fleetd #391: require reply caller role

The CB-633 allow-list scrub has been dying mid-loop on every fleet01 member
pane and saying nothing. `export UID=` in zsh is not a failed command — it is
a fatal parameter error that terminates the whole sourced file. The blanking
loop is wrapped in `{ ... } 2>/dev/null`, so the message was swallowed and the
report block after the loop never ran.

Root cause found by the fleet01 lead, with xtrace on a live pane's own ZDOTDIR:

    +scrub.zsh:28> _cb633_n=UID
    +scrub.zsh:28> export 'UID='
    +zsh:1> rc=126        <- file aborted

The severity is the INVERSION, and this is their finding, quoted:

  "env lists inherited names first and the names a startup file exports last.
   So the loop blanks the harmless inherited half and dies immediately before
   the operator's own exports — exactly the credentials the policy exists to
   remove. The selection is inverted, not merely partial."

Measured there: UID is name 42 of 57, and a ~/.zshrc decoy at 58 survived on
8 of 8 spawns. "Partial scrub" reads as "we got most of it"; it got precisely
the wrong half.

Fixed with `eval "export ${n}=" 2>/dev/null` rather than a skip-list of the
known-fatal names (UID EUID GID EGID PPID LINENO). A skip-list has to be
complete forever and this is a security control; eval needs no list. Measured:
plain export dies at UID and every later name keeps its value, while the eval
form completes the loop and blanks all of them. PR #396 proposed the skip-list
and is closed in favour of this; its claim that the abort happens "however the
assignment is wrapped" holds for a direct `if ! export` but not for eval,
which reparses in a nested context.

The report now carries `failed N` and `!`-prefixed unblankable names, and
HerdrPeerLauncher WARNs when any name could not be blanked. The old "no report"
WARN no longer claims the daemon knows what the member saw.

Why the suite stayed green: EnvAllowListScrubTest starts zsh from
pb.environment().clear(), and under a cleared parent UID is not an exported
name at all, so the abort could not reproduce in that harness.

Reviewed by mutation, which found a second gap now also closed: the eval is
only safe because names are filtered to ^[A-Za-z_][A-Za-z0-9_]*$. Replacing
that pattern with .* left the class green, so the line the security property
rests on was unpinned. The guard is now re-asserted at the eval site and pinned
by a test. The reachable vector is a VALUE with an embedded newline, not a
hostile name — measured: zsh strips non-identifier env names outright, while
MULTI=$'keep\njunk.fragment' forges 'junk.fragment' as a candidate name out of
its own value.

Closes #394. Refs #396, #388.

CLAUDE.md

@@ -137,7 +137,7 @@ the merge — and merging on a reviewer's word is delegating it by proxy.
 | Answer a member's `fleet_ask` | `fleet_send{turnId, content}` — **not** `sessionId` |
 | Message a **peer lead** on this host | `fleet_send{sessionId: <their terminal>, content}` — `fleet_list` → `leads` reports it. Coordination only, **never** a task |
 | Message a **peer lead** on another daemon or host | `fleet_send{coordId: <their coord-id>, content}` — needs a `coordinator:` block; your own coord-id is in `fleet_list`. Coordination only, **never** a task |
-| Answer a peer lead that messaged you | `fleet_reply{content}` — the one case a lead replies |
+| Answer a peer lead that messaged you | `fleet_send{coordId}` — or `{sessionId}` if they are on this host. **Not** `fleet_reply`: it has no peer route and the publish is refused |
 | Collect a held reply | `fleet_poll{target}` · then `fleet_ack{target, msgId}` |
 | Tear down a member | `fleet_stop{paneId}` |
 
@@ -163,15 +163,21 @@ The traffic between leads is coordination and nothing else:
 3. **Verify a peer exactly as you verify yourself.** Peer status buys nothing: check the claim
    against the code, and re-run the build. A peer's correction gets the same treatment — right or
    wrong on the evidence, not on who said it. Neither of you merges the other's work unreviewed.
+   **N observations are N data points only if they differ in the axis you are trusting.** This cuts
+   both ways. N *failures* blamed on one cause are one data point when the cases share what you are
+   not varying. N *agreeing measurements* are also one data point when they share an instrument —
+   two hosts, two operators and the same formula is one formula, not two confirmations.
 4. **Ask a peer to read your project addendum.** Your addendum is instruction surface: every future
    session on your host obeys it, and a wrong one is obeyed just as faithfully as a right one. The
    author is the worst reader of their own qualifier placement — measured here, one addendum carried
    two defects and a non-author found both. If you have no peer, at least re-read it asking "which
    sentence goes false first, and would a reader reach the caveat before acting?"
 
-Being messaged by a peer does not make you its worker: answer with `fleet_reply`, and push back on
-the substance if it is wrong. A peer that simply complies has thrown away the reason there are two of
-you.
+Being messaged by a peer does not make you its worker: answer the way you would open —
+`fleet_send{coordId}` for another daemon, `fleet_send{sessionId}` on this host — and push back on
+the substance if it is wrong. `fleet_reply` resolves a member's blocked `fleet_send`; a peer's
+coord-id message is durable and non-blocking, so there is nothing for it to resolve. A peer that
+simply complies has thrown away the reason there are two of you.
 
 ### Member (worker or architect) — the turn contract
 

fleetd/fleetd.example.yaml

@@ -877,32 +877,3 @@ guard:
 #   terminal: term_65619bd6174568
 #   pushReminders: 5
 #   pushBackoffMs: 15000
-
-# Central allow-list of models any profiles: entry may name. Nothing checked a profile's model:
-# value before this block existed — it was a free-form string handed straight to the backend
-# adapter, and a withdrawn or misspelled name failed silently instead of at config load (opencode
-# falls back to a default model rather than erroring on an unknown -m).
-#
-# Absent, or present with an empty allow:, is OFF: no profile's model: is checked, exactly like
-# before this block existed. fleetd.yaml is gitignored on every host, so an upgrade must not force
-# every operator to enumerate their models before the daemon will start.
-#
-# The list is the authority; profiles: is checked against it, never the reverse — adding or
-# editing a profiles: entry cannot, by itself, widen what is permitted here.
-#
-# Enforcement is at CONFIG LOAD only (a bad model: fails the daemon at startup, naming both the
-# model and the profile). There is no spawn-time enforcement, no runtime on/off switch, and no
-# interaction with BackendQuarantine — those are separate, later units.
-#
-#   allow → the permitted models. Each entry is its own block (not a bare string) so a later unit
-#           can add an on/off state or a load limit per model without changing this shape.
-#     model → the model id exactly as a profiles: entry's model: field would write it. One flat,
-#             opaque-string namespace: a bare Claude id (claude-sonnet-5) and an opencode
-#             provider-prefixed id (openai/gpt-5.6-terra) both fit here unchanged — the check is a
-#             plain string match, never a parse of the provider prefix or a branch on kind:.
-# models:
-#   allow:
-#     - model: claude-sonnet-5
-#     - model: claude-opus-5
-#     - model: openai/gpt-5.6-terra
-#     - model: amazon.nova-pro-v1:0

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -144,16 +144,19 @@ public final class Fleetd {
         SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
         guard.assertPrimaryClean(System.getenv());
 
-        // Every FleetConfig.validateXxx() the operator's config can fail — CB-501's auth-exposure
-        // check, CB-531's lead-tab-prefix check, CB-542's subscription-profile check, the charter
-        // and member-slot checks, and the "central allow-list of usable models" check — must run
-        // here, at load, before anything below opens a socket or spawns a member. fleetd ticket
-        // "central allow-list of usable models" follow-up: mutation testing found six individual
-        // calls here with nothing proving any of them still ran (deleting one left the full suite
-        // green). validateAll() replaces them with the one call that FleetConfigValidateAllTest
-        // and the Fleetd-startup tests actually pin — see FleetConfig#validateAll's javadoc for
-        // why a name-by-name list here would have the same defect it replaces.
-        cfg.validateAll();
+        // CB-501: refuse to start if the bind is wider than the auth mode can defend. Under
+        // loopback-trust, "not a known worker" means "the primary" — sound only because the OS
+        // refuses remote connections to a loopback socket. This throws rather than warns so the
+        // dangerous configuration cannot be reached by ignoring a log line.
+        cfg.validateAuthExposure();
+        cfg.validateLeadTabPrefixes();
+        // CB-542: a subscription:true profile whose env: reseats ANTHROPIC_BASE_URL/AUTH_TOKEN would
+        // reach an unguarded endpoint (the launcher skips SubscriptionGuard for it). Refuse at load.
+        cfg.validateSubscriptionProfiles();
+        cfg.validateCharters();
+        // CB-548: every architect slot must name a configured workers: profile — the strong-model
+        // backend the future spawn lifecycle would read. A stale reference dies here, not later.
+        cfg.validateMembers();
 
         Path socket = cfg.herdrSocket() != null && !cfg.herdrSocket().isBlank()
                 ? Path.of(cfg.herdrSocket())

fleetd/src/main/java/dev/ltms/fleet/config/ConfigRef.java

@@ -43,12 +43,6 @@ import java.util.function.Supplier;
  *       running daemon keeps whatever this was at startup regardless of a later edit),
  *       {@code spawnReadyTimeoutMs} / {@code spawnReadyPollMs}, {@code quarantineCooldownSeconds}
  *       (CB-578 stage B — baked once into the {@code BackendQuarantine} built at startup),
- *       {@code models:} (fleetd ticket "central allow-list of usable models" — {@link
- *       FleetConfig#validateModels()} re-runs against the fresh config in {@link #reload()}
- *       (via {@link FleetConfig#validateAll()}), so a
- *       models.allow: edit that would refuse to boot still refuses the reload; a change that
- *       passes has nothing built at startup to rebuild, so it is reported deferred rather than
- *       silently accepted with no report at all),
  *       {@code guard:}, {@code worktreeRoot:}, {@code worktreeGroup:} and {@code memberSkills:}
  *       (all three of the latter baked once into the {@code GitWorktrees} built at
  *       {@code Fleetd.java:251} and never rebuilt — fleetd #323 instance 2 found
@@ -141,9 +135,8 @@ import java.util.function.Supplier;
  * </ul>
  *
  * <p><strong>The denominator, measured on 2026-09-04 (fleetd #330; recounted for fleetd #333);
- * recounted again for fleetd #362, again after {@code idleSleepGuard:} was added, and again after
- * {@code models:} was added.</strong>
- * {@code FleetConfig} has 25 top-level record components: 5 cold, 14 deferred, 3 split, 3
+ * recounted again for fleetd #362, and again after {@code idleSleepGuard:} was added.</strong>
+ * {@code FleetConfig} has 24 top-level record components: 5 cold, 13 deferred, 3 split, 3
  * hot-excluded. Three of them are named nowhere in this file, and the reason is the same for all
  * three: {@code placement}, {@code memberCredentials} and {@code memberLoginShell} are
  * <strong>hot</strong> and correctly absent — all three are read live off {@code config.get()}
@@ -226,7 +219,7 @@ public final class ConfigRef implements Supplier<FleetConfig> {
     static final Set<String> DEFERRED_KEYS = Set.of(
             "guard", "worktreeRoot", "worktreeGroup", "memberSkills", "primary", "configReload",
             "leadHeartbeat", "lifecycle", "spawnReadyTimeoutMs", "spawnReadyPollMs",
-            "quarantineCooldownSeconds", "profiles", "idleSleepGuard", "models");
+            "quarantineCooldownSeconds", "profiles", "idleSleepGuard");
 
     private final Path path;
     private final AtomicReference<FleetConfig> current;
@@ -329,12 +322,12 @@ public final class ConfigRef implements Supplier<FleetConfig> {
             fresh = FleetConfig.load(path);
             // The same gate startup runs. A config that would have refused to boot must not be able
             // to slip in through a reload — that is how a daemon ends up in a state it could never
-            // have started in, which is the hardest kind to debug. fleetd ticket "central allow-list
-            // of usable models" follow-up: this used to be six individual validateXxx() calls, and
-            // mutation testing found two of the six unpinned here even though startup pinned nothing
-            // at all — see FleetConfig#validateAll's javadoc for why the fix is one reflective call,
-            // not a longer hand-maintained list.
-            fresh.validateAll();
+            // have started in, which is the hardest kind to debug.
+            fresh.validateAuthExposure();
+            fresh.validateLeadTabPrefixes();
+            fresh.validateSubscriptionProfiles();
+            fresh.validateCharters();
+            fresh.validateMembers();
         } catch (RuntimeException e) {
             String msg = e.getMessage() == null ? e.toString() : e.getMessage();
             log.warn("config reload from {} refused, keeping the running config: {}", path, msg);
@@ -446,15 +439,6 @@ public final class ConfigRef implements Supplier<FleetConfig> {
         if (!Objects.equals(old.idleSleepGuard(), fresh.idleSleepGuard())) {
             changed.add("idleSleepGuard");
         }
-        // fleetd ticket "central allow-list of usable models": validateModels() runs again in
-        // reload() above (via validateAll()), so a bad edit is already refused as cold-adjacent
-        // (the whole reload is refused via the catch block, never partially applied). A GOOD edit
-        // to the allow-list
-        // itself has nothing built at startup to rebuild — it only ever mattered to the validation
-        // call that already ran — so report it deferred rather than silently swallowing the change.
-        if (!Objects.equals(old.models(), fresh.models())) {
-            changed.add("models");
-        }
         if (!Objects.equals(old.spawnReadyTimeoutMs(), fresh.spawnReadyTimeoutMs())
                 || !Objects.equals(old.spawnReadyPollMs(), fresh.spawnReadyPollMs())) {
             changed.add("spawnReady*");

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -16,15 +16,11 @@ import org.slf4j.LoggerFactory;
 
 import java.io.IOException;
 import java.io.UncheckedIOException;
-import java.lang.reflect.InvocationTargetException;
-import java.lang.reflect.Method;
-import java.lang.reflect.Modifier;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
-import java.util.Comparator;
 import java.util.HashSet;
 import java.util.LinkedHashMap;
 import java.util.List;
@@ -128,13 +124,6 @@ import java.util.regex.PatternSyntaxException;
  *                      under a member's long turn. {@code null} (the block omitted) behaves the
  *                      same as an explicit {@code enabled: true}; set {@code enabled: false} to
  *                      turn it off. See {@link dev.ltms.fleet.power.IdleSleepGuard}.
- * @param models        central allow-list of models any {@code profiles:} entry may name. {@code
- *                      null} or an empty {@code allow:} ⇒ off: {@link #validateModels()} checks
- *                      nothing and every existing config keeps working exactly as it does today.
- *                      When non-empty, a profile whose {@code model:} is not one of {@link
- *                      Models#ids()} fails config load, naming both the model and the profile —
- *                      see {@link #validateModels()}. This block only decides what may be
- *                      CONFIGURED; nothing here enforces it at spawn time. See {@link Models}.
  */
 @JsonIgnoreProperties(ignoreUnknown = true)
 public record FleetConfig(
@@ -161,22 +150,7 @@ public record FleetConfig(
         String worktreeGroup,
         String memberLoginShell,
         String memberSkills,
-        IdleSleepGuard idleSleepGuard,
-        Models models) {
-
-    /** Back-compat form before the {@code models:} block was added. */
-    public FleetConfig(Bind bind, String herdrSocket, String memberHerdrSocket, Map<String, Profile> profiles,
-                         Guard guard, String worktreeRoot, Lifecycle lifecycle, Integer spawnReadyTimeoutMs,
-                         Integer spawnReadyPollMs, Broker broker, Primary primary, Fleet fleet,
-                         LeadHeartbeat leadHeartbeat, Health health, String placement, Auth auth,
-                         ConfigReload configReload, Integer quarantineCooldownSeconds,
-                         MemberCredentials memberCredentials, Coordinator coordinator, String worktreeGroup,
-                         String memberLoginShell, String memberSkills, IdleSleepGuard idleSleepGuard) {
-        this(bind, herdrSocket, memberHerdrSocket, profiles, guard, worktreeRoot, lifecycle, spawnReadyTimeoutMs,
-                spawnReadyPollMs, broker, primary, fleet, leadHeartbeat, health, placement, auth,
-                configReload, quarantineCooldownSeconds, memberCredentials, coordinator, worktreeGroup,
-                memberLoginShell, memberSkills, idleSleepGuard, null);
-    }
+        IdleSleepGuard idleSleepGuard) {
 
     /** Back-compat form before the {@code idleSleepGuard:} block was added. */
     public FleetConfig(Bind bind, String herdrSocket, String memberHerdrSocket, Map<String, Profile> profiles,
@@ -1344,72 +1318,6 @@ public record FleetConfig(
         }
     }
 
-    /**
-     * Central allow-list of models any {@code profiles:} entry may name (fleetd ticket: "a central
-     * allow-list of usable models"). Nothing before this block checked a profile's {@code model:}
-     * against anything — it was a free-form string handed straight to the backend adapter, and a
-     * withdrawn or misspelled name failed silently (opencode falls back to a default model rather
-     * than erroring on an unknown {@code -m}) rather than at config load, where a mistake is cheap.
-     *
-     * <p><b>Absent or empty {@code allow:} is "off"</b>, on purpose: this is a large deployment
-     * with gitignored {@code fleetd.yaml} on more than one host, and a change that forced every
-     * operator to enumerate their models before the daemon would start would break every one of
-     * them on upgrade. See {@link FleetConfig#validateModels()}, which is where the allow-list is
-     * actually enforced, at config load.
-     *
-     * <p><b>The list is the authority; a {@code profiles:} entry is checked against it, never the
-     * other way around.</b> Adding or editing a {@code profiles:} entry cannot, by itself, widen
-     * the set of permitted models — only editing {@code models.allow:} itself can. This is the
-     * invariant the ticket asked for: the two blocks are validated in one direction only.
-     *
-     * <p><b>Out of scope here, deliberately:</b> nothing in this block is read at spawn time —
-     * enforcing it against a live spawn, an on/off runtime switch, and any interaction with {@code
-     * BackendQuarantine} are separate units. This block is config-load validation only.
-     *
-     * @param allow the permitted models, each its own {@link ModelEntry} rather than a bare
-     *              string — see that record's javadoc for why. {@code null}/empty ⇒ the block is
-     *              treated as absent: {@link FleetConfig#validateModels()} checks nothing.
-     */
-    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Models(List<ModelEntry> allow) {
-
-        public Models {
-            allow = (allow == null) ? List.of() : List.copyOf(allow);
-        }
-
-        /**
-         * One permitted model, named as a record rather than a bare string on purpose: a later unit
-         * needs to hang an on/off state and a load-limit state off each entry, and a bare {@code
-         * List<String>} cannot grow those fields without changing the YAML shape underneath every
-         * operator who already wrote one. {@link #model()} is intentionally a single flat,
-         * opaque-string namespace — a bare Claude id ({@code claude-sonnet-5}) and an opencode
-         * provider-prefixed id ({@code openai/gpt-5.6-terra}) both fit it unchanged, because
-         * {@link FleetConfig#validateModels()} only ever compares a profile's {@code model:} value
-         * against this string for exact equality; it never parses a provider prefix or branches on
-         * a profile's {@code kind:}.
-         *
-         * @param model the model id exactly as a {@code profiles:} entry's {@code model:} field
-         *              would name it
-         */
-        @JsonIgnoreProperties(ignoreUnknown = true)
-        public record ModelEntry(String model) {
-            public ModelEntry {
-                model = (model == null || model.isBlank()) ? null : model.trim();
-            }
-        }
-
-        /** {@link #allow}'s model ids, as a set for membership checks. Blank/null entries are dropped. */
-        public Set<String> ids() {
-            Set<String> ids = new java.util.LinkedHashSet<>();
-            for (ModelEntry e : allow) {
-                if (e != null && e.model() != null) {
-                    ids.add(e.model());
-                }
-            }
-            return Collections.unmodifiableSet(ids);
-        }
-    }
-
     /**
      * The terminal → lead-name map seeded from the legacy singular {@code primary:} pin (CB-530).
      *
@@ -1661,7 +1569,7 @@ public record FleetConfig(
             "lifecycle", "spawnReadyTimeoutMs", "spawnReadyPollMs", "broker", "primary", "fleet",
             "leadHeartbeat", "health", "placement", "auth", "configReload", "quarantineCooldownSeconds",
             "memberCredentials", "coordinator", "worktreeGroup", "memberLoginShell", "memberSkills",
-            "idleSleepGuard", "models");
+            "idleSleepGuard");
 
     /** Load and validate config from {@code path}. */
     public static FleetConfig load(Path path) {
@@ -2346,15 +2254,10 @@ public record FleetConfig(
         // enabled: true — see its javadoc), so defaulting the block here would change nothing a
         // reader observes and would only obscure that "block omitted" and "block present and
         // enabled" are deliberately the same outcome.
-        // models is left as-is, like broker/primary/coordinator above: null/empty is "off", and an
-        // absent block must validate nothing (see Models's javadoc) — defaulting it here to an
-        // empty Models would be a no-op for validateModels() either way, since an empty allow-list
-        // already means "check nothing", so there is nothing to gain and one more null check to
-        // avoid by leaving it exactly as configured.
         return new FleetConfig(b, herdrSocket, memberHerdrSocket, profiles, g, worktreeRoot, l, timeout, pollMs,
                 broker, primary, f, leadHeartbeat, health, placementOrDefault, a, configReload,
                 quarantineCooldown, mc, coordinator, worktreeGroup, memberLoginShell, memberSkills,
-                idleSleepGuard, models);
+                idleSleepGuard);
     }
 
     /**
@@ -2574,118 +2477,6 @@ public record FleetConfig(
         }
     }
 
-    /**
-     * Reject a {@code profiles:} entry whose {@code model:} is not on the configured {@link
-     * #models} allow-list.
-     *
-     * <p>Absent or empty {@code models.allow:} validates nothing — see {@link Models}'s javadoc:
-     * an existing config with no such block must keep working exactly as it does today. Once the
-     * operator declares at least one entry, every profile's {@code model:} (when set — a profile
-     * may legitimately leave it {@code null}, e.g. a {@code subscription: true} profile relying on
-     * the account's own default) must equal one of {@link Models#ids()} exactly. The comparison is
-     * a flat string match: a bare Claude id and an opencode {@code provider/model} id are both
-     * just opaque strings here, so nothing here needs to know which {@code kind:} a profile runs.
-     *
-     * <p>The check runs one direction only, by construction: it reads {@link #profiles} and
-     * {@link #models}, and only ever adds to {@code bad} when a profile's model is missing from
-     * the allow-list. Nothing here can be satisfied by widening a {@code profiles:} entry — only
-     * editing {@code models.allow:} itself changes what passes. That is the invariant the ticket
-     * asked for: the list is the authority, profiles are checked against it.
-     *
-     * @throws IllegalStateException when any profile names a model outside the configured
-     *                               allow-list, naming both the model and the profile that wanted it
-     */
-    public void validateModels() {
-        if (models == null || models.allow().isEmpty()) {
-            return;
-        }
-        Set<String> allowed = models.ids();
-        List<String> bad = new ArrayList<>();
-        profiles.forEach((name, p) -> {
-            String model = p.model();
-            if (model != null && !model.isBlank() && !allowed.contains(model)) {
-                bad.add("profile '" + name + "' names model '" + model + "', which is not in "
-                        + "models.allow: (have: " + allowed + ").");
-            }
-        });
-        if (!bad.isEmpty()) {
-            throw new IllegalStateException("refusing to start: " + String.join(" ", bad));
-        }
-    }
-
-    /**
-     * Runs every validator this class declares — found by reflection, not by name.
-     *
-     * <p>fleetd ticket "central allow-list of usable models", follow-up: mutation testing found
-     * that although each of the six validators above was well pinned on its own, nothing proved
-     * either real caller ({@code Fleetd.main} and {@link ConfigRef#reload()}) still
-     * invoked it — deleting a call site left the full suite green. The fix is not a seventh test
-     * per caller; a hand-maintained list of six names here would have the exact same defect its
-     * own javadoc would warn against: the seventh validator someone adds next month has no reason
-     * to be added to it. So this method does not name any validator. It sweeps {@link
-     * #getClass()}'s own public, no-argument, {@code void} methods whose name starts with {@code
-     * "validate"} (excluding itself) and invokes every one it finds, via {@link
-     * #invokeAllValidators}. A new {@code validateXxx()} method is therefore wired into both
-     * callers the moment it is written — there is no second step to forget, and so no state in
-     * which it silently never runs.
-     *
-     * <p>{@code Fleetd.main} and {@link ConfigRef#reload()} each call this one method instead of
-     * the six individually — see the comments at those two call sites for why
-     * each must run it.
-     *
-     * <p>Methods run in a fixed (alphabetical) order, so a config with more than one violation
-     * always names the same one first, on every run.
-     *
-     * @throws IllegalStateException (or whatever unchecked exception a validator itself throws),
-     *                                propagated unchanged from the first validator, in that order,
-     *                                that finds a problem
-     */
-    public void validateAll() {
-        invokeAllValidators(this);
-    }
-
-    /**
-     * The reflective sweep behind {@link #validateAll()}, kept as its own method — taking any
-     * {@code target}, not just {@code this} — so a test can prove the MECHANISM is generic (it
-     * would sweep a seventh {@code validateXxx()} method added to any class, not just something
-     * special-cased to today's six on {@link FleetConfig}) without needing to add a real, unwanted
-     * seventh validator to this class just to exercise that claim. See {@code
-     * FleetConfigValidateAllTest} for that proof.
-     *
-     * @param target an object whose public, no-argument, {@code void} methods named {@code
-     *               validateXxx} (any name starting with {@code "validate"}, excluding {@code
-     *               validateAll} itself) should all run, in alphabetical-by-name order
-     */
-    static void invokeAllValidators(Object target) {
-        List<Method> methods = new ArrayList<>();
-        for (Method m : target.getClass().getMethods()) {
-            if (Modifier.isPublic(m.getModifiers())
-                    && m.getParameterCount() == 0
-                    && m.getReturnType() == void.class
-                    && m.getName().startsWith("validate")
-                    && !m.getName().equals("validateAll")) {
-                methods.add(m);
-            }
-        }
-        methods.sort(Comparator.comparing(Method::getName));
-        for (Method m : methods) {
-            try {
-                m.invoke(target);
-            } catch (InvocationTargetException e) {
-                Throwable cause = e.getCause();
-                if (cause instanceof RuntimeException re) {
-                    throw re;
-                }
-                if (cause instanceof Error err) {
-                    throw err;
-                }
-                throw new IllegalStateException("validator " + m.getName() + " failed", cause);
-            } catch (IllegalAccessException e) {
-                throw new IllegalStateException("cannot invoke validator " + m.getName(), e);
-            }
-        }
-    }
-
     /** True for the loopback addresses and the unspecified-but-local forms we treat as same-host. */
     private static boolean isLoopbackBind(String host) {
         if (host == null || host.isBlank()) {

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -346,7 +346,7 @@ public final class FleetMcp {
                     String self = callerTerminal(exchange);
                     McpSchema.CallToolResult denied = deny(exchange, toolAction("fleet_reply", req.arguments()), self);
                     if (denied != null) return denied;
-                    return reply(messages, self, str(req.arguments(), "content"));
+                    return reply(messages, self, principal(exchange).role(), str(req.arguments(), "content"));
                 };
         // fleet_ask (CB-205): a worker's mid-turn question — identity from the CONNECTION.
         BiFunction<McpSyncServerExchange, McpSchema.CallToolRequest, McpSchema.CallToolResult> askHandler =
@@ -868,19 +868,26 @@ public final class FleetMcp {
     /**
      * {@code fleet_reply}: the worker returns its structured answer, resolving the awaiting send
      * or — when no send is open — queueing the reply in the inbox for later drain (CB-307).
-     * {@code callerTerminal} is resolved from the connection (never an argument); a {@code null}
-     * means the caller is not a known worker (e.g. the primary called it by mistake).
+     * {@code callerTerminal} and {@code callerRole} are resolved from the connection (never an
+     * argument). A {@code null} terminal means the caller is not a known worker. A PRIMARY with a
+     * terminal is a lead and must use {@code fleet_send}, because reply has no peer-lead route.
      *
      * <p>fleetd #365: the result text names which of those actually happened
      * ({@link MessageService.ReplyOutcome#description()}) instead of the single word "delivered"
      * for both — a queued reply is a real success, but it is not the same fact as one that resolved
      * a live waiter, and the caller could not previously tell them apart.
      */
-    static McpSchema.CallToolResult reply(MessageService messages, String callerTerminal, String content) {
+    static McpSchema.CallToolResult reply(MessageService messages, String callerTerminal, Role callerRole, String content) {
         if (callerTerminal == null) {
             return error("fleet_reply is for workers only — could not identify the calling worker "
                     + "from the connection");
         }
+        if (callerRole == Role.PRIMARY) {
+            return error("fleet_reply has no route to a peer lead. Use fleet_send{coordId: ...} for a peer on another "
+                    + "daemon or fleet_send{sessionId: ...} for a peer on this host. fleet_reply resolves a member's "
+                    + "blocked fleet_send, and a peer's coord-id message is durable and non-blocking, so there is "
+                    + "nothing for it to resolve.");
+        }
         // fleetd #302: isBlank, not == null, to match fleet_send's own guard above. MessageService
         // .reply now REJECTS blank content, and this handler is a bare BiFunction with no try/catch
         // around it — so a whitespace-only fleet_reply would leave here as an uncaught

fleetd/src/main/java/dev/ltms/fleet/member/EnvAllowListScrub.java

@@ -75,9 +75,28 @@ import java.util.stream.Stream;
  * never to the control.
  *
  * <p>The scrub also writes {@code scrub-report.txt} into its own directory: one {@code allowed N of
- * M} line (N = exports left untouched, M = exports present when the scrub ran), then the blanked
- * NAMES — never values. The launcher reads this back at teardown and logs it, because a blocked
- * count next to an unknown denominator is not a finding.
+ * M failed F} line (N = exports left untouched, M = exports present when the scrub ran, F = names
+ * the scrub attempted to blank but could not), then the NAMES — blanked ones bare, unblankable ones
+ * {@code !}-prefixed — never values. The launcher reads this back at teardown and logs it, because a
+ * blocked count next to an unknown denominator is not a finding.
+ *
+ * <p><b>fleetd #394:</b> plain {@code export "$n="} is a FATAL error for a zsh read-only or special
+ * parameter (for example {@code UID}) — it aborts the whole sourced file, so every name still to
+ * come is never blanked and the report above is never written at all. The blanking loop instead
+ * routes each attempt through {@code eval}, which contains that error to the single iteration: the
+ * loop always finishes, and a name that could not be blanked is counted as {@code failed} and
+ * listed {@code !}-prefixed rather than silently disappearing. This is deliberately not a skip-list
+ * of known-bad names — every enumerated name is still attempted, so a name nobody has thought of
+ * yet still gets tried and, if it fails, still gets counted.
+ *
+ * <p>The blanking loop also re-asserts, on its own, the same {@code [A-Za-z_][A-Za-z0-9_]*} shape
+ * check the enumeration loop already applied. Before {@code eval} was introduced a non-conforming
+ * name reaching {@code export "$n="} was harmless either way — the quoting made it inert. With
+ * {@code eval}, the name is spliced into a string and interpreted as shell syntax, so the enumeration
+ * loop's check is no longer sufficient on its own to keep that call site safe — it is a guard on a
+ * different loop, and the two must not silently drift apart. Re-checking right before the
+ * {@code eval} keeps that call site safe by its own reading, independent of whatever the enumeration
+ * loop does or stops doing in a later change.
  */
 public final class EnvAllowListScrub {
 
@@ -132,10 +151,16 @@ public final class EnvAllowListScrub {
     }
 
     /**
-     * A parsed {@code scrub-report.txt}: how many exported variables existed when the scrub ran,
-     * how many were left untouched (allowed), and the NAMES that were blanked. Values never appear.
+     * A parsed {@code scrub-report.txt}: how many exported variables existed when the scrub ran
+     * ({@code total}), how many were left untouched ({@code allowed}), how many the scrub attempted
+     * to blank but could not ({@code failed} — fleetd #394: a zsh read-only/special parameter such
+     * as {@code UID} fatally errors on plain {@code export NAME=}, so those attempts go through
+     * {@code eval} instead so the loop keeps going and the failure is counted rather than left
+     * invisible), and the NAMES in each of the latter two categories. {@code allowed +
+     * blanked.size() + unblankable.size() == total}, and {@code unblankable.size() == failed}.
+     * Values never appear.
      */
-    record ScrubReport(int allowed, int total, List<String> blanked) {
+    record ScrubReport(int allowed, int total, int failed, List<String> blanked, List<String> unblankable) {
     }
 
     /**
@@ -334,15 +359,46 @@ public final class EnvAllowListScrub {
                   _cb633_blank+=("$_cb633_n")
                 done
 
-                { for _cb633_n in "${_cb633_blank[@]}"; do export "$_cb633_n="; done; } 2>/dev/null
+                # fleetd #394: plain `export "$n="` is FATAL for a zsh read-only/special parameter
+                # (e.g. UID) and aborts this whole sourced file — every name still to come is never
+                # blanked, and the report below is never written, silently. `eval` contains that
+                # error to the single iteration instead: it still fails for that one name, but the
+                # loop continues and we can tell allowed / blanked / unblankable apart afterwards.
+                # This is not a skip-list of known-bad names (that would miss the next one nobody
+                # thought of) — every name in _cb633_blank is still attempted, unconditionally.
+                # Every name reaching this loop already passed the identical identifier check in the
+                # enumeration loop above — but that guard is 20 lines away in a different loop, and
+                # this line is about to splice the name into a string handed to `eval`. Before this
+                # fix the name only ever reached `export` quoted ("$n="), which is inert on a
+                # non-identifier string either way; `eval` makes THIS line the only thing standing
+                # between such a string and code execution in the member's pane, so it re-asserts the
+                # same check on its own rather than trusting a guard it does not own. Under normal
+                # operation this can never fire (the enumeration guard already filtered everything
+                # reaching _cb633_blank), so a name caught here is counted as unblankable rather than
+                # silently dropped — it is real evidence that the upstream guard was bypassed.
+                typeset -a _cb633_ok _cb633_unblankable
+                _cb633_ok=()
+                _cb633_unblankable=()
+                for _cb633_n in "${_cb633_blank[@]}"; do
+                  if [[ ! "$_cb633_n" =~ ^[A-Za-z_][A-Za-z0-9_]*$ ]]; then
+                    _cb633_unblankable+=("$_cb633_n")
+                    continue
+                  fi
+                  if eval "export ${_cb633_n}=" 2>/dev/null; then
+                    _cb633_ok+=("$_cb633_n")
+                  else
+                    _cb633_unblankable+=("$_cb633_n")
+                  fi
+                done
 
                 integer _cb633_kept=$(( _cb633_total - ${#_cb633_blank} ))
                 {
-                  print -r -- "allowed $_cb633_kept of $_cb633_total"
-                  for _cb633_n in "${_cb633_blank[@]}"; do print -r -- "$_cb633_n"; done
+                  print -r -- "allowed $_cb633_kept of $_cb633_total failed ${#_cb633_unblankable}"
+                  for _cb633_n in "${_cb633_ok[@]}"; do print -r -- "$_cb633_n"; done
+                  for _cb633_n in "${_cb633_unblankable[@]}"; do print -r -- "!$_cb633_n"; done
                 } > "$ZDOTDIR/%s" 2>/dev/null
 
-                unset _cb633_allowed _cb633_names _cb633_blank _cb633_n _cb633_total _cb633_kept
+                unset _cb633_allowed _cb633_names _cb633_blank _cb633_ok _cb633_unblankable _cb633_n _cb633_total _cb633_kept
                 """.formatted(names, MemberEnvAllowList.zshCasePattern(), REPORT_FILE);
     }
 
@@ -356,6 +412,11 @@ public final class EnvAllowListScrub {
      * Read and parse {@link #REPORT_FILE} out of a generated ZDOTDIR directory. Returns {@code null}
      * when absent or unreadable (the pane may have been torn down before its login shell ever got to
      * the scrub) — callers treat that as "no measurement available", never as success.
+     *
+     * <p>First line is {@code "allowed <N> of <M> failed <F>"} (fleetd #394 added the trailing
+     * {@code failed <F>} — a count of names the scrub attempted to blank but could not, e.g. a zsh
+     * read-only/special parameter). Every following non-blank line is a name: a bare name was
+     * blanked, a {@code !}-prefixed name was attempted and failed. Values never appear on either.
      */
     static ScrubReport readReport(Path zdotdir) {
         Path report = zdotdir.resolve(REPORT_FILE);
@@ -368,17 +429,24 @@ public final class EnvAllowListScrub {
                 return null;
             }
             String[] parts = lines.getFirst().substring("allowed ".length()).trim().split("\\s+");
-            if (parts.length != 3 || !"of".equals(parts[1])) {
+            if (parts.length != 5 || !"of".equals(parts[1]) || !"failed".equals(parts[3])) {
                 return null;
             }
             List<String> blanked = new ArrayList<>();
+            List<String> unblankable = new ArrayList<>();
             for (int i = 1; i < lines.size(); i++) {
-                if (!lines.get(i).isBlank()) {
-                    blanked.add(lines.get(i));
+                String line = lines.get(i);
+                if (line.isBlank()) {
+                    continue;
+                }
+                if (line.startsWith("!")) {
+                    unblankable.add(line.substring(1));
+                } else {
+                    blanked.add(line);
                 }
             }
             return new ScrubReport(Integer.parseInt(parts[0]), Integer.parseInt(parts[2]),
-                    List.copyOf(blanked));
+                    Integer.parseInt(parts[4]), List.copyOf(blanked), List.copyOf(unblankable));
         } catch (IOException | NumberFormatException e) {
             return null;
         }

fleetd/src/main/java/dev/ltms/fleet/member/HerdrPeerLauncher.java

@@ -1643,11 +1643,19 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
             log.warn("memberCredentials allow-list: pane {} left no scrub report in {} — the "
                     + "environment scrub cannot be confirmed to have run. Either the pane ended "
                     + "before its shell finished starting, or its shell never read our generated "
-                    + "startup files, in which case that member saw the full host environment.",
+                    + "startup files. Either way, we cannot tell from here whether the scrub ran, "
+                    + "so we do not know what that member's environment contained.",
                     paneId, dir);
         } else {
             log.info("memberCredentials allow-list: pane {} allowed {} of {} environment variables",
                     paneId, report.allowed(), report.total());
+            if (report.failed() > 0) {
+                log.warn("memberCredentials allow-list: pane {} could not blank {} environment "
+                        + "variable(s) — {} (likely a zsh read-only/special parameter) — those "
+                        + "names were left in the member's environment. Confirm none of them is a "
+                        + "credential.",
+                        paneId, report.failed(), report.unblankable());
+            }
             List<String> shaped = report.blanked().stream()
                     .filter(name -> CREDENTIAL_SHAPED_NAME.matcher(name).matches())
                     .toList();

fleetd/src/test/java/dev/ltms/fleet/FleetdStartupValidationTest.java

@@ -1,132 +0,0 @@
-package dev.ltms.fleet;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import java.nio.file.Files;
-import java.nio.file.Path;
-
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-/**
- * Proves the one thing no test proved before this ticket's follow-up: that {@code Fleetd.main}
- * ITSELF — not a copy of its logic, not the validator called directly — still refuses to start on
- * a bad config. Mutation testing found that deleting {@code cfg.validateAll();} (née six
- * individual {@code cfg.validateXxx();} calls) from {@code Fleetd.main} left the full 1478-test
- * suite green; every existing test called a validator directly and none exercised {@code
- * Fleetd.main} as the caller. See {@code FleetConfigValidateAllTest} for why the fix collapses
- * those six calls into one reflective {@link FleetConfig#validateAll()}, and {@code
- * ConfigRefTest} for the equivalent proof on the {@link
- * dev.ltms.fleet.config.ConfigRef#reload()} path.
- *
- * <p>This is deliberately the real {@code static void main(String[] args)} — package-private, so
- * only a test in this package can call it, which is exactly what makes this proof strong: it is
- * not a helper extracted for testability, it is the literal method {@code java -jar fleetd.jar}
- * invokes. Every fixture below is otherwise-valid and fails exactly one validator, and — because
- * {@link FleetConfig#validateAll()} runs immediately after {@code SubscriptionGuard.
- * assertPrimaryClean}, before {@code main} opens the herdr socket, binds Javalin, or touches
- * anything else with a real side effect — calling {@code Fleetd.main} with one of these configs is
- * safe: it is guaranteed to throw before reaching any of that, precisely because the config is
- * deliberately invalid.
- */
-class FleetdStartupValidationTest {
-
-    private static void assertMainRefuses(Path dir, String fileName, String yaml,
-                                           String mustContain) throws Exception {
-        Path f = dir.resolve(fileName);
-        Files.writeString(f, yaml);
-        IllegalStateException e = assertThrows(IllegalStateException.class,
-                () -> Fleetd.main(new String[]{f.toString()}),
-                fileName + ": Fleetd.main must refuse this config before doing anything else");
-        assertTrue(e.getMessage().contains(mustContain),
-                fileName + ": expected message to contain \"" + mustContain + "\" but was: "
-                        + e.getMessage());
-    }
-
-    @Test
-    void mainRefusesANonLoopbackBindWithoutTokenMode(@TempDir Path dir) throws Exception {
-        assertMainRefuses(dir, "auth-exposure.yaml", """
-                bind:
-                  host: 0.0.0.0
-                  port: 8765
-                """, "auth.mode: token");
-    }
-
-    @Test
-    void mainRefusesALeadTabPrefixCollision(@TempDir Path dir) throws Exception {
-        assertMainRefuses(dir, "lead-tab-prefixes.yaml", """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                fleet:
-                  tabLabel: "lead: {role} {profile}"
-                  leaders:
-                    opus:
-                      tab: "lead: opus"
-                """, "fleet.tabLabel");
-    }
-
-    @Test
-    void mainRefusesASubscriptionProfileThatReseatsAnthropicBaseUrl(@TempDir Path dir)
-            throws Exception {
-        assertMainRefuses(dir, "subscription-profiles.yaml", """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                profiles:
-                  sonnet:
-                    subscription: true
-                    argv: ["ccs", "sonnet"]
-                    env:
-                      ANTHROPIC_BASE_URL: http://anything-not-on-the-allowlist
-                """, "ANTHROPIC_BASE_URL");
-    }
-
-    @Test
-    void mainRefusesAnUnknownCharterKey(@TempDir Path dir) throws Exception {
-        assertMainRefuses(dir, "charters.yaml", """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                fleet:
-                  charters:
-                    architetc: text
-                """, "architetc");
-    }
-
-    @Test
-    void mainRefusesAnArchitectSlotNamingAnUnconfiguredProfile(@TempDir Path dir) throws Exception {
-        assertMainRefuses(dir, "members.yaml", """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                profiles:
-                  gx10:
-                    baseUrl: http://gx10.gw:8000
-                fleet:
-                  architects:
-                    lead-designer:
-                      profile: sonnet
-                """, "lead-designer");
-    }
-
-    @Test
-    void mainRefusesAProfileNamingAModelOutsideTheAllowList(@TempDir Path dir) throws Exception {
-        assertMainRefuses(dir, "models.yaml", """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                profiles:
-                  sonnet:
-                    baseUrl: http://gx10.gw:8000
-                    model: claude-sonnet-5
-                  rogue:
-                    baseUrl: http://gx11.gw:8000
-                    model: claude-opus-9000
-                models:
-                  allow:
-                    - model: claude-sonnet-5
-                """, "rogue");
-    }
-}

fleetd/src/test/java/dev/ltms/fleet/config/ConfigRefTopLevelReportingCoverageTest.java

@@ -109,8 +109,6 @@ class ConfigRefTopLevelReportingCoverageTest {
         v.put("memberLoginShell", null);
         v.put("memberSkills", "/skills/a");
         v.put("idleSleepGuard", new FleetConfig.IdleSleepGuard(true));
-        v.put("models", new FleetConfig.Models(
-                List.of(new FleetConfig.Models.ModelEntry("model-a"))));
         assertNamesMatchComponents(v);
         return v;
     }
@@ -153,8 +151,6 @@ class ConfigRefTopLevelReportingCoverageTest {
         v.put("memberLoginShell", null);
         v.put("memberSkills", "/skills/b");
         v.put("idleSleepGuard", new FleetConfig.IdleSleepGuard(false));
-        v.put("models", new FleetConfig.Models(
-                List.of(new FleetConfig.Models.ModelEntry("model-b"))));
         assertNamesMatchComponents(v);
         return v;
     }

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java

@@ -2683,222 +2683,4 @@ class FleetConfigTest {
         assertTrue(cfg.idleSleepGuard().isEnabled(),
                 "unlike ConfigReload/Health, this block defaults to ON even when present but empty");
     }
-
-    // --- models: central allow-list of usable models -----------------------------------------
-
-    /**
-     * An absent {@code models:} block is today's behaviour exactly: no profile's {@code model:} is
-     * checked against anything, whatever it says. This is the "existing config keeps working"
-     * invariant — an operator on a gitignored {@code fleetd.yaml} that predates this feature must
-     * not be broken by upgrading the daemon.
-     */
-    @Test
-    void absentModelsBlockValidatesNothing(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("fleetd.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                profiles:
-                  gx10:
-                    baseUrl: http://gx10.gw:8000
-                    model: totally-unheard-of-model-xyz
-                """);
-
-        FleetConfig cfg = FleetConfig.load(f);
-        assertDoesNotThrow(cfg::validateModels);
-    }
-
-    /**
-     * {@code models:} present but with an empty (or absent) {@code allow:} must behave exactly like
-     * the block being absent — an operator adding the block for the first time with nothing in it
-     * yet must not be surprised by every profile suddenly refusing to start.
-     */
-    @Test
-    void modelsBlockPresentButEmptyValidatesNothing(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("fleetd.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                profiles:
-                  gx10:
-                    baseUrl: http://gx10.gw:8000
-                    model: whatever-the-operator-typed
-                models:
-                  allow: []
-                """);
-
-        FleetConfig cfg = FleetConfig.load(f);
-        assertDoesNotThrow(cfg::validateModels);
-    }
-
-    /**
-     * The core of the ticket: a profile naming a model outside the configured allow-list fails
-     * config load, naming both the model and the profile that wanted it.
-     */
-    @Test
-    void aProfileNamingAModelOutsideTheAllowListRefusesToStart(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("fleetd.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                profiles:
-                  sonnet:
-                    baseUrl: http://gx10.gw:8000
-                    model: claude-sonnet-5
-                  rogue:
-                    baseUrl: http://gx11.gw:8000
-                    model: claude-opus-9000
-                models:
-                  allow:
-                    - model: claude-sonnet-5
-                    - model: claude-haiku-5
-                """);
-        FleetConfig cfg = FleetConfig.load(f);
-
-        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateModels);
-        assertTrue(e.getMessage().contains("rogue"), "the refusal names the offending profile");
-        assertTrue(e.getMessage().contains("claude-opus-9000"), "the refusal names the offending model");
-        assertFalse(e.getMessage().contains("'sonnet'"),
-                "the profile whose model IS allowed must not be reported");
-    }
-
-    /** A profile whose {@code model:} is on the allow-list loads fine. */
-    @Test
-    void aProfileNamingAModelOnTheAllowListLoadsFine(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("fleetd.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                profiles:
-                  sonnet:
-                    baseUrl: http://gx10.gw:8000
-                    model: claude-sonnet-5
-                models:
-                  allow:
-                    - model: claude-sonnet-5
-                """);
-
-        FleetConfig cfg = FleetConfig.load(f);
-        assertDoesNotThrow(cfg::validateModels);
-    }
-
-    /**
-     * A profile that never sets {@code model:} (a {@code subscription: true} profile relying on the
-     * account's own default is the live example) must not be refused just because an allow-list is
-     * active — there is nothing to check it against.
-     */
-    @Test
-    void aProfileWithNoModelPassesEvenWithAnActiveAllowList(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("fleetd.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                profiles:
-                  opus:
-                    subscription: true
-                models:
-                  allow:
-                    - model: claude-sonnet-5
-                """);
-
-        FleetConfig cfg = FleetConfig.load(f);
-        assertDoesNotThrow(cfg::validateModels);
-    }
-
-    /**
-     * Reproduces the live config shape this ticket measured: a mix of {@code amazon-bedrock},
-     * {@code opencode} and {@code openai}-backed profiles, some naming a bare Claude id and some a
-     * provider-prefixed opencode id, in ONE allow-list. Both forms are just opaque strings compared
-     * for exact equality — proves the shape decision holds against the shape actually seen live,
-     * not just against a synthetic single-provider example.
-     */
-    @Test
-    void aBareClaudeIdAndAnOpencodeProviderPrefixedIdBothFitOneAllowList(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("fleetd.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                profiles:
-                  sonnet:
-                    baseUrl: http://gx10.gw:8000
-                    model: claude-sonnet-5
-                  terra:
-                    kind: opencode
-                    model: openai/gpt-5.6-terra
-                  nova:
-                    kind: opencode
-                    model: amazon-bedrock/amazon.nova-pro-v1:0
-                models:
-                  allow:
-                    - model: claude-sonnet-5
-                    - model: openai/gpt-5.6-terra
-                    - model: amazon-bedrock/amazon.nova-pro-v1:0
-                """);
-
-        FleetConfig cfg = FleetConfig.load(f);
-        assertDoesNotThrow(cfg::validateModels);
-    }
-
-    /** The same live shape, but one opencode profile's model is missing from the allow-list. */
-    @Test
-    void anUnlistedOpencodeProviderPrefixedModelRefusesToStart(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("fleetd.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                profiles:
-                  sonnet:
-                    baseUrl: http://gx10.gw:8000
-                    model: claude-sonnet-5
-                  terra:
-                    kind: opencode
-                    model: openai/gpt-5.6-terra-withdrawn
-                models:
-                  allow:
-                    - model: claude-sonnet-5
-                    - model: openai/gpt-5.6-terra
-                """);
-        FleetConfig cfg = FleetConfig.load(f);
-
-        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateModels);
-        assertTrue(e.getMessage().contains("terra"), "the refusal names the offending profile");
-        assertTrue(e.getMessage().contains("openai/gpt-5.6-terra-withdrawn"),
-                "the refusal names the offending model, with its provider prefix intact");
-    }
-
-    /**
-     * Editing a {@code profiles:} entry alone must never be able to widen what is permitted — only
-     * editing {@code models.allow:} itself can. This is the invariant the ticket states explicitly;
-     * this test pins it by giving a profile a plausible-looking model that was never added to the
-     * allow-list and confirming it is still refused.
-     */
-    @Test
-    void addingAProfileCannotWidenTheAllowListByItself(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("fleetd.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                profiles:
-                  sonnet:
-                    baseUrl: http://gx10.gw:8000
-                    model: claude-sonnet-5
-                  brand-new:
-                    baseUrl: http://gx12.gw:8000
-                    model: claude-sonnet-6-preview
-                models:
-                  allow:
-                    - model: claude-sonnet-5
-                """);
-        FleetConfig cfg = FleetConfig.load(f);
-
-        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateModels);
-        assertTrue(e.getMessage().contains("brand-new"));
-        assertTrue(e.getMessage().contains("claude-sonnet-6-preview"));
-    }
-
-    /** {@code models} is a brand-new top-level key and must be recognized, not WARN-ed as unknown. */
-    @Test
-    void modelsIsAKnownTopLevelKey() {
-        assertTrue(FleetConfig.KNOWN_TOP_LEVEL_KEYS.contains("models"));
-    }
 }

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigValidateAllTest.java

@@ -1,358 +0,0 @@
-package dev.ltms.fleet.config;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import java.lang.reflect.Method;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Set;
-import java.util.TreeSet;
-
-import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-/**
- * The gap this class exists to close: mutation testing on the fleetd ticket "central allow-list
- * of usable models" found that although {@link FleetConfig#validateModels()}'s own logic was well
- * pinned, nothing proved either real caller ({@code Fleetd.main} and {@link ConfigRef#reload()})
- * still invoked it — deleting the call site left the full suite green (1478/0/0/0). A follow-up
- * measurement (same technique — remove one call site, run the suite, not read the code) found the
- * SAME gap for all five of {@link FleetConfig}'s other validators at startup, and for four of the
- * six inside {@link ConfigRef#reload()}. This is a class of gap, not one line's mistake: every one
- * of those thirteen tests called the validator itself directly, never the real caller that was
- * supposed to.
- *
- * <p>The fix replaces the six individual {@code cfg.validateXxx()} calls at each of the two real
- * call sites with one {@link FleetConfig#validateAll()}, which reaches every validator by
- * reflection rather than by a hand-maintained list of names. A hand-maintained list of six names
- * would have exactly the defect it replaces: the seventh validator someone adds next month has no
- * reason to be added to it, and nothing would say so. This class proves TWO separate claims, and
- * keeps them separate on purpose:
- *
- * <ol>
- *   <li>{@link #theSweepMechanismIsGenericNotHardcodedToFleetConfigsSixNames()} and its neighbours
- *       prove the reflective sweep itself ({@link FleetConfig#invokeAllValidators}) is a general
- *       mechanism — it runs whatever public, no-arg, void {@code validateXxx()} methods a class
- *       happens to declare today, including a class with more of them than {@link FleetConfig}
- *       has right now. This is the proof that a future, real seventh validator on {@link
- *       FleetConfig} would be swept automatically, without needing to add a real (unwanted)
- *       seventh validator just to exercise the claim.</li>
- *   <li>{@link #validateAllReachesEveryOneOfTodaysSixValidators()} proves {@link
- *       FleetConfig#validateAll()} itself is wired to that same generic mechanism and genuinely
- *       reaches each of today's six real validators — reusing the exact minimal failing
- *       configurations {@code FleetConfigTest} already established for each one directly, so a
- *       single call to {@code validateAll()} is shown to reproduce every one of those six
- *       failures.</li>
- * </ol>
- *
- * <p>Together with the direct-{@code Fleetd.main}-invocation tests in {@code
- * FleetdStartupValidationTest} (which prove the real startup call site still calls {@code
- * validateAll()}) and the {@code ConfigRefTest} reload tests (which prove the same for {@link
- * ConfigRef#reload()}), removing {@code cfg.validateAll();} from either real call site now fails
- * a test in this module.
- *
- * <p><b>What is NOT pinned, measured rather than assumed.</b> Reverting {@link
- * FleetConfig#validateAll()} to a hardcoded list of today's six method calls leaves the whole
- * suite green (measured at review: 1491 tests, 0 failures). Nothing ties {@code validateAll()} to
- * the generic sweep — claim 1 proves {@link FleetConfig#invokeAllValidators} is generic, and claim
- * 2 proves {@code validateAll()} reaches today's six, and a hardcoded list satisfies both. So the
- * reflective sweep is a convenience, not the guarantee. The guarantee is {@link
- * #fleetConfigDeclaresExactlyTheseSixValidatorsToday()}: it fails the moment a seventh validator
- * is declared, which forces whoever adds it to look at this file.
- */
-class FleetConfigValidateAllTest {
-
-    // ── Claim 1: the reflective sweep is a general mechanism, not six names in disguise ──────────
-
-    /**
-     * A throwaway fixture class, unrelated to {@link FleetConfig} in every way except shape: three
-     * public, no-arg, void methods named {@code validateXxx}. Proves the sweep works on ANY class
-     * with this shape, not on something special-cased to {@link FleetConfig}.
-     */
-    static class ThreeValidators {
-        final List<String> ran = new ArrayList<>();
-
-        public void validateAlpha() {
-            ran.add("validateAlpha");
-        }
-
-        public void validateBeta() {
-            ran.add("validateBeta");
-        }
-
-        public void validateGamma() {
-            ran.add("validateGamma");
-        }
-    }
-
-    @Test
-    void theSweepMechanismIsGenericNotHardcodedToFleetConfigsSixNames() {
-        ThreeValidators target = new ThreeValidators();
-        FleetConfig.invokeAllValidators(target);
-        assertEquals(List.of("validateAlpha", "validateBeta", "validateGamma"), target.ran,
-                "every validateXxx() method on this unrelated class must run, in alphabetical "
-                        + "order — the sweep reads the class's own shape, not a name FleetConfig "
-                        + "happens to know about");
-    }
-
-    /**
-     * The core of the "self-maintaining" requirement: the exact same class shape as {@link
-     * ThreeValidators}, plus one more method — standing in for "a developer adds a validator next
-     * month". Nothing about the sweep changes to pick it up; the new method is invoked purely
-     * because it exists and matches the shape. This is what makes adding a seventh real validator
-     * to {@link FleetConfig} safe without touching {@link FleetConfig#validateAll()} or either
-     * call site — there is no "wire it in" step left to forget.
-     */
-    static class FourValidators {
-        final List<String> ran = new ArrayList<>();
-
-        public void validateAlpha() {
-            ran.add("validateAlpha");
-        }
-
-        public void validateBeta() {
-            ran.add("validateBeta");
-        }
-
-        public void validateGamma() {
-            ran.add("validateGamma");
-        }
-
-        public void validateDelta() {
-            ran.add("validateDelta");
-        }
-    }
-
-    @Test
-    void addingAFourthValidatorMethodGetsSweptWithNoOtherChange() {
-        FourValidators target = new FourValidators();
-        FleetConfig.invokeAllValidators(target);
-        assertEquals(List.of("validateAlpha", "validateBeta", "validateDelta", "validateGamma"),
-                sorted(target.ran),
-                "the fourth method must be reached automatically — proving a class can grow the "
-                        + "set of things it validates with no change to the sweep itself");
-    }
-
-    private static List<String> sorted(List<String> in) {
-        List<String> copy = new ArrayList<>(in);
-        copy.sort(String::compareTo);
-        return copy;
-    }
-
-    @Test
-    void aFailingValidatorStopsTheSweepAndPropagatesUnchanged() {
-        class OneFails {
-            @SuppressWarnings("unused")
-            public void validateOk() {
-                // passes
-            }
-
-            public void validateBoom() {
-                throw new IllegalStateException("refusing to start: boom");
-            }
-        }
-        IllegalStateException e = assertThrows(IllegalStateException.class,
-                () -> FleetConfig.invokeAllValidators(new OneFails()));
-        assertEquals("refusing to start: boom", e.getMessage(),
-                "the real exception must propagate unchanged, not be wrapped or swallowed");
-    }
-
-    /**
-     * Every rule the sweep's filter applies, proven independently: only public, no-arg, void
-     * methods whose name starts with {@code "validate"} run, {@code validateAll} itself is
-     * excluded (so a class that declares one of its own — as {@link FleetConfig} does — cannot
-     * recurse into itself), and a same-shaped-but-wrongly-named or wrongly-shaped method never
-     * runs. A reader who "simplifies" the filter in {@link FleetConfig#invokeAllValidators} in a
-     * way that widens or narrows it breaks one of these.
-     */
-    static class FilterEdgeCases {
-        final List<String> ran = new ArrayList<>();
-
-        public void validateReal() {
-            ran.add("validateReal");
-        }
-
-        /** Wrong name — must not run. */
-        public void checkSomething() {
-            ran.add("checkSomething");
-        }
-
-        /** Wrong shape — takes an argument. */
-        public void validateWithArg(String ignored) {
-            ran.add("validateWithArg");
-        }
-
-        /** Wrong shape — returns something. */
-        public boolean validateReturnsBoolean() {
-            ran.add("validateReturnsBoolean");
-            return true;
-        }
-
-        /** Excluded by name on purpose, so the sweep cannot call itself. */
-        public void validateAll() {
-            ran.add("validateAll");
-        }
-    }
-
-    @Test
-    void onlyPublicNoArgVoidValidateNamedMethodsRun() {
-        FilterEdgeCases target = new FilterEdgeCases();
-        FleetConfig.invokeAllValidators(target);
-        assertEquals(List.of("validateReal"), target.ran,
-                "checkSomething (wrong name), validateWithArg (wrong shape), "
-                        + "validateReturnsBoolean (wrong shape), and validateAll (excluded by "
-                        + "name) must all be skipped");
-    }
-
-    // ── Claim 2: FleetConfig.validateAll() is wired to that mechanism and reaches all six today ──
-
-    /**
-     * Reflectively enumerates {@link FleetConfig}'s own public, no-arg, void {@code validateXxx()}
-     * methods (excluding {@code validateAll} itself) — the exact same filter {@link
-     * FleetConfig#invokeAllValidators} applies. This is not the mechanism proof (that is claim 1,
-     * above, on an unrelated class) — it is a visible denominator: today there are six, named
-     * here, so a reader adding a seventh sees this assertion name the new count rather than a
-     * silent pass at the old one.
-     */
-    @Test
-    void fleetConfigDeclaresExactlyTheseSixValidatorsToday() {
-        Set<String> names = new TreeSet<>();
-        for (Method m : FleetConfig.class.getMethods()) {
-            if (java.lang.reflect.Modifier.isPublic(m.getModifiers())
-                    && m.getParameterCount() == 0
-                    && m.getReturnType() == void.class
-                    && m.getName().startsWith("validate")
-                    && !m.getName().equals("validateAll")) {
-                names.add(m.getName());
-            }
-        }
-        assertEquals(new TreeSet<>(Set.of("validateAuthExposure", "validateLeadTabPrefixes",
-                "validateSubscriptionProfiles", "validateCharters", "validateMembers",
-                "validateModels")), names,
-                "FleetConfig's public validate*() methods changed. Do TWO things, in this "
-                        + "order. First confirm validateAll() still delegates to "
-                        + "invokeAllValidators(this) — a hardcoded list there passes every other "
-                        + "test in this class, so this assertion is the only place that will ever "
-                        + "make you check. Only then update the expected set to match.");
-    }
-
-    /** A minimal, otherwise-valid file — same shape FleetConfigTest and ConfigRefTest use. */
-    private static String minimalValidYaml() {
-        return """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                profiles:
-                  sonnet:
-                    baseUrl: http://gx00.gw:8000
-                    model: sonnet
-                """;
-    }
-
-    @Test
-    void aFullyValidConfigPassesValidateAll(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("fleetd.yaml");
-        Files.writeString(f, minimalValidYaml());
-        assertDoesNotThrow(() -> FleetConfig.load(f).validateAll());
-    }
-
-    /**
-     * The heart of claim 2: for each of today's six real validators, a minimal file that fails
-     * ONLY that one — the exact fixtures {@code FleetConfigTest} uses to test each validator
-     * directly — must also fail through {@link FleetConfig#validateAll()}. If a future edit to
-     * {@code validateAll()} silently dropped one validator from the sweep (e.g. a typo'd name
-     * filter), exactly one of these six would start passing when it must not.
-     */
-    @Test
-    void validateAllReachesEveryOneOfTodaysSixValidators(@TempDir Path dir) throws Exception {
-        // validateAuthExposure: a non-loopback bind without token mode.
-        assertValidateAllRefuses(dir, "auth-exposure.yaml", """
-                bind:
-                  host: 0.0.0.0
-                  port: 8765
-                """, "auth.mode: token");
-
-        // validateLeadTabPrefixes: a fleet-wide tabLabel that starts with a lead's own tabPrefix.
-        assertValidateAllRefuses(dir, "lead-tab-prefixes.yaml", """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                fleet:
-                  tabLabel: "lead: {role} {profile}"
-                  leaders:
-                    opus:
-                      tab: "lead: opus"
-                """, "fleet.tabLabel");
-
-        // validateSubscriptionProfiles: subscription: true with env: reseating ANTHROPIC_BASE_URL.
-        assertValidateAllRefuses(dir, "subscription-profiles.yaml", """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                profiles:
-                  sonnet:
-                    subscription: true
-                    argv: ["ccs", "sonnet"]
-                    env:
-                      ANTHROPIC_BASE_URL: http://anything-not-on-the-allowlist
-                """, "ANTHROPIC_BASE_URL");
-
-        // validateCharters: a charter key that is not a role wire name.
-        assertValidateAllRefuses(dir, "charters.yaml", """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                fleet:
-                  charters:
-                    architetc: text
-                """, "architetc");
-
-        // validateMembers: an architect slot naming an unconfigured profile.
-        assertValidateAllRefuses(dir, "members.yaml", """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                profiles:
-                  gx10:
-                    baseUrl: http://gx10.gw:8000
-                fleet:
-                  architects:
-                    lead-designer:
-                      profile: sonnet
-                """, "lead-designer");
-
-        // validateModels: a profile naming a model outside the configured allow-list.
-        assertValidateAllRefuses(dir, "models.yaml", """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                profiles:
-                  sonnet:
-                    baseUrl: http://gx10.gw:8000
-                    model: claude-sonnet-5
-                  rogue:
-                    baseUrl: http://gx11.gw:8000
-                    model: claude-opus-9000
-                models:
-                  allow:
-                    - model: claude-sonnet-5
-                """, "rogue");
-    }
-
-    private static void assertValidateAllRefuses(Path dir, String fileName, String yaml,
-                                                  String mustContain) throws Exception {
-        Path f = dir.resolve(fileName);
-        Files.writeString(f, yaml);
-        FleetConfig cfg = FleetConfig.load(f);
-        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateAll,
-                fileName + ": validateAll() must refuse this config");
-        assertTrue(e.getMessage().contains(mustContain),
-                fileName + ": expected message to contain \"" + mustContain + "\" but was: "
-                        + e.getMessage());
-    }
-}

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigWithDefaultsPreservesEveryComponentTest.java

@@ -97,8 +97,6 @@ class FleetConfigWithDefaultsPreservesEveryComponentTest {
         v.put("memberLoginShell", "/bin/zsh");
         v.put("memberSkills", "/skills/guard");
         v.put("idleSleepGuard", new FleetConfig.IdleSleepGuard(true));
-        v.put("models", new FleetConfig.Models(
-                List.of(new FleetConfig.Models.ModelEntry("model-guard"))));
         assertNamesMatchComponents(v);
         return v;
     }

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpTest.java

@@ -3,6 +3,7 @@ package dev.ltms.fleet.mcp;
 import dev.ltms.fleet.auth.CallerResolver;
 import dev.ltms.fleet.auth.MemberRegistry;
 import dev.ltms.fleet.auth.Principal;
+import dev.ltms.fleet.auth.Role;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.AgentControl;
@@ -28,6 +29,7 @@ import dev.ltms.fleet.placement.BackendQuarantine;
 import dev.ltms.fleet.placement.PlacementPolicies;
 import io.modelcontextprotocol.spec.McpSchema;
 import dev.ltms.fleet.msg.InMemoryReplyInbox;
+import dev.ltms.fleet.msg.ReplyInbox;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 
@@ -77,7 +79,7 @@ class FleetMcpTest {
             Thread.sleep(5);
         }
         assertTrue(rendezvous.isWaiting(target), "send should be accepted for " + target);
-        FleetMcp.reply(messages, target, "received");
+        FleetMcp.reply(messages, target, Role.WORKER, "received");
         assertEquals("received", textOf(send.get(6, TimeUnit.SECONDS)));
     }
 
@@ -110,7 +112,7 @@ class FleetMcpTest {
 
         // fleetd #365: a resolved live send must read distinctly from a merely-queued reply —
         // see replyWithNoPendingSendIsQueuedNotError below for the other case.
-        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", "LGTM");
+        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", Role.WORKER, "LGTM");
         assertEquals(MessageService.ReplyOutcome.RESOLVED_SEND.description(), textOf(reply));
 
         McpSchema.CallToolResult res = send.get(6, TimeUnit.SECONDS);
@@ -136,7 +138,7 @@ class FleetMcpTest {
         }
         assertTrue(rendezvous.isWaiting("term_a"), "send should have opened its waiter");
 
-        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", "async LGTM");
+        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", Role.WORKER, "async LGTM");
         assertEquals(MessageService.ReplyOutcome.RESOLVED_SEND.description(), textOf(reply));
 
         // Poll until the async send completes and reports the reply.
@@ -183,7 +185,7 @@ class FleetMcpTest {
             Thread.sleep(5);
         }
         assertTrue(rendezvous.isWaiting("term_a"));
-        FleetMcp.reply(messages, "term_a", "done");
+        FleetMcp.reply(messages, "term_a", Role.WORKER, "done");
         assertEquals("done", textOf(answer.get(6, TimeUnit.SECONDS)));
 
         McpSchema.CallToolResult done = FleetMcp.poll(messages, ticket, null);
@@ -215,7 +217,7 @@ class FleetMcpTest {
         // fleet_poll{ticket} stuck PENDING forever and later force-failed with a false "session
         // released before it replied" reason. This used to land in the inbox instead (see the old
         // assertion this replaced: messages.drainReplies("term_a").getFirst()...) — that was the bug.
-        FleetMcp.reply(messages, "term_a", "finished after timeout");
+        FleetMcp.reply(messages, "term_a", Role.WORKER, "finished after timeout");
         assertEquals("finished after timeout", textOf(FleetMcp.poll(messages, ticket, null)));
         assertTrue(messages.drainReplies("term_a").isEmpty(),
                 "the reply completed its own ticket directly and never touched the inbox");
@@ -269,7 +271,7 @@ class FleetMcpTest {
         }
         assertEquals(MessageService.Phase.FAILED, second.phase());
 
-        FleetMcp.reply(messages, "term_a", "late reply");
+        FleetMcp.reply(messages, "term_a", Role.WORKER, "late reply");
         assertEquals("late reply", messages.drainReplies("term_a").getFirst().content());
 
         CompletableFuture<McpSchema.CallToolResult> answer = CompletableFuture.supplyAsync(
@@ -278,7 +280,7 @@ class FleetMcpTest {
         while (!rendezvous.isWaiting("term_a") && System.currentTimeMillis() < deadline) {
             Thread.sleep(5);
         }
-        FleetMcp.reply(messages, "term_a", "done");
+        FleetMcp.reply(messages, "term_a", Role.WORKER, "done");
         assertEquals("done", textOf(answer.get(6, TimeUnit.SECONDS)));
     }
 
@@ -331,7 +333,7 @@ class FleetMcpTest {
     void replyWithNoPendingSendIsQueuedNotError() {
         // CB-307: a reply with no open send is now queued in the inbox, not an error.
         // fleetd #365: it must also no longer claim "delivered" — nothing was waiting for it.
-        McpSchema.CallToolResult res = FleetMcp.reply(messages, "term_a", "orphan");
+        McpSchema.CallToolResult res = FleetMcp.reply(messages, "term_a", Role.WORKER, "orphan");
         assertNotEquals(Boolean.TRUE, res.isError(), "a queued reply is not an error");
         assertEquals(MessageService.ReplyOutcome.QUEUED.description(), textOf(res));
 
@@ -341,6 +343,40 @@ class FleetMcpTest {
         assertEquals("orphan", drained.getFirst().content());
     }
 
+    @Test
+    void replyFromLeadIsRefusedBeforeItCanPublishToTheWorkerInbox() {
+        ReplyInbox inboxThatRejectsPublishes = new ReplyInbox() {
+            @Override public void own(String target) { }
+            @Override public void release(String target) { }
+            @Override public void publish(String target, String msgId, String content) {
+                fail("a lead fleet_reply must not publish to the worker inbox");
+            }
+            @Override public List<InboxMessage> peek(String target) { return List.of(); }
+            @Override public void ack(String target, String msgId) { }
+        };
+        MessageService leadMessages = new MessageService(agents, new Injector(agents), new Rendezvous(),
+                inboxThatRejectsPublishes);
+
+        McpSchema.CallToolResult res = assertDoesNotThrow(
+                () -> FleetMcp.reply(leadMessages, "term_lead", Role.PRIMARY, "peer reply"));
+
+        assertTrue(res.isError());
+        assertEquals("fleet_reply has no route to a peer lead. Use fleet_send{coordId: ...} for a peer on another "
+                        + "daemon or fleet_send{sessionId: ...} for a peer on this host. fleet_reply resolves a member's "
+                        + "blocked fleet_send, and a peer's coord-id message is durable and non-blocking, so there is "
+                        + "nothing for it to resolve.",
+                textOf(res));
+    }
+
+    @Test
+    void replyFromUnidentifiedCallerKeepsItsOwnError() {
+        McpSchema.CallToolResult res = FleetMcp.reply(messages, null, Role.PRIMARY, "reply");
+
+        assertTrue(res.isError());
+        assertEquals("fleet_reply is for workers only — could not identify the calling worker from the connection",
+                textOf(res));
+    }
+
     @Test
     void replyWithBlankContentIsACleanToolErrorNotAnUncaughtException() {
         // fleetd #302: MessageService.reply now REJECTS blank content by throwing. fleet_reply's
@@ -351,7 +387,7 @@ class FleetMcpTest {
         // has always used isBlank for exactly this reason.
         for (String blank : new String[] {null, "", "   ", "\n\t"}) {
             McpSchema.CallToolResult res = assertDoesNotThrow(
-                    () -> FleetMcp.reply(messages, "term_a", blank),
+                    () -> FleetMcp.reply(messages, "term_a", Role.WORKER, blank),
                     "blank content must be refused as a tool error, never thrown out of the handler");
             assertEquals(Boolean.TRUE, res.isError(), "blank content is an error result");
             assertTrue(textOf(res).contains("content is required"),
@@ -364,7 +400,7 @@ class FleetMcpTest {
     @Test
     void bridgePollWithTargetDrainsReplies() {
         // A reply with no open send queues it in the inbox.
-        FleetMcp.reply(messages, "term_a", "queued-msg");
+        FleetMcp.reply(messages, "term_a", Role.WORKER, "queued-msg");
 
         // fleet_poll with target drains the inbox.
         McpSchema.CallToolResult res = FleetMcp.poll(messages, null, "term_a");
@@ -415,7 +451,7 @@ class FleetMcpTest {
             Thread.sleep(5);
         }
         assertTrue(rendezvous.isWaiting("term_a"), "the answer should have reopened a waiter");
-        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", "done");
+        McpSchema.CallToolResult reply = FleetMcp.reply(messages, "term_a", Role.WORKER, "done");
         assertEquals(MessageService.ReplyOutcome.RESOLVED_SEND.description(), textOf(reply));
         assertEquals("done", textOf(answer.get(6, TimeUnit.SECONDS)));
     }
@@ -1254,13 +1290,13 @@ class FleetMcpTest {
     @Test
     void bridgeAckRemovesSpecificReply() {
         // Queue a reply and capture its msgId.
-        FleetMcp.reply(messages, "term_a", "orphan");
+        FleetMcp.reply(messages, "term_a", Role.WORKER, "orphan");
         var before = messages.drainReplies("term_a");
         assertEquals(1, before.size(), "one reply in the inbox");
         String msgId = before.getFirst().msgId();
 
         // Publish the same reply again and ack it via fleet_ack surface.
-        FleetMcp.reply(messages, "term_a", "orphan-again");
+        FleetMcp.reply(messages, "term_a", Role.WORKER, "orphan-again");
         var peeked = messages.drainReplies("term_a");
         assertEquals(1, peeked.size(), "one fresh reply in the inbox");
 

fleetd/src/test/java/dev/ltms/fleet/member/EnvAllowListScrubTest.java

@@ -18,6 +18,7 @@ import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -118,6 +119,131 @@ class EnvAllowListScrubTest {
                 "allowed N of M with N <= M — the denominator is always reported");
     }
 
+    /**
+     * fleetd #394: the actual defect. Plain {@code export "$n="} is FATAL for a zsh read-only or
+     * special parameter (e.g. {@code UID}) and aborts the whole sourced file — every name still to
+     * come is never blanked, and the {@code scrub-report.txt} below is never written at all,
+     * silently ({@code 2>/dev/null} swallows the error). This plants an unblankable, exported,
+     * read-only variable in the MIDDLE of the names the scrub attempts to blank, with two more
+     * names after it, and asserts that both of those later names are STILL blanked and the report
+     * is STILL written with the failure counted — a test that only checked names BEFORE the failure
+     * point would pass today and prove nothing.
+     *
+     * <p>The planted name is a made-up one ({@code FLEETD_TEST_UNBLANKABLE}), not {@code UID} or
+     * any other name a skip-list might already know about — invariant 1 is that the loop survives
+     * ANY unblankable name, not a known one, so the test must not lean on one either.
+     *
+     * <p>Exercises the real artefact: {@link EnvAllowListScrub#scrubScript} is run verbatim under a
+     * real {@code /bin/zsh}, not just asserted on as a Java string. The four planted names are
+     * exported one at a time via {@code typeset -x}/{@code typeset -rx} immediately before the
+     * script runs, in a fixed order — zsh's {@code export}/{@code typeset -x} appends to the
+     * process's environment table in call order (verified empirically: a freshly-exported name
+     * always sorts after every inherited one and after every earlier freshly-exported name in
+     * {@code command env}'s own output), which is what makes the "middle" position deterministic
+     * here, unlike relying on the OS's own inherited-environment order.
+     */
+    @Test
+    void unblankableNameInTheMiddleDoesNotAbortNamesAfterIt(@TempDir Path tmp) throws Exception {
+        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+
+        // Only ZDOTDIR is allowed — it must survive the scrub itself, since the report is written
+        // to "$ZDOTDIR/..." AFTER the blanking loop runs; if ZDOTDIR were blanked as a side effect,
+        // the report write would silently go to the wrong place instead of testing anything.
+        String script = EnvAllowListScrub.scrubScript(Set.of("ZDOTDIR"));
+        String setup = """
+                typeset -x FLEETD_TEST_BEFORE=1
+                typeset -rx FLEETD_TEST_UNBLANKABLE=1
+                typeset -x FLEETD_TEST_AFTER_A=1
+                typeset -x FLEETD_TEST_AFTER_B=1
+                """;
+
+        ProcessBuilder pb = new ProcessBuilder("/bin/zsh");
+        pb.environment().clear();
+        pb.environment().put("PATH", "/usr/bin:/bin");
+        pb.environment().put("ZDOTDIR", tmp.toAbsolutePath().toString());
+        pb.redirectError(ProcessBuilder.Redirect.DISCARD);
+        Process zsh = pb.start();
+        zsh.getOutputStream().write((setup + script).getBytes(StandardCharsets.UTF_8));
+        zsh.getOutputStream().flush();
+        zsh.getOutputStream().close();
+        assertTrue(zsh.waitFor(60, java.util.concurrent.TimeUnit.SECONDS),
+                "the scrub script did not exit within 60s");
+        assertEquals(0, zsh.exitValue(),
+                "the scrub script itself must never abort — an unblankable name must not kill the "
+                        + "sourced file");
+
+        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(tmp);
+        assertNotNull(report, "the report must still be written even though one name could not be "
+                + "blanked — a report that silently never appears is the #394 bug");
+        assertTrue(report.blanked().contains("FLEETD_TEST_BEFORE"),
+                "sanity: the name before the unblankable one must be blanked");
+        assertTrue(report.blanked().contains("FLEETD_TEST_AFTER_A"),
+                "the FIRST name AFTER the unblankable one must still be blanked — before the fix, "
+                        + "the whole loop aborted at the unblankable name and every later name was "
+                        + "silently left untouched");
+        assertTrue(report.blanked().contains("FLEETD_TEST_AFTER_B"),
+                "the SECOND name after the unblankable one must also still be blanked");
+        assertEquals(1, report.failed(),
+                "exactly one attempted name could not be blanked, and that count must be visible "
+                        + "without reading the member's environment");
+        assertEquals(List.of("FLEETD_TEST_UNBLANKABLE"), report.unblankable(),
+                "the unblankable name is reported by name, not silently dropped");
+    }
+
+    /**
+     * fleetd #394 follow-up: the blanking loop's {@code eval "export ${n}="} splices {@code n} into
+     * a string that zsh then interprets as shell syntax. That is only safe because every name
+     * reaching {@code _cb633_blank} already passed an identifier check in the ENUMERATION loop
+     * (20 lines away, in a different loop) — so the fix re-asserts the identical check immediately
+     * before the {@code eval} call, rather than trusting that distant guard to keep holding.
+     *
+     * <p>This test plants a value with an embedded newline, exploiting the exact "junk from
+     * multi-line values" gap the enumeration loop's own comment already documents: {@code command
+     * env}'s text output is read line-by-line, so a value's second line becomes a spurious extra
+     * "name" that was never a real exported variable. The fragment used here ({@code
+     * junk.fragment}) is merely non-conforming (it contains a dot) — never command-shaped; this
+     * test must never demonstrate command execution and plants no command-shaped payload.
+     *
+     * <p>Exercises the real artefact end-to-end: {@link EnvAllowListScrub#scrubScript} runs
+     * verbatim under a real {@code /bin/zsh}, exactly as {@code generate()} would produce it — this
+     * is not a synthetic call into just the blanking loop.
+     */
+    @Test
+    void nonIdentifierJunkFromAMultilineValueIsSkippedNotBlankedOrUnblankable(@TempDir Path tmp)
+            throws Exception {
+        assumeTrue(Files.isExecutable(ZSH), "/bin/zsh not present — nothing to prove here");
+
+        String script = EnvAllowListScrub.scrubScript(Set.of("ZDOTDIR"));
+
+        ProcessBuilder pb = new ProcessBuilder("/bin/zsh");
+        pb.environment().clear();
+        pb.environment().put("PATH", "/usr/bin:/bin");
+        pb.environment().put("ZDOTDIR", tmp.toAbsolutePath().toString());
+        // Embedded newline: `command env`'s own text output splits this into two lines, and the
+        // second ("junk.fragment") has no "=" at all, so `cut -d= -f1` returns it unchanged as a
+        // spurious candidate "name" — it was never an actual exported variable by that name.
+        pb.environment().put("FLEETD_TEST_MULTILINE", "keep\njunk.fragment");
+        pb.redirectError(ProcessBuilder.Redirect.DISCARD);
+        Process zsh = pb.start();
+        zsh.getOutputStream().write(script.getBytes(StandardCharsets.UTF_8));
+        zsh.getOutputStream().flush();
+        zsh.getOutputStream().close();
+        assertTrue(zsh.waitFor(60, java.util.concurrent.TimeUnit.SECONDS),
+                "the scrub script did not exit within 60s");
+        assertEquals(0, zsh.exitValue(), "the scrub script must reach its end");
+
+        EnvAllowListScrub.ScrubReport report = EnvAllowListScrub.readReport(tmp);
+        assertNotNull(report, "the report must still be written");
+        assertTrue(report.blanked().contains("FLEETD_TEST_MULTILINE"),
+                "sanity: the real, identifier-shaped variable must still be blanked normally");
+        assertFalse(report.blanked().contains("junk.fragment"),
+                "a non-identifier fragment is not a real variable and must never be blanked");
+        assertFalse(report.unblankable().contains("junk.fragment"),
+                "a non-identifier fragment must never even become a candidate the blanking loop "
+                        + "attempts — it must be filtered before either guard has to catch it, so "
+                        + "it is neither blanked nor counted as a failed attempt");
+    }
+
     /** A group-shared ZDOTDIR still lets the member truncate and write its pre-created receipt. */
     @Test
     void groupSharedScrubWritesAndReadsItsReport(@TempDir Path tmp) throws Exception {