pb.environment().put("FLEETD_TEST_MULTILINE", "keep\njunk.fragment");
+        pb.redirectError(ProcessBuilder.Redirect.DISCARD);
+        Process zsh = pb.start();
+        zsh.getOutputStream().write(script.getBytes(StandardCharsets.UTF_8));
+        zsh.getOutputStream().flush();
+        zsh.getOutputStream().close();
+        assertTrue(zsh.waitFor(60, java.util.concurrent.TimeUnit.SECONDS),
+                "the scrub script did not exit within 60s");
+        assertEquals(0, zsh.exitValue(), "the scrub script must reach its end");
+
+        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(tmp);
+        assertNotNull(report, "the report must still be written");
+        assertTrue(report.blanked().contains("FLEETD_TEST_MULTILINE"),
+                "sanity: the real, identifier-shaped variable must still be blanked normally");
+        assertFalse(report.blanked().contains("junk.fragment"),
+                "a non-identifier fragment is not a real variable and must never be blanked");
+        assertFalse(report.unblankable().contains("junk.fragment"),
+                "a non-identifier fragment must never even become a candidate the blanking loop "
+                        + "attempts — it must be filtered before either guard has to catch it, so "
+                        + "it is neither blanked nor counted as a failed attempt");
+    }
+
+    /** A group-shared ZDOTDIR still lets the member truncate and write its pre-created receipt. */
+    @Test
+    void groupSharedScrubWritesAndReadsItsReport(@TempDir Path tmp) throws Exception {
+        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+        Set<String> allowed = MemberEnvAllowList.derive(List.of());
+        Path zdotdir = EnvAllowListScrub.generate(tmp, allowed, currentUserGroup());
+
+        Map<String, String> cleanParent = Map.of(
+                "HOME", System.getProperty("user.home"),
+                "PATH", "/usr/bin:/bin",
+                "SHELL", "/bin/zsh");
+        exportedNamesFromCleanParent(cleanParent, zdotdir);
+
+        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(zdotdir);
+        assertNotNull(report, "a group-shared completed login shell must leave a report behind");
+        assertTrue(report.allowed() >= 0 && report.total() >= report.allowed(),
+                "allowed N of M with N <= M — the denominator is always reported");
+        assertEquals("rw-rw----", java.nio.file.attribute.PosixFilePermissions.toString(
+                        Files.getPosixFilePermissions(zdotdir.resolve(EnvAllowListScrub.REPORT_FILE))),
+                "the pre-created receipt must be group-writable");
+        assertEquals("rwxr-x---", java.nio.file.attribute.PosixFilePermissions.toString(
+                        Files.getPosixFilePermissions(zdotdir)),
+                "group sharing must not make the ZDOTDIR directory group-writable");
+    }
+
     /** Report parsing is lenient: absent file → null (no measurement), not an exception. */
     @Test
     void readReportReturnsNullForADirectoryWithoutOne(@TempDir Path dir) {
@@ -224,6 +459,140 @@ class EnvAllowListScrubTest {
                         + "shell. A difference here means the scrub is dead on Linux.");
     }
 
+    /**
+     * fleetd #388: the actual gap. zsh reads {@code .zshenv} always, {@code .zprofile}/
+     * {@code .zlogin} only for a LOGIN shell, and {@code .zshrc} only for an INTERACTIVE one — so a
+     * shell that is NEITHER (a bare {@code /bin/zsh} reading a script off a non-tty stdin, no
+     * {@code -l}, no {@code -i}) reads only {@code .zshenv} and stops. Before this fix, that shell
+     * never reached {@code scrub.zsh} at all: the decoy secret below would survive untouched. This
+     * test injects that decoy directly into the process environment (not via a sourced dotfile,
+     * since the whole point of the gap is that {@code .zshenv} is normally close to empty) so the
+     * test does not depend on any real {@code ~/.zshrc} content existing on the host.
+     */
+    @Test
+    void scrubRunsInAShellThatIsNeitherLoginNorInteractive(@TempDir Path tmp) throws Exception {
+        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+        Set<String> allowed = MemberEnvAllowList.derive(List.of());
+        Path zdotdir = EnvAllowListScrub.generate(tmp, allowed);
+
+        Map<String, String> cleanParent = new HashMap<>(Map.of(
+                "HOME", System.getProperty("user.home"),
+                "PATH", "/usr/bin:/bin",
+                "SHELL", "/bin/zsh",
+                "USER", System.getProperty("user.name", "nobody"),
+                "TMPDIR", tmp.toString()));
+        cleanParent.put("FLEETD_TEST_DECOY_SECRET", "x"); // not on any allow-list; must be blanked
+
+        List<String> neither = List.of(); // no -l, no -i; stdin is a pipe (never a tty) either way
+        Set<String> baseline = exportedNamesFromCleanParent(cleanParent, null, neither);
+        Set<String> scrubbed = exportedNamesFromCleanParent(cleanParent, zdotdir, neither);
+
+        Set<String> expected = new TreeSet<>();
+        for (String name : baseline) {
+            if (MemberEnvAllowList.keeps(allowed, name)) {
+                expected.add(name);
+            }
+        }
+        assertTrue(baseline.contains("FLEETD_TEST_DECOY_SECRET"),
+                "sanity: the decoy must actually reach the un-scrubbed baseline, or this test proves "
+                        + "nothing");
+        expected.add("ZDOTDIR"); // the harness set it and it is infrastructure, so it must survive
+        expected.add(SCRUB_SENTINEL_NAME); // set by the new .zshenv guard once scrubbed
+        assertEquals(expected, scrubbed,
+                "a pane shell that is NEITHER login nor interactive must still be scrubbed — its "
+                        + "surviving exported names must EQUAL baseline ∩ allow-list, plus the "
+                        + "sentinel the guard sets once it has run. FLEETD_TEST_DECOY_SECRET surviving "
+                        + "here means the gap is still open.");
+    }
+
+    /**
+     * fleetd #388 invariants 3 and 4, which a name-set equality cannot show: a member's own tooling
+     * forks plain, non-login, non-interactive zsh processes for a single command (the same shape as
+     * the pane shell itself), and such a child must (a) keep whatever its parent deliberately set
+     * for it, never (b) re-run the scrub and blank it, and never (c) overwrite the pane's own
+     * {@code scrub-report.txt} with a description of itself instead of the pane. All three can only
+     * be shown by actually running a child process from within the scrubbed pane shell.
+     *
+     * <p>The pane and the child both report presence via {@code ${NAME:+present}} — empty when a
+     * name is unset OR blanked (exported empty), {@code present} when it is set and non-empty. No
+     * value is ever printed, only these two shapes and the literal word {@code set}/{@code unset}
+     * for the sentinel.
+     */
+    @Test
+    void neitherShellChildKeepsParentVariablesAndReceiptStillDescribesThePane(@TempDir Path tmp) throws Exception {
+        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+        Set<String> allowed = MemberEnvAllowList.derive(List.of());
+        Path zdotdir = EnvAllowListScrub.generate(tmp, allowed);
+
+        Map<String, String> paneEnv = new HashMap<>(Map.of(
+                "HOME", System.getProperty("user.home"),
+                "PATH", "/usr/bin:/bin",
+                "SHELL", "/bin/zsh",
+                "USER", System.getProperty("user.name", "nobody"),
+                "TMPDIR", tmp.toString()));
+        paneEnv.put("FLEETD_TEST_DECOY_SECRET", "x"); // not allow-listed; the pane must blank it
+        paneEnv.put("ZDOTDIR", zdotdir.toAbsolutePath().toString());
+
+        // The pane's own script reports what IT sees, then forks a plain non-login, non-interactive
+        // child — the shape a member's own tooling uses — carrying a variable the "parent" (this
+        // pane) deliberately set for it, the way git sets GIT_DIR for a hook.
+        String outerScript = """
+                print -r -- "PANE_SENTINEL=${%1$s:+set}"
+                print -r -- "PANE_DECOY=${FLEETD_TEST_DECOY_SECRET:+present}"
+                FLEETD_TEST_TOOL_VAR=keep /bin/zsh <<'CHILD'
+                print -r -- "CHILD_LOGIN=$([[ -o login ]] && echo yes || echo no)"
+                print -r -- "CHILD_INTERACTIVE=$([[ -o interactive ]] && echo yes || echo no)"
+                print -r -- "CHILD_TOOL_VAR=${FLEETD_TEST_TOOL_VAR:+present}"
+                print -r -- "CHILD_DECOY=${FLEETD_TEST_DECOY_SECRET:+present}"
+                print -r -- "CHILD_SENTINEL=${%1$s:+set}"
+                CHILD
+                exit
+                """.formatted(SCRUB_SENTINEL_NAME);
+
+        ProcessBuilder pb = new ProcessBuilder("/bin/zsh"); // no -l, no -i: the pane's own shape
+        pb.environment().clear();
+        pb.environment().putAll(paneEnv);
+        pb.redirectError(ProcessBuilder.Redirect.DISCARD);
+        Process zsh = pb.start();
+        zsh.getOutputStream().write(outerScript.getBytes(StandardCharsets.UTF_8));
+        zsh.getOutputStream().flush();
+        zsh.getOutputStream().close();
+        String stdout = new String(zsh.getInputStream().readAllBytes(), StandardCharsets.UTF_8);
+        assertTrue(zsh.waitFor(60, java.util.concurrent.TimeUnit.SECONDS),
+                "the pane+child probe did not exit within 60s");
+        assertTrue(zsh.exitValue() == 0, "probe zsh exited non-zero: " + stdout);
+
+        Map<String, String> reported = new HashMap<>();
+        for (String line : stdout.split("\n")) {
+            int eq = line.indexOf('=');
+            if (eq > 0) {
+                reported.put(line.substring(0, eq).trim(), line.substring(eq + 1).trim());
+            }
+        }
+
+        assertEquals("set", reported.get("PANE_SENTINEL"),
+                "the pane itself is neither login nor interactive, so the .zshenv guard must have "
+                        + "run the scrub and exported the sentinel");
+        assertEquals("", reported.get("PANE_DECOY"),
+                "the pane must blank a non-allow-listed name — invariant 1");
+        assertEquals("no", reported.get("CHILD_LOGIN"), "sanity: the child must also be non-login");
+        assertEquals("no", reported.get("CHILD_INTERACTIVE"), "sanity: the child must also be non-interactive");
+        assertEquals("present", reported.get("CHILD_TOOL_VAR"),
+                "invariant 3: a variable the pane deliberately set for its child must survive — a "
+                        + "child that re-ran the scrub would have blanked it");
+        assertEquals("", reported.get("CHILD_DECOY"),
+                "a name already blanked by the pane must stay blanked in the child, never resurrected");
+        assertEquals("set", reported.get("CHILD_SENTINEL"),
+                "the child must inherit the sentinel from the pane's environment, or it would re-scrub");
+
+        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(zdotdir);
+        assertNotNull(report, "the pane's own scrub pass must leave a report behind");
+        assertTrue(report.blanked().stream().noneMatch(n -> n.startsWith("FLEETD_TEST_TOOL_VAR")),
+                "invariant 4: the receipt must still describe the PANE, not the child — a child that "
+                        + "re-ran the scrub would have rewritten this file to list its own "
+                        + "FLEETD_TEST_TOOL_VAR as blanked");
+    }
+
     /**
      * Run {@code /bin/zsh -l -i} from a clean parent and return the NAMES it has exported by prompt
      * time. With {@code zdotdir} non-null, {@code ZDOTDIR} points at a generated scrub directory, so

fleetd/src/test/java/dev/ltms/fleet/member/MemberEnvAllowListTest.java

@@ -146,7 +146,7 @@ class MemberEnvAllowListTest {
         return new FleetConfig(null, null, null, Map.of(), null, null, null, null, null,
                 new FleetConfig.Broker(null, brokerUriEnv, null), null, null, null, null, null,
                 null, null, null, null,
-                new FleetConfig.Coordinator(null, coordinatorUriEnv, null, null)).withDefaults();
+                new FleetConfig.Coordinator(null, coordinatorUriEnv, null, null, null)).withDefaults();
     }
 
     /** {@code LC_*} categories are infrastructure by prefix; everything else needs an exact match. */

fleetd/src/test/java/dev/ltms/fleet/msg/AmqpReplyInboxContractTest.java

@@ -16,6 +16,7 @@ import java.util.List;
 import java.util.concurrent.TimeUnit;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
@@ -221,6 +222,31 @@ class AmqpReplyInboxContractTest {
         }
     }
 
+    @Test
+    void ackReportsHitVsMissAgainstARealBroker() throws Exception {
+        // fleetd #437: fleet_ack said "acknowledged <msgId>" for a message it never touched,
+        // because ReplyInbox.ack() (void) could not tell a hit from a miss. Pin the fixed
+        // boolean contract against a real broker — the adapter fleetd actually runs live.
+        String target = "worker-ack-contract-" + System.nanoTime();
+        try (AmqpReplyInbox inbox = AmqpReplyInbox.open(uri())) {
+            inbox.own(target);
+
+            // Never held for this target at all: must report false, not throw.
+            assertFalse(inbox.ack(target, "never-held"),
+                    "acking a msgId never held for an owned target must report false");
+
+            // A real message: first ack removes it and reports true...
+            inbox.publish(target, "m1", "ack me");
+            assertEquals(1, awaitPeek(inbox, target).size(), "the published reply should be held");
+            assertTrue(inbox.ack(target, "m1"), "acking a held reply must report true");
+            assertTrue(inbox.peek(target).isEmpty(), "an acked reply is dropped");
+
+            // ...and the second ack of the SAME msgId has nothing left to remove: false.
+            assertFalse(inbox.ack(target, "m1"),
+                    "acking the same msgId twice must report false the second time");
+        }
+    }
+
     @Test
     void confirmedPublishDeliversNormally() throws Exception {
         String target = "worker-confirm-" + System.nanoTime();

fleetd/src/test/java/dev/ltms/fleet/msg/FakeLeadChannel.java

@@ -3,6 +3,8 @@ package dev.ltms.fleet.msg;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
+import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
 
 /**
  * Hermetic stand-in for {@link LeadChannel}: an in-memory mailbox that records what was published
@@ -24,11 +26,27 @@ public final class FakeLeadChannel implements LeadChannel {
     private final List<String> acked = Collections.synchronizedList(new ArrayList<>());
     /** When set, every {@link #publish} throws it — the unroutable/nacked/timed-out peer. */
     private volatile IllegalStateException publishFailure;
+    /** Canned {@link #inspect} results by coord-id — absent for any coord-id not configured here. */
+    private final Map<String, MailboxState> mailboxes = new ConcurrentHashMap<>();
+    /** fleetd #440: matches {@link LeadMailbox}'s real default (durable queue + manual ack) unless overridden. */
+    private volatile boolean heldDurable = true;
 
     public FakeLeadChannel(String selfCoordId) {
         this.selfCoordId = selfCoordId;
     }
 
+    /** Make {@link #heldDurable()} report {@code durable} — the fleetd #440 seam for the false case. */
+    public FakeLeadChannel withHeldDurable(boolean durable) {
+        this.heldDurable = durable;
+        return this;
+    }
+
+    /** Make {@link #inspect(String)} return {@code state} for {@code coordId} instead of "absent". */
+    public FakeLeadChannel withMailbox(String coordId, MailboxState state) {
+        mailboxes.put(coordId, state);
+        return this;
+    }
+
     /** Make every publish fail as an unreachable peer would. */
     public FakeLeadChannel failPublishWith(String message) {
         this.publishFailure = new IllegalStateException(message);
@@ -65,6 +83,16 @@ public final class FakeLeadChannel implements LeadChannel {
         return selfCoordId;
     }
 
+    @Override
+    public MailboxState inspect(String coordId) {
+        return mailboxes.getOrDefault(coordId, MailboxState.absent(coordId));
+    }
+
+    @Override
+    public boolean heldDurable() {
+        return heldDurable;
+    }
+
     public List<LeadMessage> published() {
         return List.copyOf(published);
     }

fleetd/src/test/java/dev/ltms/fleet/msg/InMemoryReplyInboxTest.java

@@ -41,20 +41,20 @@ class InMemoryReplyInboxTest {
     @Test
     void ackRemovesTheMessage() {
         inbox.publish("term_a", "m1", "hello");
-        inbox.ack("term_a", "m1");
+        assertTrue(inbox.ack("term_a", "m1"), "fleetd #437: ack of a real entry must report true");
         assertTrue(inbox.peek("term_a").isEmpty(), "after ack, the message is gone");
     }
 
     @Test
     void ackForUnknownMsgIdIsNoOp() {
         inbox.publish("term_a", "m1", "hello");
-        inbox.ack("term_a", "no-such-id"); // no-op
+        assertFalse(inbox.ack("term_a", "no-such-id"), "fleetd #437: a miss must report false"); // no-op
         assertEquals(1, inbox.peek("term_a").size(), "the published message is still there");
     }
 
     @Test
     void ackForUnknownTargetIsNoOp() {
-        inbox.ack("no-such-target", "m1"); // no-op, should not throw
+        assertFalse(inbox.ack("no-such-target", "m1"), "fleetd #437: a miss must report false"); // no-op, should not throw
     }
 
     @Test
@@ -167,7 +167,7 @@ class InMemoryReplyInboxTest {
     @Test
     void peekAndAckAreNoOpsForUnownedTarget() {
         assertTrue(inbox.peek("term_not_owned").isEmpty());
-        inbox.ack("term_not_owned", "m1"); // no-op, should not throw
+        assertFalse(inbox.ack("term_not_owned", "m1"), "fleetd #437: a miss must report false"); // no-op, should not throw
     }
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/msg/LeadCoordLoopTest.java

@@ -54,6 +54,40 @@ class LeadCoordLoopTest {
         assertTrue(channel.peek().isEmpty(), "and is no longer held");
     }
 
+    @Test
+    void redeliveryOfAMessageAlreadyWrittenToThePaneIsAckedWithoutAnotherPaneWrite() {
+        var channel = new FakeLeadChannel(SELF).hold(new LeadMessage("m1", PEER, SELF, "recover me"));
+        var herdr = new FakeHerdr().agentStatus("idle");
+        var loop = loop(channel, herdr, Map.of(LEAD_TERM, SELF));
+
+        loop.tick();
+        channel.hold(new LeadMessage("m1", PEER, SELF, "recover me"));
+        loop.tick();
+
+        assertEquals(1, prompts(herdr).size(), "a redelivery must not consume the lead pane twice");
+        assertEquals(List.of("m1", "m1"), channel.acked(), "the redelivery still needs a fresh broker ack");
+    }
+
+    @Test
+    void aRedeliveryIsAckedEvenWhileTheLeadIsMidTurn() {
+        var channel = new FakeLeadChannel(SELF).hold(new LeadMessage("m1", PEER, SELF, "recover me"));
+        var herdr = new FakeHerdr().agentStatus("idle");
+        var loop = loop(channel, herdr, Map.of(LEAD_TERM, SELF));
+
+        loop.tick();
+        channel.hold(new LeadMessage("m1", PEER, SELF, "recover me"));
+        herdr.agentStatus("working");
+        loop.tick();
+
+        assertEquals(1, prompts(herdr).size(), "the pane is still written exactly once");
+        assertEquals(List.of("m1", "m1"), channel.acked(),
+                "a message already written to the pane must be acked even mid-turn: the mid-turn "
+                + "gate exists to protect the pane, and this message needs no pane. Gating the ack "
+                + "on it leaves the message held on a lead that is busy most of the time, and every "
+                + "recovery redelivers it again — which is the loop this fix exists to stop");
+        assertTrue(channel.peek().isEmpty(), "so it is no longer held");
+    }
+
     @Test
     void leavesTheMessageUnackedWhenTheLeadIsMidTurn() {
         var channel = new FakeLeadChannel(SELF).hold(new LeadMessage("m1", PEER, SELF, "hello"));

fleetd/src/test/java/dev/ltms/fleet/msg/LeadMailboxIsMissingQueueTest.java

@@ -0,0 +1,77 @@
+package dev.ltms.fleet.msg;
+
+import com.rabbitmq.client.ShutdownSignalException;
+import com.rabbitmq.client.impl.AMQImpl;
+import org.junit.jupiter.api.Test;
+
+import java.io.IOException;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #361 review round 2: a mutation that made {@link LeadMailbox#isMissingQueue} return
+ * {@code true} unconditionally still left {@code mvn clean install} green — 1389 tests, 0
+ * failures — because nothing exercised its false branch. That branch is the whole discriminator
+ * between {@link LeadChannel.MailboxState#absent} and {@link LeadChannel.MailboxState#unknown};
+ * without a test pinning it, a future refactor that widens it back to "always true" (restoring the
+ * exact overstatement fleetd #361 exists to fix) would pass this suite.
+ *
+ * <p>Hermetic — no broker needed, per the review's own suggestion. {@code isMissingQueue} takes a
+ * plain {@link IOException}, so every input here is constructed directly rather than provoked from
+ * a live connection. The real 404 shape itself is still pinned against a real broker, in
+ * {@code LeadMailboxTest.passiveDeclareOfAMissingQueueThrowsAnIOExceptionWrappingA404ShutdownSignal}
+ * — this class covers the three false shapes {@link LeadMailbox#isMissingQueue}'s own javadoc
+ * lists, so both directions of the discriminator are proven somewhere.
+ */
+class LeadMailboxIsMissingQueueTest {
+
+    @Test
+    void aConfirmedMissingQueueIsRecognized() {
+        ShutdownSignalException sse = new ShutdownSignalException(true, false,
+                new AMQImpl.Channel.Close(404, "NOT_FOUND - no queue 'lead.x.inbox' in vhost '/'", 50, 10), null);
+        IOException e = new IOException("channel error", sse);
+
+        assertTrue(LeadMailbox.isMissingQueue(e), "a genuine 404 Channel.Close must be recognized as a missing queue");
+    }
+
+    @Test
+    void aDifferentReplyCodeIsNotAMissingQueue() {
+        // E.g. 403 ACCESS_REFUSED — the queue may well exist; this call was simply refused.
+        ShutdownSignalException sse = new ShutdownSignalException(true, false,
+                new AMQImpl.Channel.Close(403, "ACCESS_REFUSED", 50, 10), null);
+        IOException e = new IOException("channel error", sse);
+
+        assertFalse(LeadMailbox.isMissingQueue(e),
+                "a non-404 reply code must never be read as a confirmed absence — the mailbox's real state is unknown");
+    }
+
+    @Test
+    void aShutdownSignalWhoseReasonIsNotAChannelCloseIsNotAMissingQueue() {
+        // A Connection.Close (a whole different broker-level shutdown) is still a ShutdownSignalException,
+        // but its reason is not a Channel.Close at all — must not be misread as "no such queue".
+        ShutdownSignalException sse = new ShutdownSignalException(true, false,
+                new AMQImpl.Connection.Close(404, "coincidentally 404, but this is a CONNECTION close", 10, 50), null);
+        IOException e = new IOException("connection error", sse);
+
+        assertFalse(LeadMailbox.isMissingQueue(e),
+                "a ShutdownSignalException whose reason is not a Channel.Close must never be read as a missing queue,"
+                        + " even if its reply code happens to be 404");
+    }
+
+    @Test
+    void anIOExceptionWithNoCauseAtAllIsNotAMissingQueue() {
+        IOException e = new IOException("some other declare failure, no cause attached");
+
+        assertFalse(LeadMailbox.isMissingQueue(e),
+                "an IOException with no ShutdownSignalException cause must never be read as a confirmed absence");
+    }
+
+    @Test
+    void anIOExceptionWithAnUnrelatedCauseIsNotAMissingQueue() {
+        IOException e = new IOException("wrapped something else entirely", new RuntimeException("boom"));
+
+        assertFalse(LeadMailbox.isMissingQueue(e),
+                "a cause that isn't even a ShutdownSignalException must never be read as a confirmed absence");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/msg/LeadMailboxTest.java

@@ -1,5 +1,9 @@
 package dev.ltms.fleet.msg;
 
+import com.rabbitmq.client.AMQP;
+import com.rabbitmq.client.Channel;
+import com.rabbitmq.client.Connection;
+import com.rabbitmq.client.ShutdownSignalException;
 import org.junit.jupiter.api.BeforeAll;
 import org.junit.jupiter.api.Tag;
 import org.junit.jupiter.api.Test;
@@ -7,11 +11,14 @@ import org.testcontainers.containers.RabbitMQContainer;
 import org.testcontainers.junit.jupiter.Testcontainers;
 import org.testcontainers.utility.DockerImageName;
 
+import java.io.IOException;
 import java.util.List;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
 import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
@@ -85,6 +92,33 @@ class LeadMailboxTest {
         }
     }
 
+    @Test
+    void ackThrowsWhenRecoveryClearedTheHeldMessage() throws Exception {
+        String to = coordId("lead-recovery-ack");
+        try (LeadMailbox inbox = LeadMailbox.open(uri(), to)) {
+            inbox.publish(to, new LeadMessage("recovery-ack", "lead-from", to, "in flight"));
+            assertEquals(1, awaitPeek(inbox).size(), "the broker delivery must be held before recovery clears it");
+
+            inbox.clearHeldForRecovery();
+
+            assertThrows(IllegalStateException.class, () -> inbox.ack("recovery-ack"),
+                    "a cleared delivery has no valid tag, so ack must report that it did not reach the broker");
+        }
+    }
+
+    @Test
+    void ackOfAMessageAlreadyAckedOnThisConnectionStaysQuiet() throws Exception {
+        String to = coordId("lead-repeat-ack");
+        try (LeadMailbox inbox = LeadMailbox.open(uri(), to)) {
+            inbox.publish(to, new LeadMessage("repeat-ack", "lead-from", to, "once"));
+            awaitPeek(inbox);
+
+            inbox.ack("repeat-ack");
+
+            inbox.ack("repeat-ack");
+        }
+    }
+
     @Test
     void duplicateMsgIdIsNotDoubleQueued() throws Exception {
         String to = coordId("lead-dedup");
@@ -159,6 +193,160 @@ class LeadMailboxTest {
         }
     }
 
+    @Test
+    void inspectReportsAnOwnedMailboxAsExistingWithItsOwnConsumer() throws Exception {
+        // A LeadMailbox declares AND consumes its own queue the moment open() returns (see own()),
+        // so inspecting a coord-id this same process owns must always find exactly one consumer.
+        String self = coordId("lead-inspect-self");
+        try (LeadMailbox mailbox = LeadMailbox.open(uri(), self)) {
+            LeadChannel.MailboxState state = mailbox.inspect(self);
+            assertEquals(self, state.coordId());
+            assertTrue(state.exists(), "this daemon owns and has declared this exact queue");
+            assertEquals(0, state.pending(), "nothing has been published to it yet");
+            assertEquals(1, state.consumers(), "the mailbox's own constructor already attached a consumer");
+        }
+    }
+
+    /**
+     * fleetd #440: {@code heldDurable()} must be derived from what {@link LeadMailbox#own} actually
+     * did against the real broker — a durable queue declare plus a manual-ack consumer — not a
+     * hardcoded literal. This is the mutation-sensitive test: flip {@code own()}'s {@code autoAck}
+     * local to {@code true} (or its {@code durableQueue} local to {@code false}) and this must fail.
+     */
+    @Test
+    void heldDurableReportsTrueBecauseTheQueueIsDurableAndTheConsumeIsManualAck() throws Exception {
+        String self = coordId("lead-held-durable");
+        try (LeadMailbox mailbox = LeadMailbox.open(uri(), self)) {
+            assertTrue(mailbox.heldDurable(),
+                    "own() declares a durable queue and consumes with autoAck=false, so held mail is durable");
+        }
+    }
+
+    @Test
+    void inspectReportsAMissingMailboxAsAbsentRatherThanThrowing() throws Exception {
+        String nobody = coordId("lead-inspect-nobody");
+        try (LeadMailbox mailbox = LeadMailbox.open(uri(), coordId("lead-inspect-caller"))) {
+            LeadChannel.MailboxState state = mailbox.inspect(nobody);
+            assertEquals(LeadChannel.MailboxState.absent(nobody), state,
+                    "a queue nobody has ever declared must report absent, never throw");
+            assertTrue(state.known(), "a confirmed 404 IS a definite answer — this is not the unknown case");
+        }
+    }
+
+    /**
+     * fleetd #361 review finding 3: {@code inspect} is specified to never throw, but the original
+     * implementation caught only {@link IOException} — and {@link Connection#createChannel()} on an
+     * already-closed connection throws {@link com.rabbitmq.client.AlreadyClosedException}, an
+     * unchecked {@link RuntimeException} (pinned by {@code
+     * createChannelOnAnAlreadyClosedConnectionThrowsAnUncheckedException} above). This drives that
+     * exact scenario through the real {@link LeadMailbox#inspect} — not the raw client call — and
+     * checks both halves of finding 1 and finding 3 at once: no exception escapes, and the result is
+     * {@code UNKNOWN} rather than the wrong-but-plausible-looking {@code ABSENT}.
+     */
+    @Test
+    void inspectReportsUnknownRatherThanThrowingWhenTheConnectionIsAlreadyClosed() throws Exception {
+        LeadMailbox mailbox = LeadMailbox.open(uri(), coordId("lead-inspect-dead-connection"));
+        mailbox.close(); // tears down the connection `inspect` will try to open a probe channel on
+
+        LeadChannel.MailboxState state = mailbox.inspect(coordId("lead-inspect-irrelevant-target"));
+
+        assertFalse(state.exists());
+        assertFalse(state.known(), "a dead connection proves nothing about the target mailbox — it must be unknown, not absent");
+        assertEquals(LeadChannel.MailboxState.Presence.UNKNOWN, state.presence());
+    }
+
+    @Test
+    void inspectReportsPendingMessagesAndZeroConsumersWhenNobodyIsReadingAnymore() throws Exception {
+        // Publish into a mailbox this test owns, then never consume from it, to prove `pending` and
+        // `consumers` really come off the broker rather than off this process's own in-memory state.
+        String to = coordId("lead-inspect-pending");
+        String observerId = coordId("lead-inspect-observer");
+        try (LeadMailbox owner = LeadMailbox.open(uri(), to);
+             LeadMailbox observer = LeadMailbox.open(uri(), observerId)) {
+            owner.publish(to, new LeadMessage("m1", "lead-from", to, "sitting in the queue"));
+            awaitPeek(owner); // make sure the broker has actually enqueued it before inspecting
+        } // `owner` closes here: its consumer disconnects, but the durable, unacked message stays queued.
+
+        try (LeadMailbox observer = LeadMailbox.open(uri(), coordId("lead-inspect-observer-2"))) {
+            // The broker requeues `owner`'s unacked delivery asynchronously once its connection drops,
+            // so poll rather than assume the very first passive declare already sees the settled state.
+            LeadChannel.MailboxState state = awaitInspect(observer, to, s -> s.consumers() == 0);
+            assertTrue(state.exists());
+            assertEquals(0, state.consumers(), "the only owner just closed — nobody is reading this anymore");
+            assertEquals(1, state.pending(), "the unacked message must be requeued, never dropped");
+        }
+    }
+
+    /**
+     * fleetd #361's central invariant, proved rather than assumed: a passive queue declare of a
+     * missing queue closes ITS channel with a 404 in AMQP 0-9-1. {@link LeadMailbox#inspect} is
+     * specified to run on its own disposable channel for exactly this reason — this test is the one
+     * that actually exercises the failure mode and shows {@link LeadMailbox#publish} on the SAME
+     * instance is unaffected by it.
+     */
+    @Test
+    void inspectingAMissingMailboxNeverBreaksPublishOnTheSameInstance() throws Exception {
+        String self = coordId("lead-invariant-self");
+        try (LeadMailbox mailbox = LeadMailbox.open(uri(), self)) {
+            // Miss on a queue that has never existed — this is exactly the 404-closes-the-channel case.
+            LeadChannel.MailboxState missed = mailbox.inspect(coordId("lead-invariant-nobody-home"));
+            assertFalse(missed.exists());
+            assertTrue(missed.known(), "a genuine 404 on a queue that never existed is a confirmed fact, not an unknown");
+
+            // publish() must still work on THIS SAME instance: if inspect() had reused `publishChannel`
+            // (or `channel`), the broker's 404 would have closed it out from underneath publish().
+            LeadMessage sent = new LeadMessage("after-miss", "lead-from", self, "still alive");
+            mailbox.publish(self, sent);
+            List<LeadMessage> got = awaitPeek(mailbox);
+            assertEquals(1, got.size(), "publish must still reach this mailbox's own queue after a missed inspect");
+            assertEquals("after-miss", got.getFirst().msgId());
+
+            // And a second inspect() — of a mailbox that DOES exist this time — must also still work,
+            // proving the miss did not wedge inspect() itself either.
+            LeadChannel.MailboxState self2 = mailbox.inspect(self);
+            assertTrue(self2.exists());
+        }
+    }
+
+    /**
+     * Pins the exact exception shape {@link LeadMailbox#inspect} relies on to tell a genuine 404
+     * (mailbox confirmed absent) apart from everything else (mailbox state unknown) — measured
+     * against a real broker rather than assumed from the AMQP 0-9-1 spec text. If this ever fails,
+     * the classification in {@code inspect} is reading the wrong shape and must be revisited.
+     */
+    @Test
+    void passiveDeclareOfAMissingQueueThrowsAnIOExceptionWrappingA404ShutdownSignal() throws Exception {
+        try (Connection conn = LeadMailbox.connectionFactory(uri()).newConnection()) {
+            Channel probe = conn.createChannel();
+            String missing = LeadMailbox.queueName(coordId("lead-404-shape"));
+            IOException thrown = assertThrows(IOException.class, () -> probe.queueDeclarePassive(missing));
+            assertInstanceOf(ShutdownSignalException.class, thrown.getCause(),
+                    () -> "expected the IOException to wrap a ShutdownSignalException, got: " + thrown);
+            ShutdownSignalException sse = (ShutdownSignalException) thrown.getCause();
+            assertInstanceOf(AMQP.Channel.Close.class, sse.getReason(),
+                    () -> "expected a Channel.Close reason: " + sse);
+            AMQP.Channel.Close close = (AMQP.Channel.Close) sse.getReason();
+            assertEquals(404, close.getReplyCode(), () -> "expected AMQP NOT_FOUND (404): " + close);
+            assertFalse(probe.isOpen(), "the 404 must have closed the channel the declare ran on");
+        }
+    }
+
+    /**
+     * The other half of the same measurement: calling {@code createChannel()} on an
+     * already-closed connection — the shape {@link LeadMailbox#inspect} hits when the broker
+     * connection itself is gone — throws {@link com.rabbitmq.client.AlreadyClosedException}, an
+     * unchecked {@link RuntimeException}, not an {@link IOException}. An {@code inspect} that only
+     * caught {@code IOException} here would let this escape instead of reporting "unknown".
+     */
+    @Test
+    void createChannelOnAnAlreadyClosedConnectionThrowsAnUncheckedException() throws Exception {
+        Connection conn = LeadMailbox.connectionFactory(uri()).newConnection();
+        conn.close();
+        RuntimeException thrown = assertThrows(RuntimeException.class, conn::createChannel);
+        assertInstanceOf(com.rabbitmq.client.AlreadyClosedException.class, thrown,
+                () -> "expected AlreadyClosedException, got: " + thrown);
+    }
+
     /** Poll peek until at least one message is held, or ~10s elapse (broker delivery is async). */
     @SuppressWarnings("BusyWait")
     private static List<LeadMessage> awaitPeek(LeadMailbox inbox) throws InterruptedException {
@@ -170,4 +358,18 @@ class LeadMailboxTest {
         }
         return msgs;
     }
+
+    /** Poll inspect(coordId) until it satisfies {@code done}, or ~10s elapse (broker state settles async). */
+    @SuppressWarnings("BusyWait")
+    private static LeadChannel.MailboxState awaitInspect(
+            LeadMailbox observer, String coordId, java.util.function.Predicate<LeadChannel.MailboxState> done)
+            throws InterruptedException {
+        long deadline = System.nanoTime() + TimeUnit.SECONDS.toNanos(10);
+        LeadChannel.MailboxState state = observer.inspect(coordId);
+        while (!done.test(state) && System.nanoTime() < deadline) {
+            Thread.sleep(50);
+            state = observer.inspect(coordId);
+        }
+        return state;
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/msg/MessageServiceTest.java

@@ -479,7 +479,8 @@ class MessageServiceTest {
 
             // The worker resumes on its own (per the ask() contract) and eventually sends its real
             // fleet_reply; the async ticket must still resolve with it, not strand at PENDING.
-            assertTrue(messages.reply(T, "real result"), "the worker's real reply must still be accepted");
+            assertEquals(MessageService.ReplyOutcome.RESOLVED_ASYNC_TICKET, messages.reply(T, "real result"),
+                    "the worker's real reply must still be accepted, resolving the parked async ticket");
         } finally {
             messages.setAskTimeoutRaceHookForTest(null);
         }
@@ -767,7 +768,9 @@ class MessageServiceTest {
     @Test
     void replyQueuesInInboxWhenNoSendIsOpen() {
         // No send is open for this session — reply should queue in the inbox.
-        assertTrue(messages.reply(T, "queued-text"), "reply should succeed (queued)");
+        // fleetd #365: this is the case that must read as QUEUED, not "delivered".
+        assertEquals(MessageService.ReplyOutcome.QUEUED, messages.reply(T, "queued-text"),
+                "reply should succeed but only as queued — nothing was waiting for it");
 
         var drained = messages.drainReplies(T);
         assertEquals(1, drained.size());
@@ -780,7 +783,9 @@ class MessageServiceTest {
         awaitUninterruptibly(T);
 
         // An explicit reply resolves the open send.
-        assertTrue(messages.reply(T, "send-resolved"), "reply should succeed (resolved live send)");
+        // fleetd #365: this is the other case — RESOLVED_SEND, distinct from QUEUED above.
+        assertEquals(MessageService.ReplyOutcome.RESOLVED_SEND, messages.reply(T, "send-resolved"),
+                "reply should succeed by resolving the live waiting send");
 
         // The inbox should be empty — the reply went to the send, not the inbox.
         assertTrue(messages.drainReplies(T).isEmpty(), "no reply in the inbox");
@@ -1094,8 +1099,11 @@ class MessageServiceTest {
         assertEquals(MessageService.Outcome.TIMED_OUT_WORKING, answerReply.outcome(),
                 "the primary's own bounded wait gives up before the worker finishes resuming");
 
-        // The worker keeps working past that window and only now calls fleet_reply.
-        assertTrue(messages.reply(T, "PR opened: https://example/pulls/42"));
+        // The worker keeps working past that window and only now calls fleet_reply. The forward
+        // waiter answer() opened already timed out, so this resolves via the parked async ticket,
+        // not a live send (fleetd #365).
+        assertEquals(MessageService.ReplyOutcome.RESOLVED_ASYNC_TICKET,
+                messages.reply(T, "PR opened: https://example/pulls/42"));
 
         MessageService.TaskView done = awaitTicketPhase(ticket, MessageService.Phase.DONE);
         assertEquals("PR opened: https://example/pulls/42", done.reply(),
@@ -1119,7 +1127,10 @@ class MessageServiceTest {
         assertEquals("config.yaml", ask.get(5, TimeUnit.SECONDS).answer());
         assertEquals(MessageService.Outcome.TIMED_OUT_WORKING, answerReply.outcome());
 
-        assertTrue(messages.reply(T, "PR opened: https://example/pulls/42"));
+        // No live waiter (answer()'s own forward wait already timed out) — resolves the parked
+        // async ticket instead (fleetd #365).
+        assertEquals(MessageService.ReplyOutcome.RESOLVED_ASYNC_TICKET,
+                messages.reply(T, "PR opened: https://example/pulls/42"));
 
         // fleet_stop tears the worker's session down right after the reply landed — this must never
         // report the misleading "the worker session was released before it replied": a reply is
@@ -1170,7 +1181,9 @@ class MessageServiceTest {
         assertEquals("config.yaml", ask.get(5, TimeUnit.SECONDS).answer());
         awaitWaiting(); // answer() opened its own forward waiter for the resumed worker turn
 
-        assertTrue(messages.reply(T, "PR opened: https://example/pulls/42"));
+        // A live waiter is open (the forward wait above) — this resolves it directly (fleetd #365).
+        assertEquals(MessageService.ReplyOutcome.RESOLVED_SEND,
+                messages.reply(T, "PR opened: https://example/pulls/42"));
 
         assertEquals(MessageService.Outcome.REPLIED, answer.get(5, TimeUnit.SECONDS).outcome(),
                 "the lead's own answer() call must not throw because ask()'s timeout cleanup raced it");
@@ -1221,8 +1234,9 @@ class MessageServiceTest {
 
         // The worker keeps working past the timeout and only now calls fleet_reply — with no live
         // rendezvous waiter open (ask()'s timeout already closed it) and no new send() having
-        // reopened one for this target.
-        assertTrue(messages.reply(T, "PR opened: https://example/pulls/42"));
+        // reopened one for this target. So it resolves the parked async ticket (fleetd #365).
+        assertEquals(MessageService.ReplyOutcome.RESOLVED_ASYNC_TICKET,
+                messages.reply(T, "PR opened: https://example/pulls/42"));
 
         MessageService.TaskView done = awaitTicketPhase(ticket, MessageService.Phase.DONE);
         assertEquals("PR opened: https://example/pulls/42", done.reply(),
@@ -1279,7 +1293,10 @@ class MessageServiceTest {
         // real reply — reproduce that interleaving directly instead of trying to win a real race.
         messages.forgetTurnForTest(turnId);
 
-        assertTrue(messages.reply(T, "PR opened: https://example/pulls/42"));
+        // answer() is still waiting on its own forward waiter for the resumed turn — a live send —
+        // so this resolves it directly, not the async ticket (fleetd #365).
+        assertEquals(MessageService.ReplyOutcome.RESOLVED_SEND,
+                messages.reply(T, "PR opened: https://example/pulls/42"));
 
         assertEquals(MessageService.Outcome.REPLIED, answer.get(5, TimeUnit.SECONDS).outcome(),
                 "the primary's own answer() call must still see the worker's real reply");
@@ -1321,7 +1338,9 @@ class MessageServiceTest {
 
         messages.setReplyOrphanTurnIdRaceHookForTest(() -> messages.forgetTurnForTest(turnId));
         try {
-            assertTrue(messages.reply(T, "PR opened: https://example/pulls/42"));
+            // No live waiter — resolves the parked async ticket (fleetd #365).
+            assertEquals(MessageService.ReplyOutcome.RESOLVED_ASYNC_TICKET,
+                    messages.reply(T, "PR opened: https://example/pulls/42"));
 
             MessageService.TaskView done = awaitTicketPhase(ticket, MessageService.Phase.DONE);
             assertEquals("PR opened: https://example/pulls/42", done.reply(),
@@ -1353,7 +1372,8 @@ class MessageServiceTest {
         injectDelivery();
         assertEquals(MessageService.AskOutcome.TIMED_OUT, messages.ask(T, "Q2?", 200).outcome());
 
-        assertTrue(messages.reply(T, "which task does this answer?"));
+        // Ambiguous — two candidates, so it must fall back to the inbox rather than guess (fleetd #365).
+        assertEquals(MessageService.ReplyOutcome.QUEUED, messages.reply(T, "which task does this answer?"));
 
         assertEquals(MessageService.Phase.PENDING, messages.poll(ticket1).phase(),
                 "an ambiguous reply must not guess ticket1");
@@ -1782,7 +1802,11 @@ class MessageServiceTest {
             Thread asker = new Thread(() -> assertThrows(IllegalStateException.class,
                     () -> service.ask(T, "which config file?", 30_000)));
             asker.start();
-            awaitTicketPhaseOn(service, ticket, MessageService.Phase.ASKING);
+            // Phase.ASKING (markAsyncQuestion) is only the FIRST of ask()'s three steps; the assertion
+            // below depends on the THIRD (pushLoop.onQuestionOpened). Barrier on the push loop's own
+            // pending-question state instead of the phase — see ReplyPushLoop#pendingQuestionTurnIdsForTest.
+            MessageService.TaskView asking = awaitTicketPhaseOn(service, ticket, MessageService.Phase.ASKING);
+            awaitQuestionPendingOn(pushLoop, LEAD, asking.turnId());
             assertEquals(ReplyPushLoop.Action.INJECT, pushLoop.decide(LEAD, 0, 0, 0),
                     "the open question should be the one thing keeping this lead's schedule alive");
 
@@ -1897,6 +1921,12 @@ class MessageServiceTest {
             // Only now does it reply. Under the old clock this reply was born already expired.
             assertTrue(rendezvous.resolve(T, "the long report"));
             awaitTicketPhaseOn(wiring.service(), slow, MessageService.Phase.DONE);
+            // #399: same barrier fix as the sibling eviction test, for consistency — this test's
+            // own assertion happens to survive a late stamp today (the clock is not advanced any
+            // further between here and the sweep below, so cutoff cannot move past whichever
+            // value completedNanos ends up stamped with), but DONE is still the wrong thing to
+            // order on before a sweep that matters for the TTL.
+            awaitCompletionStamped(wiring.service(), slow);
 
             // A second delegation runs pruneTerminalTickets before it returns.
             wiring.service().sendAsync(T, "an unrelated second task");
@@ -1926,6 +1956,11 @@ class MessageServiceTest {
             injectDelivery();
             assertTrue(rendezvous.resolve(T, "quick result"));
             awaitTicketPhaseOn(wiring.service(), done, MessageService.Phase.DONE);
+            // #399: DONE can be observed before the completion hook stamps completedNanos. Wait
+            // for the real stamp before advancing the clock, or the hook can run late and stamp
+            // the ADVANCED time — making cutoff = advanced - TTL unreachable and hiding the very
+            // eviction this test exists to pin.
+            awaitCompletionStamped(wiring.service(), done);
 
             // Nobody collected it, and the TTL has now passed since it FINISHED.
             clock.addAndGet(MessageService.TICKET_TTL_NANOS + TimeUnit.SECONDS.toNanos(1));
@@ -1936,6 +1971,80 @@ class MessageServiceTest {
         }
     }
 
+    /**
+     * fleetd #409: pins the #399 ordering invariant deterministically, on the first run, without
+     * relying on host load.
+     *
+     * <p>fleetd #399 was itself only reproducible probabilistically: the real race window between
+     * {@code CompletableFuture.complete()} making {@link MessageService.Phase#DONE} observable and
+     * the constructor's {@code whenComplete} hook actually stamping {@code completedNanos} (see
+     * {@link MessageService#isCompletionStampedForTest}) is normally a handful of instructions wide,
+     * and needed heavy background load on the host to show up in a run at all. This test does not
+     * try to hit that narrow window by chance — it widens it on purpose: {@link #STAMP_DELAY_MILLIS}
+     * is injected into the clock itself, so the completion hook's one read of {@code nowNanos} for
+     * this ticket sleeps before returning, and everything the test does in the meantime (advance the
+     * clock, run a sweep, assert) happens for certain inside that window, on any host.
+     *
+     * <p>Removing the {@link #awaitCompletionStamped} call below reproduces the pre-#399 ordering:
+     * the test then advances the clock and runs its sweep while the hook is still asleep, so the
+     * hook wakes up and stamps {@code completedNanos} with the clock's ALREADY-ADVANCED value
+     * instead of the real completion time. {@code cutoff = advanced - TICKET_TTL_NANOS} can then
+     * never exceed that stamp (the gap between them is fixed at exactly {@code TICKET_TTL_NANOS}),
+     * so the sweep that already ran never evicts the ticket and the very next assertion — expecting
+     * eviction — fails immediately. That is a deterministic, first-run RED failure, not a flaky one
+     * and not a false pass: I ran the test with the barrier call removed and confirmed
+     * {@code assertNull} fails because {@code poll} still returns the ticket's DONE view, which is
+     * exactly this masked-eviction mechanism and not some unrelated defect in the test's own wiring.
+     */
+    @Test
+    void aTicketOrderedOnDoneInsteadOfTheCompletionStampSurvivesAnEvictionItMustNotSurvive() throws Exception {
+        java.util.concurrent.atomic.AtomicLong clock = new java.util.concurrent.atomic.AtomicLong(1_000_000_000L);
+        // Armed for exactly one call: MessageService's only three nowNanos() call sites are the Task
+        // constructor's createdNanos, this constructor's whenComplete hook's completedNanos, and
+        // pruneTerminalTickets' cutoff — none of which run between arming this (right before
+        // triggering the reply below) and the completion hook firing, so the delayed call is
+        // unambiguously that hook's stamp for `ticket`, never a createdNanos or cutoff read.
+        java.util.concurrent.atomic.AtomicBoolean delayArmed = new java.util.concurrent.atomic.AtomicBoolean(false);
+        java.util.function.LongSupplier gatedClock = () -> {
+            if (delayArmed.compareAndSet(true, false)) {
+                try {
+                    Thread.sleep(STAMP_DELAY_MILLIS);
+                } catch (InterruptedException e) {
+                    Thread.currentThread().interrupt();
+                }
+            }
+            return clock.get();
+        };
+        MessageService service = new MessageService(agents, injector, rendezvous, inbox, null, null, gatedClock);
+        try {
+            String ticket = service.sendAsync(T, "a quick task");
+            awaitWaiting();
+            injectDelivery();
+
+            delayArmed.set(true);
+            assertTrue(rendezvous.resolve(T, "quick result"));
+
+            awaitTicketPhaseOn(service, ticket, MessageService.Phase.DONE);
+            // The barrier under test (fleetd #409, same fix as fleetd #399): remove this one call to
+            // reproduce the pre-#399 ordering — see the class-level note above for what happens then.
+            awaitCompletionStamped(service, ticket);
+
+            // A real clock would need the whole TTL to pass; the injected one does it instantly, and
+            // by now completedNanos already holds the REAL (small, unadvanced) completion time.
+            clock.addAndGet(MessageService.TICKET_TTL_NANOS + TimeUnit.SECONDS.toNanos(1));
+            service.sendAsync(T, "an unrelated second task"); // runs pruneTerminalTickets before returning
+
+            assertNull(service.poll(ticket),
+                    "a ticket whose real completion time is long past the advanced cutoff must be "
+                            + "evicted, whatever the completion hook's clock read was delayed by");
+        } finally {
+            service.close();
+        }
+    }
+
+    /** Bounded delay the injected clock sleeps for in {@link #aTicketOrderedOnDoneInsteadOfTheCompletionStampSurvivesAnEvictionItMustNotSurvive}. */
+    private static final long STAMP_DELAY_MILLIS = 300;
+
     private MessageService.TaskView awaitTicketPhaseOn(MessageService svc, String ticket,
             MessageService.Phase phase) throws Exception {
         long deadline = System.currentTimeMillis() + 3000;
@@ -1970,6 +2079,45 @@ class MessageServiceTest {
         return view;
     }
 
+    /**
+     * fleetd #399: waits until {@code ticket}'s completion hook has actually stamped
+     * {@code completedNanos}, not just until {@link MessageService#poll} reports
+     * {@link MessageService.Phase#DONE} for it. {@code poll} can observe {@code DONE} the instant
+     * the task's future resolves, before the {@code whenComplete} hook that stamps the completion
+     * time has run — {@code CompletableFuture.complete()} publishes its result and only then runs
+     * dependents. A test that is about to advance an injected clock past the TTL must order itself
+     * after the stamp, not after {@code DONE}: winning the race the other way stamps the
+     * *advanced* clock value and can hide a real eviction bug behind a false pass.
+     */
+    private void awaitCompletionStamped(MessageService svc, String ticket) throws Exception {
+        long deadline = System.currentTimeMillis() + 3000;
+        while (!svc.isCompletionStampedForTest(ticket)) {
+            assertTrue(System.currentTimeMillis() < deadline,
+                    "completedNanos for " + ticket + " was never stamped");
+            Thread.sleep(5);
+        }
+    }
+
+    /**
+     * fleetd #418: waits until {@code turnId} actually appears in {@code pushLoop}'s own open-question
+     * state for {@code lead} — {@link ReplyPushLoop#pendingQuestionTurnIdsForTest} — rather than until
+     * {@link MessageService#poll} reports {@link MessageService.Phase#ASKING}. {@code Phase.ASKING} is
+     * set by {@code markAsyncQuestion}, the FIRST of three steps {@code MessageService.ask()} performs;
+     * {@code pushLoop.onQuestionOpened} (the one that actually publishes to {@code pendingQuestions})
+     * is the THIRD. Under load the asker thread can be descheduled between those two steps, so a
+     * barrier on the phase alone can release before the push loop has anything pending — a test that
+     * then asserts on {@link ReplyPushLoop#decide} is asserting on state that has not been published
+     * yet, not on the throwing path it is named for.
+     */
+    private void awaitQuestionPendingOn(ReplyPushLoop pushLoop, String lead, String turnId) throws Exception {
+        long deadline = System.currentTimeMillis() + 3000;
+        while (!pushLoop.pendingQuestionTurnIdsForTest(lead).contains(turnId)) {
+            assertTrue(System.currentTimeMillis() < deadline,
+                    "turnId " + turnId + " never appeared in the push loop's pending questions for " + lead);
+            Thread.sleep(5);
+        }
+    }
+
     // --- CB-640: fleet health evidence accessors --------------------------------------------
 
     @Test
@@ -2032,7 +2180,7 @@ class MessageServiceTest {
         CompletableFuture<MessageService.Reply> send = sendAsync();
         awaitWaiting();
 
-        assertTrue(messages.reply(T, "resolved-live"));
+        assertEquals(MessageService.ReplyOutcome.RESOLVED_SEND, messages.reply(T, "resolved-live"));
         assertFalse(messages.hasStrandedReply(T), "a reply that resolved an open send is not stranded");
 
         MessageService.Reply r = send.get(5, TimeUnit.SECONDS);
@@ -2042,14 +2190,14 @@ class MessageServiceTest {
     @Test
     void hasStrandedReplyIsTrueWhenNoSendWasWaiting() {
         // No send is open for T — the reply queues into the inbox and is recorded as stranded.
-        assertTrue(messages.reply(T, "nobody was waiting"));
+        assertEquals(MessageService.ReplyOutcome.QUEUED, messages.reply(T, "nobody was waiting"));
         assertTrue(messages.hasStrandedReply(T),
                 "a reply with no open send strands, even though it is safely queued in the inbox");
     }
 
     @Test
     void hasStrandedReplyClearsOnceTheTargetsNextDeliveryIsAccepted() throws Exception {
-        assertTrue(messages.reply(T, "stray"));
+        assertEquals(MessageService.ReplyOutcome.QUEUED, messages.reply(T, "stray"));
         assertTrue(messages.hasStrandedReply(T));
 
         // The next accepted delivery for T clears the stale stranding fact — the one case the
@@ -2067,7 +2215,7 @@ class MessageServiceTest {
 
     @Test
     void hasStrandedReplyClearsOnAbandon() {
-        assertTrue(messages.reply(T, "stray"));
+        assertEquals(MessageService.ReplyOutcome.QUEUED, messages.reply(T, "stray"));
         assertTrue(messages.hasStrandedReply(T));
 
         messages.abandon(T, "session released");

fleetd/src/test/java/dev/ltms/fleet/msg/ReplyPushLoopTest.java

@@ -4,6 +4,7 @@ import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.herdr.HerdrException;
 import dev.ltms.fleet.mcp.PrimaryRegistry;
 import dev.ltms.fleet.metrics.FleetMetrics;
 import dev.ltms.fleet.metrics.Metrics;
@@ -44,6 +45,7 @@ class ReplyPushLoopTest {
     private static final String WORKER = "term_worker";
     private static final String WORKER2 = "term_worker2";
     private static final String OTHER_PRIMARY = "term_other_primary";
+    private static final String DEAD_LEAD = "term_dead_lead";
     private static final ObjectMapper MAPPER = new ObjectMapper();
 
     private PrimaryRegistry registry;
@@ -207,6 +209,101 @@ class ReplyPushLoopTest {
                 "exactly " + cap + " agent.prompt calls (cap=" + cap + ")");
     }
 
+    // --- fleetd #368: a lead's delegation binding must not outlive the lead ---------------------
+
+    /**
+     * The bug: {@code PrimaryRegistry.forgetDelegation} is wired to a worker's release, never to
+     * the delegating lead's own disappearance, so a lead that closed, crashed, or was relaunched
+     * leaves {@code leadByTarget} pointing at a terminal herdr no longer knows. Before the fix,
+     * {@code onReplyQueued} took that stale, non-null entry at face value — {@code nudgeTargetFor}
+     * only ever falls back to the pinned primary when the map holds nothing for the target — so
+     * the nudge's only schedule ran against the dead terminal forever and the live primary never
+     * heard about the reply through this path.
+     *
+     * <p>This drives {@link ReplyPushLoop#onReplyQueued(String)} itself (not {@code PrimaryRegistry}
+     * directly), because the registry lookup was never the defect — the caller trusting it without
+     * checking liveness was. A test that only asserted on {@code PrimaryRegistry.nudgeTargetFor}
+     * would pass whether or not {@code ReplyPushLoop} ever adopted the fix.
+     */
+    @Test
+    void aStaleLeadBindingFallsBackToTheLiveLeadInsteadOfNudgingADeadTerminal() throws Exception {
+        // PRIMARY is the single known (pinned) lead — set up in @BeforeEach via `registry`.
+        // DEAD_LEAD is a second lead that once delegated to WORKER and is now gone: herdr reports
+        // agent_not_found for it, exactly as it would for a closed/crashed/relaunched terminal.
+        registry.recordDelegation(WORKER, DEAD_LEAD);
+
+        var rec = new DeadLeadHerdrClient(DEAD_LEAD);
+        agents = new AgentControl(rec);
+        inbox.publish(WORKER, "m1", "hello");
+
+        loop(1, 50).onReplyQueued(WORKER);
+
+        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS),
+                "the nudge should still reach the live primary, not silently vanish with the dead lead");
+        assertEquals(List.of(PRIMARY), rec.promptTargets(),
+                "the nudge must be sent to the live primary, never to the dead lead's terminal");
+        assertEquals(PRIMARY, registry.nudgeTargetFor(WORKER).orElseThrow(),
+                "the stale binding must be forgotten (self-healed) once found dead, exactly like "
+                        + "AgentControl.paneByTerminal already does on agent_not_found");
+    }
+
+    /**
+     * Same dead binding, but with no pinned primary to fall back to (the multi-lead, no-fallback
+     * case {@code PrimaryRegistry.nudgeTargetFor}'s own javadoc already covers): the loop must
+     * never nudge the dead terminal, and must not spin — no schedule starts at all once the stale
+     * binding resolves to empty, same as if the map had never held an entry for this target.
+     */
+    @Test
+    void aStaleLeadBindingWithNoFallbackNeverNudgesTheDeadTerminal() throws Exception {
+        var unpinned = new PrimaryRegistry(null);
+        unpinned.recordDelegation(WORKER, DEAD_LEAD);
+
+        var rec = new DeadLeadHerdrClient(DEAD_LEAD);
+        agents = new AgentControl(rec);
+        inbox.publish(WORKER, "m1", "hello");
+
+        var loop = new ReplyPushLoop(unpinned, agents, inbox, scheduler, 1, 50);
+        loop.onReplyQueued(WORKER);
+
+        Thread.sleep(200);
+        assertEquals(0, rec.sendCount(), "no lead is live to nudge, so nothing should ever be sent");
+        assertTrue(unpinned.nudgeTargetFor(WORKER).isEmpty(),
+                "the stale binding must be forgotten even when there is no fallback to hand back");
+    }
+
+    /**
+     * fleetd #368 review, must-fix: the first version of {@code isLive} treated <em>any</em>
+     * {@code RuntimeException} from the liveness probe as "the lead is gone" — indistinguishable
+     * from a transient herdr hiccup (a socket blip, a decode error) on a lead that is actually
+     * still live. The consequence of that misdiagnosis is destructive and permanent
+     * ({@code forgetDelegation}), which is the exact #359 mistake repeated two days later: a single
+     * bad reading must never destroy a live binding. This pins the narrower rule — only an
+     * affirmative {@code agent_not_found} may forget a binding; a merely inconclusive failure must
+     * leave the binding alone, and the lead must still be nudged once the probe recovers.
+     */
+    @Test
+    void aTransientLivenessFailureMustNotForgetABindingToAStillLiveLead() throws Exception {
+        // OTHER_PRIMARY is delegated to and genuinely live — its FIRST agent.get call fails with a
+        // transient, non-agent_not_found HerdrException (a transport-level failure, code null,
+        // exactly what a socket blip looks like), then succeeds on every call after.
+        registry.recordDelegation(WORKER, OTHER_PRIMARY);
+
+        var rec = new FlakyThenLiveHerdrClient(OTHER_PRIMARY);
+        agents = new AgentControl(rec);
+        inbox.publish(WORKER, "m1", "hello");
+
+        loop(2, 50).onReplyQueued(WORKER);
+
+        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS),
+                "the nudge must still reach the live lead once the transient failure clears");
+        assertEquals(List.of(OTHER_PRIMARY), rec.promptTargets(),
+                "the nudge must go to the lead that was only transiently unreachable, not the "
+                        + "unrelated pinned primary");
+        assertEquals(OTHER_PRIMARY, registry.nudgeTargetFor(WORKER).orElseThrow(),
+                "a merely transient failure must not forget the binding to a lead that is actually "
+                        + "still live");
+    }
+
     // --- nudge format --------------------------------------------------------------------------
 
     @Test
@@ -887,7 +984,7 @@ class ReplyPushLoopTest {
     // --- metrics (CB-512) ----------------------------------------------------------------------
 
     @Test
-    void successfulNudgeIncrementsDelivered() throws Exception {
+    void successfulNudgeIncrementsSent() throws Exception {
         var rec = recordingClient();
         agents = new AgentControl(rec);
         inbox.publish(WORKER, "m1", "hello");
@@ -897,11 +994,13 @@ class ReplyPushLoopTest {
 
         assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS),
                 "one nudge (1 agent.prompt call) should have been sent");
-        // The delivered count is bumped on the scheduler thread right after the send that releases
+        // The sent count is bumped on the scheduler thread right after the send that releases
         // the latch — settle briefly so the counter is published before we read it.
         Thread.sleep(200);
-        assertEquals(1, metrics.count(FleetMetrics.PUSH_NUDGES, "outcome", "delivered"),
-                "a successfully sent nudge must count as delivered");
+        // fleetd #365: "sent", not "delivered" — this only proves the herdr call succeeded, not
+        // that the primary's pane read it.
+        assertEquals(1, metrics.count(FleetMetrics.PUSH_NUDGES, "outcome", "sent"),
+                "a successfully sent nudge must count as sent");
     }
 
     @Test
@@ -916,11 +1015,11 @@ class ReplyPushLoopTest {
 
         assertEquals(1, metrics.count(FleetMetrics.PUSH_NUDGES, "outcome", "exhausted"),
                 "hitting the reminder cap must count as exhausted");
-        assertEquals(0, metrics.count(FleetMetrics.PUSH_NUDGES, "outcome", "delivered"));
+        assertEquals(0, metrics.count(FleetMetrics.PUSH_NUDGES, "outcome", "sent"));
     }
 
     @Test
-    void successfulTicketNudgeIncrementsDelivered() throws Exception {
+    void successfulTicketNudgeIncrementsSent() throws Exception {
         var rec = recordingClient();
         agents = new AgentControl(rec);
         Metrics metrics = new Metrics();
@@ -929,8 +1028,8 @@ class ReplyPushLoopTest {
 
         assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS), "one ticket nudge should have been sent");
         Thread.sleep(200);
-        assertEquals(1, metrics.count(FleetMetrics.PUSH_NUDGES, "outcome", "delivered"),
-                "a successfully sent ticket nudge must count as delivered, same metric as CB-307");
+        assertEquals(1, metrics.count(FleetMetrics.PUSH_NUDGES, "outcome", "sent"),
+                "a successfully sent ticket nudge must count as sent, same metric as CB-307");
     }
 
     @Test
@@ -1098,4 +1197,101 @@ class ReplyPushLoopTest {
         public void close() {
         }
     }
+
+    /**
+     * Fake herdr client for fleetd #368: {@code deadTarget} is a terminal herdr genuinely no
+     * longer knows about — {@code agent.get} fails with {@code agent_not_found} exactly as
+     * {@code AgentControl.agentCall} expects for a real dead/closed pane (see its javadoc). Every
+     * other target reports {@code idle} (injectable). Records the {@code target} named by every
+     * {@code agent.prompt} call, so a test can prove which terminal actually got nudged.
+     */
+    private static final class DeadLeadHerdrClient implements HerdrClient {
+        private final String deadTarget;
+        private final List<String> promptTargets = Collections.synchronizedList(new ArrayList<>());
+        volatile CountDownLatch sendLatch = new CountDownLatch(1);
+
+        DeadLeadHerdrClient(String deadTarget) {
+            this.deadTarget = deadTarget;
+        }
+
+        @Override
+        @SuppressWarnings("unchecked")
+        public JsonNode call(String method, Object params) {
+            Map<String, Object> p = params instanceof Map ? (Map<String, Object>) params : Map.of();
+            if ("agent.get".equals(method)) {
+                String target = String.valueOf(p.get("target"));
+                if (deadTarget.equals(target)) {
+                    throw new HerdrException("no such agent: " + target, "agent_not_found", null);
+                }
+                return MAPPER.createObjectNode()
+                        .set("agent", MAPPER.createObjectNode()
+                                .put("terminal_id", target)
+                                .put("agent_status", "idle"));
+            }
+            if ("agent.prompt".equals(method)) {
+                promptTargets.add(String.valueOf(p.get("target")));
+                sendLatch.countDown();
+            }
+            return MAPPER.createObjectNode();
+        }
+
+        List<String> promptTargets() {
+            return List.copyOf(promptTargets);
+        }
+
+        long sendCount() {
+            return promptTargets.size();
+        }
+
+        @Override
+        public void close() {
+        }
+    }
+
+    /**
+     * Fake herdr client for fleetd #368 review: {@code flakyTarget}'s FIRST {@code agent.get} call
+     * fails with a transient, non-{@code agent_not_found} {@code HerdrException} — a transport-level
+     * failure (code {@code null}), exactly what a socket blip or a decode error on a perfectly live
+     * lead looks like — then succeeds ({@code idle}) on every call after. Used to prove a merely
+     * inconclusive failure must not be treated as the lead being gone.
+     */
+    private static final class FlakyThenLiveHerdrClient implements HerdrClient {
+        private final String flakyTarget;
+        private final AtomicInteger getCalls = new AtomicInteger();
+        private final List<String> promptTargets = Collections.synchronizedList(new ArrayList<>());
+        volatile CountDownLatch sendLatch = new CountDownLatch(1);
+
+        FlakyThenLiveHerdrClient(String flakyTarget) {
+            this.flakyTarget = flakyTarget;
+        }
+
+        @Override
+        @SuppressWarnings("unchecked")
+        public JsonNode call(String method, Object params) {
+            Map<String, Object> p = params instanceof Map ? (Map<String, Object>) params : Map.of();
+            if ("agent.get".equals(method)) {
+                String target = String.valueOf(p.get("target"));
+                if (flakyTarget.equals(target) && getCalls.getAndIncrement() == 0) {
+                    throw new HerdrException("herdr socket read timed out"); // transport failure, code == null
+                }
+                return MAPPER.createObjectNode()
+                        .set("agent", MAPPER.createObjectNode()
+                                .put("terminal_id", target)
+                                .put("agent_status", "idle"));
+            }
+            if ("agent.prompt".equals(method)) {
+                promptTargets.add(String.valueOf(p.get("target")));
+                sendLatch.countDown();
+            }
+            return MAPPER.createObjectNode();
+        }
+
+        List<String> promptTargets() {
+            return List.copyOf(promptTargets);
+        }
+
+        @Override
+        public void close() {
+        }
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/peer/SpawnRequestWithProfilePreservesEveryComponentTest.java

@@ -0,0 +1,144 @@
+package dev.ltms.fleet.peer;
+
+import org.junit.jupiter.api.Test;
+
+import java.lang.reflect.Constructor;
+import java.lang.reflect.RecordComponent;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.TreeSet;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * Fleetd #382, the same "defect factory" #357 and #358 guarded on {@code FleetConfig.withDefaults()}
+ * and {@link dev.ltms.fleet.session.MemberSession}'s rebuild sites — reproduced here on
+ * {@link SpawnRequest#withProfile(String)}.
+ *
+ * <p>{@code SpawnRequest} has back-compat constructors at arity 3 and 5 alongside its canonical
+ * arity-6 constructor. Before this ticket, {@code CompositePeerLauncher} routed a profile by
+ * building a fresh {@code SpawnRequest} from a literal {@code new SpawnRequest(...)} call listing
+ * six of the original request's own accessors. That call is only correct because it happens to
+ * name exactly six arguments today — add a 7th component and the established back-compat pattern
+ * (a new constructor at the old, now-shorter arity) and a call one argument short of the new
+ * canonical arity would silently rebind to that back-compat constructor, dropping the new
+ * component on every profile-routed spawn without any compile error. {@link #withProfile} replaces
+ * that literal call, so this test guards the ONE rebuild site instead of a call site scattered
+ * through a launcher.
+ *
+ * <p>The check below builds a {@link SpawnRequest} through the TRUE canonical constructor —
+ * resolved by the record's own component types via {@code getDeclaredConstructor}, never by
+ * argument count, so it can never itself land on a back-compat overload — with a real, distinctive,
+ * non-null value in every component, calls {@link SpawnRequest#withProfile(String)}, and asserts
+ * every component the method is not documented to change survives unchanged, while {@code
+ * profileName} comes back as the new value it was given. A component that comes back anything else
+ * was silently dropped — the shape of the defect this test exists to catch.
+ *
+ * <p>{@link #EXCLUDED_FROM_SURVIVAL_CHECK} is kept deliberately empty and size-pinned by
+ * {@link #exclusionListSizeIsPinned()}, for the same reason the other two guards pin theirs at
+ * zero: a checker whose escape hatch can grow to silence a failure is not a checker. Every one of
+ * {@link SpawnRequest}'s 6 current components has a real, non-null value here and none is excluded.
+ */
+class SpawnRequestWithProfilePreservesEveryComponentTest {
+
+    private static final RecordComponent[] COMPONENTS = SpawnRequest.class.getRecordComponents();
+
+    /** Deliberately empty today; grow it only with a matching justification, and re-pin the size. */
+    private static final Set<String> EXCLUDED_FROM_SURVIVAL_CHECK = Set.of();
+
+    /** One real, distinctive, non-null value per component — none of the 6 is excluded. */
+    private static Map<String, Object> baseValues() {
+        Map<String, Object> v = new LinkedHashMap<>();
+        v.put("profileName", "profile-guard");
+        v.put("requestedCwd", "/wt/requested-guard");
+        v.put("callerCwd", "/wt/caller-guard");
+        v.put("sessionName", "session-guard");
+        v.put("resumeSessionId", "resume-guard");
+        v.put("role", MemberRole.REVIEWER);
+        assertNamesMatchComponents(v);
+        return v;
+    }
+
+    /**
+     * Guards {@link #baseValues()} itself against drifting from the record's real shape — forgetting
+     * to add a new component here fails this assertion by name, rather than silently checking one
+     * component fewer than the record has.
+     */
+    private static void assertNamesMatchComponents(Map<String, Object> values) {
+        Set<String> names = new TreeSet<>();
+        for (RecordComponent rc : COMPONENTS) {
+            names.add(rc.getName());
+        }
+        assertEquals(names, new TreeSet<>(values.keySet()),
+                "this test's value map has drifted from SpawnRequest's actual components — "
+                        + "update baseValues() alongside the record");
+    }
+
+    /**
+     * Builds a {@link SpawnRequest} through the TRUE canonical constructor — resolved by the
+     * record's own component types, not by argument count — so this never accidentally exercises a
+     * back-compat overload the way a literal {@code new SpawnRequest(...)} call risks doing.
+     */
+    private static SpawnRequest requestOf(Map<String, Object> values) throws ReflectiveOperationException {
+        Class<?>[] types = Arrays.stream(COMPONENTS).map(RecordComponent::getType).toArray(Class<?>[]::new);
+        Object[] args = Arrays.stream(COMPONENTS).map(rc -> values.get(rc.getName())).toArray();
+        Constructor<SpawnRequest> ctor = SpawnRequest.class.getDeclaredConstructor(types);
+        return ctor.newInstance(args);
+    }
+
+    @Test
+    void exclusionListSizeIsPinned() {
+        assertEquals(0, EXCLUDED_FROM_SURVIVAL_CHECK.size(),
+                "EXCLUDED_FROM_SURVIVAL_CHECK grew from 0 — every entry needs a justification in "
+                        + "this test class's javadoc AND this assertion re-pinned to the new size; a "
+                        + "growing exclusion list that silences failures on its own is not a guard");
+    }
+
+    @Test
+    void withProfilePreservesEveryOtherComponent() throws ReflectiveOperationException {
+        Map<String, Object> base = baseValues();
+        SpawnRequest request = requestOf(base);
+        SpawnRequest result = request.withProfile("profile-updated");
+
+        Map<String, Object> expectedOverrides = Map.of("profileName", "profile-updated");
+
+        List<String> dropped = new ArrayList<>();
+        int checked = 0;
+        for (RecordComponent rc : COMPONENTS) {
+            String name = rc.getName();
+            if (EXCLUDED_FROM_SURVIVAL_CHECK.contains(name)) {
+                continue;
+            }
+            checked++;
+            Object expected = expectedOverrides.containsKey(name) ? expectedOverrides.get(name) : base.get(name);
+            Object actual;
+            try {
+                actual = rc.getAccessor().invoke(result);
+            } catch (ReflectiveOperationException e) {
+                throw new RuntimeException("failed to read SpawnRequest." + name + "()", e);
+            }
+            if (!Objects.equals(expected, actual)) {
+                dropped.add(String.format(Locale.ROOT,
+                        "%s: withProfile() was expected to carry (%s) for '%s' but returned %s — a "
+                                + "component silently dropped by withProfile(), the shape of the defect "
+                                + "this test exists to catch (its final \"return new SpawnRequest(...)\" "
+                                + "call binding to a back-compat constructor instead of the true "
+                                + "canonical one)",
+                        name, expected, name, actual));
+            }
+        }
+
+        System.out.printf(Locale.ROOT,
+                "SpawnRequest.withProfile() component-survival coverage — %d components, %d checked, "
+                        + "%d excluded, %d survived%n",
+                COMPONENTS.length, checked, EXCLUDED_FROM_SURVIVAL_CHECK.size(), checked - dropped.size());
+        assertEquals(List.of(), dropped,
+                "withProfile() silently dropped these components: " + dropped);
+    }
+}