fleetd #249: withhold agentSessionId for a non-provisioned opencode cwd

OpenCodeSessionDiscovery.sessionIdForDirectory keys on the worker's cwd, which
is reliable only when fleetd provisioned a unique git worktree for that
member. Without one (the default no-worktree spawn), the cwd is shared with
other sessions, and "most recently updated row for this directory" can pick a
stranger's session — fleet_list would then hand a lead an agentSessionId that
resumes someone else's conversation.

Move isProvisionedWorktree from ClaudeCodeLauncher to the shared
HerdrPeerLauncher base (both adapters need it now). OpenCodeLauncher.spawn now
refuses a resumeSessionId spawn outright when the target cwd is not a
provisioned worktree (fleetd can never verify or re-report that identity), and
SessionAwareHandle.agentSessionId() withholds the id — returns null rather
than guessing — for any member spawned without one, resumed or not. Corrected
fleet_list/fleet_spawn's tool descriptions, which previously implied
agentSessionId is always a safe resume handle.

fleetd/fleetd.example.yaml

@@ -306,35 +306,6 @@ profiles:
     #   GOTCHA 2 — `maxLoad` is the ONLY throttle you have here. There is no metering, no budget
     #   and no refusal on cost; the cap on live members is the single thing standing between a
     #   fan-out and your monthly limit. Set it deliberately and keep it small.
-    #
-    #   GOTCHA 3 (fleetd #176) — `maxLoad` counts members, never the lead itself. The lead is a live
-    #   `claude` session on this SAME account (a lead is never moved off-subscription, whatever its
-    #   own profile says), so it already holds one seat before any member spawns. If a lead's
-    #   `fleet.leaders.<name>.profile` names THIS profile — or ANY OTHER `subscription: true`
-    #   profile that shares this one's account (see THE SENTINEL, just below, next to
-    #   `credentialId:`) — `fleet_list`'s `free` for this profile subtracts that lead's live
-    #   seat(s) automatically; see `profile:` under THE FLEET below. If no lead entry names a
-    #   profile sharing this account, fleetd has no way to know a lead holds a seat here, and `free`
-    #   will overstate what a fresh `fleet_spawn` actually gets by exactly the seats the lead is
-    #   quietly holding.
-    #
-    #   THE SENTINEL (fleetd #176 stage 2, correcting an inert stage 1 fix): every `subscription:
-    #   true` profile that leaves `credentialId` unset shares ONE implicit account-wide credential
-    #   id with every other such profile on this host — because a subscription profile doesn't
-    #   authenticate with a credential of its own, it authenticates as the operator's own Claude
-    #   login, and there is exactly one of those. So on a typical host, `opus` (the lead's profile)
-    #   and `sonnet` (the members' profile) are linked automatically, with NOTHING to set here — that
-    #   is what makes GOTCHA 3 above work without also writing matching `credentialId:` values on
-    #   both. This linkage is not just cosmetic: it is the same key `BackendQuarantine`/cool-off use,
-    #   so a usage-limit hit on `opus` now quarantines `sonnet` too (and vice versa) — correct, since
-    #   they are one Claude account, but worth knowing before you wonder why an unrelated-looking
-    #   profile went quarantined.
-    #
-    #   WHEN TO OVERRIDE — set explicit, DIFFERENT `credentialId:` values on two `subscription: true`
-    #   profiles only when they are genuinely two separate Claude logins on the same host (a real,
-    #   if unusual, setup). An explicit `credentialId` always wins over the sentinel, so this is the
-    #   one way to keep two subscription profiles from being treated as one account for lead-seat
-    #   counting AND for quarantine/cool-off grouping alike.
     # gitTokenEnv: GITEA_TOKEN        # opt-in: let this profile's workers open their own PR (CB-302)
     # gitHostEnv: GITEA_HOST          # defaults to GITEA_HOST; injected only with gitTokenEnv
     # exhaustedPattern: "usage limit has been reached"   # opt-in: classify a usage-limit refusal (CB-578)
@@ -532,22 +503,6 @@ fleet:
   # recognised: give it a `profile:` and the daemon launches the shortfall when fewer than
   # `instances` are live. Omit `profile:` and it is recognise-only, as before.
   #
-  # `profile:` has a SECOND job as of fleetd #176, even for a recognise-only lead you never want
-  # auto-launched: it is also how fleetd learns which account this lead's own session shares. A
-  # `subscription: true` profile bills the operator's Claude account, and the lead itself is always
-  # a live `claude` session on that same account — `maxLoad` never counted that seat. If a lead
-  # entry here names a profile that shares a worker profile's account, `fleet_list`'s `free` for
-  # that worker profile subtracts the lead's live seat(s) automatically. "Shares the account" is
-  # decided by matching `effectiveCredentialId()`, which (fleetd #176 stage 2 — see THE SENTINEL,
-  # next to `credentialId:`, in THE WORKERS above) means: an explicit, matching `credentialId:` on
-  # both, OR — the common case, needing NO extra config — both being `subscription: true` with
-  # `credentialId` left unset, since those all share one implicit account-wide id. A lead on `opus`
-  # and workers on `sonnet` link automatically this way; they do NOT need the same profile name.
-  # Setting `profile:` on an already-running, recognise-only lead is safe — the daemon only launches
-  # the SHORTFALL below `instances`, so naming a profile here does not, by itself, start anything.
-  # Omit it and fleetd has no way to derive the sharing — there is no other reliable signal on the
-  # daemon's side — so that lead's seat goes uncounted, exactly as before this ticket.
-  #
   # `tab:` (CB-579) is REQUIRED and is the only field identity depends on — the exact label of the
   # tab hosting the lead, matched case-insensitively. Label the tab yourself and put that same
   # string here, and the pane is recognised on the next rescan. Reopen the tab later, or the session

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -640,8 +640,7 @@ public final class Fleetd {
                 new FleetMcp.OutageSource(profile -> {
                     var configured = config.get().profiles().get(profile);
                     return configured == null ? null : configured.effectiveCredentialId();
-                }, outagePolicy),
-                new FleetMcp.LeadSeatSource(leadSeatLookup(() -> config.get().profiles(), leaders, leads)));
+                }, outagePolicy));
 
         // CB-637: the receive half. Only constructed when a lead mailbox actually opened — with no
         // coordinator (or an unreachable one) there is nothing to deliver, so no scheduler is
@@ -766,68 +765,6 @@ public final class Fleetd {
                 .orElse(null);
     }
 
-    /**
-     * fleetd #176: per-profile factory for {@link FleetMcp.LeadSeatSource} — how many seats a
-     * profile's own live LEAD session(s) hold on the same Claude subscription.
-     *
-     * <p>{@code maxLoad} counts only members; the lead itself is a live {@code claude} session that
-     * is never moved off-subscription ({@code LeadLauncher} strips {@code ANTHROPIC_BASE_URL}/
-     * {@code AUTH_TOKEN} from a lead's env whatever its profile says), so a {@code subscription:
-     * true} profile's real ceiling is lower than its configured {@code maxLoad} by exactly the
-     * number of lead seats sharing that same account.
-     *
-     * <p><b>The derivation, and why this route was chosen over a new config key.</b> The link is
-     * {@code fleet.leaders.<name>.profile} — the field the operator already sets to name which
-     * {@code profiles:} entry a lead runs on (CB-557; see {@code fleetd.example.yaml}) — matched
-     * against the profile passed in here via {@link FleetConfig.Profile#effectiveCredentialId()},
-     * the same grouping key {@link dev.ltms.fleet.placement.BackendQuarantine} already uses to say
-     * two profiles share one account. Nothing new is added to the config schema: this reuses a field
-     * that already exists and already means "the profile this lead's own session runs on". A lead
-     * entry that names no {@code profile:} (recognise-only, CB-558) says nothing about which account
-     * it shares, and there is no other reliable signal on the daemon's side to derive that from — so
-     * such a lead contributes no seats, exactly as before this ticket. Making that lead's seat count
-     * requires the operator to add one line (`profile: sonnet` under its {@code fleet.leaders} entry)
-     * — a config statement, not a code change, and the smallest one available given the field
-     * already exists for a closely related purpose.
-     *
-     * <p>Only counts leads {@code liveLeadTerminals} currently reports — CB-531's live tab scan (or
-     * the legacy {@code primary.terminal} pin) — never every configured lead: an entry whose
-     * {@code instances} nobody has actually started is not really competing for a seat, and must not
-     * shrink capacity for one that was never live.
-     *
-     * @param profiles          the live profile map, normally {@code () -> config.get().profiles()}
-     *                          in {@code main} — hot, like every other {@code maxLoad}/
-     *                          {@code credentialId} read {@link FleetMcp.CapacitySource} already does
-     * @param leaders           {@code fleet.leaders}, read once at startup like the rest of that
-     *                          block ({@code fleetd.example.yaml} notes it is not hot) — passed as a
-     *                          plain map, never re-read from {@code config.get()}
-     * @param liveLeadTerminals terminal_id → lead name for every CURRENTLY recognised lead, normally
-     *                          the same supplier {@link dev.ltms.fleet.auth.CallerResolver#leads()}
-     *                          and {@code LeadCoordLoop} already consult
-     */
-    static Function<String, Integer> leadSeatLookup(Supplier<Map<String, FleetConfig.Profile>> profiles,
-            Map<String, FleetConfig.Leader> leaders, Supplier<Map<String, String>> liveLeadTerminals) {
-        return profileName -> {
-            FleetConfig.Profile target = profiles.get().get(profileName);
-            if (target == null || !target.isSubscription()) {
-                return 0;
-            }
-            String targetCredential = target.effectiveCredentialId();
-            int seats = 0;
-            for (String leadName : liveLeadTerminals.get().values()) {
-                FleetConfig.Leader lead = leaders.get(leadName);
-                if (lead == null || lead.profile() == null || lead.profile().isBlank()) {
-                    continue;
-                }
-                FleetConfig.Profile leadProfile = profiles.get().get(lead.profile());
-                if (leadProfile != null && targetCredential.equals(leadProfile.effectiveCredentialId())) {
-                    seats++;
-                }
-            }
-            return seats;
-        };
-    }
-
     /**
      * fleetd #248 / fleetd#201 Unit 5: package-private factory for the per-target backend-error
      * pattern lookup {@link CompletionResolver} classifies a pane scrape against. Closes over the

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -644,46 +644,14 @@ public record FleetConfig(
         }
 
         /**
-         * The shared credential id every {@code subscription: true} profile falls back to when it
-         * sets no explicit {@link #credentialId} (fleetd #176 stage 2, correcting an inert first cut
-         * of that ticket). A subscription profile has no credential of its own to fall back to its
-         * name for: it authenticates as the operator's own Claude login, and a host has exactly one
-         * of those, whatever names the operator gives the profiles running on it. Falling back to the
-         * profile's own name (the way an ordinary off-subscription profile does) would keep two
-         * subscription profiles on one login apart from each other, which is the opposite of what
-         * "one account" means.
-         *
-         * <p>Measured live and what it broke: a lead on profile {@code opus}, members on profile
-         * {@code sonnet}, same Claude login, neither setting {@code credentialId}. Before this
-         * sentinel, {@code opus.effectiveCredentialId()} was {@code "opus"} and {@code sonnet
-         * .effectiveCredentialId()} was {@code "sonnet"} — so fleetd #176's lead-seat matcher (and,
-         * this sentinel now also fixes, {@code CompositePeerLauncher}'s quarantine/cool-off spawn
-         * refusal and {@code BackendOutagePolicy}'s incident grouping) silently never linked them: the
-         * fix shipped, and stayed inert on the one host it was written for.
-         */
-        public static final String SUBSCRIPTION_CREDENTIAL_ID = "<subscription>";
-
-        /**
-         * The credential group this profile quarantines with (CB-578 stage B; extended fleetd #176
-         * stage 2 — see {@link #SUBSCRIPTION_CREDENTIAL_ID}): the configured {@link #credentialId}
-         * when set — that always wins, so an operator with two separate Claude logins on one host can
-         * still keep them apart. Otherwise, a {@code subscription: true} profile falls back to
-         * {@link #SUBSCRIPTION_CREDENTIAL_ID} rather than its own name; an ordinary off-subscription
-         * profile falls back to its own name, exactly as it did before this field existed, so an
-         * unconfigured off-subscription profile still quarantines alone.
-         *
-         * <p>A {@code BACKEND_EXHAUSTED} (or repeated backend-error) classification on any profile
-         * sharing the result quarantines/cools off every profile that shares it — including, now,
-         * every {@code subscription: true} profile with no explicit {@code credentialId}. That is
-         * intended, not incidental: one Claude subscription hitting a usage limit really does take out
-         * every profile running on it, the same way {@code credentialId: openai-shared} already lets
-         * two OpenAI-backed profiles share one quarantine.
+         * The credential group this profile quarantines with (CB-578 stage B): the configured
+         * {@link #credentialId} when set, else this profile's own name — so an unconfigured profile
+         * quarantines alone, exactly as it did before this field existed. Two profiles that set the
+         * same non-blank {@code credentialId} share one quarantine: a {@code BACKEND_EXHAUSTED}
+         * classification on either one quarantines both.
          */
         public String effectiveCredentialId() {
-            if (credentialId != null && !credentialId.isBlank()) {
-                return credentialId;
-            }
-            return isSubscription() ? SUBSCRIPTION_CREDENTIAL_ID : profile;
+            return (credentialId == null || credentialId.isBlank()) ? profile : credentialId;
         }
 
         /** True when this profile's workers are granted a forge token to open their own PR (CB-302). */
@@ -978,15 +946,7 @@ public record FleetConfig(
      * survives restarts of the agent inside it — so identity is now the tab label alone.
      *
      * @param profile             the {@code profiles:} entry to launch this lead on when one must
-     *                            be created; {@code null} ⇒ recognise-only, never create.
-     *                            <p>fleetd #176: also the field {@code Fleetd.leadSeatLookup} reads
-     *                            to learn which account this lead's own live session shares — set it
-     *                            (safely, even on an already-running recognise-only lead: naming a
-     *                            profile here never starts anything beyond {@code instances}) so a
-     *                            {@code subscription: true} worker profile sharing its
-     *                            {@code effectiveCredentialId()} has this lead's seat subtracted from
-     *                            {@code fleet_list}'s {@code free}. {@code null} here also means this
-     *                            lead's seat cannot be derived and is not counted.
+     *                            be created; {@code null} ⇒ recognise-only, never create
      * @param tab                 the exact tab label hosting this lead, matched case-insensitively;
      *                            the only field identity depends on. Required — a lead with no
      *                            {@code tab} can never be discovered, launched or not

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -96,8 +96,6 @@ public final class FleetMcp {
     private final QuarantineSource quarantine;
     /** fleetd #201 Unit 5: SEPARATE from {@link #quarantine} — see {@link OutageSource}'s doc. */
     private final OutageSource outage;
-    /** fleetd #176: SEPARATE from both of the above — see {@link LeadSeatSource}'s doc. */
-    private final LeadSeatSource leadSeats;
     /** CB-637: this daemon's lead-to-lead channel; {@code null} when no coordinator is configured. */
     private final LeadChannel leadChannel;
 
@@ -137,24 +135,6 @@ public final class FleetMcp {
         }
     }
 
-    /**
-     * fleetd #176: the seats a profile's own live LEAD session(s) hold on the same Claude
-     * subscription — the third reason (alongside {@link QuarantineSource} and {@link OutageSource})
-     * {@code free} can overstate what a fresh {@code fleet_spawn} would actually get.
-     *
-     * <p>{@code maxLoad} counts only <em>members</em>, never the lead itself. But a
-     * {@code subscription: true} profile bills the operator's own Claude account, and the lead is
-     * always a live {@code claude} session on that same account (it is never moved off-subscription
-     * — see {@code LeadLauncher}). So a fan-out that fills every member slot still leaves the lead's
-     * own seat unaccounted for, and the daemon reports a slot that was never really free. See
-     * {@code Fleetd.leadSeatLookup} for how the count is derived — from {@code fleet.leaders.<name>
-     * .profile} and each profile's {@code effectiveCredentialId()}, never a hardcoded constant.
-     */
-    public record LeadSeatSource(Function<String, Integer> seatsFor) {
-        /** Inert source — no profile is ever reported as sharing a seat with a lead. */
-        public static LeadSeatSource none() { return new LeadSeatSource(_ -> 0); }
-    }
-
     /**
      * @param callers resolves each call's {@link Principal}; {@code null} disables authorization.
      *                This surface needs its own enforcement: {@code /mcp} is a raw servlet on
@@ -169,7 +149,7 @@ public final class FleetMcp {
                       CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
                       QuarantineSource quarantine) {
         this(messages, workers, sessions, identity, presence, primaryRegistry, callers, metrics, capacity,
-                healthCoverage, quarantine, null, OutageSource.none(), LeadSeatSource.none());
+                healthCoverage, quarantine, null, OutageSource.none());
     }
 
     /**
@@ -183,12 +163,12 @@ public final class FleetMcp {
                       CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
                       QuarantineSource quarantine, LeadChannel leadChannel) {
         this(messages, workers, sessions, identity, presence, primaryRegistry, callers, metrics, capacity,
-                healthCoverage, quarantine, leadChannel, OutageSource.none(), LeadSeatSource.none());
+                healthCoverage, quarantine, leadChannel, OutageSource.none());
     }
 
     /**
      * As above, with fleetd #201 Unit 5 cool-off facts for {@code fleet_list}/{@code fleet_profiles}
-     * (see {@link OutageSource}).
+     * (see {@link OutageSource}). This is what {@code Fleetd.main} actually wires up.
      *
      * @param outage required — pass {@link OutageSource#none()} for a caller that does not want the
      *               feature, never a defaulting overload (the same rule {@code quarantine} follows).
@@ -197,28 +177,10 @@ public final class FleetMcp {
                      ConnectionIdentity identity, MemberPresence presence, PrimaryRegistry primaryRegistry,
                       CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
                       QuarantineSource quarantine, LeadChannel leadChannel, OutageSource outage) {
-        this(messages, workers, sessions, identity, presence, primaryRegistry, callers, metrics, capacity,
-                healthCoverage, quarantine, leadChannel, outage, LeadSeatSource.none());
-    }
-
-    /**
-     * As above, with fleetd #176 lead-seat facts (see {@link LeadSeatSource}). This is what
-     * {@code Fleetd.main} actually wires up.
-     *
-     * @param leadSeats required — pass {@link LeadSeatSource#none()} for a caller that does not want
-     *                  the feature, never a defaulting overload (the same rule {@code quarantine} and
-     *                  {@code outage} follow).
-     */
-    public FleetMcp(MessageService messages, PeerLauncher workers, SessionManager sessions,
-                     ConnectionIdentity identity, MemberPresence presence, PrimaryRegistry primaryRegistry,
-                      CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
-                      QuarantineSource quarantine, LeadChannel leadChannel, OutageSource outage,
-                      LeadSeatSource leadSeats) {
         this.leadChannel = leadChannel;
         this.capacity = capacity;
         this.quarantine = Objects.requireNonNull(quarantine, "quarantine");
         this.outage = Objects.requireNonNull(outage, "outage");
-        this.leadSeats = Objects.requireNonNull(leadSeats, "leadSeats");
         this.healthCoverage = healthCoverage;
         McpJsonMapper json = new JacksonMcpJsonMapperSupplier().get();
         this.transport = HttpServletStreamableServerTransportProvider.builder()
@@ -348,7 +310,7 @@ public final class FleetMcp {
                     McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                     if (denied != null) return denied;
                     return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, outage,
-                            leadSeats, callers == null ? Map.of() : callers.leads(),
+                            callers == null ? Map.of() : callers.leads(),
                             callerTerminal(exchange),
                             leadChannel == null ? null : leadChannel.selfCoordId());
                 };
@@ -1032,8 +994,7 @@ public final class FleetMcp {
                                                CapacitySource capacity, HealthCoverageSource healthCoverage,
                                                QuarantineSource quarantine, OutageSource outage,
                                                Map<String, String> leads, String selfTerm) {
-        return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, outage,
-                LeadSeatSource.none(), leads, selfTerm, null);
+        return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, outage, leads, selfTerm, null);
     }
 
     /**
@@ -1050,7 +1011,7 @@ public final class FleetMcp {
                                                QuarantineSource quarantine, Map<String, String> leads, String selfTerm,
                                                String selfCoordId) {
         return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, OutageSource.none(),
-                LeadSeatSource.none(), leads, selfTerm, selfCoordId);
+                leads, selfTerm, selfCoordId);
     }
 
     /** As above, plus fleetd #201 Unit 5 cool-off facts (see {@link OutageSource}). */
@@ -1058,16 +1019,6 @@ public final class FleetMcp {
                                                CapacitySource capacity, HealthCoverageSource healthCoverage,
                                                QuarantineSource quarantine, OutageSource outage,
                                                Map<String, String> leads, String selfTerm, String selfCoordId) {
-        return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, outage,
-                LeadSeatSource.none(), leads, selfTerm, selfCoordId);
-    }
-
-    /** As above, plus fleetd #176 lead-seat facts (see {@link LeadSeatSource}). */
-    static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions, MessageService messages,
-                                               CapacitySource capacity, HealthCoverageSource healthCoverage,
-                                               QuarantineSource quarantine, OutageSource outage,
-                                               LeadSeatSource leadSeats, Map<String, String> leads, String selfTerm,
-                                               String selfCoordId) {
         try {
             Map<String, Agent> live = workers.list().stream()
                     .map(Agent.class::cast)
@@ -1094,7 +1045,7 @@ public final class FleetMcp {
             }
             if (capacity.available()) result.put("capacity", profiles.stream()
                     .map(profile -> capacityView(profile, capacity.liveCount(), capacity.maxLoad(), roster, messages,
-                            capacity.clock().getAsLong(), quarantine, outage, leadSeats)).toList());
+                            capacity.clock().getAsLong(), quarantine, outage)).toList());
             return text(json(result));
         } catch (HerdrException e) {
             return error("herdr error listing the fleet: " + e.getMessage());
@@ -1133,33 +1084,20 @@ public final class FleetMcp {
      * {@code credentialId}/{@code coolingOffForSeconds}, but never {@code quarantinedForSeconds} —
      * that key is added only when exhaustion quarantine is ALSO active for this profile, since the
      * two checks are independent and either, both, or neither can be true.
-     *
-     * <p>fleetd #176: {@code maxLoad} counts panes, not subscription seats — it never counted the
-     * lead's own seat on a {@code subscription: true} profile's account. {@link LeadSeatSource}
-     * reports that count (0 for a non-subscription profile, or when no live lead shares its
-     * credential), and it is subtracted from {@code free} the same way {@code live} already is —
-     * {@code maxLoad} itself is left untouched, so the row still reports the configured cap. The
-     * {@code leadSeats} key is added only when the count is positive, for the same
-     * byte-identical-when-unused reason as the quarantine/cool-off keys above.
      */
     private static Map<String, Object> capacityView(String profile, Function<String, Integer> liveCount,
                                                      Function<String, Integer> maxLoad, List<MemberSession> roster,
                                                      MessageService messages, long nowNanos, QuarantineSource quarantine,
-                                                     OutageSource outage, LeadSeatSource leadSeats) {
+                                                     OutageSource outage) {
         Integer cap = maxLoad.apply(profile);
         int live = liveCount.apply(profile);
-        int leadSeatCount = leadSeats.seatsFor().apply(profile);
         int reclaimable = (int) roster.stream().filter(s -> profile.equals(s.profile()))
                 .filter(s -> (s.state() == MemberSession.State.READY || s.state() == MemberSession.State.DONE))
                 .filter(s -> messages == null || (!messages.hasAcceptedDelivery(s.terminalId()) && !messages.hasInboxMessage(s.terminalId())))
                 .count();
         Map<String, Object> row = new LinkedHashMap<>();
         row.put("profile", profile); row.put("maxLoad", cap); row.put("live", live);
-        row.put("free", cap == null ? null : Math.max(0, cap - live - leadSeatCount));
-        row.put("reclaimable", reclaimable);
-        if (leadSeatCount > 0) {
-            row.put("leadSeats", leadSeatCount);
-        }
+        row.put("free", cap == null ? null : Math.max(0, cap - live)); row.put("reclaimable", reclaimable);
         String credentialId = quarantine.credentialIdFor().apply(profile);
         if (credentialId != null) {
             quarantine.quarantine().remainingSeconds(credentialId).ifPresent(remaining -> {
@@ -1315,7 +1253,11 @@ public final class FleetMcp {
                         + "worktree:<ticket-slug> to provision an isolated git worktree. Pass resumeSessionId "
                         + "to relaunch onto a prior conversation instead of starting cold — this requires an "
                         + "explicit profile whose backend supports it (fleet_list shows agentSessionId for "
-                        + "resumable members), and is refused otherwise rather than silently starting fresh. "
+                        + "resumable members; it is absent for a member fleetd cannot reliably re-identify, "
+                        + "e.g. an opencode member spawned without a worktree), and is refused otherwise "
+                        + "rather than silently starting fresh. For an opencode profile, resumeSessionId "
+                        + "itself also requires worktree:true/<slug> on THIS spawn — without one fleetd can "
+                        + "never re-verify which conversation it actually resumed (fleetd #249). "
                         + "sessionName gives the member a display name in its own UI when the backend supports "
                         + "one. Returns the member's sessionId (use with fleet_send) and paneId (use with "
                         + "fleet_stop).",
@@ -1326,7 +1268,7 @@ public final class FleetMcp {
                         "worktree", Map.of("type", "string", "description", "'true' or a ticket slug — requests an isolated git worktree"),
                         "ticket", stringProp("Ticket slug when worktree:true"),
                         "sessionName", stringProp("Logical display name for the member's own session, when its backend supports one"),
-                        "resumeSessionId", stringProp("A prior member's agentSessionId (from fleet_list) to resume — requires an explicit profile that supports it")),
+                        "resumeSessionId", stringProp("A prior member's agentSessionId (from fleet_list) to resume — requires an explicit profile that supports it, and (for opencode) a worktree on this spawn too")),
                         List.of()));
     }
 
@@ -1347,9 +1289,14 @@ public final class FleetMcp {
                         + "discover a peer lead without being told its address. 'members' are the "
                         + "sessions delegated to — each with sessionId, paneId, role (architect/dev/"
                         + "reviewer), profile (the backend it runs on), state, optional "
-                        + "worktree/branch/owner/agentSessionId (the id to pass as fleet_spawn's "
-                        + "resumeSessionId to relaunch onto that same conversation, when the backend "
-                        + "supports it), and live herdr status. An empty 'members' "
+                        + "worktree/branch/owner/agentSessionId, and live herdr status. agentSessionId, "
+                        + "when present, is the id to pass as fleet_spawn's resumeSessionId to relaunch "
+                        + "onto that same conversation. It is ABSENT — not a guess — for a member fleetd "
+                        + "cannot reliably re-identify: some backends (e.g. opencode) resolve it from the "
+                        + "member's working directory, which only uniquely identifies a member when it "
+                        + "was spawned into its own fleetd-provisioned worktree (worktree:true/<slug>); a "
+                        + "member spawned without one shares its directory with others and never reports "
+                        + "an id, however long it runs (fleetd #249). An empty 'members' "
                         + "means no members are spawned; it says nothing about peers. When capacity "
                         + "facts are configured, a 'capacity' row per profile also reports free: 0 for "
                         + "a quarantined profile's credential (see fleet_profiles), whatever its "

fleetd/src/main/java/dev/ltms/fleet/member/ClaudeCodeLauncher.java

@@ -505,7 +505,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * peer that starts without the seed still starts; it just may hit the dialog fleetd #149
      * describes.
      *
-     * <p><b>Gated to a provisioned worktree</b> ({@link #isProvisionedWorktree}) — see that
+     * <p><b>Gated to a provisioned worktree</b> ({@link HerdrPeerLauncher#isProvisionedWorktree}) — see that
      * method's javadoc for the incident that made this gate mandatory, not optional: this must
      * never run against a real checkout or an un-configured fallback cwd, only the exact
      * always-fresh-directory population fleetd #149 describes.
@@ -516,7 +516,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * sibling-temp-file + {@code ATOMIC_MOVE}, never a truncate-in-place) so a crash mid-write or a
      * concurrent reader never observes a half-written file, and through {@link #TRUST_JSON_LOCK} so
      * two concurrent spawns' entries both survive instead of the second write silently discarding
-     * the first. Both exist because of a real incident: see {@link #isProvisionedWorktree}'s javadoc
+     * the first. Both exist because of a real incident: see {@link HerdrPeerLauncher#isProvisionedWorktree}'s javadoc
      * and {@link #writeAtomically}'s javadoc.
      *
      * @param configDir the profile's {@code CLAUDE_CONFIG_DIR} ({@code cfg.configDir()}), or
@@ -578,7 +578,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * <p><b>fleetd #149 incident.</b> The original implementation used
      * {@code Files.writeString(target, content)} directly, which truncates {@code target} in place
      * before writing the replacement bytes. Combined with an ungated {@code cwd} (see
-     * {@link #isProvisionedWorktree}'s javadoc), a mutation-testing run hit that truncation window
+     * {@link HerdrPeerLauncher#isProvisionedWorktree}'s javadoc), a mutation-testing run hit that truncation window
      * against the operator's real {@code ~/.claude.json} and left it at 178 bytes. The gate closes
      * <em>which file</em> this can ever target; this closes <em>how</em> the target is written, so
      * that even a legitimate write against a real, live, concurrently-read {@code .claude.json}
@@ -628,32 +628,6 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
         }
     }
 
-    /**
-     * Whether {@code cwd} is a fleetd-provisioned git worktree — signalled the same way
-     * {@link #writeIdeOverlay} already gates on: a {@code .git} that is a <strong>regular
-     * file</strong> holding a {@code gitdir:} pointer, as opposed to a real checkout's {@code .git}
-     * <strong>directory</strong>. {@code null}/blank never qualifies.
-     *
-     * <p>Shared by every write that must land only in a worktree fleetd itself created for a
-     * member — never in a real checkout, an arbitrary configured directory, or (see the incident
-     * below) the daemon's own fallback cwd.
-     *
-     * <p><b>fleetd #149 incident.</b> {@link #seedTrustDialog} originally ran unconditionally on
-     * any non-blank {@code cwd}. Most of this launcher's OWN tests spawn a profile with no
-     * {@code cwd} configured, so the base class's {@code resolveCwd} falls through to the real
-     * {@code user.dir} — and with no {@code configDir} either (also the common case in this
-     * file's fixtures), the seed's target falls through the same way to the real
-     * {@code ~/.claude.json}. Running this repo's own test suite corrupted the operator's actual
-     * config file (it shrank from ~72 KB to a single seeded entry) the first time a mutation
-     * happened to make the write non-additive. Gating both cwd-targeted writes on "this is a
-     * worktree fleetd provisioned" — exactly the population fleetd #149 describes
-     * ({@code worktree: true} always lands in a brand-new directory) — makes that class of write
-     * impossible against a real checkout or an untouched fallback cwd, in production or in tests.
-     */
-    private static boolean isProvisionedWorktree(String cwd) {
-        return cwd != null && !cwd.isBlank() && Files.isRegularFile(Path.of(cwd, ".git"));
-    }
-
     /** {@code s}, or {@code null} when {@code s} is null/blank — the charter-presence test used above. */
     private static String nonBlank(String s) {
         return (s == null || s.isBlank()) ? null : s;

fleetd/src/main/java/dev/ltms/fleet/member/HerdrPeerLauncher.java

@@ -358,6 +358,42 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         return Files.isRegularFile(candidate) ? candidate : null;
     }
 
+    /**
+     * Whether {@code cwd} is a fleetd-provisioned git worktree — signalled the same way
+     * {@code ClaudeCodeLauncher#writeIdeOverlay} already gates on: a {@code .git} that is a
+     * <strong>regular file</strong> holding a {@code gitdir:} pointer, as opposed to a real
+     * checkout's {@code .git} <strong>directory</strong>. {@code null}/blank never qualifies.
+     *
+     * <p>Shared by every write (and, since fleetd #249, every identity read) that must land only
+     * in a worktree fleetd itself created for a member — never in a real checkout, an arbitrary
+     * configured directory, or (see the incident below) the daemon's own fallback cwd. Package-
+     * private (not {@code protected}) on purpose: {@link ClaudeCodeLauncher} and
+     * {@link OpenCodeLauncher} both call it, and same-package visibility is enough — no subclass
+     * outside this package needs it.
+     *
+     * <p><b>fleetd #149 incident.</b> {@code ClaudeCodeLauncher#seedTrustDialog} originally ran
+     * unconditionally on any non-blank {@code cwd}. Most of that launcher's OWN tests spawn a
+     * profile with no {@code cwd} configured, so the base class's {@code resolveCwd} falls
+     * through to the real {@code user.dir} — and with no {@code configDir} either (also the
+     * common case in that file's fixtures), the seed's target falls through the same way to the
+     * real {@code ~/.claude.json}. Running this repo's own test suite corrupted the operator's
+     * actual config file (it shrank from ~72 KB to a single seeded entry) the first time a
+     * mutation happened to make the write non-additive. Gating both cwd-targeted writes on "this
+     * is a worktree fleetd provisioned" — exactly the population fleetd #149 describes
+     * ({@code worktree: true} always lands in a brand-new directory) — makes that class of write
+     * impossible against a real checkout or an untouched fallback cwd, in production or in tests.
+     *
+     * <p><b>fleetd #249.</b> The same reasoning extends to a READ: {@code
+     * OpenCodeSessionDiscovery#sessionIdForDirectory} keys on {@code directory}, a heuristic that
+     * is only reliable when the directory is unique to this member — i.e., exactly the population
+     * this gate identifies. {@link OpenCodeLauncher} uses it to withhold {@code agentSessionId()}
+     * (report absence rather than a guess) and to refuse a {@code resumeSessionId} spawn that
+     * cannot be resolved reliably going forward.
+     */
+    static boolean isProvisionedWorktree(String cwd) {
+        return cwd != null && !cwd.isBlank() && Files.isRegularFile(Path.of(cwd, ".git"));
+    }
+
     // --- profile surface -----------------------------------------------------------------------
 
     /** The configured peer profile names (what {@code spawn(profile)} accepts). */

fleetd/src/main/java/dev/ltms/fleet/member/OpenCodeLauncher.java

@@ -672,13 +672,29 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     /** Add lazy on-disk session discovery to the base handle. */
     @Override
     public PeerHandle spawn(SpawnRequest req) {
+        String cwd = effectiveCwd(req);
+        // fleetd #249: refuse rather than silently resume into unverifiable territory. opencode's
+        // `-s <id>` flag itself resumes precisely — the resolved id is what fails, not the resume —
+        // but resolvedSessionId() below can never confirm (or later re-report) this handle's own
+        // identity without a fleetd-provisioned worktree (isProvisionedWorktree(cwd)), because the
+        // directory is shared and sessionIdForDirectory's "most recently updated row" heuristic can
+        // pick a sibling's session. Refusing here, before anything spawns, beats letting the member
+        // start and only then discovering fleetd can never again verify who it actually is.
+        if (req.resumeSessionId() != null && !req.resumeSessionId().isBlank()
+                && !isProvisionedWorktree(cwd)) {
+            throw new IllegalArgumentException("resumeSessionId requires a fleetd-provisioned "
+                    + "worktree for an opencode profile — without one, this member's cwd is shared "
+                    + "with other sessions, so fleetd can never reliably confirm (now or later) which "
+                    + "conversation it is actually running (fleetd #249). Pass fleet_spawn{worktree:"
+                    + "<ticket-slug>} to resume this member.");
+        }
         PeerHandle inner = super.spawn(req);
         // fleetd #175: the same profile config buildLaunch resolved for this spawn (requireProfile
         // is deterministic on req.profileName(), so re-resolving here costs a map lookup, not a
         // second decision) — SessionAwareHandle needs cfg.model() to know what THIS session should
         // be running.
         FleetConfig.Profile cfg = requireProfile(req.profileName());
-        return new SessionAwareHandle(inner, discovery, effectiveCwd(req), cfg,
+        return new SessionAwareHandle(inner, discovery, cwd, cfg,
                 this::memberHerdrSocketConfigured, discoveryUnavailableWarned, exhaustionSink);
     }
 
@@ -718,6 +734,17 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
          * the directory right now."
          */
         private final AtomicReference<String> resolvedSessionId = new AtomicReference<>();
+        /**
+         * fleetd #249: whether {@link #cwd} is a fleetd-provisioned git worktree
+         * ({@link HerdrPeerLauncher#isProvisionedWorktree}), computed once at spawn time since
+         * {@code cwd} never changes for this handle. When {@code false} the directory is shared
+         * with other sessions (the default no-worktree spawn inherits the lead's own cwd), so
+         * {@link OpenCodeSessionDiscovery#sessionIdForDirectory}'s "most recently updated row for
+         * this directory" heuristic can and does pick another session's row — see that class's
+         * javadoc. {@link #agentSessionId()} refuses to guess in that case: it reports absent
+         * rather than a possibly-foreign id.
+         */
+        private final boolean worktreeProvisioned;
 
         SessionAwareHandle(PeerHandle delegate, OpenCodeSessionDiscovery discovery, String cwd,
                             FleetConfig.Profile cfg,
@@ -731,6 +758,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
             this.discoveryUnavailable = discoveryUnavailable;
             this.discoveryUnavailableWarned = discoveryUnavailableWarned;
             this.exhaustionSink = exhaustionSink;
+            this.worktreeProvisioned = isProvisionedWorktree(cwd);
         }
 
         @Override
@@ -760,6 +788,9 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
             // built from (see OpenCodeLauncher#defaultDiscoveryRoot's javadoc for the full
             // reasoning). Scanning fleetd's own $HOME under that config would only ever find "no
             // row" and read as "resume unsupported" — declare it unavailable instead, once, loudly.
+            // Checked before the fleetd #249 worktree gate below: this OS-user mismatch makes
+            // discovery unusable regardless of whether cwd happens to be a provisioned worktree, so
+            // it earns the one-time WARN either way.
             if (discoveryUnavailable.getAsBoolean()) {
                 if (discoveryUnavailableWarned.compareAndSet(false, true)) {
                     log.warn("opencode session discovery unavailable: memberHerdrSocket is "
@@ -771,6 +802,16 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                 }
                 return null;
             }
+            // fleetd #249: cwd is shared with other sessions unless fleetd itself provisioned this
+            // worktree, and sessionIdForDirectory's directory-keyed heuristic cannot tell this
+            // member's row apart from a sibling's in that case (measured: a three-day-old row from
+            // a different profile). Refuse to guess — absent is the honest answer, and it is what
+            // this codebase already returns elsewhere for absent evidence (fleetd #175's UNKNOWN).
+            // No WARN here: unlike discoveryUnavailable above, this is the ordinary, expected shape
+            // of the large majority of spawns (no worktree requested), not a configuration gap.
+            if (!worktreeProvisioned) {
+                return null;
+            }
             // fleetd #234: once resolved, stay resolved. Re-deriving from `directory` on every call
             // would let this handle's identity drift to a sibling session that later shares the
             // same cwd and writes a newer row — see resolvedSessionId's javadoc.

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadSeatLookupTest.java

@@ -1,156 +0,0 @@
-package dev.ltms.fleet;
-
-import dev.ltms.fleet.config.FleetConfig;
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Test;
-
-import java.util.Map;
-import java.util.function.Function;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-
-/**
- * fleetd #176: {@link Fleetd#leadSeatLookup} is the factory {@code Fleetd.main} wires into {@code
- * FleetMcp.LeadSeatSource} so {@code fleet_list}'s {@code free} can subtract the seat(s) a
- * {@code subscription: true} profile's own live LEAD session holds on that same account —
- * {@code maxLoad} never counted the lead, only members. {@code FleetdLeadSeatWiringTest} proves
- * {@code main} still passes this factory's result in; this class proves the factory's own matching
- * logic: subscription-only, credential-matched, and counting only CURRENTLY LIVE leads.
- */
-class FleetdLeadSeatLookupTest {
-
-    private static FleetConfig.Profile subscriptionProfile(String name, String credentialId) {
-        return new FleetConfig.Profile(name, null, "claude-sonnet-5", null, null, null,
-                "tab", "fleet", "w #{n}", null, null, null, null, null, null, null,
-                null, 3, true, null, credentialId, null);
-    }
-
-    private static FleetConfig.Profile offSubscriptionProfile(String name, String credentialId) {
-        return new FleetConfig.Profile(name, "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
-                null, "tab", "fleet", "w #{n}", null, null, null, null, null, null, null,
-                null, 2, false, null, credentialId, null);
-    }
-
-    private static FleetConfig.Leader leadOnProfile(String profile) {
-        return new FleetConfig.Leader(profile, "lead: primary", 1, "lead:", 10, "claude", "claude-sonnet-5");
-    }
-
-    @Test
-    @DisplayName("a live lead sharing the target profile's credential counts as one seat")
-    void liveLeadSharingCredentialCountsAsOneSeat() {
-        Map<String, FleetConfig.Profile> profiles = Map.of("sonnet", subscriptionProfile("sonnet", null));
-        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("sonnet"));
-        Function<String, Integer> lookup = Fleetd.leadSeatLookup(() -> profiles, leaders,
-                () -> Map.of("term_primary", "primary"));
-
-        assertEquals(1, lookup.apply("sonnet"));
-    }
-
-    @Test
-    @DisplayName("no live lead names this profile ⇒ zero seats, exactly as before this ticket")
-    void noLiveLeadOnTheProfileCountsAsZero() {
-        Map<String, FleetConfig.Profile> profiles = Map.of("sonnet", subscriptionProfile("sonnet", null));
-        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("sonnet"));
-        Function<String, Integer> lookup = Fleetd.leadSeatLookup(() -> profiles, leaders, Map::of);
-
-        assertEquals(0, lookup.apply("sonnet"));
-    }
-
-    @Test
-    @DisplayName("a lead entry with no `profile:` (recognise-only) contributes no seats — cannot be derived")
-    void recogniseOnlyLeadWithNoProfileContributesNothing() {
-        Map<String, FleetConfig.Profile> profiles = Map.of("sonnet", subscriptionProfile("sonnet", null));
-        FleetConfig.Leader recogniseOnly = new FleetConfig.Leader(null, "lead: primary", 1, "lead:", 10,
-                "claude", "claude-sonnet-5");
-        Map<String, FleetConfig.Leader> leaders = Map.of("primary", recogniseOnly);
-        Function<String, Integer> lookup = Fleetd.leadSeatLookup(() -> profiles, leaders,
-                () -> Map.of("term_primary", "primary"));
-
-        assertEquals(0, lookup.apply("sonnet"));
-    }
-
-    @Test
-    @DisplayName("a non-subscription profile never has a lead seat subtracted, whatever the credential match")
-    void nonSubscriptionProfileIsNeverAdjusted() {
-        Map<String, FleetConfig.Profile> profiles = Map.of(
-                "terra", offSubscriptionProfile("terra", "shared-openai"),
-                "sonnet", subscriptionProfile("sonnet", "shared-openai"));
-        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("sonnet"));
-        Function<String, Integer> lookup = Fleetd.leadSeatLookup(() -> profiles, leaders,
-                () -> Map.of("term_primary", "primary"));
-
-        assertEquals(0, lookup.apply("terra"), "terra is not subscription:true, so it must never be adjusted");
-    }
-
-    @Test
-    @DisplayName("explicit, different credentialIds still separate two subscription profiles (post fleetd #176 "
-            + "stage 2 sentinel)")
-    void differentCredentialIsNotCounted() {
-        Map<String, FleetConfig.Profile> profiles = Map.of(
-                "sonnet", subscriptionProfile("sonnet", "claude-account-a"),
-                "opus", subscriptionProfile("opus", "claude-account-b"));
-        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("opus"));
-        Function<String, Integer> lookup = Fleetd.leadSeatLookup(() -> profiles, leaders,
-                () -> Map.of("term_primary", "primary"));
-
-        assertEquals(0, lookup.apply("sonnet"), "different accounts must never be conflated into one seat count "
-                + "— an explicit credentialId on both sides must still win over the subscription sentinel, so an "
-                + "operator with two separate Claude logins on one host can keep them apart");
-    }
-
-    /**
-     * fleetd #176 stage 2 — the exact live shape that shipped inert: a lead on subscription profile
-     * {@code opus}, members on a DIFFERENTLY NAMED subscription profile {@code sonnet}, same Claude
-     * login, and NEITHER profile sets {@code credentialId}. Every other test in this class puts the
-     * lead on the SAME profile name as the target, which happened to keep working even with the old
-     * fall-back-to-profile-name {@code effectiveCredentialId()} — this is the one that did not, and
-     * its absence is what let the stage-1 fix ship without ever catching the bug it was filed for.
-     */
-    @Test
-    @DisplayName("[LIVE SHAPE] lead on a DIFFERENT subscription profile, same account, neither sets "
-            + "credentialId ⇒ still counts as a seat")
-    void leadOnADifferentSubscriptionProfileSameAccountStillCountsAsASeat() {
-        Map<String, FleetConfig.Profile> profiles = Map.of(
-                "opus", subscriptionProfile("opus", null),
-                "sonnet", subscriptionProfile("sonnet", null));
-        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("opus"));
-        Function<String, Integer> lookup = Fleetd.leadSeatLookup(() -> profiles, leaders,
-                () -> Map.of("term_primary", "primary"));
-
-        assertEquals(1, lookup.apply("sonnet"), "opus and sonnet are both subscription:true with no explicit "
-                + "credentialId, so they share one Claude login and the lead's live seat on opus must be charged "
-                + "against sonnet too — this is the live host's actual shape (fleetd #176 stage 2)");
-    }
-
-    @Test
-    @DisplayName("two live instances of the same lead count as two seats")
-    void twoLiveInstancesOfTheSameLeadCountAsTwoSeats() {
-        Map<String, FleetConfig.Profile> profiles = Map.of("sonnet", subscriptionProfile("sonnet", null));
-        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("sonnet"));
-        Function<String, Integer> lookup = Fleetd.leadSeatLookup(() -> profiles, leaders,
-                () -> Map.of("term_a", "primary", "term_b", "primary"));
-
-        assertEquals(2, lookup.apply("sonnet"));
-    }
-
-    @Test
-    @DisplayName("an unconfigured target profile resolves to zero, not a thrown exception")
-    void unconfiguredTargetProfileIsZero() {
-        Function<String, Integer> lookup = Fleetd.leadSeatLookup(Map::of, Map.of(), Map::of);
-
-        assertEquals(0, lookup.apply("ghost"));
-    }
-
-    @Test
-    @DisplayName("live leads are read through the supplier on every call, not snapshotted")
-    void liveLeadsAreReadThroughOnEveryCall() {
-        Map<String, FleetConfig.Profile> profiles = Map.of("sonnet", subscriptionProfile("sonnet", null));
-        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("sonnet"));
-        java.util.Map<String, String> live = new java.util.HashMap<>();
-        Function<String, Integer> lookup = Fleetd.leadSeatLookup(() -> profiles, leaders, () -> live);
-
-        assertEquals(0, lookup.apply("sonnet"));
-        live.put("term_primary", "primary");
-        assertEquals(1, lookup.apply("sonnet"));
-    }
-}

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadSeatWiringTest.java

@@ -1,43 +0,0 @@
-package dev.ltms.fleet;
-
-import java.nio.file.Files;
-import java.nio.file.Path;
-import org.junit.jupiter.api.DisplayName;
-import org.junit.jupiter.api.Test;
-
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-/**
- * fleetd #176: {@code Fleetd.main} builds its {@code FleetMcp} from a 14-argument constructor whose
- * last argument is a {@code FleetMcp.LeadSeatSource} wrapping {@link Fleetd#leadSeatLookup}. That
- * argument is exactly the kind of wiring fleetd #248 warned about: dropping it (or swapping it for
- * the inert {@code FleetMcp.LeadSeatSource.none()}) compiles with 0 errors and leaves every test
- * that builds its own {@code FleetMcp}/{@code CapacitySource} directly — every test that predates
- * this ticket — green, because none of them go through {@code main} at all.
- *
- * <p>{@link FleetdLeadSeatLookupTest} proves the factory's own matching logic; this class is the
- * plain source-text assertion that proves {@code main} still passes its result in, mirroring
- * {@code FleetdCompletionResolverWiringTest}'s approach for the same class of gap.
- *
- * <p><b>This test checks source text, not runtime behaviour.</b> It never constructs a
- * {@code FleetMcp} and never runs {@code main}.
- */
-class FleetdLeadSeatWiringTest {
-
-    private static String fleetdSource() throws Exception {
-        return Files.readString(Path.of("src/main/java/dev/ltms/fleet/Fleetd.java"));
-    }
-
-    @Test
-    @DisplayName("[SOURCE TEXT] FleetMcp's construction call still passes a LeadSeatSource built from leadSeatLookup(...)")
-    void fleetMcpConstructionStillWiresLeadSeatLookup() throws Exception {
-        String source = fleetdSource();
-        assertTrue(source.contains("new FleetMcp.LeadSeatSource(leadSeatLookup(() -> config.get().profiles(), "
-                        + "leaders, leads))"),
-                "FleetMcp's construction call must still pass a LeadSeatSource built from "
-                        + "Fleetd.leadSeatLookup(...). Dropping it or swapping in "
-                        + "FleetMcp.LeadSeatSource.none() (fleetd #176's would-be silent regression, the same "
-                        + "shape as fleetd #248's measured mutations) compiles with 0 errors and leaves every "
-                        + "existing behavioural test green — this source check is what must go red instead.");
-    }
-}

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpTest.java

@@ -651,48 +651,6 @@ class FleetMcpTest {
         assertEquals(2, out.split("\"free\":0", -1).length - 1, out);
     }
 
-    /**
-     * fleetd #176 stage 2 (correcting the inert stage 1): two {@code subscription: true} profiles,
-     * {@code opus} and {@code sonnet}, neither setting an explicit {@code credentialId} — the exact
-     * shape measured on the live Mac fleet. This is INTENDED, not a regression: a real Claude usage
-     * limit on the one login behind both profiles really does take out every profile running on it,
-     * the same way {@code credentialId: openai-shared} already lets two OpenAI-backed profiles share
-     * one quarantine (see {@code everyProfileSharingTheQuarantinedCredentialReportsZeroFree} above).
-     * The {@code credentialIdFor} function here is built the same way {@code Fleetd.main} wires it —
-     * {@code profile -> profiles.get(profile).effectiveCredentialId()} — so this proves the actual
-     * config-driven behaviour, not just {@code capacityView}'s arithmetic with a hand-picked string.
-     */
-    @Test
-    void quarantiningOneSubscriptionProfileZeroesFreeOnTheOtherSharingTheSameAccount() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-        Map<String, FleetConfig.Profile> profiles = Map.of(
-                "opus", new FleetConfig.Profile("opus", null, "claude-opus-4", null, null, null,
-                        "tab", "fleet", "w #{n}", null, null, null, null, null, null, null,
-                        null, 3, true, null, null, null),
-                "sonnet", new FleetConfig.Profile("sonnet", null, "claude-sonnet-5", null, null, null,
-                        "tab", "fleet", "w #{n}", null, null, null, null, null, null, null,
-                        null, 3, true, null, null, null));
-        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(20));
-        quarantine.quarantine(FleetConfig.Profile.SUBSCRIPTION_CREDENTIAL_ID);
-        FleetMcp.QuarantineSource source = new FleetMcp.QuarantineSource(profile -> {
-            FleetConfig.Profile configured = profiles.get(profile);
-            return configured == null ? null : configured.effectiveCredentialId();
-        }, quarantine);
-
-        String out = textOf(FleetMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
-                sessions, null, new FleetMcp.CapacitySource(profile -> 0, profile -> 3,
-                () -> Set.of("opus", "sonnet"), () -> 0), new FleetMcp.HealthCoverageSource(() -> "off"),
-                source, Map.of(), ""));
-
-        assertEquals(2, out.split("\"free\":0", -1).length - 1,
-                "opus and sonnet share one Claude login with neither setting credentialId, so quarantining "
-                        + "opus's account must also zero sonnet's free — this is intended, not a side effect: "
-                        + out);
-        assertEquals(2, out.split("\"credentialId\":\"" + FleetConfig.Profile.SUBSCRIPTION_CREDENTIAL_ID + "\"", -1)
-                .length - 1, out);
-    }
-
     /** fleetd #201 Unit 5: cool-off forces {@code free:0} but never adds {@code quarantinedForSeconds}. */
     @Test
     void coolingOffProfileReportsZeroFreeButNeverQuarantinedForSeconds() {
@@ -809,68 +767,6 @@ class FleetMcpTest {
         assertFalse(out.contains("quarantinedForSeconds"), out);
     }
 
-    /**
-     * fleetd #176: this is the exact shape measured on the Mac fleet — {@code maxLoad:3, live:2},
-     * where one of the "free" three is really the lead's own seat on the same subscription. The old
-     * formula ({@code max(0, cap - live)}) reported {@code free:1}; the real ceiling is {@code 0}
-     * (two members plus the lead's own seat already fill all three).
-     */
-    @Test
-    void leadSeatSubtractsFromFreeTheSameWayLiveDoes() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-        FleetMcp.LeadSeatSource leadSeats = new FleetMcp.LeadSeatSource(
-                profile -> "sonnet".equals(profile) ? 1 : 0);
-
-        String out = textOf(FleetMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
-                sessions, null, new FleetMcp.CapacitySource(profile -> 2, profile -> 3,
-                () -> Set.of("sonnet"), () -> 0), new FleetMcp.HealthCoverageSource(() -> "off"),
-                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), leadSeats, Map.of(), "", null));
-
-        assertTrue(out.contains("\"maxLoad\":3"), "maxLoad itself must be left untouched: " + out);
-        assertTrue(out.contains("\"live\":2"), out);
-        assertTrue(out.contains("\"free\":0"), "2 live + 1 lead seat fills all 3: " + out);
-        assertTrue(out.contains("\"leadSeats\":1"), out);
-    }
-
-    /**
-     * fleetd #176: the OTHER measurement in the issue — a completely idle fleet still overstates
-     * {@code free} by the lead's own seat. {@code maxLoad:3, live:0} must report {@code free:2}, the
-     * real fan-out ceiling, not {@code 3}.
-     */
-    @Test
-    void leadSeatLowersFreeOnAnOtherwiseIdleSubscriptionProfile() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-        FleetMcp.LeadSeatSource leadSeats = new FleetMcp.LeadSeatSource(
-                profile -> "sonnet".equals(profile) ? 1 : 0);
-
-        String out = textOf(FleetMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
-                sessions, null, new FleetMcp.CapacitySource(profile -> 0, profile -> 3,
-                () -> Set.of("sonnet"), () -> 0), new FleetMcp.HealthCoverageSource(() -> "off"),
-                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), leadSeats, Map.of(), "", null));
-
-        assertTrue(out.contains("\"live\":0"), out);
-        assertTrue(out.contains("\"free\":2"), "an idle fleet's real ceiling is 3 minus the lead's own seat: " + out);
-        assertTrue(out.contains("\"leadSeats\":1"), out);
-    }
-
-    /** A profile with no lead seats reported must be byte-identical to before this ticket. */
-    @Test
-    void zeroLeadSeatsOmitsTheKeyAndLeavesFreeUnchanged() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-
-        String out = textOf(FleetMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
-                sessions, null, new FleetMcp.CapacitySource(profile -> 0, profile -> 2,
-                () -> Set.of("terra"), () -> 0), new FleetMcp.HealthCoverageSource(() -> "off"),
-                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), FleetMcp.LeadSeatSource.none(),
-                Map.of(), "", null));
-
-        assertTrue(out.contains("\"free\":2"), out);
-        assertFalse(out.contains("leadSeats"), "no lead shares this profile's credential: " + out);
-    }
-
     @Test
     void listReportsLeadsAndFlagsTheCallersOwnRow() {
         FakeHerdr h = new FakeHerdr();

fleetd/src/test/java/dev/ltms/fleet/member/OpenCodeLauncherTest.java

@@ -323,11 +323,39 @@ class OpenCodeLauncherTest {
 
     // --- CB-547: resume + post-hoc session discovery --------------------------------------------
 
+    /**
+     * Give {@code dir} the exact signature {@link HerdrPeerLauncher#isProvisionedWorktree} checks
+     * for: a {@code .git} REGULAR FILE, never a directory. Content is never parsed by that gate, so
+     * any {@code gitdir:} pointer is fine. Mirrors {@code ClaudeCodeLauncherTest}'s helper of the
+     * same shape (fleetd #249).
+     */
+    private static void markAsProvisionedWorktree(Path dir) throws IOException {
+        Files.writeString(dir.resolve(".git"), "gitdir: /tmp/not-a-real-gitdir");
+    }
+
+    /**
+     * A fresh subdirectory of {@code configRoot}, marked as a provisioned worktree (fleetd #249),
+     * for tests that predate this gate and stood in a bare {@code "/work/dir"} string as their
+     * member's cwd — a directory that never existed on disk and, post-#249, would never pass
+     * {@link HerdrPeerLauncher#isProvisionedWorktree} either. Those tests are about the model
+     * mismatch / late-resolve machinery (fleetd #175/#234/#209), not about the worktree gate
+     * itself, so they need a cwd the gate accepts without changing what each test demonstrates.
+     */
+    private static String provisionedWorkDir(Path configRoot) throws IOException {
+        Path dir = Files.createDirectories(configRoot.resolve("work-dir"));
+        markAsProvisionedWorktree(dir);
+        return dir.toString();
+    }
+
     @Test
-    void aResumeSpawnPassesTheSessionIdAsDashS(@TempDir Path root) {
+    void aResumeSpawnIntoAProvisionedWorktreePassesTheSessionIdAsDashS(@TempDir Path root,
+                                                                        @TempDir Path worktree)
+            throws Exception {
+        markAsProvisionedWorktree(worktree);
         FakeHerdr herdr = new FakeHerdr();
         service(herdr, root, opencodeCfg("google/gemini-2.5-pro", null, null))
-                .spawn(new SpawnRequest(null, null, null, null, "ses_41b79fc90ffeI9E8uZv6VprUn2"));
+                .spawn(new SpawnRequest(null, worktree.toString(), null, null,
+                        "ses_41b79fc90ffeI9E8uZv6VprUn2"));
 
         List<String> args = startArgs(herdr);
         int s = args.indexOf("-s");
@@ -336,6 +364,27 @@ class OpenCodeLauncherTest {
                 "the resume target id follows -s");
     }
 
+    /**
+     * fleetd #249 acceptance criterion 3: without a fleetd-provisioned worktree, the member's cwd
+     * is shared with other sessions, so fleetd can never reliably confirm (now or later via {@link
+     * OpenCodeSessionDiscovery}) which conversation it is actually running. Refuse the spawn itself
+     * rather than silently launching opencode's {@code -s <id>} into unverifiable territory.
+     */
+    @Test
+    void aResumeSpawnWithoutAProvisionedWorktreeIsRefused(@TempDir Path root) {
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = service(herdr, root,
+                opencodeCfg("google/gemini-2.5-pro", null, null));
+
+        IllegalArgumentException e = assertThrows(IllegalArgumentException.class, () ->
+                launcher.spawn(new SpawnRequest(null, null, null, null,
+                        "ses_41b79fc90ffeI9E8uZv6VprUn2")));
+
+        assertTrue(e.getMessage().contains("worktree"), e.getMessage());
+        assertFalse(herdr.called("agent.start"),
+                "the refusal must happen before anything spawns — no pane, no process");
+    }
+
     @Test
     void aFreshSpawnCarriesNoSessionFlag(@TempDir Path root) {
         FakeHerdr herdr = new FakeHerdr();
@@ -348,25 +397,59 @@ class OpenCodeLauncherTest {
 
     @Test
     void theHandleDiscoversTheSessionIdForTheWorkersCwdOnlyAfterItAppears(@TempDir Path root,
-                                                                          @TempDir Path discRoot)
+                                                                          @TempDir Path discRoot,
+                                                                          @TempDir Path worktree)
             throws Exception {
+        markAsProvisionedWorktree(worktree);
         FakeHerdr herdr = new FakeHerdr();
         OpenCodeLauncher launcher = new OpenCodeLauncher(new AgentControl(herdr),
                 new WorkspaceControl(herdr), Map.of("gemini", opencodeCfg(null, null, null)),
                 "gemini", _ -> null, 0, System::currentTimeMillis, () -> { }, root, discRoot);
 
-        PeerHandle handle = launcher.spawn(new SpawnRequest(null, "/work/dir", null));
+        PeerHandle handle = launcher.spawn(new SpawnRequest(null, worktree.toString(), null));
 
         // opencode writes the record only when the session is first persisted — the instant the
         // pane is ready it does not exist, so agentSessionId() is null (never a spawn failure).
         assertNull(handle.agentSessionId(), "no record yet → null, not a spawn-time block");
         // Once the record appears (here: same cwd), lazy discovery resolves it — the handle's
         // session id matches its own worktree, not another's.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_resolved", "/work/dir", 1000L);
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_resolved", worktree.toString(), 1000L);
         assertEquals("ses_resolved", handle.agentSessionId(),
                 "agentSessionId() re-scans and picks up a record that has since been written");
     }
 
+    /**
+     * fleetd #249 acceptance criterion 1, exercised through the real caller path (the handle
+     * {@code fleet_list} actually reads), not {@link OpenCodeSessionDiscovery} directly. Without a
+     * fleetd-provisioned worktree the member's cwd is shared — the default no-worktree spawn
+     * inherits the lead's own long-lived cwd — so even once a matching row appears (here:
+     * simulating another profile's session that happens to share the directory) the handle must
+     * report absence rather than guess. Measured real-world case (2026-09-03): the row it would
+     * otherwise pick was three days old and belonged to a different profile.
+     */
+    @Test
+    void theHandleNeverReportsAnIdForANonProvisionedCwdEvenAfterARowAppears(@TempDir Path root,
+                                                                             @TempDir Path discRoot)
+            throws Exception {
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = new OpenCodeLauncher(new AgentControl(herdr),
+                new WorkspaceControl(herdr), Map.of("gemini", opencodeCfg(null, null, null)),
+                "gemini", _ -> null, 0, System::currentTimeMillis, () -> { }, root, discRoot);
+        // No markAsProvisionedWorktree — this cwd has no .git file, the shared-cwd shape a
+        // no-worktree spawn (or a real checkout) actually has.
+        String sharedCwd = root.resolve("shared-cwd").toString();
+
+        PeerHandle handle = launcher.spawn(new SpawnRequest(null, sharedCwd, null));
+
+        assertNull(handle.agentSessionId(), "no record yet → null, same as the provisioned case");
+        // A row for this exact directory now appears — e.g. a sibling member, or a stale session
+        // from days earlier, sharing the same unprovisioned cwd.
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_someone_elses", sharedCwd, 1000L);
+        assertNull(handle.agentSessionId(),
+                "a non-provisioned cwd must NEVER report an id, even once a row for it exists — "
+                        + "the row could belong to any other session sharing this directory");
+    }
+
     @Test
     void foreignWorkerMatchesOpencodePrefixButNotClaude() {
         String nonce = "abc123";
@@ -920,6 +1003,7 @@ class OpenCodeLauncherTest {
     @Test
     void theRealSessionManagerLateResolvePathCatchesAModelMismatch(@TempDir Path configRoot,
                                                                      @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
         FakeHerdr herdr = new FakeHerdr();
         // xf's real shape (fleetd #175): weight:80, model "opencode/nemotron-3-ultra-free", no
         // credentialId — the profile that actually escaped the fleet's accounting.
@@ -929,7 +1013,7 @@ class OpenCodeLauncherTest {
         OpenCodeLauncher launcher = serviceWithSink(herdr, configRoot, discRoot, cfg, sink);
 
         SessionManager sessions = new SessionManager(launcher);
-        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);
 
         // Real late-resolve path, driven BEFORE opencode has written its session row — same shape
         // as production the instant a pane goes ready.
@@ -940,7 +1024,7 @@ class OpenCodeLauncherTest {
 
         // opencode writes its row late, running gpt-5.6-sol (a PAID credential) instead of the
         // withdrawn free model the profile actually asked for — the exact fleetd #175 scenario.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                 "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
 
         // Drive the SAME real late-resolve path again: sessions.get() -> resolveAgentSessionId ->
@@ -959,12 +1043,13 @@ class OpenCodeLauncherTest {
     @Test
     void aProviderPrefixedModelMatchingBothIdAndProviderIsNotAMismatch(@TempDir Path configRoot,
                                                                         @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
         FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
         PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                 "{\"id\":\"gpt-5.6-terra\",\"providerID\":\"openai\"}");
 
         assertEquals("ses_x", handle.agentSessionId());
@@ -975,12 +1060,13 @@ class OpenCodeLauncherTest {
     @Test
     void aGxProviderPrefixedModelMatchingBothIdAndProviderIsNotAMismatch(@TempDir Path configRoot,
                                                                           @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
         FleetConfig.Profile cfg = opencodeCfg("gx/deepseek-v4-flash", null, null);
         PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                 "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");
 
         assertEquals("ses_x", handle.agentSessionId());
@@ -997,12 +1083,13 @@ class OpenCodeLauncherTest {
     @Test
     void aMissingProviderIdInTheEvidenceIsUnknownNotAMismatchWhenTheIdMatches(
             @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
         FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
         PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                 "{\"id\":\"gpt-5.6-terra\"}");
 
         assertEquals("ses_x", handle.agentSessionId());
@@ -1018,12 +1105,13 @@ class OpenCodeLauncherTest {
     @Test
     void aMissingProviderIdInTheEvidenceStillCatchesARealIdMismatch(
             @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
         FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
         PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                 "{\"id\":\"gpt-5.6-sol\"}");
 
         assertEquals("ses_x", handle.agentSessionId());
@@ -1042,12 +1130,13 @@ class OpenCodeLauncherTest {
     @Test
     void aBareModelWithNoProviderPrefixMatchesOnIdAloneAndIsNotAMismatch(@TempDir Path configRoot,
                                                                           @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
         FleetConfig.Profile cfg = opencodeCfg("deepseek-v4-flash", null, null);
         PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                 "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");
 
         assertEquals("ses_x", handle.agentSessionId());
@@ -1064,6 +1153,7 @@ class OpenCodeLauncherTest {
     @Test
     void aRealIdMismatchLogsAnErrorNamingBothModelsAndQuarantinesThroughTheSink(
             @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(target + "|" + reason);
         FleetConfig.Profile cfg = opencodeCfg("opencode/nemotron-3-ultra-free", null, null);
@@ -1075,8 +1165,8 @@ class OpenCodeLauncherTest {
         PeerHandle handle;
         try {
             handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                    .spawn(new SpawnRequest(null, "/work/dir", null));
-            OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                    .spawn(new SpawnRequest(null, workDir, null));
+            OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                     "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
             assertEquals("ses_x", handle.agentSessionId());
         } finally {
@@ -1111,11 +1201,12 @@ class OpenCodeLauncherTest {
     @Test
     void unknownOrUnparseableModelEvidenceNeverQuarantines(@TempDir Path configRoot,
                                                              @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
         FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
         PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
+                .spawn(new SpawnRequest(null, workDir, null));
 
         // No row yet at all.
         assertNull(handle.agentSessionId());
@@ -1137,12 +1228,13 @@ class OpenCodeLauncherTest {
     @Test
     void aProfileWithNoConfiguredModelIsNeverCheckedForAMismatch(@TempDir Path configRoot,
                                                                   @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
         FleetConfig.Profile cfg = opencodeCfg(null, null, null);
         PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+                .spawn(new SpawnRequest(null, workDir, null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                 "{\"id\":\"anything-at-all\",\"providerID\":\"anyone\"}");
 
         assertEquals("ses_x", handle.agentSessionId());
@@ -1166,21 +1258,22 @@ class OpenCodeLauncherTest {
     @Test
     void modelCheckReadsTheResolvedSessionsOwnRowNotWhateverIsNewestInTheSharedDirectory(
             @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
         FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
         PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, "/work/dir", null));
+                .spawn(new SpawnRequest(null, workDir, null));
 
         // Our own session's row, correctly matching the profile's requested model.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_ours", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_ours", workDir, 1000L,
                 "{\"id\":\"gpt-5.6-terra\",\"providerID\":\"openai\"}");
         assertEquals("ses_ours", handle.agentSessionId(), "resolves to our own session");
         assertTrue(exhausted.isEmpty(), "matching model → no mismatch on first resolve: " + exhausted);
 
         // A sibling member, spawned later into the SAME shared directory (no worktree, fleetd
         // #234's default), writes a newer row running a totally different model.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_sibling", "/work/dir", 9000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_sibling", workDir, 9000L,
                 "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");
 
         assertEquals("ses_ours", handle.agentSessionId(),
@@ -1212,6 +1305,7 @@ class OpenCodeLauncherTest {
     @Test
     void aSpawnTimeModelMismatchActuallyQuarantinesTheCredentialThroughTheRealAcquirePath(
             @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
         FleetConfig.Profile cfg = opencodeCfgWithCredential(
                 "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
         Map<String, FleetConfig.Profile> profiles = Map.of(cfg.profile(), cfg);
@@ -1232,14 +1326,14 @@ class OpenCodeLauncherTest {
 
         // The mismatching row exists BEFORE the spawn — reproducing fleetd #234's exact timing:
         // opencode's session table already carries evidence by the moment acquire() first asks.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                 "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
 
         assertFalse(quarantine.isQuarantined("openai-shared"), "nothing quarantined before the spawn");
 
         // The real production entrypoint: acquire() builds the MemberSession by calling
         // handle.agentSessionId() BEFORE registry.put() runs.
-        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);
 
         assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
         assertTrue(quarantine.isQuarantined("openai-shared"),
@@ -1258,6 +1352,7 @@ class OpenCodeLauncherTest {
     @Test
     void aRosterOnlySinkSilentlyDropsTheSpawnTimeQuarantine(@TempDir Path configRoot,
                                                               @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
         FleetConfig.Profile cfg = opencodeCfgWithCredential(
                 "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
         BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.SECONDS.toNanos(1800));
@@ -1270,10 +1365,10 @@ class OpenCodeLauncherTest {
         OpenCodeLauncher launcher = serviceWithSink(herdr, configRoot, discRoot, cfg, rosterOnlySink);
         SessionManager sessions = new SessionManager(launcher);
 
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                 "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
 
-        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);
 
         assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
         assertFalse(quarantine.isQuarantined("openai-shared"),
@@ -1301,6 +1396,7 @@ class OpenCodeLauncherTest {
     @Test
     void theSpawnTimeQuarantineSurvivesTheFleetdStyleForwardingHop(@TempDir Path configRoot,
                                                                      @TempDir Path discRoot) throws Exception {
+        String workDir = provisionedWorkDir(configRoot);
         FleetConfig.Profile cfg = opencodeCfgWithCredential(
                 "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
         Map<String, FleetConfig.Profile> profiles = Map.of(cfg.profile(), cfg);
@@ -1332,12 +1428,12 @@ class OpenCodeLauncherTest {
         };
         exhaustionSinkRef.set(realSink);
 
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
                 "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
 
         assertFalse(quarantine.isQuarantined("openai-shared"), "nothing quarantined before the spawn");
 
-        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);
 
         assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
         assertTrue(quarantine.isQuarantined("openai-shared"),