fleetd #296: close panes on failed spawn

No behaviour change today. HerdrCodec wraps every encode/decode failure
and UnixSocketHerdrClient wraps every IOException, so HerdrException is
all closeTab can currently throw.

But releaseZdotdir five lines below catches RuntimeException, and the
whole point of this fix is that nothing here may mask the cleanups
below. Guarding against the expected exception type and staying bare
against any other is the same asymmetry the ticket exists to remove,
one level down. This stops a later change inside
WorkspaceControl.closeTab reopening it.

.claude/skills/implementer/SKILL.md

@@ -39,6 +39,19 @@ a worker made all 59 of its edits in the primary's tree and never noticed.
 test "$(git rev-parse --show-toplevel)" = "$PWD" || cd "$(git rev-parse --show-toplevel)"
 ```
 
+**Never run `git stash` (or `git stash pop`/`apply`/`drop`).** Your worktree is isolated, but the
+stash is **not**: `refs/stash` is one stack shared by the primary's checkout and every other
+worker's worktree of this repo. Measured on 2026-09-04 — `git stash list` from a worker's worktree
+and from the primary's tree returned byte-identical output. So a `git stash` you run can be popped
+into someone else's tree, and a `git stash pop` you run can drop **another worker's** uncommitted
+edits on top of yours. This has already happened here: two workers were running in parallel and one
+of them had its in-progress edit silently overwritten by the other's stash.
+
+The branch is your isolation, so use it instead. To set work aside, commit it on your own branch
+(`git commit -m "wip: ..."`) and carry on; to try something and back out, use
+`git diff > /tmp/<your-branch>.patch` then `git checkout -- <file>`. Both stay inside your worktree.
+If you find a stash entry you did not create, leave it alone and say so in your report.
+
 ## 2. Implement
 
 - Implement exactly the scope the lead named. Keep the diff focused; note anything out of scope

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -250,9 +250,7 @@ public final class Fleetd {
         boolean clearAfterTurn = cfg.lifecycle() != null && cfg.lifecycle().clearAfterTurn();
         SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot(), cfg.worktreeGroup()),
                 System::nanoTime, contextCap, clearAfterTurn);
-        liveCountRef.set(profileName -> (int) sessions.roster().stream()
-                .filter(s -> profileName.equals(s.profile()))
-                .count());
+        liveCountRef.set(profileName -> liveSessionCount(sessions.roster(), profileName));
 
         // CB-303 part 1: idle-ttl reaper — only when configured, defaults to disabled.
         final SessionReaper reaper;
@@ -593,7 +591,11 @@ public final class Fleetd {
             if (detail.agentSessionId() != null) {
                 reason += " agentSessionId=" + detail.agentSessionId();
             }
-            messages.abandon(detail.terminalId(), reason);
+            // fleetd #275: this is an explicit teardown (fleet_stop, or the idle reaper) — the
+            // worker's pane is being stopped right now, so an open fleet_ask has no turn left to
+            // resume into. Sweep it too, unlike FleetHealthMonitor's health-classification call
+            // (see MessageService.abandon's javadoc for why those two must differ).
+            messages.abandon(detail.terminalId(), reason, true);
             replyInbox.release(detail.terminalId());
             primaryRegistry.forgetDelegation(detail.terminalId()); // CB-532: don't leak the lead binding
         });
@@ -855,6 +857,19 @@ public final class Fleetd {
                 .orElse(null);
     }
 
+    /**
+     * Count sessions that occupy a profile's spawn capacity. A {@code BACKEND_ERROR} or
+     * {@code FAILED} session stays in the roster so {@code fleet_list} can show its failure, but a
+     * member that cannot accept another delivery does not use a seat.
+     */
+    static int liveSessionCount(List<MemberSession> roster, String profileName) {
+        return (int) roster.stream()
+                .filter(session -> profileName.equals(session.profile()))
+                .filter(session -> session.state() != MemberSession.State.BACKEND_ERROR)
+                .filter(session -> session.state() != MemberSession.State.FAILED)
+                .count();
+    }
+
     /**
      * fleetd #248 / fleetd#201 Unit 5: factory for the production {@link BackendErrorSink} — the
      * collaborator {@link CompletionResolver} notifies when a pane-scrape classification actually

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -322,8 +322,9 @@ public record FleetConfig(
      *                       statement that does not stop being true just because the profile was
      *                       named directly. A negative value has no sane meaning (there is no
      *                       "excluded" to degrade to below zero) and is refused at config load
-     *                       instead, naming the profile and the key. Live means any session the
-     *                       registry still owns (acquired and not yet released), in any state.
+     *                       instead, naming the profile and the key. Live means a session that can
+     *                       receive another delivery. The roster keeps terminal {@code BACKEND_ERROR}
+     *                       and {@code FAILED} sessions for diagnostics, but they do not use capacity.
      * @param kind           which peer launcher spawns this profile: {@code "claude-code"} (default —
      *                       the {@link dev.ltms.fleet.member.ClaudeCodeLauncher}) or {@code "opencode"}.
      *                       The {@code CompositePeerLauncher} routes {@code spawn}/reap by this value, so

fleetd/src/main/java/dev/ltms/fleet/health/FleetHealthMonitor.java

@@ -14,6 +14,7 @@ import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 import java.util.function.BiConsumer;
@@ -28,6 +29,14 @@ public final class FleetHealthMonitor {
     static final int MAX_FAIL_TARGET_ATTEMPTS = 3;
     // CB-641: Match the injector's 60s readiness gate so health allows a full first boot.
     static final long READINESS_GRACE_NANOS = TimeUnit.SECONDS.toNanos(60);
+    /**
+     * fleetd #280: how long after a terminal transition to wait before the one bounded re-check
+     * fires. Must exceed the worst-case reverse-rendezvous {@code fleet_ask} window (55-115s, see
+     * {@code FleetMcp.ASK_DEFAULT_TIMEOUT_MS} / {@code FleetApp.MAX_ASK_TIMEOUT_MS}) so that, if the
+     * target was genuinely {@code ASKING} when {@code state} was first observed, its own ask has had
+     * time to lapse (clearing {@code Task#question} back to {@code null}) before this fires.
+     */
+    static final long ASK_LAPSE_RECHECK_DELAY_SECONDS = 120;
 
     private final AgentControl agents;
     private final Supplier<List<MemberSession>> roster;
@@ -38,7 +47,16 @@ public final class FleetHealthMonitor {
     private final long workingSuspectAfterNanos;
     private final BiConsumer<String, String> failTarget;
     private final Map<String, HealthPrior> priors = new HashMap<>();
-    private final Map<String, HealthState> states = new HashMap<>();
+    /**
+     * The live classification per member, and the only one of this class's three maps that more
+     * than one scheduler task touches. {@code tick} writes it (and prunes it to the roster);
+     * fleetd #280's delayed {@link #recheckTerminalTarget} reads it from its own separate scheduled
+     * task. Both run on the single-threaded scheduler {@code Fleetd} passes in today, so they are
+     * serialised — but nothing in this class enforces that, and an unsynchronised {@link HashMap}
+     * read racing a resize can spin a CPU forever rather than fail visibly. {@code priors} and
+     * {@code orphanStreaks} stay plain maps because {@code tick} is still their only toucher.
+     */
+    private final Map<String, HealthState> states = new ConcurrentHashMap<>();
     /**
      * CB-643: consecutive ticks on which a target looked like an orphaned delegation. The fact
      * {@link MessageService#hasOrphanedDelegation} reports is a true snapshot, but it can read true
@@ -171,6 +189,7 @@ public final class FleetHealthMonitor {
         // member stayed terminal.
         if (terminal(next)) {
             failTerminalTarget(target, next);
+            scheduleTerminalRecheck(target, next);
         }
     }
 
@@ -191,6 +210,48 @@ public final class FleetHealthMonitor {
                 target, state, MAX_FAIL_TARGET_ATTEMPTS, last);
     }
 
+    /**
+     * fleetd #280: schedule the one bounded, delayed follow-up for a terminal transition — never a
+     * per-tick retry (CB-580 rejected that shape; {@link #reportTransition} still fires
+     * {@link #failTerminalTarget} exactly once per transition, unconditionally on the tick loop).
+     * This is a single one-shot task, scheduled once per transition into GONE/NEVER_READY, so a
+     * member stuck terminal for the rest of its life gets exactly one extra attempt, not one per
+     * tick. See {@link #recheckTerminalTarget} for why the extra attempt is safe.
+     */
+    private void scheduleTerminalRecheck(String target, HealthState state) {
+        if (scheduler.isShutdown()) return;
+        try {
+            scheduler.schedule(() -> recheckTerminalTarget(target, state),
+                    ASK_LAPSE_RECHECK_DELAY_SECONDS, TimeUnit.SECONDS);
+        } catch (RuntimeException e) {
+            log.warn("fleet health: could not schedule terminal re-check for member={} state={}",
+                    target, state, e);
+        }
+    }
+
+    /**
+     * fleetd #280: the delayed re-check {@link #scheduleTerminalRecheck} scheduled for one terminal
+     * transition. By now, a {@code fleet_ask} that was still open when {@code state} was first
+     * observed has had time to lapse on its own (see {@link #ASK_LAPSE_RECHECK_DELAY_SECONDS}),
+     * clearing {@code Task#question} back to {@code null} — which is exactly what
+     * {@link MessageService#abandon(String, String, boolean)}'s {@code sweepAsking=false} filter
+     * needs to finally match it. Calling {@link #failTerminalTarget} again is safe only because
+     * {@code sweepAsking} stays {@code false}: a task genuinely still {@code ASKING} is skipped
+     * exactly as it was on the very first attempt — this never fails a ticket whose ask has not yet
+     * lapsed.
+     *
+     * <p><strong>Guarded on "target is still classified {@code state}."</strong> Without this guard,
+     * a member that recovered (or was released and dropped from the roster) between the transition
+     * and this re-check would still take a blind {@code failTarget} call — reaching into whatever
+     * brand-new, unrelated turn it has since picked up and failing it too. {@link #states} already
+     * carries the live classification (updated every tick, pruned to the current roster on release),
+     * so a stale or recovered target simply reads as a mismatch here and this is a no-op.
+     */
+    void recheckTerminalTarget(String target, HealthState state) {
+        if (states.get(target) != state) return;
+        failTerminalTarget(target, state);
+    }
+
     private static boolean terminal(HealthState state) {
         return state == HealthState.GONE || state == HealthState.NEVER_READY;
     }

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -257,7 +257,7 @@ public final class FleetMcp {
         // Each handler is built once and wired to its fleet_* tool below.
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> sendHandler =
                 (exchange, req) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.SEND,
+                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_send", req.arguments()),
                             str(req.arguments(), "sessionId"));
                     if (denied != null) return denied;
                     String caller = callerTerminal(exchange);
@@ -299,7 +299,7 @@ public final class FleetMcp {
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> replyHandler =
                 (exchange, req) -> {
                     String self = callerTerminal(exchange);
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.REPLY, self);
+                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_reply", req.arguments()), self);
                     if (denied != null) return denied;
                     return reply(messages, self, str(req.arguments(), "content"));
                 };
@@ -307,13 +307,13 @@ public final class FleetMcp {
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> askHandler =
                 (exchange, req) -> {
                     String self = callerTerminal(exchange);
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.ASK, self);
+                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_ask", req.arguments()), self);
                     if (denied != null) return denied;
                     return ask(messages, self, str(req.arguments(), "question"), timeoutMs(req.arguments()));
                 };
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> statusHandler =
                 (exchange, req) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
+                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_status", req.arguments()), null);
                     if (denied != null) return denied;
                     return status(messages, str(req.arguments(), "sessionId"));
                 };
@@ -322,7 +322,7 @@ public final class FleetMcp {
                     Map<String, Object> a = req.arguments();
                     String target = str(a, "target");
                     // The action depends on the ARGUMENTS, not on the tool name -- see pollAction.
-                    McpSchema.CallToolResult denied = deny(exchange, pollAction(target), target);
+                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_poll", a), target);
                     if (denied != null) return denied;
                     return poll(messages, str(a, "ticket"), target);
                 };
@@ -331,14 +331,14 @@ public final class FleetMcp {
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> ackHandler =
                 (exchange, req) -> {
                     Map<String, Object> a = req.arguments();
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.DRAIN, str(a, "target"));
+                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_ack", a), str(a, "target"));
                     if (denied != null) return denied;
                     return ack(messages, str(a, "target"), str(a, "msgId"));
                 };
         // Fleet management (CB-108): spawn/list/stop over ClaudeCodeLauncher.
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> spawnHandler =
                 (exchange, req) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.SPAWN, null);
+                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_spawn", req.arguments()), null);
                     if (denied != null) return denied;
                     String caller = callerTerminal(exchange);
                     // SPAWN is already auth-gated to PRIMARY (architects can never call it), but
@@ -355,7 +355,7 @@ public final class FleetMcp {
                 };
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> listHandler =
                 (exchange, _) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
+                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_list", Map.of()), null);
                     if (denied != null) return denied;
                     return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, outage,
                             leadSeats, callers == null ? Map.of() : callers.leads(),
@@ -365,19 +365,19 @@ public final class FleetMcp {
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> stopHandler =
                 (exchange, req) -> {
                     String paneId = str(req.arguments(), "paneId");
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.STOP, paneId);
+                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_stop", req.arguments()), paneId);
                     if (denied != null) return denied;
                     return stop(sessions, paneId);
                 };
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> profilesHandler =
                 (exchange, _) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
+                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_profiles", Map.of()), null);
                     if (denied != null) return denied;
                     return profiles(workers, quarantine, outage);
                 };
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> whoamiHandler =
                 (exchange, _) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
+                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_whoami", Map.of()), null);
                     if (denied != null) return denied;
                     return whoami(principal(exchange), sessions);
                 };
@@ -754,6 +754,25 @@ public final class FleetMcp {
         return isBlank(target) ? Authz.Action.READ : Authz.Action.DRAIN;
     }
 
+    /**
+     * The action a registered tool handler actually hands to the authorization gate.
+     * Keeping this choice beside the registered-tool inventory makes a new tool fail the coverage
+     * test until its action is pinned.
+     */
+    static Authz.Action toolAction(String toolName, Map<String, Object> arguments) {
+        return switch (toolName) {
+            case "fleet_send" -> Authz.Action.SEND;
+            case "fleet_reply" -> Authz.Action.REPLY;
+            case "fleet_ask" -> Authz.Action.ASK;
+            case "fleet_status", "fleet_list", "fleet_profiles", "fleet_whoami" -> Authz.Action.READ;
+            case "fleet_poll" -> pollAction(str(arguments, "target"));
+            case "fleet_ack" -> Authz.Action.DRAIN;
+            case "fleet_spawn" -> Authz.Action.SPAWN;
+            case "fleet_stop" -> Authz.Action.STOP;
+            default -> throw new IllegalArgumentException("unregistered tool: " + toolName);
+        };
+    }
+
     /** {@code fleet_poll}: check an async delegation by ticket, or drain a worker's inbox by target. */
     static McpSchema.CallToolResult poll(MessageService messages, String ticket, String target) {
         if (!isBlank(target)) {
@@ -1148,15 +1167,35 @@ public final class FleetMcp {
     private static Map<String, Object> memberCapacityView(MemberSession session, Agent live,
                                                            MessageService messages, long nowNanos) {
         Map<String, Object> row = SessionManager.rosterView(session, live);
-        boolean open = messages != null && messages.hasAcceptedDelivery(session.terminalId());
-        boolean inbox = messages != null && messages.hasInboxMessage(session.terminalId());
-        boolean reclaimable = (session.state() == MemberSession.State.READY || session.state() == MemberSession.State.DONE)
-                && !open && !inbox;
+        boolean reclaimable = reclaimable(session, messages);
         row.put("reclaimable", reclaimable);
         row.put("idleForSeconds", reclaimable ? Math.max(0, (nowNanos - session.lastActivityAtNanos()) / 1_000_000_000L) : null);
         return row;
     }
 
+    /**
+     * The one definition of {@code reclaimable}: this member holds a spawn seat, and has no open
+     * bridge work, so stopping it gives the seat back. Both views in a single {@code fleet_list}
+     * response call it — the per-member flag in {@link #memberCapacityView} and the per-profile
+     * count in {@link #capacityView} — because two copies of this rule in one response is how the
+     * two numbers come to disagree.
+     *
+     * <p>fleetd #284: {@code BACKEND_ERROR} and {@code FAILED} are deliberately NOT reclaimable.
+     * The ticket asked for them to be, and that half of the ticket was wrong. Once
+     * {@code Fleetd.liveSessionCount} stopped counting a terminal session as live, that seat is
+     * ALREADY in {@code free}; counting it here too reports the same seat twice, and
+     * {@code free + reclaimable} then reads as more capacity than {@code maxLoad} allows. The dead
+     * session stays visible either way: its roster row still carries {@code state:
+     * "backend_error"} or {@code "failed"}, which is what tells the lead to stop it.
+     */
+    static boolean reclaimable(MemberSession session, MessageService messages) {
+        boolean holdsSeat = session.state() == MemberSession.State.READY
+                || session.state() == MemberSession.State.DONE;
+        return holdsSeat && (messages == null
+                || (!messages.hasAcceptedDelivery(session.terminalId())
+                        && !messages.hasInboxMessage(session.terminalId())));
+    }
+
     /**
      * CB-583: {@code free} alone cannot tell a lead "busy, will free up" from "refusing, and
      * nothing changes for N seconds" — those need different decisions. So a quarantined profile
@@ -1195,8 +1234,7 @@ public final class FleetMcp {
         int live = liveCount.apply(profile);
         int leadSeatCount = leadSeats.seatsFor().apply(profile);
         int reclaimable = (int) roster.stream().filter(s -> profile.equals(s.profile()))
-                .filter(s -> (s.state() == MemberSession.State.READY || s.state() == MemberSession.State.DONE))
-                .filter(s -> messages == null || (!messages.hasAcceptedDelivery(s.terminalId()) && !messages.hasInboxMessage(s.terminalId())))
+                .filter(s -> reclaimable(s, messages))
                 .count();
         Map<String, Object> row = new LinkedHashMap<>();
         row.put("profile", profile); row.put("maxLoad", cap); row.put("live", live);

fleetd/src/main/java/dev/ltms/fleet/member/ClaudeCodeLauncher.java

@@ -540,16 +540,66 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * itself is still lost, because there is no OS-level compare-and-swap on a plain file, only this
      * cooperative narrowing of the gap.
      *
+     * <p><b>fleetd #285: refuses under {@code memberHerdrSocket} rather than writing somewhere the
+     * member cannot read.</b> Under {@code memberHerdrSocket:} the member pane runs as a
+     * <em>different OS user with its own {@code $HOME}</em> — the same reason {@link
+     * #writeCharterFile} routes the role/reply charter under {@code worktreeRoot} instead of
+     * {@code java.io.tmpdir} and refuses the spawn when it cannot. This method has no equivalent
+     * relocation available: unlike the charter (fleetd's own content, free to place anywhere and
+     * hand to the peer via an argv flag), {@code .claude.json} is a file Claude Code looks up for
+     * ITSELF at a fixed location — {@code CLAUDE_CONFIG_DIR/.claude.json}, or else the member OS
+     * user's own {@code ~/.claude.json}, a path fleetd has no channel to learn. So when {@code
+     * configDir} is unset, there is no member-readable target to seed at all — writing the
+     * unqualified default would land in <em>fleetd's own</em> {@code ~/.claude.json} instead, the
+     * exact defect this fix closes, not a workable fallback. And even with {@code configDir} set,
+     * the file this method itself just wrote is {@code 0600} (owner-only — see {@link
+     * #copyPosixPermissionsIfPresent}), unreadable by a different-uid member unless shared with
+     * {@code worktreeGroup}, the same group {@link EnvAllowListScrub#shareWithGroup} already uses
+     * for the ZDOTDIR scrub (fleetd #213) and the charter file (fleetd #219/#222). So under {@code
+     * memberHerdrSocket} this method requires BOTH {@code configDir} and {@code worktreeGroup}
+     * before it ever touches a file, and refuses the spawn — naming exactly which one is missing —
+     * rather than silently corrupt fleetd's own home or hand the member an unreadable path. This
+     * mirrors {@link #writeCharterFile}'s "refuse, don't degrade" decision: a member spawned without
+     * a readable trust seed is not degraded, it sits on the interactive dialog forever and never
+     * calls {@code fleet_reply} — exactly the failure fleetd #149 exists to prevent, so trading it
+     * for "spawn something" is not worth it. When {@code configDir} and {@code worktreeGroup} are
+     * both present, the write proceeds exactly as below and the resulting file is additionally
+     * chgrp'd/chmod'd group-readable ({@code rw-r-----}) via {@link
+     * EnvAllowListScrub#shareFileWithGroup(Path, String)} so the member's OS user can actually
+     * open it — the
+     * directory itself (unlike {@code worktreeRoot} or the charter's per-spawn directory) is not
+     * fleetd-managed, so its own traversal permissions remain the operator's setup, same as they
+     * already must be for the member to read anything else fleetd points {@code CLAUDE_CONFIG_DIR}
+     * at. With {@code memberHerdrSocket} ABSENT (today's only live mode) every branch below is
+     * byte-identical to before this fix.
+     *
      * @param configDir the profile's {@code CLAUDE_CONFIG_DIR} ({@code cfg.configDir()}), or
-     *                  {@code null}/blank to target the default {@code ~/.claude.json}
+     *                  {@code null}/blank to target the default {@code ~/.claude.json} — refused
+     *                  outright when {@code memberHerdrSocket} is configured, see above
      * @param cwd       the spawn's resolved working directory — the exact key Claude Code will look
      *                  up for itself once it starts there
+     * @throws IllegalStateException when {@code memberHerdrSocket} is configured but {@code
+     *                                configDir} and/or {@code worktreeGroup} is not — the same
+     *                                refusal shape as {@link #writeCharterFile}
      */
-    private static void seedTrustDialog(String configDir, String cwd) {
+    private void seedTrustDialog(String configDir, String cwd) {
         if (!isProvisionedWorktree(cwd)) {
             return;
         }
         boolean unsetConfigDir = configDir == null || configDir.isBlank();
+        boolean memberHerdrSocket = memberHerdrSocketConfigured();
+        String group = memberHerdrSocket ? memberGroup() : null;
+        if (memberHerdrSocket && (unsetConfigDir || group == null)) {
+            throw new IllegalStateException("memberHerdrSocket is configured, so the workspace-trust "
+                    + "seed (.claude.json, which gates Claude Code's interactive trust dialog) must be "
+                    + "placed where the member's OS user can read it — configDir, shared via "
+                    + "worktreeGroup — but " + (unsetConfigDir ? "configDir" : "worktreeGroup")
+                    + " is not configured. Refusing to spawn rather than write fleetd's own default "
+                    + "'~/.claude.json' or hand the member a config file it cannot read: that member "
+                    + "would sit on the interactive trust dialog forever and never reach an "
+                    + "injectable state. Configure configDir on this profile and worktreeGroup on the "
+                    + "fleet to enable claude-code member spawns under memberHerdrSocket.");
+        }
         Path target = unsetConfigDir
                 ? Path.of(System.getProperty("user.home"), ".claude.json")
                 : Path.of(configDir, ".claude.json");
@@ -559,18 +609,20 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
             // profile that simply forgot to set configDir gets no signal at all short of the
             // operator noticing their own file changing. Say so loudly, every time it is about to
             // happen, rather than only once ever: each occurrence is a live write to a real
-            // person's home config and deserves its own log line.
+            // person's home config and deserves its own log line. (Reached only when
+            // memberHerdrSocket is absent — the block above already refused otherwise.)
             log.warn("seedTrustDialog: profile has no configDir set, so the workspace-trust seed "
                     + "for cwd '{}' is about to write the operator's own default '{}' — set "
                     + "configDir on this profile to target a per-member config file instead",
                     cwd, target);
         }
         synchronized (TRUST_JSON_LOCK) {
+            boolean written = false;
             try {
                 if (target.getParent() != null) {
                     Files.createDirectories(target.getParent());
                 }
-                for (int attempt = 1; attempt <= MAX_TRUST_JSON_CAS_ATTEMPTS; attempt++) {
+                for (int attempt = 1; attempt <= MAX_TRUST_JSON_CAS_ATTEMPTS && !written; attempt++) {
                     byte[] before = Files.isRegularFile(target) ? Files.readAllBytes(target) : null;
                     ObjectNode root = parseTrustJsonOrEmpty(before);
                     JsonNode projectsNode = root.get("projects");
@@ -611,26 +663,39 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
                         continue;
                     }
                     writeAtomically(target, newContent);
-                    return;
+                    written = true;
+                }
+                if (!written) {
+                    // fleetd #247: deliberately do NOT write here. A member that starts without the
+                    // seed still starts — it may hit the trust dialog fleetd #149 describes and fail
+                    // to reach an injectable state, but that failure is visible (herdr reports it,
+                    // the spawn-readiness gate times out) and recoverable (retry the spawn). Writing
+                    // our stale copy over whatever the other writer left would be silent and, if that
+                    // other writer is the operator's own live session, could destroy real
+                    // configuration — fail toward the recoverable outcome, not the silent one.
+                    log.warn("seedTrustDialog: gave up seeding workspace-trust for cwd '{}' into '{}' "
+                            + "after {} attempts — another writer (most plausibly the operator's own "
+                            + "live Claude Code sharing this file) kept changing it faster than we "
+                            + "could re-read it, so nothing was written; the member may show the "
+                            + "trust dialog instead", cwd, target, MAX_TRUST_JSON_CAS_ATTEMPTS);
                 }
-                // fleetd #247: deliberately do NOT write here. A member that starts without the
-                // seed still starts — it may hit the trust dialog fleetd #149 describes and fail to
-                // reach an injectable state, but that failure is visible (herdr reports it, the
-                // spawn-readiness gate times out) and recoverable (retry the spawn). Writing our
-                // stale copy over whatever the other writer left would be silent and, if that other
-                // writer is the operator's own live session, could destroy real configuration —
-                // fail toward the recoverable outcome, not the silent one.
-                log.warn("seedTrustDialog: gave up seeding workspace-trust for cwd '{}' into '{}' "
-                        + "after {} attempts — another writer (most plausibly the operator's own "
-                        + "live Claude Code sharing this file) kept changing it faster than we could "
-                        + "re-read it, so nothing was written; the member may show the trust dialog "
-                        + "instead", cwd, target, MAX_TRUST_JSON_CAS_ATTEMPTS);
             } catch (Exception e) {
                 log.debug("cannot seed workspace-trust entry for cwd '{}' into '{}'", cwd, target, e);
+                return;
+            }
+            // fleetd #285: the write above lands as fleetd's own OS user; under memberHerdrSocket
+            // that is NOT the member's OS user, so without this the member still cannot read the
+            // file it exists to seed — a silent readiness timeout with the write looking "done".
+            // Deliberately OUTSIDE the swallow-all catch above: a group that fails to resolve here
+            // means the seed is unreadable despite a successful write, which must fail as loudly as
+            // writeCharterFile's own EnvAllowListScrub.shareWithGroup call already does.
+            if (written && memberHerdrSocket) {
+                EnvAllowListScrub.shareFileWithGroup(target, group);
             }
         }
     }
 
+
     /** Bound on {@link #seedTrustDialog}'s fleetd #247 compare-and-swap retry loop. */
     private static final int MAX_TRUST_JSON_CAS_ATTEMPTS = 5;
 

fleetd/src/main/java/dev/ltms/fleet/member/EnvAllowListScrub.java

@@ -181,6 +181,33 @@ public final class EnvAllowListScrub {
         }
     }
 
+    /**
+     * fleetd #285: share ONE file with {@code group}, read-only ({@code rw-r-----}) — the same
+     * per-file mode {@link #shareWithGroup} applies to a directory's entries, and the same error
+     * shapes, but without touching a parent directory. Used for a file fleetd writes into a
+     * directory it does NOT own — {@code configDir}'s own traversal permissions stay the
+     * operator's setup — where the directory-wide {@link #shareWithGroup} would be wrong.
+     *
+     * @throws UncheckedIOException when {@code group} does not resolve on this host, the
+     *                              filesystem has no POSIX group ownership, or a
+     *                              group-ownership/permission call is refused
+     */
+    static void shareFileWithGroup(Path file, String group) {
+        try {
+            GroupPrincipal principal = file.getFileSystem().getUserPrincipalLookupService()
+                    .lookupPrincipalByGroupName(group);
+            setGroupAndPermissions(file, principal, "rw-r-----");
+        } catch (IOException e) {
+            throw new UncheckedIOException("cannot share generated file " + file + " with group '"
+                    + group + "' — the group must exist, and the fleetd operator ("
+                    + System.getProperty("user.name") + ") must be a member of it", e);
+        } catch (UnsupportedOperationException e) {
+            throw new UncheckedIOException("cannot share generated file " + file + " with group '"
+                    + group + "' — this filesystem does not support POSIX group ownership",
+                    new IOException(e));
+        }
+    }
+
     private static void setGroupAndPermissions(Path path, GroupPrincipal group, String perms) throws IOException {
         PosixFileAttributeView view = Files.getFileAttributeView(path, PosixFileAttributeView.class);
         if (view == null) {

fleetd/src/main/java/dev/ltms/fleet/member/HerdrPeerLauncher.java

@@ -697,7 +697,20 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         if (paneId == null) {
             throw new IllegalStateException("pane.split returned no pane — cannot start a peer");
         }
-        Agent peer = startUniquelyNamed(cfg, argv, paneId).agent();
+        Agent peer;
+        try {
+            peer = startUniquelyNamed(cfg, argv, paneId).agent();
+        } catch (RuntimeException e) {
+            // The peer never started — don't leave the pane we just created orphaned.
+            // Best-effort cleanup; never let it mask the real spawn failure.
+            try {
+                stop(paneId);
+            } catch (RuntimeException cleanup) {
+                log.warn("failed to close orphaned pane {} after spawn error: {}",
+                        paneId, cleanup.getMessage());
+            }
+            throw e;
+        }
         log.info("{} started pane={} terminal={}", namePrefix, peer.paneId(), peer.terminalId());
         return peer;
     }
@@ -913,9 +926,14 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * {@link #reapOrphanWorkers() orphan-reap} and spawn-gate-timeout paths, plus any caller that
      * passes a pane directly, keep working without an owning id.
      *
-     * <p>Resolves the tab from the pane <em>before</em> closing it. An already-gone pane/tab
-     * (repeated DELETE, crashed peer) is treated as success; any other failure propagates so a
-     * genuinely failed teardown is not reported as done.
+     * <p>Resolves the tab from the pane <em>before</em> closing it. {@code agents.close} (the pane)
+     * is the one step whose failure means the teardown itself may not have happened: an already-gone
+     * pane (repeated DELETE, crashed peer) is treated as success, but any other failure propagates so
+     * a genuinely failed teardown is not reported as done. {@code spaces.closeTab} (fleetd #293) is
+     * different — by the time it runs the pane is already closed, so it is cosmetic workspace tidying
+     * rather than a real teardown failure, and a failure there is logged and never propagates, so it
+     * cannot mask the two cleanups below it ({@link #releaseZdotdir}, and the caller's worktree
+     * removal in {@code SessionManager.release}).
      */
     @Override
     public void stop(String idOrPane) {
@@ -934,7 +952,25 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
             log.debug("pane.close({}) ignored — already gone: {}", paneId, e.getMessage());
         }
         if (loc != null && loc.tabPaneCount() == 1) {
-            spaces.closeTab(loc.tabId());
+            // fleetd #293: the pane above is already closed by this point, so a failing tab.close is
+            // cosmetic workspace tidying, not a real teardown failure — it must not mask the two
+            // cleanups below it (releaseZdotdir, and the caller's worktree removal). Unlike
+            // agents.close above, this is not narrowed to "already gone": any failure here, whatever
+            // its cause, is one we continue past, so we log it at WARN (not debug) with the tab id a
+            // person can go close by hand.
+            try {
+                spaces.closeTab(loc.tabId());
+            } catch (RuntimeException e) {
+                // Caught as RuntimeException, not HerdrException, to match releaseZdotdir's own
+                // guard five lines below. Today the two are the same set — HerdrCodec wraps every
+                // encode/decode failure and UnixSocketHerdrClient wraps every IOException, so
+                // HerdrException is all closeTab can actually throw. Narrowing to it anyway would
+                // leave this step guarded against the expected failure and bare against any other,
+                // which is the exact asymmetry fleetd #293 exists to remove. No behaviour change
+                // today; it stops a later change inside WorkspaceControl.closeTab reopening it.
+                log.warn("tab.close({}) failed — the pane is already torn down, so continuing; the "
+                        + "tab may need manual cleanup: {}", loc.tabId(), e.getMessage());
+            }
         } else if (loc != null) {
             log.debug("not closing tab {} — it holds {} panes (not a dedicated peer tab)",
                     loc.tabId(), loc.tabPaneCount());
@@ -973,7 +1009,8 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * that gap: it stops waiting immediately (never burns the rest of the timeout), runs the same
      * teardown the timeout path below runs, and throws with a message that says the backend exited
      * rather than that the pane was slow. Any other {@link HerdrException} still propagates
-     * unchanged — this gate does not know how to recover from it.
+     * unchanged — this gate does not interpret or recover from it, but it still closes the pane
+     * it opened before handing the exception to its caller.
      */
     private void waitUntilInjectableOrThrow(String paneId) {
         long start = nowMillis.getAsLong();
@@ -987,7 +1024,15 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
                 if (isAlreadyGone(e)) {
                     failFastOnGoneBackend(paneId, e, nowMillis.getAsLong() - start);
                 }
-                throw e; // any other herdr failure is not ours to interpret — let it propagate
+                // This gate must not interpret an unrelated herdr error, but the caller does not
+                // receive paneId when spawn throws. Close the pane here before propagating e unchanged.
+                try {
+                    stop(paneId);
+                } catch (RuntimeException cleanup) {
+                    log.warn("failed to close orphaned pane {} after readiness-gate error: {}",
+                            paneId, cleanup.getMessage());
+                }
+                throw e;
             }
             lastStatus = sample.status();
             if (lastStatus.injectable() || refinedInjectable(paneId, sample)) {
@@ -1497,10 +1542,27 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * survive {@code allowed} (including the {@code LC_*} prefix rule). Neither number is a constant:
      * both come from the actual derived set and the actual environment this spawn sees. Never logs a
      * variable NAME or VALUE — only the counts.
+     *
+     * <p><strong>Under {@code memberHerdrSocket} the counts describe fleetd's own process, not the
+     * member's</strong> (fleetd #269 follow-up), so the message says so rather than leaving the
+     * reader to infer it from this javadoc, which the operator reading the log never sees.
      */
     private void logAllowListCoverage(Set<String> allowed) {
         Set<String> hostNames = hostEnvNames.get();
         long kept = hostNames.stream().filter(name -> MemberEnvAllowList.keeps(allowed, name)).count();
+        if (memberHerdrSocketConfigured()) {
+            // fleetd #269 covered the sibling line below (logCredentialGap) and stopped there.
+            // This line has the same problem: read plainly, "allowed 7 of 39" is a statement about
+            // the member's pane, and under memberHerdrSocket it is not -- the pane is routed to a
+            // second herdr whose environment fleetd cannot inspect. The counts stay useful, so
+            // this is not a WARN and not a refusal; only the claim is narrowed to what is true.
+            log.info("member credentials: allowed {} of {} names in fleetd's OWN environment — "
+                            + "memberHerdrSocket is configured, so member panes are routed to a "
+                            + "second herdr whose environment fleetd has no channel to inspect. "
+                            + "These counts describe fleetd's process, NOT the member pane's.",
+                    kept, hostNames.size());
+            return;
+        }
         log.info("member credentials: allowed {} of {}", kept, hostNames.size());
     }
 

fleetd/src/main/java/dev/ltms/fleet/msg/MessageService.java

@@ -360,6 +360,18 @@ public final class MessageService {
      * {@link #ask} clears the ticket's question and returns it to {@code PENDING}, but {@link #send}
      * already closed the forward waiter the instant the question surfaced, so the target has
      * neither an accepted nor a queued delivery left to show for it.
+     *
+     * <p><strong>Deliberately still {@code question == null} only (fleetd #275).</strong> This
+     * method must not also report a still-{@link Phase#ASKING} task as orphaned: the worker may
+     * genuinely be waiting on a live primary that is about to (or already mid-{@link #answer})
+     * answer it, and {@link dev.ltms.fleet.health.FleetHealthMonitor} would classify that as
+     * {@code DELEGATION_ORPHANED} on nothing more than an active, healthy conversation. {@link
+     * #abandon(String, String, boolean)}'s {@code sweepAsking} path fixes the actual reachable gap
+     * (a target torn down for good while genuinely {@code ASKING}) at the point of teardown itself,
+     * by completing the task's future right there — so by the time this method would ever see it,
+     * {@code task.future.isDone()} is already {@code true} and it is excluded regardless of this
+     * guard. Widening this check instead of that one would trade a real fix for false positives on
+     * every ordinary in-flight question.
      */
     public boolean hasOrphanedDelegation(String target) {
         if (target == null || hasAcceptedDelivery(target) || hasQueuedDelivery(target)) {
@@ -580,6 +592,39 @@ public final class MessageService {
      *         reply — see the note above)
      */
     public boolean abandon(String target, String reason) {
+        return abandon(target, reason, false);
+    }
+
+    /**
+     * As {@link #abandon(String, String)}, with control over whether a task still paused in
+     * {@code fleet_ask} ({@link Phase#ASKING}) is swept too (fleetd #275).
+     *
+     * <p>{@code sweepAsking} must be {@code true} only when the caller has independent, certain
+     * knowledge that {@code target} can never resume its turn — today that is only
+     * {@code sessions.onRelease}'s teardown (an explicit {@code fleet_stop}, or the idle reaper):
+     * the worker's pane is being stopped right now, so whatever it was mid-{@code fleet_ask} about
+     * has no turn left to resume into. {@link dev.ltms.fleet.health.FleetHealthMonitor}'s
+     * health-classification call keeps passing {@code false} (via {@link #abandon(String, String)}):
+     * a GONE/NEVER_READY reading is the daemon's best guess from the live agent list, not a teardown
+     * it performed itself, and {@code abandonDoesNotFailAnAsyncTicketWaitingForAnAnswer} documents
+     * why an active ask must survive that guess — the primary may already be mid-{@link #answer} for
+     * the very same turn, and completing it here first would preempt a real answer with a misleading
+     * failure.
+     *
+     * <p><strong>Without {@code sweepAsking} on the release path, a target torn down while
+     * genuinely {@code ASKING} was unrecoverable.</strong> {@link #resolveQuestion} had already
+     * closed the forward waiter the instant the question surfaced (so the {@code waiter} branch
+     * below finds nothing to fail), the {@code question == null} guard excluded the task from
+     * {@code matching} (so the loop below skipped it too), and the worker's own {@code fleet_ask}
+     * clears {@link Task#question} back to {@code null} only once it lapses (the reverse-rendezvous
+     * window — up to {@code FleetMcp.ASK_DEFAULT_TIMEOUT_MS} / {@code FleetApp.MAX_ASK_TIMEOUT_MS},
+     * 55–115s) — by which point the released session no longer appears in {@code sessions.roster()}
+     * for {@link dev.ltms.fleet.health.FleetHealthMonitor} to ever re-observe, so nothing was ever
+     * left to call {@link #abandon} on this target again. The ticket then sat in {@link #tasks}
+     * forever: not terminal, so {@link #pruneTerminalTickets} never dropped it, and
+     * {@code fleet_poll} reported it stuck at {@link Phase#PENDING} for good.
+     */
+    public boolean abandon(String target, String reason, boolean sweepAsking) {
         boolean hadStrandedReply = hasStrandedReply(target);
         // CB-640: the session is gone — nothing will ever accept or deliver into it now.
         strandedReplies.remove(target);
@@ -590,7 +635,8 @@ public final class MessageService {
 
         List<Task> matching = new ArrayList<>();
         for (Task task : tasks.values()) {
-            if (target.equals(task.target) && task.question == null && !task.future.isDone()) {
+            if (target.equals(task.target) && (sweepAsking || task.question == null)
+                    && !task.future.isDone()) {
                 matching.add(task);
             }
         }
@@ -607,11 +653,20 @@ public final class MessageService {
         for (Task task : matching) {
             boolean isRecovery = task == recoveryTask && recovered != null;
             Reply outcome = isRecovery ? recovered : new Reply(Outcome.WORKER_FAILED, reason);
+            String turnId = task.turnId;
             if (task.future.complete(outcome)) {
                 if (outcome.outcome() == Outcome.WORKER_FAILED) {
                     asyncFailed = true;
-                } else if (task.turnId != null) {
-                    asyncTasksByTurn.remove(task.turnId, task);
+                }
+                if (turnId != null) {
+                    // #275: whether this task was swept out of ASKING or was already answered and
+                    // only waiting on its resumed turn's real reply (#137), nothing will ever
+                    // complete this turnId now — drop it from this class's own bookkeeping AND the
+                    // reverse-rendezvous itself, so hasAsyncQuestion(target) stops reporting a turn
+                    // that is actually done, and a late answer() sees it as lapsed rather than
+                    // resolving a question nothing is listening for any more.
+                    asyncTasksByTurn.remove(turnId, task);
+                    rendezvous.closeAsk(turnId);
                 }
             } else if (isRecovery) {
                 // The recovered reply was already drained out of the inbox, but this task resolved
@@ -872,7 +927,16 @@ public final class MessageService {
         }
         try {
             CompletableFuture<Rendezvous.Resolution> reply = rendezvous.open(workerSession);
+            // #282: mirror send()'s registration (:802) so a SECOND fleet_ask inside this same
+            // resumed turn can re-associate the async ticket with its new turnId via
+            // markAsyncQuestion — without this, that second ask has no Task to attach to, and
+            // markAsyncQuestion silently returns null.
+            Task task = asyncTasksByTurn.get(turnId);
+            if (task != null) {
+                asyncTasksByWaiter.put(reply, task);
+            }
             if (!rendezvous.answerAsk(turnId, content)) {
+                asyncTasksByWaiter.remove(reply);
                 rendezvous.close(workerSession, reply);
                 return new Reply(Outcome.STALE_TURN, null); // lapsed between the lookup and the unblock
             }
@@ -880,7 +944,21 @@ public final class MessageService {
             try {
                 Rendezvous.Resolution r = reply.get(remainingMillis(deadlineNanos), TimeUnit.MILLISECONDS);
                 Reply result = new Reply(outcomeOf(r.kind()), r.text(), r.turnId());
-                finishAsyncTask(turnId, result);
+                // #282: this waiter can resolve with a FRESH question rather than a terminal reply —
+                // the worker chained a second fleet_ask before replying. Mirror sendAsync's own guard
+                // (:1000) and leave the ticket open (markAsyncQuestion above already re-armed it under
+                // the new turnId) instead of completing it here with a QUESTION "reply".
+                // Measured when #282 was merged: this guard is DEFENCE IN DEPTH, not the thing
+                // that makes the chained ask work. ask() calls markAsyncQuestion (:860) before
+                // resolveQuestion (:861), so by the time this thread wakes, the task has already
+                // moved to the new turnId and finishAsyncTask(oldTurnId, ...) finds nothing. Removing
+                // this guard alone leaves the test green. Keep it anyway: it mirrors sendAsync's
+                // sibling guard, and that sibling's own comment (:1017) warns the two orderings are
+                // not something to rely on. Do NOT delete it as dead code without re-checking that
+                // ordering, and do not treat it as the sole protection either.
+                if (result.outcome() != Outcome.QUESTION) {
+                    finishAsyncTask(turnId, result);
+                }
                 return result;
             } catch (TimeoutException e) {
                 // The worker resumed but hasn't replied yet — no completion fallback arms an answered
@@ -893,6 +971,7 @@ public final class MessageService {
                 Thread.currentThread().interrupt();
                 throw new IllegalStateException("interrupted awaiting reply from " + workerSession, e);
             } finally {
+                asyncTasksByWaiter.remove(reply);
                 rendezvous.close(workerSession, reply);
             }
         } finally {
@@ -1051,9 +1130,16 @@ public final class MessageService {
     private Task markAsyncQuestion(CompletableFuture<Rendezvous.Resolution> waiter, String text, String turnId) {
         Task task = waiter == null ? null : asyncTasksByWaiter.get(waiter);
         if (task != null) {
+            String previousTurnId = task.turnId;
             task.question = new Reply(Outcome.QUESTION, text, turnId);
             task.turnId = turnId;
             asyncTasksByTurn.put(turnId, task);
+            // #282: a second fleet_ask in the same resumed turn re-arms an already-answered task
+            // (answer() re-registers it in asyncTasksByWaiter) under a FRESH turnId — drop the old
+            // key so asyncTasksByTurn does not keep growing by one stale entry per chained ask.
+            if (previousTurnId != null && !previousTurnId.equals(turnId)) {
+                asyncTasksByTurn.remove(previousTurnId, task);
+            }
         }
         return task;
     }

fleetd/src/main/java/dev/ltms/fleet/rest/FleetApp.java

@@ -47,6 +47,22 @@ import java.util.stream.Collectors;
  */
 public final class FleetApp {
 
+    /** The authorization action the matching route handler hands to {@link #allow}. */
+    static Authz.Action routeAction(String route) {
+        return switch (route) {
+            case "GET /metrics" -> Authz.Action.METRICS;
+            case "POST /members" -> Authz.Action.SPAWN;
+            case "DELETE /members/{paneId}" -> Authz.Action.STOP;
+            case "POST /sessions/{id}/message" -> Authz.Action.SEND;
+            case "POST /sessions/{id}/reply" -> Authz.Action.REPLY;
+            case "GET /sessions/{id}/replies" -> Authz.Action.DRAIN;
+            case "POST /sessions/{id}/ask" -> Authz.Action.ASK;
+            case "GET /sessions", "GET /agents", "GET /members", "GET /profiles",
+                    "GET /member-credentials", "GET /sessions/{id}/status", "GET /tasks/{ticket}" -> Authz.Action.READ;
+            default -> throw new IllegalArgumentException("route has no authorization gate: " + route);
+        };
+    }
+
     /** Default blocking window for a message; kept under typical HTTP idle timeouts. */
     private static final long DEFAULT_MESSAGE_TIMEOUT_MS = 25_000;
     private static final long MAX_MESSAGE_TIMEOUT_MS = 120_000;
@@ -222,7 +238,7 @@ public final class FleetApp {
 
     /** Prometheus scrape endpoint (CB-502). */
     private void metrics(Context ctx) {
-        if (!allow(ctx, Authz.Action.METRICS, null)) {
+        if (!allow(ctx, routeAction("GET /metrics"), null)) {
             return;
         }
         ctx.status(200).contentType("text/plain; version=0.0.4; charset=utf-8").result(metrics.render());
@@ -294,7 +310,7 @@ public final class FleetApp {
      * member workspace (they live on the member daemon only).
      */
     private void sessions(Context ctx) {
-        if (!allow(ctx, Authz.Action.READ, null)) {
+        if (!allow(ctx, routeAction("GET /sessions"), null)) {
             return;
         }
         List<Map<String, Object>> out = new ArrayList<>();
@@ -319,7 +335,7 @@ public final class FleetApp {
 
     /** Discovery: every agent herdr tracks, keyed by its Claude session UUID. */
     private void agents(Context ctx) {
-        if (!allow(ctx, Authz.Action.READ, null)) {
+        if (!allow(ctx, routeAction("GET /agents"), null)) {
             return;
         }
         ctx.status(200).json(Map.of("agents",
@@ -328,7 +344,7 @@ public final class FleetApp {
 
     /** CB-304: bridge-owned roster merged with live herdr status by paneId. */
     private void listMembers(Context ctx) {
-        if (!allow(ctx, Authz.Action.READ, null)) {
+        if (!allow(ctx, routeAction("GET /members"), null)) {
             return;
         }
         // CB-519: the registry key is a host-unique id, not the pane coordinate — join on terminal.
@@ -359,7 +375,7 @@ public final class FleetApp {
 
     /** The configured worker profiles and which one a no-argument spawn uses. */
     private void profiles(Context ctx) {
-        if (!allow(ctx, Authz.Action.READ, null)) {
+        if (!allow(ctx, routeAction("GET /profiles"), null)) {
             return;
         }
         ctx.status(200).json(Map.of(
@@ -376,7 +392,7 @@ public final class FleetApp {
      * name list, which is exactly what let the list drift silently behind the real policy.
      */
     private void memberCredentials(Context ctx) {
-        if (!allow(ctx, Authz.Action.READ, null)) {
+        if (!allow(ctx, routeAction("GET /member-credentials"), null)) {
             return;
         }
         MemberCredentialPolicyView view = memberCredentials.get();
@@ -396,7 +412,7 @@ public final class FleetApp {
      * the subscription boundary, 400 for an unknown profile.
      */
     private void spawnMember(Context ctx) {
-        if (!allow(ctx, Authz.Action.SPAWN, null)) {
+        if (!allow(ctx, routeAction("POST /members"), null)) {
             return;
         }
         String role = ctx.queryParam("role");
@@ -467,7 +483,7 @@ public final class FleetApp {
     /** Tear a worker down by pane id. */
     private void stopMember(Context ctx) {
         String paneId = ctx.pathParam("paneId");
-        if (!allow(ctx, Authz.Action.STOP, paneId)) {
+        if (!allow(ctx, routeAction("DELETE /members/{paneId}"), paneId)) {
             return;
         }
         sessions.release(paneId);
@@ -482,7 +498,7 @@ public final class FleetApp {
      */
     private void sendMessage(Context ctx) {
         String id = ctx.pathParam("id");
-        if (!allow(ctx, Authz.Action.SEND, id)) {
+        if (!allow(ctx, routeAction("POST /sessions/{id}/message"), id)) {
             return;
         }
         String content;
@@ -569,7 +585,7 @@ public final class FleetApp {
      */
     private void askMessage(Context ctx) {
         String id = ctx.pathParam("id");
-        if (!allow(ctx, Authz.Action.ASK, id)) {
+        if (!allow(ctx, routeAction("POST /sessions/{id}/ask"), id)) {
             return;
         }
         String question;
@@ -608,7 +624,7 @@ public final class FleetApp {
         // The rule that matters: a worker may reply only as itself. Over MCP this was already true
         // structurally (identity comes from the connection, never an argument); over REST the path
         // id was simply trusted, so this is where the invariant actually gets enforced.
-        if (!allow(ctx, Authz.Action.REPLY, id)) {
+        if (!allow(ctx, routeAction("POST /sessions/{id}/reply"), id)) {
             return;
         }
         String content;
@@ -629,7 +645,7 @@ public final class FleetApp {
      */
     private void drainReplies(Context ctx) {
         String id = ctx.pathParam("id");
-        if (!allow(ctx, Authz.Action.DRAIN, id)) {
+        if (!allow(ctx, routeAction("GET /sessions/{id}/replies"), id)) {
             return;
         }
         var replies = messages.drainReplies(id);
@@ -647,7 +663,7 @@ public final class FleetApp {
      */
     private void sessionStatus(Context ctx) {
         String id = ctx.pathParam("id");
-        if (!allow(ctx, Authz.Action.READ, id)) {
+        if (!allow(ctx, routeAction("GET /sessions/{id}/status"), id)) {
             return;
         }
         try {
@@ -672,7 +688,7 @@ public final class FleetApp {
 
     /** Poll an async (wait:false) delegation by ticket. 404 for an unknown/expired ticket. */
     private void taskStatus(Context ctx) {
-        if (!allow(ctx, Authz.Action.READ, null)) {
+        if (!allow(ctx, routeAction("GET /tasks/{ticket}"), null)) {
             return;
         }
         MessageService.TaskView v = messages.poll(ctx.pathParam("ticket"));

fleetd/src/main/java/dev/ltms/fleet/session/GitWorktrees.java

@@ -167,14 +167,64 @@ public final class GitWorktrees implements Worktrees {
         log.info("adding worktree branch={} path={} base={}", branch, wt, base);
         removeUserInfoFromHttpsOrigin(repoRoot);
         exec("git", "-C", repoRoot, "worktree", "add", wt, "-b", branch, base);
-        afterWorktreeAdded.accept(wt);
-        requireCredentialFreeHttpsOrigin(wt);
-        configureEnvironmentCredentialHelper(repoRoot, wt);
-        configureHttpsUrlRewriteForSshOrigin(repoRoot, wt);
-        isolateToolSurface(wt);
+        try {
+            afterWorktreeAdded.accept(wt);
+            requireCredentialFreeHttpsOrigin(wt);
+            configureEnvironmentCredentialHelper(repoRoot, wt);
+            configureHttpsUrlRewriteForSshOrigin(repoRoot, wt);
+            isolateToolSurface(wt);
+        } catch (RuntimeException e) {
+            cleanupAfterAddFailure(repoRoot, wt, branch, e);
+            throw e;
+        }
         return wt;
     }
 
+    /**
+     * {@code add()} has already created the worktree and its branch by the time any step from
+     * {@link #afterWorktreeAdded} through {@link #isolateToolSurface} can throw — including
+     * {@link #requireCredentialFreeHttpsOrigin}, an intended security refusal, not only an IO
+     * accident. Without this, {@code add()} never returns, so its caller
+     * ({@code SessionManager#acquireWithWorktree}) never receives a path to register or clean up:
+     * its local {@code path} stays null, the {@code if (path != null)} guard in its own catch block
+     * never runs, and the worktree directory and branch leak on disk forever with nothing tracking
+     * them (fleetd #274).
+     *
+     * <p>Reuses {@link #remove} — the same {@code git worktree remove --force} path every other
+     * cleanup exit in this class already goes through — rather than a bespoke removal. It
+     * additionally deletes {@code branch}: {@link #remove} alone deliberately leaves a released
+     * session's branch behind (a worker's branch is expected to outlive its worktree, for PRs and
+     * recovery), but a branch that never finished provisioning has no session, no PR, and nothing
+     * else pointing at it, so leaving it behind would just trade one leak for a smaller one. Forced
+     * (`-D`) because the branch is new and unmerged by construction. The worktree is removed first:
+     * a branch checked out by a worktree cannot be deleted until the worktree that holds it is gone.
+     *
+     * <p>Cleanup failure must never mask {@code original} — that is the exception that explains
+     * what actually went wrong — so a failure here is only logged, matching the pattern already
+     * used in {@code SessionManager#acquireWithWorktree}'s own catch block.
+     */
+    private void cleanupAfterAddFailure(String repoRoot, String worktreePath, String branch, RuntimeException original) {
+        log.warn("provisioning failed for branch={} path={}: {} — cleaning up before rethrowing",
+                branch, worktreePath, original.getMessage());
+        try {
+            remove(repoRoot, worktreePath);
+        } catch (RuntimeException cleanup) {
+            log.warn("failed to remove leaked worktree {} after provisioning error: {}",
+                    worktreePath, cleanup.getMessage());
+        }
+        try {
+            deleteBranch(repoRoot, branch);
+        } catch (RuntimeException cleanup) {
+            log.warn("failed to remove leaked branch {} after provisioning error: {}",
+                    branch, cleanup.getMessage());
+        }
+    }
+
+    @Override
+    public void deleteBranch(String repoRoot, String branch) {
+        exec("git", "-C", repoRoot, "branch", "-D", branch);
+    }
+
     /**
      * A linked worktree shares its primary checkout's git config. Remove HTTPS user info before
      * adding one, so a credential accidentally embedded in that config cannot reach the member.

fleetd/src/main/java/dev/ltms/fleet/session/SessionManager.java

@@ -334,7 +334,20 @@ public final class SessionManager implements TurnListener {
         // slot that no longer appears in the roster and can never be reclaimed.
         launcher.stop(paneId);
         if (removed != null && !preserveWorktree && removed.worktree() != null) {
-            worktrees.remove(worktrees.repoRoot(removed.cwd()), removed.worktree());
+            // fleetd #283: this is the one cleanup step in this method that used to be bare. By the
+            // time it runs, the registry entry, the retained handle, and the pane are all already
+            // gone — so a throw here (a stale index lock, a slow filesystem, `remove`'s own 30s exec
+            // timeout) must not escape release(): there is no retry path (a second stop on this
+            // paneId is a no-op), and the caller would otherwise see a "failed stop" for a session
+            // that is in fact fully torn down. Log and swallow, matching every sibling step above.
+            try {
+                worktrees.remove(worktrees.repoRoot(removed.cwd()), removed.worktree());
+            } catch (RuntimeException e) {
+                log.warn("failed to remove worktree {} for pane={} terminal={} after release: the "
+                        + "pane is already stopped and the session already deregistered, so this is "
+                        + "not retryable — the directory must be reclaimed manually: {}",
+                        removed.worktree(), paneId, removed.terminalId(), e.toString());
+            }
         }
     }
 
@@ -504,11 +517,26 @@ public final class SessionManager implements TurnListener {
             log.warn("spawn failed for profile={} role={} branch={} path={}: {}",
                     preResolvedProfile, memberRole, branch, path, e.getMessage());
             if (path != null) {
+                // fleetd #283: this catch covers every failure AFTER worktrees.add() returned —
+                // overlayParity, shareWithGroup, launcher.spawn itself — so by this point `branch`
+                // was actually created in git. #274 fixed the sibling failure INSIDE add() by having
+                // GitWorktrees.cleanupAfterAddFailure delete both the worktree and the branch it
+                // provisioned; this path removed only the worktree and left the branch orphaned. A
+                // spawn failure here is routine (a quarantined credential, a backend refusal), so
+                // every occurrence leaked a `worker/<slug>-<nonce>` branch nothing ever pointed at
+                // again. Reuse the same Worktrees.deleteBranch GitWorktrees already has, rather than
+                // a second copy of the git command. Best-effort and log-only, like the worktree
+                // removal right above it — neither cleanup step may mask the original exception.
                 try {
                     worktrees.remove(repoRoot, path);
                 } catch (RuntimeException cleanup) {
                     log.warn("failed to clean up worktree {} after spawn error: {}", path, cleanup.getMessage());
                 }
+                try {
+                    worktrees.deleteBranch(repoRoot, branch);
+                } catch (RuntimeException cleanup) {
+                    log.warn("failed to clean up branch {} after spawn error: {}", branch, cleanup.getMessage());
+                }
             }
             throw e;
         }

fleetd/src/main/java/dev/ltms/fleet/session/Worktrees.java

@@ -11,6 +11,15 @@ public interface Worktrees {
     /** git -C <repoRoot> worktree remove --force <path>. Idempotent (already-gone tolerated). */
     void remove(String repoRoot, String worktreePath);
 
+    /**
+     * git -C {@code repoRoot} branch -D {@code branch}. Force-deletes a branch that has no other
+     * owner — used only on the failed-provisioning path (fleetd #274, #283), never on a normal
+     * release: {@link SessionManager#release} deliberately leaves a released session's branch
+     * behind so a lead can still recover the work, and this method must never be called from
+     * that path.
+     */
+    void deleteBranch(String repoRoot, String branch);
+
     /**
      * True when the worktree holds uncommitted changes the bridge cannot see: tracked
      * modifications, staged files, or untracked files. {@code git status --porcelain} is the

fleetd/src/test/java/dev/ltms/fleet/FleetdBackendErrorSinkTest.java

@@ -226,4 +226,44 @@ class FleetdBackendErrorSinkTest {
         assertTrue(remaining.isPresent(), "two distinct targets must start a cool-off");
         assertEquals(1, leadClient.sendCount());
     }
+
+    @Test
+    @DisplayName("a backend-error session no longer blocks the real maxLoad spawn gate")
+    void backendErrorSessionDoesNotBlockFreshSpawnAtMaxLoad() {
+        SessionManager sessions = capacityLimitedSessions();
+        MemberSession failed = sessions.acquire("terra", null, null, null);
+
+        assertTrue(sessions.onBackendError(failed.terminalId(), "backend exited"));
+
+        MemberSession fresh = sessions.acquire("terra", null, null, null);
+        assertEquals("terra", fresh.profile(), "the real maxLoad gate grants a fresh spawn after a backend error");
+    }
+
+    @Test
+    @DisplayName("a failed session no longer blocks the real maxLoad spawn gate")
+    void failedSessionDoesNotBlockFreshSpawnAtMaxLoad() {
+        SessionManager sessions = capacityLimitedSessions();
+        MemberSession failed = sessions.acquire("terra", null, null, null);
+
+        sessions.onTurnFailed(failed.terminalId());
+
+        MemberSession fresh = sessions.acquire("terra", null, null, null);
+        assertEquals("terra", fresh.profile(), "the real maxLoad gate grants a fresh spawn after a failed turn");
+    }
+
+    private static SessionManager capacityLimitedSessions() {
+        FakeHerdr herdr = new FakeHerdr();
+        FleetConfig.Profile profile = new FleetConfig.Profile("terra", "http://gx00.gw:8000", "coder",
+                null, "FLEETD_WORKER_TOKEN", List.of("claude"), "tab", "fleetd-workers",
+                "w #{n}", null, null, null, null, null, null, null, 1.0f, 1);
+        Map<String, FleetConfig.Profile> profiles = Map.of("terra", profile);
+        ClaudeCodeLauncher adapter = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), profiles, "terra", _ -> "tok");
+        AtomicReference<SessionManager> sessionsRef = new AtomicReference<>();
+        CompositePeerLauncher workers = new CompositePeerLauncher(List.of(adapter), "terra", profiles,
+                PlacementPolicies.fixed(), name -> Fleetd.liveSessionCount(sessionsRef.get().roster(), name));
+        SessionManager sessions = new SessionManager(workers);
+        sessionsRef.set(sessions);
+        return sessions;
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/health/FleetHealthMonitorTest.java

@@ -24,7 +24,9 @@ import org.slf4j.LoggerFactory;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledFuture;
 import java.util.concurrent.ScheduledThreadPoolExecutor;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
@@ -434,4 +436,120 @@ class FleetHealthMonitorTest {
             logger.detachAppender(appender);
         }
     }
+
+    // --- fleetd #280: a GONE/NEVER_READY guess whose fleet_ask lapses AFTER the first sweep must
+    // still be swept, without ever reaching into a target that has since recovered or left the
+    // roster. See FleetHealthMonitor.recheckTerminalTarget's javadoc for the full reachability chain.
+
+    @Test void terminalTransitionSchedulesExactlyOneDelayedRecheck() {
+        ScheduledThreadPoolExecutor scheduler = new ScheduledThreadPoolExecutor(1);
+        FleetHealthMonitor monitor = monitor(new FakeHerdr(),
+                List.of(member("term_a", MemberSession.State.BUSY, 0, 0)), scheduler, () -> 1, 600,
+                (_, _) -> { });
+
+        monitor.reportTransition("term_a", HealthState.GONE);
+
+        // Driven via reportTransition directly (not tick()), so the queue holds only the recheck.
+        assertEquals(1, scheduler.getQueue().size());
+        ScheduledFuture<?> scheduled = (ScheduledFuture<?>) scheduler.getQueue().peek();
+        assertTrue(scheduled.getDelay(TimeUnit.SECONDS) > 100,
+                "the delay must clear the worst-case fleet_ask lapse window (up to 115s)");
+
+        // An unchanged tick must not queue a second one (CB-580's fire-once rule extends to this).
+        monitor.reportTransition("term_a", HealthState.GONE);
+        assertEquals(1, scheduler.getQueue().size());
+        monitor.stop();
+    }
+
+    @Test void recheckIsANoOpOnceTheTargetHasRecovered() {
+        RecordingFailTarget failTarget = new RecordingFailTarget();
+        FleetHealthMonitor monitor = monitorWith(failTarget);
+        monitor.reportTransition("term_a", HealthState.GONE);
+        assertEquals(1, failTarget.calls.size());
+
+        monitor.reportTransition("term_a", HealthState.IDLE); // recovered before the recheck fired
+        monitor.recheckTerminalTarget("term_a", HealthState.GONE);
+
+        assertEquals(1, failTarget.calls.size(), "a recovered target must not be reached into again");
+        monitor.stop();
+    }
+
+    @Test void recheckIsANoOpForATargetItNeverObserved() {
+        // Mirrors "left the roster": tick() prunes states.keySet() to the current roster on release
+        // (see FleetHealthMonitor.tick), so a target this monitor never recorded is the same case.
+        RecordingFailTarget failTarget = new RecordingFailTarget();
+        FleetHealthMonitor monitor = monitorWith(failTarget);
+
+        monitor.recheckTerminalTarget("term_never_seen", HealthState.GONE);
+
+        assertEquals(0, failTarget.calls.size(), "an untracked/released target must not be reached into");
+        monitor.stop();
+    }
+
+    /**
+     * The scenario from the ticket, end to end, driven through the real {@link MessageService}: a
+     * target's ask is still genuinely open when health first observes GONE (sweep must skip it,
+     * exactly as {@code abandonDoesNotFailAnAsyncTicketWaitingForAnAnswer} pins), the ask then lapses
+     * on its own, an unchanged tick still must not refire, and only the delayed recheck sweeps the
+     * now-lapsed ticket to FAILED.
+     */
+    @Test void delayedRecheckSweepsATicketWhoseAskLapsedAfterGoneWasFirstObserved() throws Exception {
+        FakeHerdr herdr = new FakeHerdr().withAgent("worker", "term_a", "pane-term_a", "tab_a")
+                .readText("$ prompt");
+        AgentControl agents = new AgentControl(herdr);
+        Rendezvous rendezvous = new Rendezvous();
+        Injector injector = new Injector(agents);
+        InMemoryReplyInbox inbox = new InMemoryReplyInbox();
+        inbox.own("term_a");
+        MessageService messages = new MessageService(agents, injector, rendezvous, inbox);
+        FleetHealthMonitor monitor = new FleetHealthMonitor(agents,
+                () -> List.of(member("term_a", MemberSession.State.READY, 0, 0)), messages,
+                new ScheduledThreadPoolExecutor(1), () -> 1, 60, 600, messages::abandon);
+
+        String ticket = messages.sendAsync("term_a", "task that asks");
+        long deadline = System.currentTimeMillis() + 2000;
+        while (!rendezvous.isWaiting("term_a") && System.currentTimeMillis() < deadline) {
+            Thread.sleep(5);
+        }
+        assertTrue(rendezvous.isWaiting("term_a"), "the async send should have opened its waiter");
+        injector.onStatus("term_a", AgentStatus.IDLE);    // deliver the task
+        injector.onStatus("term_a", AgentStatus.WORKING); // the worker picks it up
+
+        // The worker asks, with a short timeout so its own fleet_ask lapses quickly in test time.
+        CompletableFuture<MessageService.AskResult> ask = CompletableFuture.supplyAsync(
+                () -> messages.ask("term_a", "which config?", 200));
+        awaitPhase(messages, ticket, MessageService.Phase.ASKING);
+
+        monitor.reportTransition("term_a", HealthState.GONE);
+        assertEquals(MessageService.Phase.ASKING, messages.poll(ticket).phase(),
+                "the first sweep must not fail a ticket that is still genuinely being asked");
+
+        // The worker's own fleet_ask now lapses on its own — task.question clears to null.
+        assertEquals(MessageService.AskOutcome.TIMED_OUT, ask.get(5, TimeUnit.SECONDS).outcome());
+
+        // An unchanged tick still must not refire (CB-580).
+        monitor.reportTransition("term_a", HealthState.GONE);
+        assertEquals(MessageService.Phase.PENDING, messages.poll(ticket).phase());
+
+        // The delayed recheck scheduled for the original transition finally sweeps it.
+        monitor.recheckTerminalTarget("term_a", HealthState.GONE);
+        assertEquals(MessageService.Phase.FAILED, messages.poll(ticket).phase());
+
+        monitor.stop();
+    }
+
+    private static MessageService.TaskView awaitPhase(MessageService messages, String ticket,
+            MessageService.Phase phase) throws InterruptedException {
+        long deadline = System.currentTimeMillis() + 2000;
+        MessageService.TaskView view;
+        do {
+            view = messages.poll(ticket);
+            if (view.phase() == phase) {
+                return view;
+            }
+            Thread.sleep(5);
+        } while (System.currentTimeMillis() < deadline);
+        assertEquals(phase, view.phase());
+        return view;
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/herdr/FakeHerdr.java

@@ -7,6 +7,7 @@ import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.CopyOnWriteArrayList;
 
 /**
@@ -39,8 +40,12 @@ public final class FakeHerdr implements HerdrClient {
     private final Map<String, List<String>> extraTabs = new LinkedHashMap<>();
     private int agentNameTakenFor = 0;
     private int agentPaneBusyFor = 0;
+    private String agentStartErrorCode = null;
     private int workerTabPaneCount = 1;
     private String paneCloseErrorCode = null;
+    private final Map<String, String> paneCloseErrorCodeFor = new ConcurrentHashMap<>();
+    private String tabCloseErrorCode = null;
+    private final Map<String, String> tabCloseErrorCodeFor = new ConcurrentHashMap<>();
     private String agentSendErrorCode = null;
     private boolean noPanes = false;
     private volatile String agentStatus = "idle"; // steady-state agent.get status
@@ -80,18 +85,56 @@ public final class FakeHerdr implements HerdrClient {
         return this;
     }
 
+    /** Make every {@code agent.start} call fail with this herdr error code. */
+    public FakeHerdr agentStartFailsWith(String code) {
+        this.agentStartErrorCode = code;
+        return this;
+    }
+
     /** Make the worker tab (w9:t2) report this many panes in {@code tab.list} (default 1). */
     public FakeHerdr withWorkerTabPaneCount(int n) {
         this.workerTabPaneCount = n;
         return this;
     }
 
-    /** Make {@code pane.close} fail with this herdr error code. */
+    /** Make {@code pane.close} fail with this herdr error code, for every pane. */
     public FakeHerdr paneCloseFailsWith(String code) {
         this.paneCloseErrorCode = code;
         return this;
     }
 
+    /**
+     * Make {@code pane.close} fail with this herdr error code, but only for the given {@code
+     * pane_id} — every other pane's {@code pane.close} still succeeds. Unlike {@link
+     * #paneCloseFailsWith}, which fails every call regardless of which pane it targets, this lets a
+     * test reap/release several sessions at once and make exactly one of them fail to stop, so the
+     * others' teardown can be asserted to proceed normally (fleetd #290).
+     */
+    public FakeHerdr paneCloseFailsForPane(String paneId, String code) {
+        this.paneCloseErrorCodeFor.put(paneId, code);
+        return this;
+    }
+
+    /** Make {@code tab.close} fail with this herdr error code, for every tab. */
+    public FakeHerdr tabCloseFailsWith(String code) {
+        this.tabCloseErrorCode = code;
+        return this;
+    }
+
+    /**
+     * Make {@code tab.close} fail with this herdr error code, but only for the given {@code
+     * tab_id} — every other tab's {@code tab.close} still succeeds. The {@code tab.close}
+     * counterpart to {@link #paneCloseFailsForPane} (fleetd #290): lets a test make exactly one
+     * session's tab teardown fail while proving the rest of {@code stop()} — {@code
+     * releaseZdotdir}, and the caller's worktree removal — still runs (fleetd #293). Named "ForTab"
+     * rather than "ForPane" (unlike its sibling) because {@code tab.close} keys on {@code tab_id},
+     * not a pane id.
+     */
+    public FakeHerdr tabCloseFailsForTab(String tabId, String code) {
+        this.tabCloseErrorCodeFor.put(tabId, code);
+        return this;
+    }
+
     /**
      * Make {@code pane.list} report no panes at all — models a second herdr daemon (CB-185) that
      * simply does not host the pane a {@link PaneLocator} is searching for.
@@ -275,6 +318,10 @@ public final class FakeHerdr implements HerdrClient {
                                             + required + "`", "invalid_request", null);
                         }
                     }
+                    if (agentStartErrorCode != null) {
+                        throw new HerdrException("herdr error [" + agentStartErrorCode + "]: agent.start failed",
+                                agentStartErrorCode, null);
+                    }
                     long starts = calls.stream().filter(c -> c.method().equals("agent.start")).count();
                     if (starts <= agentPaneBusyFor) {
                         throw new HerdrException(
@@ -338,7 +385,17 @@ public final class FakeHerdr implements HerdrClient {
                             .formatted(workerTabPaneCount,
                                     seeded.isEmpty() ? "" : "," + String.join(",", seeded)));
                 }
-                case "tab.close" -> mapper.readTree("{\"type\":\"ok\"}");
+                case "tab.close" -> {
+                    Object tabIdParam = params instanceof Map<?, ?> m ? m.get("tab_id") : null;
+                    String perTabCode = tabIdParam == null ? null
+                            : tabCloseErrorCodeFor.get(String.valueOf(tabIdParam));
+                    String code = perTabCode != null ? perTabCode : tabCloseErrorCode;
+                    if (code != null) {
+                        throw new HerdrException("herdr error [" + code + "]: tab.close failed",
+                                code, null);
+                    }
+                    yield mapper.readTree("{\"type\":\"ok\"}");
+                }
                 case "pane.get" -> mapper.readTree("""
                         {"type":"pane_info","pane":{"pane_id":"w9:pW","workspace_id":"w9",
                           "tab_id":"w9:t2","agent_status":"idle"}}""");
@@ -360,9 +417,13 @@ public final class FakeHerdr implements HerdrClient {
                                   "foreground_processes":[]}}""");
                 }
                 case "pane.close" -> {
-                    if (paneCloseErrorCode != null) {
-                        throw new HerdrException("herdr error [" + paneCloseErrorCode + "]: pane.close failed",
-                                paneCloseErrorCode, null);
+                    Object paneIdParam = params instanceof Map<?, ?> m ? m.get("pane_id") : null;
+                    String perPaneCode = paneIdParam == null ? null
+                            : paneCloseErrorCodeFor.get(String.valueOf(paneIdParam));
+                    String code = perPaneCode != null ? perPaneCode : paneCloseErrorCode;
+                    if (code != null) {
+                        throw new HerdrException("herdr error [" + code + "]: pane.close failed",
+                                code, null);
                     }
                     yield mapper.readTree("{\"type\":\"ok\"}");
                 }

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpAuthzTest.java

@@ -24,8 +24,13 @@ import io.modelcontextprotocol.spec.McpSchema;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
 
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.LinkedHashSet;
 import java.util.Map;
 import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 import static org.junit.jupiter.api.Assertions.*;
 
@@ -44,6 +49,9 @@ import static org.junit.jupiter.api.Assertions.*;
  */
 class FleetMcpAuthzTest {
 
+    private static final Path MCP_SOURCE = Path.of("src/main/java/dev/ltms/fleet/mcp/FleetMcp.java");
+    private static final Pattern TOOL_REGISTRATION = Pattern.compile("tool\\(\\\"(fleet_[a-z_]+)\\\"");
+
     private final FakeHerdr herdr = new FakeHerdr();
     private final AgentControl agents = new AgentControl(herdr);
     private Metrics metrics;
@@ -201,6 +209,42 @@ class FleetMcpAuthzTest {
                 "a blank target is an absent target");
     }
 
+    @Test
+    void everyRegisteredToolHasItsHandlerActionPinned() {
+        Set<String> registered = toolsTheServerRegisters();
+        assertTrue(registered.size() >= 10,
+                "scraped only " + registered.size() + " tool registrations from FleetMcp (" + registered
+                        + "); the server registers eleven, so the tool(\"…\") scrape has stopped matching");
+        registered.forEach(tool -> assertDoesNotThrow(() -> FleetMcp.toolAction(tool, Map.of()),
+                () -> tool + " is registered but has no pinned authorization action"));
+
+        assertEquals(Authz.Action.SEND, FleetMcp.toolAction("fleet_send", Map.of()));
+        assertEquals(Authz.Action.REPLY, FleetMcp.toolAction("fleet_reply", Map.of()));
+        assertEquals(Authz.Action.ASK, FleetMcp.toolAction("fleet_ask", Map.of()));
+        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_status", Map.of()));
+        assertEquals(Authz.Action.DRAIN, FleetMcp.toolAction("fleet_ack", Map.of()));
+        assertEquals(Authz.Action.SPAWN, FleetMcp.toolAction("fleet_spawn", Map.of()));
+        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_list", Map.of()));
+        assertEquals(Authz.Action.STOP, FleetMcp.toolAction("fleet_stop", Map.of()));
+        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_profiles", Map.of()));
+        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_whoami", Map.of()));
+        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_poll", Map.of("ticket", "task")));
+        assertEquals(Authz.Action.DRAIN, FleetMcp.toolAction("fleet_poll", Map.of("target", "term_b")));
+    }
+
+    private static Set<String> toolsTheServerRegisters() {
+        try {
+            Matcher matcher = TOOL_REGISTRATION.matcher(Files.readString(MCP_SOURCE));
+            Set<String> tools = new LinkedHashSet<>();
+            while (matcher.find()) {
+                tools.add(matcher.group(1));
+            }
+            return tools;
+        } catch (Exception e) {
+            throw new AssertionError("could not scrape FleetMcp tool registrations", e);
+        }
+    }
+
     @Test
     void aWorkerMayNotDrainAnotherSessionsInboxByPolling() {
         FleetMcp m = mcp(true);

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpTest.java

@@ -31,6 +31,7 @@ import org.junit.jupiter.api.Test;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
+import java.util.EnumSet;
 import java.util.Set;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.TimeUnit;
@@ -604,6 +605,60 @@ class FleetMcpTest {
         assertTrue(out.contains("\"reclaimable\":0"), out);
     }
 
+    /**
+     * fleetd #284: {@code reclaimable} has exactly one definition, and this pins it over EVERY
+     * {@link MemberSession.State} — so a state added later cannot slip through unconsidered. Both
+     * views in a {@code fleet_list} response call {@link FleetMcp#reclaimable}, so they cannot
+     * drift apart.
+     *
+     * <p>{@code BACKEND_ERROR} and {@code FAILED} are NOT reclaimable on purpose. The ticket asked
+     * for them to be; that half of the ticket was wrong. Their seat is already out of
+     * {@code live}, so it is already in {@code free} — counting it here too would report the same
+     * seat twice.
+     */
+    @Test
+    void onlyReadyAndDoneSessionsAreReclaimable() {
+        Set<MemberSession.State> expected = EnumSet.of(MemberSession.State.READY, MemberSession.State.DONE);
+        for (MemberSession.State state : MemberSession.State.values()) {
+            MemberSession session = new MemberSession("p1", "term1", "ltms-local", null,
+                    "/tmp", null, 0L, 0L, 0, state, null, null);
+            assertEquals(expected.contains(state), FleetMcp.reclaimable(session, null),
+                    "state " + state + " must " + (expected.contains(state) ? "" : "not ")
+                            + "count as reclaimable");
+        }
+    }
+
+    /**
+     * fleetd #284, the operator-visible half. {@code liveCount} here is the value the real counter
+     * ({@code Fleetd.liveSessionCount}, proven against the actual spawn gate in
+     * {@code FleetdBackendErrorSinkTest}) produces for this roster: 0, because both sessions are
+     * terminal. What this test pins is what {@code fleet_list} says around it — the two seats show
+     * up once, in {@code free}, and are NOT counted a second time as {@code reclaimable}; neither
+     * is any member row; and both dead sessions are still listed so the lead can see why.
+     */
+    @Test
+    void terminalFailureSessionsFreeTheirSeatWithoutBeingCountedReclaimable() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        MemberSession backendError = sessions.acquire("ltms-local", null, null, null);
+        MemberSession failed = sessions.acquire("ltms-local", null, null, null);
+        assertTrue(sessions.onBackendError(backendError.terminalId(), "backend exited"));
+        sessions.onTurnFailed(failed.terminalId());
+
+        String out = textOf(FleetMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
+                sessions, null, new FleetMcp.CapacitySource(profile -> 0, profile -> 2,
+                () -> Set.of("ltms-local"), () -> 0), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), Map.of(), ""));
+
+        assertTrue(out.contains("\"free\":2"), "both seats are back: " + out);
+        assertTrue(out.contains("\"reclaimable\":0"),
+                "the freed seats must not be counted a second time as reclaimable: " + out);
+        assertFalse(out.contains("\"reclaimable\":true"),
+                "no member row may claim a seat the profile count says is not held: " + out);
+        assertTrue(out.contains("\"state\":\"backend_error\""), "the dead session stays visible: " + out);
+        assertTrue(out.contains("\"state\":\"failed\""), "the failed session stays visible: " + out);
+    }
+
     @Test
     void inertCapacitySourceOmitsCapacityBlock() {
         FakeHerdr h = new FakeHerdr();

fleetd/src/test/java/dev/ltms/fleet/member/ClaudeCodeLauncherTest.java

@@ -925,6 +925,71 @@ class ClaudeCodeLauncherTest {
         assertTrue(herdr.called("pane.close"), "stop via handle.id() must close the pane");
     }
 
+    /** A tab-placement launcher with {@code memberCredentials policy=allow-list} under a zsh shell — the
+     * combination that makes {@link HerdrPeerLauncher#spawn} generate a real ZDOTDIR, so {@code
+     * releaseZdotdir}'s effect (the directory's deletion) is observable from a test. */
+    private ClaudeCodeLauncher serviceWithAllowList(FakeHerdr herdr) {
+        FleetConfig.Profile cfg = new FleetConfig.Profile(
+                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
+                List.of("ccs", "ltms-local"), "tab", "fleetd-workers",
+                "worker: {profile} #{n}", null, null, null);
+        Supplier<FleetConfig.MemberCredentials> creds = () -> new FleetConfig.MemberCredentials(
+                FleetConfig.MemberCredentials.POLICY_ALLOW_LIST, List.of(), List.of(), null);
+        Function<String, String> env = name -> "SHELL".equals(name) ? "/bin/zsh" : null;
+        return new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
+                env, 0, System::currentTimeMillis, () -> { }, null, creds);
+    }
+
+    /**
+     * fleetd #293: {@code stop()} used to run {@code spaces.closeTab} bare — any non-{@code
+     * *_not_found} herdr error propagated straight out of {@code stop()}, skipping {@code
+     * releaseZdotdir} entirely (the pane was already closed by that point, so the tab-close failure
+     * is cosmetic, not a real teardown failure). Proves both halves of the fix: {@code stop()} no
+     * longer throws for this failure, and {@code releaseZdotdir} still runs — observed here by the
+     * generated ZDOTDIR actually being deleted, since {@code releaseZdotdir}'s last line is {@code
+     * EnvAllowListScrub.deleteRecursively(dir)}.
+     */
+    @Test
+    @SuppressWarnings("unchecked")
+    void stopStillReleasesZdotdirWhenCloseTabFailsWithANonNotFoundCode() {
+        FakeHerdr herdr = new FakeHerdr();
+        ClaudeCodeLauncher svc = serviceWithAllowList(herdr);
+        PeerHandle handle = svc.spawn(new SpawnRequest(null, null, null));
+        Map<String, Object> tabCreateParams = (Map<String, Object>) herdr.lastCall("tab.create").params();
+        Map<String, String> tabEnv = (Map<String, String>) tabCreateParams.get("env");
+        String zdotdir = tabEnv.get("ZDOTDIR");
+        assertNotNull(zdotdir, "policy=allow-list under a zsh shell must have generated a ZDOTDIR: " + tabEnv);
+        Path dir = Path.of(zdotdir);
+        assertTrue(Files.isDirectory(dir), "the generated ZDOTDIR must exist before stop(): " + dir);
+        herdr.tabCloseFailsForTab("w9:t2", "internal_error");
+
+        Logger logger = (Logger) LoggerFactory.getLogger(HerdrPeerLauncher.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            assertDoesNotThrow(() -> svc.stop(handle.id()),
+                    "fleetd #293: a failing tab.close is cosmetic — it must not propagate out of stop()");
+        } finally {
+            logger.detachAppender(appender);
+        }
+
+        assertTrue(herdr.called("tab.close"), "tab.close was still attempted");
+        assertFalse(Files.exists(dir),
+                "releaseZdotdir must still run and delete the generated ZDOTDIR despite the tab.close "
+                        + "failure: " + dir);
+        String warn = appender.list.stream()
+                .filter(e -> e.getLevel().equals(Level.WARN))
+                .map(ILoggingEvent::getFormattedMessage)
+                .filter(m -> m.contains("tab.close") && m.contains("w9:t2"))
+                .findFirst()
+                .orElse(null);
+        assertNotNull(warn, "the failing tab.close must be logged at WARN naming the tab id — a "
+                + "silently swallowed failure with no message is not an improvement. Log lines: "
+                + appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList());
+    }
+
     // --- CB-519: host-unique id, decoupled from the pane coordinate ------------------------------
 
     @Test
@@ -1100,7 +1165,8 @@ class ClaudeCodeLauncherTest {
     @Test
     void spawnLetsAnUnrelatedHerdrErrorPropagateUnchanged() {
         // Fix 1 must only special-case a "*_not_found" answer. Any other herdr failure keeps
-        // propagating as-is — this gate does not know how to recover from it.
+        // propagating as-is — this gate does not know how to recover from it. The pane still needs
+        // closing because spawn throws before it can return the pane id to a caller that could stop it.
         FakeHerdr herdr = new FakeHerdr();
         herdr.agentStatus("unknown");
         herdr.agentGetFailsWithAfter(0, "internal_error");
@@ -1117,8 +1183,27 @@ class ClaudeCodeLauncherTest {
                 () -> svc.spawn(new SpawnRequest(null, null, null)));
 
         assertEquals("internal_error", ex.code());
-        assertEquals(0, paneCloseCount(herdr, "w9:pRoot_1"),
-                "an error this gate does not recognize is not this gate's teardown to run");
+        assertEquals(1, paneCloseCount(herdr, "w9:pRoot_1"),
+                "the unchanged error leaves spawn without a pane id, so this gate closes its orphaned pane");
+    }
+
+    @Test
+    void panePlacementClosesTheSplitPaneWhenAgentStartFails() {
+        FakeHerdr herdr = new FakeHerdr().agentStartFailsWith("internal_error");
+        FleetConfig.Profile cfg = new FleetConfig.Profile(
+                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
+                List.of("claude"), "pane", "fleetd-workers", "w #{n}", null, null, null);
+        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(
+                new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
+
+        dev.ltms.fleet.herdr.HerdrException ex = assertThrows(
+                dev.ltms.fleet.herdr.HerdrException.class,
+                () -> svc.spawn(new SpawnRequest(null, null, null)));
+
+        assertEquals("internal_error", ex.code(), "agent.start failure propagates unchanged");
+        assertEquals(1, paneCloseCount(herdr, "w1:pSplit"),
+                "the pane split for a peer that never starts is closed instead of left orphaned");
     }
 
     // --- fleetd #176 fix 2: corroborated UNKNOWN refinement --------------------------------------
@@ -2742,4 +2827,126 @@ class ClaudeCodeLauncherTest {
                 "a WARN naming the cwd must fire when the profile sets no configDir: "
                         + appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList());
     }
+
+    // --- fleetd #285: seedTrustDialog under memberHerdrSocket --------------------------------------
+    //
+    // seedTrustDialog gated only on isProvisionedWorktree(cwd) and, being static, could not see
+    // memberHerdrSocketConfigured() at all — unlike its sibling writeCharterFile one method below,
+    // which already refuses the spawn when it cannot place the charter where a different-uid member
+    // can read it. Under memberHerdrSocket + configDir unset, seedTrustDialog wrote fleetd's OWN
+    // ~/.claude.json (the operator's real file) while believing it was seeding the member's. The fix
+    // makes the method an instance method so it can see memberHerdrSocketConfigured(), and applies
+    // the same "refuse, don't silently write somewhere wrong" rule writeCharterFile already uses.
+
+    @Test
+    void seedTrustDialogUnderMemberHerdrSocketSharesTheFileWithTheConfiguredGroup(
+            @TempDir Path configDir, @TempDir Path worktree, @TempDir Path worktreeRoot) throws Exception {
+        markAsProvisionedWorktree(worktree);
+        String group = currentUserGroup();
+        FakeHerdr herdr = new FakeHerdr();
+        // trustProfile always sets a bridge mcpUrl, so a reply charter is generated too, which
+        // means writeCharterFile ALSO runs under memberHerdrSocket and needs its own worktreeRoot —
+        // pass one so this test isolates the trust-seed behaviour instead of tripping that refusal.
+        FleetConfig.Profile cfg = trustProfile(configDir.toString(), worktree.toString());
+        serviceWithConfig(herdr, cfg, () -> configWithMemberHerdrSocket(worktreeRoot.toString(), group)).spawn();
+
+        Path claudeJson = configDir.resolve(".claude.json");
+        assertTrue(Files.exists(claudeJson), "still seeded into <configDir>/.claude.json under memberHerdrSocket");
+        JsonNode project = new ObjectMapper().readTree(claudeJson.toFile())
+                .path("projects").path(worktree.toString());
+        assertTrue(project.path("hasTrustDialogAccepted").asBoolean(false));
+
+        assertEquals("rw-r-----", PosixFilePermissions.toString(Files.getPosixFilePermissions(claudeJson)),
+                "under memberHerdrSocket the file must be shared group-readable, mirroring the "
+                        + "charter file's own per-file mode (fleetd #222) — a 0600 file (Claude "
+                        + "Code's own default) is unreadable by the member's different OS user");
+        String actualGroup = Files.getFileAttributeView(claudeJson, PosixFileAttributeView.class)
+                .readAttributes().group().getName();
+        assertEquals(group, actualGroup, "the file must be chgrp'd to the configured worktreeGroup");
+    }
+
+    /**
+     * The bug itself: {@code memberHerdrSocket} configured, {@code configDir} unset. Before the fix
+     * this wrote fleetd's own default {@code ~/.claude.json} (here redirected to {@code fakeHome} so
+     * a reintroduced bug still cannot touch the real operator file); after the fix it must refuse the
+     * spawn instead, naming {@code configDir} as the missing key, before the member is ever started.
+     */
+    @Test
+    void seedTrustDialogUnderMemberHerdrSocketRefusesWhenConfigDirUnset(
+            @TempDir Path fakeHome, @TempDir Path worktree) throws Exception {
+        markAsProvisionedWorktree(worktree);
+        String originalHome = System.getProperty("user.home");
+        System.setProperty("user.home", fakeHome.toString());
+        try {
+            FakeHerdr herdr = new FakeHerdr();
+            FleetConfig.Profile cfg = trustProfile(null, worktree.toString());
+            ClaudeCodeLauncher launcher = serviceWithConfig(herdr, cfg,
+                    () -> configWithMemberHerdrSocket(null, "some-group"));
+
+            IllegalStateException ex = assertThrows(IllegalStateException.class, launcher::spawn,
+                    "memberHerdrSocket + no configDir must refuse the spawn, not write fleetd's own "
+                            + "default ~/.claude.json");
+            assertTrue(ex.getMessage().contains("configDir"),
+                    "the refusal must name the missing config key — got: " + ex.getMessage());
+            assertFalse(Files.exists(fakeHome.resolve(".claude.json")),
+                    "nothing may be written to fleetd's own default home — this is the exact fleetd "
+                            + "#285 defect: writing the operator's own home instead of the member's");
+            assertFalse(herdr.called("agent.start"),
+                    "the spawn must be refused BEFORE the member is ever started — got calls: " + herdr.calls);
+        } finally {
+            System.setProperty("user.home", originalHome);
+        }
+    }
+
+    /**
+     * {@code configDir} alone is not enough — without {@code worktreeGroup} the file fleetd writes
+     * stays {@code 0600} and the member's different OS user still cannot read it, so this must also
+     * refuse, naming {@code worktreeGroup} this time.
+     */
+    @Test
+    void seedTrustDialogUnderMemberHerdrSocketRefusesWhenWorktreeGroupUnset(
+            @TempDir Path configDir, @TempDir Path worktree) throws Exception {
+        markAsProvisionedWorktree(worktree);
+        FakeHerdr herdr = new FakeHerdr();
+        FleetConfig.Profile cfg = trustProfile(configDir.toString(), worktree.toString());
+        ClaudeCodeLauncher launcher = serviceWithConfig(herdr, cfg,
+                () -> configWithMemberHerdrSocket(null, null));
+
+        IllegalStateException ex = assertThrows(IllegalStateException.class, launcher::spawn,
+                "memberHerdrSocket + no worktreeGroup must refuse the spawn, not write an unreadable file");
+        assertTrue(ex.getMessage().contains("worktreeGroup"),
+                "configDir alone is not enough — got: " + ex.getMessage());
+        assertFalse(Files.exists(configDir.resolve(".claude.json")),
+                "nothing may be written when the file cannot be shared with the member's group");
+        assertFalse(herdr.called("agent.start"),
+                "the spawn must be refused BEFORE the member is ever started");
+    }
+
+    /**
+     * Regression proof: with {@code memberHerdrSocket} ABSENT — even given a LIVE, non-null {@code
+     * config} supplier (not merely {@code config == null}, which every other seedTrustDialog test in
+     * this file already exercises) — the write must stay byte-identical to before this fix: existing
+     * {@code 0600} permissions preserved, no chgrp/chmod attempted. This is the proof the ticket asks
+     * for: the path the whole live fleet uses today is unchanged by this fix.
+     */
+    @Test
+    void seedTrustDialogPreservesExisting0600PermissionsWhenMemberHerdrSocketAbsentEvenWithALiveConfigSupplier(
+            @TempDir Path configDir, @TempDir Path worktree) throws Exception {
+        markAsProvisionedWorktree(worktree);
+        Path claudeJson = configDir.resolve(".claude.json");
+        Files.writeString(claudeJson, "{}");
+        assumeTrue(Files.getFileAttributeView(claudeJson, PosixFileAttributeView.class) != null,
+                "no POSIX permissions on this filesystem — skipping rather than failing");
+        Files.setPosixFilePermissions(claudeJson, PosixFilePermissions.fromString("rw-------"));
+
+        FakeHerdr herdr = new FakeHerdr();
+        FleetConfig.Profile cfg = trustProfile(configDir.toString(), worktree.toString());
+        FleetConfig config = new FleetConfig(null, null, null, Map.of(), null, null, null, null, null,
+                null, null, null, null, null, null, null, null, null, null, null, null, null).withDefaults();
+        serviceWithConfig(herdr, cfg, () -> config).spawn();
+
+        assertEquals("rw-------", PosixFilePermissions.toString(Files.getPosixFilePermissions(claudeJson)),
+                "with memberHerdrSocket absent — even given a live config supplier — the seed must "
+                        + "stay byte-identical to before this fix: no chgrp/chmod attempted");
+    }
 }

fleetd/src/test/java/dev/ltms/fleet/member/HerdrPeerLauncherAllowListWiringTest.java

@@ -250,6 +250,57 @@ class HerdrPeerLauncherAllowListWiringTest {
                         + appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList());
     }
 
+    /**
+     * fleetd #269 follow-up: the same overclaim the WARN in {@code logCredentialGap} was fixed for,
+     * in the INFO line beside it. With {@code memberHerdrSocket} configured, member panes are routed
+     * to a second herdr whose environment fleetd has no channel to inspect, so the counts come from
+     * fleetd's OWN environment. The bare line "member credentials: allowed 1 of 3" reads as a fact
+     * about the member's pane, and there it is not one.
+     *
+     * <p>#269 reworded four sites and stopped at the sibling below; this pins the pair together so
+     * a future edit cannot fix one and leave the other. Real path: asserted after a real {@link
+     * HerdrPeerLauncher#spawn}, reading the log production actually emits.
+     */
+    @Test
+    void theAllowedCountLineSaysWhoseEnvironmentItCountedWhenMemberHerdrSocketIsSet(@TempDir Path worktreeRoot)
+            throws IOException {
+        String group = currentUserGroup();
+        FakeHerdr herdr = new FakeHerdr();
+        Set<String> hostEnvNames = Set.of(INJECTED, "SOME_UNRELATED_NAME", "ANOTHER_UNRELATED_NAME");
+        WiringLauncher launcher = new WiringLauncher(herdr, allowList(), "/bin/bash-should-be-ignored",
+                () -> hostEnvNames,
+                () -> configWithMemberHerdrSocketRootAndGroup("/tmp/other-user-herdr.sock", "/bin/zsh",
+                        worktreeRoot.toString(), group));
+
+        Logger logger = (Logger) LoggerFactory.getLogger(HerdrPeerLauncher.class);
+        Level original = logger.getLevel();
+        logger.setLevel(Level.INFO);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            launcher.spawn(new SpawnRequest("test", null, null, null, null, MemberRole.DEV));
+        } finally {
+            logger.detachAppender(appender);
+            logger.setLevel(original);
+        }
+
+        List<String> lines = appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList();
+        String coverage = lines.stream()
+                .filter(l -> l.startsWith("member credentials: allowed "))
+                .findFirst()
+                .orElse(null);
+        assertNotNull(coverage, "the coverage line must still be logged — narrowing the claim must "
+                + "not silently delete the line: " + lines);
+        assertTrue(coverage.contains("fleetd's OWN environment"),
+                "the line must say whose environment it counted: " + coverage);
+        assertTrue(coverage.contains("NOT the member pane's"),
+                "and must say plainly that it is not the member's: " + coverage);
+        // The counts themselves stay real — narrowing the claim must not turn them into constants.
+        assertTrue(coverage.startsWith("member credentials: allowed 1 of 3"),
+                "the real counts must survive the rewording: " + coverage);
+    }
+
     /**
      * Lead-review fix: on a NON-zsh shell no scrub ever runs (bash ignores {@code ZDOTDIR}), so the
      * "allowed N of M" line — which describes what the scrub does — must not be printed there either.

fleetd/src/test/java/dev/ltms/fleet/msg/MessageServiceTest.java

@@ -828,6 +828,56 @@ class MessageServiceTest {
         assertEquals(MessageService.Outcome.REPLIED, answer.get(5, TimeUnit.SECONDS).outcome());
     }
 
+    // --- fleetd #275: a target torn down FOR GOOD while genuinely ASKING must not orphan --------
+    //
+    // sessions.onRelease (fleet_stop, or the idle reaper) is the one abandon() caller that knows
+    // for certain the target can never resume: its pane is being stopped right now. Unlike the
+    // health-classification caller above (a GONE/NEVER_READY guess, not a teardown it performed),
+    // it must sweep an ASKING ticket right here — see MessageService.abandon(String, String,
+    // boolean)'s javadoc for the full reachability chain this closes: without this, the forward
+    // waiter is already closed by the time the question surfaces, the ASKING guard skips the task,
+    // and by the time the worker's own fleet_ask lapses (~55-115s later) the released session no
+    // longer appears in FleetHealthMonitor's roster for anything to ever sweep it again — leaving
+    // fleet_poll{ticket} stuck PENDING forever.
+
+    @Test
+    void abandonWithSweepAskingFailsATornDownTargetsAskingTicket() throws Exception {
+        String ticket = messages.sendAsync(T, "task that asks");
+        awaitWaiting();
+        injectDelivery();
+
+        CompletableFuture<MessageService.AskResult> ask =
+                CompletableFuture.supplyAsync(() -> messages.ask(T, "which config?", 300));
+        MessageService.TaskView asking = awaitTicketPhase(ticket, MessageService.Phase.ASKING);
+
+        assertTrue(messages.abandon(T, "the worker session was released before it replied", true),
+                "a released target's open ask can never resume, so it must fail right here");
+
+        MessageService.TaskView failed = awaitTicketPhase(ticket, MessageService.Phase.FAILED);
+        assertEquals("the worker session was released before it replied", failed.detail());
+
+        // The reverse-rendezvous ask is torn down too: the worker's still-blocked fleet_ask rides
+        // out its own timeout (nothing completed its answer future), and a late answer() for the
+        // same turnId must see it as lapsed rather than resolving a question nobody is waiting on.
+        assertEquals(MessageService.AskOutcome.TIMED_OUT, ask.get(5, TimeUnit.SECONDS).outcome());
+        assertEquals(MessageService.Outcome.STALE_TURN,
+                messages.answer(asking.turnId(), "config.yaml", 200).outcome());
+    }
+
+    @Test
+    void abandonWithoutSweepAskingBehavesLikeTheTwoArgOverload() throws Exception {
+        String ticket = messages.sendAsync(T, "task that asks");
+        awaitWaiting();
+        injectDelivery();
+
+        CompletableFuture.supplyAsync(() -> messages.ask(T, "which config?", 5000));
+        awaitTicketPhase(ticket, MessageService.Phase.ASKING);
+
+        assertFalse(messages.abandon(T, "agent target term_a not found", false),
+                "sweepAsking=false must match the plain abandon(target, reason) overload");
+        assertEquals(MessageService.Phase.ASKING, messages.poll(ticket).phase());
+    }
+
     // --- #137: a fleet_ask round-trip must not orphan the ticket's own reply -------------------
     //
     // The primary's fleet_send{turnId} answer call is itself bounded (a real MCP call, capped well
@@ -925,6 +975,64 @@ class MessageServiceTest {
         assertEquals(MessageService.Outcome.REPLIED, answer.get(5, TimeUnit.SECONDS).outcome());
     }
 
+    /**
+     * fleetd #282: a worker that chains a SECOND {@code fleet_ask} inside the same resumed turn —
+     * before it ever calls {@code fleet_reply} — used to kill its own async ticket. {@code answer()}
+     * opens a fresh forward waiter but (unlike {@code send()}) never registered it in
+     * {@code asyncTasksByWaiter}, so the second ask's {@code markAsyncQuestion} found no {@code Task}
+     * to re-associate. That waiter still resolved with the second {@code QUESTION} once the worker
+     * asked again, and {@code answer()} completed the ticket's future with that QUESTION "reply"
+     * unconditionally — so {@code fleet_poll} reported FAILED while the worker was still alive and
+     * the primary was mid-conversation with it.
+     *
+     * <p>Driven entirely through {@code MessageService}'s public API (sendAsync/ask/answer/poll) —
+     * never by reaching into {@link Rendezvous} or the task maps directly, so this test cannot pass
+     * for a reason unrelated to the real bug.
+     */
+    @Test
+    void secondFleetAskInTheSameResumedTurnDoesNotKillTheAsyncTicket() throws Exception {
+        String ticket = messages.sendAsync(T, "task that asks twice");
+        awaitWaiting();
+
+        // The worker's first fleet_ask.
+        CompletableFuture<MessageService.AskResult> ask1 =
+                CompletableFuture.supplyAsync(() -> messages.ask(T, "Q1", 5000));
+        MessageService.TaskView asking1 = awaitTicketPhase(ticket, MessageService.Phase.ASKING);
+        assertEquals("Q1", asking1.reply());
+
+        // The primary answers it — answer() resumes the turn and blocks for what comes next.
+        CompletableFuture<MessageService.Reply> answer1 = CompletableFuture.supplyAsync(
+                () -> messages.answer(asking1.turnId(), "a1", 5000));
+        assertEquals("a1", ask1.get(5, TimeUnit.SECONDS).answer());
+
+        // Still in the SAME resumed turn — before replying — the worker asks again.
+        CompletableFuture<MessageService.AskResult> ask2 =
+                CompletableFuture.supplyAsync(() -> messages.ask(T, "Q2", 5000));
+
+        // answer1's own call unblocks with the second QUESTION (documented QUESTION-chaining
+        // behaviour — see FleetMcp.answer's javadoc: "Answer it by calling fleet_send again with
+        // turnId=..."). The bug: this used to also kill the async ticket in the process.
+        MessageService.Reply firstAnswerResult = answer1.get(5, TimeUnit.SECONDS);
+        assertEquals(MessageService.Outcome.QUESTION, firstAnswerResult.outcome());
+        String turnId2 = firstAnswerResult.turnId();
+
+        MessageService.TaskView asking2 = awaitTicketPhase(ticket, MessageService.Phase.ASKING);
+        assertEquals("Q2", asking2.reply(),
+                "the ticket must surface the SECOND question, not be dead/FAILED");
+        assertEquals(turnId2, asking2.turnId());
+
+        // The primary answers the second question; the worker finally sends its real fleet_reply.
+        CompletableFuture<MessageService.Reply> answer2 = CompletableFuture.supplyAsync(
+                () -> messages.answer(turnId2, "a2", 5000));
+        assertEquals("a2", ask2.get(5, TimeUnit.SECONDS).answer());
+        awaitWaiting();
+        assertTrue(rendezvous.resolve(T, "done"));
+        assertEquals(MessageService.Outcome.REPLIED, answer2.get(5, TimeUnit.SECONDS).outcome());
+
+        MessageService.TaskView done = awaitTicketPhase(ticket, MessageService.Phase.DONE);
+        assertEquals("done", done.reply());
+    }
+
     // --- CB-582: fleet_status pendingAsk() ------------------------------------------------------
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/rest/FleetAppAuthTest.java

@@ -1,6 +1,7 @@
 package dev.ltms.fleet.rest;
 
 import dev.ltms.fleet.auth.CallerResolver;
+import dev.ltms.fleet.auth.Authz;
 import dev.ltms.fleet.auth.MemberRegistry;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.guard.SubscriptionGuard;
@@ -25,8 +26,15 @@ import java.net.URI;
 import java.net.http.HttpClient;
 import java.net.http.HttpRequest;
 import java.net.http.HttpResponse;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.LinkedHashSet;
+import java.util.Locale;
 import java.util.Map;
 import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import java.util.stream.Collectors;
 
 import static org.junit.jupiter.api.Assertions.*;
 
@@ -36,6 +44,10 @@ import static org.junit.jupiter.api.Assertions.*;
  */
 class FleetAppAuthTest {
 
+    private static final Path REST_SOURCE = Path.of("src/main/java/dev/ltms/fleet/rest/FleetApp.java");
+    private static final Pattern ROUTE_REGISTRATION =
+            Pattern.compile("app\\.(get|post|delete|put|patch)\\(\\s*\"([^\"]+)\"");
+
     private final HttpClient http = HttpClient.newHttpClient();
     private Javalin app;
     private Metrics metrics;
@@ -92,6 +104,49 @@ class FleetAppAuthTest {
         return http.send(b.build(), HttpResponse.BodyHandlers.ofString());
     }
 
+    @Test
+    void everyRegisteredRouteHasItsHandlerActionPinned() {
+        Set<String> registered = routesTheServerRegisters();
+        assertTrue(registered.size() >= 15,
+                "scraped only " + registered.size() + " route registrations from FleetApp (" + registered
+                        + "); the app.<verb>(\"…\") scrape has stopped matching");
+        // Liveness must work before credentials can be checked, so this route is deliberately open.
+        assertTrue(registered.remove("GET /healthz"), "GET /healthz must stay an explicit ungated exception");
+        registered.forEach(route -> assertDoesNotThrow(() -> FleetApp.routeAction(route),
+                () -> route + " is registered but has no pinned authorization action"));
+        assertEquals(Authz.Action.METRICS, FleetApp.routeAction("GET /metrics"));
+        assertEquals(Authz.Action.SPAWN, FleetApp.routeAction("POST /members"));
+        assertEquals(Authz.Action.STOP, FleetApp.routeAction("DELETE /members/{paneId}"));
+        assertEquals(Authz.Action.SEND, FleetApp.routeAction("POST /sessions/{id}/message"));
+        assertEquals(Authz.Action.REPLY, FleetApp.routeAction("POST /sessions/{id}/reply"));
+        assertEquals(Authz.Action.DRAIN, FleetApp.routeAction("GET /sessions/{id}/replies"));
+        assertEquals(Authz.Action.ASK, FleetApp.routeAction("POST /sessions/{id}/ask"));
+        for (String route : Set.of("GET /sessions", "GET /agents", "GET /members", "GET /profiles",
+                "GET /member-credentials", "GET /sessions/{id}/status", "GET /tasks/{ticket}")) {
+            assertEquals(Authz.Action.READ, FleetApp.routeAction(route), route);
+        }
+        assertThrows(IllegalArgumentException.class, () -> FleetApp.routeAction("GET /healthz"));
+    }
+
+    private static Set<String> routesTheServerRegisters() {
+        try {
+            String source = Files.readString(REST_SOURCE).lines()
+                    .filter(line -> {
+                        String stripped = line.stripLeading();
+                        return !(stripped.startsWith("//") || stripped.startsWith("*") || stripped.startsWith("/*"));
+                    })
+                    .collect(Collectors.joining("\n"));
+            Matcher matcher = ROUTE_REGISTRATION.matcher(source);
+            Set<String> routes = new LinkedHashSet<>();
+            while (matcher.find()) {
+                routes.add(matcher.group(1).toUpperCase(Locale.ROOT) + " " + matcher.group(2));
+            }
+            return routes;
+        } catch (Exception e) {
+            throw new AssertionError("could not scrape FleetApp route registrations", e);
+        }
+    }
+
     // --- loopback-trust: the caller is the primary -------------------------------------------
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/session/FakeWorktrees.java

@@ -17,6 +17,9 @@ public final class FakeWorktrees implements Worktrees {
     public record RemoveCall(String repoRoot, String worktreePath) {
     }
 
+    public record DeleteBranchCall(String repoRoot, String branch) {
+    }
+
     public record OverlayCall(String repoRoot, String worktreePath,
                                List<String> requested, List<String> copied, List<String> skipWorktree) {
     }
@@ -35,6 +38,7 @@ public final class FakeWorktrees implements Worktrees {
 
     private final List<AddCall> addCalls = new CopyOnWriteArrayList<>();
     private final List<RemoveCall> removeCalls = new CopyOnWriteArrayList<>();
+    private final List<DeleteBranchCall> deleteBranchCalls = new CopyOnWriteArrayList<>();
     private final List<OverlayCall> overlayCalls = new CopyOnWriteArrayList<>();
     private final List<RepoRootCall> repoRootCalls = new CopyOnWriteArrayList<>();
     private final List<SnapshotCall> snapshotCalls = new CopyOnWriteArrayList<>();
@@ -51,6 +55,8 @@ public final class FakeWorktrees implements Worktrees {
     private final AtomicLong snapshotSeq = new AtomicLong();
     private volatile RuntimeException addFailure;
     private volatile RuntimeException snapshotFailure;
+    private volatile RuntimeException removeFailure;
+    private volatile RuntimeException overlayFailure;
     private volatile boolean dirty = false;
     private volatile String repoRoot = "/repo";
     private volatile String prefix = "/worktrees";
@@ -98,6 +104,21 @@ public final class FakeWorktrees implements Worktrees {
         return this;
     }
 
+    /** Make subsequent {@link #remove} calls throw (fleetd #283: a stale index lock, a slow
+     *  filesystem, or {@code remove}'s own 30s exec timeout escaping the last, previously bare,
+     *  step of {@link SessionManager#release}). */
+    public FakeWorktrees failRemove(String message) {
+        this.removeFailure = new WorktreeException(message);
+        return this;
+    }
+
+    /** Make subsequent {@link #overlayParity} calls throw (simulates a post-{@code add()} spawn
+     *  failure — fleetd #283 defect 2 — so the {@code acquireWithWorktree} catch runs). */
+    public FakeWorktrees failOverlay(String message) {
+        this.overlayFailure = new WorktreeException(message);
+        return this;
+    }
+
     /** Configure the value returned by {@link #wipRefs}. */
     public FakeWorktrees withWipRefs(WipRefStats stats) {
         this.wipRefs = stats;
@@ -132,6 +153,14 @@ public final class FakeWorktrees implements Worktrees {
     @Override
     public void remove(String repoRoot, String worktreePath) {
         removeCalls.add(new RemoveCall(repoRoot, worktreePath));
+        if (removeFailure != null) {
+            throw removeFailure;
+        }
+    }
+
+    @Override
+    public void deleteBranch(String repoRoot, String branch) {
+        deleteBranchCalls.add(new DeleteBranchCall(repoRoot, branch));
     }
 
     @Override
@@ -146,6 +175,9 @@ public final class FakeWorktrees implements Worktrees {
 
     @Override
     public void overlayParity(String repoRoot, String worktreePath, List<String> overlay) {
+        if (overlayFailure != null) {
+            throw overlayFailure;
+        }
         List<String> copied = new java.util.ArrayList<>();
         List<String> skipped = new java.util.ArrayList<>();
         for (String rel : overlay) {
@@ -218,6 +250,14 @@ public final class FakeWorktrees implements Worktrees {
         return removeCalls.isEmpty() ? null : removeCalls.getLast();
     }
 
+    public List<DeleteBranchCall> deleteBranchCalls() {
+        return List.copyOf(deleteBranchCalls);
+    }
+
+    public DeleteBranchCall lastDeleteBranch() {
+        return deleteBranchCalls.isEmpty() ? null : deleteBranchCalls.getLast();
+    }
+
     public OverlayCall lastOverlay() {
         return overlayCalls.isEmpty() ? null : overlayCalls.getLast();
     }

fleetd/src/test/java/dev/ltms/fleet/session/GitWorktreesTest.java

@@ -21,6 +21,7 @@ import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicReference;
 
 import static org.junit.jupiter.api.Assertions.*;
 
@@ -362,6 +363,46 @@ class GitWorktreesTest {
         assertEquals("worktree origin contains HTTPS user info; refusing provision", error.getMessage());
     }
 
+    /**
+     * fleetd #274. {@code add()} creates the worktree and its branch, then runs several more steps
+     * that can throw — {@code requireCredentialFreeHttpsOrigin} among them, an intended security
+     * refusal, not an IO accident. Before the fix, any exception from those later steps left
+     * {@code add()} never returning, so its caller never learned the path and the worktree
+     * directory plus its branch leaked on disk forever with nothing tracking them.
+     *
+     * <p>This drives the exact same {@code afterWorktreeAdded} test seam as
+     * {@link #provisioningRefusesAWorktreeWhoseOriginStillHasHttpsUserInfo} — a mutation applied
+     * right after {@code git worktree add}, so the step that throws
+     * ({@code requireCredentialFreeHttpsOrigin}, reached moments later inside {@code add()} itself)
+     * runs strictly after the worktree and branch already exist, not downstream of {@code add()}
+     * in some other caller. {@code afterWorktreeAdded} also hands back the created path, so the
+     * assertions below don't have to guess the generated nonce.
+     */
+    @Test
+    void addCleansUpTheWorktreeAndBranchWhenAPostCreationStepThrows(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));
+        git(repo, "remote", "add", "origin", "https://git.ltms.dev/akb/kb.git");
+        String branch = "cb-274-leak";
+        AtomicReference<String> createdPath = new AtomicReference<>();
+        GitWorktrees worktrees = new GitWorktrees(tmp.resolve("wts").toString(), worktreePath -> {
+            createdPath.set(worktreePath);
+            try {
+                git(Path.of(worktreePath), "remote", "set-url", "origin",
+                        "https://synthetic-test-token@git.ltms.dev/akb/kb.git");
+            } catch (Exception e) {
+                throw new RuntimeException(e);
+            }
+        });
+
+        assertThrows(WorktreeException.class, () -> worktrees.add(repo.toString(), branch, "HEAD"));
+
+        assertNotNull(createdPath.get(), "afterWorktreeAdded must have run with the created path");
+        assertFalse(Files.exists(Path.of(createdPath.get())),
+                "the worktree directory leaked after a post-creation step threw");
+        String heads = forEachRef(repo, "refs/heads/" + branch);
+        assertTrue(heads.isBlank(), "the branch leaked after a post-creation step threw:\n" + heads);
+    }
+
     // ---- CB-189: broader remote-URL coverage — every remote, both fetch and push URLs, any
     // non-SSH scheme. Reporting only, additive to the origin/https strip-and-refuse tests above. ----
 

fleetd/src/test/java/dev/ltms/fleet/session/SessionManagerTest.java

@@ -74,6 +74,7 @@ class SessionManagerTest {
      */
     private static final class RecordingWorktrees implements Worktrees {
         private final List<String> removeCalls = new java.util.ArrayList<>();
+        private final List<String> deleteBranchCalls = new java.util.ArrayList<>();
         private final List<String> snapshotCalls = new java.util.ArrayList<>();
         private final java.util.Set<String> failRemoveFor = new java.util.HashSet<>();
         private volatile boolean dirty = false;
@@ -114,6 +115,11 @@ class SessionManagerTest {
             removeCalls.add(worktreePath);
         }
 
+        @Override
+        public void deleteBranch(String repoRoot, String branch) {
+            deleteBranchCalls.add(branch);
+        }
+
         @Override
         public boolean hasUncommitted(String worktreePath) {
             if (hasUncommittedFailure != null) {
@@ -158,6 +164,10 @@ class SessionManagerTest {
             return List.copyOf(removeCalls);
         }
 
+        List<String> deleteBranchCalls() {
+            return List.copyOf(deleteBranchCalls);
+        }
+
         List<String> snapshotCalls() {
             return List.copyOf(snapshotCalls);
         }
@@ -989,8 +999,21 @@ class SessionManagerTest {
                         + "dirty check threw");
     }
 
+    /**
+     * fleetd #283 defect 1 changed this test's own premise, so its assertions are updated along
+     * with the production fix. Before #283, the middle session's worktree-removal failure escaped
+     * {@code release()} uncaught, and this test proved {@code reapIdle}'s own per-session try/catch
+     * (CB-581) kept the rest of the pass going regardless. Now that {@code release()} itself catches
+     * a worktree-removal failure (matching every sibling cleanup step in that method) and only logs
+     * a WARN, {@code release()} no longer throws for this reason — so all three idle sessions are
+     * released and counted, and the middle one's removal failure is now visible only as the WARN
+     * {@code release()} itself logs, not as a reap-loop catch. {@code reapIdle}'s own guard (for a
+     * failure {@code release()} still cannot swallow, e.g. from {@code launcher.stop}) is untouched
+     * by this ticket. This test no longer exercises that guard — reaching it now needs a failure
+     * that #283 does not catch inside {@code release()} itself.
+     */
     @Test
-    void reapIdleSurvivesOneSessionThatFailsToRelease() {
+    void reapIdleCountsAllThreeSessionsWhenOnlyItsWorktreeRemovalFails() {
         long[] clock = {0};
         FakeHerdr herdr = new FakeHerdr();
         RecordingWorktrees worktrees = new RecordingWorktrees();
@@ -1004,8 +1027,8 @@ class SessionManagerTest {
         sessions.asPresence().markPresent(a.terminalId());
         sessions.asPresence().markPresent(b.terminalId());
         sessions.asPresence().markPresent(c.terminalId());
-        // The middle session's worktree removal fails — release() propagates that, so this is the
-        // one call reapIdle's per-session guard must survive without skipping the rest of the pass.
+        // The middle session's worktree removal fails — fleetd #283 makes release() catch and log
+        // this itself, so it no longer propagates out of release() at all.
         worktrees.failRemoveFor(b.worktree());
 
         LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
@@ -1026,14 +1049,16 @@ class SessionManagerTest {
                     .map(ILoggingEvent::getFormattedMessage)
                     .filter(m -> m.contains(b.paneId()))
                     .findFirst()
-                    .orElse("no reap-failure WARN logged");
+                    .orElse("no worktree-removal-failure WARN logged");
             assertTrue(warn.contains(b.terminalId()), "the WARN names the failed session's terminal: " + warn);
             assertTrue(warn.contains(b.worktree()), "the WARN names the failed session's worktree: " + warn);
         } finally {
             sessionLog.detachAppender(appender);
         }
 
-        assertEquals(2, reaped, "the middle session's failure is logged, not counted as reaped");
+        assertEquals(3, reaped,
+                "fleetd #283: release() no longer throws for a worktree-removal failure, so reapIdle "
+                        + "counts all three idle sessions as reaped");
         assertTrue(sessions.get(a.paneId()).isEmpty(), "the first session is still released");
         assertTrue(sessions.get(c.paneId()).isEmpty(), "the third session is still released");
         assertTrue(sessions.get(b.paneId()).isEmpty(),
@@ -1044,6 +1069,79 @@ class SessionManagerTest {
         assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_3"), "the third pane is stopped");
     }
 
+    /**
+     * fleetd #290: the #283 fix above closed the one trigger this suite used for {@code
+     * reapIdle}'s own per-session try/catch (CB-581) — a worktree-removal failure is now caught
+     * and logged inside {@code release()} itself, so it never reaches {@code reapIdle}'s guard at
+     * all. This test restores coverage of that guard using the trigger the ticket names: {@code
+     * release()} calls {@code launcher.stop(paneId)} with no try/catch around it, so a failing
+     * {@code pane.close} propagates straight out of {@code release()} uncaught. {@link
+     * FakeHerdr#paneCloseFailsForPane} (added for this ticket) makes exactly the middle session's
+     * stop fail, while the other two still succeed, so this proves {@code reapIdle} keeps reaping
+     * the rest of the roster rather than aborting the whole pass.
+     */
+    @Test
+    void reapIdleSurvivesOneSessionWhoseLauncherStopFails() {
+        long[] clock = {0};
+        FakeHerdr herdr = new FakeHerdr();
+        RecordingWorktrees worktrees = new RecordingWorktrees();
+        SessionManager sessions = sessionManager(herdr, worktrees, () -> clock[0]);
+        MemberSession a = sessions.acquire("ltms-local", null, "/caller/proj", null,
+                new WorktreeRequest("cb-290a", null));
+        MemberSession b = sessions.acquire("ltms-local", null, "/caller/proj", null,
+                new WorktreeRequest("cb-290b", null));
+        MemberSession c = sessions.acquire("ltms-local", null, "/caller/proj", null,
+                new WorktreeRequest("cb-290c", null));
+        sessions.asPresence().markPresent(a.terminalId());
+        sessions.asPresence().markPresent(b.terminalId());
+        sessions.asPresence().markPresent(c.terminalId());
+        // Only the middle session's herdr pane fails to close — a and c stop normally. This is the
+        // trigger reapIdle's own guard is for, now that #283 closed the worktree-removal trigger.
+        herdr.paneCloseFailsForPane("w9:pRoot_2", "internal_error");
+
+        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
+        ch.qos.logback.classic.Logger sessionLog =
+                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(SessionManager.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.setContext(ctx);
+        appender.start();
+        sessionLog.addAppender(appender);
+        sessionLog.setLevel(Level.WARN);
+        int reaped;
+        try {
+            clock[0] = 100;
+            reaped = sessions.reapIdle(10);
+
+            String warn = appender.list.stream()
+                    .filter(e -> e.getLevel().equals(Level.WARN))
+                    .map(ILoggingEvent::getFormattedMessage)
+                    .filter(m -> m.contains("reap failed") && m.contains(b.paneId()))
+                    .findFirst()
+                    .orElse("no reap-failed WARN logged for the failing session");
+            assertTrue(warn.contains(b.terminalId()), "the WARN names the failed session's terminal: " + warn);
+        } finally {
+            sessionLog.detachAppender(appender);
+        }
+
+        assertEquals(2, reaped,
+                "the middle session's launcher.stop failure is not counted as reaped, but must not "
+                        + "abort reaping the other two");
+        assertTrue(sessions.get(a.paneId()).isEmpty(), "the first session is still released");
+        assertTrue(sessions.get(c.paneId()).isEmpty(),
+                "the third session is still reached and released — proves the pass did not abort "
+                        + "when the middle session's release() threw");
+        assertTrue(sessions.get(b.paneId()).isEmpty(),
+                "the middle session is still deregistered — release() removes it from the registry "
+                        + "before launcher.stop() runs, regardless of whether stop() then throws");
+        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_1"), "the first pane is stopped");
+        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_2"),
+                "the middle pane's stop was attempted, even though it failed");
+        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_3"), "the third pane is stopped");
+        assertEquals(List.of(a.worktree(), c.worktree()), worktrees.removeCalls().stream().sorted().toList(),
+                "the middle session's worktree removal never runs — release() throws before reaching "
+                        + "it — while the other two, unaffected, still have theirs removed");
+    }
+
     @Test
     void unchangedRegressionCleanCompletedReleaseStillRemovesTheWorktree() {
         FakeHerdr herdr = new FakeHerdr();
@@ -1058,6 +1156,41 @@ class SessionManagerTest {
                 "COMPLETED release of a clean worktree still removes it");
     }
 
+    /**
+     * fleetd #293: {@code HerdrPeerLauncher.stop()} used to run {@code spaces.closeTab} bare — a
+     * failing {@code tab.close} (any code other than {@code *_not_found}) propagated straight out
+     * of {@code stop()}. {@code SessionManager.release} calls {@code launcher.stop(paneId)} with
+     * no try/catch (fleetd #283 wrapped the WORKTREE-removal step further down, not this one), so
+     * the throw happened <em>before</em> that worktree-removal step ever ran — and by then {@code
+     * registry.remove(paneId)} had already run, so a second {@code stop} is a no-op: the worktree
+     * leaked with no retry path. The pane itself is already closed by the time {@code tab.close}
+     * runs, so its failure is cosmetic workspace tidying, not a real teardown failure. The fix
+     * wraps {@code closeTab} inside {@code stop()} so it no longer throws for this reason; this
+     * test proves both halves at once: {@code release()} does not throw, and it still removes the
+     * worktree.
+     */
+    @Test
+    void releaseStillRemovesTheWorktreeWhenCloseTabFails() {
+        FakeHerdr herdr = new FakeHerdr();
+        RecordingWorktrees worktrees = new RecordingWorktrees();
+        SessionManager sessions = sessionManager(herdr, worktrees);
+        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
+                new WorktreeRequest("cb-293a", null));
+        // FakeHerdr's pane.get always answers with tab_id "w9:t2" for a tab-placement spawn.
+        herdr.tabCloseFailsForTab("w9:t2", "internal_error");
+
+        assertDoesNotThrow(() -> sessions.release(s.paneId()),
+                "a failing tab.close is cosmetic (the pane is already closed by then) — it must not "
+                        + "propagate out of release()");
+
+        assertTrue(herdr.called("tab.close"), "tab.close was still attempted");
+        assertEquals(List.of(s.worktree()), worktrees.removeCalls(),
+                "release() must still remove the worktree even though tab.close failed — this is "
+                        + "the leak fleetd #293 reports: before the fix, release() never reached this "
+                        + "step at all");
+        assertTrue(sessions.get(s.paneId()).isEmpty(), "the session is still deregistered");
+    }
+
     @Test
     void unchangedRegressionDirtyCompletedReleaseStillPreservesTheWorktree() {
         FakeHerdr herdr = new FakeHerdr();

fleetd/src/test/java/dev/ltms/fleet/session/WorktreeSessionManagerTest.java

@@ -212,9 +212,41 @@ class WorktreeSessionManagerTest {
         assertEquals("/repo", remove.repoRoot());
         assertEquals(s.worktree(), remove.worktreePath());
         // The fake records no branch-delete calls because Worktrees.remove only removes the checkout.
+        assertTrue(worktrees.deleteBranchCalls().isEmpty(),
+                "a normal release must NEVER delete the branch — it is the worker's only recoverable "
+                        + "copy of committed work, and only the failed-provisioning path may remove it");
         assertTrue(sessions.get(paneId).isEmpty(), "released session is no longer retrievable");
     }
 
+    /**
+     * fleetd #283 defect 1. Every other cleanup step in {@code release()} is wrapped in try/catch,
+     * because {@code exec()} can throw on a non-zero exit or its own 30s timeout — this was the one
+     * step left bare. By the time it runs, the registry entry, the retained handle, and the pane are
+     * all already gone, so a throw here used to escape {@code release()} after the session was
+     * already fully torn down: a second stop on the same paneId is a no-op (nothing left to find),
+     * so there was no retry path, and the caller saw a failed stop for a session that was in fact
+     * gone. This test makes the worktree removal throw and asserts release() still completes with
+     * the pane stopped and the registry clean.
+     */
+    @Test
+    void releaseCompletesAndStopsPaneEvenWhenWorktreeRemovalThrows() {
+        FakeHerdr herdr = new FakeHerdr();
+        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt")
+                .failRemove("stale index lock");
+        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
+        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
+                new WorktreeRequest("cb-283-1", null));
+        String paneId = s.paneId();
+
+        sessions.release(paneId); // must not throw
+
+        assertTrue(herdr.called("pane.close"), "the pane is still stopped despite the removal failure");
+        assertEquals(1, worktrees.removeCalls().size(), "worktree removal was still attempted");
+        assertTrue(sessions.get(paneId).isEmpty(),
+                "the session is deregistered regardless of the removal failure");
+        assertEquals(0, sessions.size(), "the registry is left clean");
+    }
+
     /**
      * CB-576. A normal {@code COMPLETED} release whose worktree holds uncommitted work must NOT
      * remove it — {@code --force} would destroy the worker's only copy. The bridge cannot see
@@ -352,6 +384,39 @@ class WorktreeSessionManagerTest {
         assertEquals(0, sessions.size(), "failed acquire leaves no registry entry");
         assertFalse(herdr.called("agent.start"), "spawn is never reached when add fails");
         assertTrue(worktrees.removeCalls().isEmpty(), "no worktree was added, so none is removed");
+        assertTrue(worktrees.deleteBranchCalls().isEmpty(),
+                "add() itself never created the branch in git, so there is nothing to delete");
+    }
+
+    /**
+     * fleetd #283 defect 2. {@code acquireWithWorktree}'s catch covers every failure AFTER
+     * {@code worktrees.add()} returns — {@code overlayParity}, {@code shareWithGroup},
+     * {@code launcher.spawn} itself — so by the time it runs, {@code branch} was actually created in
+     * git. It removed only the worktree and forgot the branch, leaking a {@code worker/<slug>-<nonce>}
+     * branch on every routine spawn failure (a quarantined credential, a backend refusal). This test
+     * makes {@code overlayParity} (a post-add() step) throw and asserts the branch is deleted, the
+     * same way #274 already does for the sibling failure inside {@code add()} itself.
+     */
+    @Test
+    void spawnFailureAfterAddDeletesTheOrphanedBranch() {
+        FakeHerdr herdr = new FakeHerdr();
+        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt")
+                .failOverlay("overlayParity failed");
+        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
+
+        assertThrows(WorktreeException.class, () ->
+                sessions.acquire("ltms-local", null, "/caller/proj", null,
+                        new WorktreeRequest("cb-283-2", null)));
+
+        assertEquals(0, sessions.size(), "failed acquire leaves no registry entry");
+        assertFalse(herdr.called("agent.start"), "spawn is never reached when overlayParity fails");
+        assertEquals(1, worktrees.removeCalls().size(), "the worktree checkout is still removed");
+        assertEquals(1, worktrees.deleteBranchCalls().size(),
+                "the orphaned branch that add() actually created must also be deleted");
+        FakeWorktrees.DeleteBranchCall del = worktrees.lastDeleteBranch();
+        assertEquals("/repo", del.repoRoot());
+        FakeWorktrees.AddCall add = worktrees.lastAdd();
+        assertEquals(add.branch(), del.branch(), "the branch deleted is the exact one add() created");
     }
 
     @Test