fleetd #176 stage 2: make effectiveCredentialId() subscription-aware

Stage 1's lead-seat matcher (leadSeatLookup) was correct but inert on
the live host: the lead runs on profile 'opus', members on 'sonnet',
both subscription:true with no explicit credentialId. Because
effectiveCredentialId() fell back to the profile's own name, opus and
sonnet never matched even though they share one Claude login, so the
matcher charged zero seats.

FleetConfig.Profile.effectiveCredentialId() now falls back to a shared
sentinel (SUBSCRIPTION_CREDENTIAL_ID = "<subscription>") instead of the
profile name when subscription:true and credentialId is unset. An
explicit credentialId still wins, so two separate Claude logins on one
host can still be kept apart.

This is also BackendQuarantine's and BackendOutagePolicy's grouping
key and CompositePeerLauncher's spawn-time enforcement key, so the fix
also links quarantine/cool-off across subscription profiles sharing an
account -- intentional: one usage limit really does take out every
profile on that login, mirroring credentialId: openai-shared already
doing this for off-subscription profiles. Every caller was reviewed;
none wants "this exact profile" over "this account".

Tests added:
- FleetdLeadSeatLookupTest: the live shape itself (lead on a
  DIFFERENT subscription profile than the target, same account,
  neither sets credentialId) -- the case stage 1's suite never covered
- FleetMcpTest: quarantining one subscription profile's shared
  account zeroes free on another sharing it, via the same
  effectiveCredentialId()-driven wiring Fleetd.main uses

Mutation-tested: reverting the subscription branch to the old
fall-back-to-profile-name behavior sends both new tests RED with 0
compile errors; reverting the mutation restores byte-identical
(diff -q) source and green tests.

fleetd.example.yaml's fleetd #176 notes are rewritten for the sentinel
semantics and when to override it with an explicit credentialId.

fleetd/fleetd.example.yaml

@@ -306,6 +306,35 @@ profiles:
     #   GOTCHA 2 — `maxLoad` is the ONLY throttle you have here. There is no metering, no budget
     #   and no refusal on cost; the cap on live members is the single thing standing between a
     #   fan-out and your monthly limit. Set it deliberately and keep it small.
+    #
+    #   GOTCHA 3 (fleetd #176) — `maxLoad` counts members, never the lead itself. The lead is a live
+    #   `claude` session on this SAME account (a lead is never moved off-subscription, whatever its
+    #   own profile says), so it already holds one seat before any member spawns. If a lead's
+    #   `fleet.leaders.<name>.profile` names THIS profile — or ANY OTHER `subscription: true`
+    #   profile that shares this one's account (see THE SENTINEL, just below, next to
+    #   `credentialId:`) — `fleet_list`'s `free` for this profile subtracts that lead's live
+    #   seat(s) automatically; see `profile:` under THE FLEET below. If no lead entry names a
+    #   profile sharing this account, fleetd has no way to know a lead holds a seat here, and `free`
+    #   will overstate what a fresh `fleet_spawn` actually gets by exactly the seats the lead is
+    #   quietly holding.
+    #
+    #   THE SENTINEL (fleetd #176 stage 2, correcting an inert stage 1 fix): every `subscription:
+    #   true` profile that leaves `credentialId` unset shares ONE implicit account-wide credential
+    #   id with every other such profile on this host — because a subscription profile doesn't
+    #   authenticate with a credential of its own, it authenticates as the operator's own Claude
+    #   login, and there is exactly one of those. So on a typical host, `opus` (the lead's profile)
+    #   and `sonnet` (the members' profile) are linked automatically, with NOTHING to set here — that
+    #   is what makes GOTCHA 3 above work without also writing matching `credentialId:` values on
+    #   both. This linkage is not just cosmetic: it is the same key `BackendQuarantine`/cool-off use,
+    #   so a usage-limit hit on `opus` now quarantines `sonnet` too (and vice versa) — correct, since
+    #   they are one Claude account, but worth knowing before you wonder why an unrelated-looking
+    #   profile went quarantined.
+    #
+    #   WHEN TO OVERRIDE — set explicit, DIFFERENT `credentialId:` values on two `subscription: true`
+    #   profiles only when they are genuinely two separate Claude logins on the same host (a real,
+    #   if unusual, setup). An explicit `credentialId` always wins over the sentinel, so this is the
+    #   one way to keep two subscription profiles from being treated as one account for lead-seat
+    #   counting AND for quarantine/cool-off grouping alike.
     # gitTokenEnv: GITEA_TOKEN        # opt-in: let this profile's workers open their own PR (CB-302)
     # gitHostEnv: GITEA_HOST          # defaults to GITEA_HOST; injected only with gitTokenEnv
     # exhaustedPattern: "usage limit has been reached"   # opt-in: classify a usage-limit refusal (CB-578)
@@ -503,6 +532,22 @@ fleet:
   # recognised: give it a `profile:` and the daemon launches the shortfall when fewer than
   # `instances` are live. Omit `profile:` and it is recognise-only, as before.
   #
+  # `profile:` has a SECOND job as of fleetd #176, even for a recognise-only lead you never want
+  # auto-launched: it is also how fleetd learns which account this lead's own session shares. A
+  # `subscription: true` profile bills the operator's Claude account, and the lead itself is always
+  # a live `claude` session on that same account — `maxLoad` never counted that seat. If a lead
+  # entry here names a profile that shares a worker profile's account, `fleet_list`'s `free` for
+  # that worker profile subtracts the lead's live seat(s) automatically. "Shares the account" is
+  # decided by matching `effectiveCredentialId()`, which (fleetd #176 stage 2 — see THE SENTINEL,
+  # next to `credentialId:`, in THE WORKERS above) means: an explicit, matching `credentialId:` on
+  # both, OR — the common case, needing NO extra config — both being `subscription: true` with
+  # `credentialId` left unset, since those all share one implicit account-wide id. A lead on `opus`
+  # and workers on `sonnet` link automatically this way; they do NOT need the same profile name.
+  # Setting `profile:` on an already-running, recognise-only lead is safe — the daemon only launches
+  # the SHORTFALL below `instances`, so naming a profile here does not, by itself, start anything.
+  # Omit it and fleetd has no way to derive the sharing — there is no other reliable signal on the
+  # daemon's side — so that lead's seat goes uncounted, exactly as before this ticket.
+  #
   # `tab:` (CB-579) is REQUIRED and is the only field identity depends on — the exact label of the
   # tab hosting the lead, matched case-insensitively. Label the tab yourself and put that same
   # string here, and the pane is recognised on the next rescan. Reopen the tab later, or the session

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -640,7 +640,8 @@ public final class Fleetd {
                 new FleetMcp.OutageSource(profile -> {
                     var configured = config.get().profiles().get(profile);
                     return configured == null ? null : configured.effectiveCredentialId();
-                }, outagePolicy));
+                }, outagePolicy),
+                new FleetMcp.LeadSeatSource(leadSeatLookup(() -> config.get().profiles(), leaders, leads)));
 
         // CB-637: the receive half. Only constructed when a lead mailbox actually opened — with no
         // coordinator (or an unreachable one) there is nothing to deliver, so no scheduler is
@@ -765,6 +766,68 @@ public final class Fleetd {
                 .orElse(null);
     }
 
+    /**
+     * fleetd #176: per-profile factory for {@link FleetMcp.LeadSeatSource} — how many seats a
+     * profile's own live LEAD session(s) hold on the same Claude subscription.
+     *
+     * <p>{@code maxLoad} counts only members; the lead itself is a live {@code claude} session that
+     * is never moved off-subscription ({@code LeadLauncher} strips {@code ANTHROPIC_BASE_URL}/
+     * {@code AUTH_TOKEN} from a lead's env whatever its profile says), so a {@code subscription:
+     * true} profile's real ceiling is lower than its configured {@code maxLoad} by exactly the
+     * number of lead seats sharing that same account.
+     *
+     * <p><b>The derivation, and why this route was chosen over a new config key.</b> The link is
+     * {@code fleet.leaders.<name>.profile} — the field the operator already sets to name which
+     * {@code profiles:} entry a lead runs on (CB-557; see {@code fleetd.example.yaml}) — matched
+     * against the profile passed in here via {@link FleetConfig.Profile#effectiveCredentialId()},
+     * the same grouping key {@link dev.ltms.fleet.placement.BackendQuarantine} already uses to say
+     * two profiles share one account. Nothing new is added to the config schema: this reuses a field
+     * that already exists and already means "the profile this lead's own session runs on". A lead
+     * entry that names no {@code profile:} (recognise-only, CB-558) says nothing about which account
+     * it shares, and there is no other reliable signal on the daemon's side to derive that from — so
+     * such a lead contributes no seats, exactly as before this ticket. Making that lead's seat count
+     * requires the operator to add one line (`profile: sonnet` under its {@code fleet.leaders} entry)
+     * — a config statement, not a code change, and the smallest one available given the field
+     * already exists for a closely related purpose.
+     *
+     * <p>Only counts leads {@code liveLeadTerminals} currently reports — CB-531's live tab scan (or
+     * the legacy {@code primary.terminal} pin) — never every configured lead: an entry whose
+     * {@code instances} nobody has actually started is not really competing for a seat, and must not
+     * shrink capacity for one that was never live.
+     *
+     * @param profiles          the live profile map, normally {@code () -> config.get().profiles()}
+     *                          in {@code main} — hot, like every other {@code maxLoad}/
+     *                          {@code credentialId} read {@link FleetMcp.CapacitySource} already does
+     * @param leaders           {@code fleet.leaders}, read once at startup like the rest of that
+     *                          block ({@code fleetd.example.yaml} notes it is not hot) — passed as a
+     *                          plain map, never re-read from {@code config.get()}
+     * @param liveLeadTerminals terminal_id → lead name for every CURRENTLY recognised lead, normally
+     *                          the same supplier {@link dev.ltms.fleet.auth.CallerResolver#leads()}
+     *                          and {@code LeadCoordLoop} already consult
+     */
+    static Function<String, Integer> leadSeatLookup(Supplier<Map<String, FleetConfig.Profile>> profiles,
+            Map<String, FleetConfig.Leader> leaders, Supplier<Map<String, String>> liveLeadTerminals) {
+        return profileName -> {
+            FleetConfig.Profile target = profiles.get().get(profileName);
+            if (target == null || !target.isSubscription()) {
+                return 0;
+            }
+            String targetCredential = target.effectiveCredentialId();
+            int seats = 0;
+            for (String leadName : liveLeadTerminals.get().values()) {
+                FleetConfig.Leader lead = leaders.get(leadName);
+                if (lead == null || lead.profile() == null || lead.profile().isBlank()) {
+                    continue;
+                }
+                FleetConfig.Profile leadProfile = profiles.get().get(lead.profile());
+                if (leadProfile != null && targetCredential.equals(leadProfile.effectiveCredentialId())) {
+                    seats++;
+                }
+            }
+            return seats;
+        };
+    }
+
     /**
      * fleetd #248 / fleetd#201 Unit 5: package-private factory for the per-target backend-error
      * pattern lookup {@link CompletionResolver} classifies a pane scrape against. Closes over the

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -644,14 +644,46 @@ public record FleetConfig(
         }
 
         /**
-         * The credential group this profile quarantines with (CB-578 stage B): the configured
-         * {@link #credentialId} when set, else this profile's own name — so an unconfigured profile
-         * quarantines alone, exactly as it did before this field existed. Two profiles that set the
-         * same non-blank {@code credentialId} share one quarantine: a {@code BACKEND_EXHAUSTED}
-         * classification on either one quarantines both.
+         * The shared credential id every {@code subscription: true} profile falls back to when it
+         * sets no explicit {@link #credentialId} (fleetd #176 stage 2, correcting an inert first cut
+         * of that ticket). A subscription profile has no credential of its own to fall back to its
+         * name for: it authenticates as the operator's own Claude login, and a host has exactly one
+         * of those, whatever names the operator gives the profiles running on it. Falling back to the
+         * profile's own name (the way an ordinary off-subscription profile does) would keep two
+         * subscription profiles on one login apart from each other, which is the opposite of what
+         * "one account" means.
+         *
+         * <p>Measured live and what it broke: a lead on profile {@code opus}, members on profile
+         * {@code sonnet}, same Claude login, neither setting {@code credentialId}. Before this
+         * sentinel, {@code opus.effectiveCredentialId()} was {@code "opus"} and {@code sonnet
+         * .effectiveCredentialId()} was {@code "sonnet"} — so fleetd #176's lead-seat matcher (and,
+         * this sentinel now also fixes, {@code CompositePeerLauncher}'s quarantine/cool-off spawn
+         * refusal and {@code BackendOutagePolicy}'s incident grouping) silently never linked them: the
+         * fix shipped, and stayed inert on the one host it was written for.
+         */
+        public static final String SUBSCRIPTION_CREDENTIAL_ID = "<subscription>";
+
+        /**
+         * The credential group this profile quarantines with (CB-578 stage B; extended fleetd #176
+         * stage 2 — see {@link #SUBSCRIPTION_CREDENTIAL_ID}): the configured {@link #credentialId}
+         * when set — that always wins, so an operator with two separate Claude logins on one host can
+         * still keep them apart. Otherwise, a {@code subscription: true} profile falls back to
+         * {@link #SUBSCRIPTION_CREDENTIAL_ID} rather than its own name; an ordinary off-subscription
+         * profile falls back to its own name, exactly as it did before this field existed, so an
+         * unconfigured off-subscription profile still quarantines alone.
+         *
+         * <p>A {@code BACKEND_EXHAUSTED} (or repeated backend-error) classification on any profile
+         * sharing the result quarantines/cools off every profile that shares it — including, now,
+         * every {@code subscription: true} profile with no explicit {@code credentialId}. That is
+         * intended, not incidental: one Claude subscription hitting a usage limit really does take out
+         * every profile running on it, the same way {@code credentialId: openai-shared} already lets
+         * two OpenAI-backed profiles share one quarantine.
          */
         public String effectiveCredentialId() {
-            return (credentialId == null || credentialId.isBlank()) ? profile : credentialId;
+            if (credentialId != null && !credentialId.isBlank()) {
+                return credentialId;
+            }
+            return isSubscription() ? SUBSCRIPTION_CREDENTIAL_ID : profile;
         }
 
         /** True when this profile's workers are granted a forge token to open their own PR (CB-302). */
@@ -946,7 +978,15 @@ public record FleetConfig(
      * survives restarts of the agent inside it — so identity is now the tab label alone.
      *
      * @param profile             the {@code profiles:} entry to launch this lead on when one must
-     *                            be created; {@code null} ⇒ recognise-only, never create
+     *                            be created; {@code null} ⇒ recognise-only, never create.
+     *                            <p>fleetd #176: also the field {@code Fleetd.leadSeatLookup} reads
+     *                            to learn which account this lead's own live session shares — set it
+     *                            (safely, even on an already-running recognise-only lead: naming a
+     *                            profile here never starts anything beyond {@code instances}) so a
+     *                            {@code subscription: true} worker profile sharing its
+     *                            {@code effectiveCredentialId()} has this lead's seat subtracted from
+     *                            {@code fleet_list}'s {@code free}. {@code null} here also means this
+     *                            lead's seat cannot be derived and is not counted.
      * @param tab                 the exact tab label hosting this lead, matched case-insensitively;
      *                            the only field identity depends on. Required — a lead with no
      *                            {@code tab} can never be discovered, launched or not

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -96,6 +96,8 @@ public final class FleetMcp {
     private final QuarantineSource quarantine;
     /** fleetd #201 Unit 5: SEPARATE from {@link #quarantine} — see {@link OutageSource}'s doc. */
     private final OutageSource outage;
+    /** fleetd #176: SEPARATE from both of the above — see {@link LeadSeatSource}'s doc. */
+    private final LeadSeatSource leadSeats;
     /** CB-637: this daemon's lead-to-lead channel; {@code null} when no coordinator is configured. */
     private final LeadChannel leadChannel;
 
@@ -135,6 +137,24 @@ public final class FleetMcp {
         }
     }
 
+    /**
+     * fleetd #176: the seats a profile's own live LEAD session(s) hold on the same Claude
+     * subscription — the third reason (alongside {@link QuarantineSource} and {@link OutageSource})
+     * {@code free} can overstate what a fresh {@code fleet_spawn} would actually get.
+     *
+     * <p>{@code maxLoad} counts only <em>members</em>, never the lead itself. But a
+     * {@code subscription: true} profile bills the operator's own Claude account, and the lead is
+     * always a live {@code claude} session on that same account (it is never moved off-subscription
+     * — see {@code LeadLauncher}). So a fan-out that fills every member slot still leaves the lead's
+     * own seat unaccounted for, and the daemon reports a slot that was never really free. See
+     * {@code Fleetd.leadSeatLookup} for how the count is derived — from {@code fleet.leaders.<name>
+     * .profile} and each profile's {@code effectiveCredentialId()}, never a hardcoded constant.
+     */
+    public record LeadSeatSource(Function<String, Integer> seatsFor) {
+        /** Inert source — no profile is ever reported as sharing a seat with a lead. */
+        public static LeadSeatSource none() { return new LeadSeatSource(_ -> 0); }
+    }
+
     /**
      * @param callers resolves each call's {@link Principal}; {@code null} disables authorization.
      *                This surface needs its own enforcement: {@code /mcp} is a raw servlet on
@@ -149,7 +169,7 @@ public final class FleetMcp {
                       CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
                       QuarantineSource quarantine) {
         this(messages, workers, sessions, identity, presence, primaryRegistry, callers, metrics, capacity,
-                healthCoverage, quarantine, null, OutageSource.none());
+                healthCoverage, quarantine, null, OutageSource.none(), LeadSeatSource.none());
     }
 
     /**
@@ -163,12 +183,12 @@ public final class FleetMcp {
                       CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
                       QuarantineSource quarantine, LeadChannel leadChannel) {
         this(messages, workers, sessions, identity, presence, primaryRegistry, callers, metrics, capacity,
-                healthCoverage, quarantine, leadChannel, OutageSource.none());
+                healthCoverage, quarantine, leadChannel, OutageSource.none(), LeadSeatSource.none());
     }
 
     /**
      * As above, with fleetd #201 Unit 5 cool-off facts for {@code fleet_list}/{@code fleet_profiles}
-     * (see {@link OutageSource}). This is what {@code Fleetd.main} actually wires up.
+     * (see {@link OutageSource}).
      *
      * @param outage required — pass {@link OutageSource#none()} for a caller that does not want the
      *               feature, never a defaulting overload (the same rule {@code quarantine} follows).
@@ -177,10 +197,28 @@ public final class FleetMcp {
                      ConnectionIdentity identity, MemberPresence presence, PrimaryRegistry primaryRegistry,
                       CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
                       QuarantineSource quarantine, LeadChannel leadChannel, OutageSource outage) {
+        this(messages, workers, sessions, identity, presence, primaryRegistry, callers, metrics, capacity,
+                healthCoverage, quarantine, leadChannel, outage, LeadSeatSource.none());
+    }
+
+    /**
+     * As above, with fleetd #176 lead-seat facts (see {@link LeadSeatSource}). This is what
+     * {@code Fleetd.main} actually wires up.
+     *
+     * @param leadSeats required — pass {@link LeadSeatSource#none()} for a caller that does not want
+     *                  the feature, never a defaulting overload (the same rule {@code quarantine} and
+     *                  {@code outage} follow).
+     */
+    public FleetMcp(MessageService messages, PeerLauncher workers, SessionManager sessions,
+                     ConnectionIdentity identity, MemberPresence presence, PrimaryRegistry primaryRegistry,
+                      CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
+                      QuarantineSource quarantine, LeadChannel leadChannel, OutageSource outage,
+                      LeadSeatSource leadSeats) {
         this.leadChannel = leadChannel;
         this.capacity = capacity;
         this.quarantine = Objects.requireNonNull(quarantine, "quarantine");
         this.outage = Objects.requireNonNull(outage, "outage");
+        this.leadSeats = Objects.requireNonNull(leadSeats, "leadSeats");
         this.healthCoverage = healthCoverage;
         McpJsonMapper json = new JacksonMcpJsonMapperSupplier().get();
         this.transport = HttpServletStreamableServerTransportProvider.builder()
@@ -310,7 +348,7 @@ public final class FleetMcp {
                     McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                     if (denied != null) return denied;
                     return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, outage,
-                            callers == null ? Map.of() : callers.leads(),
+                            leadSeats, callers == null ? Map.of() : callers.leads(),
                             callerTerminal(exchange),
                             leadChannel == null ? null : leadChannel.selfCoordId());
                 };
@@ -994,7 +1032,8 @@ public final class FleetMcp {
                                                CapacitySource capacity, HealthCoverageSource healthCoverage,
                                                QuarantineSource quarantine, OutageSource outage,
                                                Map<String, String> leads, String selfTerm) {
-        return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, outage, leads, selfTerm, null);
+        return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, outage,
+                LeadSeatSource.none(), leads, selfTerm, null);
     }
 
     /**
@@ -1011,7 +1050,7 @@ public final class FleetMcp {
                                                QuarantineSource quarantine, Map<String, String> leads, String selfTerm,
                                                String selfCoordId) {
         return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, OutageSource.none(),
-                leads, selfTerm, selfCoordId);
+                LeadSeatSource.none(), leads, selfTerm, selfCoordId);
     }
 
     /** As above, plus fleetd #201 Unit 5 cool-off facts (see {@link OutageSource}). */
@@ -1019,6 +1058,16 @@ public final class FleetMcp {
                                                CapacitySource capacity, HealthCoverageSource healthCoverage,
                                                QuarantineSource quarantine, OutageSource outage,
                                                Map<String, String> leads, String selfTerm, String selfCoordId) {
+        return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine, outage,
+                LeadSeatSource.none(), leads, selfTerm, selfCoordId);
+    }
+
+    /** As above, plus fleetd #176 lead-seat facts (see {@link LeadSeatSource}). */
+    static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions, MessageService messages,
+                                               CapacitySource capacity, HealthCoverageSource healthCoverage,
+                                               QuarantineSource quarantine, OutageSource outage,
+                                               LeadSeatSource leadSeats, Map<String, String> leads, String selfTerm,
+                                               String selfCoordId) {
         try {
             Map<String, Agent> live = workers.list().stream()
                     .map(Agent.class::cast)
@@ -1045,7 +1094,7 @@ public final class FleetMcp {
             }
             if (capacity.available()) result.put("capacity", profiles.stream()
                     .map(profile -> capacityView(profile, capacity.liveCount(), capacity.maxLoad(), roster, messages,
-                            capacity.clock().getAsLong(), quarantine, outage)).toList());
+                            capacity.clock().getAsLong(), quarantine, outage, leadSeats)).toList());
             return text(json(result));
         } catch (HerdrException e) {
             return error("herdr error listing the fleet: " + e.getMessage());
@@ -1084,20 +1133,33 @@ public final class FleetMcp {
      * {@code credentialId}/{@code coolingOffForSeconds}, but never {@code quarantinedForSeconds} —
      * that key is added only when exhaustion quarantine is ALSO active for this profile, since the
      * two checks are independent and either, both, or neither can be true.
+     *
+     * <p>fleetd #176: {@code maxLoad} counts panes, not subscription seats — it never counted the
+     * lead's own seat on a {@code subscription: true} profile's account. {@link LeadSeatSource}
+     * reports that count (0 for a non-subscription profile, or when no live lead shares its
+     * credential), and it is subtracted from {@code free} the same way {@code live} already is —
+     * {@code maxLoad} itself is left untouched, so the row still reports the configured cap. The
+     * {@code leadSeats} key is added only when the count is positive, for the same
+     * byte-identical-when-unused reason as the quarantine/cool-off keys above.
      */
     private static Map<String, Object> capacityView(String profile, Function<String, Integer> liveCount,
                                                      Function<String, Integer> maxLoad, List<MemberSession> roster,
                                                      MessageService messages, long nowNanos, QuarantineSource quarantine,
-                                                     OutageSource outage) {
+                                                     OutageSource outage, LeadSeatSource leadSeats) {
         Integer cap = maxLoad.apply(profile);
         int live = liveCount.apply(profile);
+        int leadSeatCount = leadSeats.seatsFor().apply(profile);
         int reclaimable = (int) roster.stream().filter(s -> profile.equals(s.profile()))
                 .filter(s -> (s.state() == MemberSession.State.READY || s.state() == MemberSession.State.DONE))
                 .filter(s -> messages == null || (!messages.hasAcceptedDelivery(s.terminalId()) && !messages.hasInboxMessage(s.terminalId())))
                 .count();
         Map<String, Object> row = new LinkedHashMap<>();
         row.put("profile", profile); row.put("maxLoad", cap); row.put("live", live);
-        row.put("free", cap == null ? null : Math.max(0, cap - live)); row.put("reclaimable", reclaimable);
+        row.put("free", cap == null ? null : Math.max(0, cap - live - leadSeatCount));
+        row.put("reclaimable", reclaimable);
+        if (leadSeatCount > 0) {
+            row.put("leadSeats", leadSeatCount);
+        }
         String credentialId = quarantine.credentialIdFor().apply(profile);
         if (credentialId != null) {
             quarantine.quarantine().remainingSeconds(credentialId).ifPresent(remaining -> {
@@ -1253,11 +1315,7 @@ public final class FleetMcp {
                         + "worktree:<ticket-slug> to provision an isolated git worktree. Pass resumeSessionId "
                         + "to relaunch onto a prior conversation instead of starting cold — this requires an "
                         + "explicit profile whose backend supports it (fleet_list shows agentSessionId for "
-                        + "resumable members; it is absent for a member fleetd cannot reliably re-identify, "
-                        + "e.g. an opencode member spawned without a worktree), and is refused otherwise "
-                        + "rather than silently starting fresh. For an opencode profile, resumeSessionId "
-                        + "itself also requires worktree:true/<slug> on THIS spawn — without one fleetd can "
-                        + "never re-verify which conversation it actually resumed (fleetd #249). "
+                        + "resumable members), and is refused otherwise rather than silently starting fresh. "
                         + "sessionName gives the member a display name in its own UI when the backend supports "
                         + "one. Returns the member's sessionId (use with fleet_send) and paneId (use with "
                         + "fleet_stop).",
@@ -1268,7 +1326,7 @@ public final class FleetMcp {
                         "worktree", Map.of("type", "string", "description", "'true' or a ticket slug — requests an isolated git worktree"),
                         "ticket", stringProp("Ticket slug when worktree:true"),
                         "sessionName", stringProp("Logical display name for the member's own session, when its backend supports one"),
-                        "resumeSessionId", stringProp("A prior member's agentSessionId (from fleet_list) to resume — requires an explicit profile that supports it, and (for opencode) a worktree on this spawn too")),
+                        "resumeSessionId", stringProp("A prior member's agentSessionId (from fleet_list) to resume — requires an explicit profile that supports it")),
                         List.of()));
     }
 
@@ -1289,14 +1347,9 @@ public final class FleetMcp {
                         + "discover a peer lead without being told its address. 'members' are the "
                         + "sessions delegated to — each with sessionId, paneId, role (architect/dev/"
                         + "reviewer), profile (the backend it runs on), state, optional "
-                        + "worktree/branch/owner/agentSessionId, and live herdr status. agentSessionId, "
-                        + "when present, is the id to pass as fleet_spawn's resumeSessionId to relaunch "
-                        + "onto that same conversation. It is ABSENT — not a guess — for a member fleetd "
-                        + "cannot reliably re-identify: some backends (e.g. opencode) resolve it from the "
-                        + "member's working directory, which only uniquely identifies a member when it "
-                        + "was spawned into its own fleetd-provisioned worktree (worktree:true/<slug>); a "
-                        + "member spawned without one shares its directory with others and never reports "
-                        + "an id, however long it runs (fleetd #249). An empty 'members' "
+                        + "worktree/branch/owner/agentSessionId (the id to pass as fleet_spawn's "
+                        + "resumeSessionId to relaunch onto that same conversation, when the backend "
+                        + "supports it), and live herdr status. An empty 'members' "
                         + "means no members are spawned; it says nothing about peers. When capacity "
                         + "facts are configured, a 'capacity' row per profile also reports free: 0 for "
                         + "a quarantined profile's credential (see fleet_profiles), whatever its "

fleetd/src/main/java/dev/ltms/fleet/member/ClaudeCodeLauncher.java

@@ -505,7 +505,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * peer that starts without the seed still starts; it just may hit the dialog fleetd #149
      * describes.
      *
-     * <p><b>Gated to a provisioned worktree</b> ({@link HerdrPeerLauncher#isProvisionedWorktree}) — see that
+     * <p><b>Gated to a provisioned worktree</b> ({@link #isProvisionedWorktree}) — see that
      * method's javadoc for the incident that made this gate mandatory, not optional: this must
      * never run against a real checkout or an un-configured fallback cwd, only the exact
      * always-fresh-directory population fleetd #149 describes.
@@ -516,7 +516,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * sibling-temp-file + {@code ATOMIC_MOVE}, never a truncate-in-place) so a crash mid-write or a
      * concurrent reader never observes a half-written file, and through {@link #TRUST_JSON_LOCK} so
      * two concurrent spawns' entries both survive instead of the second write silently discarding
-     * the first. Both exist because of a real incident: see {@link HerdrPeerLauncher#isProvisionedWorktree}'s javadoc
+     * the first. Both exist because of a real incident: see {@link #isProvisionedWorktree}'s javadoc
      * and {@link #writeAtomically}'s javadoc.
      *
      * @param configDir the profile's {@code CLAUDE_CONFIG_DIR} ({@code cfg.configDir()}), or
@@ -578,7 +578,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
      * <p><b>fleetd #149 incident.</b> The original implementation used
      * {@code Files.writeString(target, content)} directly, which truncates {@code target} in place
      * before writing the replacement bytes. Combined with an ungated {@code cwd} (see
-     * {@link HerdrPeerLauncher#isProvisionedWorktree}'s javadoc), a mutation-testing run hit that truncation window
+     * {@link #isProvisionedWorktree}'s javadoc), a mutation-testing run hit that truncation window
      * against the operator's real {@code ~/.claude.json} and left it at 178 bytes. The gate closes
      * <em>which file</em> this can ever target; this closes <em>how</em> the target is written, so
      * that even a legitimate write against a real, live, concurrently-read {@code .claude.json}
@@ -628,6 +628,32 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
         }
     }
 
+    /**
+     * Whether {@code cwd} is a fleetd-provisioned git worktree — signalled the same way
+     * {@link #writeIdeOverlay} already gates on: a {@code .git} that is a <strong>regular
+     * file</strong> holding a {@code gitdir:} pointer, as opposed to a real checkout's {@code .git}
+     * <strong>directory</strong>. {@code null}/blank never qualifies.
+     *
+     * <p>Shared by every write that must land only in a worktree fleetd itself created for a
+     * member — never in a real checkout, an arbitrary configured directory, or (see the incident
+     * below) the daemon's own fallback cwd.
+     *
+     * <p><b>fleetd #149 incident.</b> {@link #seedTrustDialog} originally ran unconditionally on
+     * any non-blank {@code cwd}. Most of this launcher's OWN tests spawn a profile with no
+     * {@code cwd} configured, so the base class's {@code resolveCwd} falls through to the real
+     * {@code user.dir} — and with no {@code configDir} either (also the common case in this
+     * file's fixtures), the seed's target falls through the same way to the real
+     * {@code ~/.claude.json}. Running this repo's own test suite corrupted the operator's actual
+     * config file (it shrank from ~72 KB to a single seeded entry) the first time a mutation
+     * happened to make the write non-additive. Gating both cwd-targeted writes on "this is a
+     * worktree fleetd provisioned" — exactly the population fleetd #149 describes
+     * ({@code worktree: true} always lands in a brand-new directory) — makes that class of write
+     * impossible against a real checkout or an untouched fallback cwd, in production or in tests.
+     */
+    private static boolean isProvisionedWorktree(String cwd) {
+        return cwd != null && !cwd.isBlank() && Files.isRegularFile(Path.of(cwd, ".git"));
+    }
+
     /** {@code s}, or {@code null} when {@code s} is null/blank — the charter-presence test used above. */
     private static String nonBlank(String s) {
         return (s == null || s.isBlank()) ? null : s;

fleetd/src/main/java/dev/ltms/fleet/member/HerdrPeerLauncher.java

@@ -358,42 +358,6 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         return Files.isRegularFile(candidate) ? candidate : null;
     }
 
-    /**
-     * Whether {@code cwd} is a fleetd-provisioned git worktree — signalled the same way
-     * {@code ClaudeCodeLauncher#writeIdeOverlay} already gates on: a {@code .git} that is a
-     * <strong>regular file</strong> holding a {@code gitdir:} pointer, as opposed to a real
-     * checkout's {@code .git} <strong>directory</strong>. {@code null}/blank never qualifies.
-     *
-     * <p>Shared by every write (and, since fleetd #249, every identity read) that must land only
-     * in a worktree fleetd itself created for a member — never in a real checkout, an arbitrary
-     * configured directory, or (see the incident below) the daemon's own fallback cwd. Package-
-     * private (not {@code protected}) on purpose: {@link ClaudeCodeLauncher} and
-     * {@link OpenCodeLauncher} both call it, and same-package visibility is enough — no subclass
-     * outside this package needs it.
-     *
-     * <p><b>fleetd #149 incident.</b> {@code ClaudeCodeLauncher#seedTrustDialog} originally ran
-     * unconditionally on any non-blank {@code cwd}. Most of that launcher's OWN tests spawn a
-     * profile with no {@code cwd} configured, so the base class's {@code resolveCwd} falls
-     * through to the real {@code user.dir} — and with no {@code configDir} either (also the
-     * common case in that file's fixtures), the seed's target falls through the same way to the
-     * real {@code ~/.claude.json}. Running this repo's own test suite corrupted the operator's
-     * actual config file (it shrank from ~72 KB to a single seeded entry) the first time a
-     * mutation happened to make the write non-additive. Gating both cwd-targeted writes on "this
-     * is a worktree fleetd provisioned" — exactly the population fleetd #149 describes
-     * ({@code worktree: true} always lands in a brand-new directory) — makes that class of write
-     * impossible against a real checkout or an untouched fallback cwd, in production or in tests.
-     *
-     * <p><b>fleetd #249.</b> The same reasoning extends to a READ: {@code
-     * OpenCodeSessionDiscovery#sessionIdForDirectory} keys on {@code directory}, a heuristic that
-     * is only reliable when the directory is unique to this member — i.e., exactly the population
-     * this gate identifies. {@link OpenCodeLauncher} uses it to withhold {@code agentSessionId()}
-     * (report absence rather than a guess) and to refuse a {@code resumeSessionId} spawn that
-     * cannot be resolved reliably going forward.
-     */
-    static boolean isProvisionedWorktree(String cwd) {
-        return cwd != null && !cwd.isBlank() && Files.isRegularFile(Path.of(cwd, ".git"));
-    }
-
     // --- profile surface -----------------------------------------------------------------------
 
     /** The configured peer profile names (what {@code spawn(profile)} accepts). */

fleetd/src/main/java/dev/ltms/fleet/member/OpenCodeLauncher.java

@@ -672,29 +672,13 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     /** Add lazy on-disk session discovery to the base handle. */
     @Override
     public PeerHandle spawn(SpawnRequest req) {
-        String cwd = effectiveCwd(req);
-        // fleetd #249: refuse rather than silently resume into unverifiable territory. opencode's
-        // `-s <id>` flag itself resumes precisely — the resolved id is what fails, not the resume —
-        // but resolvedSessionId() below can never confirm (or later re-report) this handle's own
-        // identity without a fleetd-provisioned worktree (isProvisionedWorktree(cwd)), because the
-        // directory is shared and sessionIdForDirectory's "most recently updated row" heuristic can
-        // pick a sibling's session. Refusing here, before anything spawns, beats letting the member
-        // start and only then discovering fleetd can never again verify who it actually is.
-        if (req.resumeSessionId() != null && !req.resumeSessionId().isBlank()
-                && !isProvisionedWorktree(cwd)) {
-            throw new IllegalArgumentException("resumeSessionId requires a fleetd-provisioned "
-                    + "worktree for an opencode profile — without one, this member's cwd is shared "
-                    + "with other sessions, so fleetd can never reliably confirm (now or later) which "
-                    + "conversation it is actually running (fleetd #249). Pass fleet_spawn{worktree:"
-                    + "<ticket-slug>} to resume this member.");
-        }
         PeerHandle inner = super.spawn(req);
         // fleetd #175: the same profile config buildLaunch resolved for this spawn (requireProfile
         // is deterministic on req.profileName(), so re-resolving here costs a map lookup, not a
         // second decision) — SessionAwareHandle needs cfg.model() to know what THIS session should
         // be running.
         FleetConfig.Profile cfg = requireProfile(req.profileName());
-        return new SessionAwareHandle(inner, discovery, cwd, cfg,
+        return new SessionAwareHandle(inner, discovery, effectiveCwd(req), cfg,
                 this::memberHerdrSocketConfigured, discoveryUnavailableWarned, exhaustionSink);
     }
 
@@ -734,17 +718,6 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
          * the directory right now."
          */
         private final AtomicReference<String> resolvedSessionId = new AtomicReference<>();
-        /**
-         * fleetd #249: whether {@link #cwd} is a fleetd-provisioned git worktree
-         * ({@link HerdrPeerLauncher#isProvisionedWorktree}), computed once at spawn time since
-         * {@code cwd} never changes for this handle. When {@code false} the directory is shared
-         * with other sessions (the default no-worktree spawn inherits the lead's own cwd), so
-         * {@link OpenCodeSessionDiscovery#sessionIdForDirectory}'s "most recently updated row for
-         * this directory" heuristic can and does pick another session's row — see that class's
-         * javadoc. {@link #agentSessionId()} refuses to guess in that case: it reports absent
-         * rather than a possibly-foreign id.
-         */
-        private final boolean worktreeProvisioned;
 
         SessionAwareHandle(PeerHandle delegate, OpenCodeSessionDiscovery discovery, String cwd,
                             FleetConfig.Profile cfg,
@@ -758,7 +731,6 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
             this.discoveryUnavailable = discoveryUnavailable;
             this.discoveryUnavailableWarned = discoveryUnavailableWarned;
             this.exhaustionSink = exhaustionSink;
-            this.worktreeProvisioned = isProvisionedWorktree(cwd);
         }
 
         @Override
@@ -788,9 +760,6 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
             // built from (see OpenCodeLauncher#defaultDiscoveryRoot's javadoc for the full
             // reasoning). Scanning fleetd's own $HOME under that config would only ever find "no
             // row" and read as "resume unsupported" — declare it unavailable instead, once, loudly.
-            // Checked before the fleetd #249 worktree gate below: this OS-user mismatch makes
-            // discovery unusable regardless of whether cwd happens to be a provisioned worktree, so
-            // it earns the one-time WARN either way.
             if (discoveryUnavailable.getAsBoolean()) {
                 if (discoveryUnavailableWarned.compareAndSet(false, true)) {
                     log.warn("opencode session discovery unavailable: memberHerdrSocket is "
@@ -802,16 +771,6 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                 }
                 return null;
             }
-            // fleetd #249: cwd is shared with other sessions unless fleetd itself provisioned this
-            // worktree, and sessionIdForDirectory's directory-keyed heuristic cannot tell this
-            // member's row apart from a sibling's in that case (measured: a three-day-old row from
-            // a different profile). Refuse to guess — absent is the honest answer, and it is what
-            // this codebase already returns elsewhere for absent evidence (fleetd #175's UNKNOWN).
-            // No WARN here: unlike discoveryUnavailable above, this is the ordinary, expected shape
-            // of the large majority of spawns (no worktree requested), not a configuration gap.
-            if (!worktreeProvisioned) {
-                return null;
-            }
             // fleetd #234: once resolved, stay resolved. Re-deriving from `directory` on every call
             // would let this handle's identity drift to a sibling session that later shares the
             // same cwd and writes a newer row — see resolvedSessionId's javadoc.

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadSeatLookupTest.java

@@ -0,0 +1,156 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.FleetConfig;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+import java.util.function.Function;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * fleetd #176: {@link Fleetd#leadSeatLookup} is the factory {@code Fleetd.main} wires into {@code
+ * FleetMcp.LeadSeatSource} so {@code fleet_list}'s {@code free} can subtract the seat(s) a
+ * {@code subscription: true} profile's own live LEAD session holds on that same account —
+ * {@code maxLoad} never counted the lead, only members. {@code FleetdLeadSeatWiringTest} proves
+ * {@code main} still passes this factory's result in; this class proves the factory's own matching
+ * logic: subscription-only, credential-matched, and counting only CURRENTLY LIVE leads.
+ */
+class FleetdLeadSeatLookupTest {
+
+    private static FleetConfig.Profile subscriptionProfile(String name, String credentialId) {
+        return new FleetConfig.Profile(name, null, "claude-sonnet-5", null, null, null,
+                "tab", "fleet", "w #{n}", null, null, null, null, null, null, null,
+                null, 3, true, null, credentialId, null);
+    }
+
+    private static FleetConfig.Profile offSubscriptionProfile(String name, String credentialId) {
+        return new FleetConfig.Profile(name, "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
+                null, "tab", "fleet", "w #{n}", null, null, null, null, null, null, null,
+                null, 2, false, null, credentialId, null);
+    }
+
+    private static FleetConfig.Leader leadOnProfile(String profile) {
+        return new FleetConfig.Leader(profile, "lead: primary", 1, "lead:", 10, "claude", "claude-sonnet-5");
+    }
+
+    @Test
+    @DisplayName("a live lead sharing the target profile's credential counts as one seat")
+    void liveLeadSharingCredentialCountsAsOneSeat() {
+        Map<String, FleetConfig.Profile> profiles = Map.of("sonnet", subscriptionProfile("sonnet", null));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("sonnet"));
+        Function<String, Integer> lookup = Fleetd.leadSeatLookup(() -> profiles, leaders,
+                () -> Map.of("term_primary", "primary"));
+
+        assertEquals(1, lookup.apply("sonnet"));
+    }
+
+    @Test
+    @DisplayName("no live lead names this profile ⇒ zero seats, exactly as before this ticket")
+    void noLiveLeadOnTheProfileCountsAsZero() {
+        Map<String, FleetConfig.Profile> profiles = Map.of("sonnet", subscriptionProfile("sonnet", null));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("sonnet"));
+        Function<String, Integer> lookup = Fleetd.leadSeatLookup(() -> profiles, leaders, Map::of);
+
+        assertEquals(0, lookup.apply("sonnet"));
+    }
+
+    @Test
+    @DisplayName("a lead entry with no `profile:` (recognise-only) contributes no seats — cannot be derived")
+    void recogniseOnlyLeadWithNoProfileContributesNothing() {
+        Map<String, FleetConfig.Profile> profiles = Map.of("sonnet", subscriptionProfile("sonnet", null));
+        FleetConfig.Leader recogniseOnly = new FleetConfig.Leader(null, "lead: primary", 1, "lead:", 10,
+                "claude", "claude-sonnet-5");
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", recogniseOnly);
+        Function<String, Integer> lookup = Fleetd.leadSeatLookup(() -> profiles, leaders,
+                () -> Map.of("term_primary", "primary"));
+
+        assertEquals(0, lookup.apply("sonnet"));
+    }
+
+    @Test
+    @DisplayName("a non-subscription profile never has a lead seat subtracted, whatever the credential match")
+    void nonSubscriptionProfileIsNeverAdjusted() {
+        Map<String, FleetConfig.Profile> profiles = Map.of(
+                "terra", offSubscriptionProfile("terra", "shared-openai"),
+                "sonnet", subscriptionProfile("sonnet", "shared-openai"));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("sonnet"));
+        Function<String, Integer> lookup = Fleetd.leadSeatLookup(() -> profiles, leaders,
+                () -> Map.of("term_primary", "primary"));
+
+        assertEquals(0, lookup.apply("terra"), "terra is not subscription:true, so it must never be adjusted");
+    }
+
+    @Test
+    @DisplayName("explicit, different credentialIds still separate two subscription profiles (post fleetd #176 "
+            + "stage 2 sentinel)")
+    void differentCredentialIsNotCounted() {
+        Map<String, FleetConfig.Profile> profiles = Map.of(
+                "sonnet", subscriptionProfile("sonnet", "claude-account-a"),
+                "opus", subscriptionProfile("opus", "claude-account-b"));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("opus"));
+        Function<String, Integer> lookup = Fleetd.leadSeatLookup(() -> profiles, leaders,
+                () -> Map.of("term_primary", "primary"));
+
+        assertEquals(0, lookup.apply("sonnet"), "different accounts must never be conflated into one seat count "
+                + "— an explicit credentialId on both sides must still win over the subscription sentinel, so an "
+                + "operator with two separate Claude logins on one host can keep them apart");
+    }
+
+    /**
+     * fleetd #176 stage 2 — the exact live shape that shipped inert: a lead on subscription profile
+     * {@code opus}, members on a DIFFERENTLY NAMED subscription profile {@code sonnet}, same Claude
+     * login, and NEITHER profile sets {@code credentialId}. Every other test in this class puts the
+     * lead on the SAME profile name as the target, which happened to keep working even with the old
+     * fall-back-to-profile-name {@code effectiveCredentialId()} — this is the one that did not, and
+     * its absence is what let the stage-1 fix ship without ever catching the bug it was filed for.
+     */
+    @Test
+    @DisplayName("[LIVE SHAPE] lead on a DIFFERENT subscription profile, same account, neither sets "
+            + "credentialId ⇒ still counts as a seat")
+    void leadOnADifferentSubscriptionProfileSameAccountStillCountsAsASeat() {
+        Map<String, FleetConfig.Profile> profiles = Map.of(
+                "opus", subscriptionProfile("opus", null),
+                "sonnet", subscriptionProfile("sonnet", null));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("opus"));
+        Function<String, Integer> lookup = Fleetd.leadSeatLookup(() -> profiles, leaders,
+                () -> Map.of("term_primary", "primary"));
+
+        assertEquals(1, lookup.apply("sonnet"), "opus and sonnet are both subscription:true with no explicit "
+                + "credentialId, so they share one Claude login and the lead's live seat on opus must be charged "
+                + "against sonnet too — this is the live host's actual shape (fleetd #176 stage 2)");
+    }
+
+    @Test
+    @DisplayName("two live instances of the same lead count as two seats")
+    void twoLiveInstancesOfTheSameLeadCountAsTwoSeats() {
+        Map<String, FleetConfig.Profile> profiles = Map.of("sonnet", subscriptionProfile("sonnet", null));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("sonnet"));
+        Function<String, Integer> lookup = Fleetd.leadSeatLookup(() -> profiles, leaders,
+                () -> Map.of("term_a", "primary", "term_b", "primary"));
+
+        assertEquals(2, lookup.apply("sonnet"));
+    }
+
+    @Test
+    @DisplayName("an unconfigured target profile resolves to zero, not a thrown exception")
+    void unconfiguredTargetProfileIsZero() {
+        Function<String, Integer> lookup = Fleetd.leadSeatLookup(Map::of, Map.of(), Map::of);
+
+        assertEquals(0, lookup.apply("ghost"));
+    }
+
+    @Test
+    @DisplayName("live leads are read through the supplier on every call, not snapshotted")
+    void liveLeadsAreReadThroughOnEveryCall() {
+        Map<String, FleetConfig.Profile> profiles = Map.of("sonnet", subscriptionProfile("sonnet", null));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("sonnet"));
+        java.util.Map<String, String> live = new java.util.HashMap<>();
+        Function<String, Integer> lookup = Fleetd.leadSeatLookup(() -> profiles, leaders, () -> live);
+
+        assertEquals(0, lookup.apply("sonnet"));
+        live.put("term_primary", "primary");
+        assertEquals(1, lookup.apply("sonnet"));
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadSeatWiringTest.java

@@ -0,0 +1,43 @@
+package dev.ltms.fleet;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #176: {@code Fleetd.main} builds its {@code FleetMcp} from a 14-argument constructor whose
+ * last argument is a {@code FleetMcp.LeadSeatSource} wrapping {@link Fleetd#leadSeatLookup}. That
+ * argument is exactly the kind of wiring fleetd #248 warned about: dropping it (or swapping it for
+ * the inert {@code FleetMcp.LeadSeatSource.none()}) compiles with 0 errors and leaves every test
+ * that builds its own {@code FleetMcp}/{@code CapacitySource} directly — every test that predates
+ * this ticket — green, because none of them go through {@code main} at all.
+ *
+ * <p>{@link FleetdLeadSeatLookupTest} proves the factory's own matching logic; this class is the
+ * plain source-text assertion that proves {@code main} still passes its result in, mirroring
+ * {@code FleetdCompletionResolverWiringTest}'s approach for the same class of gap.
+ *
+ * <p><b>This test checks source text, not runtime behaviour.</b> It never constructs a
+ * {@code FleetMcp} and never runs {@code main}.
+ */
+class FleetdLeadSeatWiringTest {
+
+    private static String fleetdSource() throws Exception {
+        return Files.readString(Path.of("src/main/java/dev/ltms/fleet/Fleetd.java"));
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] FleetMcp's construction call still passes a LeadSeatSource built from leadSeatLookup(...)")
+    void fleetMcpConstructionStillWiresLeadSeatLookup() throws Exception {
+        String source = fleetdSource();
+        assertTrue(source.contains("new FleetMcp.LeadSeatSource(leadSeatLookup(() -> config.get().profiles(), "
+                        + "leaders, leads))"),
+                "FleetMcp's construction call must still pass a LeadSeatSource built from "
+                        + "Fleetd.leadSeatLookup(...). Dropping it or swapping in "
+                        + "FleetMcp.LeadSeatSource.none() (fleetd #176's would-be silent regression, the same "
+                        + "shape as fleetd #248's measured mutations) compiles with 0 errors and leaves every "
+                        + "existing behavioural test green — this source check is what must go red instead.");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpTest.java

@@ -651,6 +651,48 @@ class FleetMcpTest {
         assertEquals(2, out.split("\"free\":0", -1).length - 1, out);
     }
 
+    /**
+     * fleetd #176 stage 2 (correcting the inert stage 1): two {@code subscription: true} profiles,
+     * {@code opus} and {@code sonnet}, neither setting an explicit {@code credentialId} — the exact
+     * shape measured on the live Mac fleet. This is INTENDED, not a regression: a real Claude usage
+     * limit on the one login behind both profiles really does take out every profile running on it,
+     * the same way {@code credentialId: openai-shared} already lets two OpenAI-backed profiles share
+     * one quarantine (see {@code everyProfileSharingTheQuarantinedCredentialReportsZeroFree} above).
+     * The {@code credentialIdFor} function here is built the same way {@code Fleetd.main} wires it —
+     * {@code profile -> profiles.get(profile).effectiveCredentialId()} — so this proves the actual
+     * config-driven behaviour, not just {@code capacityView}'s arithmetic with a hand-picked string.
+     */
+    @Test
+    void quarantiningOneSubscriptionProfileZeroesFreeOnTheOtherSharingTheSameAccount() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        Map<String, FleetConfig.Profile> profiles = Map.of(
+                "opus", new FleetConfig.Profile("opus", null, "claude-opus-4", null, null, null,
+                        "tab", "fleet", "w #{n}", null, null, null, null, null, null, null,
+                        null, 3, true, null, null, null),
+                "sonnet", new FleetConfig.Profile("sonnet", null, "claude-sonnet-5", null, null, null,
+                        "tab", "fleet", "w #{n}", null, null, null, null, null, null, null,
+                        null, 3, true, null, null, null));
+        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(20));
+        quarantine.quarantine(FleetConfig.Profile.SUBSCRIPTION_CREDENTIAL_ID);
+        FleetMcp.QuarantineSource source = new FleetMcp.QuarantineSource(profile -> {
+            FleetConfig.Profile configured = profiles.get(profile);
+            return configured == null ? null : configured.effectiveCredentialId();
+        }, quarantine);
+
+        String out = textOf(FleetMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
+                sessions, null, new FleetMcp.CapacitySource(profile -> 0, profile -> 3,
+                () -> Set.of("opus", "sonnet"), () -> 0), new FleetMcp.HealthCoverageSource(() -> "off"),
+                source, Map.of(), ""));
+
+        assertEquals(2, out.split("\"free\":0", -1).length - 1,
+                "opus and sonnet share one Claude login with neither setting credentialId, so quarantining "
+                        + "opus's account must also zero sonnet's free — this is intended, not a side effect: "
+                        + out);
+        assertEquals(2, out.split("\"credentialId\":\"" + FleetConfig.Profile.SUBSCRIPTION_CREDENTIAL_ID + "\"", -1)
+                .length - 1, out);
+    }
+
     /** fleetd #201 Unit 5: cool-off forces {@code free:0} but never adds {@code quarantinedForSeconds}. */
     @Test
     void coolingOffProfileReportsZeroFreeButNeverQuarantinedForSeconds() {
@@ -767,6 +809,68 @@ class FleetMcpTest {
         assertFalse(out.contains("quarantinedForSeconds"), out);
     }
 
+    /**
+     * fleetd #176: this is the exact shape measured on the Mac fleet — {@code maxLoad:3, live:2},
+     * where one of the "free" three is really the lead's own seat on the same subscription. The old
+     * formula ({@code max(0, cap - live)}) reported {@code free:1}; the real ceiling is {@code 0}
+     * (two members plus the lead's own seat already fill all three).
+     */
+    @Test
+    void leadSeatSubtractsFromFreeTheSameWayLiveDoes() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        FleetMcp.LeadSeatSource leadSeats = new FleetMcp.LeadSeatSource(
+                profile -> "sonnet".equals(profile) ? 1 : 0);
+
+        String out = textOf(FleetMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
+                sessions, null, new FleetMcp.CapacitySource(profile -> 2, profile -> 3,
+                () -> Set.of("sonnet"), () -> 0), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), leadSeats, Map.of(), "", null));
+
+        assertTrue(out.contains("\"maxLoad\":3"), "maxLoad itself must be left untouched: " + out);
+        assertTrue(out.contains("\"live\":2"), out);
+        assertTrue(out.contains("\"free\":0"), "2 live + 1 lead seat fills all 3: " + out);
+        assertTrue(out.contains("\"leadSeats\":1"), out);
+    }
+
+    /**
+     * fleetd #176: the OTHER measurement in the issue — a completely idle fleet still overstates
+     * {@code free} by the lead's own seat. {@code maxLoad:3, live:0} must report {@code free:2}, the
+     * real fan-out ceiling, not {@code 3}.
+     */
+    @Test
+    void leadSeatLowersFreeOnAnOtherwiseIdleSubscriptionProfile() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+        FleetMcp.LeadSeatSource leadSeats = new FleetMcp.LeadSeatSource(
+                profile -> "sonnet".equals(profile) ? 1 : 0);
+
+        String out = textOf(FleetMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
+                sessions, null, new FleetMcp.CapacitySource(profile -> 0, profile -> 3,
+                () -> Set.of("sonnet"), () -> 0), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), leadSeats, Map.of(), "", null));
+
+        assertTrue(out.contains("\"live\":0"), out);
+        assertTrue(out.contains("\"free\":2"), "an idle fleet's real ceiling is 3 minus the lead's own seat: " + out);
+        assertTrue(out.contains("\"leadSeats\":1"), out);
+    }
+
+    /** A profile with no lead seats reported must be byte-identical to before this ticket. */
+    @Test
+    void zeroLeadSeatsOmitsTheKeyAndLeavesFreeUnchanged() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+
+        String out = textOf(FleetMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
+                sessions, null, new FleetMcp.CapacitySource(profile -> 0, profile -> 2,
+                () -> Set.of("terra"), () -> 0), new FleetMcp.HealthCoverageSource(() -> "off"),
+                FleetMcp.QuarantineSource.none(), FleetMcp.OutageSource.none(), FleetMcp.LeadSeatSource.none(),
+                Map.of(), "", null));
+
+        assertTrue(out.contains("\"free\":2"), out);
+        assertFalse(out.contains("leadSeats"), "no lead shares this profile's credential: " + out);
+    }
+
     @Test
     void listReportsLeadsAndFlagsTheCallersOwnRow() {
         FakeHerdr h = new FakeHerdr();

fleetd/src/test/java/dev/ltms/fleet/member/OpenCodeLauncherTest.java

@@ -323,39 +323,11 @@ class OpenCodeLauncherTest {
 
     // --- CB-547: resume + post-hoc session discovery --------------------------------------------
 
-    /**
-     * Give {@code dir} the exact signature {@link HerdrPeerLauncher#isProvisionedWorktree} checks
-     * for: a {@code .git} REGULAR FILE, never a directory. Content is never parsed by that gate, so
-     * any {@code gitdir:} pointer is fine. Mirrors {@code ClaudeCodeLauncherTest}'s helper of the
-     * same shape (fleetd #249).
-     */
-    private static void markAsProvisionedWorktree(Path dir) throws IOException {
-        Files.writeString(dir.resolve(".git"), "gitdir: /tmp/not-a-real-gitdir");
-    }
-
-    /**
-     * A fresh subdirectory of {@code configRoot}, marked as a provisioned worktree (fleetd #249),
-     * for tests that predate this gate and stood in a bare {@code "/work/dir"} string as their
-     * member's cwd — a directory that never existed on disk and, post-#249, would never pass
-     * {@link HerdrPeerLauncher#isProvisionedWorktree} either. Those tests are about the model
-     * mismatch / late-resolve machinery (fleetd #175/#234/#209), not about the worktree gate
-     * itself, so they need a cwd the gate accepts without changing what each test demonstrates.
-     */
-    private static String provisionedWorkDir(Path configRoot) throws IOException {
-        Path dir = Files.createDirectories(configRoot.resolve("work-dir"));
-        markAsProvisionedWorktree(dir);
-        return dir.toString();
-    }
-
     @Test
-    void aResumeSpawnIntoAProvisionedWorktreePassesTheSessionIdAsDashS(@TempDir Path root,
-                                                                        @TempDir Path worktree)
-            throws Exception {
-        markAsProvisionedWorktree(worktree);
+    void aResumeSpawnPassesTheSessionIdAsDashS(@TempDir Path root) {
         FakeHerdr herdr = new FakeHerdr();
         service(herdr, root, opencodeCfg("google/gemini-2.5-pro", null, null))
-                .spawn(new SpawnRequest(null, worktree.toString(), null, null,
-                        "ses_41b79fc90ffeI9E8uZv6VprUn2"));
+                .spawn(new SpawnRequest(null, null, null, null, "ses_41b79fc90ffeI9E8uZv6VprUn2"));
 
         List<String> args = startArgs(herdr);
         int s = args.indexOf("-s");
@@ -364,27 +336,6 @@ class OpenCodeLauncherTest {
                 "the resume target id follows -s");
     }
 
-    /**
-     * fleetd #249 acceptance criterion 3: without a fleetd-provisioned worktree, the member's cwd
-     * is shared with other sessions, so fleetd can never reliably confirm (now or later via {@link
-     * OpenCodeSessionDiscovery}) which conversation it is actually running. Refuse the spawn itself
-     * rather than silently launching opencode's {@code -s <id>} into unverifiable territory.
-     */
-    @Test
-    void aResumeSpawnWithoutAProvisionedWorktreeIsRefused(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        OpenCodeLauncher launcher = service(herdr, root,
-                opencodeCfg("google/gemini-2.5-pro", null, null));
-
-        IllegalArgumentException e = assertThrows(IllegalArgumentException.class, () ->
-                launcher.spawn(new SpawnRequest(null, null, null, null,
-                        "ses_41b79fc90ffeI9E8uZv6VprUn2")));
-
-        assertTrue(e.getMessage().contains("worktree"), e.getMessage());
-        assertFalse(herdr.called("agent.start"),
-                "the refusal must happen before anything spawns — no pane, no process");
-    }
-
     @Test
     void aFreshSpawnCarriesNoSessionFlag(@TempDir Path root) {
         FakeHerdr herdr = new FakeHerdr();
@@ -397,59 +348,25 @@ class OpenCodeLauncherTest {
 
     @Test
     void theHandleDiscoversTheSessionIdForTheWorkersCwdOnlyAfterItAppears(@TempDir Path root,
-                                                                          @TempDir Path discRoot,
-                                                                          @TempDir Path worktree)
+                                                                          @TempDir Path discRoot)
             throws Exception {
-        markAsProvisionedWorktree(worktree);
         FakeHerdr herdr = new FakeHerdr();
         OpenCodeLauncher launcher = new OpenCodeLauncher(new AgentControl(herdr),
                 new WorkspaceControl(herdr), Map.of("gemini", opencodeCfg(null, null, null)),
                 "gemini", _ -> null, 0, System::currentTimeMillis, () -> { }, root, discRoot);
 
-        PeerHandle handle = launcher.spawn(new SpawnRequest(null, worktree.toString(), null));
+        PeerHandle handle = launcher.spawn(new SpawnRequest(null, "/work/dir", null));
 
         // opencode writes the record only when the session is first persisted — the instant the
         // pane is ready it does not exist, so agentSessionId() is null (never a spawn failure).
         assertNull(handle.agentSessionId(), "no record yet → null, not a spawn-time block");
         // Once the record appears (here: same cwd), lazy discovery resolves it — the handle's
         // session id matches its own worktree, not another's.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_resolved", worktree.toString(), 1000L);
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_resolved", "/work/dir", 1000L);
         assertEquals("ses_resolved", handle.agentSessionId(),
                 "agentSessionId() re-scans and picks up a record that has since been written");
     }
 
-    /**
-     * fleetd #249 acceptance criterion 1, exercised through the real caller path (the handle
-     * {@code fleet_list} actually reads), not {@link OpenCodeSessionDiscovery} directly. Without a
-     * fleetd-provisioned worktree the member's cwd is shared — the default no-worktree spawn
-     * inherits the lead's own long-lived cwd — so even once a matching row appears (here:
-     * simulating another profile's session that happens to share the directory) the handle must
-     * report absence rather than guess. Measured real-world case (2026-09-03): the row it would
-     * otherwise pick was three days old and belonged to a different profile.
-     */
-    @Test
-    void theHandleNeverReportsAnIdForANonProvisionedCwdEvenAfterARowAppears(@TempDir Path root,
-                                                                             @TempDir Path discRoot)
-            throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        OpenCodeLauncher launcher = new OpenCodeLauncher(new AgentControl(herdr),
-                new WorkspaceControl(herdr), Map.of("gemini", opencodeCfg(null, null, null)),
-                "gemini", _ -> null, 0, System::currentTimeMillis, () -> { }, root, discRoot);
-        // No markAsProvisionedWorktree — this cwd has no .git file, the shared-cwd shape a
-        // no-worktree spawn (or a real checkout) actually has.
-        String sharedCwd = root.resolve("shared-cwd").toString();
-
-        PeerHandle handle = launcher.spawn(new SpawnRequest(null, sharedCwd, null));
-
-        assertNull(handle.agentSessionId(), "no record yet → null, same as the provisioned case");
-        // A row for this exact directory now appears — e.g. a sibling member, or a stale session
-        // from days earlier, sharing the same unprovisioned cwd.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_someone_elses", sharedCwd, 1000L);
-        assertNull(handle.agentSessionId(),
-                "a non-provisioned cwd must NEVER report an id, even once a row for it exists — "
-                        + "the row could belong to any other session sharing this directory");
-    }
-
     @Test
     void foreignWorkerMatchesOpencodePrefixButNotClaude() {
         String nonce = "abc123";
@@ -1003,7 +920,6 @@ class OpenCodeLauncherTest {
     @Test
     void theRealSessionManagerLateResolvePathCatchesAModelMismatch(@TempDir Path configRoot,
                                                                      @TempDir Path discRoot) throws Exception {
-        String workDir = provisionedWorkDir(configRoot);
         FakeHerdr herdr = new FakeHerdr();
         // xf's real shape (fleetd #175): weight:80, model "opencode/nemotron-3-ultra-free", no
         // credentialId — the profile that actually escaped the fleet's accounting.
@@ -1013,7 +929,7 @@ class OpenCodeLauncherTest {
         OpenCodeLauncher launcher = serviceWithSink(herdr, configRoot, discRoot, cfg, sink);
 
         SessionManager sessions = new SessionManager(launcher);
-        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
 
         // Real late-resolve path, driven BEFORE opencode has written its session row — same shape
         // as production the instant a pane goes ready.
@@ -1024,7 +940,7 @@ class OpenCodeLauncherTest {
 
         // opencode writes its row late, running gpt-5.6-sol (a PAID credential) instead of the
         // withdrawn free model the profile actually asked for — the exact fleetd #175 scenario.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
                 "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
 
         // Drive the SAME real late-resolve path again: sessions.get() -> resolveAgentSessionId ->
@@ -1043,13 +959,12 @@ class OpenCodeLauncherTest {
     @Test
     void aProviderPrefixedModelMatchingBothIdAndProviderIsNotAMismatch(@TempDir Path configRoot,
                                                                         @TempDir Path discRoot) throws Exception {
-        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
         FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
         PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, workDir, null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
                 "{\"id\":\"gpt-5.6-terra\",\"providerID\":\"openai\"}");
 
         assertEquals("ses_x", handle.agentSessionId());
@@ -1060,13 +975,12 @@ class OpenCodeLauncherTest {
     @Test
     void aGxProviderPrefixedModelMatchingBothIdAndProviderIsNotAMismatch(@TempDir Path configRoot,
                                                                           @TempDir Path discRoot) throws Exception {
-        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
         FleetConfig.Profile cfg = opencodeCfg("gx/deepseek-v4-flash", null, null);
         PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, workDir, null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
                 "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");
 
         assertEquals("ses_x", handle.agentSessionId());
@@ -1083,13 +997,12 @@ class OpenCodeLauncherTest {
     @Test
     void aMissingProviderIdInTheEvidenceIsUnknownNotAMismatchWhenTheIdMatches(
             @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
-        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
         FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
         PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, workDir, null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
                 "{\"id\":\"gpt-5.6-terra\"}");
 
         assertEquals("ses_x", handle.agentSessionId());
@@ -1105,13 +1018,12 @@ class OpenCodeLauncherTest {
     @Test
     void aMissingProviderIdInTheEvidenceStillCatchesARealIdMismatch(
             @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
-        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
         FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
         PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, workDir, null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
                 "{\"id\":\"gpt-5.6-sol\"}");
 
         assertEquals("ses_x", handle.agentSessionId());
@@ -1130,13 +1042,12 @@ class OpenCodeLauncherTest {
     @Test
     void aBareModelWithNoProviderPrefixMatchesOnIdAloneAndIsNotAMismatch(@TempDir Path configRoot,
                                                                           @TempDir Path discRoot) throws Exception {
-        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
         FleetConfig.Profile cfg = opencodeCfg("deepseek-v4-flash", null, null);
         PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, workDir, null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
                 "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");
 
         assertEquals("ses_x", handle.agentSessionId());
@@ -1153,7 +1064,6 @@ class OpenCodeLauncherTest {
     @Test
     void aRealIdMismatchLogsAnErrorNamingBothModelsAndQuarantinesThroughTheSink(
             @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
-        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(target + "|" + reason);
         FleetConfig.Profile cfg = opencodeCfg("opencode/nemotron-3-ultra-free", null, null);
@@ -1165,8 +1075,8 @@ class OpenCodeLauncherTest {
         PeerHandle handle;
         try {
             handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                    .spawn(new SpawnRequest(null, workDir, null));
-            OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
+                    .spawn(new SpawnRequest(null, "/work/dir", null));
+            OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
                     "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
             assertEquals("ses_x", handle.agentSessionId());
         } finally {
@@ -1201,12 +1111,11 @@ class OpenCodeLauncherTest {
     @Test
     void unknownOrUnparseableModelEvidenceNeverQuarantines(@TempDir Path configRoot,
                                                              @TempDir Path discRoot) throws Exception {
-        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
         FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
         PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, workDir, null));
+                .spawn(new SpawnRequest(null, "/work/dir", null));
 
         // No row yet at all.
         assertNull(handle.agentSessionId());
@@ -1228,13 +1137,12 @@ class OpenCodeLauncherTest {
     @Test
     void aProfileWithNoConfiguredModelIsNeverCheckedForAMismatch(@TempDir Path configRoot,
                                                                   @TempDir Path discRoot) throws Exception {
-        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
         FleetConfig.Profile cfg = opencodeCfg(null, null, null);
         PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, workDir, null));
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
+                .spawn(new SpawnRequest(null, "/work/dir", null));
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
                 "{\"id\":\"anything-at-all\",\"providerID\":\"anyone\"}");
 
         assertEquals("ses_x", handle.agentSessionId());
@@ -1258,22 +1166,21 @@ class OpenCodeLauncherTest {
     @Test
     void modelCheckReadsTheResolvedSessionsOwnRowNotWhateverIsNewestInTheSharedDirectory(
             @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
-        String workDir = provisionedWorkDir(configRoot);
         List<String> exhausted = new ArrayList<>();
         ExhaustionSink sink = (target, reason, profile) -> exhausted.add(reason);
         FleetConfig.Profile cfg = opencodeCfg("openai/gpt-5.6-terra", null, null);
         PeerHandle handle = serviceWithSink(new FakeHerdr(), configRoot, discRoot, cfg, sink)
-                .spawn(new SpawnRequest(null, workDir, null));
+                .spawn(new SpawnRequest(null, "/work/dir", null));
 
         // Our own session's row, correctly matching the profile's requested model.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_ours", workDir, 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_ours", "/work/dir", 1000L,
                 "{\"id\":\"gpt-5.6-terra\",\"providerID\":\"openai\"}");
         assertEquals("ses_ours", handle.agentSessionId(), "resolves to our own session");
         assertTrue(exhausted.isEmpty(), "matching model → no mismatch on first resolve: " + exhausted);
 
         // A sibling member, spawned later into the SAME shared directory (no worktree, fleetd
         // #234's default), writes a newer row running a totally different model.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_sibling", workDir, 9000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_sibling", "/work/dir", 9000L,
                 "{\"id\":\"deepseek-v4-flash\",\"providerID\":\"gx\"}");
 
         assertEquals("ses_ours", handle.agentSessionId(),
@@ -1305,7 +1212,6 @@ class OpenCodeLauncherTest {
     @Test
     void aSpawnTimeModelMismatchActuallyQuarantinesTheCredentialThroughTheRealAcquirePath(
             @TempDir Path configRoot, @TempDir Path discRoot) throws Exception {
-        String workDir = provisionedWorkDir(configRoot);
         FleetConfig.Profile cfg = opencodeCfgWithCredential(
                 "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
         Map<String, FleetConfig.Profile> profiles = Map.of(cfg.profile(), cfg);
@@ -1326,14 +1232,14 @@ class OpenCodeLauncherTest {
 
         // The mismatching row exists BEFORE the spawn — reproducing fleetd #234's exact timing:
         // opencode's session table already carries evidence by the moment acquire() first asks.
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
                 "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
 
         assertFalse(quarantine.isQuarantined("openai-shared"), "nothing quarantined before the spawn");
 
         // The real production entrypoint: acquire() builds the MemberSession by calling
         // handle.agentSessionId() BEFORE registry.put() runs.
-        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
 
         assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
         assertTrue(quarantine.isQuarantined("openai-shared"),
@@ -1352,7 +1258,6 @@ class OpenCodeLauncherTest {
     @Test
     void aRosterOnlySinkSilentlyDropsTheSpawnTimeQuarantine(@TempDir Path configRoot,
                                                               @TempDir Path discRoot) throws Exception {
-        String workDir = provisionedWorkDir(configRoot);
         FleetConfig.Profile cfg = opencodeCfgWithCredential(
                 "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
         BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.SECONDS.toNanos(1800));
@@ -1365,10 +1270,10 @@ class OpenCodeLauncherTest {
         OpenCodeLauncher launcher = serviceWithSink(herdr, configRoot, discRoot, cfg, rosterOnlySink);
         SessionManager sessions = new SessionManager(launcher);
 
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
                 "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
 
-        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
 
         assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
         assertFalse(quarantine.isQuarantined("openai-shared"),
@@ -1396,7 +1301,6 @@ class OpenCodeLauncherTest {
     @Test
     void theSpawnTimeQuarantineSurvivesTheFleetdStyleForwardingHop(@TempDir Path configRoot,
                                                                      @TempDir Path discRoot) throws Exception {
-        String workDir = provisionedWorkDir(configRoot);
         FleetConfig.Profile cfg = opencodeCfgWithCredential(
                 "terra", "opencode/nemotron-3-ultra-free", "openai-shared");
         Map<String, FleetConfig.Profile> profiles = Map.of(cfg.profile(), cfg);
@@ -1428,12 +1332,12 @@ class OpenCodeLauncherTest {
         };
         exhaustionSinkRef.set(realSink);
 
-        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", workDir, 1000L,
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "ses_x", "/work/dir", 1000L,
                 "{\"id\":\"gpt-5.6-sol\",\"providerID\":\"openai\"}");
 
         assertFalse(quarantine.isQuarantined("openai-shared"), "nothing quarantined before the spawn");
 
-        MemberSession acquired = sessions.acquire(cfg.profile(), workDir, null, null);
+        MemberSession acquired = sessions.acquire(cfg.profile(), "/work/dir", null, null);
 
         assertEquals("ses_x", acquired.agentSessionId(), "the id itself still resolves correctly");
         assertTrue(quarantine.isQuarantined("openai-shared"),