audit: teardown/cleanup review of dev.ltms.fleet.session

AUDIT.md

@@ -0,0 +1,69 @@
+# Teardown/cleanup audit — dev.ltms.fleet.session
+
+Scope: `SessionManager.java`, `GitWorktrees.java`, `SessionReaper.java`, `MemberSession.java`,
+`Worktrees.java` (interface). Read-only; no code changed.
+
+## Main finding
+
+```
+1. SessionManager.java:336-338
+2. issue: the final worktree removal in release() is the one step in the whole method
+   that is not wrapped in try/catch. Every other cleanup step here (hasUncommitted check,
+   snapshot, listener notification) is defended because a `git` call can throw — exec()'s
+   own javadoc documents both a non-zero exit and its 30-second timeout as normal failure
+   modes, and every sibling worktrees.* call in this class is guarded against exactly that.
+   By the time this line runs, registry.remove(paneId) and handles.remove(paneId) have
+   already happened and launcher.stop(paneId) has already run, so if worktrees.remove()
+   throws here (e.g. `git worktree remove --force` times out on a stale lock file or a
+   slow/network filesystem, or exits non-zero), the exception escapes release() with no
+   way to retry: the paneId is already gone from the registry, so a second stop call is a
+   no-op and never re-attempts the removal. The worktree directory is now leaked forever,
+   invisible to `fleet_list`. The caller sees a stop failure — FleetMcp.stop() only catches
+   HerdrException, and FleetApp.stopMember() catches nothing — even though the session was
+   in fact fully torn down (pane stopped, deregistered, listeners notified).
+3. fix: wrap the `worktrees.remove(...)` call at the end of release() in a try/catch that
+   logs a warning, matching the pattern already used for every other cleanup step in this
+   method (e.g. cleanupAfterAddFailure's own worktree/branch removal, or the dirty-check
+   catch above it).
+4. severity: medium
+```
+
+## Secondary findings
+
+```
+1. SessionManager.java:503-514 (acquireWithWorktree's catch block)
+2. issue: after worktrees.add() succeeds, if overlayParity(), shareWithGroup(), or
+   launcher.spawn() then throws, the catch block removes only the worktree
+   (worktrees.remove(repoRoot, path)) and never deletes the branch `git worktree add`
+   created. GitWorktrees.cleanupAfterAddFailure — the sibling cleanup for failures inside
+   add() itself — explicitly deletes the branch too, with a `-D` and a documented reason
+   ("a branch that never finished provisioning has no session, no PR, nothing else
+   pointing at it"). That reasoning applies equally here, but this later catch block (the
+   one covering the three post-add() steps) omits it. Since spawn failures are a normal,
+   recurring event (this very branch already logs "spawn failed for profile=..."), this
+   leaks an orphan `worker/<slug>-<nonce>` branch in the shared repo on every such failure,
+   with nothing pointing at it once the (failed) session is never registered.
+3. fix: after worktrees.remove(...) succeeds in this catch, also delete the branch with
+   `git branch -D branch` (best-effort, log-only on failure), matching
+   cleanupAfterAddFailure's own two-step cleanup.
+4. severity: low
+```
+
+No other issue in this scope survived a read of every exit of `add()`, `remove()`,
+`snapshot()`, `overlayParity()`, `shareWithGroup()`/`shareRootWithGroup()`, `release()`,
+`reapIdle()`, `drainAll()`, and the `SessionReaper` loop. Two shapes I checked and ruled
+out as not reachable / not defects:
+
+- `release()`'s `worktrees.repoRoot(removed.cwd())` looked suspicious because `cwd` for a
+  worktree session is the worktree path itself, so `repoRoot` would equal `worktreePath` —
+  but I verified with a live git repo (`git --version` 2.53.0) that
+  `git -C <worktree> worktree remove --force <same worktree>` works correctly: git
+  resolves `-C` against the common git dir regardless of which linked worktree it's given,
+  so this is not a bug.
+- `git worktree remove --force` on a worktree containing a nested `.git` directory: I
+  expected this to need a double `--force` per older git docs, but tested it live and a
+  single `--force` succeeds on git 2.53.0. Not a live failure mode on this stack.
+
+The `if (x != null)` guard-in-catch shape from fleetd #274 (guard assigned only at the end)
+does not recur elsewhere in this scope: every `catch` block that guards on a local now
+assigns that local before the risky call it protects, not after.

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -250,7 +250,9 @@ public final class Fleetd {
         boolean clearAfterTurn = cfg.lifecycle() != null && cfg.lifecycle().clearAfterTurn();
         SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot(), cfg.worktreeGroup()),
                 System::nanoTime, contextCap, clearAfterTurn);
-        liveCountRef.set(profileName -> liveSessionCount(sessions.roster(), profileName));
+        liveCountRef.set(profileName -> (int) sessions.roster().stream()
+                .filter(s -> profileName.equals(s.profile()))
+                .count());
 
         // CB-303 part 1: idle-ttl reaper — only when configured, defaults to disabled.
         final SessionReaper reaper;
@@ -625,19 +627,6 @@ public final class Fleetd {
             log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
         }
 
-        // fleetd #297: named once and reused verbatim below for FleetApp's GET /profiles, rather than
-        // built a second time — two independently-constructed sources reading the SAME BackendQuarantine
-        // / BackendOutagePolicy would still be able to drift (e.g. a future edit to the credentialIdFor
-        // closure in only one of the two places), exactly the shape #284 was.
-        FleetMcp.QuarantineSource quarantineSource = new FleetMcp.QuarantineSource(profile -> {
-            var configured = config.get().profiles().get(profile);
-            return configured == null ? null : configured.effectiveCredentialId();
-        }, quarantine);
-        FleetMcp.OutageSource outageSource = new FleetMcp.OutageSource(profile -> {
-            var configured = config.get().profiles().get(profile);
-            return configured == null ? null : configured.effectiveCredentialId();
-        }, outagePolicy);
-
         FleetMcp mcp = new FleetMcp(messages, workers, sessions, identity, presence,
                 primaryRegistry, callers, metrics, new FleetMcp.CapacitySource(profile -> liveCountRef.get().apply(profile),
                 profile -> {
@@ -649,9 +638,15 @@ public final class Fleetd {
                     return FleetHealthMonitor.coverage(health != null && health.isEnabled(),
                             health != null && health.notifications() != null && health.notifications().configured());
                 }),
-                quarantineSource,
+                new FleetMcp.QuarantineSource(profile -> {
+                    var configured = config.get().profiles().get(profile);
+                    return configured == null ? null : configured.effectiveCredentialId();
+                }, quarantine),
                 leadMailbox,
-                outageSource,
+                new FleetMcp.OutageSource(profile -> {
+                    var configured = config.get().profiles().get(profile);
+                    return configured == null ? null : configured.effectiveCredentialId();
+                }, outagePolicy),
                 new FleetMcp.LeadSeatSource(leadSeatLookup(() -> config.get().profiles(), leaders, leads)));
 
         // CB-637: the receive half. Only constructed when a lead mailbox actually opened — with no
@@ -722,12 +717,9 @@ public final class Fleetd {
         // GET /sessions must merge across both, or a down/unpolled member daemon is invisible.
         // fleetd #111: live (re-read-per-request) memberCredentials view for GET /member-credentials —
         // same hot-reload shape as the memberCredentials supplier passed to ClaudeCodeLauncher above.
-        // fleetd #297: quarantineSource/outageSource are the SAME instances passed to FleetMcp above —
-        // GET /profiles must report the identical quarantine/cool-off facts as fleet_profiles.
         Javalin app = new FleetApp(herdr, memberHerdr, workers, sessions, messages, presence, mcp.servlet(),
                 callers, metrics, deliverable,
-                () -> MemberCredentialPolicyView.of(config.get().memberCredentials()),
-                quarantineSource, outageSource).build();
+                () -> MemberCredentialPolicyView.of(config.get().memberCredentials())).build();
         app.start(cfg.bind().host(), cfg.bind().port());
         log.info("fleetd listening on {}:{}, herdr socket {}",
                 cfg.bind().host(), cfg.bind().port(), socket);
@@ -867,19 +859,6 @@ public final class Fleetd {
                 .orElse(null);
     }
 
-    /**
-     * Count sessions that occupy a profile's spawn capacity. A {@code BACKEND_ERROR} or
-     * {@code FAILED} session stays in the roster so {@code fleet_list} can show its failure, but a
-     * member that cannot accept another delivery does not use a seat.
-     */
-    static int liveSessionCount(List<MemberSession> roster, String profileName) {
-        return (int) roster.stream()
-                .filter(session -> profileName.equals(session.profile()))
-                .filter(session -> session.state() != MemberSession.State.BACKEND_ERROR)
-                .filter(session -> session.state() != MemberSession.State.FAILED)
-                .count();
-    }
-
     /**
      * fleetd #248 / fleetd#201 Unit 5: factory for the production {@link BackendErrorSink} — the
      * collaborator {@link CompletionResolver} notifies when a pane-scrape classification actually

fleetd/src/main/java/dev/ltms/fleet/auth/CallerResolver.java

@@ -236,15 +236,7 @@ public final class CallerResolver {
         // loopback-trust: same-host callers that are not workers are the primary. A non-loopback
         // caller is anonymous even here — and startup refuses that combination anyway
         // (FleetConfig.validateAuthExposure), so this is defence in depth, not the control.
-        //
-        // fleetd #317: "not a worker" must not be conflated with "identity unresolved". The real
-        // primary is a real process — its pid resolves (c.resolved()), it just owns no herdr pane.
-        // A caller whose peer-PID lookup failed (LsofPeerPidLookup's -1 sentinel — on any failure,
-        // silently including "lsof found no match") has no such pid, and PaneLocator's own javadoc
-        // already names what happens if that case is handed the primary role: a worker→primary
-        // escalation. So an unresolved caller is refused (ANONYMOUS — the same clean, already-tested
-        // "authenticated as nothing" outcome used everywhere else in this method), never promoted.
-        return isLoopback(remoteAddr) && c.resolved() ? Principal.primary(c.pid()) : Principal.anonymous();
+        return isLoopback(remoteAddr) ? Principal.primary(c.pid()) : Principal.anonymous();
     }
 
     private boolean presentedTokenMatches(String authorizationHeader) {
@@ -270,15 +262,11 @@ public final class CallerResolver {
         return token.isEmpty() ? null : token;
     }
 
-    /**
-     * fleetd #305: delegates to {@link ConnectionIdentity#isLoopback}. This used to be a second,
-     * independent copy of the same rule, and the two drifted: this one accepted all of
-     * {@code 127.0.0.0/8}, {@code ConnectionIdentity}'s accepted only {@code 127.0.0.1}. A caller
-     * from {@code 127.0.0.2} therefore had its identity skipped (so it had no terminal) and was
-     * then read as loopback here — which under loopback-trust is the primary. Sharing the inputs
-     * would not have prevented that; only sharing the computation does.
-     */
     private static boolean isLoopback(String remoteAddr) {
-        return ConnectionIdentity.isLoopback(remoteAddr);
+        if (remoteAddr == null) {
+            return false;
+        }
+        return remoteAddr.equals("127.0.0.1") || remoteAddr.equals("::1")
+                || remoteAddr.equals("0:0:0:0:0:0:0:1") || remoteAddr.startsWith("127.");
     }
 }

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -322,9 +322,8 @@ public record FleetConfig(
      *                       statement that does not stop being true just because the profile was
      *                       named directly. A negative value has no sane meaning (there is no
      *                       "excluded" to degrade to below zero) and is refused at config load
-     *                       instead, naming the profile and the key. Live means a session that can
-     *                       receive another delivery. The roster keeps terminal {@code BACKEND_ERROR}
-     *                       and {@code FAILED} sessions for diagnostics, but they do not use capacity.
+     *                       instead, naming the profile and the key. Live means any session the
+     *                       registry still owns (acquired and not yet released), in any state.
      * @param kind           which peer launcher spawns this profile: {@code "claude-code"} (default —
      *                       the {@link dev.ltms.fleet.member.ClaudeCodeLauncher}) or {@code "opencode"}.
      *                       The {@code CompositePeerLauncher} routes {@code spawn}/reap by this value, so

fleetd/src/main/java/dev/ltms/fleet/health/FleetHealthMonitor.java

@@ -14,7 +14,6 @@ import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
-import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
 import java.util.function.BiConsumer;
@@ -29,14 +28,6 @@ public final class FleetHealthMonitor {
     static final int MAX_FAIL_TARGET_ATTEMPTS = 3;
     // CB-641: Match the injector's 60s readiness gate so health allows a full first boot.
     static final long READINESS_GRACE_NANOS = TimeUnit.SECONDS.toNanos(60);
-    /**
-     * fleetd #280: how long after a terminal transition to wait before the one bounded re-check
-     * fires. Must exceed the worst-case reverse-rendezvous {@code fleet_ask} window (55-115s, see
-     * {@code FleetMcp.ASK_DEFAULT_TIMEOUT_MS} / {@code FleetApp.MAX_ASK_TIMEOUT_MS}) so that, if the
-     * target was genuinely {@code ASKING} when {@code state} was first observed, its own ask has had
-     * time to lapse (clearing {@code Task#question} back to {@code null}) before this fires.
-     */
-    static final long ASK_LAPSE_RECHECK_DELAY_SECONDS = 120;
 
     private final AgentControl agents;
     private final Supplier<List<MemberSession>> roster;
@@ -47,16 +38,7 @@ public final class FleetHealthMonitor {
     private final long workingSuspectAfterNanos;
     private final BiConsumer<String, String> failTarget;
     private final Map<String, HealthPrior> priors = new HashMap<>();
-    /**
-     * The live classification per member, and the only one of this class's three maps that more
-     * than one scheduler task touches. {@code tick} writes it (and prunes it to the roster);
-     * fleetd #280's delayed {@link #recheckTerminalTarget} reads it from its own separate scheduled
-     * task. Both run on the single-threaded scheduler {@code Fleetd} passes in today, so they are
-     * serialised — but nothing in this class enforces that, and an unsynchronised {@link HashMap}
-     * read racing a resize can spin a CPU forever rather than fail visibly. {@code priors} and
-     * {@code orphanStreaks} stay plain maps because {@code tick} is still their only toucher.
-     */
-    private final Map<String, HealthState> states = new ConcurrentHashMap<>();
+    private final Map<String, HealthState> states = new HashMap<>();
     /**
      * CB-643: consecutive ticks on which a target looked like an orphaned delegation. The fact
      * {@link MessageService#hasOrphanedDelegation} reports is a true snapshot, but it can read true
@@ -189,7 +171,6 @@ public final class FleetHealthMonitor {
         // member stayed terminal.
         if (terminal(next)) {
             failTerminalTarget(target, next);
-            scheduleTerminalRecheck(target, next);
         }
     }
 
@@ -210,48 +191,6 @@ public final class FleetHealthMonitor {
                 target, state, MAX_FAIL_TARGET_ATTEMPTS, last);
     }
 
-    /**
-     * fleetd #280: schedule the one bounded, delayed follow-up for a terminal transition — never a
-     * per-tick retry (CB-580 rejected that shape; {@link #reportTransition} still fires
-     * {@link #failTerminalTarget} exactly once per transition, unconditionally on the tick loop).
-     * This is a single one-shot task, scheduled once per transition into GONE/NEVER_READY, so a
-     * member stuck terminal for the rest of its life gets exactly one extra attempt, not one per
-     * tick. See {@link #recheckTerminalTarget} for why the extra attempt is safe.
-     */
-    private void scheduleTerminalRecheck(String target, HealthState state) {
-        if (scheduler.isShutdown()) return;
-        try {
-            scheduler.schedule(() -> recheckTerminalTarget(target, state),
-                    ASK_LAPSE_RECHECK_DELAY_SECONDS, TimeUnit.SECONDS);
-        } catch (RuntimeException e) {
-            log.warn("fleet health: could not schedule terminal re-check for member={} state={}",
-                    target, state, e);
-        }
-    }
-
-    /**
-     * fleetd #280: the delayed re-check {@link #scheduleTerminalRecheck} scheduled for one terminal
-     * transition. By now, a {@code fleet_ask} that was still open when {@code state} was first
-     * observed has had time to lapse on its own (see {@link #ASK_LAPSE_RECHECK_DELAY_SECONDS}),
-     * clearing {@code Task#question} back to {@code null} — which is exactly what
-     * {@link MessageService#abandon(String, String, boolean)}'s {@code sweepAsking=false} filter
-     * needs to finally match it. Calling {@link #failTerminalTarget} again is safe only because
-     * {@code sweepAsking} stays {@code false}: a task genuinely still {@code ASKING} is skipped
-     * exactly as it was on the very first attempt — this never fails a ticket whose ask has not yet
-     * lapsed.
-     *
-     * <p><strong>Guarded on "target is still classified {@code state}."</strong> Without this guard,
-     * a member that recovered (or was released and dropped from the roster) between the transition
-     * and this re-check would still take a blind {@code failTarget} call — reaching into whatever
-     * brand-new, unrelated turn it has since picked up and failing it too. {@link #states} already
-     * carries the live classification (updated every tick, pruned to the current roster on release),
-     * so a stale or recovered target simply reads as a mismatch here and this is a no-op.
-     */
-    void recheckTerminalTarget(String target, HealthState state) {
-        if (states.get(target) != state) return;
-        failTerminalTarget(target, state);
-    }
-
     private static boolean terminal(HealthState state) {
         return state == HealthState.GONE || state == HealthState.NEVER_READY;
     }

fleetd/src/main/java/dev/ltms/fleet/inject/Injector.java

@@ -157,7 +157,6 @@ public final class Injector {
         boolean awaitingCompletion; // a delivered message's turn is not yet known-complete
         boolean turnObserved;      // saw a real `working` sample since that delivery (turn ran)
         int unknownSinceTurn;      // consecutive `unknown` samples while a delegation is outstanding (CB-109)
-        int unknownSincePostTurn;  // the same, for the post-turn housekeeping phase (fleetd #306)
         int notReadySincePoll;     // consecutive injectable samples a queued message waited on the readiness gate (CB-114)
         boolean postTurnPending;   // completion observed; adapter housekeeping has not started yet
         boolean awaitingPostTurnPickup;
@@ -218,12 +217,10 @@ public final class Injector {
                 t.awaitingPickup = false;
                 t.injectableSincePickup = 0;
                 t.unknownSinceTurn = 0;
-                t.unknownSincePostTurn = 0;
                 t.notReadySincePoll = 0;
                 if (t.awaitingCompletion) t.turnObserved = true;
             } else if (status.injectable()) { // IDLE or BLOCKED
                 t.unknownSinceTurn = 0;
-                t.unknownSincePostTurn = 0;
                 if (t.awaitingPostTurnPickup) {
                     if (++t.injectableSincePostTurnPickup >= PICKUP_GRACE_POLLS) {
                         t.awaitingPostTurnPickup = false;
@@ -318,24 +315,6 @@ public final class Injector {
                     t.unknownSinceTurn = 0;
                     turnFailed = true;
                 }
-                // fleetd #306: the same escape for the post-turn housekeeping phase. Four latches
-                // gate delivery (awaitingCompletion, postTurnPending, awaitingPostTurnPickup,
-                // postTurnObserved) and only the first had a way out of a sustained unknown streak —
-                // a gate that closed one direction only. The other two below are released here as
-                // well; postTurnPending needs no escape because it is cleared unconditionally on the
-                // line after the listener call that sets it.
-                //
-                // This does NOT set turnFailed. The delegated turn already completed and its waiter
-                // already resolved — what is outstanding is adapter housekeeping (the `/clear`).
-                // Reporting a turn failure here would drive SessionManager.onFailed on a session
-                // that genuinely finished its work, which is a worse lie than the wedge.
-                if ((t.awaitingPostTurnPickup || t.postTurnObserved)
-                        && ++t.unknownSincePostTurn >= TURN_STALL_GRACE_POLLS) {
-                    t.awaitingPostTurnPickup = false;
-                    t.postTurnObserved = false;
-                    t.injectableSincePostTurnPickup = 0;
-                    t.unknownSincePostTurn = 0;
-                }
             }
 
             // Reclaim the entry once the worker is fully quiescent (nothing queued, no pickup or

fleetd/src/main/java/dev/ltms/fleet/mcp/ConnectionIdentity.java

@@ -36,25 +36,6 @@ public final class ConnectionIdentity {
      * primary / an off-host client) and its {@code pid} (or {@code -1} if not resolvable).
      */
     public record Caller(String terminal, long pid) {
-
-        /**
-         * Whether the OS peer-PID lookup actually succeeded — {@code false} means {@code pid} is
-         * the {@code -1} sentinel, not a real process id, so this caller's identity could not be
-         * established at all. That is a different fact from a real pid that simply owns no worker
-         * pane (the primary's own connection): the primary is {@code resolved()} and has a
-         * {@code null terminal}; an unresolvable caller is {@code !resolved()} and also has a
-         * {@code null terminal}. The two look identical through {@link #terminal} alone, which is
-         * exactly how fleetd #317 happened — a failed {@code lsof} lookup and a genuine primary both
-         * fell through to {@code Principal.primary(...)}.
-         *
-         * <p>Centralised here, next to the sentinel it tests, for the same reason
-         * {@link ConnectionIdentity#isLoopback} is centralised rather than left for each caller to
-         * reimplement: a raw {@code pid > 0} check duplicated at every call site is precisely the
-         * "one rule, two copies" shape that let #305 drift.
-         */
-        public boolean resolved() {
-            return pid > 0;
-        }
     }
 
     /** Resolve the caller's terminal and PID from one peer-PID lookup. */
@@ -79,30 +60,7 @@ public final class ConnectionIdentity {
         return pid > 0 ? cwds.cwdForPid(pid) : null;
     }
 
-    /**
-     * Whether {@code addr} is a same-host address, and therefore one whose peer PID is worth
-     * looking up. <strong>This is the one definition of loopback in the daemon</strong> —
-     * {@code CallerResolver} calls it rather than keeping its own, because the two used to differ
-     * and that difference was a privilege escalation (fleetd #305).
-     *
-     * <p>The whole of {@code 127.0.0.0/8} counts, not just {@code 127.0.0.1}. On Linux every
-     * address in that range is bound to {@code lo} by default, so a process can connect to
-     * {@code 127.0.0.1:8765} with a source address of {@code 127.0.0.2} — measured on the Linux
-     * fleet host, where binding that source succeeds.
-     *
-     * <p><strong>Being strict here does not make the daemon safer; it makes it unsafe.</strong>
-     * That reads backwards, so it is worth stating plainly. This predicate does not decide whether
-     * a caller is trusted — it decides whether the caller's identity is <em>resolved at all</em>.
-     * Returning false means {@link #resolve} answers "no terminal", and downstream a caller with no
-     * terminal is treated as the primary under loopback-trust. So every address excluded here is an
-     * address on which a worker silently becomes the lead. Widening a check normally weakens it;
-     * widening this one is what closes the hole.
-     */
-    public static boolean isLoopback(String addr) {
-        if (addr == null) {
-            return false;
-        }
-        String a = addr.startsWith("::ffff:") ? addr.substring(7) : addr; // IPv4-mapped IPv6
-        return a.startsWith("127.") || "::1".equals(a) || "0:0:0:0:0:0:0:1".equals(a);
+    private static boolean isLoopback(String addr) {
+        return "127.0.0.1".equals(addr) || "::1".equals(addr) || "0:0:0:0:0:0:0:1".equals(addr);
     }
 }

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -22,7 +22,6 @@ import dev.ltms.fleet.placement.BackendQuarantine;
 import dev.ltms.fleet.placement.PlacementException;
 import dev.ltms.fleet.session.SessionManager;
 import dev.ltms.fleet.session.MemberSession;
-import dev.ltms.fleet.session.ShuttingDownException;
 import dev.ltms.fleet.session.WorktreeRequest;
 import dev.ltms.fleet.peer.MemberRole;
 import dev.ltms.fleet.peer.PeerLauncher;
@@ -258,7 +257,7 @@ public final class FleetMcp {
         // Each handler is built once and wired to its fleet_* tool below.
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> sendHandler =
                 (exchange, req) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_send", req.arguments()),
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.SEND,
                             str(req.arguments(), "sessionId"));
                     if (denied != null) return denied;
                     String caller = callerTerminal(exchange);
@@ -300,7 +299,7 @@ public final class FleetMcp {
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> replyHandler =
                 (exchange, req) -> {
                     String self = callerTerminal(exchange);
-                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_reply", req.arguments()), self);
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.REPLY, self);
                     if (denied != null) return denied;
                     return reply(messages, self, str(req.arguments(), "content"));
                 };
@@ -308,13 +307,13 @@ public final class FleetMcp {
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> askHandler =
                 (exchange, req) -> {
                     String self = callerTerminal(exchange);
-                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_ask", req.arguments()), self);
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.ASK, self);
                     if (denied != null) return denied;
                     return ask(messages, self, str(req.arguments(), "question"), timeoutMs(req.arguments()));
                 };
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> statusHandler =
                 (exchange, req) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_status", req.arguments()), null);
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                     if (denied != null) return denied;
                     return status(messages, str(req.arguments(), "sessionId"));
                 };
@@ -323,7 +322,7 @@ public final class FleetMcp {
                     Map<String, Object> a = req.arguments();
                     String target = str(a, "target");
                     // The action depends on the ARGUMENTS, not on the tool name -- see pollAction.
-                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_poll", a), target);
+                    McpSchema.CallToolResult denied = deny(exchange, pollAction(target), target);
                     if (denied != null) return denied;
                     return poll(messages, str(a, "ticket"), target);
                 };
@@ -332,14 +331,14 @@ public final class FleetMcp {
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> ackHandler =
                 (exchange, req) -> {
                     Map<String, Object> a = req.arguments();
-                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_ack", a), str(a, "target"));
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.DRAIN, str(a, "target"));
                     if (denied != null) return denied;
                     return ack(messages, str(a, "target"), str(a, "msgId"));
                 };
         // Fleet management (CB-108): spawn/list/stop over ClaudeCodeLauncher.
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> spawnHandler =
                 (exchange, req) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_spawn", req.arguments()), null);
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.SPAWN, null);
                     if (denied != null) return denied;
                     String caller = callerTerminal(exchange);
                     // SPAWN is already auth-gated to PRIMARY (architects can never call it), but
@@ -356,7 +355,7 @@ public final class FleetMcp {
                 };
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> listHandler =
                 (exchange, _) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_list", Map.of()), null);
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                     if (denied != null) return denied;
                     return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, outage,
                             leadSeats, callers == null ? Map.of() : callers.leads(),
@@ -366,19 +365,19 @@ public final class FleetMcp {
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> stopHandler =
                 (exchange, req) -> {
                     String paneId = str(req.arguments(), "paneId");
-                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_stop", req.arguments()), paneId);
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.STOP, paneId);
                     if (denied != null) return denied;
                     return stop(sessions, paneId);
                 };
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> profilesHandler =
                 (exchange, _) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_profiles", Map.of()), null);
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                     if (denied != null) return denied;
                     return profiles(workers, quarantine, outage);
                 };
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> whoamiHandler =
                 (exchange, _) -> {
-                    McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_whoami", Map.of()), null);
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                     if (denied != null) return denied;
                     return whoami(principal(exchange), sessions);
                 };
@@ -755,25 +754,6 @@ public final class FleetMcp {
         return isBlank(target) ? Authz.Action.READ : Authz.Action.DRAIN;
     }
 
-    /**
-     * The action a registered tool handler actually hands to the authorization gate.
-     * Keeping this choice beside the registered-tool inventory makes a new tool fail the coverage
-     * test until its action is pinned.
-     */
-    static Authz.Action toolAction(String toolName, Map<String, Object> arguments) {
-        return switch (toolName) {
-            case "fleet_send" -> Authz.Action.SEND;
-            case "fleet_reply" -> Authz.Action.REPLY;
-            case "fleet_ask" -> Authz.Action.ASK;
-            case "fleet_status", "fleet_list", "fleet_profiles", "fleet_whoami" -> Authz.Action.READ;
-            case "fleet_poll" -> pollAction(str(arguments, "target"));
-            case "fleet_ack" -> Authz.Action.DRAIN;
-            case "fleet_spawn" -> Authz.Action.SPAWN;
-            case "fleet_stop" -> Authz.Action.STOP;
-            default -> throw new IllegalArgumentException("unregistered tool: " + toolName);
-        };
-    }
-
     /** {@code fleet_poll}: check an async delegation by ticket, or drain a worker's inbox by target. */
     static McpSchema.CallToolResult poll(MessageService messages, String ticket, String target) {
         if (!isBlank(target)) {
@@ -814,12 +794,7 @@ public final class FleetMcp {
             return error("fleet_reply is for workers only — could not identify the calling worker "
                     + "from the connection");
         }
-        // fleetd #302: isBlank, not == null, to match fleet_send's own guard above. MessageService
-        // .reply now REJECTS blank content, and this handler is a bare BiFunction with no try/catch
-        // around it — so a whitespace-only fleet_reply would leave here as an uncaught
-        // IllegalArgumentException instead of this clean tool error. Null and whitespace are the
-        // same mistake by the caller and must get the same answer.
-        if (isBlank(content)) {
+        if (content == null) {
             return error("content is required");
         }
         messages.reply(callerTerminal, content);
@@ -963,10 +938,6 @@ public final class FleetMcp {
             return text(json(memberView(member)));
         } catch (GuardException e) {
             return error("subscription boundary: " + e.getMessage());
-        } catch (ShuttingDownException e) {
-            // fleetd #308: the daemon's shutdown drain has already started — refuse loudly rather
-            // than register a session drainAll will never see again.
-            return error("shutting down: " + e.getMessage());
         } catch (PlacementException e) {
             // CB-599: no candidate had capacity (maxLoad, quarantine, or all-exhausted) — distinct
             // from "profile does not exist" below.
@@ -1025,25 +996,6 @@ public final class FleetMcp {
      * both maps at once when it is both exhaustion-quarantined AND cooling off.
      */
     static McpSchema.CallToolResult profiles(PeerLauncher workers, QuarantineSource quarantine, OutageSource outage) {
-        return text(json(profilesView(workers, quarantine, outage)));
-    }
-
-    /**
-     * The body both front doors answer {@code profiles} with: the configured profile names, the
-     * default, and the two independent outage states — {@code quarantined} (the backend reported it
-     * out of capacity) and {@code coolingOff} (the credential threw repeated non-exhaustion backend
-     * errors). Each map is present only when at least one profile is in that state, and a profile
-     * can appear in both at once, because the two checks are separate.
-     *
-     * <p>fleetd #297: extracted so {@code fleet_profiles} and {@code GET /profiles} render from ONE
-     * body builder rather than two copies. Passing both doors the same {@link QuarantineSource} and
-     * {@link OutageSource} instances is necessary but not sufficient: with the loop written out
-     * twice, a later edit to the row shape — a renamed key, an added field — lands on one door and
-     * not the other, and the two then disagree about a live outage. That is exactly what fleetd
-     * #284 was, where one rule computed in two places was widened in only one and a single response
-     * contradicted itself. Shared inputs do not make duplicated computation safe.
-     */
-    public static Map<String, Object> profilesView(PeerLauncher workers, QuarantineSource quarantine, OutageSource outage) {
         Map<String, Object> result = new LinkedHashMap<>();
         result.put("profiles", workers.profiles());
         result.put("default", workers.defaultProfile() == null ? "" : workers.defaultProfile());
@@ -1075,7 +1027,7 @@ public final class FleetMcp {
         if (!coolingOff.isEmpty()) {
             result.put("coolingOff", coolingOff);
         }
-        return result;
+        return text(json(result));
     }
 
     /**
@@ -1196,35 +1148,15 @@ public final class FleetMcp {
     private static Map<String, Object> memberCapacityView(MemberSession session, Agent live,
                                                            MessageService messages, long nowNanos) {
         Map<String, Object> row = SessionManager.rosterView(session, live);
-        boolean reclaimable = reclaimable(session, messages);
+        boolean open = messages != null && messages.hasAcceptedDelivery(session.terminalId());
+        boolean inbox = messages != null && messages.hasInboxMessage(session.terminalId());
+        boolean reclaimable = (session.state() == MemberSession.State.READY || session.state() == MemberSession.State.DONE)
+                && !open && !inbox;
         row.put("reclaimable", reclaimable);
         row.put("idleForSeconds", reclaimable ? Math.max(0, (nowNanos - session.lastActivityAtNanos()) / 1_000_000_000L) : null);
         return row;
     }
 
-    /**
-     * The one definition of {@code reclaimable}: this member holds a spawn seat, and has no open
-     * bridge work, so stopping it gives the seat back. Both views in a single {@code fleet_list}
-     * response call it — the per-member flag in {@link #memberCapacityView} and the per-profile
-     * count in {@link #capacityView} — because two copies of this rule in one response is how the
-     * two numbers come to disagree.
-     *
-     * <p>fleetd #284: {@code BACKEND_ERROR} and {@code FAILED} are deliberately NOT reclaimable.
-     * The ticket asked for them to be, and that half of the ticket was wrong. Once
-     * {@code Fleetd.liveSessionCount} stopped counting a terminal session as live, that seat is
-     * ALREADY in {@code free}; counting it here too reports the same seat twice, and
-     * {@code free + reclaimable} then reads as more capacity than {@code maxLoad} allows. The dead
-     * session stays visible either way: its roster row still carries {@code state:
-     * "backend_error"} or {@code "failed"}, which is what tells the lead to stop it.
-     */
-    static boolean reclaimable(MemberSession session, MessageService messages) {
-        boolean holdsSeat = session.state() == MemberSession.State.READY
-                || session.state() == MemberSession.State.DONE;
-        return holdsSeat && (messages == null
-                || (!messages.hasAcceptedDelivery(session.terminalId())
-                        && !messages.hasInboxMessage(session.terminalId())));
-    }
-
     /**
      * CB-583: {@code free} alone cannot tell a lead "busy, will free up" from "refusing, and
      * nothing changes for N seconds" — those need different decisions. So a quarantined profile
@@ -1263,7 +1195,8 @@ public final class FleetMcp {
         int live = liveCount.apply(profile);
         int leadSeatCount = leadSeats.seatsFor().apply(profile);
         int reclaimable = (int) roster.stream().filter(s -> profile.equals(s.profile()))
-                .filter(s -> reclaimable(s, messages))
+                .filter(s -> (s.state() == MemberSession.State.READY || s.state() == MemberSession.State.DONE))
+                .filter(s -> messages == null || (!messages.hasAcceptedDelivery(s.terminalId()) && !messages.hasInboxMessage(s.terminalId())))
                 .count();
         Map<String, Object> row = new LinkedHashMap<>();
         row.put("profile", profile); row.put("maxLoad", cap); row.put("live", live);

fleetd/src/main/java/dev/ltms/fleet/mcp/LsofPeerPidLookup.java

@@ -41,14 +41,6 @@ public final class LsofPeerPidLookup implements PeerPidLookup {
             if (!p.waitFor(2, TimeUnit.SECONDS)) {
                 p.destroyForcibly();
             }
-            if (found < 0) {
-                // fleetd #317: this is the silent path — lsof ran clean and simply reported no
-                // matching process (e.g. queried before the OS socket table settles). Previously
-                // this logged nothing at all, which is exactly why the escalation went unnoticed;
-                // the exception path below already logs. A caller now refused because of this is
-                // still refused (never promoted) — this line only makes the refusal diagnosable.
-                log.debug("lsof peer-pid lookup for port {} found no matching process", port);
-            }
             return found;
         } catch (Exception e) {
             log.debug("lsof peer-pid lookup for port {} failed: {}", port, e.getMessage());

fleetd/src/main/java/dev/ltms/fleet/member/ClaudeCodeLauncher.java

@@ -540,66 +540,16 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * itself is still lost, because there is no OS-level compare-and-swap on a plain file, only this
      * cooperative narrowing of the gap.
      *
-     * <p><b>fleetd #285: refuses under {@code memberHerdrSocket} rather than writing somewhere the
-     * member cannot read.</b> Under {@code memberHerdrSocket:} the member pane runs as a
-     * <em>different OS user with its own {@code $HOME}</em> — the same reason {@link
-     * #writeCharterFile} routes the role/reply charter under {@code worktreeRoot} instead of
-     * {@code java.io.tmpdir} and refuses the spawn when it cannot. This method has no equivalent
-     * relocation available: unlike the charter (fleetd's own content, free to place anywhere and
-     * hand to the peer via an argv flag), {@code .claude.json} is a file Claude Code looks up for
-     * ITSELF at a fixed location — {@code CLAUDE_CONFIG_DIR/.claude.json}, or else the member OS
-     * user's own {@code ~/.claude.json}, a path fleetd has no channel to learn. So when {@code
-     * configDir} is unset, there is no member-readable target to seed at all — writing the
-     * unqualified default would land in <em>fleetd's own</em> {@code ~/.claude.json} instead, the
-     * exact defect this fix closes, not a workable fallback. And even with {@code configDir} set,
-     * the file this method itself just wrote is {@code 0600} (owner-only — see {@link
-     * #copyPosixPermissionsIfPresent}), unreadable by a different-uid member unless shared with
-     * {@code worktreeGroup}, the same group {@link EnvAllowListScrub#shareWithGroup} already uses
-     * for the ZDOTDIR scrub (fleetd #213) and the charter file (fleetd #219/#222). So under {@code
-     * memberHerdrSocket} this method requires BOTH {@code configDir} and {@code worktreeGroup}
-     * before it ever touches a file, and refuses the spawn — naming exactly which one is missing —
-     * rather than silently corrupt fleetd's own home or hand the member an unreadable path. This
-     * mirrors {@link #writeCharterFile}'s "refuse, don't degrade" decision: a member spawned without
-     * a readable trust seed is not degraded, it sits on the interactive dialog forever and never
-     * calls {@code fleet_reply} — exactly the failure fleetd #149 exists to prevent, so trading it
-     * for "spawn something" is not worth it. When {@code configDir} and {@code worktreeGroup} are
-     * both present, the write proceeds exactly as below and the resulting file is additionally
-     * chgrp'd/chmod'd group-readable ({@code rw-r-----}) via {@link
-     * EnvAllowListScrub#shareFileWithGroup(Path, String)} so the member's OS user can actually
-     * open it — the
-     * directory itself (unlike {@code worktreeRoot} or the charter's per-spawn directory) is not
-     * fleetd-managed, so its own traversal permissions remain the operator's setup, same as they
-     * already must be for the member to read anything else fleetd points {@code CLAUDE_CONFIG_DIR}
-     * at. With {@code memberHerdrSocket} ABSENT (today's only live mode) every branch below is
-     * byte-identical to before this fix.
-     *
      * @param configDir the profile's {@code CLAUDE_CONFIG_DIR} ({@code cfg.configDir()}), or
-     *                  {@code null}/blank to target the default {@code ~/.claude.json} — refused
-     *                  outright when {@code memberHerdrSocket} is configured, see above
+     *                  {@code null}/blank to target the default {@code ~/.claude.json}
      * @param cwd       the spawn's resolved working directory — the exact key Claude Code will look
      *                  up for itself once it starts there
-     * @throws IllegalStateException when {@code memberHerdrSocket} is configured but {@code
-     *                                configDir} and/or {@code worktreeGroup} is not — the same
-     *                                refusal shape as {@link #writeCharterFile}
      */
-    private void seedTrustDialog(String configDir, String cwd) {
+    private static void seedTrustDialog(String configDir, String cwd) {
         if (!isProvisionedWorktree(cwd)) {
             return;
         }
         boolean unsetConfigDir = configDir == null || configDir.isBlank();
-        boolean memberHerdrSocket = memberHerdrSocketConfigured();
-        String group = memberHerdrSocket ? memberGroup() : null;
-        if (memberHerdrSocket && (unsetConfigDir || group == null)) {
-            throw new IllegalStateException("memberHerdrSocket is configured, so the workspace-trust "
-                    + "seed (.claude.json, which gates Claude Code's interactive trust dialog) must be "
-                    + "placed where the member's OS user can read it — configDir, shared via "
-                    + "worktreeGroup — but " + (unsetConfigDir ? "configDir" : "worktreeGroup")
-                    + " is not configured. Refusing to spawn rather than write fleetd's own default "
-                    + "'~/.claude.json' or hand the member a config file it cannot read: that member "
-                    + "would sit on the interactive trust dialog forever and never reach an "
-                    + "injectable state. Configure configDir on this profile and worktreeGroup on the "
-                    + "fleet to enable claude-code member spawns under memberHerdrSocket.");
-        }
         Path target = unsetConfigDir
                 ? Path.of(System.getProperty("user.home"), ".claude.json")
                 : Path.of(configDir, ".claude.json");
@@ -609,20 +559,18 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
             // profile that simply forgot to set configDir gets no signal at all short of the
             // operator noticing their own file changing. Say so loudly, every time it is about to
             // happen, rather than only once ever: each occurrence is a live write to a real
-            // person's home config and deserves its own log line. (Reached only when
-            // memberHerdrSocket is absent — the block above already refused otherwise.)
+            // person's home config and deserves its own log line.
             log.warn("seedTrustDialog: profile has no configDir set, so the workspace-trust seed "
                     + "for cwd '{}' is about to write the operator's own default '{}' — set "
                     + "configDir on this profile to target a per-member config file instead",
                     cwd, target);
         }
         synchronized (TRUST_JSON_LOCK) {
-            boolean written = false;
             try {
                 if (target.getParent() != null) {
                     Files.createDirectories(target.getParent());
                 }
-                for (int attempt = 1; attempt <= MAX_TRUST_JSON_CAS_ATTEMPTS && !written; attempt++) {
+                for (int attempt = 1; attempt <= MAX_TRUST_JSON_CAS_ATTEMPTS; attempt++) {
                     byte[] before = Files.isRegularFile(target) ? Files.readAllBytes(target) : null;
                     ObjectNode root = parseTrustJsonOrEmpty(before);
                     JsonNode projectsNode = root.get("projects");
@@ -663,39 +611,26 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
                         continue;
                     }
                     writeAtomically(target, newContent);
-                    written = true;
-                }
-                if (!written) {
-                    // fleetd #247: deliberately do NOT write here. A member that starts without the
-                    // seed still starts — it may hit the trust dialog fleetd #149 describes and fail
-                    // to reach an injectable state, but that failure is visible (herdr reports it,
-                    // the spawn-readiness gate times out) and recoverable (retry the spawn). Writing
-                    // our stale copy over whatever the other writer left would be silent and, if that
-                    // other writer is the operator's own live session, could destroy real
-                    // configuration — fail toward the recoverable outcome, not the silent one.
-                    log.warn("seedTrustDialog: gave up seeding workspace-trust for cwd '{}' into '{}' "
-                            + "after {} attempts — another writer (most plausibly the operator's own "
-                            + "live Claude Code sharing this file) kept changing it faster than we "
-                            + "could re-read it, so nothing was written; the member may show the "
-                            + "trust dialog instead", cwd, target, MAX_TRUST_JSON_CAS_ATTEMPTS);
+                    return;
                 }
+                // fleetd #247: deliberately do NOT write here. A member that starts without the
+                // seed still starts — it may hit the trust dialog fleetd #149 describes and fail to
+                // reach an injectable state, but that failure is visible (herdr reports it, the
+                // spawn-readiness gate times out) and recoverable (retry the spawn). Writing our
+                // stale copy over whatever the other writer left would be silent and, if that other
+                // writer is the operator's own live session, could destroy real configuration —
+                // fail toward the recoverable outcome, not the silent one.
+                log.warn("seedTrustDialog: gave up seeding workspace-trust for cwd '{}' into '{}' "
+                        + "after {} attempts — another writer (most plausibly the operator's own "
+                        + "live Claude Code sharing this file) kept changing it faster than we could "
+                        + "re-read it, so nothing was written; the member may show the trust dialog "
+                        + "instead", cwd, target, MAX_TRUST_JSON_CAS_ATTEMPTS);
             } catch (Exception e) {
                 log.debug("cannot seed workspace-trust entry for cwd '{}' into '{}'", cwd, target, e);
-                return;
-            }
-            // fleetd #285: the write above lands as fleetd's own OS user; under memberHerdrSocket
-            // that is NOT the member's OS user, so without this the member still cannot read the
-            // file it exists to seed — a silent readiness timeout with the write looking "done".
-            // Deliberately OUTSIDE the swallow-all catch above: a group that fails to resolve here
-            // means the seed is unreadable despite a successful write, which must fail as loudly as
-            // writeCharterFile's own EnvAllowListScrub.shareWithGroup call already does.
-            if (written && memberHerdrSocket) {
-                EnvAllowListScrub.shareFileWithGroup(target, group);
             }
         }
     }
 
-
     /** Bound on {@link #seedTrustDialog}'s fleetd #247 compare-and-swap retry loop. */
     private static final int MAX_TRUST_JSON_CAS_ATTEMPTS = 5;
 

fleetd/src/main/java/dev/ltms/fleet/member/EnvAllowListScrub.java

@@ -181,33 +181,6 @@ public final class EnvAllowListScrub {
         }
     }
 
-    /**
-     * fleetd #285: share ONE file with {@code group}, read-only ({@code rw-r-----}) — the same
-     * per-file mode {@link #shareWithGroup} applies to a directory's entries, and the same error
-     * shapes, but without touching a parent directory. Used for a file fleetd writes into a
-     * directory it does NOT own — {@code configDir}'s own traversal permissions stay the
-     * operator's setup — where the directory-wide {@link #shareWithGroup} would be wrong.
-     *
-     * @throws UncheckedIOException when {@code group} does not resolve on this host, the
-     *                              filesystem has no POSIX group ownership, or a
-     *                              group-ownership/permission call is refused
-     */
-    static void shareFileWithGroup(Path file, String group) {
-        try {
-            GroupPrincipal principal = file.getFileSystem().getUserPrincipalLookupService()
-                    .lookupPrincipalByGroupName(group);
-            setGroupAndPermissions(file, principal, "rw-r-----");
-        } catch (IOException e) {
-            throw new UncheckedIOException("cannot share generated file " + file + " with group '"
-                    + group + "' — the group must exist, and the fleetd operator ("
-                    + System.getProperty("user.name") + ") must be a member of it", e);
-        } catch (UnsupportedOperationException e) {
-            throw new UncheckedIOException("cannot share generated file " + file + " with group '"
-                    + group + "' — this filesystem does not support POSIX group ownership",
-                    new IOException(e));
-        }
-    }
-
     private static void setGroupAndPermissions(Path path, GroupPrincipal group, String perms) throws IOException {
         PosixFileAttributeView view = Files.getFileAttributeView(path, PosixFileAttributeView.class);
         if (view == null) {

fleetd/src/main/java/dev/ltms/fleet/member/HerdrPeerLauncher.java

@@ -697,20 +697,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         if (paneId == null) {
             throw new IllegalStateException("pane.split returned no pane — cannot start a peer");
         }
-        Agent peer;
-        try {
-            peer = startUniquelyNamed(cfg, argv, paneId).agent();
-        } catch (RuntimeException e) {
-            // The peer never started — don't leave the pane we just created orphaned.
-            // Best-effort cleanup; never let it mask the real spawn failure.
-            try {
-                stop(paneId);
-            } catch (RuntimeException cleanup) {
-                log.warn("failed to close orphaned pane {} after spawn error: {}",
-                        paneId, cleanup.getMessage());
-            }
-            throw e;
-        }
+        Agent peer = startUniquelyNamed(cfg, argv, paneId).agent();
         log.info("{} started pane={} terminal={}", namePrefix, peer.paneId(), peer.terminalId());
         return peer;
     }
@@ -926,14 +913,9 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * {@link #reapOrphanWorkers() orphan-reap} and spawn-gate-timeout paths, plus any caller that
      * passes a pane directly, keep working without an owning id.
      *
-     * <p>Resolves the tab from the pane <em>before</em> closing it. {@code agents.close} (the pane)
-     * is the one step whose failure means the teardown itself may not have happened: an already-gone
-     * pane (repeated DELETE, crashed peer) is treated as success, but any other failure propagates so
-     * a genuinely failed teardown is not reported as done. {@code spaces.closeTab} (fleetd #293) is
-     * different — by the time it runs the pane is already closed, so it is cosmetic workspace tidying
-     * rather than a real teardown failure, and a failure there is logged and never propagates, so it
-     * cannot mask the two cleanups below it ({@link #releaseZdotdir}, and the caller's worktree
-     * removal in {@code SessionManager.release}).
+     * <p>Resolves the tab from the pane <em>before</em> closing it. An already-gone pane/tab
+     * (repeated DELETE, crashed peer) is treated as success; any other failure propagates so a
+     * genuinely failed teardown is not reported as done.
      */
     @Override
     public void stop(String idOrPane) {
@@ -952,25 +934,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
             log.debug("pane.close({}) ignored — already gone: {}", paneId, e.getMessage());
         }
         if (loc != null && loc.tabPaneCount() == 1) {
-            // fleetd #293: the pane above is already closed by this point, so a failing tab.close is
-            // cosmetic workspace tidying, not a real teardown failure — it must not mask the two
-            // cleanups below it (releaseZdotdir, and the caller's worktree removal). Unlike
-            // agents.close above, this is not narrowed to "already gone": any failure here, whatever
-            // its cause, is one we continue past, so we log it at WARN (not debug) with the tab id a
-            // person can go close by hand.
-            try {
-                spaces.closeTab(loc.tabId());
-            } catch (RuntimeException e) {
-                // Caught as RuntimeException, not HerdrException, to match releaseZdotdir's own
-                // guard five lines below. Today the two are the same set — HerdrCodec wraps every
-                // encode/decode failure and UnixSocketHerdrClient wraps every IOException, so
-                // HerdrException is all closeTab can actually throw. Narrowing to it anyway would
-                // leave this step guarded against the expected failure and bare against any other,
-                // which is the exact asymmetry fleetd #293 exists to remove. No behaviour change
-                // today; it stops a later change inside WorkspaceControl.closeTab reopening it.
-                log.warn("tab.close({}) failed — the pane is already torn down, so continuing; the "
-                        + "tab may need manual cleanup: {}", loc.tabId(), e.getMessage());
-            }
+            spaces.closeTab(loc.tabId());
         } else if (loc != null) {
             log.debug("not closing tab {} — it holds {} panes (not a dedicated peer tab)",
                     loc.tabId(), loc.tabPaneCount());
@@ -1009,8 +973,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
      * that gap: it stops waiting immediately (never burns the rest of the timeout), runs the same
      * teardown the timeout path below runs, and throws with a message that says the backend exited
      * rather than that the pane was slow. Any other {@link HerdrException} still propagates
-     * unchanged — this gate does not interpret or recover from it, but it still closes the pane
-     * it opened before handing the exception to its caller.
+     * unchanged — this gate does not know how to recover from it.
      */
     private void waitUntilInjectableOrThrow(String paneId) {
         long start = nowMillis.getAsLong();
@@ -1024,15 +987,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
                 if (isAlreadyGone(e)) {
                     failFastOnGoneBackend(paneId, e, nowMillis.getAsLong() - start);
                 }
-                // This gate must not interpret an unrelated herdr error, but the caller does not
-                // receive paneId when spawn throws. Close the pane here before propagating e unchanged.
-                try {
-                    stop(paneId);
-                } catch (RuntimeException cleanup) {
-                    log.warn("failed to close orphaned pane {} after readiness-gate error: {}",
-                            paneId, cleanup.getMessage());
-                }
-                throw e;
+                throw e; // any other herdr failure is not ours to interpret — let it propagate
             }
             lastStatus = sample.status();
             if (lastStatus.injectable() || refinedInjectable(paneId, sample)) {

fleetd/src/main/java/dev/ltms/fleet/msg/AmqpReplyInbox.java

@@ -208,72 +208,18 @@ public final class AmqpReplyInbox implements ReplyInbox, AutoCloseable {
         }
     }
 
-    /**
-     * Release ownership of {@code target}: cancel its consumer, then nack-with-requeue every
-     * delivery still held for it instead of just dropping the local record.
-     *
-     * <p><strong>Cancelling a consumer does not requeue its in-flight deliveries.</strong> In AMQP,
-     * a delivery that was pushed to a consumer stays unacked, attached to the still-open
-     * {@link #channel}, until that channel or the connection closes — {@code basicCancel} alone does
-     * neither. So before this method existed with a requeue step, it dropped {@link #held}'s entries
-     * for {@code target} while the broker still considered them outstanding: never acked, never
-     * nacked, never requeued, and no longer reachable by {@link #peek} — permanently invisible. This
-     * is unlike {@link #handleRecovery} and {@link #close()}, whose bare {@code held.clear()} is
-     * correct because each has already made the broker requeue (a real connection drop, or
-     * {@code channel.close()} respectively) before clearing local state.
-     *
-     * <p><strong>Order: cancel first, then nack.</strong> A delivery tag stays valid for
-     * {@code basicNack} on this channel regardless of whether its consumer is still attached — only
-     * a channel/connection close invalidates it — so cancelling {@code target}'s consumer first does
-     * not risk the tags. Doing it the other way round does: nacking a delivery with {@code requeue}
-     * while its consumer is still active hands the message straight back to that <em>same</em>
-     * consumer the instant a prefetch slot frees up (confirmed against a real broker — see
-     * {@code AmqpReplyInboxContractTest.releaseCancelsConsumerAndRequeuesHeldDeliveryForRecovery}),
-     * which races this method's own {@code held.remove(target)}: the redelivery can land after the
-     * clear and leave a stale entry behind, so {@link #peek} is no longer reliably empty right after
-     * {@link #release}. Cancelling first closes that consumer, so the requeued message goes back to
-     * the queue for whichever consumer picks it up next (a later {@link #own}), not this one.
-     *
-     * <p><strong>Failure of the requeue is best-effort, not fatal.</strong> {@link #release} runs
-     * during teardown ({@code Fleetd} calls it right after {@code MessageService.abandon}), and a
-     * throw here would abort cleanups the caller depends on — the same argument fleetd #293 settled
-     * for {@code HerdrPeerLauncher.stop()}'s tab-close step. So a failed {@code basicNack} is logged
-     * at WARN, naming the target and delivery tag that leaked, and release proceeds; the delivery
-     * stays unacked on the broker rather than being silently dropped, so it is still recoverable by a
-     * later connection drop even though this release did not manage to requeue it immediately. A
-     * failed {@code basicCancel} still throws, unchanged from before this fix — that failure means
-     * the consumer may still be attached, so best-effort requeue is not attempted underneath it.
-     */
     @Override
     public void release(String target) {
         synchronized (channelLock) {
             String tag = consumerTags.remove(target);
-            if (tag != null) {
-                try {
-                    channel.basicCancel(tag);
-                } catch (IOException e) {
-                    throw new IllegalStateException("cannot cancel consumer for " + target, e);
-                }
+            held.remove(target);                   // stale delivery tags must not survive release
+            if (tag == null) {
+                return;
             }
-            var perTarget = held.remove(target);
-            if (perTarget != null) {
-                synchronized (perTarget) {
-                    for (Held h : perTarget.values()) {
-                        try {
-                            channel.basicNack(h.deliveryTag(), false, true); // requeue, don't drop
-                        } catch (IOException | RuntimeException e) {
-                            // Caught broadly (not just IOException) for the same reason #293 catches
-                            // RuntimeException in HerdrPeerLauncher.stop(): best-effort teardown must
-                            // not be guarded only against the expected failure and bare against any
-                            // other. The message stays unacked on the broker either way — not lost,
-                            // just not proactively requeued — until a connection drop frees it.
-                            log.warn("release({}): could not requeue held delivery (msgId={}, tag={})"
-                                            + " back to the broker — it stays unacked until a connection"
-                                            + " drop frees it: {}",
-                                    target, h.message().msgId(), h.deliveryTag(), e.getMessage());
-                        }
-                    }
-                }
+            try {
+                channel.basicCancel(tag);
+            } catch (IOException e) {
+                throw new IllegalStateException("cannot cancel consumer for " + target, e);
             }
         }
     }

fleetd/src/main/java/dev/ltms/fleet/msg/MessageService.java

@@ -187,24 +187,6 @@ public final class MessageService {
         private volatile Long completedNanos;
         private volatile Reply question;
         private volatile String turnId;
-        /**
-         * Set when this task's {@code fleet_ask} lapsed with no answer (fleetd #307):
-         * {@link #clearAsyncQuestion} then forgets {@link #turnId} (nulls it and drops the task from
-         * {@code asyncTasksByTurn}) so {@link #hasAsyncQuestion} stops reporting the target BUSY — a
-         * later {@code fleet_send} to it must be accepted, not refused. But the worker's turn is
-         * still genuinely live: it resumed on its own and will eventually call its real
-         * {@code fleet_reply}. Losing {@link #turnId} loses {@link #askAnsweredAsyncTasks}' only
-         * signal that such a reply belongs to this task, so that reply used to fall straight to the
-         * inbox and strand — {@code fleet_poll} stayed {@code PENDING} forever, later force-failed by
-         * {@link #abandon} with the misleading "session released before it replied". This flag is a
-         * second, independent signal that survives the forgetting: {@link #askAnsweredAsyncTasks}
-         * accepts it in place of a live {@link #turnId}, without ever re-adding the task to
-         * {@code asyncTasksByTurn} (so the BUSY release is untouched). Cleared implicitly once
-         * {@link #future} resolves — every match in {@link #askAnsweredAsyncTasks} already requires
-         * {@code !future.isDone()}, so a task that recovered (or was later failed by
-         * {@link #abandon}) can never match again regardless of this flag's value.
-         */
-        private volatile boolean askTimedOut;
 
         private Task(String ticket, String target, LongSupplier nowNanos) {
             this.ticket = ticket;
@@ -413,55 +395,36 @@ public final class MessageService {
      * {@link Rendezvous#resolveQuestion} must keep today's {@code NO_WAITER} behaviour — questions
      * are interactive and must never be queued.
      *
-     * <p><strong>Ambiguous match also falls to the inbox.</strong> {@link #askAnsweredAsyncTasks} can
-     * return more than one entry — a reachable state, not a hypothetical one (see its own javadoc:
-     * an {@code fleet_ask} that lapsed with no answer, fleetd #307, frees the target for a completely fresh
-     * delegation, which can itself go on to ask-and-lapse before the first worker's real reply
-     * arrives). Returning whichever candidate a {@code ConcurrentHashMap} iteration reaches first
-     * would let a genuine reply complete the <em>wrong</em> ticket — silently handing the lead
-     * something that reads like a correct answer to a delegation the worker never touched, which is
-     * worse than a failure because the lead acts on it. When more than one candidate exists, guessing
-     * is not safe: fall back to the inbox exactly as the zero-candidate case does, and let
-     * {@link #abandon} apply the eventual recovery deterministically instead.
+     * <p><strong>Ambiguous match also falls to the inbox.</strong> {@link #askAnsweredAsyncTasks}
+     * cannot actually return more than one entry today (see its own javadoc for why — in short,
+     * {@link #hasAsyncQuestion} keeps a target BUSY, so no second task can reach this state, for as
+     * long as an earlier one's {@code turnId} is still stamped). That is an emergent guarantee from
+     * two other facts, not one this method enforces, so this branch stays in as defence in depth
+     * rather than being removed as dead code: if it ever weakens, returning whichever candidate a
+     * {@code ConcurrentHashMap} iteration reaches first would let a genuine reply complete the
+     * <em>wrong</em> ticket — silently handing the lead something that reads like a correct answer to
+     * a delegation the worker never touched, which is worse than a failure because the lead acts on
+     * it. When more than one candidate exists, guessing is not safe: fall back to the inbox exactly
+     * as the zero-candidate case does, and let {@link #abandon} apply the eventual recovery
+     * deterministically instead.
      *
-     * <p><strong>{@code content} is required (fleetd #302).</strong> Both doors that reach this
-     * method must reject a missing/blank reply the same way, so the check lives here rather than in
-     * either caller: {@code FleetMcp.reply} already refuses a {@code null} content before it ever
-     * calls this method (its own required-arg guard), and no test or production call site anywhere
-     * in the codebase relies on replying with empty content — confirmed by searching every call site
-     * of this method before adding the check, not assumed. Without this guard, a REST {@code
-     * POST /sessions/{id}/reply} whose body omits {@code content} (or a client library that maps a
-     * missing field to {@code ""}) used to reach {@link Rendezvous#resolve} with an empty string,
-     * silently completing the lead's blocking wait with nothing — indistinguishable from a worker
-     * that genuinely replied with nothing, which is worse than a loud failure because it destroys the
-     * information that the reply never arrived.
-     *
-     * @throws IllegalArgumentException if {@code content} is {@code null} or blank — the caller must
-     *         report this as a client error (REST: 400 {@code bad_request}) rather than resolve
-     *         anything
      * @return always {@code true} — the reply resolved a live send, completed a parked ticket, or
      *         was queued
      */
     public boolean reply(String session, String content) {
-        if (content == null || content.isBlank()) {
-            throw new IllegalArgumentException("content is required");
-        }
         if (rendezvous.resolve(session, content)) {
             count(FleetMetrics.REPLIES, "path", "rendezvous");
             return true;                       // a live send took it — unchanged fast path
         }
-        // #137/fleetd #307: no live rendezvous waiter, but this may be the worker's real fleet_reply resuming
-        // a turn that either answer() (#137) or ask() (fleetd #307) already gave up waiting on:
-        //  - answer()'s own bounded wait (the primary's fleet_send{turnId} call, capped well under a
-        //    minute) can time out and close its waiter long before the worker — now actually resuming
-        //    real work — finishes and replies.
-        //  - ask()'s own wait for the primary can time out first, with the worker resuming on its own
-        //    and finishing unanswered.
-        // Either way that reply used to have nowhere to land but the session inbox, leaving the async
-        // ticket's future unresolved forever: fleet_poll{ticket} stayed PENDING until fleet_stop's
-        // abandon() forced it FAILED with a misleading "session released before it replied" reason,
-        // even though the reply had, in fact, arrived. Completing the matching ticket directly here
-        // means fleet_poll{ticket} sees the real reply instead.
+        // #137: no live rendezvous waiter, but this may be the worker's real fleet_reply resuming a
+        // turn that {@link #answer} already gave up waiting on. answer()'s own bounded wait (the
+        // primary's fleet_send{turnId} call, capped well under a minute) can time out and close its
+        // waiter long before the worker — now actually resuming real work — finishes and replies. That
+        // reply used to have nowhere to land but the session inbox, leaving the async ticket's future
+        // unresolved forever: fleet_poll{ticket} stayed PENDING until fleet_stop's abandon() forced it
+        // FAILED with a misleading "session released before it replied" reason, even though the reply
+        // had, in fact, arrived. Completing the matching ticket directly here means fleet_poll{ticket}
+        // sees the real reply instead.
         List<Task> candidates = askAnsweredAsyncTasks(session);
         if (candidates.size() == 1) {
             Task orphan = candidates.get(0);
@@ -492,42 +455,34 @@ public final class MessageService {
     }
 
     /**
-     * Every still-open async task on {@code target} whose worker is genuinely expected to send a
-     * real {@code fleet_reply} next with nothing left registered to catch it: either its
-     * {@code fleet_ask} was already answered — {@link Task#turnId} is stamped but {@link
-     * Task#question} was cleared by {@link #answer} — or its {@code fleet_ask} lapsed unanswered and
-     * {@link Task#askTimedOut} marks that (fleetd #307; {@link Task#turnId} is {@code null} by then, forgotten
-     * so the target is not left BUSY — see {@link Task#askTimedOut}'s own javadoc). Either way the
-     * task's future is not resolved yet. Empty if no such task exists, including the common case
-     * where {@code target}'s worker never used {@code fleet_ask} at all (a task that was never asked
-     * has both {@code turnId == null} and {@code askTimedOut == false}, so it can never match here and
-     * only ever completes through the ordinary rendezvous fast path in {@link #reply}).
+     * Every still-open async task on {@code target} whose {@code fleet_ask} was already answered —
+     * its {@link Task#turnId} is stamped but its {@link Task#question} was cleared by {@link #answer}
+     * — yet whose future is not resolved yet (#137). Empty if no such task exists, including the
+     * common case where {@code target}'s worker never used {@code fleet_ask} at all (a task that was
+     * never asked has {@code turnId == null}, so it can never match here and only ever completes
+     * through the ordinary rendezvous fast path in {@link #reply}).
      *
-     * <p><strong>Can return more than one entry — reachable, not just defence in depth.</strong>
-     * {@link #send} refuses to open a waiter on {@code target} while {@link #hasAsyncQuestion} is
-     * true, and that check matches ANY task whose {@code turnId} is still stamped in
-     * {@code asyncTasksByTurn}. While a task's {@code turnId} stays stamped — {@link #answer} leaves
-     * it in place ({@code clearAsyncQuestion(turnId, false)}) until {@link #finishAsyncTask} removes
-     * the stamp and completes the future in the same call — no second task on the same target can
-     * reach an eligible state, because {@link #send} would refuse it as BUSY first. That single-task
-     * guarantee holds only for the {@code turnId}-stamped half of this method's match: an
-     * {@link Task#askTimedOut} task is, by construction, no longer stamped in {@code asyncTasksByTurn}
-     * (that is the whole point of forgetting {@code turnId} in {@link #clearAsyncQuestion}), so the
-     * target is free the moment one ask lapses. A fresh, independent {@code sendAsync} to the same
-     * target can then be dispatched, itself pause on {@code fleet_ask}, and itself time out — landing
-     * a second {@code askTimedOut} task on the very target the first one is still waiting to answer
-     * for. Two (or more) genuinely open tasks on one target is therefore a real, reachable state
-     * today, not a hypothetical: {@link #reply} treats it as unresolvable and falls back to the
-     * inbox rather than guess which task a reply belongs to (guessing wrong would hand the lead a
-     * plausible-looking answer to a delegation the worker never touched — worse than a failure,
-     * because the lead acts on it); {@link #abandon} instead picks the oldest deterministically (its
-     * own {@code matching} list has a different, wider match — see its javadoc).
+     * <p><strong>Returns at most one entry today — verified, not assumed.</strong> {@link #send}
+     * refuses to open a waiter on {@code target} while {@link #hasAsyncQuestion} is true, and that
+     * check matches ANY task whose {@code turnId} is still stamped in {@code asyncTasksByTurn} —
+     * not only while its question is still open. {@link #answer} deliberately leaves that stamp in
+     * place ({@code clearAsyncQuestion(turnId, false)}) until the resumed turn's own future actually
+     * resolves, at which point {@link #finishAsyncTask} both removes the stamp AND completes that
+     * task's future in the same call. So a second task can never reach "{@code turnId} stamped, future
+     * still open" — the exact pair this method matches on — while a first one already holds it: by
+     * the time the stamp is gone, so is the eligibility. This is an emergent property of those two
+     * facts holding together, not something this method (or its callers) enforces on its own — flip
+     * {@code forgetTurn} to {@code true} in that one {@link #answer} call and it silently stops being
+     * true, with nothing left to fail loudly. The callers below still handle "more than one" as
+     * defence in depth against exactly that, not because they exercise it today: {@link #reply}
+     * treats it as unresolvable and falls back to the inbox; {@link #abandon} would pick the oldest
+     * deterministically (its own {@code matching} list has no such guarantee — see its javadoc).
      */
     private List<Task> askAnsweredAsyncTasks(String target) {
         List<Task> candidates = new ArrayList<>();
         for (Task task : tasks.values()) {
-            if (target.equals(task.target) && task.question == null && !task.future.isDone()
-                    && (task.turnId != null || task.askTimedOut)) {
+            if (target.equals(task.target) && task.question == null && task.turnId != null
+                    && !task.future.isDone()) {
                 candidates.add(task);
             }
         }
@@ -925,12 +880,6 @@ public final class MessageService {
             return new AskResult(AskOutcome.ANSWERED, answer);
         } catch (TimeoutException e) {
             log.debug("fleet_ask from {} went unanswered in {}ms", workerSession, timeoutMillis);
-            // fleetd #307: mark the task BEFORE clearAsyncQuestion(forgetTurn=true) below drops it out of
-            // asyncTasksByTurn and nulls its turnId — that forgetting is deliberate and stays (it is
-            // what keeps the target from staying BUSY forever), but it would otherwise also erase
-            // askAnsweredAsyncTasks' only signal that the worker's eventual real fleet_reply still
-            // belongs to this task, stranding it in the inbox with a false "never replied" verdict.
-            markAskTimedOut(ticket.turnId());
             clearAsyncQuestion(ticket.turnId(), true);
             return new AskResult(AskOutcome.TIMED_OUT, null);
         } catch (ExecutionException e) {
@@ -978,16 +927,7 @@ public final class MessageService {
         }
         try {
             CompletableFuture<Rendezvous.Resolution> reply = rendezvous.open(workerSession);
-            // #282: mirror send()'s registration (:802) so a SECOND fleet_ask inside this same
-            // resumed turn can re-associate the async ticket with its new turnId via
-            // markAsyncQuestion — without this, that second ask has no Task to attach to, and
-            // markAsyncQuestion silently returns null.
-            Task task = asyncTasksByTurn.get(turnId);
-            if (task != null) {
-                asyncTasksByWaiter.put(reply, task);
-            }
             if (!rendezvous.answerAsk(turnId, content)) {
-                asyncTasksByWaiter.remove(reply);
                 rendezvous.close(workerSession, reply);
                 return new Reply(Outcome.STALE_TURN, null); // lapsed between the lookup and the unblock
             }
@@ -995,21 +935,7 @@ public final class MessageService {
             try {
                 Rendezvous.Resolution r = reply.get(remainingMillis(deadlineNanos), TimeUnit.MILLISECONDS);
                 Reply result = new Reply(outcomeOf(r.kind()), r.text(), r.turnId());
-                // #282: this waiter can resolve with a FRESH question rather than a terminal reply —
-                // the worker chained a second fleet_ask before replying. Mirror sendAsync's own guard
-                // (:1000) and leave the ticket open (markAsyncQuestion above already re-armed it under
-                // the new turnId) instead of completing it here with a QUESTION "reply".
-                // Measured when #282 was merged: this guard is DEFENCE IN DEPTH, not the thing
-                // that makes the chained ask work. ask() calls markAsyncQuestion (:860) before
-                // resolveQuestion (:861), so by the time this thread wakes, the task has already
-                // moved to the new turnId and finishAsyncTask(oldTurnId, ...) finds nothing. Removing
-                // this guard alone leaves the test green. Keep it anyway: it mirrors sendAsync's
-                // sibling guard, and that sibling's own comment (:1017) warns the two orderings are
-                // not something to rely on. Do NOT delete it as dead code without re-checking that
-                // ordering, and do not treat it as the sole protection either.
-                if (result.outcome() != Outcome.QUESTION) {
-                    finishAsyncTask(turnId, result);
-                }
+                finishAsyncTask(turnId, result);
                 return result;
             } catch (TimeoutException e) {
                 // The worker resumed but hasn't replied yet — no completion fallback arms an answered
@@ -1022,7 +948,6 @@ public final class MessageService {
                 Thread.currentThread().interrupt();
                 throw new IllegalStateException("interrupted awaiting reply from " + workerSession, e);
             } finally {
-                asyncTasksByWaiter.remove(reply);
                 rendezvous.close(workerSession, reply);
             }
         } finally {
@@ -1181,37 +1106,13 @@ public final class MessageService {
     private Task markAsyncQuestion(CompletableFuture<Rendezvous.Resolution> waiter, String text, String turnId) {
         Task task = waiter == null ? null : asyncTasksByWaiter.get(waiter);
         if (task != null) {
-            String previousTurnId = task.turnId;
             task.question = new Reply(Outcome.QUESTION, text, turnId);
             task.turnId = turnId;
             asyncTasksByTurn.put(turnId, task);
-            // #282: a second fleet_ask in the same resumed turn re-arms an already-answered task
-            // (answer() re-registers it in asyncTasksByWaiter) under a FRESH turnId — drop the old
-            // key so asyncTasksByTurn does not keep growing by one stale entry per chained ask.
-            if (previousTurnId != null && !previousTurnId.equals(turnId)) {
-                asyncTasksByTurn.remove(previousTurnId, task);
-            }
         }
         return task;
     }
 
-    /**
-     * Mark {@code turnId}'s task as having a {@code fleet_ask} that lapsed with no answer (fleetd #307), so
-     * {@link #askAnsweredAsyncTasks} still recognizes the worker's eventual real {@code fleet_reply}
-     * as belonging to it after {@link #clearAsyncQuestion}'s {@code forgetTurn=true} erases
-     * {@link Task#turnId} — see {@link Task#askTimedOut}. Must be called before that forgetting, while
-     * {@code turnId} can still resolve the task in {@code asyncTasksByTurn}; a lookup afterward would
-     * find nothing. Only when it matches the task's current turn — same guard as
-     * {@link #clearAsyncQuestion} — so a chained second {@code fleet_ask} (#282) that already moved
-     * the task to a fresh {@code turnId} cannot mark it for a turn that is no longer its own.
-     */
-    private void markAskTimedOut(String turnId) {
-        Task task = asyncTasksByTurn.get(turnId);
-        if (task != null && turnId.equals(task.turnId)) {
-            task.askTimedOut = true;
-        }
-    }
-
     /** Clear an answered or lapsed question, but only when it matches the ticket's current turn. */
     private void clearAsyncQuestion(String turnId, boolean forgetTurn) {
         // CB-582: tell the push loop first — like ticketCollected, a removal for a turnId it never

fleetd/src/main/java/dev/ltms/fleet/rest/FleetApp.java

@@ -9,7 +9,6 @@ import dev.ltms.fleet.auth.Principal;
 import dev.ltms.fleet.guard.GuardException;
 import dev.ltms.fleet.metrics.FleetMetrics;
 import dev.ltms.fleet.metrics.Metrics;
-import dev.ltms.fleet.mcp.FleetMcp;
 import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.herdr.HerdrClient;
 import dev.ltms.fleet.herdr.HerdrException;
@@ -19,7 +18,6 @@ import dev.ltms.fleet.peer.PeerUnreachableException;
 import dev.ltms.fleet.placement.PlacementException;
 import dev.ltms.fleet.msg.MessageService;
 import dev.ltms.fleet.session.SessionManager;
-import dev.ltms.fleet.session.ShuttingDownException;
 import dev.ltms.fleet.peer.MemberRole;
 import dev.ltms.fleet.session.MemberSession;
 import dev.ltms.fleet.session.WorktreeRequest;
@@ -49,22 +47,6 @@ import java.util.stream.Collectors;
  */
 public final class FleetApp {
 
-    /** The authorization action the matching route handler hands to {@link #allow}. */
-    static Authz.Action routeAction(String route) {
-        return switch (route) {
-            case "GET /metrics" -> Authz.Action.METRICS;
-            case "POST /members" -> Authz.Action.SPAWN;
-            case "DELETE /members/{paneId}" -> Authz.Action.STOP;
-            case "POST /sessions/{id}/message" -> Authz.Action.SEND;
-            case "POST /sessions/{id}/reply" -> Authz.Action.REPLY;
-            case "GET /sessions/{id}/replies" -> Authz.Action.DRAIN;
-            case "POST /sessions/{id}/ask" -> Authz.Action.ASK;
-            case "GET /sessions", "GET /agents", "GET /members", "GET /profiles",
-                    "GET /member-credentials", "GET /sessions/{id}/status", "GET /tasks/{ticket}" -> Authz.Action.READ;
-            default -> throw new IllegalArgumentException("route has no authorization gate: " + route);
-        };
-    }
-
     /** Default blocking window for a message; kept under typical HTTP idle timeouts. */
     private static final long DEFAULT_MESSAGE_TIMEOUT_MS = 25_000;
     private static final long MAX_MESSAGE_TIMEOUT_MS = 120_000;
@@ -88,12 +70,6 @@ public final class FleetApp {
     // absent() (the honest "no policy configured" view) for every constructor that does not wire
     // a real one, so existing legacy call sites keep building without knowing this field exists.
     private final Supplier<MemberCredentialPolicyView> memberCredentials;
-    // fleetd #297: the SAME shared sources FleetMcp.profiles/fleet_profiles reads (BackendQuarantine
-    // and BackendOutagePolicy are each one instance for the whole daemon — see Fleetd wiring) so
-    // GET /profiles cannot drift from fleet_profiles about which profile is quarantined/cooling off.
-    // .none() (the honest "feature not wired" view) for every constructor that does not pass one.
-    private final FleetMcp.QuarantineSource quarantine;
-    private final FleetMcp.OutageSource outage;
     private final ObjectMapper mapper = new ObjectMapper();
 
     /**
@@ -154,23 +130,6 @@ public final class FleetApp {
                        MessageService messages, MemberPresence presence,
                        HttpServlet mcpServlet, CallerResolver auth, Metrics metrics,
                        Predicate<String> deliverable, Supplier<MemberCredentialPolicyView> memberCredentials) {
-        this(herdr, memberHerdr, workers, sessions, messages, presence, mcpServlet, auth, metrics,
-                deliverable, memberCredentials, FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none());
-    }
-
-    /**
-     * @param quarantine the SAME {@link FleetMcp.QuarantineSource} instance passed to {@code
-     *                   FleetMcp} (fleetd #297), so {@code GET /profiles} reports the identical
-     *                   exhaustion-quarantine facts as {@code fleet_profiles} rather than a second,
-     *                   independently-computed copy
-     * @param outage     the SAME {@link FleetMcp.OutageSource} instance passed to {@code FleetMcp} —
-     *                   see {@code quarantine}; a SEPARATE check from it, never merged in
-     */
-    public FleetApp(HerdrClient herdr, HerdrClient memberHerdr, PeerLauncher workers, SessionManager sessions,
-                       MessageService messages, MemberPresence presence,
-                       HttpServlet mcpServlet, CallerResolver auth, Metrics metrics,
-                       Predicate<String> deliverable, Supplier<MemberCredentialPolicyView> memberCredentials,
-                       FleetMcp.QuarantineSource quarantine, FleetMcp.OutageSource outage) {
         this.herdr = herdr;
         this.memberHerdr = memberHerdr != null ? memberHerdr : herdr;
         this.workers = workers;
@@ -181,8 +140,6 @@ public final class FleetApp {
         this.auth = auth;
         this.metrics = metrics;
         this.memberCredentials = memberCredentials != null ? memberCredentials : MemberCredentialPolicyView::absent;
-        this.quarantine = quarantine != null ? quarantine : FleetMcp.QuarantineSource.none();
-        this.outage = outage != null ? outage : FleetMcp.OutageSource.none();
     }
 
     /** Wire routes onto a fresh, unstarted Javalin instance. Caller starts it. */
@@ -265,7 +222,7 @@ public final class FleetApp {
 
     /** Prometheus scrape endpoint (CB-502). */
     private void metrics(Context ctx) {
-        if (!allow(ctx, routeAction("GET /metrics"), null)) {
+        if (!allow(ctx, Authz.Action.METRICS, null)) {
             return;
         }
         ctx.status(200).contentType("text/plain; version=0.0.4; charset=utf-8").result(metrics.render());
@@ -337,7 +294,7 @@ public final class FleetApp {
      * member workspace (they live on the member daemon only).
      */
     private void sessions(Context ctx) {
-        if (!allow(ctx, routeAction("GET /sessions"), null)) {
+        if (!allow(ctx, Authz.Action.READ, null)) {
             return;
         }
         List<Map<String, Object>> out = new ArrayList<>();
@@ -362,76 +319,52 @@ public final class FleetApp {
 
     /** Discovery: every agent herdr tracks, keyed by its Claude session UUID. */
     private void agents(Context ctx) {
-        if (!allow(ctx, routeAction("GET /agents"), null)) {
+        if (!allow(ctx, Authz.Action.READ, null)) {
             return;
         }
-        try {
-            ctx.status(200).json(Map.of("agents",
-                    workers.list().stream().map(Agent.class::cast).map(FleetApp::view).toList()));
-        } catch (HerdrException e) {
-            // fleetd #297: workers.list() reaches herdr — a transport failure must land in the same
-            // {error, detail} envelope every other failure path here uses, not escape as a bare
-            // exception and leave Javalin's default handling to respond outside the JSON contract.
-            herdrError(ctx, e);
-        }
+        ctx.status(200).json(Map.of("agents",
+                workers.list().stream().map(Agent.class::cast).map(FleetApp::view).toList()));
     }
 
     /** CB-304: bridge-owned roster merged with live herdr status by paneId. */
     private void listMembers(Context ctx) {
-        if (!allow(ctx, routeAction("GET /members"), null)) {
+        if (!allow(ctx, Authz.Action.READ, null)) {
             return;
         }
-        try {
-            // CB-519: the registry key is a host-unique id, not the pane coordinate — join on terminal.
-            Map<String, Agent> live = workers.list().stream()
-                    .map(Agent.class::cast)
-                    .filter(a -> a.terminalId() != null)
-                    .collect(Collectors.toMap(Agent::terminalId, Function.identity(), (_, b) -> b));
-            // fleetd #209: this REST roster reports agentSessionId via SessionManager.rosterView, so it
-            // uses the resolving roster read (caller-driven, not a timer) rather than the plain one.
-            List<Map<String, Object>> out = sessions.rosterResolved().stream()
-                    .map(s -> SessionManager.rosterView(s, live.get(s.terminalId())))
-                    .toList();
-            Map<String, Object> body = new LinkedHashMap<>();
-            // fleetd #199: the endpoint became /members in the CB-634 rename but the body key stayed
-            // "workers", so a caller that read "members" saw an empty fleet and reported no members at
-            // all. "members" is the canonical key; "workers" stays as a deprecated alias so an existing
-            // REST consumer keeps working — the out-of-band path a lead falls back to when its MCP mount
-            // drops reads this endpoint. Drop the alias once nothing reads it.
-            body.put("members", out);
-            body.put("workers", out);
-            // CB-586: operator visibility for the refs/wip snapshot store without shelling into the
-            // repo — how many snapshot refs exist and roughly what they cost. Present only once a
-            // worktree session has established the repo, so a never-snapshotted fleet reports nothing.
-            sessions.wipRefs().ifPresent(st -> body.put("wipRefs",
-                    Map.of("count", st.count(), "costBytes", st.costBytes())));
-            ctx.status(200).json(body);
-        } catch (HerdrException e) {
-            // fleetd #297: same reasoning as agents() above — this is the out-of-band roster a lead
-            // falls back to when its MCP mount drops, so it must stay inside the JSON error contract
-            // exactly when herdr is briefly unreachable, not escape as a bare exception.
-            herdrError(ctx, e);
-        }
+        // CB-519: the registry key is a host-unique id, not the pane coordinate — join on terminal.
+        Map<String, Agent> live = workers.list().stream()
+                .map(Agent.class::cast)
+                .filter(a -> a.terminalId() != null)
+                .collect(Collectors.toMap(Agent::terminalId, Function.identity(), (_, b) -> b));
+        // fleetd #209: this REST roster reports agentSessionId via SessionManager.rosterView, so it
+        // uses the resolving roster read (caller-driven, not a timer) rather than the plain one.
+        List<Map<String, Object>> out = sessions.rosterResolved().stream()
+                .map(s -> SessionManager.rosterView(s, live.get(s.terminalId())))
+                .toList();
+        Map<String, Object> body = new LinkedHashMap<>();
+        // fleetd #199: the endpoint became /members in the CB-634 rename but the body key stayed
+        // "workers", so a caller that read "members" saw an empty fleet and reported no members at
+        // all. "members" is the canonical key; "workers" stays as a deprecated alias so an existing
+        // REST consumer keeps working — the out-of-band path a lead falls back to when its MCP mount
+        // drops reads this endpoint. Drop the alias once nothing reads it.
+        body.put("members", out);
+        body.put("workers", out);
+        // CB-586: operator visibility for the refs/wip snapshot store without shelling into the
+        // repo — how many snapshot refs exist and roughly what they cost. Present only once a
+        // worktree session has established the repo, so a never-snapshotted fleet reports nothing.
+        sessions.wipRefs().ifPresent(st -> body.put("wipRefs",
+                Map.of("count", st.count(), "costBytes", st.costBytes())));
+        ctx.status(200).json(body);
     }
 
-    /**
-     * The configured worker profiles, which one a no-argument spawn uses, and (fleetd #297) the two
-     * outage states {@code fleet_profiles} already reports: {@code quarantined} (CB-578 stage B —
-     * the backend reported it out of capacity) and {@code coolingOff} (fleetd #201 Unit 5 — the
-     * credential threw repeated non-exhaustion backend errors). Both are read from the SAME shared
-     * {@link FleetMcp.QuarantineSource}/{@link FleetMcp.OutageSource} instances {@code FleetMcp}
-     * reads, never recomputed, so the two doors cannot disagree about which profile is down and why.
-     * Independent checks, so a profile can appear in both maps at once; each map is present only
-     * when at least one profile is in that state.
-     */
+    /** The configured worker profiles and which one a no-argument spawn uses. */
     private void profiles(Context ctx) {
-        if (!allow(ctx, routeAction("GET /profiles"), null)) {
+        if (!allow(ctx, Authz.Action.READ, null)) {
             return;
         }
-        // fleetd #297: ONE body builder, shared with fleet_profiles. Handing both doors the same
-        // QuarantineSource/OutageSource instances stops them reading different facts; rendering
-        // through the same method stops them reporting those facts differently. Both are needed.
-        ctx.status(200).json(FleetMcp.profilesView(workers, quarantine, outage));
+        ctx.status(200).json(Map.of(
+                "profiles", workers.profiles(),
+                "default", workers.defaultProfile() == null ? "" : workers.defaultProfile()));
     }
 
     /**
@@ -443,7 +376,7 @@ public final class FleetApp {
      * name list, which is exactly what let the list drift silently behind the real policy.
      */
     private void memberCredentials(Context ctx) {
-        if (!allow(ctx, routeAction("GET /member-credentials"), null)) {
+        if (!allow(ctx, Authz.Action.READ, null)) {
             return;
         }
         MemberCredentialPolicyView view = memberCredentials.get();
@@ -463,7 +396,7 @@ public final class FleetApp {
      * the subscription boundary, 400 for an unknown profile.
      */
     private void spawnMember(Context ctx) {
-        if (!allow(ctx, routeAction("POST /members"), null)) {
+        if (!allow(ctx, Authz.Action.SPAWN, null)) {
             return;
         }
         String role = ctx.queryParam("role");
@@ -502,11 +435,6 @@ public final class FleetApp {
             ctx.status(201).json(view(member));
         } catch (GuardException e) {
             ctx.status(403).json(Map.of("error", "subscription_boundary", "detail", e.getMessage()));
-        } catch (ShuttingDownException e) {
-            // fleetd #308: the daemon's shutdown drain has already started — 503, not a bare 500,
-            // so this reads the same as PlacementException below: valid request, refused because
-            // of a transient daemon state rather than a bad argument.
-            ctx.status(503).json(Map.of("error", "shutting_down", "detail", e.getMessage()));
         } catch (PlacementException e) {
             // CB-599: no candidate had capacity (maxLoad, quarantine, or all-exhausted) — a benign,
             // likely-transient refusal, distinct from "profile does not exist" below. 503: the
@@ -516,12 +444,6 @@ public final class FleetApp {
             ctx.status(400).json(Map.of("error", "unknown_profile", "detail", e.getMessage()));
         } catch (PeerUnreachableException e) {
             ctx.status(502).json(Map.of("error", "spawn_timeout", "detail", e.getMessage()));
-        } catch (HerdrException e) {
-            // fleetd #304: not every herdr failure on the spawn path is a readiness timeout, so
-            // PeerUnreachableException above does not cover this. Without this catch the exception
-            // escapes to Javalin's default 500, while fleet_spawn reports the same failure as a
-            // clean named error (FleetMcp.spawn) — the #297 one-door-guarded shape.
-            herdrError(ctx, e);
         }
     }
 
@@ -542,29 +464,13 @@ public final class FleetApp {
         return (s == null || s.isBlank()) ? null : s;
     }
 
-    /**
-     * Tear a worker down by pane id.
-     *
-     * <p>fleetd #304: the {@code HerdrException} catch is not cosmetic. {@code release} deregisters
-     * the session, notifies the release listener and preserves a dirty worktree <em>before</em> it
-     * calls {@code launcher.stop}, so a throw from that stop arrives after the teardown the caller
-     * asked for has already happened. Letting it escape gave Javalin's default 500, which tells the
-     * caller to retry — and the retry finds nothing in the registry, reaches the same stop, and
-     * throws again, so it can never succeed. {@code herdrError} instead answers 404 ("the pane is
-     * gone, stop retrying") or 502 ("herdr is upstream and broken, a retry may help"), matching what
-     * {@code fleet_stop} reports for the same failure.
-     */
+    /** Tear a worker down by pane id. */
     private void stopMember(Context ctx) {
         String paneId = ctx.pathParam("paneId");
-        if (!allow(ctx, routeAction("DELETE /members/{paneId}"), paneId)) {
-            return;
-        }
-        try {
-            sessions.release(paneId);
-        } catch (HerdrException e) {
-            herdrError(ctx, e);
+        if (!allow(ctx, Authz.Action.STOP, paneId)) {
             return;
         }
+        sessions.release(paneId);
         ctx.status(204);
     }
 
@@ -576,7 +482,7 @@ public final class FleetApp {
      */
     private void sendMessage(Context ctx) {
         String id = ctx.pathParam("id");
-        if (!allow(ctx, routeAction("POST /sessions/{id}/message"), id)) {
+        if (!allow(ctx, Authz.Action.SEND, id)) {
             return;
         }
         String content;
@@ -663,7 +569,7 @@ public final class FleetApp {
      */
     private void askMessage(Context ctx) {
         String id = ctx.pathParam("id");
-        if (!allow(ctx, routeAction("POST /sessions/{id}/ask"), id)) {
+        if (!allow(ctx, Authz.Action.ASK, id)) {
             return;
         }
         String question;
@@ -702,7 +608,7 @@ public final class FleetApp {
         // The rule that matters: a worker may reply only as itself. Over MCP this was already true
         // structurally (identity comes from the connection, never an argument); over REST the path
         // id was simply trusted, so this is where the invariant actually gets enforced.
-        if (!allow(ctx, routeAction("POST /sessions/{id}/reply"), id)) {
+        if (!allow(ctx, Authz.Action.REPLY, id)) {
             return;
         }
         String content;
@@ -712,19 +618,7 @@ public final class FleetApp {
             ctx.status(400).json(Map.of("error", "bad_request", "detail", "body must be JSON"));
             return;
         }
-        // fleetd #302: content is required. `.path("content").asText("")` above turns a missing key
-        // into "" rather than throwing, so without this check an empty/blank reply used to reach
-        // messages.reply(...) and silently resolve the lead's waiter — the same class of bug as the
-        // sibling "content is required" guards on sendMessage/askMessage below, except this one wrote
-        // a WRONG value instead of failing loudly. The check lives in MessageService.reply so both
-        // this door and FleetMcp.reply inherit the same rule; this catch only translates it into the
-        // {error, detail} envelope this file uses everywhere else.
-        try {
-            messages.reply(id, content);
-        } catch (IllegalArgumentException e) {
-            ctx.status(400).json(Map.of("error", "bad_request", "detail", e.getMessage()));
-            return;
-        }
+        messages.reply(id, content);
         ctx.status(200).json(Map.of("sessionId", id, "delivered", true));
     }
 
@@ -735,7 +629,7 @@ public final class FleetApp {
      */
     private void drainReplies(Context ctx) {
         String id = ctx.pathParam("id");
-        if (!allow(ctx, routeAction("GET /sessions/{id}/replies"), id)) {
+        if (!allow(ctx, Authz.Action.DRAIN, id)) {
             return;
         }
         var replies = messages.drainReplies(id);
@@ -753,7 +647,7 @@ public final class FleetApp {
      */
     private void sessionStatus(Context ctx) {
         String id = ctx.pathParam("id");
-        if (!allow(ctx, routeAction("GET /sessions/{id}/status"), id)) {
+        if (!allow(ctx, Authz.Action.READ, id)) {
             return;
         }
         try {
@@ -778,7 +672,7 @@ public final class FleetApp {
 
     /** Poll an async (wait:false) delegation by ticket. 404 for an unknown/expired ticket. */
     private void taskStatus(Context ctx) {
-        if (!allow(ctx, routeAction("GET /tasks/{ticket}"), null)) {
+        if (!allow(ctx, Authz.Action.READ, null)) {
             return;
         }
         MessageService.TaskView v = messages.poll(ctx.pathParam("ticket"));

fleetd/src/main/java/dev/ltms/fleet/session/GitWorktrees.java

@@ -93,9 +93,6 @@ public final class GitWorktrees implements Worktrees {
     /** OS group name for {@link #shareWithGroup} (fleetd #185 stage 3); {@code null} ⇒ feature off. */
     private final String group;
     private final Consumer<String> afterWorktreeAdded;
-    /** How the initial {@code git worktree add} command runs. Package-private test seam for an
-     *  interrupted command after Git has made worktree state. */
-    private final Function<String[], String> worktreeAddRunner;
     /** How {@link #shareWithGroup}'s processes (git config / chgrp / chmod / find) actually run.
      *  Defaults to the real {@link #exec(String...)}. Package-private test seam so a unit test can
      *  prove "no group configured ⇒ zero processes spawned" and inspect exactly what a configured
@@ -135,13 +132,7 @@ public final class GitWorktrees implements Worktrees {
 
     /** Test seam combining a configurable {@code group} with {@link #afterWorktreeAdded}. */
     GitWorktrees(String configuredRoot, String group, Consumer<String> afterWorktreeAdded) {
-        this(configuredRoot, group, afterWorktreeAdded, null, null);
-    }
-
-    /** Test seam for changing how {@link #shareWithGroup}'s processes run. */
-    GitWorktrees(String configuredRoot, String group, Consumer<String> afterWorktreeAdded,
-                  Function<String[], String> shareGroupRunner) {
-        this(configuredRoot, group, afterWorktreeAdded, shareGroupRunner, null);
+        this(configuredRoot, group, afterWorktreeAdded, null);
     }
 
     /**
@@ -150,15 +141,13 @@ public final class GitWorktrees implements Worktrees {
      * exactly what commands a configured group runs, without a real second OS user/group.
      *
      * @param shareGroupRunner {@code null} ⇒ the real {@link #exec(String...)}.
-     * @param worktreeAddRunner {@code null} ⇒ the real {@link #exec(String...)}.
      */
     GitWorktrees(String configuredRoot, String group, Consumer<String> afterWorktreeAdded,
-                  Function<String[], String> shareGroupRunner, Function<String[], String> worktreeAddRunner) {
+                 Function<String[], String> shareGroupRunner) {
         this.configuredRoot = configuredRoot;
         this.group = (group == null || group.isBlank()) ? null : group;
         this.afterWorktreeAdded = afterWorktreeAdded == null ? _ -> {} : afterWorktreeAdded;
         this.shareGroupRunner = shareGroupRunner != null ? shareGroupRunner : this::exec;
-        this.worktreeAddRunner = worktreeAddRunner != null ? worktreeAddRunner : this::exec;
     }
 
     @Override
@@ -177,8 +166,8 @@ public final class GitWorktrees implements Worktrees {
         String wt = path.toAbsolutePath().toString();
         log.info("adding worktree branch={} path={} base={}", branch, wt, base);
         removeUserInfoFromHttpsOrigin(repoRoot);
+        exec("git", "-C", repoRoot, "worktree", "add", wt, "-b", branch, base);
         try {
-            worktreeAddRunner.apply(new String[] {"git", "-C", repoRoot, "worktree", "add", wt, "-b", branch, base});
             afterWorktreeAdded.accept(wt);
             requireCredentialFreeHttpsOrigin(wt);
             configureEnvironmentCredentialHelper(repoRoot, wt);
@@ -192,11 +181,10 @@ public final class GitWorktrees implements Worktrees {
     }
 
     /**
-     * {@code git worktree add} may have created the worktree and its branch by the time it, or any
-     * later step through {@link #isolateToolSurface}, throws. This includes
+     * {@code add()} has already created the worktree and its branch by the time any step from
+     * {@link #afterWorktreeAdded} through {@link #isolateToolSurface} can throw — including
      * {@link #requireCredentialFreeHttpsOrigin}, an intended security refusal, not only an IO
-     * accident. A Git-reported {@code worktree add} failure usually creates nothing, but an
-     * interrupted command can leave partial state. Without cleanup, {@code add()} never returns, so its caller
+     * accident. Without this, {@code add()} never returns, so its caller
      * ({@code SessionManager#acquireWithWorktree}) never receives a path to register or clean up:
      * its local {@code path} stays null, the {@code if (path != null)} guard in its own catch block
      * never runs, and the worktree directory and branch leak on disk forever with nothing tracking
@@ -216,10 +204,6 @@ public final class GitWorktrees implements Worktrees {
      * used in {@code SessionManager#acquireWithWorktree}'s own catch block.
      */
     private void cleanupAfterAddFailure(String repoRoot, String worktreePath, String branch, RuntimeException original) {
-        if (!Files.exists(Path.of(worktreePath))) {
-            log.debug("provisioning failed before worktree {} existed; nothing to clean up", worktreePath);
-            return;
-        }
         log.warn("provisioning failed for branch={} path={}: {} — cleaning up before rethrowing",
                 branch, worktreePath, original.getMessage());
         try {
@@ -229,18 +213,13 @@ public final class GitWorktrees implements Worktrees {
                     worktreePath, cleanup.getMessage());
         }
         try {
-            deleteBranch(repoRoot, branch);
+            exec("git", "-C", repoRoot, "branch", "-D", branch);
         } catch (RuntimeException cleanup) {
             log.warn("failed to remove leaked branch {} after provisioning error: {}",
                     branch, cleanup.getMessage());
         }
     }
 
-    @Override
-    public void deleteBranch(String repoRoot, String branch) {
-        exec("git", "-C", repoRoot, "branch", "-D", branch);
-    }
-
     /**
      * A linked worktree shares its primary checkout's git config. Remove HTTPS user info before
      * adding one, so a credential accidentally embedded in that config cannot reach the member.

fleetd/src/main/java/dev/ltms/fleet/session/SessionManager.java

@@ -21,7 +21,6 @@ import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.Consumer;
 import java.util.function.LongSupplier;
@@ -62,8 +61,6 @@ public final class SessionManager implements TurnListener {
     private final LongSupplier nowNanos;
     private final int contextCap;
     private final boolean clearAfterTurn;
-    /** Null in production; test seam for the interval before an idle session's conditional release. */
-    private final Consumer<MemberSession> beforeIdleRelease;
     private volatile MemberLifecycle memberLifecycle = MemberLifecycle.NONE;
     /**
      * CB-586: the repo root the fleet actually works in, remembered the first time a worktree
@@ -74,16 +71,6 @@ public final class SessionManager implements TurnListener {
      */
     private volatile String fleetRepoRoot;
 
-    /**
-     * fleetd #308: flips true the instant {@link #drainAll} starts, before its registry snapshot
-     * is even taken — so a spawn already in flight sees the refusal as early as a plain flag can
-     * make it. This alone cannot close the race completely: a caller that read {@code false} just
-     * before the flip can still land in the registry after the snapshot. {@link #drainAll}'s
-     * post-loop sweep is what catches that straggler; the two mechanisms are deliberately paired,
-     * see {@link #drainAll}'s javadoc.
-     */
-    private final AtomicBoolean draining = new AtomicBoolean(false);
-
     /** CB-520: notified with a terminalId on every acquire; no-op until wired. */
     private final List<Consumer<String>> acquireListeners = new java.util.concurrent.CopyOnWriteArrayList<>();
     /** CB-516: notified with a {@link ReleaseDetail} on every release; no-op until wired. */
@@ -115,23 +102,13 @@ public final class SessionManager implements TurnListener {
     }
 
     public SessionManager(PeerLauncher launcher, Worktrees worktrees, LongSupplier nowNanos,
-                           int contextCap, boolean clearAfterTurn) {
-        this(launcher, worktrees, nowNanos, contextCap, clearAfterTurn, null);
-    }
-
-    /**
-     * Package-private constructor for a deterministic reap/delivery race test. Production callers
-     * use the constructor above, whose null hook adds no callback or lock to an ordinary reap.
-     */
-    SessionManager(PeerLauncher launcher, Worktrees worktrees, LongSupplier nowNanos,
-                   int contextCap, boolean clearAfterTurn, Consumer<MemberSession> beforeIdleRelease) {
+                          int contextCap, boolean clearAfterTurn) {
         this.launcher = launcher;
         this.worktrees = worktrees;
         this.presence = new PresenceFleet(this);
         this.nowNanos = nowNanos;
         this.contextCap = contextCap;
         this.clearAfterTurn = clearAfterTurn;
-        this.beforeIdleRelease = beforeIdleRelease;
     }
 
     /**
@@ -204,14 +181,6 @@ public final class SessionManager implements TurnListener {
     public MemberSession acquire(String profile, MemberRole role, String requestedCwd, String callerCwd,
                                  String ownerTerminal, WorktreeRequest wt,
                                  String sessionName, String resumeSessionId) {
-        // fleetd #308: refuse before anything else runs — no slot reservation, no launcher spawn —
-        // so a caller learns the daemon is going down instead of getting a session drainAll will
-        // never see again. Checked here because every other acquire(...) overload delegates to
-        // this one, so this is the single point every spawn path passes through.
-        if (draining.get()) {
-            throw new ShuttingDownException("fleetd is shutting down; refusing to spawn a session "
-                    + "the shutdown drain would never see");
-        }
         MemberRole memberRole = (role == null) ? MemberRole.DEV : role;
         requireResumeCapability(profile, resumeSessionId);
         // CB-619 / fleetd #123: an explicit profile bypasses placement (CompositePeerLauncher only
@@ -303,32 +272,10 @@ public final class SessionManager implements TurnListener {
      */
     private void release(String paneId, ReleaseCause cause) {
         MemberSession removed = registry.remove(paneId);
-        releaseRemoved(paneId, removed, handles.remove(paneId), cause);
-    }
-
-    /**
-     * Tear a session down only while {@code expected} is still its registry value. A lifecycle
-     * transition replaces the immutable record, so this prevents a reap based on an old READY or
-     * DONE record from stopping a worker that delivery has made BUSY.
-     */
-    private boolean releaseIfCurrent(MemberSession expected, ReleaseCause cause) {
-        if (!registry.remove(expected.paneId(), expected)) {
-            // A lifecycle transition replaced the record between the caller's check and this remove.
-            // Log it: this race is by definition unobservable otherwise, and a reaper that silently
-            // declines to reap is the hardest kind of behaviour to diagnose after the fact.
-            log.debug("skipping reap of pane={}: its registry record changed after the idle check "
-                    + "(most likely a delivery made it BUSY)", expected.paneId());
-            return false;
-        }
-        releaseRemoved(expected.paneId(), expected, handles.remove(expected.paneId()), cause);
-        return true;
-    }
-
-    private void releaseRemoved(String paneId, MemberSession removed, PeerHandle removedHandle,
-                                ReleaseCause cause) {
         // fleetd #209: remove right alongside the registry entry so a released session's handle is
         // never leaked — but keep the local reference below, so the id can still be resolved for
         // the ReleaseDetail this teardown notifies with.
+        PeerHandle removedHandle = handles.remove(paneId);
         boolean preserveWorktree = cause == ReleaseCause.SHUTDOWN;
         String snapshotRef = null;
         if (removed != null) {
@@ -387,20 +334,7 @@ public final class SessionManager implements TurnListener {
         // slot that no longer appears in the roster and can never be reclaimed.
         launcher.stop(paneId);
         if (removed != null && !preserveWorktree && removed.worktree() != null) {
-            // fleetd #283: this is the one cleanup step in this method that used to be bare. By the
-            // time it runs, the registry entry, the retained handle, and the pane are all already
-            // gone — so a throw here (a stale index lock, a slow filesystem, `remove`'s own 30s exec
-            // timeout) must not escape release(): there is no retry path (a second stop on this
-            // paneId is a no-op), and the caller would otherwise see a "failed stop" for a session
-            // that is in fact fully torn down. Log and swallow, matching every sibling step above.
-            try {
-                worktrees.remove(worktrees.repoRoot(removed.cwd()), removed.worktree());
-            } catch (RuntimeException e) {
-                log.warn("failed to remove worktree {} for pane={} terminal={} after release: the "
-                        + "pane is already stopped and the session already deregistered, so this is "
-                        + "not retryable — the directory must be reclaimed manually: {}",
-                        removed.worktree(), paneId, removed.terminalId(), e.toString());
-            }
+            worktrees.remove(worktrees.repoRoot(removed.cwd()), removed.worktree());
         }
     }
 
@@ -570,26 +504,11 @@ public final class SessionManager implements TurnListener {
             log.warn("spawn failed for profile={} role={} branch={} path={}: {}",
                     preResolvedProfile, memberRole, branch, path, e.getMessage());
             if (path != null) {
-                // fleetd #283: this catch covers every failure AFTER worktrees.add() returned —
-                // overlayParity, shareWithGroup, launcher.spawn itself — so by this point `branch`
-                // was actually created in git. #274 fixed the sibling failure INSIDE add() by having
-                // GitWorktrees.cleanupAfterAddFailure delete both the worktree and the branch it
-                // provisioned; this path removed only the worktree and left the branch orphaned. A
-                // spawn failure here is routine (a quarantined credential, a backend refusal), so
-                // every occurrence leaked a `worker/<slug>-<nonce>` branch nothing ever pointed at
-                // again. Reuse the same Worktrees.deleteBranch GitWorktrees already has, rather than
-                // a second copy of the git command. Best-effort and log-only, like the worktree
-                // removal right above it — neither cleanup step may mask the original exception.
                 try {
                     worktrees.remove(repoRoot, path);
                 } catch (RuntimeException cleanup) {
                     log.warn("failed to clean up worktree {} after spawn error: {}", path, cleanup.getMessage());
                 }
-                try {
-                    worktrees.deleteBranch(repoRoot, branch);
-                } catch (RuntimeException cleanup) {
-                    log.warn("failed to clean up branch {} after spawn error: {}", branch, cleanup.getMessage());
-                }
             }
             throw e;
         }
@@ -899,18 +818,14 @@ public final class SessionManager implements TurnListener {
             }
             long idleNanos = now - s.lastActivityAtNanos();
             if (idleNanos > idleTtlNanos) {
+                log.debug("reaping idle session terminal={} pane={}: idle {}s exceeds the {}s ttl",
+                        s.terminalId(), s.paneId(), TimeUnit.NANOSECONDS.toSeconds(idleNanos),
+                        TimeUnit.NANOSECONDS.toSeconds(idleTtlNanos));
                 // CB-581: one session that fails to release must not abort the whole reaping pass —
                 // match drainAll's per-session try/catch so the rest of the roster still gets reaped.
                 try {
-                    if (beforeIdleRelease != null) {
-                        beforeIdleRelease.accept(s);
-                    }
-                    if (releaseIfCurrent(s, ReleaseCause.COMPLETED)) {
-                        log.debug("reaping idle session terminal={} pane={}: idle {}s exceeds the {}s ttl",
-                                s.terminalId(), s.paneId(), TimeUnit.NANOSECONDS.toSeconds(idleNanos),
-                                TimeUnit.NANOSECONDS.toSeconds(idleTtlNanos));
-                        reaped++;
-                    }
+                    release(s.paneId());
+                    reaped++;
                 } catch (RuntimeException e) {
                     log.warn("reap failed for pane={} terminal={} worktree={}; continuing with "
                             + "remaining sessions", s.paneId(), s.terminalId(), s.worktree(), e);
@@ -921,60 +836,20 @@ public final class SessionManager implements TurnListener {
     }
 
     /**
-     * Gracefully drain all registered sessions on daemon shutdown. Non-busy sessions are released
-     * immediately; a {@code BUSY} one is polled until it leaves {@code BUSY}, then released
-     * regardless. A failure releasing one session is logged and does not abort the rest.
-     *
-     * <p>{@code timeoutNanos} is a budget for the WHOLE drain, not a grace period per session: the
-     * deadline is taken once, before the loop. So the first BUSY session can spend all of it, and a
-     * later BUSY one is then released with no wait at all. That is deliberate. This drain is only
-     * one phase of shutdown — {@code Fleetd} closes the message service, the push loop, the
-     * heartbeat, MCP and the router after it — and the whole sequence has to finish inside
-     * launchd's exit window. A per-session grace would let N busy members drain for N * the
-     * timeout, overrun that window, and get the daemon SIGKILLed part-way through; the members not
-     * yet reached would then get no clean release, no preserved-worktree log, and no snapshot.
-     * Cutting one turn short is the cheaper failure, and it is not silent: an abandoned BUSY
-     * session is preserved, snapshotted, and logged at WARN by {@code logPreservedForShutdown}.
+     * Gracefully drain all registered sessions on daemon shutdown. For each session that is
+     * {@code BUSY}, poll up to {@code timeoutNanos} for it to leave {@code BUSY}, then release it
+     * regardless. Non-busy sessions are released immediately. A failure releasing one session is
+     * logged and does not abort the rest.
      *
      * <p>CB-544: this is a {@link ReleaseCause#SHUTDOWN} release — the worker's pane is stopped
      * (the process must end) but its worktree is preserved and its path logged. Shutdown is never
      * a reason to delete a worker's only copy of its uncommitted work. A session still {@code BUSY}
      * when the timeout expired is abandoned mid-turn and logged loudly so an operator can find its
      * kept worktree.
-     *
-     * <p>fleetd #308: {@code roster()} is a one-shot snapshot (see its javadoc), and nothing used
-     * to stop a new session from registering after it was taken — {@link #acquire} stayed open for
-     * as long as this drain waited on a {@code BUSY} session, up to the whole {@code timeoutNanos}
-     * budget. Two things close that window, deliberately paired because neither alone is complete:
-     * {@link #draining} is flipped true before the snapshot is even taken, so {@link #acquire}
-     * refuses (invariant 3: loudly, via {@link ShuttingDownException}) as much of the window as a
-     * plain flag can close; and the sweep below re-reads the registry once the initial snapshot has
-     * fully drained and drains whatever a straggler — a caller that read the flag as {@code false}
-     * a moment before it flipped — still managed to register. The sweep shares the same
-     * {@code deadline} rather than getting its own: {@code timeoutNanos} is a budget for the WHOLE
-     * drain (see above), and a straggler must not buy the drain more time than the flag it lost the
-     * race against would have. In the ordinary case the sweep finds nothing and costs one empty
-     * {@link #roster()} call.
      */
     void drainAll(long timeoutNanos) {
         long deadline = System.nanoTime() + timeoutNanos;
-        draining.set(true);
-        drainSnapshot(roster(), deadline);
-        List<MemberSession> stragglers = roster();
-        if (!stragglers.isEmpty()) {
-            log.warn("drain sweep found {} session(s) registered after the drain snapshot was "
-                    + "taken (raced past the shutdown guard); draining them too", stragglers.size());
-            drainSnapshot(stragglers, deadline);
-        }
-    }
-
-    /**
-     * Drain exactly the sessions in {@code snapshot}, waiting out a {@code BUSY} one against the
-     * shared whole-drain {@code deadline} before releasing it. Shared by {@link #drainAll}'s main
-     * pass and its post-loop straggler sweep (fleetd #308) so both honor the same one budget.
-     */
-    private void drainSnapshot(List<MemberSession> snapshot, long deadline) {
-        for (MemberSession s : snapshot) {
+        for (MemberSession s : roster()) {
             try {
                 if (s.state() == MemberSession.State.BUSY) {
                     while (System.nanoTime() < deadline) {

fleetd/src/main/java/dev/ltms/fleet/session/ShuttingDownException.java

@@ -1,18 +0,0 @@
-package dev.ltms.fleet.session;
-
-/**
- * Thrown by {@link SessionManager#acquire} when a spawn is requested after the daemon's shutdown
- * drain has already begun (fleetd #308).
- *
- * <p>{@link SessionManager#drainAll} snapshots the registry once and tears down exactly what is
- * in that snapshot. A session registered after the snapshot is invisible to the drain loop: its
- * pane is left running and its worktree is never preserved, and nothing else ever reclaims
- * either — the daemon's in-memory registry dies with the process. Refusing the spawn here,
- * loudly, is what stops that session from ever being created in the first place, rather than
- * silently handing the caller a session the daemon can no longer manage.
- */
-public final class ShuttingDownException extends RuntimeException {
-    public ShuttingDownException(String message) {
-        super(message);
-    }
-}

fleetd/src/main/java/dev/ltms/fleet/session/Worktrees.java

@@ -11,15 +11,6 @@ public interface Worktrees {
     /** git -C <repoRoot> worktree remove --force <path>. Idempotent (already-gone tolerated). */
     void remove(String repoRoot, String worktreePath);
 
-    /**
-     * git -C {@code repoRoot} branch -D {@code branch}. Force-deletes a branch that has no other
-     * owner — used only on the failed-provisioning path (fleetd #274, #283), never on a normal
-     * release: {@link SessionManager#release} deliberately leaves a released session's branch
-     * behind so a lead can still recover the work, and this method must never be called from
-     * that path.
-     */
-    void deleteBranch(String repoRoot, String branch);
-
     /**
      * True when the worktree holds uncommitted changes the bridge cannot see: tracked
      * modifications, staged files, or untracked files. {@code git status --porcelain} is the

fleetd/src/test/java/dev/ltms/fleet/FleetdBackendErrorSinkTest.java

@@ -226,44 +226,4 @@ class FleetdBackendErrorSinkTest {
         assertTrue(remaining.isPresent(), "two distinct targets must start a cool-off");
         assertEquals(1, leadClient.sendCount());
     }
-
-    @Test
-    @DisplayName("a backend-error session no longer blocks the real maxLoad spawn gate")
-    void backendErrorSessionDoesNotBlockFreshSpawnAtMaxLoad() {
-        SessionManager sessions = capacityLimitedSessions();
-        MemberSession failed = sessions.acquire("terra", null, null, null);
-
-        assertTrue(sessions.onBackendError(failed.terminalId(), "backend exited"));
-
-        MemberSession fresh = sessions.acquire("terra", null, null, null);
-        assertEquals("terra", fresh.profile(), "the real maxLoad gate grants a fresh spawn after a backend error");
-    }
-
-    @Test
-    @DisplayName("a failed session no longer blocks the real maxLoad spawn gate")
-    void failedSessionDoesNotBlockFreshSpawnAtMaxLoad() {
-        SessionManager sessions = capacityLimitedSessions();
-        MemberSession failed = sessions.acquire("terra", null, null, null);
-
-        sessions.onTurnFailed(failed.terminalId());
-
-        MemberSession fresh = sessions.acquire("terra", null, null, null);
-        assertEquals("terra", fresh.profile(), "the real maxLoad gate grants a fresh spawn after a failed turn");
-    }
-
-    private static SessionManager capacityLimitedSessions() {
-        FakeHerdr herdr = new FakeHerdr();
-        FleetConfig.Profile profile = new FleetConfig.Profile("terra", "http://gx00.gw:8000", "coder",
-                null, "FLEETD_WORKER_TOKEN", List.of("claude"), "tab", "fleetd-workers",
-                "w #{n}", null, null, null, null, null, null, null, 1.0f, 1);
-        Map<String, FleetConfig.Profile> profiles = Map.of("terra", profile);
-        ClaudeCodeLauncher adapter = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), profiles, "terra", _ -> "tok");
-        AtomicReference<SessionManager> sessionsRef = new AtomicReference<>();
-        CompositePeerLauncher workers = new CompositePeerLauncher(List.of(adapter), "terra", profiles,
-                PlacementPolicies.fixed(), name -> Fleetd.liveSessionCount(sessionsRef.get().roster(), name));
-        SessionManager sessions = new SessionManager(workers);
-        sessionsRef.set(sessions);
-        return sessions;
-    }
 }

fleetd/src/test/java/dev/ltms/fleet/auth/CallerResolverTest.java

@@ -103,54 +103,6 @@ class CallerResolverTest {
         assertEquals(Role.PRIMARY, p.role(), "the historical behaviour, now an explicit choice");
     }
 
-    // ── fleetd #317: an unresolvable caller must never be promoted to the primary ──────────────────
-    // #305 closed the trigger where a resolved pid matched no pane *and* had no ancestry walk to
-    // save it. This is the other trigger PaneLocator's javadoc names: the pid never resolves at
-    // all — LsofPeerPidLookup returns -1 on any failure, including (silently) "lsof found no
-    // match" — so there is no candidate pid for an ancestry walk to even attempt.
-
-    /**
-     * The failing-without-the-fix case. Before #317's fix, {@code c.terminal() == null} was the
-     * only test in the loopback-trust fallback, and an unresolved pid produces exactly that same
-     * {@code null} terminal as a genuine primary — so this caller was handed
-     * {@code Principal.primary(...)}, a real worker's failed lookup becoming indistinguishable from
-     * the lead.
-     */
-    @Test
-    void aFailedPeerPidLookupIsRefusedNotPromotedToPrimary() {
-        ConnectionIdentity unresolved = new ConnectionIdentity(new PaneLocator(herdr), _ -> -1);
-        Principal p = new CallerResolver(unresolved).resolve("127.0.0.1", 55555, null);
-
-        assertEquals(Role.ANONYMOUS, p.role(),
-                "an unresolvable caller must never be silently promoted to the primary");
-    }
-
-    /**
-     * The companion invariant #317 must not break: a caller whose lookup genuinely succeeded, and
-     * who simply owns no herdr pane — the real primary's own connection — is still the primary.
-     * This is {@link #loopbackTrustTreatsANonWorkerLoopbackCallerAsThePrimary} pinned again here,
-     * named for #317 and placed next to the test it must be distinguished from: same {@code null}
-     * terminal, opposite verdict, because {@code Caller.resolved()} tells them apart.
-     */
-    @Test
-    void aRealPidThatOwnsNoPaneIsStillThePrimaryNotRefused() {
-        Principal p = new CallerResolver(nonWorkerIdentity()).resolve("127.0.0.1", 55555, null);
-
-        assertEquals(Role.PRIMARY, p.role());
-    }
-
-    /** #317 point 4: token mode never consults {@code c.pid()}, so a failed lookup must not change it. */
-    @Test
-    void tokenModeIsUndisturbedByAnUnresolvedLookup() {
-        ConnectionIdentity unresolved = new ConnectionIdentity(new PaneLocator(herdr), _ -> -1);
-        CallerResolver r = new CallerResolver(unresolved, true, "s3cret");
-
-        assertEquals(Role.ANONYMOUS, r.resolve("127.0.0.1", 55555, null).role(),
-                "no credential is still just ANONYMOUS, as before #317 — unchanged by the lookup failing");
-        assertEquals(Role.PRIMARY, r.resolve("127.0.0.1", 55555, "Bearer s3cret").role(),
-                "a valid token still authenticates the primary even though the peer-pid lookup failed");
-    }
-
     @Test
     void tokenModeRefusesANonWorkerCallerThatPresentsNoToken() {
         Principal p = new CallerResolver(nonWorkerIdentity(), true, "s3cret")
@@ -461,29 +413,4 @@ class CallerResolverTest {
         assertThrows(IllegalArgumentException.class, () -> new CallerResolver(id, true, null));
         assertThrows(IllegalArgumentException.class, () -> new CallerResolver(id, true, "  "));
     }
-    @Test
-    void aWorkerOnAnyLoopbackSourceAddressIsStillAWorkerNotThePrimary() {
-        // fleetd #305: the escalation. ConnectionIdentity used to accept only 127.0.0.1, so a
-        // worker connecting from 127.0.0.2 resolved to no terminal, and this resolver's own
-        // (wider) loopback check then made it the PRIMARY — granting spawn, stop, send and drain.
-        // Measured on the Linux fleet host: binding a source of 127.0.0.2 succeeds there, so the
-        // path is real and not theoretical.
-        CallerResolver r = new CallerResolver(workerIdentity(), false, null);
-        for (String src : new String[]{"127.0.0.1", "127.0.0.2", "127.1.2.3", "::ffff:127.0.0.2"}) {
-            Principal p = r.resolve(src, 55555, null);
-            assertEquals(Role.WORKER, p.role(), "a worker must stay a worker from source " + src);
-            assertEquals("term_a", p.terminal(), "worker terminal from source " + src);
-        }
-    }
-
-    @Test
-    void aNonWorkerOnAnyLoopbackSourceAddressIsStillThePrimary() {
-        // The other direction of the same fix: widening the identity check must not demote a
-        // legitimate same-host primary that happens to connect from another 127.* address.
-        CallerResolver r = new CallerResolver(nonWorkerIdentity(), false, null);
-        for (String src : new String[]{"127.0.0.1", "127.0.0.2", "::ffff:127.0.0.1"}) {
-            assertEquals(Role.PRIMARY, r.resolve(src, 55555, null).role(), "source " + src);
-        }
-    }
-
 }

fleetd/src/test/java/dev/ltms/fleet/health/FleetHealthMonitorTest.java

@@ -24,9 +24,7 @@ import org.slf4j.LoggerFactory;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
-import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.Executors;
-import java.util.concurrent.ScheduledFuture;
 import java.util.concurrent.ScheduledThreadPoolExecutor;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
@@ -436,120 +434,4 @@ class FleetHealthMonitorTest {
             logger.detachAppender(appender);
         }
     }
-
-    // --- fleetd #280: a GONE/NEVER_READY guess whose fleet_ask lapses AFTER the first sweep must
-    // still be swept, without ever reaching into a target that has since recovered or left the
-    // roster. See FleetHealthMonitor.recheckTerminalTarget's javadoc for the full reachability chain.
-
-    @Test void terminalTransitionSchedulesExactlyOneDelayedRecheck() {
-        ScheduledThreadPoolExecutor scheduler = new ScheduledThreadPoolExecutor(1);
-        FleetHealthMonitor monitor = monitor(new FakeHerdr(),
-                List.of(member("term_a", MemberSession.State.BUSY, 0, 0)), scheduler, () -> 1, 600,
-                (_, _) -> { });
-
-        monitor.reportTransition("term_a", HealthState.GONE);
-
-        // Driven via reportTransition directly (not tick()), so the queue holds only the recheck.
-        assertEquals(1, scheduler.getQueue().size());
-        ScheduledFuture<?> scheduled = (ScheduledFuture<?>) scheduler.getQueue().peek();
-        assertTrue(scheduled.getDelay(TimeUnit.SECONDS) > 100,
-                "the delay must clear the worst-case fleet_ask lapse window (up to 115s)");
-
-        // An unchanged tick must not queue a second one (CB-580's fire-once rule extends to this).
-        monitor.reportTransition("term_a", HealthState.GONE);
-        assertEquals(1, scheduler.getQueue().size());
-        monitor.stop();
-    }
-
-    @Test void recheckIsANoOpOnceTheTargetHasRecovered() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        assertEquals(1, failTarget.calls.size());
-
-        monitor.reportTransition("term_a", HealthState.IDLE); // recovered before the recheck fired
-        monitor.recheckTerminalTarget("term_a", HealthState.GONE);
-
-        assertEquals(1, failTarget.calls.size(), "a recovered target must not be reached into again");
-        monitor.stop();
-    }
-
-    @Test void recheckIsANoOpForATargetItNeverObserved() {
-        // Mirrors "left the roster": tick() prunes states.keySet() to the current roster on release
-        // (see FleetHealthMonitor.tick), so a target this monitor never recorded is the same case.
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-
-        monitor.recheckTerminalTarget("term_never_seen", HealthState.GONE);
-
-        assertEquals(0, failTarget.calls.size(), "an untracked/released target must not be reached into");
-        monitor.stop();
-    }
-
-    /**
-     * The scenario from the ticket, end to end, driven through the real {@link MessageService}: a
-     * target's ask is still genuinely open when health first observes GONE (sweep must skip it,
-     * exactly as {@code abandonDoesNotFailAnAsyncTicketWaitingForAnAnswer} pins), the ask then lapses
-     * on its own, an unchanged tick still must not refire, and only the delayed recheck sweeps the
-     * now-lapsed ticket to FAILED.
-     */
-    @Test void delayedRecheckSweepsATicketWhoseAskLapsedAfterGoneWasFirstObserved() throws Exception {
-        FakeHerdr herdr = new FakeHerdr().withAgent("worker", "term_a", "pane-term_a", "tab_a")
-                .readText("$ prompt");
-        AgentControl agents = new AgentControl(herdr);
-        Rendezvous rendezvous = new Rendezvous();
-        Injector injector = new Injector(agents);
-        InMemoryReplyInbox inbox = new InMemoryReplyInbox();
-        inbox.own("term_a");
-        MessageService messages = new MessageService(agents, injector, rendezvous, inbox);
-        FleetHealthMonitor monitor = new FleetHealthMonitor(agents,
-                () -> List.of(member("term_a", MemberSession.State.READY, 0, 0)), messages,
-                new ScheduledThreadPoolExecutor(1), () -> 1, 60, 600, messages::abandon);
-
-        String ticket = messages.sendAsync("term_a", "task that asks");
-        long deadline = System.currentTimeMillis() + 2000;
-        while (!rendezvous.isWaiting("term_a") && System.currentTimeMillis() < deadline) {
-            Thread.sleep(5);
-        }
-        assertTrue(rendezvous.isWaiting("term_a"), "the async send should have opened its waiter");
-        injector.onStatus("term_a", AgentStatus.IDLE);    // deliver the task
-        injector.onStatus("term_a", AgentStatus.WORKING); // the worker picks it up
-
-        // The worker asks, with a short timeout so its own fleet_ask lapses quickly in test time.
-        CompletableFuture<MessageService.AskResult> ask = CompletableFuture.supplyAsync(
-                () -> messages.ask("term_a", "which config?", 200));
-        awaitPhase(messages, ticket, MessageService.Phase.ASKING);
-
-        monitor.reportTransition("term_a", HealthState.GONE);
-        assertEquals(MessageService.Phase.ASKING, messages.poll(ticket).phase(),
-                "the first sweep must not fail a ticket that is still genuinely being asked");
-
-        // The worker's own fleet_ask now lapses on its own — task.question clears to null.
-        assertEquals(MessageService.AskOutcome.TIMED_OUT, ask.get(5, TimeUnit.SECONDS).outcome());
-
-        // An unchanged tick still must not refire (CB-580).
-        monitor.reportTransition("term_a", HealthState.GONE);
-        assertEquals(MessageService.Phase.PENDING, messages.poll(ticket).phase());
-
-        // The delayed recheck scheduled for the original transition finally sweeps it.
-        monitor.recheckTerminalTarget("term_a", HealthState.GONE);
-        assertEquals(MessageService.Phase.FAILED, messages.poll(ticket).phase());
-
-        monitor.stop();
-    }
-
-    private static MessageService.TaskView awaitPhase(MessageService messages, String ticket,
-            MessageService.Phase phase) throws InterruptedException {
-        long deadline = System.currentTimeMillis() + 2000;
-        MessageService.TaskView view;
-        do {
-            view = messages.poll(ticket);
-            if (view.phase() == phase) {
-                return view;
-            }
-            Thread.sleep(5);
-        } while (System.currentTimeMillis() < deadline);
-        assertEquals(phase, view.phase());
-        return view;
-    }
 }

fleetd/src/test/java/dev/ltms/fleet/herdr/FakeHerdr.java

@@ -7,7 +7,6 @@ import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.CopyOnWriteArrayList;
 
 /**
@@ -40,12 +39,8 @@ public final class FakeHerdr implements HerdrClient {
     private final Map<String, List<String>> extraTabs = new LinkedHashMap<>();
     private int agentNameTakenFor = 0;
     private int agentPaneBusyFor = 0;
-    private String agentStartErrorCode = null;
     private int workerTabPaneCount = 1;
     private String paneCloseErrorCode = null;
-    private final Map<String, String> paneCloseErrorCodeFor = new ConcurrentHashMap<>();
-    private String tabCloseErrorCode = null;
-    private final Map<String, String> tabCloseErrorCodeFor = new ConcurrentHashMap<>();
     private String agentSendErrorCode = null;
     private boolean noPanes = false;
     private volatile String agentStatus = "idle"; // steady-state agent.get status
@@ -85,56 +80,18 @@ public final class FakeHerdr implements HerdrClient {
         return this;
     }
 
-    /** Make every {@code agent.start} call fail with this herdr error code. */
-    public FakeHerdr agentStartFailsWith(String code) {
-        this.agentStartErrorCode = code;
-        return this;
-    }
-
     /** Make the worker tab (w9:t2) report this many panes in {@code tab.list} (default 1). */
     public FakeHerdr withWorkerTabPaneCount(int n) {
         this.workerTabPaneCount = n;
         return this;
     }
 
-    /** Make {@code pane.close} fail with this herdr error code, for every pane. */
+    /** Make {@code pane.close} fail with this herdr error code. */
     public FakeHerdr paneCloseFailsWith(String code) {
         this.paneCloseErrorCode = code;
         return this;
     }
 
-    /**
-     * Make {@code pane.close} fail with this herdr error code, but only for the given {@code
-     * pane_id} — every other pane's {@code pane.close} still succeeds. Unlike {@link
-     * #paneCloseFailsWith}, which fails every call regardless of which pane it targets, this lets a
-     * test reap/release several sessions at once and make exactly one of them fail to stop, so the
-     * others' teardown can be asserted to proceed normally (fleetd #290).
-     */
-    public FakeHerdr paneCloseFailsForPane(String paneId, String code) {
-        this.paneCloseErrorCodeFor.put(paneId, code);
-        return this;
-    }
-
-    /** Make {@code tab.close} fail with this herdr error code, for every tab. */
-    public FakeHerdr tabCloseFailsWith(String code) {
-        this.tabCloseErrorCode = code;
-        return this;
-    }
-
-    /**
-     * Make {@code tab.close} fail with this herdr error code, but only for the given {@code
-     * tab_id} — every other tab's {@code tab.close} still succeeds. The {@code tab.close}
-     * counterpart to {@link #paneCloseFailsForPane} (fleetd #290): lets a test make exactly one
-     * session's tab teardown fail while proving the rest of {@code stop()} — {@code
-     * releaseZdotdir}, and the caller's worktree removal — still runs (fleetd #293). Named "ForTab"
-     * rather than "ForPane" (unlike its sibling) because {@code tab.close} keys on {@code tab_id},
-     * not a pane id.
-     */
-    public FakeHerdr tabCloseFailsForTab(String tabId, String code) {
-        this.tabCloseErrorCodeFor.put(tabId, code);
-        return this;
-    }
-
     /**
      * Make {@code pane.list} report no panes at all — models a second herdr daemon (CB-185) that
      * simply does not host the pane a {@link PaneLocator} is searching for.
@@ -318,10 +275,6 @@ public final class FakeHerdr implements HerdrClient {
                                             + required + "`", "invalid_request", null);
                         }
                     }
-                    if (agentStartErrorCode != null) {
-                        throw new HerdrException("herdr error [" + agentStartErrorCode + "]: agent.start failed",
-                                agentStartErrorCode, null);
-                    }
                     long starts = calls.stream().filter(c -> c.method().equals("agent.start")).count();
                     if (starts <= agentPaneBusyFor) {
                         throw new HerdrException(
@@ -385,17 +338,7 @@ public final class FakeHerdr implements HerdrClient {
                             .formatted(workerTabPaneCount,
                                     seeded.isEmpty() ? "" : "," + String.join(",", seeded)));
                 }
-                case "tab.close" -> {
-                    Object tabIdParam = params instanceof Map<?, ?> m ? m.get("tab_id") : null;
-                    String perTabCode = tabIdParam == null ? null
-                            : tabCloseErrorCodeFor.get(String.valueOf(tabIdParam));
-                    String code = perTabCode != null ? perTabCode : tabCloseErrorCode;
-                    if (code != null) {
-                        throw new HerdrException("herdr error [" + code + "]: tab.close failed",
-                                code, null);
-                    }
-                    yield mapper.readTree("{\"type\":\"ok\"}");
-                }
+                case "tab.close" -> mapper.readTree("{\"type\":\"ok\"}");
                 case "pane.get" -> mapper.readTree("""
                         {"type":"pane_info","pane":{"pane_id":"w9:pW","workspace_id":"w9",
                           "tab_id":"w9:t2","agent_status":"idle"}}""");
@@ -417,13 +360,9 @@ public final class FakeHerdr implements HerdrClient {
                                   "foreground_processes":[]}}""");
                 }
                 case "pane.close" -> {
-                    Object paneIdParam = params instanceof Map<?, ?> m ? m.get("pane_id") : null;
-                    String perPaneCode = paneIdParam == null ? null
-                            : paneCloseErrorCodeFor.get(String.valueOf(paneIdParam));
-                    String code = perPaneCode != null ? perPaneCode : paneCloseErrorCode;
-                    if (code != null) {
-                        throw new HerdrException("herdr error [" + code + "]: pane.close failed",
-                                code, null);
+                    if (paneCloseErrorCode != null) {
+                        throw new HerdrException("herdr error [" + paneCloseErrorCode + "]: pane.close failed",
+                                paneCloseErrorCode, null);
                     }
                     yield mapper.readTree("{\"type\":\"ok\"}");
                 }

fleetd/src/test/java/dev/ltms/fleet/inject/InjectorTest.java

@@ -297,68 +297,6 @@ class InjectorTest {
         assertTrue(inj.activeTargets().isEmpty(), "the wedged target is reclaimed, not polled forever");
     }
 
-    /** A listener whose post-turn housekeeping always starts, as SessionManager's does with clearAfterTurn on. */
-    private static final class PostTurnListener implements TurnListener {
-        @Override public void onTurnComplete(String target) { }
-        @Override public boolean hasPostTurnAction(String target) { return true; }
-        @Override public boolean onTurnCompleteWithPostAction(String target) { return true; }
-    }
-
-    @Test
-    void aWorkerThatWedgesInUnknownAwaitingPostTurnPickupIsReleased() {
-        // fleetd #306: the post-turn phase had no way out of a sustained unknown streak, so the
-        // pickup latch stayed set, the target was polled forever, and every later message to it was
-        // blocked by the delivery gate — while the session still looked healthy.
-        Captor cap = new Captor();
-        Injector inj = new Injector(new AgentControl(herdr), new PostTurnListener());
-        inj.enqueue(T, "task", TestTurnTokens.inert(T));
-
-        inj.onStatus(T, AgentStatus.IDLE);    // deliver
-        inj.onStatus(T, AgentStatus.WORKING); // turn starts
-        inj.onStatus(T, AgentStatus.IDLE);    // turn completes; housekeeping dispatched
-        for (int i = 0; i < STALL_SAMPLES; i++) inj.onStatus(T, AgentStatus.UNKNOWN); // then wedges
-
-        assertTrue(inj.activeTargets().isEmpty(),
-                "a target wedged awaiting post-turn pickup must be reclaimed, not polled forever");
-        assertEquals(List.of(), cap.failed,
-                "the delegated turn already completed — a stuck /clear must not be reported as a failed turn");
-    }
-
-    @Test
-    void aWorkerThatWedgesInUnknownAfterPickingUpTheResetIsReleased() {
-        // The sibling latch. postTurnObserved is set when the reset is seen picked up (WORKING) and
-        // is cleared only on a later injectable sample, so a wedge right after pickup sticks too.
-        Captor cap = new Captor();
-        Injector inj = new Injector(new AgentControl(herdr), new PostTurnListener());
-        inj.enqueue(T, "task", TestTurnTokens.inert(T));
-
-        inj.onStatus(T, AgentStatus.IDLE);
-        inj.onStatus(T, AgentStatus.WORKING);
-        inj.onStatus(T, AgentStatus.IDLE);    // turn complete; reset dispatched
-        inj.onStatus(T, AgentStatus.WORKING); // reset picked up -> postTurnObserved
-        for (int i = 0; i < STALL_SAMPLES; i++) inj.onStatus(T, AgentStatus.UNKNOWN);
-
-        assertTrue(inj.activeTargets().isEmpty(), "a wedge after reset pickup must also be reclaimed");
-        assertEquals(List.of(), cap.failed, "still not a turn failure");
-    }
-
-    @Test
-    void aBriefUnknownDuringPostTurnHousekeepingDoesNotDropTheLatch() {
-        // The other direction: the escape must not fire on a glitch, or the queued next delegation
-        // would overtake housekeeping that is still running.
-        Injector inj = new Injector(new AgentControl(herdr), new PostTurnListener());
-        inj.enqueue(T, "first", TestTurnTokens.inert(T));
-        inj.enqueue(T, "second", TestTurnTokens.inert(T));
-
-        inj.onStatus(T, AgentStatus.IDLE);
-        inj.onStatus(T, AgentStatus.WORKING);
-        inj.onStatus(T, AgentStatus.IDLE);    // first completes; reset dispatched
-        for (int i = 0; i < 10; i++) inj.onStatus(T, AgentStatus.UNKNOWN); // well under the grace
-
-        assertFalse(inj.activeTargets().isEmpty(), "a brief glitch must not release the post-turn latch");
-        assertEquals(List.of("first"), sent(), "the queued delegation must not overtake housekeeping");
-    }
-
     @Test
     void aTransientUnknownGlitchNeitherFailsNorBlocksCompletion() {
         Captor cap = new Captor();

fleetd/src/test/java/dev/ltms/fleet/mcp/ConnectionIdentityTest.java

@@ -20,17 +20,6 @@ class ConnectionIdentityTest {
         assertEquals("term_a", with(_ -> FakeHerdr.WORKER_PID).callerTerminal("127.0.0.1", 55555));
     }
 
-    @Test
-    void resolvesWorkerFromAnyLoopbackSourceAddressNotJust127001() {
-        // fleetd #305. On Linux the whole 127.0.0.0/8 is bound to lo, so a worker can connect with
-        // a source address of 127.0.0.2. If identity resolution skips that address the caller has
-        // no terminal, and a caller with no terminal is the primary under loopback-trust — so this
-        // must resolve the worker, not null.
-        assertEquals("term_a", with(_ -> FakeHerdr.WORKER_PID).callerTerminal("127.0.0.2", 55555));
-        assertEquals("term_a", with(_ -> FakeHerdr.WORKER_PID).callerTerminal("127.1.2.3", 55555));
-        assertEquals("term_a", with(_ -> FakeHerdr.WORKER_PID).callerTerminal("::ffff:127.0.0.2", 55555));
-    }
-
     @Test
     void nullForOffHostCaller() {
         // A non-loopback peer can't be an on-host worker → treat as primary/unknown.
@@ -43,22 +32,6 @@ class ConnectionIdentityTest {
         assertNull(with(_ -> 999_999).callerTerminal("127.0.0.1", 55555));
     }
 
-    @Test
-    void callerIsUnresolvedWhenThePeerPidLookupFails() {
-        // fleetd #317: LsofPeerPidLookup returns -1 on any failure — a fork error, or (silently)
-        // simply no matching lsof line. Caller.resolved() is the one place that sentinel is tested.
-        ConnectionIdentity.Caller c = with(_ -> -1).resolve("127.0.0.1", 55555);
-        assertFalse(c.resolved(), "a -1 pid means the lookup failed, not that this pid owns no pane");
-    }
-
-    @Test
-    void callerIsResolvedWhenThePidIsRealEvenThoughItOwnsNoPane() {
-        // The primary's own connection: a real, lsof-found pid that just isn't a worker pane. This
-        // must read as "resolved" — the distinction #317 turns on.
-        ConnectionIdentity.Caller c = with(_ -> 999_999).resolve("127.0.0.1", 55555);
-        assertTrue(c.resolved());
-    }
-
     @Test
     void resolvesTheCallersPidAndCwd() {
         // CB-112: the primary maps to no pane, but its PID and cwd are still readable.

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpAuthzTest.java

@@ -24,13 +24,8 @@ import io.modelcontextprotocol.spec.McpSchema;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
 
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.LinkedHashSet;
 import java.util.Map;
 import java.util.Set;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
 
 import static org.junit.jupiter.api.Assertions.*;
 
@@ -49,9 +44,6 @@ import static org.junit.jupiter.api.Assertions.*;
  */
 class FleetMcpAuthzTest {
 
-    private static final Path MCP_SOURCE = Path.of("src/main/java/dev/ltms/fleet/mcp/FleetMcp.java");
-    private static final Pattern TOOL_REGISTRATION = Pattern.compile("tool\\(\\\"(fleet_[a-z_]+)\\\"");
-
     private final FakeHerdr herdr = new FakeHerdr();
     private final AgentControl agents = new AgentControl(herdr);
     private Metrics metrics;
@@ -209,42 +201,6 @@ class FleetMcpAuthzTest {
                 "a blank target is an absent target");
     }
 
-    @Test
-    void everyRegisteredToolHasItsHandlerActionPinned() {
-        Set<String> registered = toolsTheServerRegisters();
-        assertTrue(registered.size() >= 10,
-                "scraped only " + registered.size() + " tool registrations from FleetMcp (" + registered
-                        + "); the server registers eleven, so the tool(\"…\") scrape has stopped matching");
-        registered.forEach(tool -> assertDoesNotThrow(() -> FleetMcp.toolAction(tool, Map.of()),
-                () -> tool + " is registered but has no pinned authorization action"));
-
-        assertEquals(Authz.Action.SEND, FleetMcp.toolAction("fleet_send", Map.of()));
-        assertEquals(Authz.Action.REPLY, FleetMcp.toolAction("fleet_reply", Map.of()));
-        assertEquals(Authz.Action.ASK, FleetMcp.toolAction("fleet_ask", Map.of()));
-        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_status", Map.of()));
-        assertEquals(Authz.Action.DRAIN, FleetMcp.toolAction("fleet_ack", Map.of()));
-        assertEquals(Authz.Action.SPAWN, FleetMcp.toolAction("fleet_spawn", Map.of()));
-        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_list", Map.of()));
-        assertEquals(Authz.Action.STOP, FleetMcp.toolAction("fleet_stop", Map.of()));
-        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_profiles", Map.of()));
-        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_whoami", Map.of()));
-        assertEquals(Authz.Action.READ, FleetMcp.toolAction("fleet_poll", Map.of("ticket", "task")));
-        assertEquals(Authz.Action.DRAIN, FleetMcp.toolAction("fleet_poll", Map.of("target", "term_b")));
-    }
-
-    private static Set<String> toolsTheServerRegisters() {
-        try {
-            Matcher matcher = TOOL_REGISTRATION.matcher(Files.readString(MCP_SOURCE));
-            Set<String> tools = new LinkedHashSet<>();
-            while (matcher.find()) {
-                tools.add(matcher.group(1));
-            }
-            return tools;
-        } catch (Exception e) {
-            throw new AssertionError("could not scrape FleetMcp tool registrations", e);
-        }
-    }
-
     @Test
     void aWorkerMayNotDrainAnotherSessionsInboxByPolling() {
         FleetMcp m = mcp(true);

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpTest.java

@@ -31,7 +31,6 @@ import org.junit.jupiter.api.Test;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
-import java.util.EnumSet;
 import java.util.Set;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.TimeUnit;
@@ -189,7 +188,7 @@ class FleetMcpTest {
     }
 
     @Test
-    void unansweredAsyncAskReturnsTheTicketToPendingThenAWorkersLateReplyStillCompletesIt() throws Exception {
+    void unansweredAsyncAskReturnsTheTicketToPending() throws Exception {
         McpSchema.CallToolResult accepted = FleetMcp.sendAsync(messages, "term_a", "do it", null, Set.of());
         String ticket = textOf(accepted).substring(textOf(accepted).indexOf("ticket=") + "ticket=".length()).trim();
 
@@ -203,15 +202,8 @@ class FleetMcpTest {
         assertTrue(textOf(ask).contains("no answer"), textOf(ask));
         assertTrue(textOf(FleetMcp.poll(messages, ticket, null)).startsWith("[pending"));
 
-        // fleetd #307: the worker resumed on its own after the primary never answered, and its real
-        // fleet_reply must complete its OWN async ticket — not strand in the inbox with
-        // fleet_poll{ticket} stuck PENDING forever and later force-failed with a false "session
-        // released before it replied" reason. This used to land in the inbox instead (see the old
-        // assertion this replaced: messages.drainReplies("term_a").getFirst()...) — that was the bug.
         FleetMcp.reply(messages, "term_a", "finished after timeout");
-        assertEquals("finished after timeout", textOf(FleetMcp.poll(messages, ticket, null)));
-        assertTrue(messages.drainReplies("term_a").isEmpty(),
-                "the reply completed its own ticket directly and never touched the inbox");
+        assertEquals("finished after timeout", messages.drainReplies("term_a").getFirst().content());
     }
 
     @Test
@@ -333,26 +325,6 @@ class FleetMcpTest {
         assertEquals("orphan", drained.getFirst().content());
     }
 
-    @Test
-    void replyWithBlankContentIsACleanToolErrorNotAnUncaughtException() {
-        // fleetd #302: MessageService.reply now REJECTS blank content by throwing. fleet_reply's
-        // handler is a bare BiFunction with no try/catch around it, so if this guard only checked
-        // `== null` (as it did), a whitespace-only reply would leave the handler as an uncaught
-        // IllegalArgumentException instead of a tool error the caller can read. Null and whitespace
-        // are the same caller mistake and must get the same answer — the sibling fleet_send guard
-        // has always used isBlank for exactly this reason.
-        for (String blank : new String[] {null, "", "   ", "\n\t"}) {
-            McpSchema.CallToolResult res = assertDoesNotThrow(
-                    () -> FleetMcp.reply(messages, "term_a", blank),
-                    "blank content must be refused as a tool error, never thrown out of the handler");
-            assertEquals(Boolean.TRUE, res.isError(), "blank content is an error result");
-            assertTrue(textOf(res).contains("content is required"),
-                    "the error names the missing argument: " + textOf(res));
-        }
-        assertEquals(0, messages.drainReplies("term_a").size(),
-                "a refused reply must not reach the inbox");
-    }
-
     @Test
     void bridgePollWithTargetDrainsReplies() {
         // A reply with no open send queues it in the inbox.
@@ -632,60 +604,6 @@ class FleetMcpTest {
         assertTrue(out.contains("\"reclaimable\":0"), out);
     }
 
-    /**
-     * fleetd #284: {@code reclaimable} has exactly one definition, and this pins it over EVERY
-     * {@link MemberSession.State} — so a state added later cannot slip through unconsidered. Both
-     * views in a {@code fleet_list} response call {@link FleetMcp#reclaimable}, so they cannot
-     * drift apart.
-     *
-     * <p>{@code BACKEND_ERROR} and {@code FAILED} are NOT reclaimable on purpose. The ticket asked
-     * for them to be; that half of the ticket was wrong. Their seat is already out of
-     * {@code live}, so it is already in {@code free} — counting it here too would report the same
-     * seat twice.
-     */
-    @Test
-    void onlyReadyAndDoneSessionsAreReclaimable() {
-        Set<MemberSession.State> expected = EnumSet.of(MemberSession.State.READY, MemberSession.State.DONE);
-        for (MemberSession.State state : MemberSession.State.values()) {
-            MemberSession session = new MemberSession("p1", "term1", "ltms-local", null,
-                    "/tmp", null, 0L, 0L, 0, state, null, null);
-            assertEquals(expected.contains(state), FleetMcp.reclaimable(session, null),
-                    "state " + state + " must " + (expected.contains(state) ? "" : "not ")
-                            + "count as reclaimable");
-        }
-    }
-
-    /**
-     * fleetd #284, the operator-visible half. {@code liveCount} here is the value the real counter
-     * ({@code Fleetd.liveSessionCount}, proven against the actual spawn gate in
-     * {@code FleetdBackendErrorSinkTest}) produces for this roster: 0, because both sessions are
-     * terminal. What this test pins is what {@code fleet_list} says around it — the two seats show
-     * up once, in {@code free}, and are NOT counted a second time as {@code reclaimable}; neither
-     * is any member row; and both dead sessions are still listed so the lead can see why.
-     */
-    @Test
-    void terminalFailureSessionsFreeTheirSeatWithoutBeingCountedReclaimable() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-        MemberSession backendError = sessions.acquire("ltms-local", null, null, null);
-        MemberSession failed = sessions.acquire("ltms-local", null, null, null);
-        assertTrue(sessions.onBackendError(backendError.terminalId(), "backend exited"));
-        sessions.onTurnFailed(failed.terminalId());
-
-        String out = textOf(FleetMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
-                sessions, null, new FleetMcp.CapacitySource(profile -> 0, profile -> 2,
-                () -> Set.of("ltms-local"), () -> 0), new FleetMcp.HealthCoverageSource(() -> "off"),
-                FleetMcp.QuarantineSource.none(), Map.of(), ""));
-
-        assertTrue(out.contains("\"free\":2"), "both seats are back: " + out);
-        assertTrue(out.contains("\"reclaimable\":0"),
-                "the freed seats must not be counted a second time as reclaimable: " + out);
-        assertFalse(out.contains("\"reclaimable\":true"),
-                "no member row may claim a seat the profile count says is not held: " + out);
-        assertTrue(out.contains("\"state\":\"backend_error\""), "the dead session stays visible: " + out);
-        assertTrue(out.contains("\"state\":\"failed\""), "the failed session stays visible: " + out);
-    }
-
     @Test
     void inertCapacitySourceOmitsCapacityBlock() {
         FakeHerdr h = new FakeHerdr();

fleetd/src/test/java/dev/ltms/fleet/member/ClaudeCodeLauncherTest.java

@@ -925,71 +925,6 @@ class ClaudeCodeLauncherTest {
         assertTrue(herdr.called("pane.close"), "stop via handle.id() must close the pane");
     }
 
-    /** A tab-placement launcher with {@code memberCredentials policy=allow-list} under a zsh shell — the
-     * combination that makes {@link HerdrPeerLauncher#spawn} generate a real ZDOTDIR, so {@code
-     * releaseZdotdir}'s effect (the directory's deletion) is observable from a test. */
-    private ClaudeCodeLauncher serviceWithAllowList(FakeHerdr herdr) {
-        FleetConfig.Profile cfg = new FleetConfig.Profile(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
-                List.of("ccs", "ltms-local"), "tab", "fleetd-workers",
-                "worker: {profile} #{n}", null, null, null);
-        Supplier<FleetConfig.MemberCredentials> creds = () -> new FleetConfig.MemberCredentials(
-                FleetConfig.MemberCredentials.POLICY_ALLOW_LIST, List.of(), List.of(), null);
-        Function<String, String> env = name -> "SHELL".equals(name) ? "/bin/zsh" : null;
-        return new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
-                env, 0, System::currentTimeMillis, () -> { }, null, creds);
-    }
-
-    /**
-     * fleetd #293: {@code stop()} used to run {@code spaces.closeTab} bare — any non-{@code
-     * *_not_found} herdr error propagated straight out of {@code stop()}, skipping {@code
-     * releaseZdotdir} entirely (the pane was already closed by that point, so the tab-close failure
-     * is cosmetic, not a real teardown failure). Proves both halves of the fix: {@code stop()} no
-     * longer throws for this failure, and {@code releaseZdotdir} still runs — observed here by the
-     * generated ZDOTDIR actually being deleted, since {@code releaseZdotdir}'s last line is {@code
-     * EnvAllowListScrub.deleteRecursively(dir)}.
-     */
-    @Test
-    @SuppressWarnings("unchecked")
-    void stopStillReleasesZdotdirWhenCloseTabFailsWithANonNotFoundCode() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = serviceWithAllowList(herdr);
-        PeerHandle handle = svc.spawn(new SpawnRequest(null, null, null));
-        Map<String, Object> tabCreateParams = (Map<String, Object>) herdr.lastCall("tab.create").params();
-        Map<String, String> tabEnv = (Map<String, String>) tabCreateParams.get("env");
-        String zdotdir = tabEnv.get("ZDOTDIR");
-        assertNotNull(zdotdir, "policy=allow-list under a zsh shell must have generated a ZDOTDIR: " + tabEnv);
-        Path dir = Path.of(zdotdir);
-        assertTrue(Files.isDirectory(dir), "the generated ZDOTDIR must exist before stop(): " + dir);
-        herdr.tabCloseFailsForTab("w9:t2", "internal_error");
-
-        Logger logger = (Logger) LoggerFactory.getLogger(HerdrPeerLauncher.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.start();
-        logger.addAppender(appender);
-        try {
-            assertDoesNotThrow(() -> svc.stop(handle.id()),
-                    "fleetd #293: a failing tab.close is cosmetic — it must not propagate out of stop()");
-        } finally {
-            logger.detachAppender(appender);
-        }
-
-        assertTrue(herdr.called("tab.close"), "tab.close was still attempted");
-        assertFalse(Files.exists(dir),
-                "releaseZdotdir must still run and delete the generated ZDOTDIR despite the tab.close "
-                        + "failure: " + dir);
-        String warn = appender.list.stream()
-                .filter(e -> e.getLevel().equals(Level.WARN))
-                .map(ILoggingEvent::getFormattedMessage)
-                .filter(m -> m.contains("tab.close") && m.contains("w9:t2"))
-                .findFirst()
-                .orElse(null);
-        assertNotNull(warn, "the failing tab.close must be logged at WARN naming the tab id — a "
-                + "silently swallowed failure with no message is not an improvement. Log lines: "
-                + appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList());
-    }
-
     // --- CB-519: host-unique id, decoupled from the pane coordinate ------------------------------
 
     @Test
@@ -1165,8 +1100,7 @@ class ClaudeCodeLauncherTest {
     @Test
     void spawnLetsAnUnrelatedHerdrErrorPropagateUnchanged() {
         // Fix 1 must only special-case a "*_not_found" answer. Any other herdr failure keeps
-        // propagating as-is — this gate does not know how to recover from it. The pane still needs
-        // closing because spawn throws before it can return the pane id to a caller that could stop it.
+        // propagating as-is — this gate does not know how to recover from it.
         FakeHerdr herdr = new FakeHerdr();
         herdr.agentStatus("unknown");
         herdr.agentGetFailsWithAfter(0, "internal_error");
@@ -1183,27 +1117,8 @@ class ClaudeCodeLauncherTest {
                 () -> svc.spawn(new SpawnRequest(null, null, null)));
 
         assertEquals("internal_error", ex.code());
-        assertEquals(1, paneCloseCount(herdr, "w9:pRoot_1"),
-                "the unchanged error leaves spawn without a pane id, so this gate closes its orphaned pane");
-    }
-
-    @Test
-    void panePlacementClosesTheSplitPaneWhenAgentStartFails() {
-        FakeHerdr herdr = new FakeHerdr().agentStartFailsWith("internal_error");
-        FleetConfig.Profile cfg = new FleetConfig.Profile(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
-                List.of("claude"), "pane", "fleetd-workers", "w #{n}", null, null, null);
-        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(
-                new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-
-        dev.ltms.fleet.herdr.HerdrException ex = assertThrows(
-                dev.ltms.fleet.herdr.HerdrException.class,
-                () -> svc.spawn(new SpawnRequest(null, null, null)));
-
-        assertEquals("internal_error", ex.code(), "agent.start failure propagates unchanged");
-        assertEquals(1, paneCloseCount(herdr, "w1:pSplit"),
-                "the pane split for a peer that never starts is closed instead of left orphaned");
+        assertEquals(0, paneCloseCount(herdr, "w9:pRoot_1"),
+                "an error this gate does not recognize is not this gate's teardown to run");
     }
 
     // --- fleetd #176 fix 2: corroborated UNKNOWN refinement --------------------------------------
@@ -2827,126 +2742,4 @@ class ClaudeCodeLauncherTest {
                 "a WARN naming the cwd must fire when the profile sets no configDir: "
                         + appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList());
     }
-
-    // --- fleetd #285: seedTrustDialog under memberHerdrSocket --------------------------------------
-    //
-    // seedTrustDialog gated only on isProvisionedWorktree(cwd) and, being static, could not see
-    // memberHerdrSocketConfigured() at all — unlike its sibling writeCharterFile one method below,
-    // which already refuses the spawn when it cannot place the charter where a different-uid member
-    // can read it. Under memberHerdrSocket + configDir unset, seedTrustDialog wrote fleetd's OWN
-    // ~/.claude.json (the operator's real file) while believing it was seeding the member's. The fix
-    // makes the method an instance method so it can see memberHerdrSocketConfigured(), and applies
-    // the same "refuse, don't silently write somewhere wrong" rule writeCharterFile already uses.
-
-    @Test
-    void seedTrustDialogUnderMemberHerdrSocketSharesTheFileWithTheConfiguredGroup(
-            @TempDir Path configDir, @TempDir Path worktree, @TempDir Path worktreeRoot) throws Exception {
-        markAsProvisionedWorktree(worktree);
-        String group = currentUserGroup();
-        FakeHerdr herdr = new FakeHerdr();
-        // trustProfile always sets a bridge mcpUrl, so a reply charter is generated too, which
-        // means writeCharterFile ALSO runs under memberHerdrSocket and needs its own worktreeRoot —
-        // pass one so this test isolates the trust-seed behaviour instead of tripping that refusal.
-        FleetConfig.Profile cfg = trustProfile(configDir.toString(), worktree.toString());
-        serviceWithConfig(herdr, cfg, () -> configWithMemberHerdrSocket(worktreeRoot.toString(), group)).spawn();
-
-        Path claudeJson = configDir.resolve(".claude.json");
-        assertTrue(Files.exists(claudeJson), "still seeded into <configDir>/.claude.json under memberHerdrSocket");
-        JsonNode project = new ObjectMapper().readTree(claudeJson.toFile())
-                .path("projects").path(worktree.toString());
-        assertTrue(project.path("hasTrustDialogAccepted").asBoolean(false));
-
-        assertEquals("rw-r-----", PosixFilePermissions.toString(Files.getPosixFilePermissions(claudeJson)),
-                "under memberHerdrSocket the file must be shared group-readable, mirroring the "
-                        + "charter file's own per-file mode (fleetd #222) — a 0600 file (Claude "
-                        + "Code's own default) is unreadable by the member's different OS user");
-        String actualGroup = Files.getFileAttributeView(claudeJson, PosixFileAttributeView.class)
-                .readAttributes().group().getName();
-        assertEquals(group, actualGroup, "the file must be chgrp'd to the configured worktreeGroup");
-    }
-
-    /**
-     * The bug itself: {@code memberHerdrSocket} configured, {@code configDir} unset. Before the fix
-     * this wrote fleetd's own default {@code ~/.claude.json} (here redirected to {@code fakeHome} so
-     * a reintroduced bug still cannot touch the real operator file); after the fix it must refuse the
-     * spawn instead, naming {@code configDir} as the missing key, before the member is ever started.
-     */
-    @Test
-    void seedTrustDialogUnderMemberHerdrSocketRefusesWhenConfigDirUnset(
-            @TempDir Path fakeHome, @TempDir Path worktree) throws Exception {
-        markAsProvisionedWorktree(worktree);
-        String originalHome = System.getProperty("user.home");
-        System.setProperty("user.home", fakeHome.toString());
-        try {
-            FakeHerdr herdr = new FakeHerdr();
-            FleetConfig.Profile cfg = trustProfile(null, worktree.toString());
-            ClaudeCodeLauncher launcher = serviceWithConfig(herdr, cfg,
-                    () -> configWithMemberHerdrSocket(null, "some-group"));
-
-            IllegalStateException ex = assertThrows(IllegalStateException.class, launcher::spawn,
-                    "memberHerdrSocket + no configDir must refuse the spawn, not write fleetd's own "
-                            + "default ~/.claude.json");
-            assertTrue(ex.getMessage().contains("configDir"),
-                    "the refusal must name the missing config key — got: " + ex.getMessage());
-            assertFalse(Files.exists(fakeHome.resolve(".claude.json")),
-                    "nothing may be written to fleetd's own default home — this is the exact fleetd "
-                            + "#285 defect: writing the operator's own home instead of the member's");
-            assertFalse(herdr.called("agent.start"),
-                    "the spawn must be refused BEFORE the member is ever started — got calls: " + herdr.calls);
-        } finally {
-            System.setProperty("user.home", originalHome);
-        }
-    }
-
-    /**
-     * {@code configDir} alone is not enough — without {@code worktreeGroup} the file fleetd writes
-     * stays {@code 0600} and the member's different OS user still cannot read it, so this must also
-     * refuse, naming {@code worktreeGroup} this time.
-     */
-    @Test
-    void seedTrustDialogUnderMemberHerdrSocketRefusesWhenWorktreeGroupUnset(
-            @TempDir Path configDir, @TempDir Path worktree) throws Exception {
-        markAsProvisionedWorktree(worktree);
-        FakeHerdr herdr = new FakeHerdr();
-        FleetConfig.Profile cfg = trustProfile(configDir.toString(), worktree.toString());
-        ClaudeCodeLauncher launcher = serviceWithConfig(herdr, cfg,
-                () -> configWithMemberHerdrSocket(null, null));
-
-        IllegalStateException ex = assertThrows(IllegalStateException.class, launcher::spawn,
-                "memberHerdrSocket + no worktreeGroup must refuse the spawn, not write an unreadable file");
-        assertTrue(ex.getMessage().contains("worktreeGroup"),
-                "configDir alone is not enough — got: " + ex.getMessage());
-        assertFalse(Files.exists(configDir.resolve(".claude.json")),
-                "nothing may be written when the file cannot be shared with the member's group");
-        assertFalse(herdr.called("agent.start"),
-                "the spawn must be refused BEFORE the member is ever started");
-    }
-
-    /**
-     * Regression proof: with {@code memberHerdrSocket} ABSENT — even given a LIVE, non-null {@code
-     * config} supplier (not merely {@code config == null}, which every other seedTrustDialog test in
-     * this file already exercises) — the write must stay byte-identical to before this fix: existing
-     * {@code 0600} permissions preserved, no chgrp/chmod attempted. This is the proof the ticket asks
-     * for: the path the whole live fleet uses today is unchanged by this fix.
-     */
-    @Test
-    void seedTrustDialogPreservesExisting0600PermissionsWhenMemberHerdrSocketAbsentEvenWithALiveConfigSupplier(
-            @TempDir Path configDir, @TempDir Path worktree) throws Exception {
-        markAsProvisionedWorktree(worktree);
-        Path claudeJson = configDir.resolve(".claude.json");
-        Files.writeString(claudeJson, "{}");
-        assumeTrue(Files.getFileAttributeView(claudeJson, PosixFileAttributeView.class) != null,
-                "no POSIX permissions on this filesystem — skipping rather than failing");
-        Files.setPosixFilePermissions(claudeJson, PosixFilePermissions.fromString("rw-------"));
-
-        FakeHerdr herdr = new FakeHerdr();
-        FleetConfig.Profile cfg = trustProfile(configDir.toString(), worktree.toString());
-        FleetConfig config = new FleetConfig(null, null, null, Map.of(), null, null, null, null, null,
-                null, null, null, null, null, null, null, null, null, null, null, null, null).withDefaults();
-        serviceWithConfig(herdr, cfg, () -> config).spawn();
-
-        assertEquals("rw-------", PosixFilePermissions.toString(Files.getPosixFilePermissions(claudeJson)),
-                "with memberHerdrSocket absent — even given a live config supplier — the seed must "
-                        + "stay byte-identical to before this fix: no chgrp/chmod attempted");
-    }
 }

fleetd/src/test/java/dev/ltms/fleet/msg/AmqpReplyInboxContractTest.java

@@ -154,7 +154,7 @@ class AmqpReplyInboxContractTest {
     }
 
     @Test
-    void releaseCancelsConsumerAndRequeuesHeldDeliveryForRecovery() throws Exception {
+    void releaseCancelsConsumerAndClearsHeld() throws Exception {
         String target = "worker-release-" + System.nanoTime();
         try (AmqpReplyInbox inbox = AmqpReplyInbox.open(uri())) {
             inbox.own(target);
@@ -164,22 +164,6 @@ class AmqpReplyInboxContractTest {
             inbox.release(target);
             assertTrue(inbox.peek(target).isEmpty(),
                     "release clears the local held snapshot");
-
-            // fleetd #298: release() must not just drop the local record — the broker delivery was
-            // never acked, so cancelling the consumer alone leaves it unacked-but-orphaned on the
-            // still-open channel unless release() nacks it back with requeue=true. Prove the message
-            // is genuinely recoverable, not merely absent from peek: re-own the same target and
-            // confirm the broker redelivers it to the fresh consumer.
-            inbox.own(target);
-            List<ReplyInbox.InboxMessage> recovered = awaitPeek(inbox, target);
-            assertEquals(1, recovered.size(),
-                    "a reply held (but undrained) at release() time must still be recoverable — "
-                            + "release() must requeue it, not silently drop it while the broker still "
-                            + "considers it outstanding");
-            assertEquals("m1", recovered.getFirst().msgId());
-            assertEquals("release me", recovered.getFirst().content());
-
-            inbox.ack(target, "m1");
         }
     }
 

fleetd/src/test/java/dev/ltms/fleet/msg/MessageServiceTest.java

@@ -957,76 +957,6 @@ class MessageServiceTest {
         assertEquals(MessageService.Phase.DONE, awaitTicketPhase(next, MessageService.Phase.DONE).phase());
     }
 
-    /**
-     * fleetd #307: a worker's {@code fleet_ask} can time out because the primary never answers —
-     * distinct from {@link #aReplyAfterAnswerTimesOutStillCompletesTheAsyncTicket}, where the
-     * primary DID answer and only its own bounded wait for the resumed turn expired.
-     * {@code ask()}'s timeout path deliberately forgets the task's {@code turnId} (so
-     * {@code hasAsyncQuestion} stops reporting the target BUSY — see
-     * {@code unansweredAsyncQuestionReturnsTheTicketToPendingAndReleasesItsTarget} above), which used
-     * to also erase the one signal {@code askAnsweredAsyncTasks} needed to recognize the worker's
-     * eventual real {@code fleet_reply}. That reply then had nowhere to land but the inbox, and
-     * {@code fleet_poll{ticket}} stayed PENDING forever — later force-failed with the false reason
-     * "session released before it replied", even though the worker had, in fact, replied.
-     */
-    @Test
-    void aReplyAfterAnAskTimeoutStillCompletesTheAsyncTicket() throws Exception {
-        String ticket = messages.sendAsync(T, "task that asks then finishes alone");
-        awaitWaiting();
-        injectDelivery();
-
-        assertEquals(MessageService.AskOutcome.TIMED_OUT,
-                messages.ask(T, "which config?", 200).outcome());
-        assertEquals(MessageService.Phase.PENDING, messages.poll(ticket).phase(),
-                "only the question wait ended; the delegated turn may still finish");
-
-        // The worker keeps working past the timeout and only now calls fleet_reply — with no live
-        // rendezvous waiter open (ask()'s timeout already closed it) and no new send() having
-        // reopened one for this target.
-        assertTrue(messages.reply(T, "PR opened: https://example/pulls/42"));
-
-        MessageService.TaskView done = awaitTicketPhase(ticket, MessageService.Phase.DONE);
-        assertEquals("PR opened: https://example/pulls/42", done.reply(),
-                "fleet_poll{ticket} must return the worker's real reply, not stay pending forever");
-        assertEquals("reply", done.replySource());
-        assertFalse(messages.hasStrandedReply(T),
-                "the reply completed its own ticket directly and never touched the inbox");
-    }
-
-    /**
-     * fleetd #307's ambiguity guard: an ask timeout frees its target ({@code hasAsyncQuestion}
-     * becomes false the instant it lapses — proven above), so a second, independent delegation can
-     * be dispatched to the same target and itself go on to ask-and-lapse before the first worker's
-     * real reply ever arrives. Two open tasks are then both eligible candidates on one target with
-     * no live waiter to disambiguate them. A reply arriving now must not guess which one it answers
-     * — guessing wrong would hand the lead a plausible-looking answer to a delegation the worker
-     * never touched, worse than a failure because the lead acts on it — so it must fall back to the
-     * inbox exactly as the zero-candidate case does.
-     */
-    @Test
-    void twoAskTimedOutTicketsOnOneTargetFallBackToTheInboxRatherThanGuess() throws Exception {
-        String ticket1 = messages.sendAsync(T, "first task that asks");
-        awaitWaiting();
-        injectDelivery();
-        assertEquals(MessageService.AskOutcome.TIMED_OUT, messages.ask(T, "Q1?", 200).outcome());
-
-        String ticket2 = messages.sendAsync(T, "second task that asks");
-        awaitWaiting();
-        injectDelivery();
-        assertEquals(MessageService.AskOutcome.TIMED_OUT, messages.ask(T, "Q2?", 200).outcome());
-
-        assertTrue(messages.reply(T, "which task does this answer?"));
-
-        assertEquals(MessageService.Phase.PENDING, messages.poll(ticket1).phase(),
-                "an ambiguous reply must not guess ticket1");
-        assertEquals(MessageService.Phase.PENDING, messages.poll(ticket2).phase(),
-                "an ambiguous reply must not guess ticket2");
-        assertTrue(messages.hasStrandedReply(T));
-        var drained = messages.drainReplies(T);
-        assertEquals(1, drained.size());
-        assertEquals("which task does this answer?", drained.get(0).content());
-    }
-
     @Test
     void asyncQuestionBelongsToTheTaskThatOwnsItsForwardWaiter() throws Exception {
         String first = messages.sendAsync(T, "first task");
@@ -1045,64 +975,6 @@ class MessageServiceTest {
         assertEquals(MessageService.Outcome.REPLIED, answer.get(5, TimeUnit.SECONDS).outcome());
     }
 
-    /**
-     * fleetd #282: a worker that chains a SECOND {@code fleet_ask} inside the same resumed turn —
-     * before it ever calls {@code fleet_reply} — used to kill its own async ticket. {@code answer()}
-     * opens a fresh forward waiter but (unlike {@code send()}) never registered it in
-     * {@code asyncTasksByWaiter}, so the second ask's {@code markAsyncQuestion} found no {@code Task}
-     * to re-associate. That waiter still resolved with the second {@code QUESTION} once the worker
-     * asked again, and {@code answer()} completed the ticket's future with that QUESTION "reply"
-     * unconditionally — so {@code fleet_poll} reported FAILED while the worker was still alive and
-     * the primary was mid-conversation with it.
-     *
-     * <p>Driven entirely through {@code MessageService}'s public API (sendAsync/ask/answer/poll) —
-     * never by reaching into {@link Rendezvous} or the task maps directly, so this test cannot pass
-     * for a reason unrelated to the real bug.
-     */
-    @Test
-    void secondFleetAskInTheSameResumedTurnDoesNotKillTheAsyncTicket() throws Exception {
-        String ticket = messages.sendAsync(T, "task that asks twice");
-        awaitWaiting();
-
-        // The worker's first fleet_ask.
-        CompletableFuture<MessageService.AskResult> ask1 =
-                CompletableFuture.supplyAsync(() -> messages.ask(T, "Q1", 5000));
-        MessageService.TaskView asking1 = awaitTicketPhase(ticket, MessageService.Phase.ASKING);
-        assertEquals("Q1", asking1.reply());
-
-        // The primary answers it — answer() resumes the turn and blocks for what comes next.
-        CompletableFuture<MessageService.Reply> answer1 = CompletableFuture.supplyAsync(
-                () -> messages.answer(asking1.turnId(), "a1", 5000));
-        assertEquals("a1", ask1.get(5, TimeUnit.SECONDS).answer());
-
-        // Still in the SAME resumed turn — before replying — the worker asks again.
-        CompletableFuture<MessageService.AskResult> ask2 =
-                CompletableFuture.supplyAsync(() -> messages.ask(T, "Q2", 5000));
-
-        // answer1's own call unblocks with the second QUESTION (documented QUESTION-chaining
-        // behaviour — see FleetMcp.answer's javadoc: "Answer it by calling fleet_send again with
-        // turnId=..."). The bug: this used to also kill the async ticket in the process.
-        MessageService.Reply firstAnswerResult = answer1.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.QUESTION, firstAnswerResult.outcome());
-        String turnId2 = firstAnswerResult.turnId();
-
-        MessageService.TaskView asking2 = awaitTicketPhase(ticket, MessageService.Phase.ASKING);
-        assertEquals("Q2", asking2.reply(),
-                "the ticket must surface the SECOND question, not be dead/FAILED");
-        assertEquals(turnId2, asking2.turnId());
-
-        // The primary answers the second question; the worker finally sends its real fleet_reply.
-        CompletableFuture<MessageService.Reply> answer2 = CompletableFuture.supplyAsync(
-                () -> messages.answer(turnId2, "a2", 5000));
-        assertEquals("a2", ask2.get(5, TimeUnit.SECONDS).answer());
-        awaitWaiting();
-        assertTrue(rendezvous.resolve(T, "done"));
-        assertEquals(MessageService.Outcome.REPLIED, answer2.get(5, TimeUnit.SECONDS).outcome());
-
-        MessageService.TaskView done = awaitTicketPhase(ticket, MessageService.Phase.DONE);
-        assertEquals("done", done.reply());
-    }
-
     // --- CB-582: fleet_status pendingAsk() ------------------------------------------------------
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/rest/FleetAppAuthTest.java

@@ -1,7 +1,6 @@
 package dev.ltms.fleet.rest;
 
 import dev.ltms.fleet.auth.CallerResolver;
-import dev.ltms.fleet.auth.Authz;
 import dev.ltms.fleet.auth.MemberRegistry;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.guard.SubscriptionGuard;
@@ -26,15 +25,8 @@ import java.net.URI;
 import java.net.http.HttpClient;
 import java.net.http.HttpRequest;
 import java.net.http.HttpResponse;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.LinkedHashSet;
-import java.util.Locale;
 import java.util.Map;
 import java.util.Set;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-import java.util.stream.Collectors;
 
 import static org.junit.jupiter.api.Assertions.*;
 
@@ -44,10 +36,6 @@ import static org.junit.jupiter.api.Assertions.*;
  */
 class FleetAppAuthTest {
 
-    private static final Path REST_SOURCE = Path.of("src/main/java/dev/ltms/fleet/rest/FleetApp.java");
-    private static final Pattern ROUTE_REGISTRATION =
-            Pattern.compile("app\\.(get|post|delete|put|patch)\\(\\s*\"([^\"]+)\"");
-
     private final HttpClient http = HttpClient.newHttpClient();
     private Javalin app;
     private Metrics metrics;
@@ -104,49 +92,6 @@ class FleetAppAuthTest {
         return http.send(b.build(), HttpResponse.BodyHandlers.ofString());
     }
 
-    @Test
-    void everyRegisteredRouteHasItsHandlerActionPinned() {
-        Set<String> registered = routesTheServerRegisters();
-        assertTrue(registered.size() >= 15,
-                "scraped only " + registered.size() + " route registrations from FleetApp (" + registered
-                        + "); the app.<verb>(\"…\") scrape has stopped matching");
-        // Liveness must work before credentials can be checked, so this route is deliberately open.
-        assertTrue(registered.remove("GET /healthz"), "GET /healthz must stay an explicit ungated exception");
-        registered.forEach(route -> assertDoesNotThrow(() -> FleetApp.routeAction(route),
-                () -> route + " is registered but has no pinned authorization action"));
-        assertEquals(Authz.Action.METRICS, FleetApp.routeAction("GET /metrics"));
-        assertEquals(Authz.Action.SPAWN, FleetApp.routeAction("POST /members"));
-        assertEquals(Authz.Action.STOP, FleetApp.routeAction("DELETE /members/{paneId}"));
-        assertEquals(Authz.Action.SEND, FleetApp.routeAction("POST /sessions/{id}/message"));
-        assertEquals(Authz.Action.REPLY, FleetApp.routeAction("POST /sessions/{id}/reply"));
-        assertEquals(Authz.Action.DRAIN, FleetApp.routeAction("GET /sessions/{id}/replies"));
-        assertEquals(Authz.Action.ASK, FleetApp.routeAction("POST /sessions/{id}/ask"));
-        for (String route : Set.of("GET /sessions", "GET /agents", "GET /members", "GET /profiles",
-                "GET /member-credentials", "GET /sessions/{id}/status", "GET /tasks/{ticket}")) {
-            assertEquals(Authz.Action.READ, FleetApp.routeAction(route), route);
-        }
-        assertThrows(IllegalArgumentException.class, () -> FleetApp.routeAction("GET /healthz"));
-    }
-
-    private static Set<String> routesTheServerRegisters() {
-        try {
-            String source = Files.readString(REST_SOURCE).lines()
-                    .filter(line -> {
-                        String stripped = line.stripLeading();
-                        return !(stripped.startsWith("//") || stripped.startsWith("*") || stripped.startsWith("/*"));
-                    })
-                    .collect(Collectors.joining("\n"));
-            Matcher matcher = ROUTE_REGISTRATION.matcher(source);
-            Set<String> routes = new LinkedHashSet<>();
-            while (matcher.find()) {
-                routes.add(matcher.group(1).toUpperCase(Locale.ROOT) + " " + matcher.group(2));
-            }
-            return routes;
-        } catch (Exception e) {
-            throw new AssertionError("could not scrape FleetApp route registrations", e);
-        }
-    }
-
     // --- loopback-trust: the caller is the primary -------------------------------------------
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/rest/FleetAppTest.java

@@ -19,10 +19,6 @@ import dev.ltms.fleet.session.SessionManager;
 import dev.ltms.fleet.session.Worktrees;
 import dev.ltms.fleet.member.ClaudeCodeLauncher;
 import dev.ltms.fleet.member.CompositePeerLauncher;
-import dev.ltms.fleet.member.MemberCredentialPolicyView;
-import dev.ltms.fleet.mcp.FleetMcp;
-import dev.ltms.fleet.placement.BackendOutagePolicy;
-import dev.ltms.fleet.placement.BackendQuarantine;
 import dev.ltms.fleet.placement.PlacementPolicies;
 import io.javalin.Javalin;
 import org.junit.jupiter.api.AfterEach;
@@ -36,7 +32,6 @@ import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.UUID;
-import java.util.concurrent.TimeUnit;
 import java.util.function.Predicate;
 
 import static org.junit.jupiter.api.Assertions.*;
@@ -75,19 +70,6 @@ class FleetAppTest {
 
     private int start(FakeHerdr herdr, String workerBaseUrl, Set<String> allow, String placement,
                       Worktrees worktrees, Predicate<String> deliverable) {
-        return start(herdr, workerBaseUrl, allow, placement, worktrees, deliverable,
-                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none());
-    }
-
-    /**
-     * fleetd #297: same wiring as above, plus the two SAME shared sources {@code GET /profiles}
-     * must read — lets a test prove the quarantined/coolingOff facts it reports come from a real
-     * {@link dev.ltms.fleet.placement.BackendQuarantine}/{@link
-     * dev.ltms.fleet.placement.BackendOutagePolicy}, exactly like {@code fleet_profiles}'s own tests.
-     */
-    private int start(FakeHerdr herdr, String workerBaseUrl, Set<String> allow, String placement,
-                      Worktrees worktrees, Predicate<String> deliverable,
-                      FleetMcp.QuarantineSource quarantine, FleetMcp.OutageSource outage) {
         FleetConfig.Profile wcfg = new FleetConfig.Profile(
                 "ltms-local", workerBaseUrl, "coder", null, "FLEETD_WORKER_TOKEN", null,
                 placement, "fleet", "worker: {profile} #{n}", null, null, null);
@@ -108,9 +90,8 @@ class FleetAppTest {
         // it directly so the inbox contract holds for those endpoints.
         inbox.own("term_a");
         MessageService messages = new MessageService(agents, injector, rendezvous, inbox);
-        app = new FleetApp(herdr, herdr, workers, sessions, messages, this.presence, null,
-                null, null, id -> this.presence.isPresent(id) || deliverable.test(id),
-                MemberCredentialPolicyView::absent, quarantine, outage)
+        app = new FleetApp(herdr, workers, sessions, messages, this.presence, null,
+                null, null, id -> this.presence.isPresent(id) || deliverable.test(id))
                 .build().start("127.0.0.1", 0);
         return app.port();
     }
@@ -183,22 +164,6 @@ class FleetAppTest {
         assertEquals("idle", agents.get(0).get("status").asText());
     }
 
-    /**
-     * fleetd #297 gap 1: {@code workers.list()} reaches herdr, and a transport failure there must
-     * land in the same {@code {error, detail}} envelope every other failure path in this file uses
-     * (see {@code herdrError}), not escape as a bare exception outside the JSON contract.
-     */
-    @Test
-    void agentsMapsAHerdrFailureToTheJsonErrorEnvelope() throws Exception {
-        FakeHerdr down = new FakeHerdr().healthy(false);
-        int port = start(down, "http://gx00.gw:8000", Set.of("gx00.gw"));
-        HttpResponse<String> res = req(port, "GET", "/agents");
-        assertEquals(502, res.statusCode(), res.body());
-        JsonNode body = mapper.readTree(res.body());
-        assertEquals("herdr_error", body.get("error").asText());
-        assertTrue(body.has("detail"), res.body());
-    }
-
     @Test
     void spawnWorkerLandsInOwnTabInWorkerSpaceAndInjectsBaseUrl() throws Exception {
         FakeHerdr herdr = new FakeHerdr();
@@ -238,42 +203,6 @@ class FleetAppTest {
         JsonNode body = mapper.readTree(req(port, "GET", "/profiles").body());
         assertEquals("ltms-local", body.get("default").asText());
         assertEquals("ltms-local", body.get("profiles").get(0).asText());
-        assertFalse(body.has("quarantined"), "nothing is quarantined, so the key is omitted: " + body);
-        assertFalse(body.has("coolingOff"), "nothing is cooling off, so the key is omitted: " + body);
-    }
-
-    /**
-     * fleetd #297 gap 2: {@code GET /profiles} must report the same two outage states {@code
-     * fleet_profiles} does — CB-578 stage B exhaustion quarantine and fleetd #201 Unit 5 cool-off —
-     * reading the SAME shared {@link BackendQuarantine}/{@link BackendOutagePolicy} instances rather
-     * than recomputing them. The two checks are independent, and this profile is deliberately put in
-     * both states at once, matching {@code FleetMcpTest}'s own coverage of that overlap.
-     */
-    @Test
-    void profilesReportsQuarantineAndCoolingOffFromTheSameSharedSources() throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
-        quarantine.quarantine("shared-openai");
-        FleetMcp.QuarantineSource quarantineSource = new FleetMcp.QuarantineSource(
-                profile -> "ltms-local".equals(profile) ? "shared-openai" : null, quarantine);
-        BackendOutagePolicy outagePolicy = new BackendOutagePolicy(() -> 0L);
-        outagePolicy.record("shared-openai", "t1", "API Error: rate limited");
-        outagePolicy.record("shared-openai", "t2", "API Error: rate limited"); // 2nd distinct target starts the incident
-        FleetMcp.OutageSource outageSource = new FleetMcp.OutageSource(
-                profile -> "ltms-local".equals(profile) ? "shared-openai" : null, outagePolicy);
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"), "tab", new GitWorktrees(),
-                ignored -> false, quarantineSource, outageSource);
-
-        JsonNode body = mapper.readTree(req(port, "GET", "/profiles").body());
-        assertTrue(body.has("quarantined"), body.toString());
-        assertEquals("shared-openai",
-                body.get("quarantined").get("ltms-local").get("credentialId").asText());
-        assertEquals(1800,
-                body.get("quarantined").get("ltms-local").get("quarantinedForSeconds").asLong());
-        assertTrue(body.has("coolingOff"), body.toString());
-        assertEquals("shared-openai",
-                body.get("coolingOff").get("ltms-local").get("credentialId").asText());
-        assertEquals(60, body.get("coolingOff").get("ltms-local").get("coolingOffForSeconds").asLong());
     }
 
     @Test
@@ -310,23 +239,6 @@ class FleetAppTest {
                 "liveStatus is unknown when herdr has no matching pane");
     }
 
-    /**
-     * fleetd #297 gap 1: same reasoning as {@code agentsMapsAHerdrFailureToTheJsonErrorEnvelope} —
-     * {@code GET /members} is the endpoint's own comment names as "the out-of-band path a lead falls
-     * back to when its MCP mount drops", so it must stay inside the {@code {error, detail}} envelope
-     * exactly when herdr is briefly unreachable.
-     */
-    @Test
-    void membersMapsAHerdrFailureToTheJsonErrorEnvelope() throws Exception {
-        FakeHerdr down = new FakeHerdr().healthy(false);
-        int port = start(down, "http://gx00.gw:8000", Set.of("gx00.gw"));
-        HttpResponse<String> res = req(port, "GET", "/members");
-        assertEquals(502, res.statusCode(), res.body());
-        JsonNode body = mapper.readTree(res.body());
-        assertEquals("herdr_error", body.get("error").asText());
-        assertTrue(body.has("detail"), res.body());
-    }
-
     @Test
     void spawnWithACwdParamRootsTheWorkerThere() throws Exception {
         FakeHerdr herdr = new FakeHerdr();
@@ -415,11 +327,7 @@ class FleetAppTest {
         FakeHerdr herdr = new FakeHerdr().agentNameTakenTimes(99);
         int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
 
-        // fleetd #304: 502, not Javalin's default 500 — the herdr failure is named, and the body
-        // carries herdr's own message, matching what fleet_spawn reports for the same failure.
-        HttpResponse<String> res = req(port, "POST", "/members");
-        assertEquals(502, res.statusCode());
-        assertEquals("herdr_error", mapper.readTree(res.body()).get("error").asText());
+        assertEquals(500, req(port, "POST", "/members").statusCode());
         assertTrue(herdr.called("tab.create"), "a tab was created before the failed start");
         assertEquals("w9:t2", params(herdr, "tab.close").get("tab_id"), "orphaned tab must be closed");
     }
@@ -536,53 +444,6 @@ class FleetAppTest {
         assertEquals("orphan", body.get("replies").get(0).get("content").asText());
     }
 
-    @Test
-    void replyWithMissingContentIsRejectedAndDoesNotResolveTheWaiter() throws Exception {
-        // fleetd #302: `.path("content").asText("")` used to turn a missing "content" key into an
-        // empty string that reached rendezvous.resolve, silently completing the lead's blocking wait
-        // with nothing. Prove the fix two ways: the bad call is rejected with 400, AND the real send
-        // it would have wrongly resolved is still open afterwards — a real reply completes it.
-        FakeHerdr herdr = new FakeHerdr().agentStatus("idle");
-        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-
-        var send = java.util.concurrent.CompletableFuture.supplyAsync(() -> {
-            try { return postMessage(port, "{\"content\":\"review this\",\"timeoutMs\":4000}"); }
-            catch (Exception e) { throw new RuntimeException(e); }
-        });
-
-        Thread.sleep(200); // let the background send open its rendezvous waiter
-
-        HttpResponse<String> badReply = postJson(port, "/sessions/term_a/reply", "{}");
-        assertEquals(400, badReply.statusCode());
-        JsonNode err = mapper.readTree(badReply.body());
-        assertEquals("bad_request", err.get("error").asText());
-        assertTrue(err.has("detail"));
-
-        // The waiter must still be open — a real reply now completes the ORIGINAL send.
-        HttpResponse<String> goodReply = postJson(port, "/sessions/term_a/reply", "{\"content\":\"LGTM ship it\"}");
-        assertEquals(200, goodReply.statusCode());
-
-        HttpResponse<String> res = send.get(6, java.util.concurrent.TimeUnit.SECONDS);
-        assertEquals(200, res.statusCode());
-        assertEquals("LGTM ship it", mapper.readTree(res.body()).get("reply").asText());
-    }
-
-    @Test
-    void replyWithEmptyOrWhitespaceContentIsRejectedSameAsMissing() throws Exception {
-        // fleetd #302 sibling case: present-but-blank content is treated the same as a missing key —
-        // FleetMcp's own required-content guard (fleet_reply's "content is required") makes no
-        // distinction between the two either, so diverging here would be a new asymmetry.
-        int port = startHealthy();
-
-        HttpResponse<String> empty = postJson(port, "/sessions/term_a/reply", "{\"content\":\"\"}");
-        assertEquals(400, empty.statusCode());
-        assertEquals("bad_request", mapper.readTree(empty.body()).get("error").asText());
-
-        HttpResponse<String> whitespace = postJson(port, "/sessions/term_a/reply", "{\"content\":\"   \"}");
-        assertEquals(400, whitespace.statusCode());
-        assertEquals("bad_request", mapper.readTree(whitespace.body()).get("error").asText());
-    }
-
     @Test
     void drainRepliesReturnsEmptyForNoReplies() throws Exception {
         int port = startHealthy();
@@ -737,12 +598,7 @@ class FleetAppTest {
         int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
 
         // A genuine teardown failure must surface, not be reported as a successful 204.
-        // fleetd #304: it surfaces as a named 502 rather than Javalin's default 500. The property
-        // this test guards is "not 204" and the herdr detail reaching the caller — a bare 500 gave
-        // the body "Server Error" and said nothing about herdr.
-        HttpResponse<String> res = req(port, "DELETE", "/members/w9:pW");
-        assertEquals(502, res.statusCode());
-        assertEquals("herdr_error", mapper.readTree(res.body()).get("error").asText());
+        assertEquals(500, req(port, "DELETE", "/members/w9:pW").statusCode());
         assertFalse(herdr.called("tab.close"), "tab is not removed when the pane close failed");
     }
 
@@ -755,5 +611,4 @@ class FleetAppTest {
         assertEquals(204, req(port, "DELETE", "/members/w9:pW").statusCode());
         assertTrue(herdr.called("tab.close"));
     }
-
 }

fleetd/src/test/java/dev/ltms/fleet/session/FakeWorktrees.java

@@ -17,9 +17,6 @@ public final class FakeWorktrees implements Worktrees {
     public record RemoveCall(String repoRoot, String worktreePath) {
     }
 
-    public record DeleteBranchCall(String repoRoot, String branch) {
-    }
-
     public record OverlayCall(String repoRoot, String worktreePath,
                                List<String> requested, List<String> copied, List<String> skipWorktree) {
     }
@@ -38,7 +35,6 @@ public final class FakeWorktrees implements Worktrees {
 
     private final List<AddCall> addCalls = new CopyOnWriteArrayList<>();
     private final List<RemoveCall> removeCalls = new CopyOnWriteArrayList<>();
-    private final List<DeleteBranchCall> deleteBranchCalls = new CopyOnWriteArrayList<>();
     private final List<OverlayCall> overlayCalls = new CopyOnWriteArrayList<>();
     private final List<RepoRootCall> repoRootCalls = new CopyOnWriteArrayList<>();
     private final List<SnapshotCall> snapshotCalls = new CopyOnWriteArrayList<>();
@@ -55,8 +51,6 @@ public final class FakeWorktrees implements Worktrees {
     private final AtomicLong snapshotSeq = new AtomicLong();
     private volatile RuntimeException addFailure;
     private volatile RuntimeException snapshotFailure;
-    private volatile RuntimeException removeFailure;
-    private volatile RuntimeException overlayFailure;
     private volatile boolean dirty = false;
     private volatile String repoRoot = "/repo";
     private volatile String prefix = "/worktrees";
@@ -104,21 +98,6 @@ public final class FakeWorktrees implements Worktrees {
         return this;
     }
 
-    /** Make subsequent {@link #remove} calls throw (fleetd #283: a stale index lock, a slow
-     *  filesystem, or {@code remove}'s own 30s exec timeout escaping the last, previously bare,
-     *  step of {@link SessionManager#release}). */
-    public FakeWorktrees failRemove(String message) {
-        this.removeFailure = new WorktreeException(message);
-        return this;
-    }
-
-    /** Make subsequent {@link #overlayParity} calls throw (simulates a post-{@code add()} spawn
-     *  failure — fleetd #283 defect 2 — so the {@code acquireWithWorktree} catch runs). */
-    public FakeWorktrees failOverlay(String message) {
-        this.overlayFailure = new WorktreeException(message);
-        return this;
-    }
-
     /** Configure the value returned by {@link #wipRefs}. */
     public FakeWorktrees withWipRefs(WipRefStats stats) {
         this.wipRefs = stats;
@@ -153,14 +132,6 @@ public final class FakeWorktrees implements Worktrees {
     @Override
     public void remove(String repoRoot, String worktreePath) {
         removeCalls.add(new RemoveCall(repoRoot, worktreePath));
-        if (removeFailure != null) {
-            throw removeFailure;
-        }
-    }
-
-    @Override
-    public void deleteBranch(String repoRoot, String branch) {
-        deleteBranchCalls.add(new DeleteBranchCall(repoRoot, branch));
     }
 
     @Override
@@ -175,9 +146,6 @@ public final class FakeWorktrees implements Worktrees {
 
     @Override
     public void overlayParity(String repoRoot, String worktreePath, List<String> overlay) {
-        if (overlayFailure != null) {
-            throw overlayFailure;
-        }
         List<String> copied = new java.util.ArrayList<>();
         List<String> skipped = new java.util.ArrayList<>();
         for (String rel : overlay) {
@@ -250,14 +218,6 @@ public final class FakeWorktrees implements Worktrees {
         return removeCalls.isEmpty() ? null : removeCalls.getLast();
     }
 
-    public List<DeleteBranchCall> deleteBranchCalls() {
-        return List.copyOf(deleteBranchCalls);
-    }
-
-    public DeleteBranchCall lastDeleteBranch() {
-        return deleteBranchCalls.isEmpty() ? null : deleteBranchCalls.getLast();
-    }
-
     public OverlayCall lastOverlay() {
         return overlayCalls.isEmpty() ? null : overlayCalls.getLast();
     }

fleetd/src/test/java/dev/ltms/fleet/session/GitWorktreesTest.java

@@ -403,52 +403,6 @@ class GitWorktreesTest {
         assertTrue(heads.isBlank(), "the branch leaked after a post-creation step threw:\n" + heads);
     }
 
-    /**
-     * fleetd #309. The add runner is a narrow seam for the case where Git has created state but
-     * the caller then kills the process. The runner first performs the real add in this throwaway
-     * repo, then throws the same kind of exception that {@link GitWorktrees#exec} uses for a timeout.
-     * This proves the failure path cleans both real Git objects without waiting for a slow checkout.
-     */
-    @Test
-    void addCleansUpWhenTheWorktreeAddRunnerFailsAfterCreatingState(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        String branch = "cb-309-timeout";
-        WorktreeException timeout = new WorktreeException("command timed out: synthetic git worktree add");
-        AtomicReference<String> createdPath = new AtomicReference<>();
-        GitWorktrees worktrees = new GitWorktrees(tmp.resolve("wts").toString(), null, null, null, command -> {
-            createdPath.set(command[5]);
-            try {
-                git(repo, "worktree", "add", command[5], "-b", command[7], command[8]);
-            } catch (Exception e) {
-                throw new AssertionError("test setup could not create the worktree", e);
-            }
-            throw timeout;
-        });
-
-        WorktreeException thrown = assertThrows(WorktreeException.class,
-                () -> worktrees.add(repo.toString(), branch, "HEAD"));
-
-        assertSame(timeout, thrown, "cleanup must not replace the add failure");
-        assertNotNull(createdPath.get(), "the add runner must receive the worktree path");
-        assertFalse(Files.exists(Path.of(createdPath.get())),
-                "the worktree directory leaked after the add runner failed");
-        assertFalse(refExists(repo, "refs/heads/" + branch), "the branch leaked after the add runner failed");
-    }
-
-    /** An ordinary Git refusal must not delete the existing branch or log a cleanup warning. */
-    @Test
-    void addFailureBeforeCreatingAWorktreeIsQuiet(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        String branch = "already-exists";
-        git(repo, "branch", branch);
-
-        assertThrows(WorktreeException.class, () -> new GitWorktrees(tmp.resolve("wts").toString())
-                .add(repo.toString(), branch, "HEAD"));
-
-        assertTrue(refExists(repo, "refs/heads/" + branch), "the existing branch must remain");
-        assertTrue(capturedMessages().isEmpty(), "an ordinary Git refusal logged a warning: " + capturedMessages());
-    }
-
     // ---- CB-189: broader remote-URL coverage — every remote, both fetch and push URLs, any
     // non-SSH scheme. Reporting only, additive to the origin/https strip-and-refuse tests above. ----
 

fleetd/src/test/java/dev/ltms/fleet/session/SessionManagerTest.java

@@ -26,12 +26,7 @@ import org.slf4j.LoggerFactory;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.Future;
 import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicInteger;
 import java.util.function.LongSupplier;
 
 import static org.junit.jupiter.api.Assertions.*;
@@ -79,7 +74,6 @@ class SessionManagerTest {
      */
     private static final class RecordingWorktrees implements Worktrees {
         private final List<String> removeCalls = new java.util.ArrayList<>();
-        private final List<String> deleteBranchCalls = new java.util.ArrayList<>();
         private final List<String> snapshotCalls = new java.util.ArrayList<>();
         private final java.util.Set<String> failRemoveFor = new java.util.HashSet<>();
         private volatile boolean dirty = false;
@@ -120,11 +114,6 @@ class SessionManagerTest {
             removeCalls.add(worktreePath);
         }
 
-        @Override
-        public void deleteBranch(String repoRoot, String branch) {
-            deleteBranchCalls.add(branch);
-        }
-
         @Override
         public boolean hasUncommitted(String worktreePath) {
             if (hasUncommittedFailure != null) {
@@ -169,10 +158,6 @@ class SessionManagerTest {
             return List.copyOf(removeCalls);
         }
 
-        List<String> deleteBranchCalls() {
-            return List.copyOf(deleteBranchCalls);
-        }
-
         List<String> snapshotCalls() {
             return List.copyOf(snapshotCalls);
         }
@@ -183,19 +168,14 @@ class SessionManagerTest {
     }
 
     private SessionManager sessionManager(FakeHerdr herdr, LongSupplier clock, int contextCap,
-                                           boolean clearAfterTurn) {
-        return sessionManager(herdr, clock, contextCap, clearAfterTurn, null);
-    }
-
-    private SessionManager sessionManager(FakeHerdr herdr, LongSupplier clock, int contextCap,
-                                           boolean clearAfterTurn, java.util.function.Consumer<MemberSession> hook) {
+                                          boolean clearAfterTurn) {
         FleetConfig.Profile cfg = new FleetConfig.Profile(
                 "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
                 List.of("ccs", "ltms-local"), "tab", "fleetd-workers",
                 "worker: {profile} #{n}", null, null, null);
         ClaudeCodeLauncher workers = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
                 new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-        return new SessionManager(workers, new GitWorktrees(), clock, contextCap, clearAfterTurn, hook);
+        return new SessionManager(workers, new GitWorktrees(), clock, contextCap, clearAfterTurn);
     }
 
     @Test
@@ -680,24 +660,6 @@ class SessionManagerTest {
                 "BUSY session remains");
     }
 
-    @Test
-    void reapIdleDoesNotReleaseSessionDeliveredAfterItsEligibilityCheck() {
-        long[] clock = {0};
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager[] manager = new SessionManager[1];
-        SessionManager sessions = sessionManager(herdr, () -> clock[0], 0, false,
-                session -> manager[0].onDelivered(session.terminalId(), TestTurnTokens.inert(session.terminalId())));
-        manager[0] = sessions;
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        sessions.asPresence().markPresent(session.terminalId());
-
-        clock[0] = 11;
-        assertEquals(0, sessions.reapIdle(10), "delivery replaces the idle snapshot before release");
-        assertEquals(MemberSession.State.BUSY, sessions.get(session.paneId()).orElseThrow().state(),
-                "a just-delivered session stays registered and busy");
-        assertFalse(herdr.called("pane.close"), "the busy session pane is not stopped");
-    }
-
     @Test
     void doneSessionPastIdleTtlIsReaped() {
         long[] clock = {0};
@@ -852,186 +814,6 @@ class SessionManagerTest {
                 .count();
     }
 
-    // --- fleetd #308: a spawn accepted while the shutdown drain is running must not orphan ---
-
-    @Test
-    void acquireRefusesANewSpawnOnceDrainAllHasStarted() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-
-        sessions.drainAll(TimeUnit.MILLISECONDS.toNanos(50)); // empty roster — returns immediately,
-        // but the shutdown guard it flips must stay tripped for the life of the process.
-
-        ShuttingDownException e = assertThrows(ShuttingDownException.class,
-                () -> sessions.acquire("ltms-local", null, "/caller", "term_primary"),
-                "a spawn requested after the drain has begun must be refused loudly (invariant 3), "
-                        + "not silently registered into a registry the drain will never revisit");
-        assertNotNull(e.getMessage());
-        assertFalse(e.getMessage().isBlank(), "the refusal must say why, not just that it failed");
-        assertTrue(sessions.roster().isEmpty(), "the refused spawn must never reach the registry");
-    }
-
-    /**
-     * fleetd #308: the guard above closes most of the shutdown-race window, but it cannot close
-     * all of it — a caller that already passed the {@code draining} check before {@code drainAll}
-     * flips it can still be mid-{@code launcher.spawn()} (a real herdr round trip, not
-     * instantaneous) when {@code drainAll} takes its registry snapshot. This test forces exactly
-     * that interleaving with a launcher double that blocks the second {@code spawn()} call and the
-     * first {@code stop()} call until released, then proves the post-loop sweep in {@code
-     * drainAll} still finds and tears down the straggler that lands in the registry afterward.
-     */
-    @Test
-    void drainAllSweepsAStragglerThatRegisteredAfterTheInitialSnapshot() throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        FleetConfig.Profile cfg = new FleetConfig.Profile(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
-                List.of("ccs", "ltms-local"), "tab", "fleetd-workers",
-                "worker: {profile} #{n}", null, null, null);
-        ClaudeCodeLauncher delegate = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-        RaceLauncher race = new RaceLauncher(delegate);
-        SessionManager sessions = new SessionManager(race);
-
-        // Registered normally, before the drain starts — the first spawn call, never blocked.
-        MemberSession ready = sessions.acquire("ltms-local", "/ready", "/caller", "ownerR");
-
-        ExecutorService exec = Executors.newFixedThreadPool(2);
-        try {
-            // The straggler's acquire() reads `draining == false` (checked before this call ever
-            // touches the launcher) and then blocks inside its own spawn() — the second spawn call.
-            Future<MemberSession> straggler = exec.submit(() ->
-                    sessions.acquire("ltms-local", "/late", "/caller", "ownerLate"));
-
-            assertTrue(race.enteredSecondSpawn.await(5, TimeUnit.SECONDS),
-                    "the straggler must have passed the shutdown guard and reached spawn() before "
-                            + "drainAll ever runs");
-            assertEquals(1, sessions.roster().size(),
-                    "the straggler is still inside spawn() — not registered yet");
-
-            // drainAll flips `draining`, snapshots the registry (only `ready` is in it), and starts
-            // releasing that snapshot — its first release() call stops `ready`'s pane, which this
-            // launcher double blocks on so the interleaving below is deterministic, not a timing bet.
-            Future<?> drain = exec.submit(() -> sessions.drainAll(TimeUnit.SECONDS.toNanos(5)));
-
-            assertTrue(race.enteredFirstStop.await(5, TimeUnit.SECONDS),
-                    "drainAll must be stopping the ready session's pane — proof its initial "
-                            + "registry snapshot has already been taken");
-
-            // Only now does the straggler's spawn complete and register — strictly after the
-            // snapshot drainAll's main pass is working from.
-            race.releaseSecondSpawn.countDown();
-            MemberSession registered = straggler.get(5, TimeUnit.SECONDS);
-
-            // Let drainAll finish releasing `ready`; it then re-checks the registry and must find
-            // (and drain) the straggler that just landed in it.
-            race.releaseFirstStop.countDown();
-            drain.get(5, TimeUnit.SECONDS);
-
-            assertTrue(sessions.roster().isEmpty(),
-                    "the post-loop sweep must drain the straggler too, not just the initial snapshot");
-            assertNotNull(registered.paneId());
-            long paneCloseCalls = herdr.calls.stream().filter(c -> "pane.close".equals(c.method())).count();
-            assertEquals(2, paneCloseCalls,
-                    "both ready's pane AND the straggler's pane must actually be stopped — a pane "
-                            + "left running is exactly the orphan this ticket is about");
-        } finally {
-            exec.shutdownNow();
-        }
-    }
-
-    /**
-     * Delegates every call while blocking the SECOND {@code spawn()} call and the FIRST
-     * {@code stop()} call until the test releases them — used to force the fleetd #308 race
-     * deterministically instead of betting on real thread-scheduling timing.
-     */
-    private static final class RaceLauncher implements PeerLauncher {
-        private final PeerLauncher delegate;
-        private final AtomicInteger spawnCalls = new AtomicInteger();
-        private final AtomicInteger stopCalls = new AtomicInteger();
-        final CountDownLatch enteredSecondSpawn = new CountDownLatch(1);
-        final CountDownLatch releaseSecondSpawn = new CountDownLatch(1);
-        final CountDownLatch enteredFirstStop = new CountDownLatch(1);
-        final CountDownLatch releaseFirstStop = new CountDownLatch(1);
-
-        RaceLauncher(PeerLauncher delegate) {
-            this.delegate = delegate;
-        }
-
-        private static void awaitOrFail(CountDownLatch latch) {
-            try {
-                if (!latch.await(5, TimeUnit.SECONDS)) {
-                    throw new AssertionError("RaceLauncher latch timed out");
-                }
-            } catch (InterruptedException e) {
-                Thread.currentThread().interrupt();
-                throw new AssertionError("RaceLauncher latch interrupted", e);
-            }
-        }
-
-        @Override
-        public Set<Capability> capabilities() {
-            return delegate.capabilities();
-        }
-
-        @Override
-        public Set<Capability> capabilitiesFor(String profileName) {
-            return delegate.capabilitiesFor(profileName);
-        }
-
-        @Override
-        public PeerHandle spawn(SpawnRequest req) {
-            if (spawnCalls.incrementAndGet() == 2) {
-                enteredSecondSpawn.countDown();
-                awaitOrFail(releaseSecondSpawn);
-            }
-            return delegate.spawn(req);
-        }
-
-        @Override
-        public Set<String> profiles() {
-            return delegate.profiles();
-        }
-
-        @Override
-        public String defaultProfile() {
-            return delegate.defaultProfile();
-        }
-
-        @Override
-        public String effectiveCwd(SpawnRequest req) {
-            return delegate.effectiveCwd(req);
-        }
-
-        @Override
-        public List<String> parityOverlay(String profileName) {
-            return delegate.parityOverlay(profileName);
-        }
-
-        @Override
-        public List<?> list() {
-            return delegate.list();
-        }
-
-        @Override
-        public int reapOrphanWorkers() {
-            return delegate.reapOrphanWorkers();
-        }
-
-        @Override
-        public void stop(String id) {
-            if (stopCalls.incrementAndGet() == 1) {
-                enteredFirstStop.countDown();
-                awaitOrFail(releaseFirstStop);
-            }
-            delegate.stop(id);
-        }
-
-        @Override
-        public boolean clearContext(String id) {
-            return delegate.clearContext(id);
-        }
-    }
-
     private static List<String> promptTexts(FakeHerdr herdr) {
         return herdr.calls.stream()
                 .filter(c -> "agent.prompt".equals(c.method()))
@@ -1207,21 +989,8 @@ class SessionManagerTest {
                         + "dirty check threw");
     }
 
-    /**
-     * fleetd #283 defect 1 changed this test's own premise, so its assertions are updated along
-     * with the production fix. Before #283, the middle session's worktree-removal failure escaped
-     * {@code release()} uncaught, and this test proved {@code reapIdle}'s own per-session try/catch
-     * (CB-581) kept the rest of the pass going regardless. Now that {@code release()} itself catches
-     * a worktree-removal failure (matching every sibling cleanup step in that method) and only logs
-     * a WARN, {@code release()} no longer throws for this reason — so all three idle sessions are
-     * released and counted, and the middle one's removal failure is now visible only as the WARN
-     * {@code release()} itself logs, not as a reap-loop catch. {@code reapIdle}'s own guard (for a
-     * failure {@code release()} still cannot swallow, e.g. from {@code launcher.stop}) is untouched
-     * by this ticket. This test no longer exercises that guard — reaching it now needs a failure
-     * that #283 does not catch inside {@code release()} itself.
-     */
     @Test
-    void reapIdleCountsAllThreeSessionsWhenOnlyItsWorktreeRemovalFails() {
+    void reapIdleSurvivesOneSessionThatFailsToRelease() {
         long[] clock = {0};
         FakeHerdr herdr = new FakeHerdr();
         RecordingWorktrees worktrees = new RecordingWorktrees();
@@ -1235,8 +1004,8 @@ class SessionManagerTest {
         sessions.asPresence().markPresent(a.terminalId());
         sessions.asPresence().markPresent(b.terminalId());
         sessions.asPresence().markPresent(c.terminalId());
-        // The middle session's worktree removal fails — fleetd #283 makes release() catch and log
-        // this itself, so it no longer propagates out of release() at all.
+        // The middle session's worktree removal fails — release() propagates that, so this is the
+        // one call reapIdle's per-session guard must survive without skipping the rest of the pass.
         worktrees.failRemoveFor(b.worktree());
 
         LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
@@ -1257,16 +1026,14 @@ class SessionManagerTest {
                     .map(ILoggingEvent::getFormattedMessage)
                     .filter(m -> m.contains(b.paneId()))
                     .findFirst()
-                    .orElse("no worktree-removal-failure WARN logged");
+                    .orElse("no reap-failure WARN logged");
             assertTrue(warn.contains(b.terminalId()), "the WARN names the failed session's terminal: " + warn);
             assertTrue(warn.contains(b.worktree()), "the WARN names the failed session's worktree: " + warn);
         } finally {
             sessionLog.detachAppender(appender);
         }
 
-        assertEquals(3, reaped,
-                "fleetd #283: release() no longer throws for a worktree-removal failure, so reapIdle "
-                        + "counts all three idle sessions as reaped");
+        assertEquals(2, reaped, "the middle session's failure is logged, not counted as reaped");
         assertTrue(sessions.get(a.paneId()).isEmpty(), "the first session is still released");
         assertTrue(sessions.get(c.paneId()).isEmpty(), "the third session is still released");
         assertTrue(sessions.get(b.paneId()).isEmpty(),
@@ -1277,79 +1044,6 @@ class SessionManagerTest {
         assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_3"), "the third pane is stopped");
     }
 
-    /**
-     * fleetd #290: the #283 fix above closed the one trigger this suite used for {@code
-     * reapIdle}'s own per-session try/catch (CB-581) — a worktree-removal failure is now caught
-     * and logged inside {@code release()} itself, so it never reaches {@code reapIdle}'s guard at
-     * all. This test restores coverage of that guard using the trigger the ticket names: {@code
-     * release()} calls {@code launcher.stop(paneId)} with no try/catch around it, so a failing
-     * {@code pane.close} propagates straight out of {@code release()} uncaught. {@link
-     * FakeHerdr#paneCloseFailsForPane} (added for this ticket) makes exactly the middle session's
-     * stop fail, while the other two still succeed, so this proves {@code reapIdle} keeps reaping
-     * the rest of the roster rather than aborting the whole pass.
-     */
-    @Test
-    void reapIdleSurvivesOneSessionWhoseLauncherStopFails() {
-        long[] clock = {0};
-        FakeHerdr herdr = new FakeHerdr();
-        RecordingWorktrees worktrees = new RecordingWorktrees();
-        SessionManager sessions = sessionManager(herdr, worktrees, () -> clock[0]);
-        MemberSession a = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-290a", null));
-        MemberSession b = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-290b", null));
-        MemberSession c = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-290c", null));
-        sessions.asPresence().markPresent(a.terminalId());
-        sessions.asPresence().markPresent(b.terminalId());
-        sessions.asPresence().markPresent(c.terminalId());
-        // Only the middle session's herdr pane fails to close — a and c stop normally. This is the
-        // trigger reapIdle's own guard is for, now that #283 closed the worktree-removal trigger.
-        herdr.paneCloseFailsForPane("w9:pRoot_2", "internal_error");
-
-        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
-        ch.qos.logback.classic.Logger sessionLog =
-                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(SessionManager.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.setContext(ctx);
-        appender.start();
-        sessionLog.addAppender(appender);
-        sessionLog.setLevel(Level.WARN);
-        int reaped;
-        try {
-            clock[0] = 100;
-            reaped = sessions.reapIdle(10);
-
-            String warn = appender.list.stream()
-                    .filter(e -> e.getLevel().equals(Level.WARN))
-                    .map(ILoggingEvent::getFormattedMessage)
-                    .filter(m -> m.contains("reap failed") && m.contains(b.paneId()))
-                    .findFirst()
-                    .orElse("no reap-failed WARN logged for the failing session");
-            assertTrue(warn.contains(b.terminalId()), "the WARN names the failed session's terminal: " + warn);
-        } finally {
-            sessionLog.detachAppender(appender);
-        }
-
-        assertEquals(2, reaped,
-                "the middle session's launcher.stop failure is not counted as reaped, but must not "
-                        + "abort reaping the other two");
-        assertTrue(sessions.get(a.paneId()).isEmpty(), "the first session is still released");
-        assertTrue(sessions.get(c.paneId()).isEmpty(),
-                "the third session is still reached and released — proves the pass did not abort "
-                        + "when the middle session's release() threw");
-        assertTrue(sessions.get(b.paneId()).isEmpty(),
-                "the middle session is still deregistered — release() removes it from the registry "
-                        + "before launcher.stop() runs, regardless of whether stop() then throws");
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_1"), "the first pane is stopped");
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_2"),
-                "the middle pane's stop was attempted, even though it failed");
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_3"), "the third pane is stopped");
-        assertEquals(List.of(a.worktree(), c.worktree()), worktrees.removeCalls().stream().sorted().toList(),
-                "the middle session's worktree removal never runs — release() throws before reaching "
-                        + "it — while the other two, unaffected, still have theirs removed");
-    }
-
     @Test
     void unchangedRegressionCleanCompletedReleaseStillRemovesTheWorktree() {
         FakeHerdr herdr = new FakeHerdr();
@@ -1364,41 +1058,6 @@ class SessionManagerTest {
                 "COMPLETED release of a clean worktree still removes it");
     }
 
-    /**
-     * fleetd #293: {@code HerdrPeerLauncher.stop()} used to run {@code spaces.closeTab} bare — a
-     * failing {@code tab.close} (any code other than {@code *_not_found}) propagated straight out
-     * of {@code stop()}. {@code SessionManager.release} calls {@code launcher.stop(paneId)} with
-     * no try/catch (fleetd #283 wrapped the WORKTREE-removal step further down, not this one), so
-     * the throw happened <em>before</em> that worktree-removal step ever ran — and by then {@code
-     * registry.remove(paneId)} had already run, so a second {@code stop} is a no-op: the worktree
-     * leaked with no retry path. The pane itself is already closed by the time {@code tab.close}
-     * runs, so its failure is cosmetic workspace tidying, not a real teardown failure. The fix
-     * wraps {@code closeTab} inside {@code stop()} so it no longer throws for this reason; this
-     * test proves both halves at once: {@code release()} does not throw, and it still removes the
-     * worktree.
-     */
-    @Test
-    void releaseStillRemovesTheWorktreeWhenCloseTabFails() {
-        FakeHerdr herdr = new FakeHerdr();
-        RecordingWorktrees worktrees = new RecordingWorktrees();
-        SessionManager sessions = sessionManager(herdr, worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-293a", null));
-        // FakeHerdr's pane.get always answers with tab_id "w9:t2" for a tab-placement spawn.
-        herdr.tabCloseFailsForTab("w9:t2", "internal_error");
-
-        assertDoesNotThrow(() -> sessions.release(s.paneId()),
-                "a failing tab.close is cosmetic (the pane is already closed by then) — it must not "
-                        + "propagate out of release()");
-
-        assertTrue(herdr.called("tab.close"), "tab.close was still attempted");
-        assertEquals(List.of(s.worktree()), worktrees.removeCalls(),
-                "release() must still remove the worktree even though tab.close failed — this is "
-                        + "the leak fleetd #293 reports: before the fix, release() never reached this "
-                        + "step at all");
-        assertTrue(sessions.get(s.paneId()).isEmpty(), "the session is still deregistered");
-    }
-
     @Test
     void unchangedRegressionDirtyCompletedReleaseStillPreservesTheWorktree() {
         FakeHerdr herdr = new FakeHerdr();

fleetd/src/test/java/dev/ltms/fleet/session/WorktreeSessionManagerTest.java

@@ -212,41 +212,9 @@ class WorktreeSessionManagerTest {
         assertEquals("/repo", remove.repoRoot());
         assertEquals(s.worktree(), remove.worktreePath());
         // The fake records no branch-delete calls because Worktrees.remove only removes the checkout.
-        assertTrue(worktrees.deleteBranchCalls().isEmpty(),
-                "a normal release must NEVER delete the branch — it is the worker's only recoverable "
-                        + "copy of committed work, and only the failed-provisioning path may remove it");
         assertTrue(sessions.get(paneId).isEmpty(), "released session is no longer retrievable");
     }
 
-    /**
-     * fleetd #283 defect 1. Every other cleanup step in {@code release()} is wrapped in try/catch,
-     * because {@code exec()} can throw on a non-zero exit or its own 30s timeout — this was the one
-     * step left bare. By the time it runs, the registry entry, the retained handle, and the pane are
-     * all already gone, so a throw here used to escape {@code release()} after the session was
-     * already fully torn down: a second stop on the same paneId is a no-op (nothing left to find),
-     * so there was no retry path, and the caller saw a failed stop for a session that was in fact
-     * gone. This test makes the worktree removal throw and asserts release() still completes with
-     * the pane stopped and the registry clean.
-     */
-    @Test
-    void releaseCompletesAndStopsPaneEvenWhenWorktreeRemovalThrows() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt")
-                .failRemove("stale index lock");
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-283-1", null));
-        String paneId = s.paneId();
-
-        sessions.release(paneId); // must not throw
-
-        assertTrue(herdr.called("pane.close"), "the pane is still stopped despite the removal failure");
-        assertEquals(1, worktrees.removeCalls().size(), "worktree removal was still attempted");
-        assertTrue(sessions.get(paneId).isEmpty(),
-                "the session is deregistered regardless of the removal failure");
-        assertEquals(0, sessions.size(), "the registry is left clean");
-    }
-
     /**
      * CB-576. A normal {@code COMPLETED} release whose worktree holds uncommitted work must NOT
      * remove it — {@code --force} would destroy the worker's only copy. The bridge cannot see
@@ -384,39 +352,6 @@ class WorktreeSessionManagerTest {
         assertEquals(0, sessions.size(), "failed acquire leaves no registry entry");
         assertFalse(herdr.called("agent.start"), "spawn is never reached when add fails");
         assertTrue(worktrees.removeCalls().isEmpty(), "no worktree was added, so none is removed");
-        assertTrue(worktrees.deleteBranchCalls().isEmpty(),
-                "add() itself never created the branch in git, so there is nothing to delete");
-    }
-
-    /**
-     * fleetd #283 defect 2. {@code acquireWithWorktree}'s catch covers every failure AFTER
-     * {@code worktrees.add()} returns — {@code overlayParity}, {@code shareWithGroup},
-     * {@code launcher.spawn} itself — so by the time it runs, {@code branch} was actually created in
-     * git. It removed only the worktree and forgot the branch, leaking a {@code worker/<slug>-<nonce>}
-     * branch on every routine spawn failure (a quarantined credential, a backend refusal). This test
-     * makes {@code overlayParity} (a post-add() step) throw and asserts the branch is deleted, the
-     * same way #274 already does for the sibling failure inside {@code add()} itself.
-     */
-    @Test
-    void spawnFailureAfterAddDeletesTheOrphanedBranch() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt")
-                .failOverlay("overlayParity failed");
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-
-        assertThrows(WorktreeException.class, () ->
-                sessions.acquire("ltms-local", null, "/caller/proj", null,
-                        new WorktreeRequest("cb-283-2", null)));
-
-        assertEquals(0, sessions.size(), "failed acquire leaves no registry entry");
-        assertFalse(herdr.called("agent.start"), "spawn is never reached when overlayParity fails");
-        assertEquals(1, worktrees.removeCalls().size(), "the worktree checkout is still removed");
-        assertEquals(1, worktrees.deleteBranchCalls().size(),
-                "the orphaned branch that add() actually created must also be deleted");
-        FakeWorktrees.DeleteBranchCall del = worktrees.lastDeleteBranch();
-        assertEquals("/repo", del.repoRoot());
-        FakeWorktrees.AddCall add = worktrees.lastAdd();
-        assertEquals(add.branch(), del.branch(), "the branch deleted is the exact one add() created");
     }
 
     @Test