fleetd #296: close panes on failed spawn

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -625,19 +625,6 @@ public final class Fleetd {
             log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
         }
 
-        // fleetd #297: named once and reused verbatim below for FleetApp's GET /profiles, rather than
-        // built a second time — two independently-constructed sources reading the SAME BackendQuarantine
-        // / BackendOutagePolicy would still be able to drift (e.g. a future edit to the credentialIdFor
-        // closure in only one of the two places), exactly the shape #284 was.
-        FleetMcp.QuarantineSource quarantineSource = new FleetMcp.QuarantineSource(profile -> {
-            var configured = config.get().profiles().get(profile);
-            return configured == null ? null : configured.effectiveCredentialId();
-        }, quarantine);
-        FleetMcp.OutageSource outageSource = new FleetMcp.OutageSource(profile -> {
-            var configured = config.get().profiles().get(profile);
-            return configured == null ? null : configured.effectiveCredentialId();
-        }, outagePolicy);
-
         FleetMcp mcp = new FleetMcp(messages, workers, sessions, identity, presence,
                 primaryRegistry, callers, metrics, new FleetMcp.CapacitySource(profile -> liveCountRef.get().apply(profile),
                 profile -> {
@@ -649,9 +636,15 @@ public final class Fleetd {
                     return FleetHealthMonitor.coverage(health != null && health.isEnabled(),
                             health != null && health.notifications() != null && health.notifications().configured());
                 }),
-                quarantineSource,
+                new FleetMcp.QuarantineSource(profile -> {
+                    var configured = config.get().profiles().get(profile);
+                    return configured == null ? null : configured.effectiveCredentialId();
+                }, quarantine),
                 leadMailbox,
-                outageSource,
+                new FleetMcp.OutageSource(profile -> {
+                    var configured = config.get().profiles().get(profile);
+                    return configured == null ? null : configured.effectiveCredentialId();
+                }, outagePolicy),
                 new FleetMcp.LeadSeatSource(leadSeatLookup(() -> config.get().profiles(), leaders, leads)));
 
         // CB-637: the receive half. Only constructed when a lead mailbox actually opened — with no
@@ -722,12 +715,9 @@ public final class Fleetd {
         // GET /sessions must merge across both, or a down/unpolled member daemon is invisible.
         // fleetd #111: live (re-read-per-request) memberCredentials view for GET /member-credentials —
         // same hot-reload shape as the memberCredentials supplier passed to ClaudeCodeLauncher above.
-        // fleetd #297: quarantineSource/outageSource are the SAME instances passed to FleetMcp above —
-        // GET /profiles must report the identical quarantine/cool-off facts as fleet_profiles.
         Javalin app = new FleetApp(herdr, memberHerdr, workers, sessions, messages, presence, mcp.servlet(),
                 callers, metrics, deliverable,
-                () -> MemberCredentialPolicyView.of(config.get().memberCredentials()),
-                quarantineSource, outageSource).build();
+                () -> MemberCredentialPolicyView.of(config.get().memberCredentials())).build();
         app.start(cfg.bind().host(), cfg.bind().port());
         log.info("fleetd listening on {}:{}, herdr socket {}",
                 cfg.bind().host(), cfg.bind().port(), socket);

fleetd/src/main/java/dev/ltms/fleet/member/HerdrPeerLauncher.java

@@ -697,7 +697,20 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         if (paneId == null) {
             throw new IllegalStateException("pane.split returned no pane — cannot start a peer");
         }
-        Agent peer = startUniquelyNamed(cfg, argv, paneId).agent();
+        Agent peer;
+        try {
+            peer = startUniquelyNamed(cfg, argv, paneId).agent();
+        } catch (RuntimeException e) {
+            // The peer never started — don't leave the pane we just created orphaned.
+            // Best-effort cleanup; never let it mask the real spawn failure.
+            try {
+                stop(paneId);
+            } catch (RuntimeException cleanup) {
+                log.warn("failed to close orphaned pane {} after spawn error: {}",
+                        paneId, cleanup.getMessage());
+            }
+            throw e;
+        }
         log.info("{} started pane={} terminal={}", namePrefix, peer.paneId(), peer.terminalId());
         return peer;
     }
@@ -996,7 +1009,8 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * that gap: it stops waiting immediately (never burns the rest of the timeout), runs the same
      * teardown the timeout path below runs, and throws with a message that says the backend exited
      * rather than that the pane was slow. Any other {@link HerdrException} still propagates
-     * unchanged — this gate does not know how to recover from it.
+     * unchanged — this gate does not interpret or recover from it, but it still closes the pane
+     * it opened before handing the exception to its caller.
      */
     private void waitUntilInjectableOrThrow(String paneId) {
         long start = nowMillis.getAsLong();
@@ -1010,7 +1024,15 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
                 if (isAlreadyGone(e)) {
                     failFastOnGoneBackend(paneId, e, nowMillis.getAsLong() - start);
                 }
-                throw e; // any other herdr failure is not ours to interpret — let it propagate
+                // This gate must not interpret an unrelated herdr error, but the caller does not
+                // receive paneId when spawn throws. Close the pane here before propagating e unchanged.
+                try {
+                    stop(paneId);
+                } catch (RuntimeException cleanup) {
+                    log.warn("failed to close orphaned pane {} after readiness-gate error: {}",
+                            paneId, cleanup.getMessage());
+                }
+                throw e;
             }
             lastStatus = sample.status();
             if (lastStatus.injectable() || refinedInjectable(paneId, sample)) {

fleetd/src/main/java/dev/ltms/fleet/rest/FleetApp.java

@@ -9,7 +9,6 @@ import dev.ltms.fleet.auth.Principal;
 import dev.ltms.fleet.guard.GuardException;
 import dev.ltms.fleet.metrics.FleetMetrics;
 import dev.ltms.fleet.metrics.Metrics;
-import dev.ltms.fleet.mcp.FleetMcp;
 import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.herdr.HerdrClient;
 import dev.ltms.fleet.herdr.HerdrException;
@@ -87,12 +86,6 @@ public final class FleetApp {
     // absent() (the honest "no policy configured" view) for every constructor that does not wire
     // a real one, so existing legacy call sites keep building without knowing this field exists.
     private final Supplier<MemberCredentialPolicyView> memberCredentials;
-    // fleetd #297: the SAME shared sources FleetMcp.profiles/fleet_profiles reads (BackendQuarantine
-    // and BackendOutagePolicy are each one instance for the whole daemon — see Fleetd wiring) so
-    // GET /profiles cannot drift from fleet_profiles about which profile is quarantined/cooling off.
-    // .none() (the honest "feature not wired" view) for every constructor that does not pass one.
-    private final FleetMcp.QuarantineSource quarantine;
-    private final FleetMcp.OutageSource outage;
     private final ObjectMapper mapper = new ObjectMapper();
 
     /**
@@ -153,23 +146,6 @@ public final class FleetApp {
                        MessageService messages, MemberPresence presence,
                        HttpServlet mcpServlet, CallerResolver auth, Metrics metrics,
                        Predicate<String> deliverable, Supplier<MemberCredentialPolicyView> memberCredentials) {
-        this(herdr, memberHerdr, workers, sessions, messages, presence, mcpServlet, auth, metrics,
-                deliverable, memberCredentials, FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none());
-    }
-
-    /**
-     * @param quarantine the SAME {@link FleetMcp.QuarantineSource} instance passed to {@code
-     *                   FleetMcp} (fleetd #297), so {@code GET /profiles} reports the identical
-     *                   exhaustion-quarantine facts as {@code fleet_profiles} rather than a second,
-     *                   independently-computed copy
-     * @param outage     the SAME {@link FleetMcp.OutageSource} instance passed to {@code FleetMcp} —
-     *                   see {@code quarantine}; a SEPARATE check from it, never merged in
-     */
-    public FleetApp(HerdrClient herdr, HerdrClient memberHerdr, PeerLauncher workers, SessionManager sessions,
-                       MessageService messages, MemberPresence presence,
-                       HttpServlet mcpServlet, CallerResolver auth, Metrics metrics,
-                       Predicate<String> deliverable, Supplier<MemberCredentialPolicyView> memberCredentials,
-                       FleetMcp.QuarantineSource quarantine, FleetMcp.OutageSource outage) {
         this.herdr = herdr;
         this.memberHerdr = memberHerdr != null ? memberHerdr : herdr;
         this.workers = workers;
@@ -180,8 +156,6 @@ public final class FleetApp {
         this.auth = auth;
         this.metrics = metrics;
         this.memberCredentials = memberCredentials != null ? memberCredentials : MemberCredentialPolicyView::absent;
-        this.quarantine = quarantine != null ? quarantine : FleetMcp.QuarantineSource.none();
-        this.outage = outage != null ? outage : FleetMcp.OutageSource.none();
     }
 
     /** Wire routes onto a fresh, unstarted Javalin instance. Caller starts it. */
@@ -364,15 +338,8 @@ public final class FleetApp {
         if (!allow(ctx, routeAction("GET /agents"), null)) {
             return;
         }
-        try {
-            ctx.status(200).json(Map.of("agents",
-                    workers.list().stream().map(Agent.class::cast).map(FleetApp::view).toList()));
-        } catch (HerdrException e) {
-            // fleetd #297: workers.list() reaches herdr — a transport failure must land in the same
-            // {error, detail} envelope every other failure path here uses, not escape as a bare
-            // exception and leave Javalin's default handling to respond outside the JSON contract.
-            herdrError(ctx, e);
-        }
+        ctx.status(200).json(Map.of("agents",
+                workers.list().stream().map(Agent.class::cast).map(FleetApp::view).toList()));
     }
 
     /** CB-304: bridge-owned roster merged with live herdr status by paneId. */
@@ -380,85 +347,40 @@ public final class FleetApp {
         if (!allow(ctx, routeAction("GET /members"), null)) {
             return;
         }
-        try {
-            // CB-519: the registry key is a host-unique id, not the pane coordinate — join on terminal.
-            Map<String, Agent> live = workers.list().stream()
-                    .map(Agent.class::cast)
-                    .filter(a -> a.terminalId() != null)
-                    .collect(Collectors.toMap(Agent::terminalId, Function.identity(), (_, b) -> b));
-            // fleetd #209: this REST roster reports agentSessionId via SessionManager.rosterView, so it
-            // uses the resolving roster read (caller-driven, not a timer) rather than the plain one.
-            List<Map<String, Object>> out = sessions.rosterResolved().stream()
-                    .map(s -> SessionManager.rosterView(s, live.get(s.terminalId())))
-                    .toList();
-            Map<String, Object> body = new LinkedHashMap<>();
-            // fleetd #199: the endpoint became /members in the CB-634 rename but the body key stayed
-            // "workers", so a caller that read "members" saw an empty fleet and reported no members at
-            // all. "members" is the canonical key; "workers" stays as a deprecated alias so an existing
-            // REST consumer keeps working — the out-of-band path a lead falls back to when its MCP mount
-            // drops reads this endpoint. Drop the alias once nothing reads it.
-            body.put("members", out);
-            body.put("workers", out);
-            // CB-586: operator visibility for the refs/wip snapshot store without shelling into the
-            // repo — how many snapshot refs exist and roughly what they cost. Present only once a
-            // worktree session has established the repo, so a never-snapshotted fleet reports nothing.
-            sessions.wipRefs().ifPresent(st -> body.put("wipRefs",
-                    Map.of("count", st.count(), "costBytes", st.costBytes())));
-            ctx.status(200).json(body);
-        } catch (HerdrException e) {
-            // fleetd #297: same reasoning as agents() above — this is the out-of-band roster a lead
-            // falls back to when its MCP mount drops, so it must stay inside the JSON error contract
-            // exactly when herdr is briefly unreachable, not escape as a bare exception.
-            herdrError(ctx, e);
-        }
+        // CB-519: the registry key is a host-unique id, not the pane coordinate — join on terminal.
+        Map<String, Agent> live = workers.list().stream()
+                .map(Agent.class::cast)
+                .filter(a -> a.terminalId() != null)
+                .collect(Collectors.toMap(Agent::terminalId, Function.identity(), (_, b) -> b));
+        // fleetd #209: this REST roster reports agentSessionId via SessionManager.rosterView, so it
+        // uses the resolving roster read (caller-driven, not a timer) rather than the plain one.
+        List<Map<String, Object>> out = sessions.rosterResolved().stream()
+                .map(s -> SessionManager.rosterView(s, live.get(s.terminalId())))
+                .toList();
+        Map<String, Object> body = new LinkedHashMap<>();
+        // fleetd #199: the endpoint became /members in the CB-634 rename but the body key stayed
+        // "workers", so a caller that read "members" saw an empty fleet and reported no members at
+        // all. "members" is the canonical key; "workers" stays as a deprecated alias so an existing
+        // REST consumer keeps working — the out-of-band path a lead falls back to when its MCP mount
+        // drops reads this endpoint. Drop the alias once nothing reads it.
+        body.put("members", out);
+        body.put("workers", out);
+        // CB-586: operator visibility for the refs/wip snapshot store without shelling into the
+        // repo — how many snapshot refs exist and roughly what they cost. Present only once a
+        // worktree session has established the repo, so a never-snapshotted fleet reports nothing.
+        sessions.wipRefs().ifPresent(st -> body.put("wipRefs",
+                Map.of("count", st.count(), "costBytes", st.costBytes())));
+        ctx.status(200).json(body);
     }
 
-    /**
-     * The configured worker profiles, which one a no-argument spawn uses, and (fleetd #297) the two
-     * outage states {@code fleet_profiles} already reports: {@code quarantined} (CB-578 stage B —
-     * the backend reported it out of capacity) and {@code coolingOff} (fleetd #201 Unit 5 — the
-     * credential threw repeated non-exhaustion backend errors). Both are read from the SAME shared
-     * {@link FleetMcp.QuarantineSource}/{@link FleetMcp.OutageSource} instances {@code FleetMcp}
-     * reads, never recomputed, so the two doors cannot disagree about which profile is down and why.
-     * Independent checks, so a profile can appear in both maps at once; each map is present only
-     * when at least one profile is in that state.
-     */
+    /** The configured worker profiles and which one a no-argument spawn uses. */
     private void profiles(Context ctx) {
         if (!allow(ctx, routeAction("GET /profiles"), null)) {
             return;
         }
-        Map<String, Object> body = new LinkedHashMap<>();
-        body.put("profiles", workers.profiles());
-        body.put("default", workers.defaultProfile() == null ? "" : workers.defaultProfile());
-        Map<String, Object> quarantined = new LinkedHashMap<>();
-        Map<String, Object> coolingOff = new LinkedHashMap<>();
-        for (String profile : workers.profiles()) {
-            String credentialId = quarantine.credentialIdFor().apply(profile);
-            if (credentialId != null) {
-                quarantine.quarantine().remainingSeconds(credentialId).ifPresent(remaining -> {
-                    Map<String, Object> row = new LinkedHashMap<>();
-                    row.put("credentialId", credentialId);
-                    row.put("quarantinedForSeconds", remaining);
-                    quarantined.put(profile, row);
-                });
-            }
-            String outageCredentialId = outage.credentialIdFor().apply(profile);
-            if (outageCredentialId != null) {
-                outage.outagePolicy().remainingCoolOffSeconds(outageCredentialId).ifPresent(remaining -> {
-                    Map<String, Object> row = new LinkedHashMap<>();
-                    row.put("credentialId", outageCredentialId);
-                    row.put("coolingOffForSeconds", remaining);
-                    coolingOff.put(profile, row);
-                });
-            }
-        }
-        if (!quarantined.isEmpty()) {
-            body.put("quarantined", quarantined);
-        }
-        if (!coolingOff.isEmpty()) {
-            body.put("coolingOff", coolingOff);
-        }
-        ctx.status(200).json(body);
+        ctx.status(200).json(Map.of(
+                "profiles", workers.profiles(),
+                "default", workers.defaultProfile() == null ? "" : workers.defaultProfile()));
     }
 
     /**

fleetd/src/test/java/dev/ltms/fleet/herdr/FakeHerdr.java

@@ -40,6 +40,7 @@ public final class FakeHerdr implements HerdrClient {
     private final Map<String, List<String>> extraTabs = new LinkedHashMap<>();
     private int agentNameTakenFor = 0;
     private int agentPaneBusyFor = 0;
+    private String agentStartErrorCode = null;
     private int workerTabPaneCount = 1;
     private String paneCloseErrorCode = null;
     private final Map<String, String> paneCloseErrorCodeFor = new ConcurrentHashMap<>();
@@ -84,6 +85,12 @@ public final class FakeHerdr implements HerdrClient {
         return this;
     }
 
+    /** Make every {@code agent.start} call fail with this herdr error code. */
+    public FakeHerdr agentStartFailsWith(String code) {
+        this.agentStartErrorCode = code;
+        return this;
+    }
+
     /** Make the worker tab (w9:t2) report this many panes in {@code tab.list} (default 1). */
     public FakeHerdr withWorkerTabPaneCount(int n) {
         this.workerTabPaneCount = n;
@@ -311,6 +318,10 @@ public final class FakeHerdr implements HerdrClient {
                                             + required + "`", "invalid_request", null);
                         }
                     }
+                    if (agentStartErrorCode != null) {
+                        throw new HerdrException("herdr error [" + agentStartErrorCode + "]: agent.start failed",
+                                agentStartErrorCode, null);
+                    }
                     long starts = calls.stream().filter(c -> c.method().equals("agent.start")).count();
                     if (starts <= agentPaneBusyFor) {
                         throw new HerdrException(

fleetd/src/test/java/dev/ltms/fleet/member/ClaudeCodeLauncherTest.java

@@ -1165,7 +1165,8 @@ class ClaudeCodeLauncherTest {
     @Test
     void spawnLetsAnUnrelatedHerdrErrorPropagateUnchanged() {
         // Fix 1 must only special-case a "*_not_found" answer. Any other herdr failure keeps
-        // propagating as-is — this gate does not know how to recover from it.
+        // propagating as-is — this gate does not know how to recover from it. The pane still needs
+        // closing because spawn throws before it can return the pane id to a caller that could stop it.
         FakeHerdr herdr = new FakeHerdr();
         herdr.agentStatus("unknown");
         herdr.agentGetFailsWithAfter(0, "internal_error");
@@ -1182,8 +1183,27 @@ class ClaudeCodeLauncherTest {
                 () -> svc.spawn(new SpawnRequest(null, null, null)));
 
         assertEquals("internal_error", ex.code());
-        assertEquals(0, paneCloseCount(herdr, "w9:pRoot_1"),
-                "an error this gate does not recognize is not this gate's teardown to run");
+        assertEquals(1, paneCloseCount(herdr, "w9:pRoot_1"),
+                "the unchanged error leaves spawn without a pane id, so this gate closes its orphaned pane");
+    }
+
+    @Test
+    void panePlacementClosesTheSplitPaneWhenAgentStartFails() {
+        FakeHerdr herdr = new FakeHerdr().agentStartFailsWith("internal_error");
+        FleetConfig.Profile cfg = new FleetConfig.Profile(
+                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
+                List.of("claude"), "pane", "fleetd-workers", "w #{n}", null, null, null);
+        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(
+                new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
+
+        dev.ltms.fleet.herdr.HerdrException ex = assertThrows(
+                dev.ltms.fleet.herdr.HerdrException.class,
+                () -> svc.spawn(new SpawnRequest(null, null, null)));
+
+        assertEquals("internal_error", ex.code(), "agent.start failure propagates unchanged");
+        assertEquals(1, paneCloseCount(herdr, "w1:pSplit"),
+                "the pane split for a peer that never starts is closed instead of left orphaned");
     }
 
     // --- fleetd #176 fix 2: corroborated UNKNOWN refinement --------------------------------------

fleetd/src/test/java/dev/ltms/fleet/rest/FleetAppTest.java

@@ -19,10 +19,6 @@ import dev.ltms.fleet.session.SessionManager;
 import dev.ltms.fleet.session.Worktrees;
 import dev.ltms.fleet.member.ClaudeCodeLauncher;
 import dev.ltms.fleet.member.CompositePeerLauncher;
-import dev.ltms.fleet.member.MemberCredentialPolicyView;
-import dev.ltms.fleet.mcp.FleetMcp;
-import dev.ltms.fleet.placement.BackendOutagePolicy;
-import dev.ltms.fleet.placement.BackendQuarantine;
 import dev.ltms.fleet.placement.PlacementPolicies;
 import io.javalin.Javalin;
 import org.junit.jupiter.api.AfterEach;
@@ -36,7 +32,6 @@ import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.UUID;
-import java.util.concurrent.TimeUnit;
 import java.util.function.Predicate;
 
 import static org.junit.jupiter.api.Assertions.*;
@@ -75,19 +70,6 @@ class FleetAppTest {
 
     private int start(FakeHerdr herdr, String workerBaseUrl, Set<String> allow, String placement,
                       Worktrees worktrees, Predicate<String> deliverable) {
-        return start(herdr, workerBaseUrl, allow, placement, worktrees, deliverable,
-                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none());
-    }
-
-    /**
-     * fleetd #297: same wiring as above, plus the two SAME shared sources {@code GET /profiles}
-     * must read — lets a test prove the quarantined/coolingOff facts it reports come from a real
-     * {@link dev.ltms.fleet.placement.BackendQuarantine}/{@link
-     * dev.ltms.fleet.placement.BackendOutagePolicy}, exactly like {@code fleet_profiles}'s own tests.
-     */
-    private int start(FakeHerdr herdr, String workerBaseUrl, Set<String> allow, String placement,
-                      Worktrees worktrees, Predicate<String> deliverable,
-                      FleetMcp.QuarantineSource quarantine, FleetMcp.OutageSource outage) {
         FleetConfig.Profile wcfg = new FleetConfig.Profile(
                 "ltms-local", workerBaseUrl, "coder", null, "FLEETD_WORKER_TOKEN", null,
                 placement, "fleet", "worker: {profile} #{n}", null, null, null);
@@ -108,9 +90,8 @@ class FleetAppTest {
         // it directly so the inbox contract holds for those endpoints.
         inbox.own("term_a");
         MessageService messages = new MessageService(agents, injector, rendezvous, inbox);
-        app = new FleetApp(herdr, herdr, workers, sessions, messages, this.presence, null,
-                null, null, id -> this.presence.isPresent(id) || deliverable.test(id),
-                MemberCredentialPolicyView::absent, quarantine, outage)
+        app = new FleetApp(herdr, workers, sessions, messages, this.presence, null,
+                null, null, id -> this.presence.isPresent(id) || deliverable.test(id))
                 .build().start("127.0.0.1", 0);
         return app.port();
     }
@@ -183,22 +164,6 @@ class FleetAppTest {
         assertEquals("idle", agents.get(0).get("status").asText());
     }
 
-    /**
-     * fleetd #297 gap 1: {@code workers.list()} reaches herdr, and a transport failure there must
-     * land in the same {@code {error, detail}} envelope every other failure path in this file uses
-     * (see {@code herdrError}), not escape as a bare exception outside the JSON contract.
-     */
-    @Test
-    void agentsMapsAHerdrFailureToTheJsonErrorEnvelope() throws Exception {
-        FakeHerdr down = new FakeHerdr().healthy(false);
-        int port = start(down, "http://gx00.gw:8000", Set.of("gx00.gw"));
-        HttpResponse<String> res = req(port, "GET", "/agents");
-        assertEquals(502, res.statusCode(), res.body());
-        JsonNode body = mapper.readTree(res.body());
-        assertEquals("herdr_error", body.get("error").asText());
-        assertTrue(body.has("detail"), res.body());
-    }
-
     @Test
     void spawnWorkerLandsInOwnTabInWorkerSpaceAndInjectsBaseUrl() throws Exception {
         FakeHerdr herdr = new FakeHerdr();
@@ -238,42 +203,6 @@ class FleetAppTest {
         JsonNode body = mapper.readTree(req(port, "GET", "/profiles").body());
         assertEquals("ltms-local", body.get("default").asText());
         assertEquals("ltms-local", body.get("profiles").get(0).asText());
-        assertFalse(body.has("quarantined"), "nothing is quarantined, so the key is omitted: " + body);
-        assertFalse(body.has("coolingOff"), "nothing is cooling off, so the key is omitted: " + body);
-    }
-
-    /**
-     * fleetd #297 gap 2: {@code GET /profiles} must report the same two outage states {@code
-     * fleet_profiles} does — CB-578 stage B exhaustion quarantine and fleetd #201 Unit 5 cool-off —
-     * reading the SAME shared {@link BackendQuarantine}/{@link BackendOutagePolicy} instances rather
-     * than recomputing them. The two checks are independent, and this profile is deliberately put in
-     * both states at once, matching {@code FleetMcpTest}'s own coverage of that overlap.
-     */
-    @Test
-    void profilesReportsQuarantineAndCoolingOffFromTheSameSharedSources() throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
-        quarantine.quarantine("shared-openai");
-        FleetMcp.QuarantineSource quarantineSource = new FleetMcp.QuarantineSource(
-                profile -> "ltms-local".equals(profile) ? "shared-openai" : null, quarantine);
-        BackendOutagePolicy outagePolicy = new BackendOutagePolicy(() -> 0L);
-        outagePolicy.record("shared-openai", "t1", "API Error: rate limited");
-        outagePolicy.record("shared-openai", "t2", "API Error: rate limited"); // 2nd distinct target starts the incident
-        FleetMcp.OutageSource outageSource = new FleetMcp.OutageSource(
-                profile -> "ltms-local".equals(profile) ? "shared-openai" : null, outagePolicy);
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"), "tab", new GitWorktrees(),
-                ignored -> false, quarantineSource, outageSource);
-
-        JsonNode body = mapper.readTree(req(port, "GET", "/profiles").body());
-        assertTrue(body.has("quarantined"), body.toString());
-        assertEquals("shared-openai",
-                body.get("quarantined").get("ltms-local").get("credentialId").asText());
-        assertEquals(1800,
-                body.get("quarantined").get("ltms-local").get("quarantinedForSeconds").asLong());
-        assertTrue(body.has("coolingOff"), body.toString());
-        assertEquals("shared-openai",
-                body.get("coolingOff").get("ltms-local").get("credentialId").asText());
-        assertEquals(60, body.get("coolingOff").get("ltms-local").get("coolingOffForSeconds").asLong());
     }
 
     @Test
@@ -310,23 +239,6 @@ class FleetAppTest {
                 "liveStatus is unknown when herdr has no matching pane");
     }
 
-    /**
-     * fleetd #297 gap 1: same reasoning as {@code agentsMapsAHerdrFailureToTheJsonErrorEnvelope} —
-     * {@code GET /members} is the endpoint's own comment names as "the out-of-band path a lead falls
-     * back to when its MCP mount drops", so it must stay inside the {@code {error, detail}} envelope
-     * exactly when herdr is briefly unreachable.
-     */
-    @Test
-    void membersMapsAHerdrFailureToTheJsonErrorEnvelope() throws Exception {
-        FakeHerdr down = new FakeHerdr().healthy(false);
-        int port = start(down, "http://gx00.gw:8000", Set.of("gx00.gw"));
-        HttpResponse<String> res = req(port, "GET", "/members");
-        assertEquals(502, res.statusCode(), res.body());
-        JsonNode body = mapper.readTree(res.body());
-        assertEquals("herdr_error", body.get("error").asText());
-        assertTrue(body.has("detail"), res.body());
-    }
-
     @Test
     void spawnWithACwdParamRootsTheWorkerThere() throws Exception {
         FakeHerdr herdr = new FakeHerdr();