#297: map HerdrException on GET /agents and /members; GET /profiles reports quarantine + cool-off

Two REST-only visibility gaps, both against the same shared instances FleetMcp
reads (BackendQuarantine/BackendOutagePolicy), never recomputed:

- GET /agents and GET /members let a HerdrException escape uncaught, outside
  the {error, detail} envelope every other failure path in FleetApp uses.
  Both now route through the existing herdrError() helper, matching healthz/
  sessionStatus. GET /members is the endpoint's own comment names as the
  out-of-band path a lead falls back to when its MCP mount drops.
- GET /profiles omitted the two outage states fleet_profiles already reports:
  quarantined (CB-578 stage B) and coolingOff (fleetd #201 Unit 5). FleetApp
  now takes the SAME FleetMcp.QuarantineSource/OutageSource instances Fleetd
  wires into FleetMcp (extracted to local vars in Fleetd.java so both doors
  share one object, not two independently-built copies of the same rule).

FleetMcp itself is unchanged. Item 3 of the ticket (a capacity block on
GET /members) is explicitly out of scope and was not added.

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -625,6 +625,19 @@ public final class Fleetd {
             log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
         }
 
+        // fleetd #297: named once and reused verbatim below for FleetApp's GET /profiles, rather than
+        // built a second time — two independently-constructed sources reading the SAME BackendQuarantine
+        // / BackendOutagePolicy would still be able to drift (e.g. a future edit to the credentialIdFor
+        // closure in only one of the two places), exactly the shape #284 was.
+        FleetMcp.QuarantineSource quarantineSource = new FleetMcp.QuarantineSource(profile -> {
+            var configured = config.get().profiles().get(profile);
+            return configured == null ? null : configured.effectiveCredentialId();
+        }, quarantine);
+        FleetMcp.OutageSource outageSource = new FleetMcp.OutageSource(profile -> {
+            var configured = config.get().profiles().get(profile);
+            return configured == null ? null : configured.effectiveCredentialId();
+        }, outagePolicy);
+
         FleetMcp mcp = new FleetMcp(messages, workers, sessions, identity, presence,
                 primaryRegistry, callers, metrics, new FleetMcp.CapacitySource(profile -> liveCountRef.get().apply(profile),
                 profile -> {
@@ -636,15 +649,9 @@ public final class Fleetd {
                     return FleetHealthMonitor.coverage(health != null && health.isEnabled(),
                             health != null && health.notifications() != null && health.notifications().configured());
                 }),
-                new FleetMcp.QuarantineSource(profile -> {
-                    var configured = config.get().profiles().get(profile);
-                    return configured == null ? null : configured.effectiveCredentialId();
-                }, quarantine),
+                quarantineSource,
                 leadMailbox,
-                new FleetMcp.OutageSource(profile -> {
-                    var configured = config.get().profiles().get(profile);
-                    return configured == null ? null : configured.effectiveCredentialId();
-                }, outagePolicy),
+                outageSource,
                 new FleetMcp.LeadSeatSource(leadSeatLookup(() -> config.get().profiles(), leaders, leads)));
 
         // CB-637: the receive half. Only constructed when a lead mailbox actually opened — with no
@@ -715,9 +722,12 @@ public final class Fleetd {
         // GET /sessions must merge across both, or a down/unpolled member daemon is invisible.
         // fleetd #111: live (re-read-per-request) memberCredentials view for GET /member-credentials —
         // same hot-reload shape as the memberCredentials supplier passed to ClaudeCodeLauncher above.
+        // fleetd #297: quarantineSource/outageSource are the SAME instances passed to FleetMcp above —
+        // GET /profiles must report the identical quarantine/cool-off facts as fleet_profiles.
         Javalin app = new FleetApp(herdr, memberHerdr, workers, sessions, messages, presence, mcp.servlet(),
                 callers, metrics, deliverable,
-                () -> MemberCredentialPolicyView.of(config.get().memberCredentials())).build();
+                () -> MemberCredentialPolicyView.of(config.get().memberCredentials()),
+                quarantineSource, outageSource).build();
         app.start(cfg.bind().host(), cfg.bind().port());
         log.info("fleetd listening on {}:{}, herdr socket {}",
                 cfg.bind().host(), cfg.bind().port(), socket);

fleetd/src/main/java/dev/ltms/fleet/health/FleetHealthMonitor.java

@@ -14,6 +14,7 @@ import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 import java.util.function.BiConsumer;
@@ -46,7 +47,16 @@ public final class FleetHealthMonitor {
     private final long workingSuspectAfterNanos;
     private final BiConsumer<String, String> failTarget;
     private final Map<String, HealthPrior> priors = new HashMap<>();
-    private final Map<String, HealthState> states = new HashMap<>();
+    /**
+     * The live classification per member, and the only one of this class's three maps that more
+     * than one scheduler task touches. {@code tick} writes it (and prunes it to the roster);
+     * fleetd #280's delayed {@link #recheckTerminalTarget} reads it from its own separate scheduled
+     * task. Both run on the single-threaded scheduler {@code Fleetd} passes in today, so they are
+     * serialised — but nothing in this class enforces that, and an unsynchronised {@link HashMap}
+     * read racing a resize can spin a CPU forever rather than fail visibly. {@code priors} and
+     * {@code orphanStreaks} stay plain maps because {@code tick} is still their only toucher.
+     */
+    private final Map<String, HealthState> states = new ConcurrentHashMap<>();
     /**
      * CB-643: consecutive ticks on which a target looked like an orphaned delegation. The fact
      * {@link MessageService#hasOrphanedDelegation} reports is a true snapshot, but it can read true

fleetd/src/main/java/dev/ltms/fleet/member/HerdrPeerLauncher.java

@@ -913,9 +913,14 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * {@link #reapOrphanWorkers() orphan-reap} and spawn-gate-timeout paths, plus any caller that
      * passes a pane directly, keep working without an owning id.
      *
-     * <p>Resolves the tab from the pane <em>before</em> closing it. An already-gone pane/tab
-     * (repeated DELETE, crashed peer) is treated as success; any other failure propagates so a
-     * genuinely failed teardown is not reported as done.
+     * <p>Resolves the tab from the pane <em>before</em> closing it. {@code agents.close} (the pane)
+     * is the one step whose failure means the teardown itself may not have happened: an already-gone
+     * pane (repeated DELETE, crashed peer) is treated as success, but any other failure propagates so
+     * a genuinely failed teardown is not reported as done. {@code spaces.closeTab} (fleetd #293) is
+     * different — by the time it runs the pane is already closed, so it is cosmetic workspace tidying
+     * rather than a real teardown failure, and a failure there is logged and never propagates, so it
+     * cannot mask the two cleanups below it ({@link #releaseZdotdir}, and the caller's worktree
+     * removal in {@code SessionManager.release}).
      */
     @Override
     public void stop(String idOrPane) {
@@ -934,7 +939,25 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
             log.debug("pane.close({}) ignored — already gone: {}", paneId, e.getMessage());
         }
         if (loc != null && loc.tabPaneCount() == 1) {
-            spaces.closeTab(loc.tabId());
+            // fleetd #293: the pane above is already closed by this point, so a failing tab.close is
+            // cosmetic workspace tidying, not a real teardown failure — it must not mask the two
+            // cleanups below it (releaseZdotdir, and the caller's worktree removal). Unlike
+            // agents.close above, this is not narrowed to "already gone": any failure here, whatever
+            // its cause, is one we continue past, so we log it at WARN (not debug) with the tab id a
+            // person can go close by hand.
+            try {
+                spaces.closeTab(loc.tabId());
+            } catch (RuntimeException e) {
+                // Caught as RuntimeException, not HerdrException, to match releaseZdotdir's own
+                // guard five lines below. Today the two are the same set — HerdrCodec wraps every
+                // encode/decode failure and UnixSocketHerdrClient wraps every IOException, so
+                // HerdrException is all closeTab can actually throw. Narrowing to it anyway would
+                // leave this step guarded against the expected failure and bare against any other,
+                // which is the exact asymmetry fleetd #293 exists to remove. No behaviour change
+                // today; it stops a later change inside WorkspaceControl.closeTab reopening it.
+                log.warn("tab.close({}) failed — the pane is already torn down, so continuing; the "
+                        + "tab may need manual cleanup: {}", loc.tabId(), e.getMessage());
+            }
         } else if (loc != null) {
             log.debug("not closing tab {} — it holds {} panes (not a dedicated peer tab)",
                     loc.tabId(), loc.tabPaneCount());

fleetd/src/main/java/dev/ltms/fleet/rest/FleetApp.java

@@ -9,6 +9,7 @@ import dev.ltms.fleet.auth.Principal;
 import dev.ltms.fleet.guard.GuardException;
 import dev.ltms.fleet.metrics.FleetMetrics;
 import dev.ltms.fleet.metrics.Metrics;
+import dev.ltms.fleet.mcp.FleetMcp;
 import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.herdr.HerdrClient;
 import dev.ltms.fleet.herdr.HerdrException;
@@ -86,6 +87,12 @@ public final class FleetApp {
     // absent() (the honest "no policy configured" view) for every constructor that does not wire
     // a real one, so existing legacy call sites keep building without knowing this field exists.
     private final Supplier<MemberCredentialPolicyView> memberCredentials;
+    // fleetd #297: the SAME shared sources FleetMcp.profiles/fleet_profiles reads (BackendQuarantine
+    // and BackendOutagePolicy are each one instance for the whole daemon — see Fleetd wiring) so
+    // GET /profiles cannot drift from fleet_profiles about which profile is quarantined/cooling off.
+    // .none() (the honest "feature not wired" view) for every constructor that does not pass one.
+    private final FleetMcp.QuarantineSource quarantine;
+    private final FleetMcp.OutageSource outage;
     private final ObjectMapper mapper = new ObjectMapper();
 
     /**
@@ -146,6 +153,23 @@ public final class FleetApp {
                        MessageService messages, MemberPresence presence,
                        HttpServlet mcpServlet, CallerResolver auth, Metrics metrics,
                        Predicate<String> deliverable, Supplier<MemberCredentialPolicyView> memberCredentials) {
+        this(herdr, memberHerdr, workers, sessions, messages, presence, mcpServlet, auth, metrics,
+                deliverable, memberCredentials, FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none());
+    }
+
+    /**
+     * @param quarantine the SAME {@link FleetMcp.QuarantineSource} instance passed to {@code
+     *                   FleetMcp} (fleetd #297), so {@code GET /profiles} reports the identical
+     *                   exhaustion-quarantine facts as {@code fleet_profiles} rather than a second,
+     *                   independently-computed copy
+     * @param outage     the SAME {@link FleetMcp.OutageSource} instance passed to {@code FleetMcp} —
+     *                   see {@code quarantine}; a SEPARATE check from it, never merged in
+     */
+    public FleetApp(HerdrClient herdr, HerdrClient memberHerdr, PeerLauncher workers, SessionManager sessions,
+                       MessageService messages, MemberPresence presence,
+                       HttpServlet mcpServlet, CallerResolver auth, Metrics metrics,
+                       Predicate<String> deliverable, Supplier<MemberCredentialPolicyView> memberCredentials,
+                       FleetMcp.QuarantineSource quarantine, FleetMcp.OutageSource outage) {
         this.herdr = herdr;
         this.memberHerdr = memberHerdr != null ? memberHerdr : herdr;
         this.workers = workers;
@@ -156,6 +180,8 @@ public final class FleetApp {
         this.auth = auth;
         this.metrics = metrics;
         this.memberCredentials = memberCredentials != null ? memberCredentials : MemberCredentialPolicyView::absent;
+        this.quarantine = quarantine != null ? quarantine : FleetMcp.QuarantineSource.none();
+        this.outage = outage != null ? outage : FleetMcp.OutageSource.none();
     }
 
     /** Wire routes onto a fresh, unstarted Javalin instance. Caller starts it. */
@@ -338,8 +364,15 @@ public final class FleetApp {
         if (!allow(ctx, routeAction("GET /agents"), null)) {
             return;
         }
-        ctx.status(200).json(Map.of("agents",
-                workers.list().stream().map(Agent.class::cast).map(FleetApp::view).toList()));
+        try {
+            ctx.status(200).json(Map.of("agents",
+                    workers.list().stream().map(Agent.class::cast).map(FleetApp::view).toList()));
+        } catch (HerdrException e) {
+            // fleetd #297: workers.list() reaches herdr — a transport failure must land in the same
+            // {error, detail} envelope every other failure path here uses, not escape as a bare
+            // exception and leave Javalin's default handling to respond outside the JSON contract.
+            herdrError(ctx, e);
+        }
     }
 
     /** CB-304: bridge-owned roster merged with live herdr status by paneId. */
@@ -347,40 +380,85 @@ public final class FleetApp {
         if (!allow(ctx, routeAction("GET /members"), null)) {
             return;
         }
-        // CB-519: the registry key is a host-unique id, not the pane coordinate — join on terminal.
-        Map<String, Agent> live = workers.list().stream()
-                .map(Agent.class::cast)
-                .filter(a -> a.terminalId() != null)
-                .collect(Collectors.toMap(Agent::terminalId, Function.identity(), (_, b) -> b));
-        // fleetd #209: this REST roster reports agentSessionId via SessionManager.rosterView, so it
-        // uses the resolving roster read (caller-driven, not a timer) rather than the plain one.
-        List<Map<String, Object>> out = sessions.rosterResolved().stream()
-                .map(s -> SessionManager.rosterView(s, live.get(s.terminalId())))
-                .toList();
-        Map<String, Object> body = new LinkedHashMap<>();
-        // fleetd #199: the endpoint became /members in the CB-634 rename but the body key stayed
-        // "workers", so a caller that read "members" saw an empty fleet and reported no members at
-        // all. "members" is the canonical key; "workers" stays as a deprecated alias so an existing
-        // REST consumer keeps working — the out-of-band path a lead falls back to when its MCP mount
-        // drops reads this endpoint. Drop the alias once nothing reads it.
-        body.put("members", out);
-        body.put("workers", out);
-        // CB-586: operator visibility for the refs/wip snapshot store without shelling into the
-        // repo — how many snapshot refs exist and roughly what they cost. Present only once a
-        // worktree session has established the repo, so a never-snapshotted fleet reports nothing.
-        sessions.wipRefs().ifPresent(st -> body.put("wipRefs",
-                Map.of("count", st.count(), "costBytes", st.costBytes())));
-        ctx.status(200).json(body);
+        try {
+            // CB-519: the registry key is a host-unique id, not the pane coordinate — join on terminal.
+            Map<String, Agent> live = workers.list().stream()
+                    .map(Agent.class::cast)
+                    .filter(a -> a.terminalId() != null)
+                    .collect(Collectors.toMap(Agent::terminalId, Function.identity(), (_, b) -> b));
+            // fleetd #209: this REST roster reports agentSessionId via SessionManager.rosterView, so it
+            // uses the resolving roster read (caller-driven, not a timer) rather than the plain one.
+            List<Map<String, Object>> out = sessions.rosterResolved().stream()
+                    .map(s -> SessionManager.rosterView(s, live.get(s.terminalId())))
+                    .toList();
+            Map<String, Object> body = new LinkedHashMap<>();
+            // fleetd #199: the endpoint became /members in the CB-634 rename but the body key stayed
+            // "workers", so a caller that read "members" saw an empty fleet and reported no members at
+            // all. "members" is the canonical key; "workers" stays as a deprecated alias so an existing
+            // REST consumer keeps working — the out-of-band path a lead falls back to when its MCP mount
+            // drops reads this endpoint. Drop the alias once nothing reads it.
+            body.put("members", out);
+            body.put("workers", out);
+            // CB-586: operator visibility for the refs/wip snapshot store without shelling into the
+            // repo — how many snapshot refs exist and roughly what they cost. Present only once a
+            // worktree session has established the repo, so a never-snapshotted fleet reports nothing.
+            sessions.wipRefs().ifPresent(st -> body.put("wipRefs",
+                    Map.of("count", st.count(), "costBytes", st.costBytes())));
+            ctx.status(200).json(body);
+        } catch (HerdrException e) {
+            // fleetd #297: same reasoning as agents() above — this is the out-of-band roster a lead
+            // falls back to when its MCP mount drops, so it must stay inside the JSON error contract
+            // exactly when herdr is briefly unreachable, not escape as a bare exception.
+            herdrError(ctx, e);
+        }
     }
 
-    /** The configured worker profiles and which one a no-argument spawn uses. */
+    /**
+     * The configured worker profiles, which one a no-argument spawn uses, and (fleetd #297) the two
+     * outage states {@code fleet_profiles} already reports: {@code quarantined} (CB-578 stage B —
+     * the backend reported it out of capacity) and {@code coolingOff} (fleetd #201 Unit 5 — the
+     * credential threw repeated non-exhaustion backend errors). Both are read from the SAME shared
+     * {@link FleetMcp.QuarantineSource}/{@link FleetMcp.OutageSource} instances {@code FleetMcp}
+     * reads, never recomputed, so the two doors cannot disagree about which profile is down and why.
+     * Independent checks, so a profile can appear in both maps at once; each map is present only
+     * when at least one profile is in that state.
+     */
     private void profiles(Context ctx) {
         if (!allow(ctx, routeAction("GET /profiles"), null)) {
             return;
         }
-        ctx.status(200).json(Map.of(
-                "profiles", workers.profiles(),
-                "default", workers.defaultProfile() == null ? "" : workers.defaultProfile()));
+        Map<String, Object> body = new LinkedHashMap<>();
+        body.put("profiles", workers.profiles());
+        body.put("default", workers.defaultProfile() == null ? "" : workers.defaultProfile());
+        Map<String, Object> quarantined = new LinkedHashMap<>();
+        Map<String, Object> coolingOff = new LinkedHashMap<>();
+        for (String profile : workers.profiles()) {
+            String credentialId = quarantine.credentialIdFor().apply(profile);
+            if (credentialId != null) {
+                quarantine.quarantine().remainingSeconds(credentialId).ifPresent(remaining -> {
+                    Map<String, Object> row = new LinkedHashMap<>();
+                    row.put("credentialId", credentialId);
+                    row.put("quarantinedForSeconds", remaining);
+                    quarantined.put(profile, row);
+                });
+            }
+            String outageCredentialId = outage.credentialIdFor().apply(profile);
+            if (outageCredentialId != null) {
+                outage.outagePolicy().remainingCoolOffSeconds(outageCredentialId).ifPresent(remaining -> {
+                    Map<String, Object> row = new LinkedHashMap<>();
+                    row.put("credentialId", outageCredentialId);
+                    row.put("coolingOffForSeconds", remaining);
+                    coolingOff.put(profile, row);
+                });
+            }
+        }
+        if (!quarantined.isEmpty()) {
+            body.put("quarantined", quarantined);
+        }
+        if (!coolingOff.isEmpty()) {
+            body.put("coolingOff", coolingOff);
+        }
+        ctx.status(200).json(body);
     }
 
     /**

fleetd/src/test/java/dev/ltms/fleet/herdr/FakeHerdr.java

@@ -7,6 +7,7 @@ import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.CopyOnWriteArrayList;
 
 /**
@@ -41,6 +42,9 @@ public final class FakeHerdr implements HerdrClient {
     private int agentPaneBusyFor = 0;
     private int workerTabPaneCount = 1;
     private String paneCloseErrorCode = null;
+    private final Map<String, String> paneCloseErrorCodeFor = new ConcurrentHashMap<>();
+    private String tabCloseErrorCode = null;
+    private final Map<String, String> tabCloseErrorCodeFor = new ConcurrentHashMap<>();
     private String agentSendErrorCode = null;
     private boolean noPanes = false;
     private volatile String agentStatus = "idle"; // steady-state agent.get status
@@ -86,12 +90,44 @@ public final class FakeHerdr implements HerdrClient {
         return this;
     }
 
-    /** Make {@code pane.close} fail with this herdr error code. */
+    /** Make {@code pane.close} fail with this herdr error code, for every pane. */
     public FakeHerdr paneCloseFailsWith(String code) {
         this.paneCloseErrorCode = code;
         return this;
     }
 
+    /**
+     * Make {@code pane.close} fail with this herdr error code, but only for the given {@code
+     * pane_id} — every other pane's {@code pane.close} still succeeds. Unlike {@link
+     * #paneCloseFailsWith}, which fails every call regardless of which pane it targets, this lets a
+     * test reap/release several sessions at once and make exactly one of them fail to stop, so the
+     * others' teardown can be asserted to proceed normally (fleetd #290).
+     */
+    public FakeHerdr paneCloseFailsForPane(String paneId, String code) {
+        this.paneCloseErrorCodeFor.put(paneId, code);
+        return this;
+    }
+
+    /** Make {@code tab.close} fail with this herdr error code, for every tab. */
+    public FakeHerdr tabCloseFailsWith(String code) {
+        this.tabCloseErrorCode = code;
+        return this;
+    }
+
+    /**
+     * Make {@code tab.close} fail with this herdr error code, but only for the given {@code
+     * tab_id} — every other tab's {@code tab.close} still succeeds. The {@code tab.close}
+     * counterpart to {@link #paneCloseFailsForPane} (fleetd #290): lets a test make exactly one
+     * session's tab teardown fail while proving the rest of {@code stop()} — {@code
+     * releaseZdotdir}, and the caller's worktree removal — still runs (fleetd #293). Named "ForTab"
+     * rather than "ForPane" (unlike its sibling) because {@code tab.close} keys on {@code tab_id},
+     * not a pane id.
+     */
+    public FakeHerdr tabCloseFailsForTab(String tabId, String code) {
+        this.tabCloseErrorCodeFor.put(tabId, code);
+        return this;
+    }
+
     /**
      * Make {@code pane.list} report no panes at all — models a second herdr daemon (CB-185) that
      * simply does not host the pane a {@link PaneLocator} is searching for.
@@ -338,7 +374,17 @@ public final class FakeHerdr implements HerdrClient {
                             .formatted(workerTabPaneCount,
                                     seeded.isEmpty() ? "" : "," + String.join(",", seeded)));
                 }
-                case "tab.close" -> mapper.readTree("{\"type\":\"ok\"}");
+                case "tab.close" -> {
+                    Object tabIdParam = params instanceof Map<?, ?> m ? m.get("tab_id") : null;
+                    String perTabCode = tabIdParam == null ? null
+                            : tabCloseErrorCodeFor.get(String.valueOf(tabIdParam));
+                    String code = perTabCode != null ? perTabCode : tabCloseErrorCode;
+                    if (code != null) {
+                        throw new HerdrException("herdr error [" + code + "]: tab.close failed",
+                                code, null);
+                    }
+                    yield mapper.readTree("{\"type\":\"ok\"}");
+                }
                 case "pane.get" -> mapper.readTree("""
                         {"type":"pane_info","pane":{"pane_id":"w9:pW","workspace_id":"w9",
                           "tab_id":"w9:t2","agent_status":"idle"}}""");
@@ -360,9 +406,13 @@ public final class FakeHerdr implements HerdrClient {
                                   "foreground_processes":[]}}""");
                 }
                 case "pane.close" -> {
-                    if (paneCloseErrorCode != null) {
-                        throw new HerdrException("herdr error [" + paneCloseErrorCode + "]: pane.close failed",
-                                paneCloseErrorCode, null);
+                    Object paneIdParam = params instanceof Map<?, ?> m ? m.get("pane_id") : null;
+                    String perPaneCode = paneIdParam == null ? null
+                            : paneCloseErrorCodeFor.get(String.valueOf(paneIdParam));
+                    String code = perPaneCode != null ? perPaneCode : paneCloseErrorCode;
+                    if (code != null) {
+                        throw new HerdrException("herdr error [" + code + "]: pane.close failed",
+                                code, null);
                     }
                     yield mapper.readTree("{\"type\":\"ok\"}");
                 }

fleetd/src/test/java/dev/ltms/fleet/member/ClaudeCodeLauncherTest.java

@@ -925,6 +925,71 @@ class ClaudeCodeLauncherTest {
         assertTrue(herdr.called("pane.close"), "stop via handle.id() must close the pane");
     }
 
+    /** A tab-placement launcher with {@code memberCredentials policy=allow-list} under a zsh shell — the
+     * combination that makes {@link HerdrPeerLauncher#spawn} generate a real ZDOTDIR, so {@code
+     * releaseZdotdir}'s effect (the directory's deletion) is observable from a test. */
+    private ClaudeCodeLauncher serviceWithAllowList(FakeHerdr herdr) {
+        FleetConfig.Profile cfg = new FleetConfig.Profile(
+                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
+                List.of("ccs", "ltms-local"), "tab", "fleetd-workers",
+                "worker: {profile} #{n}", null, null, null);
+        Supplier<FleetConfig.MemberCredentials> creds = () -> new FleetConfig.MemberCredentials(
+                FleetConfig.MemberCredentials.POLICY_ALLOW_LIST, List.of(), List.of(), null);
+        Function<String, String> env = name -> "SHELL".equals(name) ? "/bin/zsh" : null;
+        return new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
+                env, 0, System::currentTimeMillis, () -> { }, null, creds);
+    }
+
+    /**
+     * fleetd #293: {@code stop()} used to run {@code spaces.closeTab} bare — any non-{@code
+     * *_not_found} herdr error propagated straight out of {@code stop()}, skipping {@code
+     * releaseZdotdir} entirely (the pane was already closed by that point, so the tab-close failure
+     * is cosmetic, not a real teardown failure). Proves both halves of the fix: {@code stop()} no
+     * longer throws for this failure, and {@code releaseZdotdir} still runs — observed here by the
+     * generated ZDOTDIR actually being deleted, since {@code releaseZdotdir}'s last line is {@code
+     * EnvAllowListScrub.deleteRecursively(dir)}.
+     */
+    @Test
+    @SuppressWarnings("unchecked")
+    void stopStillReleasesZdotdirWhenCloseTabFailsWithANonNotFoundCode() {
+        FakeHerdr herdr = new FakeHerdr();
+        ClaudeCodeLauncher svc = serviceWithAllowList(herdr);
+        PeerHandle handle = svc.spawn(new SpawnRequest(null, null, null));
+        Map<String, Object> tabCreateParams = (Map<String, Object>) herdr.lastCall("tab.create").params();
+        Map<String, String> tabEnv = (Map<String, String>) tabCreateParams.get("env");
+        String zdotdir = tabEnv.get("ZDOTDIR");
+        assertNotNull(zdotdir, "policy=allow-list under a zsh shell must have generated a ZDOTDIR: " + tabEnv);
+        Path dir = Path.of(zdotdir);
+        assertTrue(Files.isDirectory(dir), "the generated ZDOTDIR must exist before stop(): " + dir);
+        herdr.tabCloseFailsForTab("w9:t2", "internal_error");
+
+        Logger logger = (Logger) LoggerFactory.getLogger(HerdrPeerLauncher.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            assertDoesNotThrow(() -> svc.stop(handle.id()),
+                    "fleetd #293: a failing tab.close is cosmetic — it must not propagate out of stop()");
+        } finally {
+            logger.detachAppender(appender);
+        }
+
+        assertTrue(herdr.called("tab.close"), "tab.close was still attempted");
+        assertFalse(Files.exists(dir),
+                "releaseZdotdir must still run and delete the generated ZDOTDIR despite the tab.close "
+                        + "failure: " + dir);
+        String warn = appender.list.stream()
+                .filter(e -> e.getLevel().equals(Level.WARN))
+                .map(ILoggingEvent::getFormattedMessage)
+                .filter(m -> m.contains("tab.close") && m.contains("w9:t2"))
+                .findFirst()
+                .orElse(null);
+        assertNotNull(warn, "the failing tab.close must be logged at WARN naming the tab id — a "
+                + "silently swallowed failure with no message is not an improvement. Log lines: "
+                + appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList());
+    }
+
     // --- CB-519: host-unique id, decoupled from the pane coordinate ------------------------------
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/rest/FleetAppTest.java

@@ -19,6 +19,10 @@ import dev.ltms.fleet.session.SessionManager;
 import dev.ltms.fleet.session.Worktrees;
 import dev.ltms.fleet.member.ClaudeCodeLauncher;
 import dev.ltms.fleet.member.CompositePeerLauncher;
+import dev.ltms.fleet.member.MemberCredentialPolicyView;
+import dev.ltms.fleet.mcp.FleetMcp;
+import dev.ltms.fleet.placement.BackendOutagePolicy;
+import dev.ltms.fleet.placement.BackendQuarantine;
 import dev.ltms.fleet.placement.PlacementPolicies;
 import io.javalin.Javalin;
 import org.junit.jupiter.api.AfterEach;
@@ -32,6 +36,7 @@ import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.UUID;
+import java.util.concurrent.TimeUnit;
 import java.util.function.Predicate;
 
 import static org.junit.jupiter.api.Assertions.*;
@@ -70,6 +75,19 @@ class FleetAppTest {
 
     private int start(FakeHerdr herdr, String workerBaseUrl, Set<String> allow, String placement,
                       Worktrees worktrees, Predicate<String> deliverable) {
+        return start(herdr, workerBaseUrl, allow, placement, worktrees, deliverable,
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none());
+    }
+
+    /**
+     * fleetd #297: same wiring as above, plus the two SAME shared sources {@code GET /profiles}
+     * must read — lets a test prove the quarantined/coolingOff facts it reports come from a real
+     * {@link dev.ltms.fleet.placement.BackendQuarantine}/{@link
+     * dev.ltms.fleet.placement.BackendOutagePolicy}, exactly like {@code fleet_profiles}'s own tests.
+     */
+    private int start(FakeHerdr herdr, String workerBaseUrl, Set<String> allow, String placement,
+                      Worktrees worktrees, Predicate<String> deliverable,
+                      FleetMcp.QuarantineSource quarantine, FleetMcp.OutageSource outage) {
         FleetConfig.Profile wcfg = new FleetConfig.Profile(
                 "ltms-local", workerBaseUrl, "coder", null, "FLEETD_WORKER_TOKEN", null,
                 placement, "fleet", "worker: {profile} #{n}", null, null, null);
@@ -90,8 +108,9 @@ class FleetAppTest {
         // it directly so the inbox contract holds for those endpoints.
         inbox.own("term_a");
         MessageService messages = new MessageService(agents, injector, rendezvous, inbox);
-        app = new FleetApp(herdr, workers, sessions, messages, this.presence, null,
-                null, null, id -> this.presence.isPresent(id) || deliverable.test(id))
+        app = new FleetApp(herdr, herdr, workers, sessions, messages, this.presence, null,
+                null, null, id -> this.presence.isPresent(id) || deliverable.test(id),
+                MemberCredentialPolicyView::absent, quarantine, outage)
                 .build().start("127.0.0.1", 0);
         return app.port();
     }
@@ -164,6 +183,22 @@ class FleetAppTest {
         assertEquals("idle", agents.get(0).get("status").asText());
     }
 
+    /**
+     * fleetd #297 gap 1: {@code workers.list()} reaches herdr, and a transport failure there must
+     * land in the same {@code {error, detail}} envelope every other failure path in this file uses
+     * (see {@code herdrError}), not escape as a bare exception outside the JSON contract.
+     */
+    @Test
+    void agentsMapsAHerdrFailureToTheJsonErrorEnvelope() throws Exception {
+        FakeHerdr down = new FakeHerdr().healthy(false);
+        int port = start(down, "http://gx00.gw:8000", Set.of("gx00.gw"));
+        HttpResponse<String> res = req(port, "GET", "/agents");
+        assertEquals(502, res.statusCode(), res.body());
+        JsonNode body = mapper.readTree(res.body());
+        assertEquals("herdr_error", body.get("error").asText());
+        assertTrue(body.has("detail"), res.body());
+    }
+
     @Test
     void spawnWorkerLandsInOwnTabInWorkerSpaceAndInjectsBaseUrl() throws Exception {
         FakeHerdr herdr = new FakeHerdr();
@@ -203,6 +238,42 @@ class FleetAppTest {
         JsonNode body = mapper.readTree(req(port, "GET", "/profiles").body());
         assertEquals("ltms-local", body.get("default").asText());
         assertEquals("ltms-local", body.get("profiles").get(0).asText());
+        assertFalse(body.has("quarantined"), "nothing is quarantined, so the key is omitted: " + body);
+        assertFalse(body.has("coolingOff"), "nothing is cooling off, so the key is omitted: " + body);
+    }
+
+    /**
+     * fleetd #297 gap 2: {@code GET /profiles} must report the same two outage states {@code
+     * fleet_profiles} does — CB-578 stage B exhaustion quarantine and fleetd #201 Unit 5 cool-off —
+     * reading the SAME shared {@link BackendQuarantine}/{@link BackendOutagePolicy} instances rather
+     * than recomputing them. The two checks are independent, and this profile is deliberately put in
+     * both states at once, matching {@code FleetMcpTest}'s own coverage of that overlap.
+     */
+    @Test
+    void profilesReportsQuarantineAndCoolingOffFromTheSameSharedSources() throws Exception {
+        FakeHerdr herdr = new FakeHerdr();
+        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
+        quarantine.quarantine("shared-openai");
+        FleetMcp.QuarantineSource quarantineSource = new FleetMcp.QuarantineSource(
+                profile -> "ltms-local".equals(profile) ? "shared-openai" : null, quarantine);
+        BackendOutagePolicy outagePolicy = new BackendOutagePolicy(() -> 0L);
+        outagePolicy.record("shared-openai", "t1", "API Error: rate limited");
+        outagePolicy.record("shared-openai", "t2", "API Error: rate limited"); // 2nd distinct target starts the incident
+        FleetMcp.OutageSource outageSource = new FleetMcp.OutageSource(
+                profile -> "ltms-local".equals(profile) ? "shared-openai" : null, outagePolicy);
+        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"), "tab", new GitWorktrees(),
+                ignored -> false, quarantineSource, outageSource);
+
+        JsonNode body = mapper.readTree(req(port, "GET", "/profiles").body());
+        assertTrue(body.has("quarantined"), body.toString());
+        assertEquals("shared-openai",
+                body.get("quarantined").get("ltms-local").get("credentialId").asText());
+        assertEquals(1800,
+                body.get("quarantined").get("ltms-local").get("quarantinedForSeconds").asLong());
+        assertTrue(body.has("coolingOff"), body.toString());
+        assertEquals("shared-openai",
+                body.get("coolingOff").get("ltms-local").get("credentialId").asText());
+        assertEquals(60, body.get("coolingOff").get("ltms-local").get("coolingOffForSeconds").asLong());
     }
 
     @Test
@@ -239,6 +310,23 @@ class FleetAppTest {
                 "liveStatus is unknown when herdr has no matching pane");
     }
 
+    /**
+     * fleetd #297 gap 1: same reasoning as {@code agentsMapsAHerdrFailureToTheJsonErrorEnvelope} —
+     * {@code GET /members} is the endpoint's own comment names as "the out-of-band path a lead falls
+     * back to when its MCP mount drops", so it must stay inside the {@code {error, detail}} envelope
+     * exactly when herdr is briefly unreachable.
+     */
+    @Test
+    void membersMapsAHerdrFailureToTheJsonErrorEnvelope() throws Exception {
+        FakeHerdr down = new FakeHerdr().healthy(false);
+        int port = start(down, "http://gx00.gw:8000", Set.of("gx00.gw"));
+        HttpResponse<String> res = req(port, "GET", "/members");
+        assertEquals(502, res.statusCode(), res.body());
+        JsonNode body = mapper.readTree(res.body());
+        assertEquals("herdr_error", body.get("error").asText());
+        assertTrue(body.has("detail"), res.body());
+    }
+
     @Test
     void spawnWithACwdParamRootsTheWorkerThere() throws Exception {
         FakeHerdr herdr = new FakeHerdr();

fleetd/src/test/java/dev/ltms/fleet/session/SessionManagerTest.java

@@ -1069,6 +1069,79 @@ class SessionManagerTest {
         assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_3"), "the third pane is stopped");
     }
 
+    /**
+     * fleetd #290: the #283 fix above closed the one trigger this suite used for {@code
+     * reapIdle}'s own per-session try/catch (CB-581) — a worktree-removal failure is now caught
+     * and logged inside {@code release()} itself, so it never reaches {@code reapIdle}'s guard at
+     * all. This test restores coverage of that guard using the trigger the ticket names: {@code
+     * release()} calls {@code launcher.stop(paneId)} with no try/catch around it, so a failing
+     * {@code pane.close} propagates straight out of {@code release()} uncaught. {@link
+     * FakeHerdr#paneCloseFailsForPane} (added for this ticket) makes exactly the middle session's
+     * stop fail, while the other two still succeed, so this proves {@code reapIdle} keeps reaping
+     * the rest of the roster rather than aborting the whole pass.
+     */
+    @Test
+    void reapIdleSurvivesOneSessionWhoseLauncherStopFails() {
+        long[] clock = {0};
+        FakeHerdr herdr = new FakeHerdr();
+        RecordingWorktrees worktrees = new RecordingWorktrees();
+        SessionManager sessions = sessionManager(herdr, worktrees, () -> clock[0]);
+        MemberSession a = sessions.acquire("ltms-local", null, "/caller/proj", null,
+                new WorktreeRequest("cb-290a", null));
+        MemberSession b = sessions.acquire("ltms-local", null, "/caller/proj", null,
+                new WorktreeRequest("cb-290b", null));
+        MemberSession c = sessions.acquire("ltms-local", null, "/caller/proj", null,
+                new WorktreeRequest("cb-290c", null));
+        sessions.asPresence().markPresent(a.terminalId());
+        sessions.asPresence().markPresent(b.terminalId());
+        sessions.asPresence().markPresent(c.terminalId());
+        // Only the middle session's herdr pane fails to close — a and c stop normally. This is the
+        // trigger reapIdle's own guard is for, now that #283 closed the worktree-removal trigger.
+        herdr.paneCloseFailsForPane("w9:pRoot_2", "internal_error");
+
+        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
+        ch.qos.logback.classic.Logger sessionLog =
+                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(SessionManager.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.setContext(ctx);
+        appender.start();
+        sessionLog.addAppender(appender);
+        sessionLog.setLevel(Level.WARN);
+        int reaped;
+        try {
+            clock[0] = 100;
+            reaped = sessions.reapIdle(10);
+
+            String warn = appender.list.stream()
+                    .filter(e -> e.getLevel().equals(Level.WARN))
+                    .map(ILoggingEvent::getFormattedMessage)
+                    .filter(m -> m.contains("reap failed") && m.contains(b.paneId()))
+                    .findFirst()
+                    .orElse("no reap-failed WARN logged for the failing session");
+            assertTrue(warn.contains(b.terminalId()), "the WARN names the failed session's terminal: " + warn);
+        } finally {
+            sessionLog.detachAppender(appender);
+        }
+
+        assertEquals(2, reaped,
+                "the middle session's launcher.stop failure is not counted as reaped, but must not "
+                        + "abort reaping the other two");
+        assertTrue(sessions.get(a.paneId()).isEmpty(), "the first session is still released");
+        assertTrue(sessions.get(c.paneId()).isEmpty(),
+                "the third session is still reached and released — proves the pass did not abort "
+                        + "when the middle session's release() threw");
+        assertTrue(sessions.get(b.paneId()).isEmpty(),
+                "the middle session is still deregistered — release() removes it from the registry "
+                        + "before launcher.stop() runs, regardless of whether stop() then throws");
+        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_1"), "the first pane is stopped");
+        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_2"),
+                "the middle pane's stop was attempted, even though it failed");
+        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_3"), "the third pane is stopped");
+        assertEquals(List.of(a.worktree(), c.worktree()), worktrees.removeCalls().stream().sorted().toList(),
+                "the middle session's worktree removal never runs — release() throws before reaching "
+                        + "it — while the other two, unaffected, still have theirs removed");
+    }
+
     @Test
     void unchangedRegressionCleanCompletedReleaseStillRemovesTheWorktree() {
         FakeHerdr herdr = new FakeHerdr();
@@ -1083,6 +1156,41 @@ class SessionManagerTest {
                 "COMPLETED release of a clean worktree still removes it");
     }
 
+    /**
+     * fleetd #293: {@code HerdrPeerLauncher.stop()} used to run {@code spaces.closeTab} bare — a
+     * failing {@code tab.close} (any code other than {@code *_not_found}) propagated straight out
+     * of {@code stop()}. {@code SessionManager.release} calls {@code launcher.stop(paneId)} with
+     * no try/catch (fleetd #283 wrapped the WORKTREE-removal step further down, not this one), so
+     * the throw happened <em>before</em> that worktree-removal step ever ran — and by then {@code
+     * registry.remove(paneId)} had already run, so a second {@code stop} is a no-op: the worktree
+     * leaked with no retry path. The pane itself is already closed by the time {@code tab.close}
+     * runs, so its failure is cosmetic workspace tidying, not a real teardown failure. The fix
+     * wraps {@code closeTab} inside {@code stop()} so it no longer throws for this reason; this
+     * test proves both halves at once: {@code release()} does not throw, and it still removes the
+     * worktree.
+     */
+    @Test
+    void releaseStillRemovesTheWorktreeWhenCloseTabFails() {
+        FakeHerdr herdr = new FakeHerdr();
+        RecordingWorktrees worktrees = new RecordingWorktrees();
+        SessionManager sessions = sessionManager(herdr, worktrees);
+        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
+                new WorktreeRequest("cb-293a", null));
+        // FakeHerdr's pane.get always answers with tab_id "w9:t2" for a tab-placement spawn.
+        herdr.tabCloseFailsForTab("w9:t2", "internal_error");
+
+        assertDoesNotThrow(() -> sessions.release(s.paneId()),
+                "a failing tab.close is cosmetic (the pane is already closed by then) — it must not "
+                        + "propagate out of release()");
+
+        assertTrue(herdr.called("tab.close"), "tab.close was still attempted");
+        assertEquals(List.of(s.worktree()), worktrees.removeCalls(),
+                "release() must still remove the worktree even though tab.close failed — this is "
+                        + "the leak fleetd #293 reports: before the fix, release() never reached this "
+                        + "step at all");
+        assertTrue(sessions.get(s.paneId()).isEmpty(), "the session is still deregistered");
+    }
+
     @Test
     void unchangedRegressionDirtyCompletedReleaseStillPreservesTheWorktree() {
         FakeHerdr herdr = new FakeHerdr();