fleetd #111 : probe reads the live memberCredentials policy, no hardcoded name list

scripts/probe-member-credentials.sh carried its own hand-maintained NAMES array (31 names, recorded 2026-08-16), so a name added later to fleetd.yaml's memberCredentials.known was never checked and the probe still exited 0 with a clean-looking table. Same drift shape as #114's tool catalogue. - New dev.ltms.fleet.member.MemberCredentialPolicyView: the single place that turns a MemberCredentials policy into names + counts (never a value). Reused by Fleetd.reportMemberCredentialsGap (startup log line) and by the new GET /member-credentials REST endpoint (FleetApp), so the two can no longer drift apart the way the probe and the policy did. - FleetApp gains one route + handler + a Supplier<MemberCredentialPolicyView> constructor param (legacy constructors default to ::absent, so existing call sites are unaffected). - probe-member-credentials.sh now fetches its name list from GET /member-credentials instead of carrying one. No local fallback: an unreachable daemon, an empty/absent policy, or a knownCount/known[] length mismatch all refuse with a non-zero exit rather than silently checking zero names. Prints "policy contains N; this run checked N" so the two numbers are visibly equal.
#248 follow-up: drive the real backendErrorSink, not a copy of it
2026-09-03 13:21:35 +07:00 · 2026-09-03 13:06:11 +07:00 · 2026-09-03 12:55:29 +07:00 · 2026-09-03 12:52:12 +07:00 · 2026-09-03 12:51:56 +07:00 · 2026-09-03 12:41:20 +07:00
15 changed files with 876 additions and 464 deletions
@@ -215,11 +215,14 @@ must obey belongs in the charter, not here.
  reads the list with `git config --worktree --get-all fleet.neutralizedConfig`, and the
  consequence with `git config --worktree --get fleet.neutralizedConfigNote`. Never brief a worker
  to edit one of these files: the edit cannot be committed, and it will not tell you so.
- **Flows and the error model** — rendezvous, `fleet_ask`, detached delivery, turn-done fallback —
-  are diagrammed in `docs/MCP-Contract.md` **§6 only**. The rest of that page is a pre-build design
-  doc whose tool names, parameter names and REST paths never caught up with the code, so do not use
-  it as the tool reference (CB-609). Section 6 is kept out of this file because this file loads into
-  every session's context.
+- **Flows and the error model** — rendezvous, `fleet_ask`, detached delivery, the turn-done
+  fallback and status gating — are diagrammed in `docs/MCP-Contract.md`. That page is now flows
+  only: its pre-build tool catalogue, parameter tables and REST paths were deleted rather than
+  corrected, because a hand-maintained second copy of the tool surface is what drifted for a month
+  while this line pointed every session at it (CB-609 / #114). **The live MCP schema is the tool
+  reference**, with the intent→tool table above as the short form. `McpContractDocTest` fails if
+  that page names a `fleet_*` tool the server does not register. The flows are kept out of this
+  file because this file loads into every session's context.

 ### Redeploying the daemon — the lead may do this (primary only)

@@ -1,311 +1,162 @@
-# MCP Contract — `fleetd`'s unified gateway
+# MCP flows and error model — `fleetd`

-> **Status: 🔴 HISTORICAL DESIGN — do NOT use as the tool reference.** Written 2026-07-14, before
-> any MCP code existed. The system shipped and this page never caught up, so **its tool names,
-> parameter names and REST paths are wrong today**. Audited 2026-08-17; the specific drift:
+> **What this page is.** The **flows**: how a delegation, a clarification, a detached task and a
+> silent member each travel through `fleetd`. These shapes are what shipped, and they are hard to
+> read off the code because they span the MCP face, the rendezvous registry, the `Injector` and
+> herdr.
 >
-> - **Tools it names that do not exist:** `fleet_read`, `fleet_cancel`.
-> - **Shipped tools it omits:** `fleet_poll`, `fleet_ack`, `fleet_profiles`, `fleet_whoami`.
-> - **Parameter names are wrong nearly everywhere** — it says `message`/`target`/`timeout_seconds`/
->   `block` where the code takes `content`/`sessionId`/`timeoutMs`/`wait`; `text` where
->   `fleet_reply` takes `content`; `target` where `fleet_stop` takes `paneId`.
-> - **REST paths are wrong:** it says `POST /workers` and `DELETE /workers/{paneId}`; the daemon
->   serves `POST /members` and `DELETE /members/{paneId}`.
+> **What this page is NOT: a tool reference.** It deliberately holds no tool catalogue, no
+> parameter tables and no REST paths. **The live MCP schema is the authority** — each tool's own
+> description and parameters, as mounted — with the intent→tool table in `CLAUDE.md` as the short
+> form.
 >
-> **The authoritative tool surface is the live MCP schema** (each tool's own description and
-> parameters, as mounted), with the intent→tool table in `CLAUDE.md` as the short form. Both were
-> checked against `mcp/FleetMcp.java` on 2026-08-17 and are accurate.
+> That absence is the fix for fleetd #114 (CB-609), and it is worth stating why. This page used to
+> carry a full tool catalogue written in July 2026, before any MCP code existed. The code shipped;
+> the page did not follow. By August it named two tools that do not exist, omitted five that do,
+> had the wrong name for nearly every parameter, pointed at REST paths the daemon does not serve,
+> and — worst — still described an identity model (*"any connection that does not map to a known
+> worker is treated as a primary"*) that was a real privilege bug, fixed since by the ancestry
+> walk in fleetd #161. Every one of those errors is the same error: **a second, hand-maintained
+> copy of something the code already states**. So the second copy is gone rather than corrected.
+> Only the flows remain, because a flow is a shape rather than a name, and shapes are what this
+> page was ever good for.
 >
-> What is still worth reading here is **§6 — the flows and the error model** (rendezvous,
-> `fleet_ask`, detached delivery, the turn-done fallback). The shapes it describes are the ones
-> that shipped; only the names around them drifted. Rewriting this page is tracked as **CB-609**.
-
-`fleetd` is the **sole communication gateway** for every Claude session in the bridge. Both
-the **primary** (Opus, on subscription) and every **worker** (off-subscription Claude Code)
-mount the *same* MCP server with a single `claude mcp add` line, and talk only through its
-tools. No Claude session ever addresses a broker, a peer, or the network directly.
-
-This document defines every MCP tool that face must expose, who may call it, its blocking
-semantics, and how it maps onto the code already in the tree.
+> The names that do appear below are checked by `McpContractDocTest`, which fails if this page
+> names a `fleet_*` tool the server does not register. That test is the whole reason it is safe to
+> write a tool name here at all.

 ---

-## 1. Design constraints (non-negotiable)
+## 1. Rendezvous flows

-These come from the project's core invariants and bound every decision below.
+### 1.1 Delegation — happy path

-1. **One server, both roles.** The primary and all workers mount an identical server. The
-   catalog must serve both, and `fleetd` must decide *who is calling* from the connection —
-   never from a caller-supplied argument that could be spoofed.
-2. **Subscription-safe by construction.** No MCP tool ever reads, sets, or forwards
-   `ANTHROPIC_BASE_URL`. Mounting the bridge cannot move a session off subscription.
-   Enforced today by [`SubscriptionGuard`](1-Architecture).
-3. **Blocking rendezvous, no busy-poll.** The primary consumes a worker's reply through a
-   *single* MCP call that `fleetd` holds open — never a cross-turn poll loop that would burn
-   subscription quota.
-4. **Status-gated delivery.** Anything that puts text into a worker flows through the existing
-   [`Injector`](1-Architecture): delivered only when the worker is `idle`/`blocked`, at most
-   one message per turn.
-5. **`fleetd` owns policy; herdr owns PTYs.** MCP tools express *intent*; `fleetd`
-   translates it into guard checks, rendezvous bookkeeping, and herdr `agent.*` calls.
-
---
-
-## 2. Topology
-
-Both faces live in the one daemon. The **north face** is MCP (this document); the **south
-face** is the herdr Unix socket. REST/SSE remains only for non-Claude clients and dashboards.
-
-```mermaid
-flowchart LR
-    OPUS["Opus — primary<br/>(Claude Code, env CLEAN)<br/>MCP client"]
-    subgraph BD["fleetd — standalone daemon"]
-        MCP["MCP server (north face)<br/>fleet_send · fleet_reply<br/>fleet_ask · fleet_status · lifecycle"]
-        RDV["rendezvous registry<br/>(blocking-call waiters)"]
-        INJ["Injector + StatusPoller<br/>(status-gated writer)"]
-        SOCK["herdr socket client (south face)"]
-        MCP --> RDV
-        RDV --> INJ
-        INJ --> SOCK
-        MCP --> SOCK
-    end
-    HERDR["herdr<br/>panes · agent-status"]
-    W["worker claude pane<br/>ANTHROPIC_BASE_URL set<br/>MCP client"]
-
-    OPUS -->|"fleet_send (blocks)"| MCP
-    W -.->|"fleet_reply / fleet_ask"| MCP
-    SOCK -->|"agent.start · agent.send<br/>agent.get · pane.close"| HERDR
-    HERDR -->|"drives PTY"| W
-
-    classDef ext fill:#2b6cb0,stroke:#1a365d,color:#ffffff;
-    classDef core fill:#2f855a,stroke:#22543d,color:#ffffff;
-    class OPUS,W ext
-    class MCP,RDV,INJ,SOCK core
-```
-
---
-
-## 3. Identity & addressing
-
-Because the same server is mounted by everyone, `fleetd` resolves the caller's role on every
-request — this is the linchpin of the whole contract and has no code yet.
-
- **Workers are known.** `fleetd` spawns every worker
-  ([`WorkerService`](1-Architecture)) and records its herdr session UUID / `terminal_id` on
-  the returned [`Agent`]. When a call arrives on a connection that maps to a known worker,
-  the caller is *that* worker — so **workers never pass a target**; routing is implicit.
- **The primary is "not a worker".** Any connection that does not map to a known worker is
-  treated as a primary. It addresses workers **explicitly** by `target` — a session UUID,
-  a `terminal_id`, or a friendly `profile` name.
- **Turn correlation.** A blocking `fleet_send` registers a *waiter* keyed by worker
-  identity. A worker's later `fleet_reply` / `fleet_ask` on the same identity resolves that
-  waiter. A `turn_id` is minted per exchange so a clarification round-trip
-  (§6.2) rejoins the right turn.
-
---
-
-## 4. Transport
-
-`fleetd` is a long-lived daemon serving **multiple** concurrent clients (one primary + N
-workers), so a per-client stdio child is the wrong shape. The recommended transport is
-**streamable-HTTP / SSE** on the same bind as the REST face:
-
-```bash
-# identical on primary and every worker
-claude mcp add --transport http fleetd http://127.0.0.1:8080/mcp
-```
-
-This adds an MCP-server dependency the pom does not yet carry. See [Open decisions](#10-open-decisions).
-
---
-
-## 5. Tool catalog
-
-| Tool | Caller | Blocks? | Backing (exists today?) |
-|---|---|---|---|
-| [`fleet_send`](#fleet_send) | primary | yes (default) | `Injector.enqueue` ✅ · rendezvous registry ❌ (CB-104) |
-| [`fleet_reply`](#fleet_reply) | worker | no | rendezvous ❌ · pane injection via `Injector` ✅ |
-| [`fleet_ask`](#fleet_ask) | worker | yes | reverse rendezvous ❌ |
-| [`fleet_status`](#fleet_status) | either | no | `AgentControl.status` ✅ · `Injector.activeTargets` ✅ |
-| [`fleet_spawn`](#lifecycle) | primary | no | `WorkerService.spawn` ✅ (`POST /workers`) |
-| [`fleet_list`](#lifecycle) | either | no | `WorkerService.list` ✅ (`/agents`) |
-| [`fleet_stop`](#lifecycle) | primary | no | `WorkerService.stop` ✅ (`DELETE /workers/{paneId}`) |
-| [`fleet_read`](#fleet_read) | primary | no | `AgentControl.read` ✅ |
-| [`fleet_cancel`](#fleet_cancel) | primary | no | — ❌ (future) |
-
-### Core: delegation & rendezvous
-
-#### `fleet_send`
-*(primary → worker — the headline tool, CB-104)*
-
- **Params:** `message` (required); `target` (optional — defaults to the sole worker / default
-  profile); `timeout_seconds` (default 600); `block` (default `true`); `auto_spawn`
-  (default `true`); `turn_id` (optional — supplied when answering a worker's `fleet_ask`).
- **Blocking (`block:true`):** enqueue `message` via the `Injector`, then hold the call open
-  until exactly one of:
-  - worker calls `fleet_reply` → `{ outcome:"reply", text }`
-  - worker calls `fleet_ask` → `{ outcome:"question", text, turn_id }`
-  - worker's `agent_status` reaches done/idle with no reply → `{ outcome:"turn_done", text:<terminal tail> }`
-  - deadline elapses → `{ outcome:"timeout" }`
-  - worker gone → error `worker_gone`
- **Detached (`block:false`):** enqueue and return `{ outcome:"dispatched", dispatch_id }`
-  immediately. The eventual reply is injected into the primary's idle pane (§6.3), or drained
-  via `fleet_status` on a split-host primary.
-
-#### `fleet_reply`
-*(worker → primary)*
-
- **Params:** `text` (required); `final` (default `true`).
- **Behavior:** resolve the primary waiter registered against this worker with `text`. If no
-  waiter exists (detached delegation), `fleetd` **injects the primary's idle pane** instead.
-  Returns `{ delivered:true, mode:"resolved"|"injected" }`. No `target` — identity is implicit.
-
-#### `fleet_ask`
-*(worker → primary — the reverse rendezvous)*
-
- **Params:** `question` (required); `timeout_seconds`.
- **Behavior:** blocks the *worker's* call. Surfaces the question to the primary (resolving its
-  open `fleet_send` with `outcome:"question"`, or injecting its pane). When the primary
-  answers — a `fleet_send` carrying the matching `turn_id` — that unblocks this call and
-  returns `{ answer }` to the worker, which continues **in the same turn**.
-
-### Worker lifecycle
-<a id="lifecycle"></a>
-Thin adapters over [`WorkerService`](1-Architecture) — parity with the existing REST routes.
-
- **`fleet_spawn`** — `{ profile? }` → worker view (`sessionId`, `terminalId`, `paneId`,
-  `status`). Guard-checked; a boundary breach returns error `subscription_boundary` (the
-  REST `403`).
- **`fleet_list`** — no params → all workers + `agent_status`. Read-only, either role.
- **`fleet_stop`** — `{ target }` → tears down the pane and its dedicated tab. Idempotent.
-
-### Observability
-
-#### `fleet_status`
-*(either role — the README's 4th named tool)*
-
- **Params:** `target?`.
- **Behavior:** per-worker `agent_status`, queue depth (`Injector.activeTargets`), whether a
-  rendezvous is open, and ids. For the *calling* session it also reports/drains **pending
-  messages addressed to me** — the path a split-host primary's `Stop`-hook uses to wake and
-  collect replies without being injectable. Read-only, non-blocking.
-
-#### `fleet_read`
-*(primary)*
-
- **Params:** `target`; `source` ∈ `visible | recent | recent_unwrapped | detection`.
- **Behavior:** returns the worker's terminal text so the primary can peek at a *detached*
-  worker's progress. Adapter over `AgentControl.read`.
-
-### Control (future)
-
-#### `fleet_cancel`
-*(primary)*
-
- **Params:** `target`. Interrupt the worker's current turn / abandon the rendezvous. No
-  backing code yet.
-
---
-
-## 6. Rendezvous flows
-
-### 6.1 Delegation — happy path
-
-One blocking call, zero polls.
+One blocking call, zero polls. The lead's call is held open by `fleetd` until the member answers.

 ```mermaid
 sequenceDiagram
-    participant P as Primary (Opus)
-    participant B as fleetd (MCP + Injector)
+    participant P as "Lead (primary)"
+    participant B as "fleetd (MCP + Injector)"
    participant H as herdr
-    participant W as Worker (Claude)
+    participant W as "Member"

-    P->>B: fleet_send("do X", target=w) — blocks
-    B->>B: register waiter(w)
-    B->>H: agent.send(w, "do X")  (idle window)
-    H-->>W: prompt injected
-    W->>W: works the turn
-    W->>B: fleet_reply("result")
-    B->>B: resolve waiter(w)
-    B-->>P: { outcome:"reply", text:"result" }
+    P->>B: "fleet_send{sessionId, content} — blocks"
+    B->>B: "register waiter(sessionId)"
+    B->>H: "agent.send — only in an injectable window"
+    H-->>W: "prompt injected"
+    W->>W: "works the turn"
+    W->>B: "fleet_reply{content}"
+    B->>B: "resolve waiter"
+    B-->>P: "{ outcome: reply }"
 ```

-### 6.2 Clarification — reverse rendezvous (`fleet_ask`)
+**The cap that matters:** a blocking `fleet_send` is bounded by the *caller's own* MCP client
+timeout, about 60 seconds — not by the task. Anything slower than that must use the detached flow
+in §1.3, or the lead's call returns while the member is still working.

-The worker pauses mid-turn to ask; the primary answers; the worker resumes in the same turn.
+### 1.2 Clarification — reverse rendezvous
+
+The member pauses mid-turn to ask, the lead answers, and the member resumes **the same turn** with
+its context intact.

 ```mermaid
 sequenceDiagram
-    participant P as Primary
+    participant P as "Lead"
    participant B as fleetd
-    participant W as Worker
+    participant W as "Member"

-    P->>B: fleet_send("do X", target=w) — blocks
-    B-->>W: "do X" (injected)
-    W->>B: fleet_ask("which config?") — worker blocks
-    B-->>P: { outcome:"question", text:"which config?", turn_id }
-    P->>B: fleet_send("config.yaml", target=w, turn_id) — blocks again
-    B-->>W: resolve fleet_ask → { answer:"config.yaml" }
-    W->>W: resumes same turn
-    W->>B: fleet_reply("done")
-    B-->>P: { outcome:"reply", text:"done" }
+    P->>B: "fleet_send{sessionId, content} — blocks"
+    B-->>W: "content injected"
+    W->>B: "fleet_ask{question} — member blocks"
+    B-->>P: "{ outcome: question, turnId }"
+    P->>B: "fleet_send{turnId, content} — answers THIS turn"
+    B-->>W: "fleet_ask returns the answer"
+    W->>W: "resumes the same turn"
+    W->>B: "fleet_reply{content}"
+    B-->>P: "{ outcome: reply }"
 ```

-### 6.3 Detached delegation — pane injection
+**Answer with `turnId`, never `sessionId`.** A `sessionId` send starts a new turn; it does not
+resolve the waiting `fleet_ask`.

-The primary does not block; the reply arrives later in its idle pane.
+**The window is about 55 seconds and no nudge extends it.** So never brief a member to "ask me":
+decide before delegating, or give the member an explicit default to fall back on.
+
+### 1.3 Detached delegation — the lead does not block
+
+The lead gets a ticket immediately and collects the answer later. This is the flow for any real
+task, because of the ~60s cap in §1.1.

 ```mermaid
 sequenceDiagram
-    participant P as Primary
+    participant P as "Lead"
    participant B as fleetd
-    participant W as Worker
+    participant W as "Member"

-    P->>B: fleet_send("do X", target=w, block=false)
-    B-->>P: { outcome:"dispatched", dispatch_id }
-    P->>P: continues its own work
-    W->>B: fleet_reply("result")
-    Note over B: no waiter → detached path
-    B->>B: Injector.enqueue(primary_pane, "result")
-    B-->>P: injected into idle pane (status-gated)
+    P->>B: "fleet_send{sessionId, content, wait:false}"
+    B-->>P: "accepted — ticket"
+    P->>P: "continues its own work"
+    W->>B: "fleet_reply{content}"
+    Note over B: "no waiter is blocked — the reply is held"
+    B->>B: "nudge the lead's own pane (status-gated)"
+    P->>B: "fleet_poll{ticket}"
+    B-->>P: "the member's report"
+    P->>B: "fleet_ack{target, msgId}"
 ```

-### 6.4 Uncooperative worker — turn-done fallback
+A terminal ticket nudges the lead's pane by itself, so a detached task does not need watching. The
+nudge needs an injectable lead pane and is capped, so it is a convenience rather than a guarantee.

-A worker that never calls `fleet_reply` still returns a result: `fleetd` reads its terminal
-tail when the turn completes.
+### 1.4 The member never replies — turn-done fallback
+
+A member that ends its turn without `fleet_reply` still produces something: `fleetd` reads its
+pane tail. This is a **fallback, not a channel** — it is lossy in three separate ways, and every
+one of them has produced a wrong answer in practice.

 ```mermaid
 sequenceDiagram
-    participant P as Primary
+    participant P as "Lead"
    participant B as fleetd
-    participant W as Worker
+    participant W as "Member"

-    P->>B: fleet_send("do X", target=w) — blocks
-    B-->>W: "do X" (injected)
-    W->>W: works, never calls fleet_reply
-    B->>B: StatusPoller sees agent_status → idle/done
-    B->>B: AgentControl.read(w, "recent")
-    B-->>P: { outcome:"turn_done", text:<terminal tail> }
+    P->>B: "fleet_send — blocks or detaches"
+    B-->>W: "content injected"
+    W->>W: "works, never calls fleet_reply"
+    B->>B: "StatusPoller sees the turn end"
+    B->>B: "read the pane tail"
+    B->>B: "classify: exhausted? echoed brief? real report?"
+    B-->>P: "{ outcome: turn_done } or a named failure"
 ```

+The three ways it goes wrong, and what each looks like now:
+
+| What happened | What the lead used to get | What it gets today |
+|---|---|---|
+| The report is longer than the scrape window | The **end** silently cut off | Still clipped, but marked partial |
+| The member never started — spent credential | The lead's **own brief** echoed back as a report | A named failure: backend exhausted |
+| The member is simply slow | A tail of work in progress | Unchanged — read it as a hint, not a result |
+
+The echoed-brief case is the one to remember: it reads as a long, on-topic report with nothing in
+it from the member. It is suppressed now, but the general rule stands — **check the member's
+worktree with `git log` before believing a report you did not watch arrive.**
+
 ---

-## 7. Status gating
+## 2. Status gating

-Delivery only happens in a safe window. This is the state machine the `Injector` already
-enforces via `AgentStatus.injectable()`; MCP `fleet_send` is simply its producer.
+Delivery only happens in a safe window. `fleet_send` is a producer for the `Injector`, which
+already enforces this through `AgentStatus.injectable()`.

 ```mermaid
 stateDiagram-v2
    [*] --> IDLE
-    IDLE --> WORKING: message delivered / picks up
-    WORKING --> IDLE: turn done
-    WORKING --> BLOCKED: awaits input
-    BLOCKED --> WORKING: input delivered
-    IDLE --> UNKNOWN: detection glitch
-    BLOCKED --> UNKNOWN: detection glitch
-    UNKNOWN --> IDLE: re-detected
+    IDLE --> WORKING: "message delivered, picked up"
+    WORKING --> IDLE: "turn done"
+    WORKING --> BLOCKED: "awaits input"
+    BLOCKED --> WORKING: "input delivered"
+    IDLE --> UNKNOWN: "detection glitch"
+    BLOCKED --> UNKNOWN: "detection glitch"
+    UNKNOWN --> IDLE: "re-detected"

    note right of IDLE
        injectable — deliver head of FIFO
@@ -321,69 +172,17 @@ stateDiagram-v2
    end note
 ```

-At most one message is delivered per turn: after a send the `Injector` waits for a `WORKING`
-pickup before delivering the next, with a `PICKUP_GRACE_POLLS` fallback for turns faster than
-the poll interval. A herdr `events.subscribe` stream can later replace the sampling without
-touching this state machine.
+**At most one message per turn.** After a send, the `Injector` waits for a `WORKING` pickup before
+delivering the next, with a grace-poll fallback for turns that finish faster than the poll
+interval.

---
+Two consequences a lead feels directly:

-## 8. Error model
+- **A second send to a busy member never lands.** It reports as queued and times out. The member
+  is fine; the message simply waits, and then restarts the member when it next goes idle.
+- **A spawned member is not deliverable until it has mounted the MCP.** Until then a send waits on
+  that gate for about 60 seconds and then fails without ever reaching the pane.

-| Condition | `fleet_send` result | Notes |
-|---|---|---|
-| Worker replies | `{ outcome:"reply" }` | normal |
-| Worker asks | `{ outcome:"question", turn_id }` | answer with `fleet_send(turn_id)` |
-| Turn ends, no reply | `{ outcome:"turn_done" }` | terminal tail as text |
-| Deadline elapsed | `{ outcome:"timeout" }` | message may still be queued/delivered |
-| Worker vanished | error `worker_gone` | `Injector.drop` fails the queued future |
-| Guard breach on spawn | error `subscription_boundary` | REST `403` parity |
-| Delivery failed at herdr | error, message dropped | poisoned message not left blocking the FIFO |
-
-`fleet_reply` from a worker with no open waiter is **not** an error — it falls through to
-detached pane injection (§6.3).
-
---
-
-## 9. Mapping to existing code
-
-The MCP face is a thin adapter layer; nearly every capability already exists behind the REST
-seam. Only the **rendezvous registry** and the **caller-identity resolver** are new.
-
-| MCP tool | Existing collaborator | New work |
-|---|---|---|
-| `fleet_send` | `Injector.enqueue`, `AgentControl.send` | waiter registry, timeout, outcome mux (CB-104) |
-| `fleet_reply` / `fleet_ask` | `Injector` (pane injection) | reverse rendezvous, identity resolver |
-| `fleet_status` | `AgentControl.status`, `Injector.activeTargets` | pending-drain projection |
-| `fleet_spawn` / `list` / `stop` | `WorkerService.{spawn,list,stop}` | MCP adapter only |
-| `fleet_read` | `AgentControl.read` | MCP adapter only |
-
-Because the REST routes in `FleetApp` already exercise the collaborators, MCP tools are
-validated by **parity** against those routes, not by re-testing behavior.
-
---
-
-## 10. Open decisions
-
-1. **`fleet_ask` direction.** This page defines it as *worker-asks-primary* (a genuine reverse
-   channel, matching the "inject the primary's pane" language). The alternative — a synonym for
-   a blocking primary→worker send — is weaker and produces different plumbing. **Recommend
-   worker-asks-primary.**
-2. **Detached delivery shape.** A `block:false` param on `fleet_send` (keeps the catalog
-   small) vs. a separate `fleet_dispatch` tool. **Recommend the param.**
-3. **Auto-spawn on send.** `fleet_send` provisions a worker per profile when none exists
-   (simplest primary UX) vs. requiring an explicit `fleet_spawn` first. **Recommend
-   auto-spawn, defaulting on.**
-4. **Transport & SDK.** Streamable-HTTP/SSE co-located with the REST bind (recommended) vs.
-   stdio. Requires choosing a Java MCP server SDK and adding it to the pom.
-
---
-
-## 11. Implementation staging
-
- **CB-104** — blocking `fleet_send` + rendezvous registry + caller-identity resolver
-  (the producer that finally drives the inert `StatusPoller`).
- **CB-1xx** — `fleet_reply` / `fleet_ask` reverse rendezvous + detached pane injection.
- **CB-1xx** — lifecycle + observability adapters (`fleet_spawn/list/stop/status/read`).
- **CB-1xx** — transport wiring + `claude mcp add` docs; parity tests vs. REST.
- **Later** — `fleet_cancel`; swap `StatusPoller` for herdr `events.subscribe`.
+`UNKNOWN` is deliberately neither injectable nor a pickup. A pane whose status cannot be read is
+not a pane that is safe to write to — see fleetd #176 for what happens when a gate treats an
+unreadable pane as a ready one.
@@ -51,6 +51,7 @@ import dev.ltms.fleet.session.SessionReaper;
 import dev.ltms.fleet.member.ClaudeCodeLauncher;
 import dev.ltms.fleet.member.CompositePeerLauncher;
 import dev.ltms.fleet.member.HerdrPeerLauncher;
+import dev.ltms.fleet.member.MemberCredentialPolicyView;
 import dev.ltms.fleet.member.OpenCodeLauncher;
 import dev.ltms.fleet.placement.BackendOutagePolicy;
 import dev.ltms.fleet.placement.BackendQuarantine;
@@ -708,8 +709,11 @@ public final class Fleetd {

        // CB-185: give FleetApp both daemons — /healthz must require both to answer and
        // GET /sessions must merge across both, or a down/unpolled member daemon is invisible.
+        // fleetd #111: live (re-read-per-request) memberCredentials view for GET /member-credentials —
+        // same hot-reload shape as the memberCredentials supplier passed to ClaudeCodeLauncher above.
        Javalin app = new FleetApp(herdr, memberHerdr, workers, sessions, messages, presence, mcp.servlet(),
-                callers, metrics, deliverable).build();
+                callers, metrics, deliverable,
+                () -> MemberCredentialPolicyView.of(config.get().memberCredentials())).build();
        app.start(cfg.bind().host(), cfg.bind().port());
        log.info("fleetd listening on {}:{}, herdr socket {}",
                cfg.bind().host(), cfg.bind().port(), socket);
@@ -1082,12 +1086,14 @@ public final class Fleetd {
     * #requiredSecretEnvVars} is exposed for {@link #reportRequiredSecrets}'s own test.
     */
    static void reportMemberCredentialsGap(FleetConfig cfg) {
-        FleetConfig.MemberCredentials creds = cfg.memberCredentials();
-        if (creds != null && !creds.known().isEmpty()) {
+        // fleetd #111: the counts below come from MemberCredentialPolicyView, the same class the
+        // live GET /member-credentials endpoint reads — one place computes them, not two.
+        MemberCredentialPolicyView view = MemberCredentialPolicyView.of(cfg.memberCredentials());
+        if (view.present()) {
            log.info("memberCredentials: policy={}, {} known name(s), {} allowed — blocking {} on "
                            + "every spawn{}",
-                    creds.policy(), creds.known().size(), creds.allow().size(), creds.blockedSet().size(),
-                    creds.isAllowList()
+                    view.policy(), view.knownCount(), view.allowedCount(), view.blockedCount(),
+                    cfg.memberCredentials().isAllowList()
                            ? " (allow-list: known/allow are reporting only — the control is the derived ZDOTDIR scrub)"
                            : "");
            return;
@@ -1253,7 +1253,11 @@ public final class FleetMcp {
                        + "worktree:<ticket-slug> to provision an isolated git worktree. Pass resumeSessionId "
                        + "to relaunch onto a prior conversation instead of starting cold — this requires an "
                        + "explicit profile whose backend supports it (fleet_list shows agentSessionId for "
-                        + "resumable members), and is refused otherwise rather than silently starting fresh. "
+                        + "resumable members; it is absent for a member fleetd cannot reliably re-identify, "
+                        + "e.g. an opencode member spawned without a worktree), and is refused otherwise "
+                        + "rather than silently starting fresh. For an opencode profile, resumeSessionId "
+                        + "itself also requires worktree:true/<slug> on THIS spawn — without one fleetd can "
+                        + "never re-verify which conversation it actually resumed (fleetd #249). "
                        + "sessionName gives the member a display name in its own UI when the backend supports "
                        + "one. Returns the member's sessionId (use with fleet_send) and paneId (use with "
                        + "fleet_stop).",
@@ -1264,7 +1268,7 @@ public final class FleetMcp {
                        "worktree", Map.of("type", "string", "description", "'true' or a ticket slug — requests an isolated git worktree"),
                        "ticket", stringProp("Ticket slug when worktree:true"),
                        "sessionName", stringProp("Logical display name for the member's own session, when its backend supports one"),
-                        "resumeSessionId", stringProp("A prior member's agentSessionId (from fleet_list) to resume — requires an explicit profile that supports it")),
+                        "resumeSessionId", stringProp("A prior member's agentSessionId (from fleet_list) to resume — requires an explicit profile that supports it, and (for opencode) a worktree on this spawn too")),
                        List.of()));
    }

@@ -1285,9 +1289,14 @@ public final class FleetMcp {
                        + "discover a peer lead without being told its address. 'members' are the "
                        + "sessions delegated to — each with sessionId, paneId, role (architect/dev/"
                        + "reviewer), profile (the backend it runs on), state, optional "
-                        + "worktree/branch/owner/agentSessionId (the id to pass as fleet_spawn's "
-                        + "resumeSessionId to relaunch onto that same conversation, when the backend "
-                        + "supports it), and live herdr status. An empty 'members' "
+                        + "worktree/branch/owner/agentSessionId, and live herdr status. agentSessionId, "
+                        + "when present, is the id to pass as fleet_spawn's resumeSessionId to relaunch "
+                        + "onto that same conversation. It is ABSENT — not a guess — for a member fleetd "
+                        + "cannot reliably re-identify: some backends (e.g. opencode) resolve it from the "
+                        + "member's working directory, which only uniquely identifies a member when it "
+                        + "was spawned into its own fleetd-provisioned worktree (worktree:true/<slug>); a "
+                        + "member spawned without one shares its directory with others and never reports "
+                        + "an id, however long it runs (fleetd #249). An empty 'members' "
                        + "means no members are spawned; it says nothing about peers. When capacity "
                        + "facts are configured, a 'capacity' row per profile also reports free: 0 for "
                        + "a quarantined profile's credential (see fleet_profiles), whatever its "
@@ -495,7 +495,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * <p><b>Additive, not a rewrite.</b> {@code .claude.json} is large (tens of KB, dozens of
     * projects) and Claude Code itself rewrites it while running, so this reads the file as a JSON
     * tree (missing or unreadable → treated as an empty object) and changes only
-     * {@code projects.<cwd>.hasTrustDialogAccepted} / {@code .hasCompletedProjectOnboarding} —
+     * {@code projects.<cwd>.hasTrustDialogAccepted} (that key alone — see fleetd #247) —
     * every other top-level key and every other project entry is written back untouched. Only the
     * one project entry for {@code cwd} is replaced/created; an existing entry for a DIFFERENT cwd
     * (or the operator's own project history) is never touched.
@@ -505,7 +505,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * peer that starts without the seed still starts; it just may hit the dialog fleetd #149
     * describes.
     *
-     * <p><b>Gated to a provisioned worktree</b> ({@link #isProvisionedWorktree}) — see that
+     * <p><b>Gated to a provisioned worktree</b> ({@link HerdrPeerLauncher#isProvisionedWorktree}) — see that
     * method's javadoc for the incident that made this gate mandatory, not optional: this must
     * never run against a real checkout or an un-configured fallback cwd, only the exact
     * always-fresh-directory population fleetd #149 describes.
@@ -516,7 +516,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * sibling-temp-file + {@code ATOMIC_MOVE}, never a truncate-in-place) so a crash mid-write or a
     * concurrent reader never observes a half-written file, and through {@link #TRUST_JSON_LOCK} so
     * two concurrent spawns' entries both survive instead of the second write silently discarding
-     * the first. Both exist because of a real incident: see {@link #isProvisionedWorktree}'s javadoc
+     * the first. Both exist because of a real incident: see {@link HerdrPeerLauncher#isProvisionedWorktree}'s javadoc
     * and {@link #writeAtomically}'s javadoc.
     *
     * @param configDir the profile's {@code CLAUDE_CONFIG_DIR} ({@code cfg.configDir()}), or
@@ -558,8 +558,18 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
                if (!(projectNode instanceof ObjectNode)) {
                    projects.set(cwd, project);
                }
+                // fleetd #247: ONLY hasTrustDialogAccepted. We used to write
+                // hasCompletedProjectOnboarding beside it; do not put it back. Measured on
+                // 2026-09-03, minutes after a live spawn seeded this file: 28 of 28 project
+                // entries carried hasTrustDialogAccepted and 0 of 28 carried the onboarding key
+                // — including the 27 entries Claude Code wrote for itself. Claude Code
+                // normalises the whole file when it saves and drops that key every time, so
+                // writing it achieved nothing except making the next reader think it mattered.
+                // The member reached idle with the trust flag alone, which is the only outcome
+                // this seed exists for. If a future Claude Code needs the second flag the
+                // symptom returns as the trust dialog fleetd #149 describes — re-measure then,
+                // do not restore it on a guess.
                project.put("hasTrustDialogAccepted", true);
-                project.put("hasCompletedProjectOnboarding", true);
                writeAtomically(target, TRUST_JSON.writerWithDefaultPrettyPrinter().writeValueAsString(root));
            } catch (Exception e) {
                log.debug("cannot seed workspace-trust entry for cwd '{}' into '{}'", cwd, target, e);
@@ -578,7 +588,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * <p><b>fleetd #149 incident.</b> The original implementation used
     * {@code Files.writeString(target, content)} directly, which truncates {@code target} in place
     * before writing the replacement bytes. Combined with an ungated {@code cwd} (see
-     * {@link #isProvisionedWorktree}'s javadoc), a mutation-testing run hit that truncation window
+     * {@link HerdrPeerLauncher#isProvisionedWorktree}'s javadoc), a mutation-testing run hit that truncation window
     * against the operator's real {@code ~/.claude.json} and left it at 178 bytes. The gate closes
     * <em>which file</em> this can ever target; this closes <em>how</em> the target is written, so
     * that even a legitimate write against a real, live, concurrently-read {@code .claude.json}
@@ -628,32 +638,6 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
        }
    }

-    /**
-     * Whether {@code cwd} is a fleetd-provisioned git worktree — signalled the same way
-     * {@link #writeIdeOverlay} already gates on: a {@code .git} that is a <strong>regular
-     * file</strong> holding a {@code gitdir:} pointer, as opposed to a real checkout's {@code .git}
-     * <strong>directory</strong>. {@code null}/blank never qualifies.
-     *
-     * <p>Shared by every write that must land only in a worktree fleetd itself created for a
-     * member — never in a real checkout, an arbitrary configured directory, or (see the incident
-     * below) the daemon's own fallback cwd.
-     *
-     * <p><b>fleetd #149 incident.</b> {@link #seedTrustDialog} originally ran unconditionally on
-     * any non-blank {@code cwd}. Most of this launcher's OWN tests spawn a profile with no
-     * {@code cwd} configured, so the base class's {@code resolveCwd} falls through to the real
-     * {@code user.dir} — and with no {@code configDir} either (also the common case in this
-     * file's fixtures), the seed's target falls through the same way to the real
-     * {@code ~/.claude.json}. Running this repo's own test suite corrupted the operator's actual
-     * config file (it shrank from ~72 KB to a single seeded entry) the first time a mutation
-     * happened to make the write non-additive. Gating both cwd-targeted writes on "this is a
-     * worktree fleetd provisioned" — exactly the population fleetd #149 describes
-     * ({@code worktree: true} always lands in a brand-new directory) — makes that class of write
-     * impossible against a real checkout or an untouched fallback cwd, in production or in tests.
-     */
-    private static boolean isProvisionedWorktree(String cwd) {
-        return cwd != null && !cwd.isBlank() && Files.isRegularFile(Path.of(cwd, ".git"));
-    }
-
    /** {@code s}, or {@code null} when {@code s} is null/blank — the charter-presence test used above. */
    private static String nonBlank(String s) {
        return (s == null || s.isBlank()) ? null : s;
@@ -358,6 +358,42 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        return Files.isRegularFile(candidate) ? candidate : null;
    }

+    /**
+     * Whether {@code cwd} is a fleetd-provisioned git worktree — signalled the same way
+     * {@code ClaudeCodeLauncher#writeIdeOverlay} already gates on: a {@code .git} that is a
+     * <strong>regular file</strong> holding a {@code gitdir:} pointer, as opposed to a real
+     * checkout's {@code .git} <strong>directory</strong>. {@code null}/blank never qualifies.
+     *
+     * <p>Shared by every write (and, since fleetd #249, every identity read) that must land only
+     * in a worktree fleetd itself created for a member — never in a real checkout, an arbitrary
+     * configured directory, or (see the incident below) the daemon's own fallback cwd. Package-
+     * private (not {@code protected}) on purpose: {@link ClaudeCodeLauncher} and
+     * {@link OpenCodeLauncher} both call it, and same-package visibility is enough — no subclass
+     * outside this package needs it.
+     *
+     * <p><b>fleetd #149 incident.</b> {@code ClaudeCodeLauncher#seedTrustDialog} originally ran
+     * unconditionally on any non-blank {@code cwd}. Most of that launcher's OWN tests spawn a
+     * profile with no {@code cwd} configured, so the base class's {@code resolveCwd} falls
+     * through to the real {@code user.dir} — and with no {@code configDir} either (also the
+     * common case in that file's fixtures), the seed's target falls through the same way to the
+     * real {@code ~/.claude.json}. Running this repo's own test suite corrupted the operator's
+     * actual config file (it shrank from ~72 KB to a single seeded entry) the first time a
+     * mutation happened to make the write non-additive. Gating both cwd-targeted writes on "this
+     * is a worktree fleetd provisioned" — exactly the population fleetd #149 describes
+     * ({@code worktree: true} always lands in a brand-new directory) — makes that class of write
+     * impossible against a real checkout or an untouched fallback cwd, in production or in tests.
+     *
+     * <p><b>fleetd #249.</b> The same reasoning extends to a READ: {@code
+     * OpenCodeSessionDiscovery#sessionIdForDirectory} keys on {@code directory}, a heuristic that
+     * is only reliable when the directory is unique to this member — i.e., exactly the population
+     * this gate identifies. {@link OpenCodeLauncher} uses it to withhold {@code agentSessionId()}
+     * (report absence rather than a guess) and to refuse a {@code resumeSessionId} spawn that
+     * cannot be resolved reliably going forward.
+     */
+    static boolean isProvisionedWorktree(String cwd) {
+        return cwd != null && !cwd.isBlank() && Files.isRegularFile(Path.of(cwd, ".git"));
+    }
+
    // --- profile surface -----------------------------------------------------------------------

    /** The configured peer profile names (what {@code spawn(profile)} accepts). */
@@ -0,0 +1,75 @@
+package dev.ltms.fleet.member;
+
+import dev.ltms.fleet.config.FleetConfig;
+
+import java.util.List;
+
+/**
+ * fleetd #111 (CB-608): a single, testable read of the {@code memberCredentials:} policy — names
+ * and counts only, never a value. The daemon never holds a credential's <em>value</em> in the
+ * first place (only the names configured under {@code known:}/{@code allow:}), so there is
+ * nothing here to redact by construction; the point of this class is that it is the ONE place
+ * that turns a policy into names-and-counts, so nothing else hand-counts a second time.
+ *
+ * <p>Before this class, {@link dev.ltms.fleet.Fleetd#reportMemberCredentialsGap} computed these
+ * same counts inline for the startup log line, and {@code scripts/probe-member-credentials.sh}
+ * carried its own hardcoded {@code NAMES} array that the live policy could grow past silently
+ * (#111) — the exact "hand-maintained second copy drifts" shape #114 fixed for the tool
+ * catalogue. Both now read this class: the startup log via {@link
+ * dev.ltms.fleet.Fleetd#reportMemberCredentialsGap}, and a live daemon via the {@code
+ * GET /member-credentials} REST endpoint ({@link dev.ltms.fleet.rest.FleetApp}), which the probe
+ * script fetches instead of carrying its own list.
+ *
+ * @param present policy configured with at least one {@code known} name. {@code false} for an
+ *                absent or empty {@code memberCredentials:} block — represented honestly as "no
+ *                policy", never as "nothing blocked" (an empty {@link #blocked} could otherwise be
+ *                misread as a clean bill of health).
+ * @param policy  the normalized policy mode ({@link FleetConfig.MemberCredentials#policy()}), or
+ *                {@code null} when {@link #present} is {@code false}.
+ * @param known   every name the policy declares, in configured order. Names only, never a value.
+ * @param allowed the subset of {@link #known} explicitly let through. Names only.
+ * @param blocked {@link #known} minus {@link #allowed} — the names an actual spawn shadows. Names
+ *                only.
+ */
+public record MemberCredentialPolicyView(boolean present, String policy, List<String> known,
+                                          List<String> allowed, List<String> blocked) {
+
+    private static final MemberCredentialPolicyView ABSENT =
+            new MemberCredentialPolicyView(false, null, List.of(), List.of(), List.of());
+
+    public MemberCredentialPolicyView {
+        known = known == null ? List.of() : List.copyOf(known);
+        allowed = allowed == null ? List.of() : List.copyOf(allowed);
+        blocked = blocked == null ? List.of() : List.copyOf(blocked);
+    }
+
+    /** The honest "no policy configured" view. */
+    public static MemberCredentialPolicyView absent() {
+        return ABSENT;
+    }
+
+    /**
+     * Build the view straight from the live config. {@code creds} may be {@code null} (no {@code
+     * memberCredentials:} block at all) — treated the same as a present-but-empty block, exactly
+     * like {@link dev.ltms.fleet.Fleetd#reportMemberCredentialsGap} already did.
+     */
+    public static MemberCredentialPolicyView of(FleetConfig.MemberCredentials creds) {
+        if (creds == null || creds.known().isEmpty()) {
+            return ABSENT;
+        }
+        return new MemberCredentialPolicyView(true, creds.policy(), creds.known(), creds.allow(),
+                List.copyOf(creds.blockedSet()));
+    }
+
+    public int knownCount() {
+        return known.size();
+    }
+
+    public int allowedCount() {
+        return allowed.size();
+    }
+
+    public int blockedCount() {
+        return blocked.size();
+    }
+}
@@ -672,13 +672,29 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
    /** Add lazy on-disk session discovery to the base handle. */
    @Override
    public PeerHandle spawn(SpawnRequest req) {
+        String cwd = effectiveCwd(req);
+        // fleetd #249: refuse rather than silently resume into unverifiable territory. opencode's
+        // `-s <id>` flag itself resumes precisely — the resolved id is what fails, not the resume —
+        // but resolvedSessionId() below can never confirm (or later re-report) this handle's own
+        // identity without a fleetd-provisioned worktree (isProvisionedWorktree(cwd)), because the
+        // directory is shared and sessionIdForDirectory's "most recently updated row" heuristic can
+        // pick a sibling's session. Refusing here, before anything spawns, beats letting the member
+        // start and only then discovering fleetd can never again verify who it actually is.
+        if (req.resumeSessionId() != null && !req.resumeSessionId().isBlank()
+                && !isProvisionedWorktree(cwd)) {
+            throw new IllegalArgumentException("resumeSessionId requires a fleetd-provisioned "
+                    + "worktree for an opencode profile — without one, this member's cwd is shared "
+                    + "with other sessions, so fleetd can never reliably confirm (now or later) which "
+                    + "conversation it is actually running (fleetd #249). Pass fleet_spawn{worktree:"
+                    + "<ticket-slug>} to resume this member.");
+        }
        PeerHandle inner = super.spawn(req);
        // fleetd #175: the same profile config buildLaunch resolved for this spawn (requireProfile
        // is deterministic on req.profileName(), so re-resolving here costs a map lookup, not a
        // second decision) — SessionAwareHandle needs cfg.model() to know what THIS session should
        // be running.
        FleetConfig.Profile cfg = requireProfile(req.profileName());
-        return new SessionAwareHandle(inner, discovery, effectiveCwd(req), cfg,
+        return new SessionAwareHandle(inner, discovery, cwd, cfg,
                this::memberHerdrSocketConfigured, discoveryUnavailableWarned, exhaustionSink);
    }

@@ -718,6 +734,17 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
         * the directory right now."
         */
        private final AtomicReference<String> resolvedSessionId = new AtomicReference<>();
+        /**
+         * fleetd #249: whether {@link #cwd} is a fleetd-provisioned git worktree
+         * ({@link HerdrPeerLauncher#isProvisionedWorktree}), computed once at spawn time since
+         * {@code cwd} never changes for this handle. When {@code false} the directory is shared
+         * with other sessions (the default no-worktree spawn inherits the lead's own cwd), so
+         * {@link OpenCodeSessionDiscovery#sessionIdForDirectory}'s "most recently updated row for
+         * this directory" heuristic can and does pick another session's row — see that class's
+         * javadoc. {@link #agentSessionId()} refuses to guess in that case: it reports absent
+         * rather than a possibly-foreign id.
+         */
+        private final boolean worktreeProvisioned;

        SessionAwareHandle(PeerHandle delegate, OpenCodeSessionDiscovery discovery, String cwd,
                            FleetConfig.Profile cfg,
@@ -731,6 +758,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
            this.discoveryUnavailable = discoveryUnavailable;
            this.discoveryUnavailableWarned = discoveryUnavailableWarned;
            this.exhaustionSink = exhaustionSink;
+            this.worktreeProvisioned = isProvisionedWorktree(cwd);
        }

        @Override
@@ -760,6 +788,9 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
            // built from (see OpenCodeLauncher#defaultDiscoveryRoot's javadoc for the full
            // reasoning). Scanning fleetd's own $HOME under that config would only ever find "no
            // row" and read as "resume unsupported" — declare it unavailable instead, once, loudly.
+            // Checked before the fleetd #249 worktree gate below: this OS-user mismatch makes
+            // discovery unusable regardless of whether cwd happens to be a provisioned worktree, so
+            // it earns the one-time WARN either way.
            if (discoveryUnavailable.getAsBoolean()) {
                if (discoveryUnavailableWarned.compareAndSet(false, true)) {
                    log.warn("opencode session discovery unavailable: memberHerdrSocket is "
@@ -771,6 +802,16 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                }
                return null;
            }
+            // fleetd #249: cwd is shared with other sessions unless fleetd itself provisioned this
+            // worktree, and sessionIdForDirectory's directory-keyed heuristic cannot tell this
+            // member's row apart from a sibling's in that case (measured: a three-day-old row from
+            // a different profile). Refuse to guess — absent is the honest answer, and it is what
+            // this codebase already returns elsewhere for absent evidence (fleetd #175's UNKNOWN).
+            // No WARN here: unlike discoveryUnavailable above, this is the ordinary, expected shape
+            // of the large majority of spawns (no worktree requested), not a configuration gap.
+            if (!worktreeProvisioned) {
+                return null;
+            }
            // fleetd #234: once resolved, stay resolved. Re-deriving from `directory` on every call
            // would let this handle's identity drift to a sibling session that later shares the
            // same cwd and writes a newer row — see resolvedSessionId's javadoc.
@@ -13,6 +13,7 @@ import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.herdr.HerdrClient;
 import dev.ltms.fleet.herdr.HerdrException;
 import dev.ltms.fleet.inject.MemberPresence;
+import dev.ltms.fleet.member.MemberCredentialPolicyView;
 import dev.ltms.fleet.peer.PeerUnreachableException;
 import dev.ltms.fleet.placement.PlacementException;
 import dev.ltms.fleet.msg.MessageService;
@@ -32,6 +33,7 @@ import java.util.List;
 import java.util.Map;
 import java.util.function.Function;
 import java.util.function.Predicate;
+import java.util.function.Supplier;
 import java.util.stream.Collectors;

 /**
@@ -64,6 +66,10 @@ public final class FleetApp {
    private final HttpServlet mcpServlet; // MCP Streamable-HTTP endpoint, mounted at /mcp (nullable)
    private final CallerResolver auth;    // CB-501: null → authz not enforced (legacy behaviour)
    private final Metrics metrics;        // CB-502: null → /metrics not exposed
+    // fleetd #111: re-read per request, same hot-reload shape as every other live config read —
+    // absent() (the honest "no policy configured" view) for every constructor that does not wire
+    // a real one, so existing legacy call sites keep building without knowing this field exists.
+    private final Supplier<MemberCredentialPolicyView> memberCredentials;
    private final ObjectMapper mapper = new ObjectMapper();

    /**
@@ -111,6 +117,19 @@ public final class FleetApp {
                       MessageService messages, MemberPresence presence,
                       HttpServlet mcpServlet, CallerResolver auth, Metrics metrics,
                       Predicate<String> deliverable) {
+        this(herdr, memberHerdr, workers, sessions, messages, presence, mcpServlet, auth, metrics,
+                deliverable, MemberCredentialPolicyView::absent);
+    }
+
+    /**
+     * @param memberCredentials live {@code memberCredentials:} policy view (fleetd #111), re-read
+     *                          per request for {@code GET /member-credentials}; production wiring
+     *                          passes the same hot-reload shape as every other live config read
+     */
+    public FleetApp(HerdrClient herdr, HerdrClient memberHerdr, PeerLauncher workers, SessionManager sessions,
+                       MessageService messages, MemberPresence presence,
+                       HttpServlet mcpServlet, CallerResolver auth, Metrics metrics,
+                       Predicate<String> deliverable, Supplier<MemberCredentialPolicyView> memberCredentials) {
        this.herdr = herdr;
        this.memberHerdr = memberHerdr != null ? memberHerdr : herdr;
        this.workers = workers;
@@ -120,6 +139,7 @@ public final class FleetApp {
        this.mcpServlet = mcpServlet;
        this.auth = auth;
        this.metrics = metrics;
+        this.memberCredentials = memberCredentials != null ? memberCredentials : MemberCredentialPolicyView::absent;
    }

    /** Wire routes onto a fresh, unstarted Javalin instance. Caller starts it. */
@@ -148,6 +168,7 @@ public final class FleetApp {
        app.get("/agents", this::agents);
        app.get("/members", this::listMembers);                  // CB-304: registry roster + live herdr status
        app.get("/profiles", this::profiles);                    // configured backend profiles
+        app.get("/member-credentials", this::memberCredentials); // fleetd #111: policy names + counts, never a value
        app.post("/members", this::spawnMember);                 // optional ?role=&profile= or {"role":…,"profile":…}
        app.delete("/members/{paneId}", this::stopMember);
        app.post("/sessions/{id}/message", this::sendMessage);   // fleet_send (primary; blocking, wait:false, or answer via turnId)
@@ -346,6 +367,29 @@ public final class FleetApp {
                "default", workers.defaultProfile() == null ? "" : workers.defaultProfile()));
    }

+    /**
+     * fleetd #111 (CB-608): the live {@code memberCredentials:} policy as names and counts —
+     * NEVER a value. The daemon does not hold a credential's value in the first place (only the
+     * name it is configured under), so there is nothing to redact here beyond what {@link
+     * MemberCredentialPolicyView} already omits by construction. This is the source
+     * {@code scripts/probe-member-credentials.sh} reads instead of carrying its own hardcoded
+     * name list, which is exactly what let the list drift silently behind the real policy.
+     */
+    private void memberCredentials(Context ctx) {
+        if (!allow(ctx, Authz.Action.READ, null)) {
+            return;
+        }
+        MemberCredentialPolicyView view = memberCredentials.get();
+        ctx.status(200).json(Map.of(
+                "present", view.present(),
+                "policy", view.policy() == null ? "" : view.policy(),
+                "known", view.known(),
+                "allowed", view.allowed(),
+                "knownCount", view.knownCount(),
+                "allowedCount", view.allowedCount(),
+                "blockedCount", view.blockedCount()));
+    }
+
    /**
     * Spawn a guard-checked worker. An optional {@code profile} (query param or {@code {"profile":…}}
     * body) picks which configured profile; omitted → the default. 403 if the base_url would breach
@@ -2,6 +2,7 @@ package dev.ltms.fleet.inject;

 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
+import dev.ltms.fleet.Fleetd;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.AgentControl;
@@ -146,40 +147,16 @@ class BackendOutageFlowTest {
            pushLoop = new ReplyPushLoop(registry, new AgentControl(leadClient), inbox, scheduler, 3, 50);
            AtomicReference<ReplyPushLoop> pushLoopRef = new AtomicReference<>(pushLoop);

-            // --- mirrors Fleetd.main's backendErrorSink lambda EXACTLY: (1) mark BACKEND_ERROR,
-            // (2) resolve profile/credential via the roster, fail-loud + notify unmapped-target,
-            // (3) record in BackendOutagePolicy, (4) on a NEW incident, notify the lead. ------------
-            BackendErrorSink backendErrorSink = (target, matchedLine, reason) -> {
-                sessions.onBackendError(target, reason);
+            // fleetd #248 follow-up: this used to be a 30-line hand-copy of Fleetd.main's
+            // backendErrorSink lambda, with a comment promising it mirrored production "EXACTLY".
+            // That promise is exactly the problem: a copy proves the copy. Editing or deleting the
+            // real sink left this whole flow test green, because it never touched the real sink.
+            // #248 made Fleetd.backendErrorSink public precisely so a cross-package test could
+            // drive the real object, so this now calls it. Every assertion below is about
+            // production code again.
+            BackendErrorSink backendErrorSink =
+                    Fleetd.backendErrorSink(sessions, () -> profiles, outagePolicy, pushLoopRef::get);

-                String profileName = sessions.roster().stream()
-                        .filter(session -> target.equals(session.terminalId()))
-                        .findFirst()
-                        .map(MemberSession::profile)
-                        .orElse(null);
-                FleetConfig.Profile profile = profileName == null ? null : profiles.get(profileName);
-                if (profile == null) {
-                    ReplyPushLoop loop = pushLoopRef.get();
-                    if (loop != null) {
-                        loop.onBackendTargetUnmapped(target, reason);
-                    }
-                    return;
-                }
-                String credentialId = profile.effectiveCredentialId();
-                Optional<BackendOutagePolicy.Incident> incident = outagePolicy.record(credentialId, target, reason);
-                incident.ifPresent(inc -> {
-                    List<String> affectedProfiles = profiles.values().stream()
-                            .filter(p -> credentialId.equals(p.effectiveCredentialId()))
-                            .map(FleetConfig.Profile::profile)
-                            .sorted()
-                            .toList();
-                    ReplyPushLoop loop = pushLoopRef.get();
-                    if (loop != null) {
-                        loop.onBackendIncident(inc.id(), inc.targets(), credentialId, affectedProfiles,
-                                (int) inc.remainingCoolOffSeconds());
-                    }
-                });
-            };
            BackendErrorPatternLookup patterns = target -> Pattern.compile("(?i)503 Service Unavailable");
            resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(),
                    ExhaustionSink.none(), patterns, backendErrorSink);
@@ -0,0 +1,121 @@
+package dev.ltms.fleet.mcp;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.LinkedHashSet;
+import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #114 (CB-609): the guard that lets {@code docs/MCP-Contract.md} name a tool at all.
+ *
+ * <p>That page was written in July 2026, before any MCP code existed, and then did not follow the
+ * code. By August it named two tools that had never been built, omitted five that shipped, had the
+ * wrong name for nearly every parameter, and still described a caller-identity rule that was a
+ * privilege bug by then. Nothing failed, because nothing checked it — and {@code CLAUDE.md} sends
+ * every session in the fleet to that page.
+ *
+ * <p>The fix was to delete the tool catalogue rather than correct it: a hand-maintained second copy
+ * of the tool surface is the defect, not the particular errors it had accumulated. What survives is
+ * the flows, which are shapes rather than names. But the flows still have to say {@code fleet_send}
+ * somewhere to be readable, and that is exactly the sentence that rots. This test is what makes it
+ * safe to write.
+ *
+ * <p><b>It checks source text, not behaviour.</b> It reads the Markdown and reads {@link FleetMcp}'s
+ * source, and it only catches a name in the doc that the server does not register. It cannot catch a
+ * flow that describes the wrong order, or a parameter name in prose — those are not name-shaped. The
+ * doc's own header carries that caveat for its readers.
+ */
+class McpContractDocTest {
+
+    /** Tests run with the module directory as cwd, so the repo-root doc is one level up. */
+    private static final Path DOC = Path.of("../docs/MCP-Contract.md");
+    private static final Path MCP_SOURCE = Path.of("src/main/java/dev/ltms/fleet/mcp/FleetMcp.java");
+
+    private static Set<String> matches(Path file, String regex) throws Exception {
+        Matcher m = Pattern.compile(regex).matcher(Files.readString(file));
+        Set<String> found = new LinkedHashSet<>();
+        while (m.find()) {
+            found.add(m.group(1));
+        }
+        return found;
+    }
+
+    /** Every {@code fleet_*} the doc mentions, in prose or in a diagram. */
+    private static Set<String> toolsNamedInTheDoc() throws Exception {
+        return matches(DOC, "(fleet_[a-z_]+)");
+    }
+
+    /** Every tool {@link FleetMcp} actually registers, read from its {@code tool("…")} calls. */
+    private static Set<String> toolsTheServerRegisters() throws Exception {
+        return matches(MCP_SOURCE, "tool\\(\"(fleet_[a-z_]+)\"");
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] every fleet_* tool named in MCP-Contract.md is one the server registers")
+    void theDocNamesNoToolThatDoesNotExist() throws Exception {
+        Set<String> registered = toolsTheServerRegisters();
+        Set<String> named = toolsNamedInTheDoc();
+
+        Set<String> unknown = new LinkedHashSet<>(named);
+        unknown.removeAll(registered);
+
+        assertTrue(unknown.isEmpty(),
+                "docs/MCP-Contract.md names " + unknown + ", which FleetMcp does not register. "
+                        + "Checked " + named.size() + " name(s) in the doc against " + registered.size()
+                        + " registered tool(s): " + registered + ". This is the fleetd #114 defect "
+                        + "recurring — the doc named fleet_read and fleet_cancel for weeks after the "
+                        + "code shipped without them. Either fix the name or drop it from the page; do "
+                        + "NOT weaken this test.");
+    }
+
+    /**
+     * The denominator guard. The check above passes trivially if the doc stops naming any tool at
+     * all — an empty set is a subset of everything. A checker that can silently check nothing is the
+     * fleetd #113 shape, so this pins that the doc really is still describing the flows, and that
+     * the registration scrape really did find the server's tools.
+     */
+    @Test
+    @DisplayName("[SOURCE TEXT] the doc/server name check is not vacuous — both sides found names")
+    void theCheckActuallyHasSomethingToCheck() throws Exception {
+        Set<String> registered = toolsTheServerRegisters();
+        Set<String> named = toolsNamedInTheDoc();
+
+        assertTrue(registered.size() >= 10,
+                "scraped only " + registered.size() + " tool registrations from FleetMcp (" + registered
+                        + "); the server registers eleven, so the tool(\"…\") scrape has stopped matching "
+                        + "and the check above is now vacuous");
+        assertTrue(named.size() >= 4,
+                "docs/MCP-Contract.md names only " + named.size() + " fleet_* tool(s) (" + named + "). "
+                        + "The flows describe delegation, clarification, detached delivery and the "
+                        + "turn-done fallback, so it should name several. Too few means the page has been "
+                        + "gutted and this test is guarding nothing.");
+    }
+
+    /**
+     * fleetd #114's actual lesson. The catalogue was deleted on purpose; a well-meaning "let me just
+     * document the tools here" restores the exact second copy that drifted for a month.
+     */
+    @Test
+    @DisplayName("[SOURCE TEXT] MCP-Contract.md still says it is not the tool reference")
+    void theDocStillDisclaimsBeingTheToolReference() throws Exception {
+        String doc = Files.readString(DOC);
+        assertTrue(doc.contains("**What this page is NOT: a tool reference.**"),
+                "docs/MCP-Contract.md must keep saying it is not the tool reference. That sentence is "
+                        + "the fix for fleetd #114: the page carried a hand-maintained tool catalogue that "
+                        + "drifted from the code for a month while CLAUDE.md pointed every session at it.");
+        assertEquals(0, countTables(doc.substring(0, doc.indexOf("## 1. Rendezvous flows"))),
+                "the header of docs/MCP-Contract.md must not grow a tool/parameter table — that is the "
+                        + "second copy fleetd #114 deleted");
+    }
+
+    private static int countTables(String markdown) {
+        return (int) markdown.lines().filter(l -> l.strip().startsWith("|")).count();
+    }
+}
@@ -2159,8 +2159,7 @@ class ClaudeCodeLauncherTest {
                }
                JsonNode root = new ObjectMapper().readTree(claudeJson.toFile());
                JsonNode project = root.path("projects").path(worktree.toString());
-                seededBeforeStart.set(project.path("hasTrustDialogAccepted").asBoolean(false)
-                        && project.path("hasCompletedProjectOnboarding").asBoolean(false));
+                seededBeforeStart.set(project.path("hasTrustDialogAccepted").asBoolean(false));
            } catch (IOException e) {
                seededBeforeStart.set(false);
            }
@@ -2178,7 +2177,7 @@ class ClaudeCodeLauncherTest {
    }

    @Test
-    void seedTrustDialogWritesBothTrustFlagsForTheResolvedCwd(
+    void seedTrustDialogWritesOnlyTheTrustFlagAndNotTheOnboardingKey(
            @TempDir Path configDir, @TempDir Path worktree) throws Exception {
        markAsProvisionedWorktree(worktree);
        FakeHerdr herdr = new FakeHerdr();
@@ -2192,7 +2191,13 @@ class ClaudeCodeLauncherTest {
        JsonNode project = new ObjectMapper().readTree(claudeJson.toFile())
                .path("projects").path(worktree.toString());
        assertTrue(project.path("hasTrustDialogAccepted").asBoolean(false));
-        assertTrue(project.path("hasCompletedProjectOnboarding").asBoolean(false));
+        // fleetd #247: the onboarding key must NOT be written. Claude Code strips it on every
+        // save (measured: 0 of 28 live entries had it, including its own), so writing it only
+        // adds a contested key to a file two processes share. This assertion is the guard that
+        // stops it coming back as a plausible-looking "completeness" fix.
+        assertFalse(project.has("hasCompletedProjectOnboarding"),
+                "hasCompletedProjectOnboarding must not be written — Claude Code drops it on "
+                        + "every save, and the member reaches idle on hasTrustDialogAccepted alone");
    }

    /**
@@ -2238,7 +2243,6 @@ class ClaudeCodeLauncherTest {

        JsonNode mine = root.path("projects").path(worktree.toString());
        assertTrue(mine.path("hasTrustDialogAccepted").asBoolean(false));
-        assertTrue(mine.path("hasCompletedProjectOnboarding").asBoolean(false));
    }

    /**
@@ -0,0 +1,99 @@
+package dev.ltms.fleet.member;
+
+import dev.ltms.fleet.config.FleetConfig;
+import org.junit.jupiter.api.Test;
+
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #111 (CB-608): {@link MemberCredentialPolicyView} is the one place that turns a {@code
+ * memberCredentials:} policy into names-and-counts, so the startup log line and {@code
+ * GET /member-credentials} cannot drift apart. These tests pin: the counts always match the
+ * policy that produced them, an absent/empty policy is represented honestly (never as "nothing
+ * blocked"), and the view carries names only — no value ever flows through it, because it is
+ * built only from {@link FleetConfig.MemberCredentials}, which itself never holds a value.
+ */
+class MemberCredentialPolicyViewTest {
+
+    @Test
+    void nullPolicyIsAbsentNotClean() {
+        MemberCredentialPolicyView view = MemberCredentialPolicyView.of(null);
+
+        assertFalse(view.present(), "a null policy must be reported as absent");
+        assertEquals(0, view.knownCount());
+        assertEquals(0, view.allowedCount());
+        assertEquals(0, view.blockedCount());
+        assertTrue(view.known().isEmpty());
+        assertTrue(view.allowed().isEmpty());
+        assertTrue(view.blocked().isEmpty());
+    }
+
+    @Test
+    void emptyKnownListIsAbsentEvenWithAPolicyModeSet() {
+        // A memberCredentials: block can be present in YAML with policy: set but known: empty —
+        // that must still read as "no policy configured", the same as a fully absent block,
+        // because zero known names means the daemon blocks nothing either way.
+        FleetConfig.MemberCredentials creds =
+                new FleetConfig.MemberCredentials("deny-by-default", List.of(), List.of());
+
+        MemberCredentialPolicyView view = MemberCredentialPolicyView.of(creds);
+
+        assertFalse(view.present());
+        assertEquals(0, view.knownCount());
+    }
+
+    @Test
+    void countsMatchARealPolicyExactly() {
+        FleetConfig.MemberCredentials creds = new FleetConfig.MemberCredentials(
+                "deny-by-default",
+                List.of("AI_GATEWAY_TOKEN"),
+                List.of("AI_GATEWAY_TOKEN", "GITEA_ACCESS_TOKEN", "WORKER_GITEA_TOKEN"));
+
+        MemberCredentialPolicyView view = MemberCredentialPolicyView.of(creds);
+
+        assertTrue(view.present());
+        assertEquals("deny-by-default", view.policy());
+        assertEquals(List.of("AI_GATEWAY_TOKEN", "GITEA_ACCESS_TOKEN", "WORKER_GITEA_TOKEN"), view.known());
+        assertEquals(List.of("AI_GATEWAY_TOKEN"), view.allowed());
+        assertEquals(3, view.knownCount());
+        assertEquals(1, view.allowedCount());
+        // known minus allowed — the two names actually shadowed on a spawn.
+        assertEquals(2, view.blockedCount());
+        assertTrue(view.blocked().containsAll(List.of("GITEA_ACCESS_TOKEN", "WORKER_GITEA_TOKEN")));
+    }
+
+    @Test
+    void presentPolicyThatBlocksNothingIsStillDistinctFromAbsent() {
+        // known == allow => blockedCount is 0, exactly like an absent policy's blockedCount — the
+        // two must still be told apart by `present`, or a reader cannot tell "policy configured,
+        // nothing currently blocked" from "no policy at all".
+        FleetConfig.MemberCredentials creds = new FleetConfig.MemberCredentials(
+                "deny-by-default", List.of("X"), List.of("X"));
+
+        MemberCredentialPolicyView view = MemberCredentialPolicyView.of(creds);
+
+        assertTrue(view.present());
+        assertEquals(1, view.knownCount());
+        assertEquals(0, view.blockedCount());
+        assertFalse(MemberCredentialPolicyView.absent().present());
+    }
+
+    @Test
+    void namesPassThroughUnchangedNeverAValue() {
+        // The view is built only from FleetConfig.MemberCredentials, which itself carries names,
+        // never values (see its javadoc) — so there is no code path here that could substitute a
+        // secret's value for its name. This pins the identity: what goes into `known`/`allow` is
+        // exactly what comes out, character for character.
+        List<String> known = List.of("SOME_TOKEN_NAME", "ANOTHER_NAME");
+        FleetConfig.MemberCredentials creds =
+                new FleetConfig.MemberCredentials("deny-by-default", List.of(), known);
+
+        MemberCredentialPolicyView view = MemberCredentialPolicyView.of(creds);
+
+        assertEquals(known, view.known());
+    }
+}
@@ -323,11 +323,39 @@ class OpenCodeLauncherTest {

    // --- CB-547: resume + post-hoc session discovery --------------------------------------------

+    /**
+     * Give {@code dir} the exact signature {@link HerdrPeerLauncher#isProvisionedWorktree} checks
+     * for: a {@code .git} REGULAR FILE, never a directory. Content is never parsed by that gate, so
+     * any {@code gitdir:} pointer is fine. Mirrors {@code ClaudeCodeLauncherTest}'s helper of the
+     * same shape (fleetd #249).
+     */
+    private static void markAsProvisionedWorktree(Path dir) throws IOException {
+        Files.writeString(dir.resolve(".git"), "gitdir: /tmp/not-a-real-gitdir");
+    }
+
+    /**
+     * A fresh subdirectory of {@code configRoot}, marked as a provisioned worktree (fleetd #249),
+     * for tests that predate this gate and stood in a bare {@code "/work/dir"} string as their
+     * member's cwd — a directory that never existed on disk and, post-#249, would never pass
+     * {@link HerdrPeerLauncher#isProvisionedWorktree} either. Those tests are about the model
+     * mismatch / late-resolve machinery (fleetd #175/#234/#209), not about the worktree gate
+     * itself, so they need a cwd the gate accepts without changing what each test demonstrates.
+     */
+    private static String provisionedWorkDir(Path configRoot) throws IOException {
+        Path dir = Files.createDirectories(configRoot.resolve("work-dir"));
+        markAsProvisionedWorktree(dir);
+        return dir.toString();
+    }
+
    @Test
-    void aResumeSpawnPassesTheSessionIdAsDashS(@TempDir Path root) {
+    void aResumeSpawnIntoAProvisionedWorktreePassesTheSessionIdAsDashS(@TempDir Path root,
+                                                                        @TempDir Path worktree)
+            throws Exception {
+        markAsProvisionedWorktree(worktree);
        FakeHerdr herdr = new FakeHerdr();
        service(herdr, root, opencodeCfg("google/gemini-2.5-pro", null, null))
-                .spawn(new SpawnRequest(null, null, null, null, "ses_41b79fc90ffeI9E8uZv6VprUn2"));
+                .spawn(new SpawnRequest(null, worktree.toString(), null, null,
+                        "ses_41b79fc90ffeI9E8uZv6VprUn2"));

        List<String> args = startArgs(herdr);
        int s = args.indexOf("-s");
@@ -336,6 +364,27 @@ class OpenCodeLauncherTest {
                "the resume target id follows -s");
    }

+    /**
+     * fleetd #249 acceptance criterion 3: without a fleetd-provisioned worktree, the member's cwd
+     * is shared with other sessions, so fleetd can never reliably confirm (now or later via {@link
+     * OpenCodeSessionDiscovery}) which conversation it is actually running. Refuse the spawn itself
+     * rather than silently launching opencode's {@code -s <id>} into unverifiable territory.
+     */
+    @Test
+    void aResumeSpawnWithoutAProvisionedWorktreeIsRefused(@TempDir Path root) {
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = service(herdr, root,
+                opencodeCfg("google/gemini-2.5-pro", null, null));
+
+        IllegalArgumentException e = assertThrows(IllegalArgumentException.class, () ->
+                launcher.spawn(new SpawnRequest(null, null, null, null,
+                        "ses_41b79fc90ffeI9E8uZv6VprUn2")));
+
+        assertTrue(e.getMessage().contains("worktree"), e.getMessage());
+        assertFalse(herdr.called("agent.start"),
+                "the refusal must happen before anything spawns — no pane, no process");
+    }
+
    @Test
    void aFreshSpawnCarriesNoSessionFlag(@TempDir Path root) {
        FakeHerdr herdr = new FakeHerdr();
@@ -348,25 +397,59 @@ class OpenCodeLauncherTest {

    @Test
    void theHandleDiscoversTheSessionIdForTheWorkersCwdOnlyAfterItAppears(@TempDir Path root,
-                                                                          @TempDir Path discRoot)
+                                                                          @TempDir Path discRoot,
+                                                                          @TempDir Path worktree)
            throws Exception {
+        markAsProvisionedWorktree(worktree);
        FakeHerdr herdr = new FakeHerdr();
        OpenCodeLauncher launcher = new OpenCodeLauncher(new AgentControl(herdr),
                new WorkspaceControl(herdr), Map.of("gemini", opencodeCfg(null, null, null)),
                "gemini", _ -> null, 0, System::currentTimeMillis, () -> { }, root, discRoot);

-        PeerHandle handle = launcher.spawn(new SpawnRequest(null, "/work/dir", null));
+        PeerHandle handle = launcher.spawn(new SpawnRequest(null, worktree.toString(), null));

        // opencode writes the record only when the session is first persisted — the instant the
        // pane is ready it does not exist, so agentSessionId() is null (never a spawn failure).
        assertNull(handle.agentSessionId(), "no record yet → null, not a spawn-time block");
        // Once the record appears (here: same cwd), lazy discovery resolves it — the handle's
        // session id matches its own worktree, not another's.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_resolved", "/work/dir", 1000L);
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_resolved", worktree.toString(), 1000L);
        assertEquals("ses_resolved", handle.agentSessionId(),
                "agentSessionId() re-scans and picks up a record that has since been written");
    }

+    /**
+     * fleetd #249 acceptance criterion 1, exercised through the real caller path (the handle
+     * {@code fleet_list} actually reads), not {@link OpenCodeSessionDiscovery} directly. Without a
+     * fleetd-provisioned worktree the member's cwd is shared — the default no-worktree spawn
+     * inherits the lead's own long-lived cwd — so even once a matching row appears (here:
+     * simulating another profile's session that happens to share the directory) the handle must
+     * report absence rather than guess. Measured real-world case (2026-09-03): the row it would
+     * otherwise pick was three days old and belonged to a different profile.
+     */
+    @Test
+    void theHandleNeverReportsAnIdForANonProvisionedCwdEvenAfterARowAppears(@TempDir Path root,
+                                                                             @TempDir Path discRoot)
+            throws Exception {
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = new OpenCodeLauncher(new AgentControl(herdr),
+                new WorkspaceControl(herdr), Map.of("gemini", opencodeCfg(null, null, null)),
+                "gemini", _ -> null, 0, System::currentTimeMillis, () -> { }, root, discRoot);
+        // No markAsProvisionedWorktree — this cwd has no .git file, the shared-cwd shape a
+        // no-worktree spawn (or a real checkout) actually has.
+        String sharedCwd = root.resolve("shared-cwd").toString();
+
+        PeerHandle handle = launcher.spawn(new SpawnRequest(null, sharedCwd, null));
+
+        assertNull(handle.agentSessionId(), "no record yet → null, same as the provisioned case");
+        // A row for this exact directory now appears — e.g. a sibling member, or a stale session
+        // from days earlier, sharing the same unprovisioned cwd.
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_someone_elses", sharedCwd, 1000L);
+        assertNull(handle.agentSessionId(),
+                "a non-provisioned cwd must NEVER report an id, even once a row for it exists — "
+                        + "the row could belong to any other session sharing this directory");
+    }
+
    @Test
    void foreignWorkerMatchesOpencodePrefixButNotClaude() {
        String nonce = "abc123";
@@ -920,6 +1003,7 @@ class OpenCodeLauncherTest {
    @Test
    void theRealSessionManagerLateResolvePathCatchesAModelMismatch(@TempDir Path configRoot,
                                                                     @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        FakeHerdr herdr = new FakeHerdr();
        // xf's real shape (fleetd #175): weight:80, model "opencode/nemotron-3-ultra-free", no
        // credentialId — the profile that actually escaped the fleet's accounting.
@@ -929,7 +1013,7 @@ class OpenCodeLauncherTest {
        OpenCodeLauncher launcher = serviceWithSink(herdr, configRoot, discRoot, cfg, sink);

        SessionManager sessions = new SessionManager(launcher);
-        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);

        // Real late-resolve path, driven BEFORE opencode has written its session row — same shape
        // as production the instant a pane goes ready.
@@ -940,7 +1024,7 @@ class OpenCodeLauncherTest {

        // opencode writes its row late, running gpt-5.6-sol (a PAID credential) instead of the
        // withdrawn free model the profile actually asked for — the exact fleetd #175 scenario.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");

        // Drive the SAME real late-resolve path again: sessions.get() -> resolveAgentSessionId ->
@@ -959,12 +1043,13 @@ class OpenCodeLauncherTest {
    @Test
    void aProviderPrefixedModelMatchingBothIdAndProviderIsNotAMismatch(@TempDir Path configRoot,
                                                                        @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-terra\",\"providerID\":\"openai\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -975,12 +1060,13 @@ class OpenCodeLauncherTest {
    @Test
    void aGxProviderPrefixedModelMatchingBothIdAndProviderIsNotAMismatch(@TempDir Path configRoot,
                                                                          @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("gx/deepseek-v4-flash", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -997,12 +1083,13 @@ class OpenCodeLauncherTest {
    @Test
    void aMissingProviderIdInTheEvidenceIsUnknownNotAMismatchWhenTheIdMatches(
            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-terra\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -1018,12 +1105,13 @@ class OpenCodeLauncherTest {
    @Test
    void aMissingProviderIdInTheEvidenceStillCatchesARealIdMismatch(
            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-sol\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -1042,12 +1130,13 @@ class OpenCodeLauncherTest {
    @Test
    void aBareModelWithNoProviderPrefixMatchesOnIdAloneAndIsNotAMismatch(@TempDir Path configRoot,
                                                                          @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("deepseek-v4-flash", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -1064,6 +1153,7 @@ class OpenCodeLauncherTest {
    @Test
    void aRealIdMismatchLogsAnErrorNamingBothModelsAndQuarantinesThroughTheSink(
            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(target + "|" + reason);
        FleetConfig.Profile cfg = opencodeCfg("opencode/nemotron-3-ultra-free", null, null);
@@ -1075,8 +1165,8 @@ class OpenCodeLauncherTest {
        PeerHandle handle;
        try {
            handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                    .spawn(new SpawnRequest(null, "/work/dir", null));
-            OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                    .spawn(new SpawnRequest(null, workDir, null));
+            OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                    "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
            assertEquals("ses_x", handle.agentSessionId());
        } finally {
@@ -1111,11 +1201,12 @@ class OpenCodeLauncherTest {
    @Test
    void unknownOrUnparseableModelEvidenceNeverQuarantines(@TempDir Path configRoot,
                                                             @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
+                .spawn(new SpawnRequest(null, workDir, null));

        // No row yet at all.
        assertNull(handle.agentSessionId());
@@ -1137,12 +1228,13 @@ class OpenCodeLauncherTest {
    @Test
    void aProfileWithNoConfiguredModelIsNeverCheckedForAMismatch(@TempDir Path configRoot,
                                                                  @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg(null, null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"anything-at-all\",\"providerID\":\"anyone\"}");

        assertEquals("ses_x", handle.agentSessionId());
@@ -1166,21 +1258,22 @@ class OpenCodeLauncherTest {
    @Test
    void modelCheckReadsTheResolvedSessionsOwnRowNotWhateverIsNewestInTheSharedDirectory(
            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        List<String> exhausted = new ArrayList<>();
        ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
        FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
        PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
+                .spawn(new SpawnRequest(null, workDir, null));

        // Our own session's row, correctly matching the profile's requested model.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_ours", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_ours", workDir, 1000L,
                "{\"id\":\"gpt-5.6-terra\",\"providerID\":\"openai\"}");
        assertEquals("ses_ours", handle.agentSessionId(), "resolves to our own session");
        assertTrue(exhausted.isEmpty(), "matching model → no mismatch on first resolve: " + exhausted);

        // A sibling member, spawned later into the SAME shared directory (no worktree, fleetd
        // #234's default), writes a newer row running a totally different model.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_sibling", "/work/dir", 9000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_sibling", workDir, 9000L,
                "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");

        assertEquals("ses_ours", handle.agentSessionId(),
@@ -1212,6 +1305,7 @@ class OpenCodeLauncherTest {
    @Test
    void aSpawnTimeModelMismatchActuallyQuarantinesTheCredentialThroughTheRealAcquirePath(
            @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        FleetConfig.Profile cfg = opencodeCfgWithCredential(
                "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
        Map<String, FleetConfig.Profile> profiles = Map.of(cfg.profile(), cfg);
@@ -1232,14 +1326,14 @@ class OpenCodeLauncherTest {

        // The mismatching row exists BEFORE the spawn — reproducing fleetd #234's exact timing:
        // opencode's session table already carries evidence by the moment acquire() first asks.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");

        assertFalse(quarantine.isQuarantined("openai-shared"), "nothing quarantined before the spawn");

        // The real production entrypoint: acquire() builds the MemberSession by calling
        // handle.agentSessionId() BEFORE registry.put() runs.
-        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);

        assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
        assertTrue(quarantine.isQuarantined("openai-shared"),
@@ -1258,6 +1352,7 @@ class OpenCodeLauncherTest {
    @Test
    void aRosterOnlySinkSilentlyDropsTheSpawnTimeQuarantine(@TempDir Path configRoot,
                                                              @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        FleetConfig.Profile cfg = opencodeCfgWithCredential(
                "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.SECONDS.toNanos(1800));
@@ -1270,10 +1365,10 @@ class OpenCodeLauncherTest {
        OpenCodeLauncher launcher = serviceWithSink(herdr, configRoot, discRoot, cfg, rosterOnlySink);
        SessionManager sessions = new SessionManager(launcher);

-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");

-        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);

        assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
        assertFalse(quarantine.isQuarantined("openai-shared"),
@@ -1301,6 +1396,7 @@ class OpenCodeLauncherTest {
    @Test
    void theSpawnTimeQuarantineSurvivesTheFleetdStyleForwardingHop(@TempDir Path configRoot,
                                                                     @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
        FleetConfig.Profile cfg = opencodeCfgWithCredential(
                "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
        Map<String, FleetConfig.Profile> profiles = Map.of(cfg.profile(), cfg);
@@ -1332,12 +1428,12 @@ class OpenCodeLauncherTest {
        };
        exhaustionSinkRef.set(realSink);

-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");

        assertFalse(quarantine.isQuarantined("openai-shared"), "nothing quarantined before the spawn");

-        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);

        assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
        assertTrue(quarantine.isQuarantined("openai-shared"),
@@ -22,8 +22,34 @@
 #     A prefix of a short secret is most of the secret, and it would end up pasted into a ticket. The
 #     hash answers every question the prefix was for — is it set, is it the same value as over there,
 #     is it the CB-592 sentinel — and answers none of the ones it should not.
-#   * It never writes anywhere, never contacts the network, and never touches secrets.sh, which is
-#     the operator's file.
+#   * It never writes anywhere, never contacts the network except the daemon's own REST port (see
+#     below), and never touches secrets.sh, which is the operator's file.
+#
+# WHERE THE NAME LIST COMES FROM (fleetd #111 / CB-608)
+#
+# Earlier versions of this script carried their own hardcoded NAMES array, recorded by hand on
+# 2026-08-16. The live memberCredentials: policy in fleetd.yaml grew past that list, and this probe
+# never noticed — it kept checking the same 31 names, printed a clean-looking table, and exited 0.
+# A verification tool that silently under-reports the thing it verifies is worse than no tool at
+# all, because its "clean" output gets taken as proof rather than treated with the suspicion an
+# absent tool would get.
+#
+# The fix is the same one #114 used for the drifted tool catalogue: delete the hand-maintained copy
+# rather than update it. This script now fetches the policy's name list from the daemon itself, at
+# `GET /member-credentials` (dev.ltms.fleet.member.MemberCredentialPolicyView via FleetApp) — names
+# and counts only, the same way the daemon's own startup log line is computed, from the SAME class.
+# If fleetd adds a name to memberCredentials.known tomorrow, this probe checks it tomorrow too,
+# with no edit here required. There is no local fallback list. See fetch_policy() below for what
+# happens when the daemon cannot be reached — it is a hard failure, on purpose (see next section).
+#
+# WHY AN UNREACHABLE DAEMON IS A HARD FAILURE, NOT A DEGRADED RUN
+#
+# An empty (or short) name list passes every subset check trivially — a probe that checked zero
+# names would print "0 of 0 names are set" and look identical to a clean bill of health. That trap
+# has bitten this project twice in one week (see docs/memory — "silent defaults disable features"
+# and "a test on the seam does not prove the caller"). So the denominator is guarded explicitly:
+# this script refuses to proceed unless it got a policy with at least one known name, and it refuses
+# just as hard if the count it fetched does not match the count it is about to check.
 #
 # HOW TO RUN IT
 #
@@ -32,34 +58,22 @@
 #   2. For the comparison row, in your OWN shell — a lead, not a member:
 #        bash scripts/probe-member-credentials.sh --allow-outside-member
 #
+# Both readings need the daemon's REST port reachable (default http://127.0.0.1:8765; override with
+# FLEETD_HOST). That is normally true in every pane this script is meant to run in.
+#
 # The two outputs side by side are the finding: any name whose hash matches between them is a
 # credential the member holds in full.
 #
 set -uo pipefail

-# The names ${SHARED_ENV}/tools/secrets.sh exports, recorded on 2026-08-16 (issue #82). Names only —
-# this list contains no values and never should. If secrets.sh gains a name, this list goes stale and
-# the probe silently stops asking about it; that staleness is itself part of what #82's criterion 4
-# has to solve, so it is called out in the summary rather than hidden.
-NAMES=(
-  AI_GATEWAY_TOKEN BESZEL_ADMIN_EMAIL BESZEL_ADMIN_PASSWORD
-  BESZEL_HUB_URL BESZEL_KEY BESZEL_UNIVERSAL_TOKEN
-  BRAIN_MCP_TOKEN CF_ACCOUNT_ID CF_API_TOKEN
-  CF_USER_TOKEN CONFLUENCE_API_TOKEN CONFLUENCE_USERNAME
-  CONTEXT7_TOKEN GITEA_HOST GITLAB_OAUTH_CLIENT_SECRET
-  GITLAB_PERSONAL_ACCESS_TOKEN GRAFANA_ADMIN_PASSWORD GRAFANA_ADMIN_USER
-  HASS_TOKEN HW_PASSWORD HW_USER
-  LTMS_API_KEY MEMORY_MCP_TOKEN METRICS_PUSH_TOKEN
-  OPENCODE_AUTOMODE_MODEL TELEGRAM_BOT_TOKEN TELEGRAM_CHAT_ID
-  TS_API_KEY TS_AUTHKEY WORKER_GITEA_TOKEN
-  GITEA_ACCESS_TOKEN
-)
+FLEETD_HOST="${FLEETD_HOST:-http://127.0.0.1:8765}"
+POLICY_URL="${FLEETD_HOST%/}/member-credentials"

 allow_outside=0
 for arg in "$@"; do
  case "$arg" in
    --allow-outside-member) allow_outside=1 ;;
-    -h|--help) sed -n '2,40p' "$0"; exit 0 ;;
+    -h|--help) sed -n '2,60p' "$0"; exit 0 ;;
    *) echo "unknown argument: $arg" >&2; exit 2 ;;
  esac
 done
@@ -75,6 +89,107 @@ EOF
  exit 1
 fi

+# --- fetch the policy from the daemon (fleetd #111) — no local fallback, ever ------------------
+#
+# Prefer jq (a real JSON parser); fall back to python3 (present on every host this has run on so
+# far); if neither exists, fail loudly rather than guess at the JSON with grep/sed, which is exactly
+# the kind of "looks like it worked" degradation this ticket exists to remove.
+#
+# NOTE: jq's `//` alternative operator treats `false` AND `0` as "missing" and substitutes the
+# default — so `.present // empty` silently turns a real `"present": false` into an empty string
+# ("unknown"), not the false it actually is. Every extraction below reads its field directly
+# instead, so a genuine false/0 is reported as exactly that, not swallowed into "unknown".
+if ! command -v jq >/dev/null 2>&1 && ! command -v python3 >/dev/null 2>&1; then
+  echo "refusing to run: neither jq nor python3 is on PATH, and this probe will not guess at JSON" \
+       "with grep/sed. Install one of them, or run from a shell that has one." >&2
+  exit 1
+fi
+
+POLICY_JSON="$(curl -fsS --max-time 5 "$POLICY_URL" 2>/dev/null)"
+CURL_STATUS=$?
+if [ "$CURL_STATUS" -ne 0 ] || [ -z "$POLICY_JSON" ]; then
+  cat >&2 <<EOF
+refusing to run: could not fetch the memberCredentials policy from $POLICY_URL (curl exit $CURL_STATUS).
+
+This probe has NO built-in name list any more (fleetd #111) — it only checks what the live daemon
+reports, so an unreachable daemon means it cannot check anything at all. It will not fall back to a
+guessed or empty list, because an empty list would pass every check trivially and look clean.
+
+Fix: confirm fleetd is up (curl \${FLEETD_HOST:-http://127.0.0.1:8765}/healthz) and that
+FLEETD_HOST (if set) points at it, then re-run.
+EOF
+  exit 1
+fi
+
+# One parse pass: line 1 = present (true/false/null), line 2 = policy mode (possibly blank),
+# lines 3-5 = knownCount/allowedCount/blockedCount, remaining lines = the known[] names. A single
+# pass avoids re-parsing (and re-risking a truthiness bug) five separate times.
+if command -v jq >/dev/null 2>&1; then
+  mapfile -t _FIELDS < <(printf '%s' "$POLICY_JSON" | jq -r '
+      (.present | tostring),
+      (.policy // ""),
+      (.knownCount // 0 | tostring),
+      (.allowedCount // 0 | tostring),
+      (.blockedCount // 0 | tostring),
+      (.known[]? // empty)')
+else
+  mapfile -t _FIELDS < <(printf '%s' "$POLICY_JSON" | python3 - <<'PY'
+import json, sys
+data = json.load(sys.stdin)
+print(str(data.get("present")))
+print(data.get("policy") or "")
+print(data.get("knownCount") if data.get("knownCount") is not None else 0)
+print(data.get("allowedCount") if data.get("allowedCount") is not None else 0)
+print(data.get("blockedCount") if data.get("blockedCount") is not None else 0)
+for n in (data.get("known") or []):
+    print(n)
+PY
+  )
+fi
+
+PRESENT="${_FIELDS[0]:-null}"
+POLICY_MODE="${_FIELDS[1]:-}"
+KNOWN_COUNT_REPORTED="${_FIELDS[2]:-0}"
+ALLOWED_COUNT_REPORTED="${_FIELDS[3]:-0}"
+BLOCKED_COUNT_REPORTED="${_FIELDS[4]:-0}"
+NAMES=("${_FIELDS[@]:5}")
+
+# knownCount must be a plain non-negative integer for the arithmetic guard below — a malformed or
+# unparseable response must fail loudly, not be coerced into a number that happens to compare true.
+case "$KNOWN_COUNT_REPORTED" in
+  ''|*[!0-9]*)
+    echo "refusing to run: knownCount in the response ('$KNOWN_COUNT_REPORTED') is not a plain" \
+         "non-negative integer — the response could not be parsed as expected." >&2
+    exit 1
+    ;;
+esac
+
+# --- guard the denominator explicitly — never proceed on a zero/short count ---------------------
+#
+# This is the exact trap named in the ticket: an empty (or truncated) NAMES array passes every
+# subsequent "is it set" check vacuously and prints a table that LOOKS complete. So this is checked
+# before anything else runs, with a message that says why, not just that it failed.
+if [ "${#NAMES[@]}" -eq 0 ] || [ "$KNOWN_COUNT_REPORTED" -eq 0 ]; then
+  cat >&2 <<EOF
+refusing to run: the policy fetched from $POLICY_URL contains 0 known names (present=${PRESENT:-unknown}).
+
+Either memberCredentials: is absent/empty on the running daemon (nothing is protected — see fleetd's
+own startup warning), or the response could not be parsed. Either way, checking zero names would
+print a clean-looking table for a policy that protects nothing, or for a probe that read nothing.
+This is refused rather than reported as a pass.
+EOF
+  exit 1
+fi
+
+if [ "${#NAMES[@]}" -ne "$KNOWN_COUNT_REPORTED" ]; then
+  cat >&2 <<EOF
+refusing to run: the policy reports knownCount=$KNOWN_COUNT_REPORTED but the known[] array this probe
+parsed has ${#NAMES[@]} entries. That mismatch means the JSON was not parsed correctly, and this
+probe will not check a name list it cannot trust to be complete.
+EOF
+  exit 1
+fi
+
 # Prefer sha256sum (Linux), fall back to shasum (macOS). If neither exists, report presence and
 # length only — degraded, but never a value.
 hasher=""
@@ -95,12 +210,13 @@ else
  where="NOT a member — comparison reading only"
 fi

-echo "CB-596 credential probe"
+echo "CB-596 credential probe (fleetd #111: names sourced live from $POLICY_URL)"
 echo "reading from : $where"
 echo "shell        : ${SHELL:-unknown}"
 echo "hash         : ${hasher:-none available — lengths only}"
 # Only printed so the two readings can be told apart when they are pasted side by side.
 echo "host         : $(hostname 2>/dev/null || echo unknown)"
+echo "policy       : mode=${POLICY_MODE:-unknown} known=$KNOWN_COUNT_REPORTED allowed=${ALLOWED_COUNT_REPORTED:-?} blocked=${BLOCKED_COUNT_REPORTED:-?}"
 echo
 printf '%-30s %-7s %6s  %s\n' "NAME" "STATE" "LEN" "SHA256-12"
 printf '%-30s %-7s %6s  %s\n' "------------------------------" "-------" "------" "------------"
@@ -118,6 +234,7 @@ done

 echo
 echo "$set_count of ${#NAMES[@]} names are set in this shell."
+echo "policy contains $KNOWN_COUNT_REPORTED name(s); this run checked ${#NAMES[@]} — they match."
 echo
 cat <<'EOF'
 How to read this:
@@ -129,7 +246,8 @@ How to read this:
    most urgent thing on this page.
  * AI_GATEWAY_TOKEN matching is expected and correct, not a leak: fleetd.yaml names it in
    `tokenEnv:` for the local and gx profiles, so a member reaching the gateway is by design.
-  * A name that is set here but is NOT in the list above will not appear at all. The list was
-    recorded on 2026-08-16 and does not update itself. Anything added to secrets.sh since then is
-    invisible to this probe — which is the same gap issue #82 criterion 4 asks to close properly.
+  * The name list above is fetched live from the running daemon's memberCredentials: policy
+    (fleetd #111) — it is never hand-maintained here, so it cannot go stale the way the old
+    hardcoded list did. If the daemon's policy changes, the next run of this script reflects it
+    with no edit to this file.
 EOF
Author	SHA1	Message	Date
Dai Ha	51f7b0a3ca	fleetd #111 : probe reads the live memberCredentials policy, no hardcoded name list CI / contract (pull_request) Successful in 1m24s Details CI / build (pull_request) Successful in 2m22s Details scripts/probe-member-credentials.sh carried its own hand-maintained NAMES array (31 names, recorded 2026-08-16), so a name added later to fleetd.yaml's memberCredentials.known was never checked and the probe still exited 0 with a clean-looking table. Same drift shape as #114's tool catalogue. - New dev.ltms.fleet.member.MemberCredentialPolicyView: the single place that turns a MemberCredentials policy into names + counts (never a value). Reused by Fleetd.reportMemberCredentialsGap (startup log line) and by the new GET /member-credentials REST endpoint (FleetApp), so the two can no longer drift apart the way the probe and the policy did. - FleetApp gains one route + handler + a Supplier<MemberCredentialPolicyView> constructor param (legacy constructors default to ::absent, so existing call sites are unaffected). - probe-member-credentials.sh now fetches its name list from GET /member-credentials instead of carrying one. No local fallback: an unreachable daemon, an empty/absent policy, or a knownCount/known[] length mismatch all refuse with a non-zero exit rather than silently checking zero names. Prints "policy contains N; this run checked N" so the two numbers are visibly equal.	2026-09-03 13:21:35 +07:00
Dai Ha	01a840cc14	#248 follow-up: drive the real backendErrorSink, not a copy of it CI / contract (push) Successful in 1m16s Details CI / build (push) Successful in 1m29s Details BackendOutageFlowTest held a ~30-line hand-copy of the lambda in Fleetd.main, under a comment promising it mirrored production "EXACTLY". That promise was the defect. The test proved the copy, so any change to the real sink left the flow test green. #248 made Fleetd.backendErrorSink(...) public for exactly this reason. The test now calls it. Measured, same mutation in the real sink (an early return after sessions.onBackendError, dropping the cool-off and the lead nudge): old test (hand-copy): Tests run: 5, Failures: 0 -- blind new test (real sink): Tests run: 5, Failures: 4 -- catches it 0 compile errors in both runs, so both are real results. Production reverted and confirmed with diff -q. Full build: 1234 tests, 0 failures, 0 compile errors.	2026-09-03 13:06:11 +07:00
Dai Ha	c4deef08be	fleetd #249 : withhold agentSessionId when the cwd is not a provisioned worktree CI / contract (push) Successful in 1m22s Details CI / build (push) Successful in 1m22s Details A member spawned without a worktree inherits the lead's cwd, which holds many old opencode session rows. sessionIdForDirectory picks the most recently updated row for that directory, so a brand-new member - which has not written its own row yet - resolves to somebody else's session. Measured: a row three days old, from a different profile. The damage was at the tool surface. fleet_list told the lead that agentSessionId is the id to pass as resumeSessionId, so acting on it would resume a stranger's conversation, with foreign context, and nothing to distinguish that from a correct resume. Fixed by refusing to answer rather than by making the heuristic smarter. #234 already established the heuristic cannot be made reliable at that layer, and its javadoc records why, so the SQL is untouched. agentSessionId() now returns null for a non-provisioned cwd, and spawn() refuses a resumeSessionId request for one outright, before anything starts. isProvisionedWorktree moved to HerdrPeerLauncher so both adapters share it. fleet_list and fleet_spawn descriptions no longer describe the id as always safe to resume. Verified rather than taken on trust: - the refusal reaches the lead as a readable message, not a stack trace - FleetMcp.spawn already catches IllegalArgumentException and returns error(e.getMessage()). - the message tells the lead to pass fleet_spawn{worktree:<slug>}, which is valid: worktree is typed string, 'true' or a ticket slug. - 13 existing tests moved off a placeholder "/work/dir" onto a real provisioned-worktree fixture. They cover #175/#234 model-mismatch machinery and would otherwise have tripped the new gate incidentally. Worker's mutation evidence, both reverted and diff-confirmed: - gate at OpenCodeLauncher:812 -> if(false): RED at OpenCodeLauncherTest:448, expected <null> but was <ses_someone_elses>. - resume refusal at OpenCodeLauncher:683 -> 'false &&': RED at OpenCodeLauncherTest:379, expected IllegalArgumentException. Both 0 compile errors. Closes #249. PR #253.	2026-09-03 12:55:29 +07:00
Dai Ha	e897e5257b	fleetd #114 : delete the drifted tool catalogue, keep the flows, guard the names CI / contract (push) Successful in 51s Details CI / build (push) Successful in 1m42s Details docs/MCP-Contract.md was written 2026-07-14, before any MCP code existed, and never caught up. CLAUDE.md points every session in the fleet at it. Audited against the code today. The drift was not confined to the tool table the ticket reported: section 3 still described the OLD identity rule - "any connection that does not map to a known worker is treated as a primary". That was a real privilege bug, fixed since by the ancestry walk in #161. The page still taught it. section 4 names port 8080 (the mount is 8765) and says the pom does not yet carry an MCP dependency. section 5 named fleet_read and fleet_cancel, which do not exist, and omitted fleet_poll, fleet_ack, fleet_profiles, fleet_whoami and fleet_list, which do. section 8 says turn_id where the code says turnId, and has no row for the exhausted outcome CB-578 added. sections 9, 10, 11 pre-build planning: "new work" columns, open decisions long since decided, CB-1xx placeholders. Every one of those is the same defect: a hand-maintained second copy of something the code already states. So the copy is deleted rather than corrected - correcting it just restarts the clock. What survives is the flows and the status gating, because a flow is a shape rather than a name, and shapes are what this page was ever good for. They are rewritten with the names checked against the code, and extended with what has been learned since: the ~60s cap on a blocking send, the ~55s ask window, and the three ways the turn-done fallback loses a report (clipped, echoed brief, slow member). 389 lines -> 188. The names that remain are guarded. McpContractDocTest fails if the page names a fleet_* tool FleetMcp does not register, and - because an empty set is a subset of everything - a second test pins that both sides actually found names, so the check cannot pass by checking nothing. A third pins the "this is not the tool reference" sentence, which is the fix itself: without it someone helpfully re-adds a tool table. Mutation-tested both ways, 0 compile errors each: adding `fleet_read` to the doc fails theDocNamesNoToolThatDoesNotExist ("names [fleet_read] ... Checked 6 name(s)"); removing the disclaimer fails theDocStillDisclaimsBeingTheToolReference. All 5 mermaid diagrams render under mermaid-cli. CLAUDE.md's pointer said "section 6 only" and now names the guard instead. It is in the project addendum, so the canonical block is untouched - verified still byte-identical with the wiki template. REST is split out to #252: 14 routes, documented nowhere, and it IS a supported operator surface - one of them drains on read. 1232 tests, 0 failures.	2026-09-03 12:52:12 +07:00
Dai Ha	2afa3652bb	fleetd #249 : withhold agentSessionId for a non-provisioned opencode cwd CI / contract (pull_request) Successful in 54s Details CI / build (pull_request) Successful in 1m52s Details OpenCodeSessionDiscovery.sessionIdForDirectory keys on the worker's cwd, which is reliable only when fleetd provisioned a unique git worktree for that member. Without one (the default no-worktree spawn), the cwd is shared with other sessions, and "most recently updated row for this directory" can pick a stranger's session — fleet_list would then hand a lead an agentSessionId that resumes someone else's conversation. Move isProvisionedWorktree from ClaudeCodeLauncher to the shared HerdrPeerLauncher base (both adapters need it now). OpenCodeLauncher.spawn now refuses a resumeSessionId spawn outright when the target cwd is not a provisioned worktree (fleetd can never verify or re-report that identity), and SessionAwareHandle.agentSessionId() withholds the id — returns null rather than guessing — for any member spawned without one, resumed or not. Corrected fleet_list/fleet_spawn's tool descriptions, which previously implied agentSessionId is always a safe resume handle.	2026-09-03 12:51:56 +07:00
Dai Ha	80092ff359	fleetd #247 : stop writing a trust key Claude Code strips on every save CI / contract (push) Successful in 1m26s Details CI / build (push) Successful in 1m28s Details seedTrustDialog wrote two keys into the shared .claude.json: hasTrustDialogAccepted and hasCompletedProjectOnboarding. Only the first one survives. Measured live on 2026-09-03, minutes after a spawn seeded the file: hasTrustDialogAccepted: 28 of 28 project entries hasCompletedProjectOnboarding: 0 of 28 project entries Our entry was written by the running jar and the key was already gone, so it was written and then removed. It is absent from the 27 entries Claude Code wrote for itself too, which says Claude Code normalises the whole file when it saves and drops that key every time. That reframes #247. I filed it as a race - a save landing between our read and our ATOMIC_MOVE. It is not a race. The other writer removes this key as its steady-state behaviour, with no window involved. So the compare-and-swap retry proposed there would not have helped: it would re-add a key that gets stripped again on the next save. The seed's whole job is to stop the workspace-trust dialog blocking a member (#149). The live probe reached idle with hasTrustDialogAccepted alone, so the second key was never doing that job. Writing it only added a contested key to a file two processes share, and made the next reader think it mattered. The atomic write and the lock stay. Both are still correct, both are cheap, and hasTrustDialogAccepted is genuinely shared state. The new assertion is assertFalse, not a deletion. Removing the old assertion would leave nothing to stop someone re-adding the key later as a plausible-looking completeness fix. Mutation-tested: restoring the production line fails seedTrustDialogWritesOnlyTheTrustFlagAndNotTheOnboardingKey:2198 with 0 compile errors. 1229 tests, 0 failures.	2026-09-03 12:41:20 +07:00