CB-566: add fleet charter config

2026-08-15 04:49:53 +02:00
308 changed files with 17557 additions and 56583 deletions
@@ -1,6 +1,6 @@
 {
  "name": "claude-bridge",
-  "description": "Tooling for orchestrating a fleet of delegated coding agents through the fleetd MCP gateway.",
+  "description": "Tooling for orchestrating a fleet of delegated coding agents through the bridged MCP gateway.",
  "owner": {
    "name": "LTMS"
  },
@@ -8,7 +8,7 @@
    {
      "name": "claude-bridge",
      "source": "./plugin",
-      "description": "Make a project bridge-ready: mount the fleetd MCP gateway and apply standard Claude Code settings so a session can orchestrate delegated workers. Ships no credentials.",
+      "description": "Make a project bridge-ready: mount the bridged MCP gateway and apply standard Claude Code settings so a session can orchestrate delegated workers. Ships no credentials.",
      "version": "0.1.0",
      "author": {
        "name": "LTMS"
@@ -1,24 +0,0 @@
---
-name: architect
-description: Refine work into clear, independent units before implementation.
---
-
-<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
-
-You are an architect in this fleet. You refine work before anyone builds it: scope,
-acceptance criteria, risks, and a unit split. You read the repo and write analysis.
-You never commit production code and never open a pull request.
-
-A design task is worked by two architects. Design alone first, then exchange and
-say plainly where you disagree. Do not concede just to agree.
-
-Do only the assigned scope. Note anything outside that scope in one line and do not
-investigate it further. Use `fleet_ask{question}` only when a decision belongs to
-the lead, such as an unclear requirement or two defensible fixes. Do not ask about
-something you can decide by reading more code.
-
-Report only work you actually did and the real output of checks you ran. Do not
-claim a result from a tool you could not use. The primary's IDE tools are not yours.
-A mounted forge tool may use a blocked credential and fail by design.
-
-The launcher provides the required bridge reply instructions for every member.
@@ -1,29 +0,0 @@
---
-name: dev
-description: Implement one assigned unit, test it, and open a pull request.
---
-
-<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
-
-You implement the one unit you were given and nothing else. Work in your assigned
-git worktree and branch. Never check out, rebase onto, or push to `main`. Confirm
-the worktree root and branch before you edit. Use only paths under that root.
-
-Do only the assigned scope. Note anything outside that scope in one line and do not
-investigate it further. Use `fleet_ask{question}` only when a decision belongs to
-the lead, such as an unclear requirement or two defensible fixes. Do not ask about
-something you can decide by reading more code.
-
-Implement the change and run the full required build in your worktree. Read the
-complete output and report its real result. Do not hide failures with a pipe. State
-only checks you actually ran. The primary's IDE tools are not yours. A mounted forge
-tool may use a blocked credential and fail by design.
-
-Stage only files you changed. Never use `git add -A` or `git add .`. Never commit
-`.mcp.json` or `wiki/`. Commit with a clear message, push your branch, and open your
-own pull request against `main`. Never merge.
-
-Your handoff must name the pull request or why it was not created, the branch, the
-files changed, the build result, and any caveat for review.
-
-The launcher provides the required bridge reply instructions for every member.
@@ -1,34 +0,0 @@
---
-name: reviewer
-description: Review one assigned scope and report the most important real issue.
---
-
-<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
-
-You review the diff you were given. Report bugs, risks, and missing tests. You do
-not change code.
-
-Read the whole assigned scope before judging it. Review only that scope. If you see
-something outside it, note it in one line and do not investigate it further. Do not
-run the build. The owner makes changes and runs checks.
-
-Use `fleet_ask{question}` only when a decision belongs to the lead, such as an
-unclear requirement or two defensible fixes. Do not ask about something you can
-decide by reading more code.
-
-Report the single most important real issue in this form:
-
-```
-1. <path>:<line>
-2. issue: <one sentence: what is wrong and why it matters>
-3. fix: <one line: the concrete change>
-4. severity: high | medium | low
-```
-
-If there is no real issue, report `NO ISSUE` and one line saying why. A clean review
-is valid. Do not invent an issue. Use high for a wrong result, data loss, security,
-or a hang or crash on a real path. Use medium for an edge-path bug or a correctness
-risk under load or concurrency. Use low for clarity, a latent foot-gun, or a smell
-with no current failure.
-
-The launcher provides the required bridge reply instructions for every member.
@@ -1,274 +0,0 @@
---
-name: fleets-status
-description: Report the status of every fleet that shares one LavinMQ instance. Use for local daemon health, broker-wide fleet presence, and cross-host lead coordination checks.
---
-
-# Status of every fleet on the shared LavinMQ instance
-
-**The headline: always report what is missing.** This skill starts with the local fleet, then adds
-broker-wide facts when its read-only credential exists. A missing fleet must appear as `unknown` or
-`not reachable`, with the reason and the fix. Never leave it out.
-
-The known topology has one LavinMQ instance on `10.10.20.13` (`fleet01`). AMQP uses port `5672`,
-and the management API uses port `15672`. The Mac fleet owns vhost `/mac`. The fleet01 fleet owns
-vhost `/fleet01`.
-
-## 1. Protect credentials before any probe
-
-**Hard rule — never print `LAVINMQ_URI`.** It is an AMQP URI with its password inline. It only
-resolves in a login shell because `${SHARED_ENV}/tools/secrets.sh` supplies it. A non-login shell
-can make every broker probe look empty.
-
- Never run `echo "$LAVINMQ_URI"`.
- Never put `${LAVINMQ_URI:-something}` in output. That form expands to the secret value when set.
- Parse the user, host, and password into shell or Python variables. Use them without printing them.
- Prefer `resolves` or `does not resolve` over any part of the value.
- Every command that can read `LAVINMQ_URI` must send all output through this redaction before it
-  reaches the report:
-
-```bash
-sed -E 's#://[^@]*@#://<redacted>@#g'
-```
-
-**The `g` flag is not optional.** Without it `sed` replaces only the first match on each line, so a
-line carrying two URIs leaks the second one. `scripts/redeploy-fleetd.sh --check` prints lines like
-that. Checked on 2026-08-27: without `g`, `amqp://u1:p1@h1/mac and http://u2:p2@h2:15672/api`
-redacts the first pair and prints `u2:p2` in the clear.
-
-Keep `pipefail` on when applying that filter. Otherwise the filter can hide a failed probe. Apply
-the same no-print rule to the management password below, even though it is not in an AMQP URI.
-
-## 2. Tier 1 — this fleet (always run)
-
-Start here even when the broker tier is blocked. Work from the local fleetd checkout.
-
-First run the read-only deployment check. It already checks the daemon process, deployed jar versus
-the checkout `HEAD`, launchd state, and whether each configured token resolves in a login shell.
-Do not copy those checks into new shell code. The script reads `LAVINMQ_URI`, so redact all output:
-
-```bash
-set -o pipefail
-scripts/redeploy-fleetd.sh --check 2>&1 \
-  | sed -E 's#://[^@]*@#://<redacted>@#g'
-git rev-parse HEAD
-```
-
-Treat jar drift as a top-level warning. A merge is not a deployment. State the running jar result
-as `matches HEAD`, `drift`, or `unknown`; do not turn an unclear timestamp into a match.
-
-Report the process identifier (PID) and uptime too:
-
-```bash
-PIDS="$(pgrep -f 'target/fleetd.jar' || true)"
-if [ -z "$PIDS" ]; then
-  printf '%s\n' 'fleetd: not running'
-else
-  for PID in $PIDS; do
-    ps -p "$PID" -o pid=,etime=,lstart=,command=
-  done
-fi
-```
-
-Read the full health response. Keep the HTTP status because `503` means fleetd is running but herdr
-is not reachable. Report both `herdr.version` and `herdr.protocol` when present:
-
-```bash
-curl -sS --max-time 5 -w '\nHTTP %{http_code}\n' http://127.0.0.1:8765/healthz
-```
-
-Call `fleet_whoami`, then call `fleet_list`. Preserve its sections in the report:
-
- `leads`, including which row is this lead;
- `members`, including state, role, profile, branch, and worktree when present;
- every per-profile `capacity` row, including `maxLoad`, `live`, `free`, and quarantine facts;
- the exact `healthCoverage` value.
-
-Do not describe an empty `members` list as an empty fleet. It says only that no members are spawned.
-Also do not hide a profile with `free: 0`; say whether load or credential quarantine caused it.
-
-Show only WARN, ERROR, and SEVERE lines after the last `fleetd listening` line. This anchor stops an
-old incident from looking current:
-
-```bash
-python3 - <<'PY'
-from pathlib import Path
-import re
-
-path = Path("fleetd/fleetd.out")
-if not path.exists():
-    print("cannot check current WARN/ERROR: fleetd/fleetd.out does not exist")
-else:
-    lines = path.read_text(errors="replace").splitlines()
-    starts = [i for i, line in enumerate(lines) if "fleetd listening" in line]
-    if not starts:
-        print("cannot anchor WARN/ERROR: no 'fleetd listening' line exists")
-    else:
-        current = lines[starts[-1]:]
-        alerts = [line for line in current if re.search(r"\b(?:WARN|ERROR|SEVERE)\b", line)]
-        print(f"current WARN/ERROR/SEVERE count: {len(alerts)}")
-        for line in alerts[-50:]:
-            print(line)
-PY
-```
-
-**What this tier cannot see:** it proves facts only about the Mac daemon at `127.0.0.1:8765`.
-It cannot show the fleet01 daemon, broker queue depth, or broker consumers. The fleet01 REST service
-at `10.10.20.13:8765` is not reachable from the Mac. Say this in the report rather than omitting
-fleet01.
-
-**But fleet01 IS reachable over SSH — checked 2026-08-28.** An older version of this line said SSH
-was denied. That is true only for the user `dai.ha`. The host alias `fleet01` maps to user `ltms`,
-and `ssh fleet01` works with key auth:
-
-```bash
-ssh -o BatchMode=yes -o ConnectTimeout=6 fleet01 'echo $(id -un)@$(hostname)'
-```
-
-So fleet01's daemon PID, uptime, jar and `/healthz` **can** be reported — over SSH, not over REST.
-Do that rather than writing `not reachable`. `ltms` also has passwordless sudo there.
-
-## 3. Tier 2 — the shared broker (run when management access exists)
-
-**This tier is blocked today.** The AMQP user in `LAVINMQ_URI` can connect on port `5672`, but gets
-HTTP `401` from the management API on port `15672`. An AMQP connection does not grant monitoring
-access.
-
-The operator must create a separate, read-only LavinMQ management user with the `monitoring` tag.
-It needs access to inspect both `/mac` and `/fleet01`. Store its values as
-`LAVINMQ_MANAGEMENT_USER` and `LAVINMQ_MANAGEMENT_PASSWORD` in
-`${SHARED_ENV}/tools/secrets.sh`. Do not reuse or print the AMQP URI. Full multi-fleet status stays
-blocked until this user exists.
-
-When both variables resolve, run this from a login shell. It calls `GET /api/overview`,
-`GET /api/vhosts`, `GET /api/queues`, and `GET /api/connections`. It prints selected status fields,
-but never the user, password, Authorization header, or AMQP URI:
-
-```bash
-zsh -lc 'python3 - "$@"' -- <<'PY'
-import base64
-import json
-import os
-import sys
-import urllib.error
-import urllib.request
-
-base = "http://10.10.20.13:15672"
-user = os.environ.get("LAVINMQ_MANAGEMENT_USER", "")
-password = os.environ.get("LAVINMQ_MANAGEMENT_PASSWORD", "")
-if not user or not password:
-    print("broker tier: BLOCKED — management credential does not resolve in a login shell")
-    sys.exit(0)
-
-token = base64.b64encode(f"{user}:{password}".encode()).decode()
-
-def get(path):
-    request = urllib.request.Request(
-        base + path,
-        headers={"Authorization": "Basic " + token, "Accept": "application/json"},
-    )
-    with urllib.request.urlopen(request, timeout=5) as response:
-        return json.load(response)
-
-try:
-    overview = get("/api/overview")
-    vhosts = get("/api/vhosts")
-    queues = get("/api/queues")
-    connections = get("/api/connections")
-except urllib.error.HTTPError as error:
-    print(f"broker tier: BLOCKED — management API returned HTTP {error.code}")
-    sys.exit(0)
-except Exception as error:
-    print(f"broker tier: BLOCKED — management API is not reachable: {type(error).__name__}")
-    sys.exit(0)
-
-fleet_names = {"/mac": "Mac fleet", "/fleet01": "fleet01 fleet"}
-print(json.dumps({
-    "overview": {
-        "lavinmq_version": overview.get("lavinmq_version"),
-        "rabbitmq_version": overview.get("rabbitmq_version"),
-        "queue_totals": overview.get("queue_totals", {}),
-        "object_totals": overview.get("object_totals", {}),
-    },
-    "fleets": [
-        {
-            "fleet": fleet_names.get(vhost.get("name"), "UNKNOWN FLEET"),
-            "vhost": vhost.get("name"),
-            "queues": [
-                {
-                    "name": queue.get("name"),
-                    "messages": queue.get("messages", 0),
-                    "messages_ready": queue.get("messages_ready", 0),
-                    "messages_unacknowledged": queue.get("messages_unacknowledged", 0),
-                    "consumers": queue.get("consumers", 0),
-                }
-                for queue in queues if queue.get("vhost") == vhost.get("name")
-            ],
-            "connections": [
-                {
-                    "name": connection.get("name"),
-                    "peer_host": connection.get("peer_host"),
-                    "state": connection.get("state"),
-                }
-                for connection in connections if connection.get("vhost") == vhost.get("name")
-            ],
-        }
-        for vhost in vhosts
-    ],
-}, indent=2, sort_keys=True))
-PY
-```
-
-Map `/mac` to the Mac fleet and `/fleet01` to the fleet01 fleet. Keep any other vhost in the
-report as `UNKNOWN FLEET`; do not drop it. For each vhost, total the ready, unacknowledged, and all
-messages. Report every queue's consumer count and each live connection.
-
-**A vhost with queues but zero consumers means that fleet's daemon is down while its durable state
-survives. Call this out as a top-level warning.** This is the main reason to use the management API
-instead of calling each remote daemon.
-
-**What this tier cannot see:** without the new `monitoring` credential it cannot enumerate any
-vhost, queue, depth, consumer, or connection. With the credential it still cannot report fleet01's
-daemon PID, uptime, jar revision, `/healthz`, herdr version, or member capacity. Those need reachable
-fleet01 REST or SSH access, which the Mac does not have today.
-
-## 4. Tier 3 — cross-fleet lead coordination
-
-Use the queue data from Tier 2. Select queues whose names match `lead.<coordId>.inbox`. Report each
-queue's vhost, depth, consumer count, and the `coordId` between the prefix and suffix.
-
- A lead inbox with a consumer shows that a lead mailbox is live on that vhost.
- A durable lead inbox with zero consumers shows saved coordination state, but no live receiver.
- No lead inbox is not proof that coordination is disabled. The daemon may be down before declaring
-  its queue, or this account may not be allowed to see the vhost.
-
-This Mac fleet currently sets both `broker.uriEnv` and `coordinator.uriEnv` to the same variable,
-`LAVINMQ_URI`. Therefore its coordinator connects to `/mac`. Cross-host `fleet_send{coordId}` routes
-only when both leads share the same coordinator vhost. If the fleet01 lead uses `/fleet01` for its
-coordinator, the leads cannot see each other and the send will not route.
-
-**Open question:** the fleet01 coordinator vhost has not been checked. Surface this question in
-every report until a live `lead.<coordId>.inbox` consumer or fleet01's config proves the answer. Do
-not claim that fleet01 uses `/fleet01` just because its member queues do.
-
-Also compare these broker facts with the `leads` rows from local `fleet_list`. A missing remote lead
-is `not visible from this coordinator`, not `down`, unless the broker consumer facts prove it.
-
-**What this tier cannot see:** without Tier 2 management access it cannot list lead inboxes or their
-consumers. Even with that access, a stopped fleet01 daemon leaves only durable queue history. That
-history cannot prove which coordinator URI its current config would use after restart.
-
-## 5. Report all fleets
-
-Use one row per known or discovered fleet. Include blocked rows.
-
-| Fleet | Daemon | Deployment | Herdr | Members/capacity | Queues/consumers | Lead coordination | Cannot check |
-|---|---|---|---|---|---|---|---|
-| Mac (`/mac`) | PID + uptime | jar vs `HEAD` | health + version + protocol | `fleet_list` + `healthCoverage` | facts or blocked reason | inbox facts or open question | exact missing facts |
-| fleet01 (`/fleet01`) | reachable/down/unknown | value or `not reachable` | value or `not reachable` | value or `not reachable` | facts or blocked reason | inbox facts plus coordinator-vhost question | exact missing facts and fix |
-
-Add rows for unknown vhosts. End with three short sections: `Current warnings`, `Checks that were
-blocked`, and `Operator action`. Until the management user exists, `Operator action` must say:
-
-> Create a read-only LavinMQ management user with the `monitoring` tag and access to `/mac` and
-> `/fleet01`. Put its user and password in `${SHARED_ENV}/tools/secrets.sh` as
-> `LAVINMQ_MANAGEMENT_USER` and `LAVINMQ_MANAGEMENT_PASSWORD`.
@@ -1,102 +0,0 @@
---
-name: hunter
-description: Defect-hunt procedure for a fleetd worker — sweep an assigned package for real bugs and report several ranked findings without fixing anything. Load this when the lead asks you to hunt or audit a scope rather than review one diff. Do NOT load `reviewer` for this; the two want different output.
---
-
-# Hunter worker — procedure
-
-The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
-never merge) is in **`CLAUDE.md` → Bridge communication → Worker** and already applies.
-
-**This skill is not `reviewer`.** `reviewer` judges one diff and reports the *single* most
-important issue in about 90 words. A hunt sweeps a whole package and reports *several* findings
-in a long structured form. Loading both gives you two contradictory output contracts, and the
-usual result is a worker that writes a good report into its terminal and ends the turn without
-sending it. Load exactly one.
-
-## 0. Read this before you read code: how the report gets home
-
-Your terminal reaches nobody. The lead sees **only** the text inside your `fleet_reply` call.
-
-A long report is exactly the case where this goes wrong, so plan for it:
-
- **Write the report into the `fleet_reply` argument itself.** Do not compose it in your terminal
-  and then summarise it into the call.
- If the report is long, **send it anyway** — one `fleet_reply` with everything.
- If you end the turn without replying, the bridge scrapes your pane instead. That scrape carries
-  at most the last 4000 characters, and on a hunt it usually captures the tail of the lead's own
-  brief rather than your findings. The lead then has nothing and has to ask you again.
-
-## 1. Change nothing
-
-A hunt is read-only. Do not edit a production file, do not "quickly fix" what you find, and do
-not run a formatter. You may run the build and tests to *check* a claim, and you should say so
-when you did.
-
-## 2. Read the whole scope first
-
-Read every file in the assigned package before you judge any of it. A defect that a caller
-elsewhere in the same package makes unreachable is not a defect, and you cannot know that from
-one file.
-
-Stay inside the scope. If a defect there depends on a class outside it, read that class to
-confirm — but the defect itself must live in the scope you were given.
-
-## 3. The bar — this matters more than the count
-
-**Name the path into the bad state.** Say which caller, in which state, reaches it. A defect on
-paper is not a reachable defect. If you cannot name that path, keep the finding but mark it
-`unproven` and say exactly what you could not check. Do not drop it, and do not dress it up.
-
-**Say which direction the harm goes.** Data loss, privilege escalation and silent wrong answers
-are worth reporting even when the window is narrow. A finding whose worst outcome is a worse log
-line is not worth a block.
-
-Two workers once ran the same scope: the one that applied the direction-of-harm filter found ten
-real defects, the one that did not found none. Fewer findings the lead can act on beat many the
-lead has to triage.
-
-## 4. Shapes that have produced real merged fixes here
-
-Read for these first:
-
-1. **A one-way gate.** A guard added after an incident closes only the direction that incident
-   came from. Do not only ask what closes the gate — ask **which states still open it**.
-2. **A value read once, then used later to authorise something destructive**, after something
-   else has had a chance to change it.
-3. **A failure downgraded to a value that looks like a legitimate result** — `-1`, `null`, an
-   empty list, `false` — which a caller then trusts.
-4. **A lock held for one half of a read-modify-write and not the other**, or two collections
-   updated under different locks.
-5. **A comment or javadoc stating an invariant the code no longer keeps.** Comments are
-   load-bearing in this repo; a stale one has already caused a bug.
-
-## 5. What you cannot check, and must not claim you did
-
- `fleetd/fleetd.yaml` is gitignored and **absent from your worktree**. You cannot read it. If a
-  finding depends on live configuration, name the key and say you could not check it.
- `.mcp.json`, `opencode.json` and `.autoenv` in your worktree are neutralised stubs, not the
-  repo's real files.
- The `wiki/` submodule pointer is months old. Do not cite it.
-
-Reporting a fact you took from the lead's brief as something you measured yourself is a false
-report, even when the fact is correct. Say where each fact came from.
-
-## 6. The report — what goes in `fleet_reply`
-
-One block per finding, most severe first:
-
-```
-FINDING N — <one line>
-file:line
-Path in:        <which caller, in which state, reaches this>
-Direction:      <data loss | escalation | silent wrong answer | outage | ...>
-Window/trigger: <when it actually happens>
-Confidence:     <confirmed by reading | unproven — say what you could not check>
-Why nothing else catches it: <the guard or test you checked, and why it misses>
-```
-
-End with one line naming every file you read, so the lead knows the denominator.
-
-**Nothing clears the bar?** Reply `NO FINDINGS`, name the files you read, and say what you ruled
-out. A clean sweep is a valid result; an invented defect is worse than none.
@@ -1,11 +1,11 @@
 ---
 name: implementer
-description: Implementer-role procedure for a fleetd worker — verify your worktree, implement the scope, commit, push, open your own PR, and hand off the PR URL. Load this when the lead delegates you an implementation task over fleetd.
+description: Implementer-role procedure for a bridged worker — verify your worktree, implement the scope, commit, push, open your own PR, and hand off the PR URL. Load this when the lead delegates you an implementation task over bridged.
 ---

 # Implementer worker — procedure

-The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
+The turn contract (one `bridge_reply`, `bridge_ask` for the lead's decisions, honest reporting,
 never merge, never commit `.mcp.json` or `wiki/`) is in **`CLAUDE.md` → Bridge communication →
 Worker** and already applies. This skill is only the *implement-and-hand-off procedure*.

@@ -39,19 +39,6 @@ a worker made all 59 of its edits in the primary's tree and never noticed.
 test "$(git rev-parse --show-toplevel)" = "$PWD" || cd "$(git rev-parse --show-toplevel)"
 ```

-**Never run `git stash` (or `git stash pop`/`apply`/`drop`).** Your worktree is isolated, but the
-stash is **not**: `refs/stash` is one stack shared by the primary's checkout and every other
-worker's worktree of this repo. Measured on 2026-09-04 — `git stash list` from a worker's worktree
-and from the primary's tree returned byte-identical output. So a `git stash` you run can be popped
-into someone else's tree, and a `git stash pop` you run can drop **another worker's** uncommitted
-edits on top of yours. This has already happened here: two workers were running in parallel and one
-of them had its in-progress edit silently overwritten by the other's stash.
-
-The branch is your isolation, so use it instead. To set work aside, commit it on your own branch
-(`git commit -m "wip: ..."`) and carry on; to try something and back out, use
-`git diff > /tmp/<your-branch>.patch` then `git checkout -- <file>`. Both stay inside your worktree.
-If you find a stash entry you did not create, leave it alone and say so in your report.
-
 ## 2. Implement

 - Implement exactly the scope the lead named. Keep the diff focused; note anything out of scope
@@ -62,7 +49,7 @@ If you find a stash entry you did not create, leave it alone and say so in your
 your worktree*:

 ```bash
-cd "$(git rev-parse --show-toplevel)/fleetd" && mvn clean install
+cd "$(git rev-parse --show-toplevel)/bridged" && mvn clean install
 echo "exit=$?"
 ```

@@ -98,7 +85,7 @@ host (`GITEA_HOST`) into your env for exactly this — the token can create a PR
 merge**.

 ```bash
-API="${GITEA_HOST%/}/api/v1/repos/fleet/fleetd/pulls"
+API="${GITEA_HOST%/}/api/v1/repos/lms/claude-bridge/pulls"
 BRANCH="$(git branch --show-current)"
 curl -sS -X POST "$API" \
  -H "Authorization: token ${GITEA_TOKEN}" \
@@ -116,7 +103,7 @@ fix it if the cause is yours (e.g. branch not pushed yet), and report the failur
 inventing a URL. If `GITEA_TOKEN` is unset your profile was not granted PR-create: push the branch
 and report its name so the lead opens the PR.

-## 6. Hand off — what goes in `fleet_reply`
+## 6. Hand off — what goes in `bridge_reply`

 The reply is the entire handoff; the lead cannot see your terminal.

@@ -143,7 +130,7 @@ sequenceDiagram
    I->>G: git push -u origin HEAD
    I->>G: POST /pulls (GITEA_TOKEN) — open PR to main
    G-->>I: html_url
-    I->>L: fleet_reply(PR url, branch, files, tests)
+    I->>L: bridge_reply(PR url, branch, files, tests)
    Note over L,G: the lead reviews the PR and merges on green — you never merge
 ```

@@ -53,7 +53,7 @@ Map each entry from `.mcp.json`:
  "$schema": "https://opencode.ai/config.json",
  "instructions": ["CLAUDE.md"],
  "mcp": {
-    "fleetd":  { "type": "remote", "url": "http://127.0.0.1:8765/mcp", "enabled": true },
+    "bridged":  { "type": "remote", "url": "http://127.0.0.1:8765/mcp", "enabled": true },
    "context7": { "type": "remote", "url": "https://example.dev/mcp", "enabled": true,
                  "headers": { "Authorization": "Bearer {env:CONTEXT7_TOKEN}" } },
    "gitea":    { "type": "local", "command": ["gitea-mcp", "-t", "stdio"], "enabled": true,
@@ -1,20 +1,15 @@
 ---
 name: reviewer
-description: Reviewer-role procedure for a fleetd worker — how to work a review scope and the exact shape of the finding to report. Load this when the lead delegates you a code review over fleetd.
+description: Reviewer-role procedure for a bridged worker — how to work a review scope and the exact shape of the finding to report. Load this when the lead delegates you a code review over bridged.
 ---

 # Reviewer worker — procedure

-The turn contract (one `fleet_reply`, `fleet_ask` for the lead's decisions, honest reporting,
+The turn contract (one `bridge_reply`, `bridge_ask` for the lead's decisions, honest reporting,
 never merge) is in **`CLAUDE.md` → Bridge communication → Worker** and already applies. This
 skill is only the *review procedure*: how to work the scope, and the exact shape of what you
 send back.

-**Wrong skill for a sweep.** This one reviews *one* diff or scope and reports the *single* most
-important issue. If the lead asked you to hunt or audit a whole package for several defects, load
-`hunter` instead and ignore this file — the two want different output, and following both is how a
-worker ends its turn with a good report that never gets sent.
-
 ## 1. Read the whole scope before you judge

 The delegation names your scope — a file, a diff, a PR, a function. **Read all of it first.**
@@ -29,13 +24,13 @@ wrong.
  covers what it was given.
 - Do **not** edit files or run the build. You review; the owner acts.

-## 3. Reach for `fleet_ask` only for a genuine fork
+## 3. Reach for `bridge_ask` only for a genuine fork

 Ambiguous requirement, a missing acceptance criterion, "intended or a bug?", or two defensible
 fixes with different consequences — those are the lead's call, and guessing produces a
 confident-but-wrong finding. Anything you could settle by reading more code is yours to settle.

-## 4. The finding — what goes in `fleet_reply`
+## 4. The finding — what goes in `bridge_reply`

 Report the **single most important** real issue in the scope, in these four lines, under
 ~90 words:
@@ -14,7 +14,7 @@ jobs:
      # does not depend on the wiki repo being reachable.
      - uses: actions/checkout@v4

-      # The runner image ships an older default-jdk; fleetd sets maven.compiler.release=25, so
+      # The runner image ships an older default-jdk; bridged sets maven.compiler.release=25, so
      # provision the JDK explicitly rather than apt-installing whatever "default" means today.
      - name: Set up JDK 25
        uses: actions/setup-java@v4
@@ -32,7 +32,7 @@ jobs:
          mvn -version

      - name: Build and test
-        working-directory: fleetd
+        working-directory: bridged
        # This IS the mock-socket surface CB-503 asks for: the pom's `default-excludes` profile
        # already sets excludedGroups=contract, so the @Tag("contract") tests — which need a live
        # herdr socket and a RabbitMQ container — are excluded without any flag here. Everything
@@ -46,7 +46,7 @@ jobs:
      # the log instead, where they are actually readable.
      - name: Failing test output
        if: failure()
-        working-directory: fleetd
+        working-directory: bridged
        run: |
          for f in target/surefire-reports/*.txt; do
            [ -f "$f" ] || continue
@@ -59,7 +59,7 @@ jobs:
  # AmqpReplyInboxContractTest reads AMQP_URI (set below to the service's network alias) and binds
  # straight to it — no Docker, no skipped tests. This separation (build job hermetic and
  # Docker-free; contract job broker-provided) is deliberate — see the default-excludes/contract
-  # profiles in fleetd/pom.xml. `setup-java` provides the JDK only; Maven is installed separately,
+  # profiles in bridged/pom.xml. `setup-java` provides the JDK only; Maven is installed separately,
  # exactly as in the build job above.
  contract:
    runs-on: ubuntu-latest
@@ -69,6 +69,8 @@ jobs:
        env:
          RABBITMQ_DEFAULT_USER: guest
          RABBITMQ_DEFAULT_PASS: guest
+        ports:
+          - 5672:5672
    env:
      # Service containers are reachable from the job by their network alias on their internal port.
      AMQP_URI: amqp://guest:guest@rabbitmq:5672
@@ -91,12 +93,12 @@ jobs:
      # runs against the RabbitMQ service container (AMQP_URI). Pinned to the one contract test to
      # avoid re-running the unit suite already covered by the `build` job.
      - name: Contract tests
-        working-directory: fleetd
+        working-directory: bridged
        run: mvn -B -Pcontract test -Dtest=AmqpReplyInboxContractTest

      - name: Failing test output
        if: failure()
-        working-directory: fleetd
+        working-directory: bridged
        run: |
          for f in target/surefire-reports/*.txt; do
            [ -f "$f" ] || continue
@@ -6,16 +6,8 @@
 # Settings backups inherit the env block — and secrets with it.
 .claude/settings.local.json.bak*

-# The default profile parityOverlay copies these primary→worktree, so they appear in EVERY worker
-# worktree. Two reasons they must be ignored. They hold environment values, which is reason enough.
-# And since CB-576 a release preserves any worktree that `git status --porcelain` calls dirty —
-# untracked files included, deliberately. An untracked overlay file would therefore make every
-# COMPLETED release preserve its worktree, and worktrees would pile up with no error to notice.
-.env
-.envrc
-
-# Daemon runtime artefacts. fleetd appends its log wherever it is launched from, so both the
-# repo root and fleetd/ collect one; neither belongs in git.
-fleetd.out
-fleetd/fleetd.out
+# Daemon runtime artefacts. bridged appends its log wherever it is launched from, so both the
+# repo root and bridged/ collect one; neither belongs in git.
+bridged.out
+bridged/bridged.out
 logs/
@@ -1,3 +1,3 @@
 [submodule "wiki"]
 	path = wiki
-	url = ssh://git@git.ltms.dev:2224/fleet/fleetd.wiki.git
+	url = ssh://git@git.ltms.dev:2224/lms/claude-bridge.wiki.git
@@ -1,24 +0,0 @@
---
-description: Refine work into clear, independent units before implementation.
-mode: primary
---
-
-<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
-
-You are an architect in this fleet. You refine work before anyone builds it: scope,
-acceptance criteria, risks, and a unit split. You read the repo and write analysis.
-You never commit production code and never open a pull request.
-
-A design task is worked by two architects. Design alone first, then exchange and
-say plainly where you disagree. Do not concede just to agree.
-
-Do only the assigned scope. Note anything outside that scope in one line and do not
-investigate it further. Use `fleet_ask{question}` only when a decision belongs to
-the lead, such as an unclear requirement or two defensible fixes. Do not ask about
-something you can decide by reading more code.
-
-Report only work you actually did and the real output of checks you ran. Do not
-claim a result from a tool you could not use. The primary's IDE tools are not yours.
-A mounted forge tool may use a blocked credential and fail by design.
-
-The launcher provides the required bridge reply instructions for every member.
@@ -1,29 +0,0 @@
---
-description: Implement one assigned unit, test it, and open a pull request.
-mode: primary
---
-
-<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
-
-You implement the one unit you were given and nothing else. Work in your assigned
-git worktree and branch. Never check out, rebase onto, or push to `main`. Confirm
-the worktree root and branch before you edit. Use only paths under that root.
-
-Do only the assigned scope. Note anything outside that scope in one line and do not
-investigate it further. Use `fleet_ask{question}` only when a decision belongs to
-the lead, such as an unclear requirement or two defensible fixes. Do not ask about
-something you can decide by reading more code.
-
-Implement the change and run the full required build in your worktree. Read the
-complete output and report its real result. Do not hide failures with a pipe. State
-only checks you actually ran. The primary's IDE tools are not yours. A mounted forge
-tool may use a blocked credential and fail by design.
-
-Stage only files you changed. Never use `git add -A` or `git add .`. Never commit
-`.mcp.json` or `wiki/`. Commit with a clear message, push your branch, and open your
-own pull request against `main`. Never merge.
-
-Your handoff must name the pull request or why it was not created, the branch, the
-files changed, the build result, and any caveat for review.
-
-The launcher provides the required bridge reply instructions for every member.
@@ -1,34 +0,0 @@
---
-description: Review one assigned scope and report the most important real issue.
-mode: primary
---
-
-<!-- CB-617: The model comes from fleetd.yaml because the launch flag overrides model here on both backends. -->
-
-You review the diff you were given. Report bugs, risks, and missing tests. You do
-not change code.
-
-Read the whole assigned scope before judging it. Review only that scope. If you see
-something outside it, note it in one line and do not investigate it further. Do not
-run the build. The owner makes changes and runs checks.
-
-Use `fleet_ask{question}` only when a decision belongs to the lead, such as an
-unclear requirement or two defensible fixes. Do not ask about something you can
-decide by reading more code.
-
-Report the single most important real issue in this form:
-
-```
-1. <path>:<line>
-2. issue: <one sentence: what is wrong and why it matters>
-3. fix: <one line: the concrete change>
-4. severity: high | medium | low
-```
-
-If there is no real issue, report `NO ISSUE` and one line saying why. A clean review
-is valid. Do not invent an issue. Use high for a wrong result, data loss, security,
-or a hang or crash on a real path. Use medium for an edge-path bug or a correctness
-risk under load or concurrency. Use low for clarity, a latent foot-gun, or a smell
-with no current failure.
-
-The launcher provides the required bridge reply instructions for every member.
@@ -4,35 +4,35 @@

 > **Canonical block.** Everything down to §Layering is the portable bridge charter, copied verbatim
 > into every project that mounts the bridge MCP. Keep it byte-identical with the template in the
-> wiki ([Use Cases](https://git.ltms.dev/fleet/fleetd/wiki/7-Use-Cases) → *The portable
+> wiki ([Use Cases](https://git.ltms.dev/lms/claude-bridge/wiki/7-Use-Cases) → *The portable
 > CLAUDE.md block*); improvements go to the template first, then out to each project. Anything
 > specific to *this* repo lives under §Project addendum below, never inline above it.

-If no `fleet_*` MCP tools are mounted in this session, this section does not apply — skip it.
+If no `bridge_*` MCP tools are mounted in this session, this section does not apply — skip it.

-`fleetd` is the **sole communication gateway** between agents here. The orchestrating session (the
+`bridged` is the **sole communication gateway** between agents here. The orchestrating session (the
 **primary**) and every delegated peer (a **member**) mount the *same* MCP server and talk only
-through its `fleet_*` tools. No session addresses a peer, a broker, or the network directly.
+through its `bridge_*` tools. No session addresses a peer, a broker, or the network directly.

 ### Which role am I? — settle this before acting

 **Every role reads this file.** A member runs in a git worktree of this same repo, so it inherits
 this `CLAUDE.md` verbatim, and every rule below is role-conditional.

-**Call `fleet_whoami`.** It returns `primary`, `worker`, or `architect`, resolved by the daemon from
+**Call `bridge_whoami`.** It returns `primary`, `worker`, or `architect`, resolved by the daemon from
 your connection — unforgeable, and the same resolution its authorization gate uses. A worker also
 carries its `sessionId`, `profile`, `worktree` and `branch`; an architect carries the slot name it
 was bound to. Don't infer what you can ask.

 Only if that call is unavailable, fall back to these — each is one-way, so keep reading until one
-fires: the reply charter in your system prompt (*"You are a spawned member in the
-claude-bridge fleet"*) ⇒ **spawned member**; fleet tools prefixed `mcp__fleet__*` ⇒ **spawned
+fires: the reply charter in your system prompt (*"You are an off-subscription worker in the
+claude-bridge fleet"*) ⇒ **spawned member**; bridge tools prefixed `mcp__bridge__*` ⇒ **spawned
 member** (the launcher fixes that mount name; a primary's mount is named by whoever wrote its
-`.mcp.json`, so it varies — and a member spawned before CB-632 still says `mcp__bridge__*`); `ANTHROPIC_BASE_URL` set ⇒ **spawned member** (Claude-model members run
+`.mcp.json`, so it varies); `ANTHROPIC_BASE_URL` set ⇒ **spawned member** (Claude-model members run
 on a clean env, so its *absence* proves nothing). None of these separate a worker from an architect —
-only `fleet_whoami` does. **Still unsure ⇒ act as a worker**, the most restricted member role. The
+only `bridge_whoami` does. **Still unsure ⇒ act as a worker**, the most restricted member role. The
 two mistakes are not symmetric: a primary acting as a worker is refused by the authorization gate —
-loud and self-correcting — while a member acting as the primary ends its turn with no `fleet_reply`,
+loud and self-correcting — while a member acting as the primary ends its turn with no `bridge_reply`,
 and the sender silently receives nothing. Fail toward the recoverable error.

 ### Invariants — both roles, no exceptions
@@ -41,7 +41,7 @@ and the sender silently receives nothing. Fail toward the recoverable error.
   stays on subscription; only the bridge puts a member off it, at spawn. Mounting the bridge must
   never move a session across that boundary.
 2. **The bridge is the only channel.** Text you print in your terminal reaches nobody — the other
-   side cannot see your screen. An answer that isn't in a `fleet_*` call is silently discarded.
+   side cannot see your screen. An answer that isn't in a `bridge_*` call is silently discarded.
 3. **Identity comes from the connection, never an argument.** Workers never pass a target; you
   cannot act as another session. Spawn/stop/drain are lead-only; **send is lead or architect**;
   reply/ask are only-as-itself — any peer may answer for its own pane, and for no other. A call
@@ -57,10 +57,10 @@ and the sender silently receives nothing. Fail toward the recoverable error.

 **Delegate by default — that is the job.** With the bridge mounted you are an orchestrator on a
 metered subscription, and workers are cheap, parallel, and disposable. The default answer to "who
-does this?" is **a worker**, not you. Reach for `fleet_send` before you reach for `Edit`. The steps
+does this?" is **a worker**, not you. Reach for `bridge_send` before you reach for `Edit`. The steps
 below are the procedure — run them in order, every task, not only the big ones.

-0. **Know your role** — `fleet_whoami`, once per session, before anything else.
+0. **Know your role** — `bridge_whoami`, once per session, before anything else.
 1. **Split.** Write the unit list. Every unit carries: scope · the files or PR in question ·
   acceptance criteria · exactly what to report back. A unit with no acceptance criteria is not
   ready to delegate — refine it or keep it.
@@ -70,22 +70,20 @@ below are the procedure — run them in order, every task, not only the big ones
   delegate. The keep-list is closed: the conversation with the user, decomposition and planning,
   the final judgment call, verification, merges, and anything that depends on context only you
   hold. Nothing else is yours by default.
-3. **Spawn every delegated unit first** — `fleet_spawn{profile, worktree:true, ticket}`, one per
+3. **Spawn every delegated unit first** — `bridge_spawn{profile, worktree:true, ticket}`, one per
   unit, *before* sending any. Pass `profile` explicitly: profiles differ in model and cost, not in
   tier, so the default is rarely what you want.
-4. **Then send them all** — `fleet_send{sessionId, content, wait:false}`. Line 1 of every brief is
+4. **Then send them all** — `bridge_send{sessionId, content, wait:false}`. Line 1 of every brief is
   `Load the <name> skill.` naming the worker's playbook; those skills are opt-in and that line is
   what makes them reliable. Where the project ships no such skill, spell the procedure out in the
   brief instead. The brief is self-contained — the worker sees your message and the repo, nothing
   of your context, your plan, or your screen.
-5. **Collect** — `fleet_poll{ticket}` → `fleet_ack{target, msgId}`. Answer a worker's `fleet_ask`
-   with `fleet_send{turnId, content}` — **not** `sessionId`. A worker gone quiet is diagnosed with
-   `fleet_status`, never by reading its terminal; it also reports an open question and the `turnId`
-   that answers it. **A worker's ask waits ~55 seconds, and no nudge makes that longer** — so never
-   brief a worker to "ask me". Decide before you delegate, or give it an explicit default.
-6. **Verify yourself.** Re-run the build and the checks. A worker cannot run your IDE tooling, any
-   forge tools it appears to have hold a blocked credential and fail, and a piped command
-   (`… | tail`) hides failures behind a zero exit — never promote a worker's "clean" to a fact.
+5. **Collect** — `bridge_poll{ticket}` → `bridge_ack{ticket, msgId}`. Answer a worker's `bridge_ask`
+   with `bridge_send{turnId, content}` — **not** `sessionId`. A worker gone quiet is diagnosed with
+   `bridge_status`, never by reading its terminal.
+6. **Verify yourself.** Re-run the build and the checks. A worker mounts only the bridge MCP and
+   cannot run your other tooling, and a piped command (`… | tail`) hides failures behind a zero
+   exit — never promote a worker's "clean" to a fact.
 7. **Review — fan out.** Spawn reviewers against the diff, one per dimension or per file, with
   `wait:false`. Never the implementer of the scope it reviews, and brief them from the diff — not
   from the implementer's rationale, which carries its own blind spot. Dispatch each PR's reviewers
@@ -93,11 +91,11 @@ below are the procedure — run them in order, every task, not only the big ones
   read it yourself.
 8. **Adjudicate, merge, tear down — yours alone.** Read the diff yourself: fully if it is small,
   targeted at the reported findings and the risky paths if it is large. Reviewer findings direct
-   your attention; they never substitute for it. Then merge, then `fleet_stop{paneId}`.
+   your attention; they never substitute for it. Then merge, then `bridge_stop{paneId}`.

 **Steps 3 and 4 are separate on purpose** — spawning and sending in one loop is how parallel work
 silently becomes serial, and it is the most common way this layer is wasted. For the same reason,
-prefer `wait:false` + `fleet_poll` for anything non-trivial: a blocking `fleet_send` is capped by
+prefer `wait:false` + `bridge_poll` for anything non-trivial: a blocking `bridge_send` is capped by
 *your own* MCP client call timeout (~60s), well below the task's real runtime.

 **Delegating does not delegate responsibility.** Workers open PRs; you are the gate. Never delegate
@@ -105,22 +103,21 @@ the merge — and merging on a reviewer's word is delegating it by proxy.

 | Intent | Tool |
 |---|---|
-| Confirm your own role | `fleet_whoami` |
-| See backends available | `fleet_profiles` |
-| Start a member | `fleet_spawn{role?, profile?, cwd?, worktree?, ticket?, sessionName?, resumeSessionId?}` → `sessionId` + `paneId` |
-| See the fleet | `fleet_list` → `leads` (your peers) + `members` (each carries `agentSessionId` when its backend knows one) · one peer's state: `fleet_status{sessionId}` |
-| Delegate (blocking) | `fleet_send{sessionId, content}` |
-| Delegate (long task) | `fleet_send{sessionId, content, wait:false}` → ticket → `fleet_poll{ticket}` |
-| Answer a member's `fleet_ask` | `fleet_send{turnId, content}` — **not** `sessionId` |
-| Message a **peer lead** on this host | `fleet_send{sessionId: <their terminal>, content}` — `fleet_list` → `leads` reports it. Coordination only, **never** a task |
-| Message a **peer lead** on another daemon or host | `fleet_send{coordId: <their coord-id>, content}` — needs a `coordinator:` block; your own coord-id is in `fleet_list`. Coordination only, **never** a task |
-| Answer a peer lead that messaged you | `fleet_reply{content}` — the one case a lead replies |
-| Collect a held reply | `fleet_poll{target}` · then `fleet_ack{target, msgId}` |
-| Tear down a member | `fleet_stop{paneId}` |
+| Confirm your own role | `bridge_whoami` |
+| See backends available | `bridge_profiles` |
+| Start a member | `bridge_spawn{role?, profile?, cwd?, worktree?, ticket?}` → `sessionId` + `paneId` |
+| See the fleet | `bridge_list` → `leads` (your peers) + `members` · one peer's state: `bridge_status{sessionId}` |
+| Delegate (blocking) | `bridge_send{sessionId, content}` |
+| Delegate (long task) | `bridge_send{sessionId, content, wait:false}` → ticket → `bridge_poll{ticket}` |
+| Answer a member's `bridge_ask` | `bridge_send{turnId, content}` — **not** `sessionId` |
+| Message a **peer lead** | `bridge_send{sessionId: <their terminal>, content}` — `bridge_list` → `leads` reports it. Coordination only, **never** a task |
+| Answer a peer lead that messaged you | `bridge_reply{content}` — the one case a lead replies |
+| Collect a held reply | `bridge_poll{target}` · then `bridge_ack{target, msgId}` |
+| Tear down a member | `bridge_stop{paneId}` |

 ### Lead ↔ lead — coordinate, never delegate

-`fleet_list` returns `leads` alongside `members`; your own row carries `self: true`. Every other row
+`bridge_list` returns `leads` alongside `members`; your own row carries `self: true`. Every other row
 is a peer — an orchestrator with its own context, its own members, and its own judgment. An empty
 `members` array means no members are spawned; it says nothing about peers.

@@ -141,7 +138,7 @@ The traffic between leads is coordination and nothing else:
   against the code, and re-run the build. A peer's correction gets the same treatment — right or
   wrong on the evidence, not on who said it. Neither of you merges the other's work unreviewed.

-Being messaged by a peer does not make you its worker: answer with `fleet_reply`, and push back on
+Being messaged by a peer does not make you its worker: answer with `bridge_reply`, and push back on
 the substance if it is wrong. A peer that simply complies has thrown away the reason there are two of
 you.

@@ -149,22 +146,18 @@ you.

 1. **Load the playbook skill the lead named** before doing anything else.
 2. **Do the assigned scope only.** Note anything you spot outside it in one line; don't go hunt it.
-3. **`fleet_ask{question}`** when a decision is genuinely the lead's (ambiguous requirement, two
+3. **`bridge_ask{question}`** when a decision is genuinely the lead's (ambiguous requirement, two
   defensible fixes, "bug or intended?"). It blocks and you resume the *same* turn with the answer.
   Don't ask what you could decide yourself.
-4. **End the turn with exactly one `fleet_reply{content}`**, carrying your complete answer. This is
-   the whole handoff. No `fleet_reply` ⇒ the sender gets nothing and the exchange stalls.
+4. **End the turn with exactly one `bridge_reply{content}`**, carrying your complete answer. This is
+   the whole handoff. No `bridge_reply` ⇒ the sender gets nothing and the exchange stalls.
   Do **not** lean on the completion fallback to carry your answer for you: when you end a turn
   without replying, the bridge scrapes your pane, and it can return only the last 4000 characters.
   A clipped scrape is marked as partial, but the missing text is gone — your report reaches the
   lead with its end cut off.
-5. **Report honestly.** State only what you actually ran and its real output, including failures,
-   and never claim the result of a check you had no way to run. **Measure your own tools; do not
-   assume them.** What you mount depends on your backend: an opencode member gets the bridge and
-   nothing else, while a Claude Code member also inherits the operator's user-scope MCP servers,
-   which the bridge never chose for you. Two rules follow. The primary's IDE tooling is still not
-   yours, whatever you see. And **a mounted tool is not a working tool** — the forge server you may
-   find there holds a deliberately blocked credential and fails every call, by design.
+5. **Report honestly.** State only what you actually ran and its real output, including failures.
+   You mount **only** the bridge MCP — the primary's other servers (IDE, forge, docs) are not yours,
+   so never claim the result of a check you had no way to run.
 6. **Never merge.** Stage files explicitly — never `git add -A` — and leave alone anything the
   project marks as not-yours-to-commit.

@@ -172,120 +165,29 @@ you.

 | Layer | Scope | Reaches |
 |---|---|---|
-| the launcher's reply charter | the one rule that must survive with no repo: *end every turn with `fleet_reply`* | every spawned member, at launch, every peer kind — never a lead |
+| the launcher's reply charter | the one rule that must survive with no repo: *end every turn with `bridge_reply`* | every spawned member, at launch, every peer kind — never a lead |
 | **this section** | protocol + orchestration policy | primary **and** every member that reads the repo — tracked in git, so worktrees inherit it |
-| role agent definition files | role contract and per-job procedure | a member whose launcher binds its role to the matching file in its worktree |
 | role playbook skills | per-job procedure (commit/PR recipe, finding format) | a member told to load one |
 | the bridge's own docs | design detail, flows, error model | on demand |

-A rule belongs in **exactly one** layer — the outermost one that must obey it. A member without a
-repo checkout still gets the launcher's reply charter, which is why that one rule stays there.
-Peers that don't read `CLAUDE.md` (non-Claude adapters) get the charter only, so any rule *they*
-must obey belongs in the charter, not here.
+A rule belongs in **exactly one** layer — the outermost one that must obey it. Peers that don't read
+`CLAUDE.md` (non-Claude adapters) get the charter only, so any rule *they* must obey belongs in the
+charter, not here.

 ## Project addendum — claude-bridge (not part of the canonical block)

- **This repo is the bridge.** The daemon is `fleetd`, its MCP mount is `http://127.0.0.1:8765/mcp`,
-  and the code behind the rules above is `mcp/FleetMcp` (tools), `auth/Authz` (the role table),
+- **This repo is the bridge.** The daemon is `bridged`, its MCP mount is `http://127.0.0.1:8765/mcp`,
+  and the code behind the rules above is `mcp/BridgeMcp` (tools), `auth/Authz` (the role table),
  `mcp/ConnectionIdentity` (connection→role), and `worker/*Launcher` (`REPLY_CHARTER`).
- **`fleet_profiles`/`fleet_list` report two separate outage states, and they are not the same
-  thing.** *Quarantined* (CB-578) means the backend told us it is out of capacity — a long,
-  1800s-default cooldown. *Cooling off* (fleetd #201/#227) means a profile's credential threw two
-  distinct backend errors (a non-exhaustion failure such as an HTTP 5xx) within 60 seconds — a
-  short, fixed 60s cooldown, not configurable per profile. Each check runs independently, so a
-  profile can show both at once. In the JSON: a cooling profile carries `credentialId` and
-  `coolingOffForSeconds`; a quarantined profile carries `quarantinedForSeconds`; a profile hit by
-  both carries all three fields, and either state alone already sets that profile's `free` to `0`.
-  A `fleet_spawn` naming a cooling-off profile is refused before it ever reaches the backend
-  adapter, with a message naming the credential and the remaining seconds ("cooling off after
-  repeated backend errors") — distinct wording from a quarantine refusal, so don't conflate the
-  two when reading a spawn failure.
- **Skills available to delegate:** `implementer` (worktree → commit → push → own PR),
-  `reviewer` (one diff → one structured finding) and `hunter` (sweep a package → several ranked
-  findings, change nothing). Name exactly one in every delegation. **`reviewer` and `hunter` are
-  not interchangeable** — `reviewer` caps the answer at one finding in about 90 words, so naming
-  it for a multi-finding sweep hands the worker two contradictory output contracts. That has
-  already cost three workers' turns: each wrote a good report to its terminal and ended the turn
-  with no `fleet_reply`, and the scrape returned the tail of the brief instead.
+- **Skills available to delegate:** `implementer` (worktree → commit → push → own PR) and
+  `reviewer` (scoped review → one structured finding). Name one in every delegation.
 - **Primary-side skills** (not delegation playbooks — a worker cannot use them):
-  `port-to-opencode` (make an OpenCode session a participant in this workspace) and
-  `fleets-status` (report every fleet that shares one LavinMQ instance).
+  `port-to-opencode` (make an OpenCode session a participant in this workspace).
 - **Never commit** `.mcp.json` (the primary's local copy, flagged `--skip-worktree`) or `wiki/`
  (a submodule with its own remote).
- **A provisioned worktree neutralizes `.mcp.json`, `opencode.json` and `.autoenv`** — the repo's
-  committed copies would otherwise mount the primary's IDE and forge servers (fleetd #134). The
-  worktree's copy of each is a stub, **not** the repo's real file, so a worker that reads one and
-  reports what it found is reporting on the stub. The daemon logs a per-spawn summary, but the
-  worker cannot see that log. From inside its own worktree a worker — or a lead debugging one —
-  reads the list with `git config --worktree --get-all fleet.neutralizedConfig`, and the
-  consequence with `git config --worktree --get fleet.neutralizedConfigNote`. Never brief a worker
-  to edit one of these files: the edit cannot be committed, and it will not tell you so.
- **Flows and the error model** — rendezvous, `fleet_ask`, detached delivery, the turn-done
-  fallback and status gating — are diagrammed in `docs/MCP-Contract.md`. That page is now flows
-  only: its pre-build tool catalogue, parameter tables and REST paths were deleted rather than
-  corrected, because a hand-maintained second copy of the tool surface is what drifted for a month
-  while this line pointed every session at it (CB-609 / #114). **The live MCP schema is the tool
-  reference**, with the intent→tool table above as the short form. `McpContractDocTest` fails if
-  that page names a `fleet_*` tool the server does not register. The flows are kept out of this
-  file because this file loads into every session's context.
-
-### Redeploying the daemon — the lead may do this (primary only)
-
-**A merge is not a deployment.** The running `fleetd` holds the jar it was started with, so a
-feature merged to `main` does nothing until the daemon is rebuilt and restarted. Saying "shipped"
-about code the live daemon has never loaded is a false report. The lead **may and should** redeploy
-rather than hand the job back to the operator.
-
-Workers must never do this. A worker has no business restarting the daemon it is talking through,
-and stopping it kills the worker's own channel mid-turn.
-
-**Use the script — do not hand-roll the steps.**
-
-```bash
-scripts/redeploy-fleetd.sh --check   # report state, change nothing
-scripts/redeploy-fleetd.sh           # build, confirm drain, restart, verify
-scripts/redeploy-fleetd.sh --yes     # skip the drain prompt (fleet already checked)
-```
-
-It builds before it stops anything, so a failed build never leaves the fleet down; it waits for the
-old process to exit rather than assuming; it polls `/healthz`; and it anchors its log checks to a
-line marker taken before the restart, so old errors cannot be misread as new ones. Run `--check`
-first — it is read-only and reports whether the forge token resolves, which nothing else tells you.
-
-The script encodes the five things below, each of which has gone wrong here before. Read them anyway:
-if the script is unavailable or a step fails, this is what it was protecting you from.
-
-1. **Login shell, or workers silently lose their forge token.** The daemon inherits
-   `WORKER_GITEA_TOKEN` from the shell that starts it, and that comes from
-   `${SHARED_ENV}/tools/secrets.sh`. Start it from a non-login shell and the variable is empty, the
-   daemon starts fine, and the failure appears much later as workers that cannot open a PR. Nothing
-   logs this at startup — the script's `--check` is the only thing that reports it, and it checks
-   whether the name resolves without ever printing the value.
-2. **Drain live members first.** `fleet_list`, then `fleet_stop` each member, and collect anything
-   you still want with `fleet_poll` before you kill anything. A restart drops in-flight tickets and
-   rendezvous, and a member's report is not recoverable once its ticket is gone.
-3. **A restart is the only way deferred config keys take effect.** That is usually the reason to do
-   it. The startup log names which keys it accepted and which it deferred — read those lines rather
-   than assuming.
-4. **Re-check identity afterwards.** Call `fleet_whoami` and confirm it still answers `primary`. The
-   lead is found by its tab label (`fleet.leaders.*.tab`), and a lead whose tab no longer matches is
-   demoted to worker, which refuses every orchestration call.
-5. **Prove the new jar is the one running.** Confirm a *fresh* `fleetd listening` line at the end of
-   `fleetd/fleetd.out`, dated after the restart. An old daemon that never died looks identical from
-   the outside.
-
-**Permission.** A `CLAUDE.md` rule grants intent, not tool permission — the command classifier
-refuses a bare `kill` on the daemon whatever this file says. The script is the seam that fixes that:
-it is one auditable command, so the operator allow-lists it once instead of approving a stop and a
-start every time. The rule lives in the operator's Claude Code settings:
-
-```json
-{ "permissions": { "allow": ["Bash(scripts/redeploy-fleetd.sh:*)"] } }
-```
-
-Granted by the operator on 2026-08-15. If a call is still refused, do **not** route around it by
-running the stop and start as separate commands — that is exactly the approval the script replaced.
-Say what you were going to run and why, and let the operator decide.
+- **Flows and the error model** — rendezvous, `bridge_ask`, detached delivery, turn-done fallback —
+  are diagrammed in `docs/MCP-Contract.md` §6, kept out of this file because it loads into every
+  session's context.

 ### The prompt is part of the product — update it with the code (mandatory)

@@ -298,15 +200,15 @@ Before you call any work done, check the row that matches what you touched:

 | You changed… | Re-read and update… |
 |---|---|
-| a `fleet_*` tool — added, removed, renamed, or its params/semantics | the primary's intent→tool table; any rule that names that tool |
+| a `bridge_*` tool — added, removed, renamed, or its params/semantics | the primary's intent→tool table; any rule that names that tool |
 | `Authz` / the role table | invariant 3, and the primary-only vs worker-only claims |
-| `ConnectionIdentity` / how a caller is resolved | the `fleet_whoami` paragraph and the fallback ladder |
-| `REPLY_CHARTER`, or a launcher's mount/flags | the fallback ladder (`mcp__fleet__*`), and the layering table's top row |
+| `ConnectionIdentity` / how a caller is resolved | the `bridge_whoami` paragraph and the fallback ladder |
+| `REPLY_CHARTER`, or a launcher's mount/flags | the fallback ladder (`mcp__bridge__*`), and the layering table's top row |
 | the injector / status gating | invariant 4 |
 | worktree provisioning or the parity overlay | the "both roles read this file" premise — it rests on the worker's worktree being a checkout of this repo |
 | `.claude/skills/**` | the addendum's skill list, and the "name the playbook" rule |
 | a new peer kind (non-Claude adapter) | what that peer can read — anything it must obey belongs in its charter, not in the block |
-| **anything an operator can use, configure, or observe** — an MCP tool, a `fleetd.yaml` knob, an endpoint, a visible behaviour | **[Features](wiki/11-Features.md)** — one entry: what it does · the knob that turns it on · **why it exists** · the gotcha |
+| **anything an operator can use, configure, or observe** — an MCP tool, a `bridged.yaml` knob, an endpoint, a visible behaviour | **[Features](wiki/11-Features.md)** — one entry: what it does · the knob that turns it on · **why it exists** · the gotcha |

 That last row is not bookkeeping. Chapters 1–10 answer *how is this built* and *why this way*;
 none of them has a home for *what can it do and how do I turn it on*, so for twenty tickets a
@@ -317,7 +219,7 @@ is a Roadmap line. A change that touches none of the three earns no entry, and t
 outcome rather than an omission.

 Then **propagate**: the block in this file and the template in the wiki
-([Use Cases](https://git.ltms.dev/fleet/fleetd/wiki/7-Use-Cases) → *The portable `CLAUDE.md`
+([Use Cases](https://git.ltms.dev/lms/claude-bridge/wiki/7-Use-Cases) → *The portable `CLAUDE.md`
 block*) must stay byte-identical, and other projects carrying the block need the same edit. Verify
 rather than trust:

@@ -340,10 +242,10 @@ PY

 Two IDE MCP servers are connected: **intellij-index** (semantic code intelligence) and
 **jetbrains** (file problems, reformat, debugger). IntelliJ has multiple projects open; our
-module is **`fleetd`**. Always pass these to IDE MCP tools:
+module is **`bridged`**. Always pass these to IDE MCP tools:

- `project_path` = `/Users/dai.ha/LTMS/claude-bridge/fleetd`
- IDE paths are relative to `fleetd/` (e.g. `src/main/java/dev/ltms/fleet/...`)
+- `project_path` = `/Users/dai.ha/LTMS/claude-bridge/bridged`
+- IDE paths are relative to `bridged/` (e.g. `src/main/java/dev/ltms/bridged/...`)

 ### After editing any file — mandatory

@@ -357,7 +259,7 @@ module is **`fleetd`**. Always pass these to IDE MCP tools:
   whole-project gate before declaring work done or committing.

 **Whenever dependencies change (or a `pom.xml` edit), validate CVEs with
-`jetbrains get_file_problems{filePath: "fleetd/pom.xml"}`** — its Mend.io check reflects the
+`jetbrains get_file_problems{filePath: "bridged/pom.xml"}`** — its Mend.io check reflects the
 dependencies on disk. (Note: `ide_diagnostics` / intellij-index does NOT re-resolve dependencies
 after a pom edit without a full Maven reimport, so it reports stale CVE results — don't trust it
 for this.) Treat a CVE warning like any other: bump to a patched version and confirm
@@ -9,33 +9,32 @@ Sibling of [`crush-bridge`](https://git.ltms.dev/systems/vms) (which drives a he
 process*, so it inherits `CLAUDE.md`, hooks, skills, and MCP — just pointed at a
 cheaper/local model.

-## Leading approach — herdr-centric message server (`fleetd`)
+## Leading approach — herdr-centric message server (`bridged`)

-A small always-on message server, **`fleetd`**, controls
+A small always-on message server, **`bridged`**, controls
 [herdr](https://herdr.dev) (an agent multiplexer) over its Unix-socket API and exposes a
 clean 2-way messaging API as an **MCP server that both the primary and the workers mount** —
 one unified Claude setup and the **sole communication gateway** (REST/SSE stays for non-Claude
-clients; any broker is `fleetd`-internal, below the gateway).
-herdr owns the PTYs, multiplexing, persistence, and **agent-status events**; `fleetd` owns
+clients; any broker is `bridged`-internal, below the gateway).
+herdr owns the PTYs, multiplexing, persistence, and **agent-status events**; `bridged` owns
 policy (subscription boundary, session lifecycle, status-gated delivery) and the client
-contract. A Claude member launches with `ANTHROPIC_BASE_URL` pointed at the gateway,
-`https://llm.ltms.dev/anthropic`, plus a bearer token; the lead stays env-clean and calls
-`fleetd`'s MCP tools. See the wiki's **[13 User Guide](wiki/13-User-Guide.md)** to run it.
+contract. The worker `claude` launches with `ANTHROPIC_BASE_URL=https://ollama.ltms.dev` + a
+bearer token; the primary Opus stays env-clean and calls `bridged`'s MCP tools.

 ```mermaid
 flowchart LR
    OPUS["Opus — primary<br/>(Claude Code, env CLEAN)<br/>MCP client"]
-    subgraph BD["fleetd — standalone daemon (not a claude process)"]
+    subgraph BD["bridged — standalone daemon (not a claude process)"]
        SRV["SERVER face<br/>MCP · REST/SSE · policy"]
        CLI["CLIENT face<br/>status-gated injector · herdr socket"]
        SRV --> CLI
    end
    HERDR["herdr<br/>panes · agent-status"]
    W["worker claude pane<br/>ANTHROPIC_BASE_URL set<br/>MCP client"]
-    M["llm.ltms.dev<br/>(the one gateway)"]
+    M["ollama.ltms.dev<br/>(worker model)"]

-    OPUS -->|"MCP fleet_send (blocks)"| SRV
-    W -.->|"MCP fleet_reply"| SRV
+    OPUS -->|"MCP bridge_send (blocks)"| SRV
+    W -.->|"MCP bridge_reply"| SRV
    CLI -->|"Unix socket<br/>send_text · events.subscribe"| HERDR
    HERDR -->|"drives PTY"| W
    W -->|"inference"| M
@@ -47,26 +46,24 @@ flowchart LR
 ```

 - **Subscription boundary:** the *primary* never sets `ANTHROPIC_BASE_URL` (stays on
-  Pro/Max). Only the *secondary* process is off-subscription — and `fleetd` itself is a
+  Pro/Max). Only the *secondary* process is off-subscription — and `bridged` itself is a
  plain daemon (no Anthropic quota), so it may poll/subscribe freely.
- **One gateway (unified MCP setup):** `fleetd` is the **sole communication path** for every
+- **One gateway (unified MCP setup):** `bridged` is the **sole communication path** for every
  Claude session. Primary and workers each mount it as an MCP server (one `claude mcp add`
-   line, same on both) and talk over MCP tools — `fleet_send` / `fleet_reply` /
-   `fleet_status` (with `fleet_ask` planned for the blocked-worker path). **No Claude session
-   ever addresses a broker, a peer, or the network
-   directly**; any queue is `fleetd`-internal. MCP tool I/O never sets `ANTHROPIC_BASE_URL`, so
-   mounting the bridge is subscription-safe by construction.
-   **Tool naming:** the tools are `fleet_*` (renamed from `bridge_*` in CB-622). The old
-   `bridge_*` names were removed in CB-634 — only `fleet_*` answers now.
- **How the primary consumes a reply:** a single **blocking MCP call** (`fleet_send`);
-  `fleetd` holds it open until the worker calls `fleet_reply` or its turn hits
+  line, same on both) and talk over MCP tools — `bridge_send` / `bridge_reply` /
+  `bridge_status` (with `bridge_ask` planned for the blocked-worker path). **No Claude session
+  ever addresses a broker, a peer, or the network
+  directly**; any queue is `bridged`-internal. MCP tool I/O never sets `ANTHROPIC_BASE_URL`, so
+  mounting the bridge is subscription-safe by construction.
+- **How the primary consumes a reply:** a single **blocking MCP call** (`bridge_send`);
+  `bridged` holds it open until the worker calls `bridge_reply` or its turn hits
  `agent_status=done`, then returns the reply as the tool result. No cross-turn busy-poll, so
  no quota burn. SSE is an optional side-channel for humans/dashboards watching status.
- **Worker → primary** rides `fleetd`'s **MCP rendezvous** — the reply resolves the primary's
-  blocking call (or, for detached work, `fleetd` **injects the primary's idle pane** when it's
+- **Worker → primary** rides `bridged`'s **MCP rendezvous** — the reply resolves the primary's
+  blocking call (or, for detached work, `bridged` **injects the primary's idle pane** when it's
  ready), so *no keystroke-into-primary and no broker are involved, even single-host*. The one
  exception: a split-host primary that isn't a herdr pane wakes via its own `Stop`-hook, which
-  polls **`fleetd`** (never a broker). See the wiki for the two topologies.
+  polls **`bridged`** (never a broker). See the wiki for the two topologies.
 - **Different model per process** sidesteps Claude Code's lack of per-subagent provider
  routing — the worker isn't a subagent, it's its own configured process.
 - **AgentAPI** ([`coder/agentapi`](https://github.com/coder/agentapi)) is retained only as a
@@ -75,11 +72,11 @@ flowchart LR

 ## Docs

-Full design, setup, and operations live in the **[wiki](https://git.ltms.dev/fleet/fleetd/wiki)**,
+Full design, setup, and operations live in the **[wiki](https://git.ltms.dev/lms/claude-bridge/wiki)**,
 vendored here as a submodule under [`wiki/`](./wiki):

 ```bash
-git clone --recurse-submodules ssh://git@git.ltms.dev:2224/fleet/fleetd.git
+git clone --recurse-submodules ssh://git@git.ltms.dev:2224/lms/claude-bridge.git
 # or, after a plain clone:
 git submodule update --init
 ```
@@ -89,7 +86,7 @@ Gitea wiki.

 ## Status

-🟢 **Implemented & dogfooded** — the herdr-centric **`fleetd`** message server is built and in
+🟢 **Implemented & dogfooded** — the herdr-centric **`bridged`** message server is built and in
 real use: an Opus primary delegates tasks to off-subscription workers that reply through the
 bridge (code reviews delegated this way have produced committed bug fixes). Selected as the
 primary approach 2026-07-11, superseding the AgentAPI plan (2026-07-08); AgentAPI retained as a
@@ -100,9 +97,9 @@ tests run separately via `mvn test -Pcontract`):

 - **Core gateway** — herdr socket client (contract-tested vs live 0.7.0); guard-checked worker
  spawn with `ANTHROPIC_BASE_URL` injected only into the worker's env; status-gated injector;
-  blocking `fleet_send` with reply rendezvous; MCP server as a thin adapter over the REST core.
- **MCP tools** — `fleet_send` / `fleet_reply` / `fleet_status` (messaging) and `fleet_spawn`
-  / `fleet_list` / `fleet_stop` / `fleet_profiles` / `fleet_poll` (fleet). Caller identity is
+  blocking `bridge_send` with reply rendezvous; MCP server as a thin adapter over the REST core.
+- **MCP tools** — `bridge_send` / `bridge_reply` / `bridge_status` (messaging) and `bridge_spawn`
+  / `bridge_list` / `bridge_stop` / `bridge_profiles` / `bridge_poll` (fleet). Caller identity is
  connection-based (loopback peer PID → herdr pane), so the same mount serves primary and workers.
 - **Delivery reliability** — completion fallback (a confirmed `working→idle` turn resolves a
  send); async fire-and-poll (beats the caller's MCP call timeout for long tasks); and failure
@@ -110,7 +107,7 @@ tests run separately via `mvn test -Pcontract`):
 - **Fleet** — multiple worker profiles, each with an independent base_url guard check; workers
  inherit the primary's working directory (never `$HOME`); a readiness gate holds delivery until
  a worker's Claude has connected the bridge MCP (no paste lost into its boot window).
- **Blocked-worker path** — `fleet_ask` reverse rendezvous: a worker pauses its delegated turn to
+- **Blocked-worker path** — `bridge_ask` reverse rendezvous: a worker pauses its delegated turn to
  ask the primary and resumes the *same* turn with the answer (CB-205).
 - **Session lifecycle** — session manager with spawn/reuse/recycle, `idle_ttl` reaper, `context_cap`,
  and graceful drain on shutdown (CB-301/CB-303); per-worker git worktrees on their own branch with
@@ -0,0 +1,14 @@
+# Build output
+target/
+dependency-reduced-pom.xml
+
+# Local runtime config (copy from bridged.example.yaml)
+bridged.yaml
+
+# CB-505 audit trail + daemon stdout/stderr — runtime records, never source
+logs/
+
+# Editor / OS
+*.iml
+.idea/
+.DS_Store
@@ -0,0 +1,409 @@
+# bridged configuration (example). Copy to bridged.yaml and adjust.
+#
+# bridged is the sole gateway between primary/worker Claude sessions and herdr.
+# It is NOT a Claude process and must never carry ANTHROPIC_BASE_URL.
+
+# REST + MCP listen address. Keep it on loopback unless you also switch auth.mode to `token`
+# below — bridged REFUSES TO START on a non-loopback bind under loopback-trust (see auth).
+bind:
+  host: 127.0.0.1
+  port: 8765
+
+# API authentication (CB-501). Governs how a caller that is NOT an on-host worker pane proves it
+# is the primary. Worker identity never depends on this: a loopback peer PID that maps to a herdr
+# pane is unforgeable and is always honoured, so turning auth on cannot lock the fleet out.
+#
+#   mode: loopback-trust  → DEFAULT, and the historical behaviour: any loopback caller that is not
+#                           a worker is the primary, no credential needed. Sound ONLY because the
+#                           OS refuses remote connections to a loopback socket.
+#   mode: token           → such a caller must send `Authorization: Bearer <token>`; without it it
+#                           is anonymous and authorized for nothing. REQUIRED for a non-loopback
+#                           bind — the daemon fails fast otherwise, because "unauthenticated ⇒
+#                           primary" on a reachable port would hand spawn/stop/send to anyone.
+#   tokenEnv              → host env var holding the token (never the literal value). Default
+#                           BRIDGED_API_TOKEN. Read only in token mode; empty ⇒ startup fails.
+#
+# TLS is deliberately NOT terminated in the daemon (CB-501 D3): run a reverse proxy in front and
+# let it own certificate lifecycle, e.g.
+#     location / { proxy_pass http://127.0.0.1:8765; proxy_set_header Authorization $http_authorization; }
+# The broker link gets TLS from its own URI (amqps://…) — see `broker` below.
+# auth:
+#   mode: token
+#   tokenEnv: BRIDGED_API_TOKEN
+
+# Optional pinned primary terminal (CB-307). Names the herdr pane the PRIMARY itself runs in:
+# a caller whose connection maps to this pane resolves as the primary (no credential needed —
+# the pane mapping is as unforgeable as a worker's), and reply nudges are pushed to it.
+# REQUIRED when the primary runs inside a herdr pane — without it the pane match reads the
+# primary as a worker and refuses spawn/send/stop. Get the id from bridge_whoami; re-pin if
+# the primary moves panes.
+# primary:
+#   terminal: term_0123456789abcd
+#   pushReminders: 5      # max nudges before giving up (default 5)
+#   pushBackoffMs: 15000  # delay between nudges (default 15000)
+
+# CB-530: MORE THAN ONE LEAD. `primary:` above is singular by construction — every other pane
+# resolves as a worker — which is right for one lead driving a fleet and wrong the moment two leads
+# (say a Claude lead and an opencode lead) work as peers: the second is silently demoted and refused
+# every orchestration call. List each lead's pane here and all of them resolve as leads.
+#
+#   terminal → the ONLY field identity depends on; get it from that session's bridge_whoami
+#   kind/model → descriptive; they document what runs in the pane and are echoed by bridge_whoami
+#
+# A lead is never spawned — it pre-exists, which is exactly why it must be named rather than created.
+# `bridge_whoami` reports `{"role":"primary","leader":"<name>"}`; role stays "primary" because a lead
+# IS a primary for authorization, so nothing that keys on the role breaks.
+#
+# KEEP `primary:` when adding leads: it still addresses the CB-307 push loop, which needs a single
+# destination for its nudges. If both name the same terminal, the `fleet.leaders:` entry wins.
+#
+# Leads are configured under `fleet.leaders:` — see THE FLEET further down.
+#
+# Two things stop the tab-name convention from becoming a way to claim leadership: the configured
+# member spaces are excluded from the scan, so nothing bridged places can land in a matching tab;
+# and startup REFUSES a `tabPrefix` that the fleet tabLabel template, or any per-profile `tabLabel`
+# override, also matches — so the two namespaces cannot overlap by accident. The label is a NAME,
+# never a capability: what a pane may do is decided by the role the daemon resolves for it.
+
+# CB-551: IDLE-LEAD HEARTBEAT — nudge the single lead back to work when it has been continuously
+# idle (no open bridge_send driving it) past the quiet period. The fleet is one lead + architects +
+# workers, so a lead that stalls is a single point of failure; the ReplyPushLoop only nudges when a
+# reply lands, and this timer catches the gap where nothing lands and the lead just sits idle.
+#
+# Opt-in on purpose — it SPENDS the operator's subscription on its own initiative (each nudge starts
+# a lead turn nobody asked for), so upgrading the daemon must never switch it on for you. Absent
+# block = feature off, exactly as before.
+#
+# Three knobs, each with a default that errs on the side of not burning context:
+#   idleAfterSeconds: 300   # how long the lead must stay idle before the FIRST nudge (default 300 —
+#                           # absorbs normal post-turn pauses; re-prompting every pause burns context)
+#   backoffMs: 60000        # re-check cadence / spacing between nudges past the quiet period (default 60000)
+#   quietNudgeCap: 3        # cap on consecutive nudges that find NOTHING pending, then it stops
+#                           # until real state appears (default 3 — never nag an empty fleet forever)
+# leadHeartbeat:
+#   idleAfterSeconds: 300
+#   backoffMs: 60000
+#   quietNudgeCap: 3
+
+# herdr Unix socket. Omit to use the client default
+# (${HERDR_SOCKET_PATH:-~/.config/herdr/herdr.sock}).
+herdrSocket: ~/.config/herdr/herdr.sock
+
+# How member sessions are spawned. Define one or more named profiles (backends) under
+# `profiles`; each key is the profile name (also the ccs profile). A profile says only WHICH
+# BACKEND — model, CLI adapter, credentials, cost. It says nothing about what a member spawned on
+# it is for; that is the member's role, and roles live under `fleet:` below. Which profile an
+# unqualified spawn lands on comes from that role's pool, not from a global default.
+#
+# Shared knobs (placement/workspace) can be repeated per profile; they usually match.
+#   placement: tab   → each worker lands in its OWN tab in a dedicated worker space (default).
+#                      Use `pane` for the legacy behaviour (split the focused tab).
+#   mcpUrl           → bridged mounts the bridge MCP (--mcp-config, inline) + reply charter
+#                      (--append-system-prompt) as launch flags; nothing is written to the profile.
+#   tokenEnv         → host env var holding the worker's auth token (value never stored in config);
+#                      omit for a backend that needs no token (e.g. a local ollama).
+#   cwd              → pin this profile's working directory (CB-112). Omit to inherit the primary's
+#                      cwd on an MCP spawn, else the daemon's cwd — never $HOME. See
+#                      docs/Worker-Startup-and-Trust.md.
+#   configDir        → CLAUDE_CONFIG_DIR for the worker, so it inherits that profile's
+#                      skills/MCP/hooks. Omit to leave the worker on the host default.
+#   parityOverlay    → repo-relative paths copied primary→worktree so a worker in a provisioned
+#                      worktree sees the same local config (CB-301-ext). Omit for the default set:
+#                      [.claude/settings.local.json, .env, .envrc].
+#
+#                      Do NOT add .mcp.json (CB-525). A worker's tools are whatever its launcher
+#                      mounts — the bridge, and nothing else. Replicating the primary's MCP config
+#                      handed a worker the primary's IDE servers, which are bound to the primary's
+#                      checkout, so its navigation returned paths OUTSIDE its own worktree: one
+#                      worker made all 59 of its edits in the primary tree while compiling its
+#                      worktree, and every build it ran was of code that did not contain them.
+#                      bridged neutralizes a provisioned worktree's .mcp.json for this reason;
+#                      listing it here would copy the primary's back over that.
+#   gitTokenEnv      → host env var holding the git-forge API token. When set, its value is injected
+#                      as GITEA_TOKEN so the worker can open its OWN PR at checkpoint (CB-302).
+#                      Opt-in by design — omit and the worker gets no PR-create grant (push over
+#                      SSH is unaffected). The token value itself is never stored in this file.
+#   gitHostEnv       → host env var holding the forge host (default GITEA_HOST). Injected as
+#                      GITEA_HOST *only* alongside a resolved gitTokenEnv.
+#   env              → extra environment for this profile's workers, as a literal key/value map
+#                      (CB-511). Use it to give workers a toolchain.
+#
+#                      A worker's environment does NOT come from your shell. bridged hands herdr an
+#                      explicit env map and herdr merges it into ITS OWN process env — so before
+#                      CB-511 a worker inherited whatever PATH the herdr server happened to be
+#                      started with, which on a long-lived herdr can predate your toolchain entirely
+#                      and leave workers unable to run `mvn` or `java` at all.
+#                      bridged now propagates ITS OWN PATH to every worker by default; set `env:`
+#                      only to override that or add more (JAVA_HOME, …). Since the default is the
+#                      daemon's PATH, make sure the daemon is started with a good one — see the PATH
+#                      lines in deploy/dev.ltms.bridged.plist and deploy/bridged.service.
+#
+#                      Adapter-owned variables always win over `env:`: ANTHROPIC_BASE_URL and the
+#                      rest of the ANTHROPIC_*/CLAUDE_* wiring are applied after it, so an `env:`
+#                      entry cannot repoint a worker past the SubscriptionGuard — which is checked
+#                      against `baseUrl` alone.
+# Put `defaultMode: "auto"` in each ccs profile so the worker runs autonomously.
+profiles:
+  gx10:                              # ccs profile name (NOT a hostname)
+    kind: claude-code                # which adapter spawns this profile (default; may omit)
+    baseUrl: http://gx01.gw:8000     # the vLLM host this profile targets (gx00.gw / gx01.gw)
+    model: coder
+    placement: tab
+    workspace: bridged-workers
+    # tabLabel: an optional per-profile override; the fleet template usually covers it
+    mcpUrl: http://127.0.0.1:8765/mcp
+    tokenEnv: BRIDGED_WORKER_TOKEN
+    argv: ["ccs", "gx10"]
+    weight: 0.5                       # relative selection weight for placement: weighted
+    maxLoad: 2                        # max live workers on this profile (omit for unlimited)
+    # gitTokenEnv: GITEA_TOKEN        # opt-in: let this profile's workers open their own PR (CB-302)
+    # gitHostEnv: GITEA_HOST          # defaults to GITEA_HOST; injected only with gitTokenEnv
+    # configDir: /Users/me/.ccs/instances/gx10   # CLAUDE_CONFIG_DIR — inherit that profile's skills/MCP
+    # cwd: /Users/me/src/myrepo       # pin the working dir; omit to inherit the primary's
+    # parityOverlay: [".claude/settings.local.json", ".env", ".envrc"]   # never add .mcp.json — see above
+  gx11:                              # a second backend, so `placement: weighted` has a choice
+    baseUrl: http://gx01.gw:8000     # self-hosted; ccs handles the model + token
+    placement: tab
+    workspace: bridged-workers
+    # tabLabel: an optional per-profile override; the fleet template usually covers it
+    mcpUrl: http://127.0.0.1:8765/mcp
+    argv: ["ccs", "gx11"]
+    weight: 0.5
+    maxLoad: 2
+    # Pin an auto-compact window BELOW the served model's context ceiling. The global
+    # ~/.claude/settings.json value is shared by every ccs instance and the primary, so the
+    # per-profile override belongs here. Equal to the ceiling means auto-compact never fires
+    # before the server rejects the prompt, which kills a worker mid-turn (CB-523).
+    env:
+      CLAUDE_CODE_AUTO_COMPACT_WINDOW: "280000"
+  # CB-402: a second coding-agent kind, proving the PeerLauncher SPI is provider-neutral.
+  # opencode is provider-agnostic and uses NONE of Claude's private seams: no ANTHROPIC_BASE_URL /
+  # SubscriptionGuard (so it needs no `guard` host entry), no --mcp-config / --append-system-prompt.
+  # The bridge MCP + reply charter mount via a generated OPENCODE_CONFIG file, and the model is a
+  # `provider/model` selector. Placement, tabs, cwd, and the readiness gate are shared with Claude.
+  #
+  # Dogfood-verified 2026-07-29 against opencode 1.18.5 (spawn → readiness gate → bridge_send →
+  # structured bridge_reply → teardown). The `opencode/*-free` models run on opencode's own gateway
+  # and need NO credentials — check `opencode models` for the current free list, since the names
+  # change. That also makes the worker off-subscription by construction.
+  #   opencode-free:
+  #     kind: opencode
+  #     model: opencode/north-mini-code-free  # `provider/model` selector, injected as `-m`
+  #     placement: tab
+  #     workspace: bridged-workers
+  #     tabLabel: "opencode: {profile} #{n}"
+  #     mcpUrl: http://127.0.0.1:8765/mcp
+  #     argv: ["opencode"]
+  #
+  # CB-508: point an opencode profile at your OWN OpenAI-compatible endpoint (local vLLM, llama.cpp,
+  # LM Studio, TGI…) instead of opencode's gateway. Setting `baseUrl` on a `kind: opencode` profile
+  # makes the bridge emit a custom `provider` block into the generated opencode.json — opencode has
+  # no ANTHROPIC_BASE_URL seam, so this is how the endpoint is pinned.
+  #   baseUrl → a bare host:port gets `/v1` appended (where these servers mount the API); a URL that
+  #             already has a path is used verbatim, so a custom mount point still works.
+  #   model   → MUST be "<provider>/<model>". The provider half names the generated block; the model
+  #             half must match an id the server reports at /v1/models. One field drives both the
+  #             declaration and the `-m` flag, so they cannot drift apart. A bare model name with a
+  #             baseUrl set is rejected at spawn rather than silently using the default gateway.
+  #   tokenEnv → optional; its value becomes the provider apiKey. Most local servers ignore the key,
+  #             so a placeholder is used when unset (the AI SDK still requires a non-empty one).
+  # NOTE: no `guard` entry is needed even with a baseUrl set. The SubscriptionGuard exists to stop a
+  # worker borrowing the primary's Anthropic subscription, and an opencode process has no Anthropic
+  # credential path at all.
+  #   opencode-local:
+  #     kind: opencode
+  #     baseUrl: http://127.0.0.1:8000
+  #     model: local-vllm/deepseek-v4-flash
+  #     placement: tab
+  #     workspace: bridged-workers
+  #     tabLabel: "opencode: {profile} #{n}"
+  #     mcpUrl: http://127.0.0.1:8765/mcp
+  #     argv: ["opencode"]
+# How an unqualified spawn chooses a profile: fixed (default, reproduces pre-CB-518 behaviour),
+# round-robin, or weighted. Omitting this key is a strict no-op for existing configs.
+placement: weighted
+
+# Re-read this file without restarting the daemon (CB-559). Off unless you add this block, so an
+# upgraded bridged keeps the old behaviour: the file is read once at boot and never again.
+#   enabled          → turn the watch on. bridged checks the file's modified time on a timer and
+#                      reloads when it moves.
+#   intervalSeconds  → how often to check (default 10). One `stat` per tick, so this is cheap.
+#
+# Not every key can move under a running daemon, and the difference is about what already exists
+# when the reload happens — not about how important the key is:
+#   HOT       → takes effect on the next spawn: the whole `fleet:` block (every role pool,
+#               `charters`, and `tabLabel`), `placement:`, and an existing profile's weight / maxLoad. Those are
+#               hot because the placement policy reads them through a supplier — being config is
+#               not by itself enough to make a key hot.
+#   DEFERRED  → accepted into the new config, but the wiring built at startup keeps the old value
+#               until you restart: `lifecycle:`, `leadHeartbeat:`, `guard:`, `worktreeRoot:`,
+#               `spawnReadyTimeoutMs` / `spawnReadyPollMs`, ADDING or REMOVING a profile (a new
+#               backend needs its own launcher, and launchers are built once), AND an existing
+#               profile's launch settings — model, baseUrl, argv, env, configDir, mcpUrl, tabLabel.
+#               The launcher takes a copy of `profiles:` at startup and resolves every spawn out of
+#               that copy, so those never reach a launch until you restart. The reload logs them by
+#               name rather than pretending they applied.
+#   COLD      → cannot change at all: `bind:`, `herdrSocket:`, `broker:` and `auth:`. The socket is
+#               bound, the broker connection is open, and the auth mode decides who may reach the
+#               port that is already listening.
+#
+# A changed COLD key refuses the WHOLE reload — not the hot half applied and the cold half warned
+# about. A half-applied reload would leave the daemon matching no file on disk, which is the worst
+# thing a reload can do to an operator debugging one. A file that fails to parse or fails a startup
+# validator is refused the same way, and the running config stays live.
+# configReload:
+#   enabled: true
+#   intervalSeconds: 10
+
+# THE FLEET (CB-557) — who the daemon may run, and under which role. This one block replaced four
+# older keys: `leaders:`, `members:`, `leadScan:` and `defaultProfile:`.
+#
+# A member is anything a lead spawns, and every member has two INDEPENDENT attributes:
+#   role    — which contract: architect, dev or reviewer. It picks the launch charter, the role
+#             file, the playbook skill and the authz row.
+#   profile — which backend: one of the `profiles:` keys above (model, CLI adapter, cost).
+# They vary on their own. A reviewer may run on the same profile as the dev whose diff it reads,
+# which is why the two cannot be one field.
+#
+# The ROLE IS THE CONTAINING KEY, not a `role:` field. That is not only tidier: a misspelled role
+# used to parse into a member with no contract at all, while a misspelled pool name here simply
+# declares nothing.
+#
+# Each pool lists the profiles that role MAY run on — these are pools, not identities. That is also
+# what replaced `defaultProfile:`: an unqualified spawn names a role, and that role's pool supplies
+# the candidates, in definition order. A dev and a reviewer staying anonymous is exactly compatible
+# with being listed here; the entry key just names the entry.
+fleet:
+  # Optional launch-charter text, keyed only by the singular role wire names: architect, dev,
+  # reviewer. Changes are HOT and reach the next spawn without a daemon restart. Do not put secrets
+  # here: a later launch step writes this text to a world-readable temp file, and ${ENV} interpolation
+  # is deliberately not supported.
+  charters:
+    architect: |-
+      You are an architect in this fleet. You refine work before anyone builds it:
+      scope, acceptance criteria, risks, and a unit split. You read the repo and
+      write analysis. You never commit production code and never open a PR.
+      A design task is worked by two architects. Design alone first, then exchange
+      and say plainly where you disagree. Do not concede just to agree.
+    dev: |-
+      You implement the one unit you were given, and nothing else. You test it,
+      commit it, and open your own pull request. You never merge.
+    reviewer: |-
+      You review the diff you were given. You report bugs, risks and missing tests.
+      You do not change code.
+
+  # Optional. Template for a member tab's label; {role}, {profile}, {model} and {n} are substituted.
+  # {n} counts per role+profile, so `dev: sonnet #2` really is the second sonnet dev. Because {role}
+  # comes from a closed enum, a generated label can never begin with a lead's tabPrefix.
+  # tabLabel: "{role}: {profile} #{n}"
+
+  # Panes that orchestrate rather than are orchestrated. A lead may now be CREATED as well as
+  # recognised: give it a `profile:` and the daemon launches the shortfall when fewer than
+  # `instances` are live. Give it only a `terminal:` and it is recognise-only, as before.
+  #
+  # `tabPrefix` is the naming convention that finds a lead without pasting a terminal id: label the
+  # tab `lead: <name>` when you open it and the pane is recognised on the next rescan. Reopen the
+  # tab later and the id changes; the label does not.
+  #
+  # A lead the daemon launches is labelled BY the daemon, using the same convention, so it is found
+  # by the same scan. A lead counts as live only when herdr also reports a running agent in that
+  # tab — a label left behind by a session that died does not block the relaunch.
+  #
+  # An auto-launched lead is NOT a member: it gets no worker reply charter, is never registered with
+  # the session lifecycle (the idle reaper would kill your orchestrator), and stays on the
+  # subscription — ANTHROPIC_BASE_URL/AUTH_TOKEN are stripped from its env whatever the profile says.
+  # leaders:
+  #   opus-5.0:
+  #     profile: opus                # omit to never create this lead, only recognise it
+  #     instances: 1                 # desired live count; only the shortfall is launched. 0 = off
+  #     terminal: term_0123456789abcd  # optional hand-pin; usually found by tabPrefix instead.
+  #                                  # A running agent on this terminal also counts as live, so a
+  #                                  # lead you opened by hand is not relaunched under you.
+  #     tabPrefix: "lead:"           # `lead: opus-5.0` ⇒ a lead named opus-5.0 (case-insensitive)
+  #     scanIntervalSeconds: 10      # rescan cadence, and the worst case before a new tab is seen
+  #     workspace: leads             # where a launched lead's tab is created (default "leads").
+  #                                  # MUST NOT be a member workspace — those are excluded from the
+  #                                  # scan, so a lead placed in one is never found again.
+  #     cwd: /path/to/repo           # the launched lead's working directory (default: bridged's own)
+  #     kind: claude                 # descriptive; reported by bridge_whoami
+  #   gpt-sol-5.6:
+  #     terminal: term_fedcba9876543
+  #     kind: opencode
+  #     model: openai/gpt-5.6-terra
+
+  # architects:
+  #   architect-1:
+  #     profile: opus                # a strong model, on the operator's subscription
+  #   architect-2:
+  #     profile: sol                 # a different vendor on purpose — two architects that share a
+  #                                  # model share its blind spots
+  developers:
+    gx10:
+      profile: gx10
+  # reviewers:
+  #   gx10:
+  #     profile: gx10                # the same backend may serve two roles; that is the point
+
+# Subscription boundary. A worker's base_url host MUST be one of these; the primary
+# must carry none. Every profile above must have its host listed here.
+guard:
+  offSubscriptionHosts:
+    - gx00.gw
+    - gx01.gw
+
+# Spawn-readiness gate (CB-306). The launcher blocks until the worker's herdr status is
+# injectable (IDLE/BLOCKED/DONE) or the timeout elapses. 0 disables the gate.
+# NOTE: keys are camelCase — config is bound by plain Jackson with no naming strategy and
+# unknown keys are ignored, so a snake_case key would be silently dropped (default kept).
+# spawnReadyTimeoutMs: 20000
+# spawnReadyPollMs: 300
+
+# Worktree provisioning root (CB-301-ext). Where per-worker git worktrees are checked out so
+# each worker owns an isolated branch instead of sharing the primary's tree. Omit to default
+# to a sibling directory of the repo root.
+# worktreeRoot: /Users/me/src/.bridged-worktrees
+
+# Session lifecycle limits (CB-303). All knobs are opt-in; omit or set to null to keep
+# the feature disabled. By default the daemon never reaps, caps, or drains sessions.
+#   idleTtlSeconds     → reap READY/DONE sessions idle longer than this (never BUSY/SPAWNING)
+#   contextCap         → force-release a session after this many delegated turns
+#   drainTimeoutSeconds → seconds to wait for BUSY sessions on shutdown before forced teardown
+# lifecycle:
+#   idleTtlSeconds: 300
+#   contextCap: 10
+#   drainTimeoutSeconds: 5
+
+# Durable reply delivery (CB-307 Stage 2). OMIT this block entirely to keep the default
+# in-memory, soft-state reply inbox (late worker replies are held only until a daemon bounce).
+# Set a broker uri to swap in the AMQP-backed inbox: worker replies with no open send are held
+# on a durable per-target queue (agent.<target>.inbox) and survive a restart — the broker
+# redelivers anything the primary had not yet drained. Production default is LavinMQ; a stock
+# RabbitMQ speaks the same AMQP 0-9-1, so it is a URI-only swap.
+#   uri → AMQP connection URI. No trailing slash ⇒ the default vhost "/"; an empty path ("/")
+#         is vhost "" and will NOT connect. Encode a named vhost as .../%2Fmyvhost.
+# broker:
+#   uri: amqp://guest:guest@127.0.0.1:5672
+
+# Active push-to-primary (CB-307 Stage 3). When a worker reply lands with no open bridge_send,
+# the ReplyPushLoop injects a *drain nudge* (never the payload) into the primary's own herdr
+# pane — status-gated (only when injectable, never mid-turn) and bounded. Ack = drain: the loop
+# stops as soon as the primary's inbox is empty.
+#   terminal       → pin the primary's herdr terminal id. Omit to learn it from the connection on
+#                    the first orchestration-side MCP call (the normal case). An off-host or
+#                    non-herdr primary leaves this unresolved → the loop is a no-op and delivery
+#                    degrades to pull; the reply is still never lost.
+#
+#                    REQUIRED (CB-522) if the primary itself runs inside a herdr pane. Caller
+#                    identity resolves a loopback PID to its herdr pane, and PaneLocator scans
+#                    EVERY pane — not just bridged-spawned ones — so such a primary is otherwise
+#                    classified as a WORKER and refused SPAWN/SEND/STOP. That failure is
+#                    self-locking: the learned terminal is populated by the very orchestration
+#                    calls being refused, so only this pinned value can break the cycle. Read the
+#                    id off bridge_whoami (it reports the current terminal even while
+#                    misclassified) and re-pin whenever the primary moves panes.
+#   pushReminders  → max nudges before giving up (default 5)
+#   pushBackoffMs  → delay between nudges in ms (default 15000)
+# primary:
+#   terminal: term_65619bd6174568
+#   pushReminders: 5
+#   pushBackoffMs: 15000
@@ -5,10 +5,10 @@

 ## Why this exists

-Stage 2 gave a worker→primary reply a **durable place to wait** when no `fleet_send` is
+Stage 2 gave a worker→primary reply a **durable place to wait** when no `bridge_send` is
 open: it lands in `agent.<target>.inbox` on the broker and survives a daemon bounce. But
 delivery is still **pull** — the primary only sees the reply if it happens to call
-`fleet_poll(target)` / `GET /sessions/{id}/replies`. A reply can sit indefinitely while
+`bridge_poll(target)` / `GET /sessions/{id}/replies`. A reply can sit indefinitely while
 the primary works on something else.

 This layer makes delivery **active**: the bridge *pushes* a nudge to the primary the moment
@@ -26,11 +26,11 @@ pointed at the primary's pane instead.

 ```mermaid
 flowchart LR
-    W["worker"] -->|"fleet_reply (no open send)"| MS["MessageService.reply"]
+    W["worker"] -->|"bridge_reply (no open send)"| MS["MessageService.reply"]
    MS -->|"inbox.publish"| INBOX[("agent.&lt;target&gt;.inbox<br/>(durable, LavinMQ)")]
    MS -->|"notify"| LOOP["ReplyPushLoop"]
    LOOP -->|"status-gated inject"| PANE["primary's herdr pane"]
-    PANE -->|"primary drains"| DRAIN["fleet_poll(target)<br/>= peek + ack"]
+    PANE -->|"primary drains"| DRAIN["bridge_poll(target)<br/>= peek + ack"]
    DRAIN -->|"inbox now empty"| LOOP
    LOOP -.->|"still non-empty →<br/>re-inject on backoff"| PANE
    classDef store fill:#2c5282,stroke:#1a365d,color:#ffffff;
@@ -51,13 +51,13 @@ the caller runs in a herdr pane on this host. Today it's discarded for the prima
 (`presence.markPresent` is a no-op on it).

 **Plan:** a single-slot `PrimaryRegistry` (thread-safe) holding the primary's `terminal_id`.
-Populate it from the **orchestration-side** MCP tools — `fleet_send`, `fleet_spawn`,
-`fleet_poll`, `fleet_list`, `fleet_status`, `fleet_profiles` — capturing
+Populate it from the **orchestration-side** MCP tools — `bridge_send`, `bridge_spawn`,
+`bridge_poll`, `bridge_list`, `bridge_status`, `bridge_profiles` — capturing
 `callerTerminal(exchange)` when it is (a) non-null and (b) **not** a registered worker
 session in `SessionManager`. That caller is, by construction, the primary. Worker-side tools
-(`fleet_reply`, `fleet_ask`) never set it.
+(`bridge_reply`, `bridge_ask`) never set it.

- **Config override / pin:** a `primary: { terminal: "<id>" }` block in `FleetConfig`
+- **Config override / pin:** a `primary: { terminal: "<id>" }` block in `BridgedConfig`
  (nested record, same shape as `Broker`). Lets an operator pin it, or supply it when
  derivation can't (see degrade case).
 - **Degrade:** if the primary is off-host or in a non-herdr terminal, `terminalForPid`
@@ -71,13 +71,13 @@ A `ReplyPushLoop` component, notified at the single no-waiter call site
 (`MessageService.reply` → the `inbox.publish` branch, `MessageService.java:192`).

 - **Inject a nudge, not the payload.** The injected turn tells the primary *to drain*
-  (e.g. "Worker `<target>` returned a reply — run `fleet_poll(target=<target>)` to collect
+  (e.g. "Worker `<target>` returned a reply — run `bridge_poll(target=<target>)` to collect
  it"), it does **not** carry the reply text. Rationale: replies can be large/multiline and
  terminal injection would mangle them; the drain response is the clean transport. Keeps the
  push idempotent — re-nudging is harmless.
 - **Ack = drain.** The primary draining (`drainReplies` = peek + ack) is the acknowledgement.
  The loop's **stop condition is `inbox.peek(target).isEmpty()`** — the reply is gone from the
-  inbox because it was acked. No new `fleet_ack` tool needed for v1 (see Increment 3).
+  inbox because it was acked. No new `bridge_ack` tool needed for v1 (see Increment 3).
 - **Status-gated injection (mechanism (b), chosen).** A dedicated lightweight scheduled loop,
  **not** the worker `Injector`. It injects via `AgentControl.send(primaryTerminal, nudge)`
  (the same herdr `agent.send` = `pane send-text` + submit that delivers to workers) only when
@@ -93,10 +93,10 @@ A `ReplyPushLoop` component, notified at the single no-waiter call site
  the reply remains in the durable inbox and the next natural poll (or a later worker reply's
  nudge) still surfaces it. Bounded so the bridge never spams the primary.

-### Increment 3 — optional per-`msgId` `fleet_ack` tool (deferred)
+### Increment 3 — optional per-`msgId` `bridge_ack` tool (deferred)

 Drain-as-ack is coarse: it clears *all* pending replies for a target at once. If finer
-control is ever needed (ack one reply, leave others held), add a `fleet_ack(msgId)` tool
+control is ever needed (ack one reply, leave others held), add a `bridge_ack(msgId)` tool
 mapping to `inbox.ack(target, msgId)` — the port already supports per-`msgId` ack. Not built
 in v1; the stop-on-empty loop is sufficient.

@@ -106,7 +106,7 @@ in v1; the stop-on-empty loop is sufficient.
   resolved terminal is non-null **and not a registered worker session**, seen on an
   orchestration-side tool. This never mislabels a worker (workers are in `SessionManager`)
   and needs no new env var or argument (identity stays connection-derived, per the existing
-   `FleetMcp` invariant).
+   `BridgeMcp` invariant).

 2. **Readiness-gate mismatch → dedicated loop.** The existing `Injector` gates delivery on
   `ready.test(target)` = `WorkerPresence` (the *worker's* MCP connected). The primary is not
@@ -132,7 +132,7 @@ boundary**. The bridge is signalling the primary that it has mail — not drivin
  non-null terminal AND not a registered session" predicate; the loop's stop-on-empty and
  bounded-reminder logic with an injected clock + a fake injector (no real herdr).
 - **Live dogfood (primary-side):** with the daemon on the broker jar + a real worker,
-  delegate a task, let the worker reply after the `fleet_send` window closes, and observe the
+  delegate a task, let the worker reply after the `bridge_send` window closes, and observe the
  bridge inject a drain nudge into *this* primary pane; confirm draining stops the reminders;
  confirm an unreachable primary (registry empty) degrades to pull with no loss.

@@ -5,17 +5,17 @@
    <modelVersion>4.0.0</modelVersion>

    <groupId>dev.ltms</groupId>
-    <artifactId>fleetd</artifactId>
+    <artifactId>bridged</artifactId>
    <version>1.0.0</version>
    <packaging>jar</packaging>

-    <name>fleetd</name>
-    <description>fleet message server: sole gateway between a lead session, its members, and herdr</description>
+    <name>bridged</name>
+    <description>claude-bridge message server: sole gateway between primary/worker Claude sessions and herdr</description>

    <properties>
        <maven.compiler.release>25</maven.compiler.release>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <mainClass>dev.ltms.fleet.Fleetd</mainClass>
+        <mainClass>dev.ltms.bridged.Bridged</mainClass>

        <jackson.version>2.19.0</jackson.version>
        <javalin.version>6.7.0</javalin.version>
@@ -28,8 +28,6 @@
        <testcontainers.version>1.20.4</testcontainers.version>
        <commons-compress.version>1.27.1</commons-compress.version>
        <commons-lang3.version>3.18.0</commons-lang3.version>
-        <sqlite-jdbc.version>3.53.4.0</sqlite-jdbc.version>
-        <archunit.version>1.5.0</archunit.version>
    </properties>

    <!--
@@ -46,12 +44,6 @@
          3.0-rc5; bumping Jackson 3 to the patched 3.2.x breaks the SDK (annotation mismatch).
          Only the loopback /mcp endpoint parses this JSON, from trusted local Claude clients.
      The 11.0.23 -> 11.0.25 bump did clear jetty CVE-2024-8184 (5.9) and CVE-2024-6763.
-
-      fleetd #206: org.xerial:sqlite-jdbc 3.53.4.0 (added for OpenCodeSessionDiscovery) — the
-      only known advisory against this artifact is CVE-2023-32697 (RCE via an attacker-controlled
-      JDBC URL), fixed in 3.41.2.2; 3.53.4.0 is well past that fix and OSV.dev reports no open
-      advisory against it. Checked via the OSV.dev API (no Mend.io/JetBrains IDE MCP mount
-      available from this worktree) on 2026-08-31.
    -->

    <!-- Force the latest patched Jetty 11.x across all Javalin-pulled Jetty modules (no version
@@ -114,7 +106,7 @@
        </dependency>

        <!-- MCP server: the SERVER face. Streamable-HTTP servlet mounted on Javalin's Jetty at
-             /mcp, exposing fleet_send/fleet_reply/fleet_status as thin adapters over REST. -->
+             /mcp, exposing bridge_send/bridge_reply/bridge_status as thin adapters over REST. -->
        <dependency>
            <groupId>io.modelcontextprotocol.sdk</groupId>
            <artifactId>mcp</artifactId>
@@ -131,17 +123,6 @@
            <version>${amqp.version}</version>
        </dependency>

-        <!-- fleetd #206: opencode moved its session store from a JSON tree to SQLite
-             (opencode.db). This is the JDBC driver OpenCodeSessionDiscovery uses to read it
-             read-only. Ships bundled native libraries (linux/mac/windows, several archs), so it
-             is a heavier jar than most deps here — see the pom's dependency-security note below
-             for the size/CVE tradeoff actually measured. -->
-        <dependency>
-            <groupId>org.xerial</groupId>
-            <artifactId>sqlite-jdbc</artifactId>
-            <version>${sqlite-jdbc.version}</version>
-        </dependency>
-
        <!-- Logging -->
        <dependency>
            <groupId>org.slf4j</groupId>
@@ -177,21 +158,10 @@
            <version>${testcontainers.version}</version>
            <scope>test</scope>
        </dependency>
-
-        <!-- fleetd #131: package-boundary and cycle enforcement (PackageCyclesTest). -->
-        <dependency>
-            <groupId>com.tngtech.archunit</groupId>
-            <artifactId>archunit-junit5</artifactId>
-            <version>${archunit.version}</version>
-            <scope>test</scope>
-        </dependency>
    </dependencies>

    <build>
-        <!-- CB-634: the cutover renamed the module dir (bridged/ -> fleetd/), the jar, and the
-         launchd plist together. The installed plist names fleetd/target/fleetd.jar and
-         KeepAlive is armed, so this name, the plist, and the wrapper must move as one. -->
-        <finalName>fleetd</finalName>
+        <finalName>bridged</finalName>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
@@ -233,7 +203,7 @@
                </configuration>
            </plugin>

-            <!-- Runnable fat jar: java -jar target/fleetd.jar -->
+            <!-- Runnable fat jar: java -jar target/bridged.jar -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-shade-plugin</artifactId>
@@ -0,0 +1,486 @@
+package dev.ltms.bridged;
+
+import dev.ltms.bridged.config.BridgedConfig;
+import dev.ltms.bridged.config.ConfigRef;
+import dev.ltms.bridged.config.ConfigWatcher;
+import dev.ltms.bridged.guard.SubscriptionGuard;
+import dev.ltms.bridged.herdr.AgentControl;
+import dev.ltms.bridged.herdr.HerdrClient;
+import dev.ltms.bridged.herdr.HerdrException;
+import dev.ltms.bridged.herdr.LeadTabScanner;
+import dev.ltms.bridged.lead.LeadLauncher;
+import dev.ltms.bridged.herdr.PaneLocator;
+import dev.ltms.bridged.herdr.UnixSocketHerdrClient;
+import dev.ltms.bridged.herdr.WorkspaceControl;
+import dev.ltms.bridged.inject.CompletionResolver;
+import dev.ltms.bridged.inject.Injector;
+import dev.ltms.bridged.inject.StatusPoller;
+import dev.ltms.bridged.inject.TurnListener;
+import dev.ltms.bridged.inject.MemberPresence;
+import dev.ltms.bridged.auth.MemberRegistry;
+import dev.ltms.bridged.auth.CallerResolver;
+import dev.ltms.bridged.mcp.BridgeMcp;
+import dev.ltms.bridged.mcp.ConnectionIdentity;
+import dev.ltms.bridged.metrics.BridgedMetrics;
+import dev.ltms.bridged.metrics.Metrics;
+import dev.ltms.bridged.mcp.PrimaryRegistry;
+import dev.ltms.bridged.mcp.LsofPeerPidLookup;
+import dev.ltms.bridged.mcp.LsofProcessCwdLookup;
+import dev.ltms.bridged.msg.AmqpReplyInbox;
+import dev.ltms.bridged.msg.InMemoryReplyInbox;
+import dev.ltms.bridged.msg.MessageService;
+import dev.ltms.bridged.msg.Rendezvous;
+import dev.ltms.bridged.msg.ReplyInbox;
+import dev.ltms.bridged.msg.LeadHeartbeatLoop;
+import dev.ltms.bridged.msg.ReplyPushLoop;
+import dev.ltms.bridged.rest.BridgedApp;
+import dev.ltms.bridged.session.GitWorktrees;
+import dev.ltms.bridged.session.SessionManager;
+import dev.ltms.bridged.peer.PeerLauncher;
+import dev.ltms.bridged.session.SessionReaper;
+import dev.ltms.bridged.member.ClaudeCodeLauncher;
+import dev.ltms.bridged.member.CompositePeerLauncher;
+import dev.ltms.bridged.member.HerdrPeerLauncher;
+import dev.ltms.bridged.member.OpenCodeLauncher;
+import io.javalin.Javalin;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Function;
+import java.util.function.Predicate;
+import java.util.function.Supplier;
+import java.util.stream.Collectors;
+
+/**
+ * {@code bridged} entry point. Wires the real herdr socket client to the REST app and
+ * starts listening. Before anything else it asserts its own environment is clean —
+ * {@code bridged} is not a Claude process and must never carry a base_url.
+ */
+public final class Bridged {
+
+    private static final Logger log = LoggerFactory.getLogger(Bridged.class);
+
+    /** CB-504: how long to wait at startup for herdr's socket before serving degraded. */
+    private static final long HERDR_WAIT_SECONDS = 30;
+    private static final long HERDR_WAIT_POLL_MILLIS = 500;
+
+    static void main(String[] args) {
+        Path configPath = Path.of(args.length > 0 ? args[0] : "bridged.yaml");
+        BridgedConfig cfg = BridgedConfig.load(configPath);
+        // CB-559: `cfg` stays the startup snapshot — every validation and every piece of one-time
+        // wiring below reads it, and must, because those decisions cannot be unmade. `config` is the
+        // live reference the hot paths read per use. Which keys can actually move is ConfigRef's
+        // contract; adding a reader here does not make a key reloadable by itself.
+        ConfigRef config = new ConfigRef(configPath, cfg);
+
+        // The primary/host env that launched bridged must not be tainted.
+        SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
+        guard.assertPrimaryClean(System.getenv());
+
+        // CB-501: refuse to start if the bind is wider than the auth mode can defend. Under
+        // loopback-trust, "not a known worker" means "the primary" — sound only because the OS
+        // refuses remote connections to a loopback socket. This throws rather than warns so the
+        // dangerous configuration cannot be reached by ignoring a log line.
+        cfg.validateAuthExposure();
+        cfg.validateLeadTabPrefixes();
+        // CB-542: a subscription:true profile whose env: reseats ANTHROPIC_BASE_URL/AUTH_TOKEN would
+        // reach an unguarded endpoint (the launcher skips SubscriptionGuard for it). Refuse at load.
+        cfg.validateSubscriptionProfiles();
+        cfg.validateCharters();
+        // CB-548: every architect slot must name a configured workers: profile — the strong-model
+        // backend the future spawn lifecycle would read. A stale reference dies here, not later.
+        cfg.validateMembers();
+
+        Path socket = cfg.herdrSocket() != null && !cfg.herdrSocket().isBlank()
+                ? Path.of(cfg.herdrSocket())
+                : UnixSocketHerdrClient.defaultSocketPath();
+
+        UnixSocketHerdrClient herdr = UnixSocketHerdrClient.connect(socket, new com.fasterxml.jackson.databind.ObjectMapper());
+
+        AgentControl agents = new AgentControl(herdr);
+        WorkspaceControl spaces = new WorkspaceControl(herdr);
+        // CB-402: one adapter per configured peer kind, fronted by a composite router. A profile's
+        // `kind:` selects its adapter — claude-code (the default) and opencode partition the profile
+        // set — and the composite dispatches each SPI call to the adapter that owns the profile/pane.
+        Map<String, BridgedConfig.Profile> claudeProfiles = new LinkedHashMap<>();
+        Map<String, BridgedConfig.Profile> opencodeProfiles = new LinkedHashMap<>();
+        cfg.profiles().forEach((name, w) -> {
+            if (w.isOpenCode()) {
+                opencodeProfiles.put(name, w);
+            } else {
+                claudeProfiles.put(name, w);
+            }
+        });
+        List<HerdrPeerLauncher> adapters = new ArrayList<>();
+        // The claude-code adapter is the always-present default; keep it even with no profiles (so a
+        // bridge configured with no workers, or opencode-only, still has a well-defined base adapter)
+        // unless opencode is the only kind configured.
+        if (!claudeProfiles.isEmpty() || opencodeProfiles.isEmpty()) {
+            adapters.add(new ClaudeCodeLauncher(agents, spaces, guard,
+                    claudeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
+                    cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
+                    () -> config.get().fleet().tabLabel()));
+        }
+        if (!opencodeProfiles.isEmpty()) {
+            adapters.add(new OpenCodeLauncher(agents, spaces,
+                    opencodeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
+                    cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
+                    () -> config.get().fleet().tabLabel()));
+        }
+        AtomicReference<Function<String, Integer>> liveCountRef = new AtomicReference<>(_ -> 0);
+        PeerLauncher workers = new CompositePeerLauncher(
+                adapters,
+                cfg.effectiveDefaultProfile(),
+                config,
+                profileName -> liveCountRef.get().apply(profileName));
+        // CB-504: under supervision (launchd/systemd) bridged can start before herdr's socket
+        // exists. The client itself is lazy — it connects per call — but the orphan reap below is
+        // the first thing that actually talks to herdr, so without this wait a boot-order race
+        // would crash the daemon into a restart loop. Wait, then degrade rather than die: serving
+        // with /healthz reporting "degraded" is strictly more useful than exiting.
+        boolean herdrUp = awaitHerdr(herdr);
+        if (herdrUp) {
+            // CB-117: herdr keeps worker panes alive across a daemon restart, and their ids died
+            // with the previous process — reap those leaked orphans now, before we start serving.
+            workers.reapOrphanWorkers();
+        } else {
+            log.warn("herdr did not answer within {}s — starting anyway; /healthz will report "
+                    + "degraded until it comes up. Orphaned worker panes (if any) were NOT reaped.",
+                    HERDR_WAIT_SECONDS);
+        }
+
+        // CB-301: authoritative session registry + lifecycle FSM on top of ClaudeCodeLauncher.
+        // CB-301-ext: worktree provisioning seam, optionally rooted at a configured directory.
+        // CB-303 part 2: context cap is opt-in and disabled (0) when absent/null.
+        int contextCap = 0;
+        if (cfg.lifecycle() != null && cfg.lifecycle().contextCap() != null
+                && cfg.lifecycle().contextCap() > 0) {
+            contextCap = cfg.lifecycle().contextCap();
+        }
+        boolean clearAfterTurn = cfg.lifecycle() != null && cfg.lifecycle().clearAfterTurn();
+        SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot()),
+                System::nanoTime, contextCap, clearAfterTurn);
+        liveCountRef.set(profileName -> (int) sessions.roster().stream()
+                .filter(s -> profileName.equals(s.profile()))
+                .count());
+
+        // CB-303 part 1: idle-ttl reaper — only when configured, defaults to disabled.
+        final SessionReaper reaper;
+        if (cfg.lifecycle() != null
+                && cfg.lifecycle().idleTtlSeconds() != null
+                && cfg.lifecycle().idleTtlSeconds() > 0) {
+            reaper = new SessionReaper(sessions, cfg.lifecycle().idleTtlSeconds());
+            reaper.start();
+        } else {
+            reaper = null;
+        }
+
+        // CB-530: every pane the config names as a lead, merged from `leaders:` and the legacy
+        // singular pin. PrimaryRegistry below still tracks ONE terminal — it addresses the push
+        // loop's nudges, which need a single destination — so it keeps the legacy pin.
+        Map<String, String> leadTerminals = cfg.leaderTerminals();
+        if (leadTerminals.size() > 1) {
+            log.info("leads: {} panes recognised {}", leadTerminals.size(), leadTerminals.values());
+        }
+        // CB-531: on top of the static registry, discover leads by the tab labels the operator
+        // writes. CB-557 moved the settings onto the lead they describe, so scanning is on whenever
+        // a `fleet.leaders:` entry exists — with no leads configured the supplier is a constant and
+        // never touches herdr, exactly as a missing `leadScan:` block used to behave.
+        final Supplier<Map<String, String>> leads;
+        var leaders = cfg.fleet().leaders();
+        if (!leaders.isEmpty()) {
+            // One scanner, so one prefix and one interval. Distinct per-lead prefixes would need a
+            // scanner each; until a config actually wants that, take the first entry's settings and
+            // say so, rather than silently honouring one lead's prefix and dropping another's.
+            var scan = leaders.values().iterator().next();
+            Set<String> memberSpaces = cfg.profiles().values().stream()
+                    .map(BridgedConfig.Profile::workspace)
+                    .filter(Objects::nonNull)
+                    .collect(Collectors.toSet());
+            leads = new LeadTabScanner(herdr, scan.tabPrefix(), memberSpaces, leadTerminals,
+                    TimeUnit.SECONDS.toNanos(scan.scanIntervalSeconds()), System::nanoTime);
+            log.info("lead scan: tabs labelled '{}…' host a lead (rescan every {}s, member spaces {} "
+                            + "excluded)",
+                    scan.tabPrefix(), scan.scanIntervalSeconds(), memberSpaces);
+            long distinctPrefixes = leaders.values().stream()
+                    .map(BridgedConfig.Leader::tabPrefix).distinct().count();
+            if (distinctPrefixes > 1) {
+                log.warn("fleet.leaders declares {} different tabPrefix values; only '{}' is scanned "
+                                + "for. Give every lead the same tabPrefix, or leads under the others "
+                                + "will not be discovered.",
+                        distinctPrefixes, scan.tabPrefix());
+            }
+        } else {
+            leads = () -> leadTerminals;
+        }
+
+        // CB-558: start any declared lead that is not already running. After the scanner is built,
+        // because both read the same tab labels and the ordering makes that dependency visible; and
+        // only when herdr answered, because the launcher's whole safety property is that it can
+        // count live leads first — it must never guess and risk a second orchestrator.
+        if (herdrUp && !leaders.isEmpty()) {
+            int launched = new LeadLauncher(agents, spaces, cfg).ensureLeads();
+            if (launched > 0) {
+                log.info("lead auto-launch: {} lead(s) started", launched);
+            }
+        }
+
+        // CB-548: config-declared architect slots. Config supplies only the stable name → profile
+        // map; the terminal → slot binding is owned by the registry and is empty at startup, so no
+        // pane resolves to an architect until the later spawn lifecycle binds one. The registry is
+        // what CallerResolver resolves against and what that lifecycle will read profiles from;
+        // nothing here spawns a slot.
+        MemberRegistry members = new MemberRegistry(cfg.fleet());
+        sessions.setMemberLifecycle(members);
+        if (!members.slots().isEmpty()) {
+            log.info("member slots: {} configured {} — none bound yet (a slot is idle until the "
+                            + "spawn lifecycle binds a live terminal to it)",
+                    members.slots().size(), members.slots().keySet());
+        }
+
+        // Status-gated injector (CB-103): the single writer into workers, fed by a poller.
+        // The blocking message endpoint (CB-104) is the producer; the poller is inert until then.
+        // CB-106: a confirmed turn completion resolves a blocked send whose worker never replied.
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver completion = new CompletionResolver(agents, rendezvous);
+        // CB-113: deliver only to an available worker (its MCP is connected), never its boot window.
+        // CB-301: the manager's presence bridge records availability and drives SPAWNING → READY.
+        MemberPresence presence = sessions.asPresence();
+        TurnListener turnListener = new TurnListener() {
+            @Override
+            public void onTurnComplete(String target) {
+                completion.onTurnComplete(target);
+                sessions.onTurnComplete(target);
+            }
+
+            @Override
+            public boolean hasPostTurnAction(String target) {
+                return sessions.hasPostTurnAction(target);
+            }
+
+            @Override
+            public boolean onTurnCompleteWithPostAction(String target) {
+                completion.resolveBeforePostAction(target);
+                return sessions.onTurnCompleteWithPostAction(target);
+            }
+
+            @Override
+            public void onDelivered(String target) {
+                completion.onDelivered(target);
+                sessions.onDelivered(target);
+            }
+
+            @Override
+            public void onTurnFailed(String target) {
+                completion.onTurnFailed(target);
+                sessions.onTurnFailed(target);
+            }
+        };
+        Injector injector = new Injector(agents, turnListener, deliverableTo(presence, leads),
+                presence::forget);
+        StatusPoller poller = new StatusPoller(agents, injector, Injector.POLL_INTERVAL_MILLIS);
+        poller.start();
+
+        // CB-307: reply inbox. A broker: block (with a uri) selects the AMQP-backed durable adapter;
+        // absent, bridged stays soft-state on the in-memory inbox. The AMQP inbox owns a broker
+        // connection, so keep the reference to close it in the ordered shutdown hook.
+        final ReplyInbox replyInbox;
+        if (cfg.broker() != null && cfg.broker().isConfigured()) {
+            replyInbox = AmqpReplyInbox.open(cfg.broker().uri());
+            log.info("reply inbox: AMQP broker (durable) at {}", cfg.broker().uri());
+        } else {
+            replyInbox = new InMemoryReplyInbox();
+            log.info("reply inbox: in-memory (soft-state)");
+        }
+        // CB-307: learn the primary's terminal from orchestration tool calls (or pin from config).
+        // The pin also feeds CallerResolver below: a primary running inside a herdr pane would
+        // otherwise resolve as a worker and be refused every orchestration tool.
+        String pinnedPrimaryTerminal = cfg.primary() != null ? cfg.primary().terminal() : null;
+        PrimaryRegistry primaryRegistry = new PrimaryRegistry(pinnedPrimaryTerminal);
+        // CB-532: `primary.terminal` is superseded and no longer needed for either of its jobs —
+        // identity comes from `leaders:`/`leadScan:`, and reply nudges now follow the delegating
+        // lead. Say so once at startup rather than leaving a redundant pin to look load-bearing.
+        if (pinnedPrimaryTerminal != null && !pinnedPrimaryTerminal.isBlank()) {
+            log.warn("primary.terminal is DEPRECATED (CB-532) and can be deleted: identity now comes "
+                    + "from leaders:/leadScan:, and reply nudges follow the lead that delegated. "
+                    + "It still works, and is still the fallback nudge destination when a restart "
+                    + "has lost the delegation map. Its pushReminders/pushBackoffMs stay valid.");
+        }
+        // CB-307: active push-to-primary loop — nudge the primary when replies land without an
+        // open bridge_send. Uses its own lightweight scheduled executor, separate from the injector.
+        int maxReminders = cfg.primary() != null ? cfg.primary().remindersOrDefault() : 5;
+        long backoffMs = cfg.primary() != null ? cfg.primary().backoffMsOrDefault() : 15_000L;
+        var pushScheduler = Executors.newSingleThreadScheduledExecutor(r ->
+                Thread.ofVirtual().name("bridge-push-").unstarted(r));
+        // CB-502: the registry is built before the service and the push loop so send/reply outcomes
+        // are counted at their single funnel rather than at each of the two caller-facing surfaces.
+        // CB-512: the push loop takes it too, so nudge outcomes (delivered|exhausted) are counted.
+        Metrics metrics = BridgedMetrics.create(sessions, replyInbox);
+        var pushLoop = new ReplyPushLoop(primaryRegistry, agents, replyInbox,
+                pushScheduler, maxReminders, backoffMs, metrics);
+        // CB-551: idle-lead heartbeat. Opt-in; absent `leadHeartbeat:` this is never constructed, so
+        // an upgraded daemon cannot silently start spending subscription on nudging an idle lead.
+        // It has its own single-thread scheduler and holds its own scheduler shutdown via close().
+        final LeadHeartbeatLoop heartbeat;
+        var heartbeatScheduler = Executors.newSingleThreadScheduledExecutor(r ->
+                Thread.ofVirtual().name("bridge-heartbeat-").unstarted(r));
+        if (cfg.leadHeartbeat() != null) {
+            var hb = cfg.leadHeartbeat();
+            heartbeat = new LeadHeartbeatLoop(primaryRegistry, agents, replyInbox, sessions::roster,
+                    pushLoop, heartbeatScheduler, System::nanoTime,
+                    TimeUnit.SECONDS.toNanos(hb.idleAfterSeconds()), hb.backoffMs(), hb.quietNudgeCap(),
+                    metrics);
+            heartbeat.start();
+        } else {
+            heartbeat = null;
+            heartbeatScheduler.shutdownNow();
+        }
+        MessageService messages = new MessageService(agents, injector, rendezvous, replyInbox,
+                pushLoop, metrics);
+
+        // CB-520: the reply inbox only consumes for agents this gateway owns. own on acquire,
+        // release on teardown. Do this before CB-516 so the inbox is owned before any reply can land.
+        sessions.onAcquire(replyInbox::own);
+        // CB-516: releasing a worker must fail whatever send was waiting on it. Without this a
+        // torn-down delegation kept reporting PENDING until the 30-minute async timeout, and never
+        // reached /metrics — the delegation was unresolvable and nothing said so.
+        sessions.onRelease(terminal -> {
+            messages.abandon(terminal, "the worker session was released before it replied");
+            replyInbox.release(terminal);
+            primaryRegistry.forgetDelegation(terminal); // CB-532: don't leak the lead binding
+        });
+
+        // MCP server face (CB-105): bridge_send/bridge_reply/bridge_status, mounted at /mcp.
+        // Caller identity is resolved from the connection (peer PID → herdr pane), not arguments.
+        ConnectionIdentity identity = new ConnectionIdentity(
+                new PaneLocator(herdr), new LsofPeerPidLookup(), new LsofProcessCwdLookup());
+
+        // CB-501: one resolver behind both entry paths. Worker identity still comes from the
+        // connection and is never token-gated, so enabling token mode cannot lock the fleet out.
+        final CallerResolver callers;
+        if (cfg.auth().tokenMode()) {
+            String token = System.getenv(cfg.auth().tokenEnv());
+            if (token == null || token.isBlank()) {
+                throw new IllegalStateException("auth.mode=token but env var " + cfg.auth().tokenEnv()
+                        + " is unset or empty — export it before starting bridged");
+            }
+            callers = CallerResolver.withLeadsAndMembers(identity, true, token, leads, members);
+            log.info("auth: token mode (bearer required for non-worker callers, env {})",
+                    cfg.auth().tokenEnv());
+        } else {
+            callers = CallerResolver.withLeadsAndMembers(identity, false, null, leads, members);
+            log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
+        }
+
+        BridgeMcp mcp = new BridgeMcp(messages, workers, sessions, identity, presence,
+                primaryRegistry, callers, metrics);
+
+        // CB-559: opt-in config reload. With no `configReload:` block nothing is constructed, so an
+        // upgraded daemon behaves exactly as before — the file is read once at boot and never again.
+        final ConfigWatcher configWatcher;
+        if (cfg.configReload() != null && cfg.configReload().isEnabled()) {
+            configWatcher = new ConfigWatcher(config, cfg.configReload().intervalSeconds());
+            configWatcher.start();
+        } else {
+            configWatcher = null;
+        }
+
+        // CB-303 part 3: single ordered shutdown hook. Drain sessions first while herdr is still
+        // open (so releases reach the daemon), then stop poller/message/mcp/reaper, and close herdr
+        // last. This replaces the earlier independent hooks that could race and close herdr early.
+        Runtime.getRuntime().addShutdownHook(new Thread(() -> {
+            sessions.close(cfg.lifecycle() != null ? cfg.lifecycle().drainTimeoutSeconds() : null);
+            poller.stop();
+            messages.close();
+            pushLoop.close();
+            if (heartbeat != null) heartbeat.close(); // CB-551: stop the idle-lead heartbeat scheduler
+            if (configWatcher != null) configWatcher.stop(); // CB-559: stop polling the config file
+            mcp.close();
+            if (reaper != null) reaper.stop();
+            // Release the broker connection last among message resources (no-op for the in-memory inbox).
+            if (replyInbox instanceof AutoCloseable closeable) {
+                try {
+                    closeable.close();
+                } catch (Exception e) {
+                    log.debug("reply inbox close: {}", e.toString());
+                }
+            }
+            herdr.close();
+        }));
+
+        Javalin app = new BridgedApp(herdr, workers, sessions, messages, presence, mcp.servlet(),
+                callers, metrics).build();
+        app.start(cfg.bind().host(), cfg.bind().port());
+        log.info("bridged listening on {}:{}, herdr socket {}",
+                cfg.bind().host(), cfg.bind().port(), socket);
+    }
+
+    /**
+     * The {@link Injector}'s readiness gate (CB-534): a target is deliverable if it is a spawned
+     * member whose agent has connected the bridge MCP, <em>or</em> a lead.
+     *
+     * <p>The gate exists for one reason — to hold a delivery out of a <em>spawned</em> member's boot
+     * window, where herdr already reports {@code idle} but the TUI would drop an injected paste. That
+     * hazard is a property of spawning. A lead is never spawned: the operator started it and named it
+     * (or labelled its tab) only once it was up, so there is no boot window to guard.
+     *
+     * <p>A lead is also never enrolled in {@link MemberPresence} — {@code BridgeMcp} marks presence
+     * for every spawned member (worker and architect), deliberately, since that map doubles as the
+     * member roster's availability signal and a lead counted there would show up as an available
+     * member. So without the second disjunct a lead is permanently un-deliverable: every
+     * lead→lead send sat on the gate for {@code READINESS_GRACE_POLLS} (~60s) and then failed
+     * having never been typed into the pane.
+     *
+     * <p>The lead set is read through the supplier on each call rather than snapshotted, so a lead
+     * discovered by {@code leadScan} after startup becomes deliverable without a restart.
+     */
+    static Predicate<String> deliverableTo(MemberPresence presence, Supplier<Map<String, String>> leads) {
+        return target -> presence.isPresent(target) || leads.get().containsKey(target);
+    }
+
+    /**
+     * Poll herdr's {@code ping} until it answers or {@link #HERDR_WAIT_SECONDS} elapses (CB-504).
+     *
+     * @return true if herdr answered, false if it never did
+     */
+    private static boolean awaitHerdr(HerdrClient herdr) {
+        long deadline = System.nanoTime() + HERDR_WAIT_SECONDS * 1_000_000_000L;
+        boolean waited = false;
+        while (true) {
+            try {
+                herdr.call("ping");
+                if (waited) {
+                    log.info("herdr is up");
+                }
+                return true;
+            } catch (HerdrException e) {
+                if (System.nanoTime() >= deadline) {
+                    return false;
+                }
+                if (!waited) {
+                    log.info("waiting up to {}s for the herdr socket…", HERDR_WAIT_SECONDS);
+                    waited = true;
+                }
+                try {
+                    Thread.sleep(HERDR_WAIT_POLL_MILLIS);
+                } catch (InterruptedException ie) {
+                    Thread.currentThread().interrupt();
+                    return false;
+                }
+            }
+        }
+    }
+
+    private Bridged() {
+    }
+}
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.auth;
+package dev.ltms.bridged.auth;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -1,9 +1,9 @@
-package dev.ltms.fleet.auth;
+package dev.ltms.bridged.auth;

 /**
 * The authorization table (CB-505), stated once and enforced on both entry paths.
 *
- * <p>Most of these rules are already true de facto — {@code FleetMcp} derives a worker's identity
+ * <p>Most of these rules are already true de facto — {@code BridgeMcp} derives a worker's identity
 * from the connection rather than reading it from an argument, so a worker has never been able to
 * reply <em>as</em> another worker over MCP. What was missing is that the REST surface trusted the
 * session id in the URL path, and neither surface checked role at all. This class makes the
@@ -1,7 +1,7 @@
-package dev.ltms.fleet.auth;
+package dev.ltms.bridged.auth;

-import dev.ltms.fleet.mcp.ConnectionIdentity;
-import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.bridged.mcp.ConnectionIdentity;
+import dev.ltms.bridged.peer.MemberRole;

 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
@@ -12,7 +12,7 @@ import java.util.function.Supplier;
 /**
 * Resolves every caller to a {@link Principal}, for both entry paths into the core (CB-501).
 *
- * <p>There are two of them and they are not layered the way the docs suggest: {@code FleetMcp}
+ * <p>There are two of them and they are not layered the way the docs suggest: {@code BridgeMcp}
 * calls the service layer directly and is mounted as a raw servlet (so it never passes through a
 * Javalin filter), while the REST routes historically resolved no identity at all. Both now
 * delegate here, so the authorization rules are stated once instead of drifting apart.
@@ -59,7 +59,7 @@ public final class CallerResolver {
     * <p>Like {@link #leadTerminals}, a supplier rather than a fixed map, so a binding injected
     * after startup — when the later spawn lifecycle establishes a live architect session, or an
     * operator pins one — takes effect without a restart. Consulted per resolve; today's wiring
-     * in {@code Fleetd} reads a constant from config, which is the degenerate live case.
+     * in {@code Bridged} reads a constant from config, which is the degenerate live case.
     */
    private final Supplier<Map<String, String>> architectTerminals;
    private final Function<String, MemberRole> memberSlotRoles;
@@ -235,16 +235,8 @@ public final class CallerResolver {

        // loopback-trust: same-host callers that are not workers are the primary. A non-loopback
        // caller is anonymous even here — and startup refuses that combination anyway
-        // (FleetConfig.validateAuthExposure), so this is defence in depth, not the control.
-        //
-        // fleetd #317: "not a worker" must not be conflated with "identity unresolved". The real
-        // primary is a real process — its pid resolves (c.resolved()), it just owns no herdr pane.
-        // A caller whose peer-PID lookup failed (LsofPeerPidLookup's -1 sentinel — on any failure,
-        // silently including "lsof found no match") has no such pid, and PaneLocator's own javadoc
-        // already names what happens if that case is handed the primary role: a worker→primary
-        // escalation. So an unresolved caller is refused (ANONYMOUS — the same clean, already-tested
-        // "authenticated as nothing" outcome used everywhere else in this method), never promoted.
-        return isLoopback(remoteAddr) && c.resolved() ? Principal.primary(c.pid()) : Principal.anonymous();
+        // (BridgedConfig.validateAuthExposure), so this is defence in depth, not the control.
+        return isLoopback(remoteAddr) ? Principal.primary(c.pid()) : Principal.anonymous();
    }

    private boolean presentedTokenMatches(String authorizationHeader) {
@@ -270,15 +262,11 @@ public final class CallerResolver {
        return token.isEmpty() ? null : token;
    }

-    /**
-     * fleetd #305: delegates to {@link ConnectionIdentity#isLoopback}. This used to be a second,
-     * independent copy of the same rule, and the two drifted: this one accepted all of
-     * {@code 127.0.0.0/8}, {@code ConnectionIdentity}'s accepted only {@code 127.0.0.1}. A caller
-     * from {@code 127.0.0.2} therefore had its identity skipped (so it had no terminal) and was
-     * then read as loopback here — which under loopback-trust is the primary. Sharing the inputs
-     * would not have prevented that; only sharing the computation does.
-     */
    private static boolean isLoopback(String remoteAddr) {
-        return ConnectionIdentity.isLoopback(remoteAddr);
+        if (remoteAddr == null) {
+            return false;
+        }
+        return remoteAddr.equals("127.0.0.1") || remoteAddr.equals("::1")
+                || remoteAddr.equals("0:0:0:0:0:0:0:1") || remoteAddr.startsWith("127.");
    }
 }
@@ -0,0 +1,21 @@
+package dev.ltms.bridged.auth;
+
+import dev.ltms.bridged.peer.MemberRole;
+
+/** Optional session lifecycle hook for live member-slot bindings. */
+public interface MemberLifecycle {
+
+    MemberLifecycle NONE = new MemberLifecycle() {
+        @Override
+        public void acquired(MemberRole role, String profile, String terminal) {
+        }
+
+        @Override
+        public void released(String terminal) {
+        }
+    };
+
+    void acquired(MemberRole role, String profile, String terminal);
+
+    void released(String terminal);
+}
@@ -1,14 +1,13 @@
-package dev.ltms.fleet.auth;
+package dev.ltms.bridged.auth;

-import dev.ltms.fleet.config.FleetConfig;
-import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.bridged.config.BridgedConfig;
+import dev.ltms.bridged.peer.MemberRole;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

 import java.util.Collections;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
-import java.util.List;
 import java.util.Map;
 import java.util.Objects;

@@ -56,13 +55,11 @@ public final class MemberRegistry implements MemberLifecycle {
    }

    private final Map<String, Entry> slots;
-    /** Live {@code terminal_id → qualified slot key}; guarded by {@code terminalToSlot}. */
+    /** Live {@code terminal_id → qualified slot key}; guarded by {@code this}. */
    private final Map<String, String> terminalToSlot = new HashMap<>();
-    /** Slot keys held between reservation and the terminal binding. Guarded by terminalToSlot. */
-    private final java.util.Set<String> reservedSlots = new java.util.HashSet<>();

    /** Flatten every role pool in {@code fleet} into one registry. Leaders are not members. */
-    public MemberRegistry(FleetConfig.Fleet fleet) {
+    public MemberRegistry(BridgedConfig.Fleet fleet) {
        Map<String, Entry> flat = new LinkedHashMap<>();
        if (fleet != null) {
            for (MemberRole role : MemberRole.values()) {
@@ -97,7 +94,7 @@ public final class MemberRegistry implements MemberLifecycle {
     * An immutable copy of the live {@code terminal_id → slot name} bindings.
     *
     * <p>Passed to {@link CallerResolver} as the source of architect identity, and what
-     * {@code fleet_whoami}/the roster will read to say which slot a pane hosts. Empty until the
+     * {@code bridge_whoami}/the roster will read to say which slot a pane hosts. Empty until the
     * spawn lifecycle binds a slot.
     */
    public Map<String, String> snapshot() {
@@ -169,7 +166,7 @@ public final class MemberRegistry implements MemberLifecycle {
            if (existingSlot != null) {
                return slot.equals(existingSlot); // already this slot (idempotent) or a different one
            }
-            if (terminalToSlot.containsValue(slot) || reservedSlots.contains(slot)) {
+            if (terminalToSlot.containsValue(slot)) {
                return false; // slot already hosts a terminal — no second one
            }
            terminalToSlot.put(terminal, slot);
@@ -209,116 +206,19 @@ public final class MemberRegistry implements MemberLifecycle {
     *
     * <p>The role check is lifecycle policy. {@link CallerResolver} repeats it when resolving a
     * binding, so a later lifecycle regression cannot turn a worker into an architect.
-     *
-     * <p>CB-619 / fleetd #123: the return value is the role this session actually holds, and the
-     * caller is required to record THAT — never the requested {@code role} — on the session. Before
-     * this fix the caller kept the requested role regardless of whether the bind below succeeded, so
-     * a demoted session's {@code GET /members} row still said {@code "architect"} while
-     * {@code fleet_whoami} (which reads the live binding, not the request) correctly said
-     * {@code "worker"} — three sources of truth that disagreed about one live member, silently.
     */
    @Override
-    public MemberRole acquired(MemberRole role, String profile, String terminal) {
+    public void acquired(MemberRole role, String profile, String terminal) {
        if (role != MemberRole.ARCHITECT || terminal == null || terminal.isBlank()) {
-            return role;
+            return;
        }
        // slotsFor preserves definition order, so duplicate-profile slots use the first free one.
        for (Entry entry : slotsFor(MemberRole.ARCHITECT).values()) {
            if (Objects.equals(profile, entry.profile()) && bind(entry.key(), terminal)) {
-                return MemberRole.ARCHITECT;
-            }
-        }
-        // fleetd #123: at least WARN — a role downgrade that the roster must now also reflect is
-        // not routine bookkeeping. requireSlotFor already refuses the config-gap case (no slot at
-        // all carries this profile) before a process ever spawns; reaching here means the config DID
-        // carry a matching slot but every one of them was already bound to a different terminal — a
-        // race this pre-spawn check cannot close on its own (see requireSlotFor's javadoc).
-        log.warn("member slot: no free architect slot for profile={} terminal={}; holding the session "
-                + "as {} instead of the architect it asked for — every configured slot for this "
-                + "profile is already bound to a different terminal", profile, terminal,
-                MemberRole.DEV.wireName());
-        return MemberRole.DEV;
-    }
-
-    /**
-     * CB-619 / fleetd #123: refuse an architect acquire before anything spawns when no configured
-     * slot carries {@code profile} — the config-gap case from the original defect report (a spawn
-     * asked for {@code role=architect, profile=sonnet}, and {@code fleet.architects} carried only
-     * {@code opus} and {@code sol}). A dev/reviewer acquire is always a no-op: those pools are
-     * placement candidates only (see {@code CompositePeerLauncher}), never a live identity binding,
-     * so there is nothing here to refuse — an explicit profile outside the pool for those roles is a
-     * documented operator override, not a defect.
-     *
-     * <p>This closes the config-gap case, not the live-capacity case: a profile that DOES carry a
-     * slot can still lose the race to a concurrent spawn between this check and the actual
-     * {@link #bind}, which is why {@link #acquired} must still answer honestly even after this
-     * check has passed.
-     */
-    @Override
-    public void requireSlotFor(MemberRole role, String profile) {
-        if (role != MemberRole.ARCHITECT) {
-            return;
-        }
-        boolean hasSlot = slotsFor(MemberRole.ARCHITECT).values().stream()
-                .anyMatch(e -> Objects.equals(profile, e.profile()));
-        if (hasSlot) {
-            return;
-        }
-        List<String> pools = slotsFor(MemberRole.ARCHITECT).values().stream()
-                .map(Entry::profile)
-                .distinct()
-                .toList();
-        throw new IllegalArgumentException(
-                "no " + role.wireName() + " slot for profile '" + profile + "' — an architect's "
-                        + "identity IS the slot it is bound to, so there is nothing to bind this "
-                        + "session's identity to. fleet." + role.configKey() + " carries profiles: "
-                        + (pools.isEmpty() ? "(none configured)" : String.join(", ", pools))
-                        + "; add profile '" + profile + "' there, or spawn " + role.wireName()
-                        + " on one of those profiles instead");
-    }
-
-    @Override
-    public SlotReservation reserve(MemberRole role, String profile) {
-        if (role != MemberRole.ARCHITECT) {
-            return null;
-        }
-        synchronized (terminalToSlot) {
-            for (Entry entry : slotsFor(MemberRole.ARCHITECT).values()) {
-                if ((profile == null || profile.isBlank() || Objects.equals(profile, entry.profile()))
-                        && !terminalToSlot.containsValue(entry.key()) && reservedSlots.add(entry.key())) {
-                    return new SlotReservation(entry.key(), entry.profile());
-                }
-            }
-        }
-        throw new IllegalArgumentException("no free architect slot for profile '" + profile
-                + "' — every matching slot is already bound or reserved");
-    }
-
-    @Override
-    public boolean bind(SlotReservation reservation, String terminal) {
-        if (reservation == null || terminal == null || terminal.isBlank()) {
-            return false;
-        }
-        synchronized (terminalToSlot) {
-            if (!reservedSlots.remove(reservation.slot())) {
-                return false;
-            }
-            if (!isSlot(reservation.slot()) || terminalToSlot.containsKey(terminal)
-                    || terminalToSlot.containsValue(reservation.slot())) {
-                return false;
-            }
-            terminalToSlot.put(terminal, reservation.slot());
-            return true;
-        }
-    }
-
-    @Override
-    public void release(SlotReservation reservation) {
-        if (reservation != null) {
-            synchronized (terminalToSlot) {
-                reservedSlots.remove(reservation.slot());
+                return;
            }
        }
+        log.info("member slot: no free architect slot for profile={}; session remains a worker", profile);
    }

    /** Unbind a released terminal using the compare-safe registry operation. */
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.auth;
+package dev.ltms.bridged.auth;

 /**
 * A resolved caller: its {@link Role}, and — for a worker — the herdr {@code terminal_id} that
@@ -39,14 +39,14 @@ public record Principal(Role role, String terminal, long pid, String name) {
     *
     * <p>Carries {@link Role#PRIMARY}: a lead <em>is</em> a primary as far as authorization goes,
     * so every existing {@code isPrimary()} gate keeps working unchanged and the role table needed
-     * no new entry. The name is reporting only — it lets {@code fleet_whoami} say <em>which</em>
+     * no new entry. The name is reporting only — it lets {@code bridge_whoami} say <em>which</em>
     * lead is asking once more than one is configured.
     *
     * <p><strong>CB-532: a lead now carries the terminal it was matched by.</strong> Under CB-530 it
     * deliberately did not, because {@code terminal} meant "which worker pane" everywhere and a
     * non-null one would have enrolled the lead in the worker presence map. That reading was what
     * made a lead unaddressable: {@link #ownsSession} could never be true for it, so
-     * {@code fleet_reply} was refused and one lead could send to another but never be answered.
+     * {@code bridge_reply} was refused and one lead could send to another but never be answered.
     * The terminal now means "which pane is this caller", the presence map keys on
     * {@link #isSpawnedMember()} instead, and a lead is a peer that can both send and receive.
     */
@@ -63,7 +63,7 @@ public record Principal(Role role, String terminal, long pid, String name) {
     * An architect (CB-548), identified by the slot it occupies and the pane bound to it.
     *
     * <p>Carries {@link Role#ARCHITECT}. {@code slotName} is reporting only — it lets
-     * {@code fleet_whoami} say <em>which</em> architect slot is asking, and it is the key the
+     * {@code bridge_whoami} say <em>which</em> architect slot is asking, and it is the key the
     * (future) spawn lifecycle reads a profile back from. Identity is the {@code terminal}: like a
     * worker's it comes from the connection and the live terminal→slot binding, so
     * {@code ownsSession} works exactly as it does for a worker — an architect acts as its own
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.auth;
+package dev.ltms.bridged.auth;

 /**
 * What a caller is allowed to be on the bus (CB-501).
@@ -0,0 +1,270 @@
+package dev.ltms.bridged.config;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
+import java.util.concurrent.atomic.AtomicReference;
+import java.util.function.Supplier;
+
+/**
+ * The daemon's live configuration, re-readable without a restart (CB-559).
+ *
+ * <p>Consumers hold this, not a {@link BridgedConfig}, and read through {@link #get()} at the point
+ * of use. A component that captures {@code ref.get()} into a field at construction has opted out of
+ * reload — which is sometimes right (see <em>deferred</em> below), but it must then be a deliberate
+ * choice rather than an accident of where the field was initialised.
+ *
+ * <h2>Not every key can change under a running daemon</h2>
+ * Keys fall into three classes, and the difference is about what already exists when the reload
+ * happens — not about how important the key is.
+ *
+ * <ul>
+ *   <li><strong>Hot</strong> — re-read per use, so a reload takes effect on the next spawn:
+ *       {@code fleet:} (every role pool, {@code charters}, and {@code tabLabel}),
+ *       {@code placement:}, and an existing profile's {@code weight} / {@code maxLoad}. Those three are read through a supplier on
+ *       {@code CompositePeerLauncher}, which is what makes them hot — not the fact that they are
+ *       config.</li>
+ *   <li><strong>Deferred</strong> — accepted into the new snapshot, but the wiring built at startup
+ *       keeps the old value until a restart: {@code lifecycle:}, {@code leadHeartbeat:},
+ *       {@code spawnReadyTimeoutMs} / {@code spawnReadyPollMs}, {@code guard:},
+ *       {@code worktreeRoot:}, adding or removing a profile (a new backend needs its own launcher,
+ *       which is constructed once), <em>and an existing profile's launch settings</em> —
+ *       {@code model}, {@code baseUrl}, {@code argv}, {@code env}, {@code mcpUrl} and the rest.
+ *       {@code HerdrPeerLauncher} takes {@code Map.copyOf(profiles)} at construction and resolves
+ *       each spawn out of that copy, so those never reach a launch until the daemon restarts. A
+ *       reload logs these rather than pretending they applied.</li>
+ *   <li><strong>Cold</strong> — cannot change at all under a running daemon: {@code bind:},
+ *       {@code herdrSocket:}, {@code broker:} and {@code auth:}. The socket is bound, the broker
+ *       connection is open, and the auth mode decides who may reach the port that is already
+ *       listening.</li>
+ * </ul>
+ *
+ * <p><strong>A cold change refuses the whole reload.</strong> Not the hot half applied and the cold
+ * half warned about: that would leave the running daemon in a state matching no file on disk, which
+ * is the worst thing a reload can do to an operator debugging one. Refusing keeps the invariant that
+ * the live config is always some version of the file, and the message names the keys that must
+ * change through a restart.
+ *
+ * <p>A reload that fails to parse or fails validation is also refused, and the previous config keeps
+ * running. A config file being edited is normally read once mid-save; degrading a working daemon
+ * because it caught a half-written file would be a bad trade.
+ */
+public final class ConfigRef implements Supplier<BridgedConfig> {
+
+    private static final Logger log = LoggerFactory.getLogger(ConfigRef.class);
+
+    /** Keys that cannot change under a running daemon — see the class doc. */
+    private static final Set<String> COLD_KEYS =
+            Set.of("bind", "herdrSocket", "broker", "auth");
+
+    private final Path path;
+    private final AtomicReference<BridgedConfig> current;
+
+    public ConfigRef(Path path, BridgedConfig initial) {
+        this.path = path;
+        this.current = new AtomicReference<>(Objects.requireNonNull(initial, "initial config"));
+    }
+
+    /** A fixed reference that never reloads — for tests and for wiring built from a config in code. */
+    public static ConfigRef fixed(BridgedConfig cfg) {
+        return new ConfigRef(null, cfg);
+    }
+
+    /** The live configuration. Read this per use; do not cache it in a field. */
+    @Override
+    public BridgedConfig get() {
+        return current.get();
+    }
+
+    /** The file this ref reloads from, or {@code null} for a {@link #fixed} ref. */
+    public Path path() {
+        return path;
+    }
+
+    /**
+     * What a reload attempt did.
+     *
+     * @param applied  true when the new config is now live
+     * @param coldKeys cold keys whose value changed, which is why an unapplied reload was refused
+     * @param deferred keys that changed and were accepted, but whose effect waits for a restart
+     * @param error    the parse or validation failure that refused the reload, else {@code null}
+     */
+    public record Outcome(boolean applied, List<String> coldKeys, List<String> deferred,
+                          String error) {
+
+        public Outcome {
+            coldKeys = List.copyOf(coldKeys);
+            deferred = List.copyOf(deferred);
+        }
+
+        static Outcome refusedCold(List<String> keys) {
+            return new Outcome(false, keys, List.of(), null);
+        }
+
+        static Outcome failed(String error) {
+            return new Outcome(false, List.of(), List.of(), error);
+        }
+
+        /** A one-line summary for the operator — the reason, not just the verdict. */
+        public String summary() {
+            if (error != null) {
+                return "config reload refused — " + error;
+            }
+            if (!applied) {
+                return "config reload refused — these keys cannot change under a running daemon: "
+                        + String.join(", ", coldKeys) + ". Restart bridged to apply them.";
+            }
+            if (!deferred.isEmpty()) {
+                return "config reloaded; these changes need a restart to take effect: "
+                        + String.join(", ", deferred);
+            }
+            return "config reloaded";
+        }
+    }
+
+    /**
+     * Re-read the file, validate it, and swap it in when nothing cold changed.
+     *
+     * <p>Never throws: a reload is a best-effort operation on a daemon that is already serving, and
+     * a bad edit must not take it down. Every failure path leaves the previous config live and is
+     * reported through the returned {@link Outcome}.
+     */
+    public Outcome reload() {
+        if (path == null) {
+            return Outcome.failed("this config was built in code and has no file to reload from");
+        }
+        BridgedConfig old = current.get();
+        BridgedConfig fresh;
+        try {
+            fresh = BridgedConfig.load(path);
+            // The same gate startup runs. A config that would have refused to boot must not be able
+            // to slip in through a reload — that is how a daemon ends up in a state it could never
+            // have started in, which is the hardest kind to debug.
+            fresh.validateAuthExposure();
+            fresh.validateLeadTabPrefixes();
+            fresh.validateSubscriptionProfiles();
+            fresh.validateCharters();
+            fresh.validateMembers();
+        } catch (RuntimeException e) {
+            String msg = e.getMessage() == null ? e.toString() : e.getMessage();
+            log.warn("config reload from {} refused, keeping the running config: {}", path, msg);
+            return Outcome.failed(msg);
+        }
+
+        List<String> cold = changedColdKeys(old, fresh);
+        if (!cold.isEmpty()) {
+            Outcome out = Outcome.refusedCold(cold);
+            log.warn(out.summary());
+            return out;
+        }
+
+        List<String> deferred = changedDeferredKeys(old, fresh);
+        current.set(fresh);
+        Outcome out = new Outcome(true, List.of(), deferred, null);
+        log.info(out.summary());
+        return out;
+    }
+
+    /** Cold keys whose value differs between the running config and the candidate. */
+    private static List<String> changedColdKeys(BridgedConfig old, BridgedConfig fresh) {
+        List<String> changed = new ArrayList<>();
+        if (!Objects.equals(old.bind(), fresh.bind())) {
+            changed.add("bind");
+        }
+        if (!Objects.equals(old.herdrSocket(), fresh.herdrSocket())) {
+            changed.add("herdrSocket");
+        }
+        if (!Objects.equals(old.broker(), fresh.broker())) {
+            changed.add("broker");
+        }
+        if (!Objects.equals(old.auth(), fresh.auth())) {
+            changed.add("auth");
+        }
+        // Kept in step with COLD_KEYS so the doc and the code cannot drift apart silently.
+        assert COLD_KEYS.containsAll(changed) : "a cold key was reported that COLD_KEYS omits";
+        return changed;
+    }
+
+    /** Changed keys that were accepted but whose effect waits for a restart. */
+    private static List<String> changedDeferredKeys(BridgedConfig old, BridgedConfig fresh) {
+        List<String> changed = new ArrayList<>();
+        if (!Objects.equals(old.lifecycle(), fresh.lifecycle())) {
+            changed.add("lifecycle");
+        }
+        if (!Objects.equals(old.leadHeartbeat(), fresh.leadHeartbeat())) {
+            changed.add("leadHeartbeat");
+        }
+        if (!Objects.equals(old.guard(), fresh.guard())) {
+            changed.add("guard");
+        }
+        if (!Objects.equals(old.worktreeRoot(), fresh.worktreeRoot())) {
+            changed.add("worktreeRoot");
+        }
+        if (!Objects.equals(old.spawnReadyTimeoutMs(), fresh.spawnReadyTimeoutMs())
+                || !Objects.equals(old.spawnReadyPollMs(), fresh.spawnReadyPollMs())) {
+            changed.add("spawnReady*");
+        }
+        Map<String, BridgedConfig.Profile> before =
+                old.profiles() == null ? Map.of() : old.profiles();
+        Map<String, BridgedConfig.Profile> after =
+                fresh.profiles() == null ? Map.of() : fresh.profiles();
+        // Adding or removing a profile is deferred: a new backend needs its own launcher, and
+        // launchers are built once at startup.
+        if (!before.keySet().equals(after.keySet())) {
+            Set<String> diff = new LinkedHashSet<>(before.keySet());
+            diff.addAll(after.keySet());
+            diff.removeIf(p -> before.containsKey(p) && after.containsKey(p));
+            changed.add("profiles (added/removed: " + String.join(", ", diff) + ")");
+        }
+        // An EXISTING profile's launch settings are deferred too, and this is easy to get wrong:
+        // `HerdrPeerLauncher` takes `Map.copyOf(profiles)` at construction and `spawn` resolves the
+        // profile out of that snapshot, so a reloaded model/baseUrl/argv/env never reaches a launch.
+        // Only weight and maxLoad are genuinely hot, because placement reads them through the
+        // supplier on the composite rather than from the adapter's copy. Without this check a
+        // changed model would report "config reloaded" and silently do nothing — the worst outcome
+        // a reload can produce, because the operator has no reason to doubt it.
+        List<String> relaunch = new ArrayList<>();
+        before.forEach((name, was) -> {
+            BridgedConfig.Profile now = after.get(name);
+            if (now != null && !sameLaunchSettings(was, now)) {
+                relaunch.add(name);
+            }
+        });
+        if (!relaunch.isEmpty()) {
+            changed.add("profiles." + String.join("/", relaunch) + " launch settings "
+                    + "(model, baseUrl, argv, env, …) — the launcher holds a startup snapshot");
+        }
+        return changed;
+    }
+
+    /**
+     * Whether two versions of a profile would launch a peer identically. Compares every component
+     * the launcher reads at spawn; {@code weight} and {@code maxLoad} are excluded because those are
+     * read live by the placement policy and really do take effect on the next spawn.
+     */
+    private static boolean sameLaunchSettings(BridgedConfig.Profile a, BridgedConfig.Profile b) {
+        return Objects.equals(a.baseUrl(), b.baseUrl())
+                && Objects.equals(a.model(), b.model())
+                && Objects.equals(a.configDir(), b.configDir())
+                && Objects.equals(a.tokenEnv(), b.tokenEnv())
+                && Objects.equals(a.argv(), b.argv())
+                && Objects.equals(a.placement(), b.placement())
+                && Objects.equals(a.workspace(), b.workspace())
+                && Objects.equals(a.tabLabel(), b.tabLabel())
+                && Objects.equals(a.mcpUrl(), b.mcpUrl())
+                && Objects.equals(a.cwd(), b.cwd())
+                && Objects.equals(a.parityOverlay(), b.parityOverlay())
+                && Objects.equals(a.gitTokenEnv(), b.gitTokenEnv())
+                && Objects.equals(a.gitHostEnv(), b.gitHostEnv())
+                && Objects.equals(a.kind(), b.kind())
+                && Objects.equals(a.env(), b.env())
+                && Objects.equals(a.subscription(), b.subscription());
+    }
+}
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.config;
+package dev.ltms.bridged.config;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -11,7 +11,7 @@ import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;

 /**
- * Polls {@code fleetd.yaml}'s modified time and asks {@link ConfigRef} to reload when it moves
+ * Polls {@code bridged.yaml}'s modified time and asks {@link ConfigRef} to reload when it moves
 * (CB-559). Opt-in through {@code configReload.enabled}.
 *
 * <p><strong>Why polling and not a filesystem watch.</strong> {@code WatchService} on macOS has no
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.guard;
+package dev.ltms.bridged.guard;

 /** Thrown when the subscription boundary would be violated. Never swallow this. */
 public class GuardException extends RuntimeException {
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.guard;
+package dev.ltms.bridged.guard;

 import java.net.URI;
 import java.net.URISyntaxException;
@@ -16,7 +16,7 @@ import java.util.Set;
 *       means its traffic would leave the subscription. That is a hard stop.</li>
 * </ul>
 *
- * Both checks throw {@link GuardException} on violation. {@code fleetd} calls
+ * Both checks throw {@link GuardException} on violation. {@code bridged} calls
 * {@link #assertWorker} before spawning a worker and {@link #assertPrimaryClean}
 * against its own environment at startup.
 */
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.herdr;
+package dev.ltms.bridged.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

@@ -1,4 +1,4 @@
-package dev.ltms.fleet.herdr;
+package dev.ltms.bridged.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

@@ -38,11 +38,6 @@ public final class AgentControl {
        this.herdr = herdr;
    }

-    /** The herdr daemon this control object sends its agent calls to. */
-    public HerdrClient herdr() {
-        return herdr;
-    }
-
    /** One agent-targeted call, translating a terminal id to its pane id (retrying once fresh). */
    private JsonNode agentCall(String method, String target, Map<String, Object> extra) {
        String resolved = resolveTarget(target);
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.herdr;
+package dev.ltms.bridged.herdr;

 /**
 * A herdr agent's lifecycle state, as reported by {@code agent_status}. Drives the
@@ -32,7 +32,7 @@ public enum AgentStatus {
        };
    }

-    /** Whether {@code fleetd} may inject a message now without stepping on a live turn. */
+    /** Whether {@code bridged} may inject a message now without stepping on a live turn. */
    public boolean injectable() {
        return this == IDLE || this == BLOCKED || this == DONE;
    }
@@ -1,17 +1,17 @@
-package dev.ltms.fleet.herdr;
+package dev.ltms.bridged.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

 /**
 * Client face onto the herdr daemon (protocol 14, herdr 0.7.0).
 *
- * <p>This is the ONLY thing in {@code fleetd} that speaks to herdr. Every method
+ * <p>This is the ONLY thing in {@code bridged} that speaks to herdr. Every method
 * maps to a herdr JSON-RPC call over its Unix domain socket. Requests are
 * newline-delimited JSON with a <em>string</em> id; responses carry either a
 * {@code result} object (whose {@code type} field discriminates the payload) or an
 * {@code error} object.
 *
- * <p>Higher layers ({@code fleetd}'s policy brain, REST endpoints, MCP adapters)
+ * <p>Higher layers ({@code bridged}'s policy brain, REST endpoints, MCP adapters)
 * depend on this interface, not on the socket. Tests substitute a fake; the
 * {@code contract}-tagged suite exercises the real implementation against a running
 * herdr to catch protocol drift.
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.herdr;
+package dev.ltms.bridged.herdr;

 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.databind.JsonNode;
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.herdr;
+package dev.ltms.bridged.herdr;

 /**
 * Raised when a herdr call fails: transport error, or an {@code error} envelope
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.herdr;
+package dev.ltms.bridged.herdr;

 import com.fasterxml.jackson.databind.JsonNode;
 import org.slf4j.Logger;
@@ -6,7 +6,6 @@ import org.slf4j.LoggerFactory;

 import java.util.Collections;
 import java.util.LinkedHashMap;
-import java.util.Locale;
 import java.util.Map;
 import java.util.Set;
 import java.util.function.LongSupplier;
@@ -14,7 +13,7 @@ import java.util.function.Supplier;

 /**
 * Discovers which panes host a lead by scanning herdr for tabs the operator labelled by convention
- * (CB-531), and hands {@link dev.ltms.fleet.auth.CallerResolver} the resulting
+ * (CB-531), and hands {@link dev.ltms.bridged.auth.CallerResolver} the resulting
 * {@code terminal_id → lead name} map.
 *
 * <p><strong>Why scan at all.</strong> A lead is never spawned — a human opens a tab and starts an
@@ -24,33 +23,24 @@ import java.util.function.Supplier;
 * by first starting the session and asking it. Scanning closes that loop: label the tab, and the
 * pane is recognised on the next resolve.
 *
- * <p><strong>CB-579 — matched by name, not prefix.</strong> This used to strip one shared
- * {@code tabPrefix} off a label to derive the lead's name, and merged a config-supplied
- * {@code terminal_id} pin over every scan result so the pin could never expire. Both are gone: each
- * lead now configures its own exact {@code tab} label ({@code fleet.leaders.<name>.tab}), so this
- * class is handed a {@code tab → name} map up front and matches labels against it exactly
- * (case-insensitively). There is no merge step — a scan result is the whole answer. That is the
- * fix for the bug this replaces: a {@code terminal_id} pin surviving in config after the pane it
- * named was gone, so the daemon kept treating a dead session as a live lead forever.
- *
 * <p><strong>Direction of trust.</strong> The label names the lead; it never <em>grants</em>
 * anything a pane could take for itself. Three properties keep that honest:
 * <ol>
 *   <li>Worker spaces are excluded wholesale ({@code excludedWorkspaceLabels}), so a worker cannot
 *       become a lead by being placed — as a split, say — inside a matching tab.</li>
 *   <li>A worker cannot rename a tab: {@code tab.rename} is reachable only through
- *       {@link WorkspaceControl}, which no {@code fleet_*} tool exposes. The label is writable by
+ *       {@link WorkspaceControl}, which no {@code bridge_*} tool exposes. The label is writable by
 *       the human at the terminal and by nobody the bridge is defending against.</li>
 *   <li>The label is a <em>name</em>, not a capability. What a pane may do is decided by
 *       {@code Authz} against the role {@code CallerResolver} returns; a tab that calls itself a
 *       lead still cannot act as one unless the daemon's own registry agrees.</li>
 * </ol>
 *
- * <p><strong>CB-558 — fleetd now writes lead labels too.</strong> This class used to be able to say
- * that fleetd never renames a lead tab, so the label was always the human's own writing and there
+ * <p><strong>CB-558 — bridged now writes lead labels too.</strong> This class used to be able to say
+ * that bridged never renames a lead tab, so the label was always the human's own writing and there
 * was no round-trip from the daemon's rename back into its next decision.
- * {@code dev.ltms.fleet.lead.LeadLauncher} ends that: an auto-launched lead is labelled by the
- * daemon and found again by this scan. The trust direction above is unaffected — fleetd writing a
+ * {@code dev.ltms.bridged.lead.LeadLauncher} ends that: an auto-launched lead is labelled by the
+ * daemon and found again by this scan. The trust direction above is unaffected — bridged writing a
 * name for a lead it just started is not a pane promoting itself — but <em>staleness</em> becomes
 * real: a label left behind by a session that has since died would read as a live lead forever.
 * This scanner does not solve that (its job is naming, and a stale name costs nothing here); the
@@ -58,7 +48,7 @@ import java.util.function.Supplier;
 * ever make a decision that <em>removes</em> something based on this map, add the same check.
 * The remaining hazard is an <em>operator</em> one — a worker {@code tabLabel} template that
 * happens to start with the same prefix would promote the whole fleet — and that is refused at
- * startup by {@code FleetConfig.validateLeadTabPrefixes} rather than documented here.
+ * startup by {@code BridgedConfig.validateLeadScan} rather than documented here.
 *
 * <p><strong>Caching.</strong> {@link #get()} is on the request path (every resolve), so the scan
 * is TTL-cached and a stale-but-valid map is preferred to a herdr round-trip. A failed scan keeps
@@ -70,46 +60,38 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
    private static final Logger log = LoggerFactory.getLogger(LeadTabScanner.class);

    private final HerdrClient herdr;
-    private final Map<String, String> tabToName;
+    private final String tabPrefix;
    private final Set<String> excludedWorkspaceLabels;
+    private final Map<String, String> configuredLeads;
    private final long ttlNanos;
    private final LongSupplier clock;

-    private Map<String, String> cached = Map.of();
+    private Map<String, String> cached;
    private long scannedAtNanos;
    private boolean everScanned;

    /**
     * @param herdr                   the herdr client to query ({@code workspace.list},
     *                                {@code tab.list}, {@code pane.list} — all read-only)
-     * @param tabToName               every configured lead's exact tab label → its name
-     *                                ({@code fleet.leaders.<name>.tab}), matched case-insensitively
+     * @param tabPrefix               a tab whose label starts with this (case-insensitively) hosts a
+     *                                lead; the rest of the label, trimmed, is the lead's name
     * @param excludedWorkspaceLabels workspaces never scanned — the configured worker spaces
+     * @param configuredLeads         the static {@code leaders:}/{@code primary:} registry, merged
+     *                                over every scan result. Explicit config outranks the
+     *                                convention, and survives a scan that cannot run at all
     * @param ttlNanos                how long a scan result is reused before the next one
     * @param clock                   nanosecond time source ({@code System::nanoTime} in production)
     */
-    public LeadTabScanner(HerdrClient herdr, Map<String, String> tabToName,
-                          Set<String> excludedWorkspaceLabels, long ttlNanos, LongSupplier clock) {
+    public LeadTabScanner(HerdrClient herdr, String tabPrefix, Set<String> excludedWorkspaceLabels,
+                          Map<String, String> configuredLeads, long ttlNanos, LongSupplier clock) {
        this.herdr = herdr;
-        this.tabToName = normalize(tabToName);
+        this.tabPrefix = tabPrefix == null || tabPrefix.isBlank() ? "lead:" : tabPrefix.strip();
        this.excludedWorkspaceLabels = excludedWorkspaceLabels == null
                ? Set.of() : Set.copyOf(excludedWorkspaceLabels);
+        this.configuredLeads = configuredLeads == null ? Map.of() : Map.copyOf(configuredLeads);
        this.ttlNanos = ttlNanos;
        this.clock = clock;
-    }
-
-    /** Keys stripped and lower-cased once, so every lookup is a plain map hit. */
-    private static Map<String, String> normalize(Map<String, String> tabToName) {
-        if (tabToName == null || tabToName.isEmpty()) {
-            return Map.of();
-        }
-        Map<String, String> out = new LinkedHashMap<>();
-        tabToName.forEach((tab, name) -> {
-            if (tab != null && !tab.isBlank() && name != null && !name.isBlank()) {
-                out.put(tab.strip().toLowerCase(Locale.ROOT), name);
-            }
-        });
-        return Collections.unmodifiableMap(out);
+        this.cached = this.configuredLeads;
    }

    /**
@@ -169,20 +151,25 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
                }
            }
        }
+        byTerminal.putAll(configuredLeads); // an explicit pin outranks a label
        return Collections.unmodifiableMap(byTerminal);
    }

    /**
-     * The lead name a tab label declares, or {@code null} if it names none of the configured leads.
+     * The lead name a tab label declares, or {@code null} if it declares none.
     *
-     * <p>Exact match (case-insensitive, ends stripped) against {@link #tabToName} — no prefix
-     * stripping, so an operator's {@code "lead: something-else"} tab is never mistaken for a
-     * configured lead just because it shares a prefix.
+     * <p>{@code "lead: opus-5.0"} → {@code "opus-5.0"}. A bare {@code "lead:"} names nobody and is
+     * rejected: an unnamed lead would resolve as {@code PRIMARY} with nothing to attribute it to.
     */
    private String leadNameOf(String label) {
        if (label == null) {
            return null;
        }
-        return tabToName.get(label.strip().toLowerCase(Locale.ROOT));
+        String l = label.strip();
+        if (!l.regionMatches(true, 0, tabPrefix, 0, tabPrefix.length())) {
+            return null;
+        }
+        String name = l.substring(tabPrefix.length()).strip();
+        return name.isEmpty() ? null : name;
    }
 }
@@ -0,0 +1,59 @@
+package dev.ltms.bridged.herdr;
+
+import com.fasterxml.jackson.databind.JsonNode;
+
+import java.util.Map;
+
+/**
+ * Resolves which herdr pane a process belongs to — the herdr half of connection-based MCP
+ * identity (CB-105). Given the PID that opened an MCP connection, {@link #terminalForPid} finds
+ * the agent pane whose process tree contains it, so {@code bridged} can tell <em>which worker</em>
+ * is calling without the worker sending anything spoofable.
+ *
+ * <p>herdr owns the PID→pane truth: {@code pane.process_info} reports each pane's {@code shell_pid}
+ * and foreground process PIDs. This scans agent panes; a spawn-time {@code pid→terminal} cache is
+ * the obvious optimization once wired into {@code ClaudeCodeLauncher}.
+ */
+public final class PaneLocator {
+
+    private final HerdrClient herdr;
+
+    public PaneLocator(HerdrClient herdr) {
+        this.herdr = herdr;
+    }
+
+    /**
+     * The {@code terminal_id} of the agent pane whose process tree contains {@code pid}, or
+     * {@code null} if no agent pane owns it (e.g. the caller is the primary, or off-host).
+     */
+    public String terminalForPid(long pid) {
+        if (pid <= 0) {
+            return null;
+        }
+        for (JsonNode pane : herdr.call("pane.list", Map.of()).path("panes")) {
+            String paneId = pane.path("pane_id").asText(null);
+            if (paneId != null && paneOwnsPid(paneId, pid)) {
+                return pane.path("terminal_id").asText(null);
+            }
+        }
+        return null;
+    }
+
+    private boolean paneOwnsPid(String paneId, long pid) {
+        JsonNode info;
+        try {
+            info = herdr.call("pane.process_info", Map.of("pane_id", paneId)).path("process_info");
+        } catch (HerdrException e) {
+            return false; // pane vanished mid-scan — just skip it
+        }
+        if (info.path("shell_pid").asLong(-1) == pid) {
+            return true;
+        }
+        for (JsonNode p : info.path("foreground_processes")) {
+            if (p.path("pid").asLong(-1) == pid) {
+                return true;
+            }
+        }
+        return false;
+    }
+}
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.herdr;
+package dev.ltms.bridged.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

@@ -1,4 +1,4 @@
-package dev.ltms.fleet.herdr;
+package dev.ltms.bridged.herdr;

 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.herdr;
+package dev.ltms.bridged.herdr;

 import com.fasterxml.jackson.databind.JsonNode;

@@ -7,7 +7,7 @@ import com.fasterxml.jackson.databind.JsonNode;
 * dedicated worker space so they never split or clutter the user's real work spaces.
 *
 * @param workspaceId herdr's stable id (e.g. {@code "w4"})
- * @param label       display label shown in herdr's UI (e.g. {@code "fleetd-workers"})
+ * @param label       display label shown in herdr's UI (e.g. {@code "bridged-workers"})
 * @param activeTabId the workspace's currently-focused tab, or {@code null}
 */
 public record Workspace(String workspaceId, String label, String activeTabId) {
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.herdr;
+package dev.ltms.bridged.herdr;

 import com.fasterxml.jackson.databind.JsonNode;
 import org.slf4j.Logger;
@@ -0,0 +1,279 @@
+package dev.ltms.bridged.inject;
+
+import dev.ltms.bridged.herdr.AgentControl;
+import dev.ltms.bridged.msg.Rendezvous;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * The CB-106 completion fallback: bridges the {@link Injector}'s turn-completion signal to the
+ * {@link Rendezvous} so a blocking {@code bridge_send} resolves even when the worker finishes its
+ * task without ever calling {@code bridge_reply} — the common case for a real delegated coding task.
+ *
+ * <p>On a confirmed {@code working → idle} boundary it scrapes the worker's recent transcript and
+ * resolves the awaiting send with that tail (a {@link Rendezvous.Kind#COMPLETION} resolution, so the
+ * caller can tell a scrape from a structured reply). It scrapes only when a send is actually waiting
+ * — a fleet worker's own turns, or a send that already timed out, cost no herdr traffic. An explicit
+ * {@code bridge_reply} that raced in first wins; {@link Rendezvous#resolveCompletion} is then a no-op.
+ *
+ * <p>It also handles the CB-109 stall signal ({@link #onTurnFailed}): a worker that ran a turn then
+ * wedged in an {@code unknown} state resolves the send as a failure (with the error screen as
+ * context) rather than leaving it to time out.
+ *
+ * <p>The scrape is cleaned to the last {@code ⏺} assistant block (stripping TUI chrome) and guarded
+ * against misattribution (CB-115): the pane content is baselined on delivery ({@link #onDelivered}),
+ * and a completion whose scrape is unchanged from that baseline — the previous turn's wind-down
+ * sampled as this turn's boundary on a rapid back-to-back send — is suppressed rather than resolving
+ * the send with a stale answer.
+ *
+ * <p><strong>Waiter-specific resolution (CB-116).</strong> On delivery we also capture the exact
+ * {@link Rendezvous} waiter this turn belongs to, and the completion/failure fallbacks resolve
+ * <em>that</em> waiter — never "whatever send is waiting now". A completion fallback runs on a virtual
+ * thread and can land after the worker's {@code bridge_reply} already resolved the turn and the
+ * <em>next</em> send opened its own waiter on the same session; resolving the current waiter would
+ * then deliver turn N's stale scrape as turn N+1's answer. Targeting the captured waiter makes a late
+ * completion a harmless no-op (its waiter is already done) instead of a cross-turn stale reply.
+ *
+ * <p>Wired as the {@link Injector}'s {@link TurnListener}; the handlers hand off to a virtual thread
+ * so the scrape's herdr round-trip never stalls the status poller. The captured waiter is read on the
+ * poller thread (before any next-turn delivery can overwrite it) and passed into the virtual thread.
+ */
+public final class CompletionResolver implements TurnListener {
+
+    private static final Logger log = LoggerFactory.getLogger(CompletionResolver.class);
+
+    /**
+     * herdr {@code agent.read} source for the completion scrape. {@code recent} returns the tail of
+     * the transcript (the worker's last output), which is what a delegator wants when the worker
+     * didn't structure a reply.
+     */
+    static final String SCRAPE_SOURCE = "recent";
+
+    /** Cap the scraped tail so a long transcript can't return an unbounded blob. */
+    static final int MAX_SCRAPE_CHARS = 4000;
+
+    private static final String CLIPPED_PANE_TAIL_MARKER =
+            "[Pane tail clipped: member did not call bridge_reply.]";
+
+    private final AgentControl agents;
+    private final Rendezvous rendezvous;
+
+    /**
+     * Per-target record of the turn currently in flight: the exact {@link Rendezvous} waiter its
+     * delivering send opened, plus the assistant block present when it was delivered.
+     *
+     * <p>The {@code waiter} is what makes a late fallback safe (CB-116): we resolve it, not "whoever
+     * is waiting now", so a completion that fires after the next send has opened its own waiter is a
+     * no-op rather than a cross-turn stale reply. The {@code baseline} is the CB-115 staleness
+     * reference: a completion scrape equal to it means the worker produced no new output (the previous
+     * turn's wind-down sampled as this boundary), so it is suppressed. Overwritten on each delivery;
+     * cleared when the turn resolves. Package-private so tests can capture and replay a specific turn.
+     */
+    record InFlight(CompletableFuture<Rendezvous.Resolution> waiter, String baseline) {
+    }
+
+    private final ConcurrentHashMap<String, InFlight> inFlight = new ConcurrentHashMap<>();
+
+    public CompletionResolver(AgentControl agents, Rendezvous rendezvous) {
+        this.agents = agents;
+        this.rendezvous = rendezvous;
+    }
+
+    @Override
+    public void onDelivered(String target) {
+        // Capture the exact waiter this turn belongs to (CB-116) and snapshot the pane's pre-turn
+        // content — what it shows *before* the just-delivered turn produces output — as the staleness
+        // reference (CB-115). Done synchronously (like the delivering send itself) so both are in
+        // place before this turn's completion can fire.
+        captureBaseline(target);
+    }
+
+    /** Capture the in-flight turn: its waiter and pre-turn baseline (the testable core of {@link #onDelivered}). */
+    void captureBaseline(String target) {
+        CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.currentWaiter(target);
+        if (waiter == null) {
+            inFlight.remove(target); // no send is waiting on this delivery — nothing to resolve later
+            return;
+        }
+        String baseline;
+        try {
+            // Clip to the same cap resolve() applies to the tail (line ~134): the CB-115 misattribution
+            // guard compares baseline.equals(tail), so both sides must be the same capped representation.
+            // An unclipped baseline vs a clipped tail would never match for a >MAX_SCRAPE_CHARS block,
+            // defeating the guard and letting a stale completion resolve the send.
+            baseline = clip(lastAssistantBlock(agents.read(target, SCRAPE_SOURCE)));
+        } catch (RuntimeException e) {
+            baseline = null; // fail open: no baseline ⇒ no suppression
+            log.debug("delivery baseline for {} failed: {}", target, e.getMessage());
+        }
+        inFlight.put(target, new InFlight(waiter, baseline));
+    }
+
+    /** The turn currently baselined for {@code target}, or {@code null} — a test hook for the captureBaseline path. */
+    InFlight inFlight(String target) {
+        return inFlight.get(target);
+    }
+
+    @Override
+    public void onTurnComplete(String target) {
+        // Read the in-flight turn on the poller thread — before any next-turn delivery can overwrite
+        // it — then off-load the scrape (a herdr round-trip we must not block polling on) to a vthread.
+        InFlight turn = inFlight.get(target);
+        Thread.ofVirtual().name("completion-" + target).start(() -> resolve(target, turn));
+    }
+
+    /**
+     * Resolve the completed turn before adapter housekeeping can erase its rendered output. This is
+     * intentionally synchronous and used only when a post-turn context reset is enabled; the normal
+     * path remains off-loaded so polling is not blocked by a scrape.
+     */
+    public void resolveBeforePostAction(String target) {
+        resolve(target, inFlight.get(target));
+    }
+
+    @Override
+    public void onTurnFailed(String target) {
+        InFlight turn = inFlight.get(target);
+        Thread.ofVirtual().name("turn-failed-" + target).start(() -> fail(target, turn));
+    }
+
+    /** Synchronous resolve (the unit-testable core of {@link #onTurnComplete}). */
+    void resolve(String target, InFlight turn) {
+        CompletableFuture<Rendezvous.Resolution> waiter = turn == null ? null : turn.waiter();
+        if (waiter == null || waiter.isDone()) {
+            // Nobody is blocked on THIS turn (it had no send, or its bridge_reply already won). Skip
+            // the scrape; resolving the current waiter here would be the CB-116 cross-turn stale reply.
+            inFlight.remove(target, turn);
+            return;
+        }
+        String tail;
+        int originalLength = 0;
+        boolean clipped = false;
+        boolean scrapeFailed = false;
+        try {
+            String assistantBlock = lastAssistantBlock(agents.read(target, SCRAPE_SOURCE));
+            originalLength = assistantBlock.strip().length();
+            clipped = originalLength > MAX_SCRAPE_CHARS;
+            tail = clip(assistantBlock);
+        } catch (RuntimeException e) {
+            // The worker finished but we couldn't read its screen — still resolve the send so the
+            // caller unblocks; an empty tail beats hanging until the caller's timeout.
+            log.warn("completion scrape for {} failed; resolving with an empty tail: {}",
+                    target, e.getMessage());
+            tail = "";
+            scrapeFailed = true;
+        }
+        // Misattribution guard (CB-115): if the scrape is byte-identical to the pane content at
+        // delivery, this turn produced no new output — the boundary belongs to the previous turn's
+        // wind-down (common on rapid back-to-back sends). Suppress rather than resolve the send with
+        // a stale answer; the real bridge_reply (or a later genuine completion) resolves it instead.
+        // A scrape that failed to read is exempt — an empty tail there is "couldn't see", not "no change".
+        String baseline = turn.baseline();
+        if (!scrapeFailed && baseline != null && baseline.equals(tail)) {
+            log.debug("suppressing misattributed completion for {} (no output change since delivery)",
+                    target);
+            return; // keep the in-flight record: a later genuine completion still needs it
+        }
+        String completion = clipped ? tail + "\n" + CLIPPED_PANE_TAIL_MARKER : tail;
+        if (rendezvous.resolveCompletion(waiter, completion)) {
+            inFlight.remove(target, turn);
+            if (clipped) {
+                log.warn("completion scrape for {} clipped from {} chars to the {} char cap; "
+                                + "member did not call bridge_reply, so the pane tail is partial",
+                        target, originalLength, MAX_SCRAPE_CHARS);
+            }
+            log.debug("resolved send to {} via turn-completion fallback ({} chars scraped)",
+                    target, tail.length());
+        }
+    }
+
+    /** Synchronous fail (the unit-testable core of {@link #onTurnFailed}). */
+    void fail(String target, InFlight turn) {
+        // A never-delivered readiness failure has no in-flight record but still has a blocked send;
+        // fall back to the currently-registered waiter (unambiguous — that send never completed, so
+        // no next turn exists to confuse it with).
+        CompletableFuture<Rendezvous.Resolution> waiter =
+                turn != null ? turn.waiter() : rendezvous.currentWaiter(target);
+        if (waiter == null || waiter.isDone()) {
+            inFlight.remove(target, turn); // nobody blocked on this worker — nothing to fail
+            return;
+        }
+        String reason;
+        try {
+            reason = clip(agents.read(target, SCRAPE_SOURCE));
+        } catch (RuntimeException e) {
+            reason = "";
+        }
+        if (reason.isBlank()) {
+            // No screen to scrape — either the worker is stuck (CB-109) or gone (CB-110).
+            reason = "worker did not reply; its turn ended in an unrecoverable state "
+                    + "(worker unreachable or stuck)";
+        }
+        if (rendezvous.resolveFailure(waiter, reason)) {
+            inFlight.remove(target, turn);
+            log.warn("failing send to {} via turn-stall fallback: {}", target, reason);
+        }
+    }
+
+    private static String clip(String s) {
+        if (s == null) return "";
+        String trimmed = s.strip();
+        return trimmed.length() <= MAX_SCRAPE_CHARS
+                ? trimmed
+                : trimmed.substring(trimmed.length() - MAX_SCRAPE_CHARS);
+    }
+
+    /**
+     * Extract the last assistant message from a raw Claude Code pane scrape (CB-115). Claude Code
+     * prefixes each assistant turn with {@code ⏺}; the delegator wants that answer, not the TUI
+     * chrome around it. Take everything from the final {@code ⏺} onward and stop at the <em>first</em>
+     * hard interface boundary below it — the spinner/status line, input box, {@code ❯} prompt (which
+     * may echo the <em>next</em> turn's text), footer, or tips/warnings. Stopping at the first
+     * boundary (rather than trimming only trailing chrome) is what keeps a following turn's echoed
+     * prompt out of this reply. Blank lines are not boundaries, so a multi-paragraph answer survives;
+     * trailing blanks are trimmed at the end. With no {@code ⏺} marker (an unusual render) the whole
+     * text is scanned the same way, so we never lose the reply.
+     *
+     * <p>Package-private and pure so it is unit-testable without herdr.
+     */
+    static String lastAssistantBlock(String raw) {
+        if (raw == null || raw.isBlank()) return "";
+        int marker = raw.lastIndexOf('⏺');
+        String block = marker >= 0 ? raw.substring(marker + 1) : raw;
+        StringBuilder out = new StringBuilder();
+        int kept = 0;
+        for (String line : block.split("\n", -1)) {
+            if (isBoundary(line)) break; // first TUI boundary ends the assistant message
+            if (kept++ > 0) out.append('\n');
+            out.append(line);
+        }
+        return out.toString().strip();
+    }
+
+    /**
+     * A hard TUI boundary line that marks the end of an assistant message and the start of interface
+     * chrome (input box, prompt, spinner, footer, tips/warnings). Blank lines are <em>not</em>
+     * boundaries — an answer may contain them — so they are kept and trimmed only if trailing.
+     */
+    private static boolean isBoundary(String line) {
+        String t = line.strip();
+        if (t.isEmpty()) return false;
+        // A horizontal rule / all box-drawing separators (e.g. "──────").
+        if (t.chars().allMatch(c -> c == '─' || c == '—' || c == '━' || c == '═' || c == '-')) {
+            return true;
+        }
+        String lower = t.toLowerCase();
+        return t.startsWith("╭") || t.startsWith("│") || t.startsWith("╰") || t.startsWith("┌")
+                || t.startsWith("└") || t.startsWith("❯") || t.startsWith("⏵")
+                || t.startsWith("⎿") || t.startsWith("⚠")
+                // Status/spinner lines Claude Code renders below a settled or in-flight turn,
+                // e.g. "✻ Baked for 21s", "✶ Forming…".
+                || t.startsWith("✻") || t.startsWith("✳") || t.startsWith("✽") || t.startsWith("·")
+                || t.startsWith("●") || t.startsWith("◐") || t.startsWith("✢") || t.startsWith("✶")
+                || lower.contains("auto mode") || lower.contains("for shortcuts")
+                || lower.contains("esc to interrupt") || lower.contains("bypass permissions");
+    }
+}
@@ -1,9 +1,7 @@
-package dev.ltms.fleet.inject;
+package dev.ltms.bridged.inject;

-import dev.ltms.fleet.herdr.AgentControl;
-import dev.ltms.fleet.herdr.AgentStatus;
-import dev.ltms.fleet.herdr.HerdrRouter;
-import dev.ltms.fleet.msg.TurnToken;
+import dev.ltms.bridged.herdr.AgentControl;
+import dev.ltms.bridged.herdr.AgentStatus;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -82,7 +80,7 @@ public final class Injector {

    /**
     * The single source for the injector poll cadence — how often the {@link StatusPoller} drives
-     * {@link #onStatus} at. {@code Fleetd} passes this to every {@link StatusPoller} it constructs,
+     * {@link #onStatus} at. {@code Bridged} passes this to every {@link StatusPoller} it constructs,
     * and this class reads it to state the readiness grace in seconds on the CB-562 expiry log
     * instead of hardcoding "60s". One constant, so a cadence change cannot silently desync a log
     * that claims a grace duration.
@@ -90,7 +88,6 @@ public final class Injector {
    public static final long POLL_INTERVAL_MILLIS = 250;

    private final AgentControl agents;
-    private final HerdrRouter router;
    private final TurnListener turnListener;
    private final Predicate<String> ready; // CB-113: a target is deliverable only when available
    private final Consumer<String> forget; // CB-114: clear a gone worker's readiness/presence
@@ -126,77 +123,13 @@ public final class Injector {
    public Injector(AgentControl agents, TurnListener turnListener, Predicate<String> ready,
                    Consumer<String> forget) {
        this.agents = agents;
-        this.router = null;
        this.turnListener = turnListener;
        this.ready = ready;
        this.forget = forget;
    }

-    public Injector(HerdrRouter router, TurnListener turnListener, Predicate<String> ready,
-                    Consumer<String> forget) {
-        this.agents = null;
-        this.router = router;
-        this.turnListener = turnListener;
-        this.ready = ready;
-        this.forget = forget;
-    }
-
-    private AgentControl agentsFor(String target) {
-        return router != null ? router.agentsFor(target) : agents;
-    }
-
-    /** The result of trying to remove an undelivered message from the injector. */
-    public enum Cancellation {
-        CANCELLED,
-        DELIVERED,
-        NOT_DELIVERED
-    }
-
-    /**
-     * An identity handle for one queued delivery. It is the only value accepted by
-     * {@link #cancel(Delivery)}, so a caller cannot cancel a different message with the same target
-     * or text.
-     */
-    public static final class Delivery {
-        private final Pending pending;
-
-        private Delivery(Pending pending) {
-            this.pending = pending;
-        }
-
-        public CompletableFuture<Void> completion() {
-            return pending.delivered;
-        }
-    }
-
    /** A pending message and the future that completes when it has been delivered. */
-    private static final class Pending {
-        enum State { QUEUED, DELIVERED, NOT_DELIVERED, CANCELLED }
-
-        final String target;
-        final String text;
-        final TurnToken token;
-        final CompletableFuture<Void> delivered;
-        volatile State state = State.QUEUED; // written under the owning Target monitor
-
-        Pending(String target, String text, TurnToken token, CompletableFuture<Void> delivered) {
-            this.target = target;
-            this.text = text;
-            this.token = token;
-            this.delivered = delivered;
-        }
-
-        String text() {
-            return text;
-        }
-
-        TurnToken token() {
-            return token;
-        }
-
-        CompletableFuture<Void> delivered() {
-            return delivered;
-        }
+    private record Pending(String text, CompletableFuture<Void> delivered) {
    }

    /** Per-worker delivery state, guarded by its own monitor (single writer per worker). */
@@ -207,7 +140,6 @@ public final class Injector {
        boolean awaitingCompletion; // a delivered message's turn is not yet known-complete
        boolean turnObserved;      // saw a real `working` sample since that delivery (turn ran)
        int unknownSinceTurn;      // consecutive `unknown` samples while a delegation is outstanding (CB-109)
-        int unknownSincePostTurn;  // the same, for the post-turn housekeeping phase (fleetd #306)
        int notReadySincePoll;     // consecutive injectable samples a queued message waited on the readiness gate (CB-114)
        boolean postTurnPending;   // completion observed; adapter housekeeping has not started yet
        boolean awaitingPostTurnPickup;
@@ -227,47 +159,15 @@ public final class Injector {
     * <p>Uses an atomic map update so a concurrent {@link #drop} cannot slip between "find the
     * target" and "queue the message" and orphan it in a target it just removed.
     */
-    public Delivery enqueue(String target, String text, TurnToken token) {
+    public CompletableFuture<Void> enqueue(String target, String text) {
        CompletableFuture<Void> delivered = new CompletableFuture<>();
-        Pending p = new Pending(target, text, token, delivered);
+        Pending p = new Pending(text, delivered);
        targets.compute(target, (_, existing) -> {
            Target t = (existing != null) ? existing : new Target();
            t.add(p); // synchronized on the Target monitor — atomic with a concurrent drop
            return t;
        });
-        return new Delivery(p);
-    }
-
-    /**
-     * Cancel this exact queued delivery. The target monitor serializes this operation with
-     * {@link #onStatus}: if delivery wins that race, this returns {@link Cancellation#DELIVERED}
-     * rather than claiming the message remained queued.
-     */
-    public Cancellation cancel(Delivery delivery) {
-        Pending p = delivery.pending;
-        Target t = targets.get(p.target);
-        if (t == null) {
-            return cancellationOf(p);
-        }
-        synchronized (t) {
-            if (p.state != Pending.State.QUEUED || !t.queue.remove(p)) {
-                return cancellationOf(p);
-            }
-            p.state = Pending.State.CANCELLED;
-            if (isQuiescent(t)) {
-                targets.remove(p.target, t);
-            }
-            return Cancellation.CANCELLED;
-        }
-    }
-
-    private static Cancellation cancellationOf(Pending p) {
-        return p.state == Pending.State.DELIVERED ? Cancellation.DELIVERED : Cancellation.NOT_DELIVERED;
-    }
-
-    private static boolean isQuiescent(Target t) {
-        return t.queue.isEmpty() && !t.awaitingPickup && !t.awaitingCompletion
-                && !t.postTurnPending && !t.awaitingPostTurnPickup && !t.postTurnObserved;
+        return delivered;
    }

    /**
@@ -300,12 +200,10 @@ public final class Injector {
                t.awaitingPickup = false;
                t.injectableSincePickup = 0;
                t.unknownSinceTurn = 0;
-                t.unknownSincePostTurn = 0;
                t.notReadySincePoll = 0;
                if (t.awaitingCompletion) t.turnObserved = true;
            } else if (status.injectable()) { // IDLE or BLOCKED
                t.unknownSinceTurn = 0;
-                t.unknownSincePostTurn = 0;
                if (t.awaitingPostTurnPickup) {
                    if (++t.injectableSincePostTurnPickup >= PICKUP_GRACE_POLLS) {
                        t.awaitingPostTurnPickup = false;
@@ -354,9 +252,8 @@ public final class Injector {
                        if (p != null && ready.test(target)) {
                            t.notReadySincePoll = 0;
                            try {
-                                agentsFor(target).send(target, p.text());
+                                agents.send(target, p.text());
                                t.queue.poll();
-                                p.state = Pending.State.DELIVERED;
                                t.awaitingPickup = true;
                                t.awaitingCompletion = true;
                                t.turnObserved = false;
@@ -366,7 +263,6 @@ public final class Injector {
                                // Delivery failed at herdr; drop the poisoned message and surface it
                                // rather than blocking the queue behind it.
                                t.queue.poll();
-                                p.state = Pending.State.NOT_DELIVERED;
                                sent = p;
                                sendError = e;
                            }
@@ -377,9 +273,6 @@ public final class Injector {
                            // fail every queued message and release the target (CB-114) instead of
                            // polling it indefinitely with the caller's future never completing.
                            notReady = new ArrayList<>(t.queue);
-                            for (Pending pending : notReady) {
-                                pending.state = Pending.State.NOT_DELIVERED;
-                            }
                            log.warn("readiness grace for {} expired after {} polls ({}s): target never "
                                    + "became deliverable, so failing {} queued message(s) that never "
                                    + "reached its pane",
@@ -405,29 +298,12 @@ public final class Injector {
                    t.unknownSinceTurn = 0;
                    turnFailed = true;
                }
-                // fleetd #306: the same escape for the post-turn housekeeping phase. Four latches
-                // gate delivery (awaitingCompletion, postTurnPending, awaitingPostTurnPickup,
-                // postTurnObserved) and only the first had a way out of a sustained unknown streak —
-                // a gate that closed one direction only. The other two below are released here as
-                // well; postTurnPending needs no escape because it is cleared unconditionally on the
-                // line after the listener call that sets it.
-                //
-                // This does NOT set turnFailed. The delegated turn already completed and its waiter
-                // already resolved — what is outstanding is adapter housekeeping (the `/clear`).
-                // Reporting a turn failure here would drive SessionManager.onFailed on a session
-                // that genuinely finished its work, which is a worse lie than the wedge.
-                if ((t.awaitingPostTurnPickup || t.postTurnObserved)
-                        && ++t.unknownSincePostTurn >= TURN_STALL_GRACE_POLLS) {
-                    t.awaitingPostTurnPickup = false;
-                    t.postTurnObserved = false;
-                    t.injectableSincePostTurnPickup = 0;
-                    t.unknownSincePostTurn = 0;
-                }
            }

            // Reclaim the entry once the worker is fully quiescent (nothing queued, no pickup or
            // completion awaited), so the map cannot grow without bound across short-lived workers.
-            if (isQuiescent(t)) {
+            if (t.queue.isEmpty() && !t.awaitingPickup && !t.awaitingCompletion
+                    && !t.postTurnPending && !t.awaitingPostTurnPickup && !t.postTurnObserved) {
                targets.remove(target, t);
            }
        }
@@ -436,7 +312,7 @@ public final class Injector {
        // thread while it holds the target lock.
        if (resubmit) {
            try {
-                agentsFor(target).submit(target); // nudge a raced Enter so the pending paste submits
+                agents.submit(target); // nudge a raced Enter so the pending paste submits
            } catch (RuntimeException e) {
                log.debug("resubmit to {} failed (will retry next poll): {}", target, e.getMessage());
            }
@@ -480,7 +356,7 @@ public final class Injector {
            } else {
                // Baseline the pane's pre-turn content so a misattributed completion (no new output)
                // can't resolve this send with the previous turn's stale answer (CB-115).
-                turnListener.onDelivered(target, sent.token());
+                turnListener.onDelivered(target);
                sent.delivered().complete(null);
            }
        }
@@ -518,9 +394,6 @@ public final class Injector {
        boolean hadDeliveredTurn;
        synchronized (t) {
            pending = new ArrayList<>(t.queue);
-            for (Pending p : pending) {
-                p.state = Pending.State.NOT_DELIVERED;
-            }
            t.queue.clear();
            hadDeliveredTurn = t.awaitingCompletion;
            t.awaitingCompletion = false;
@@ -537,8 +410,8 @@ public final class Injector {
        for (Pending p : pending) {
            p.delivered().completeExceptionally(cause);
        }
-        // A queued send has no in-flight record, while a delivered turn does. CompletionResolver
-        // handles both forms and resolves its waiter at most once.
-        turnListener.onTurnFailed(target, cause.getMessage());
+        if (hadDeliveredTurn) {
+            turnListener.onTurnFailed(target);
+        }
    }
 }
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.inject;
+package dev.ltms.bridged.inject;

 import java.util.concurrent.ConcurrentHashMap;
 import java.util.Set;
@@ -1,9 +1,8 @@
-package dev.ltms.fleet.inject;
+package dev.ltms.bridged.inject;

-import dev.ltms.fleet.herdr.AgentControl;
-import dev.ltms.fleet.herdr.AgentStatus;
-import dev.ltms.fleet.herdr.HerdrException;
-import dev.ltms.fleet.herdr.HerdrRouter;
+import dev.ltms.bridged.herdr.AgentControl;
+import dev.ltms.bridged.herdr.AgentStatus;
+import dev.ltms.bridged.herdr.HerdrException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -23,7 +22,6 @@ public final class StatusPoller {
    private static final Logger log = LoggerFactory.getLogger(StatusPoller.class);

    private final AgentControl agents;
-    private final HerdrRouter router;
    private final Injector injector;
    private final StatusRefiner refiner;
    private final long intervalMillis;
@@ -37,24 +35,11 @@ public final class StatusPoller {
    public StatusPoller(AgentControl agents, Injector injector, StatusRefiner refiner,
                        long intervalMillis) {
        this.agents = agents;
-        this.router = null;
        this.injector = injector;
        this.refiner = refiner;
        this.intervalMillis = intervalMillis;
    }

-    public StatusPoller(HerdrRouter router, Injector injector, long intervalMillis) {
-        this.agents = null;
-        this.router = router;
-        this.injector = injector;
-        // CB-185: this refiner's own AgentControl (member) is only a default for the legacy 2-arg
-        // refine() overload — the loop below always calls the 3-arg refine(target, raw, control)
-        // with the per-target control from router.agentsFor(target), so a lead target is refined
-        // against the LEAD daemon even though this field points at the member one.
-        this.refiner = new StatusRefiner(router.memberAgents());
-        this.intervalMillis = intervalMillis;
-    }
-
    /** Start the polling loop on a virtual thread. Idempotent. */
    public synchronized void start() {
        if (running) return;
@@ -71,11 +56,7 @@ public final class StatusPoller {
                try {
                    // herdr's agent_status can misreport a settled worker as `unknown`; refine it
                    // against the pane content before it drives delivery/completion (CB-115).
-                    // CB-185: refine THROUGH the same control the raw status came from — a router
-                    // splits lead/member targets across two herdr daemons, and reading a lead's pane
-                    // through the (fixed) member refiner never finds it, wedging that lead at UNKNOWN.
-                    AgentControl control = router != null ? router.agentsFor(target) : agents;
-                    AgentStatus status = refiner.refine(target, control.status(target), control);
+                    AgentStatus status = refiner.refine(target, agents.status(target));
                    injector.onStatus(target, status);
                } catch (HerdrException e) {
                    // The worker's agent is gone — stop trying and unblock its waiters.
@@ -1,7 +1,7 @@
-package dev.ltms.fleet.inject;
+package dev.ltms.bridged.inject;

-import dev.ltms.fleet.herdr.AgentControl;
-import dev.ltms.fleet.herdr.AgentStatus;
+import dev.ltms.bridged.herdr.AgentControl;
+import dev.ltms.bridged.herdr.AgentStatus;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -41,32 +41,15 @@ public final class StatusRefiner {
    }

    /**
-     * Return a trustworthy status for {@code target}, reading its pane through this refiner's own
-     * {@link AgentControl}. Equivalent to {@link #refine(String, AgentStatus, AgentControl)} with
-     * that control — kept for callers that only ever talk to one herdr daemon.
+     * Return a trustworthy status for {@code target}. Any non-{@code UNKNOWN} {@code raw} is returned
+     * unchanged; an {@code UNKNOWN} triggers a pane read and content classification. A read failure
+     * leaves it {@code UNKNOWN} (the safe default: no delivery, and the stall path still applies).
     */
    public AgentStatus refine(String target, AgentStatus raw) {
-        return refine(target, raw, agents);
-    }
-
-    /**
-     * Return a trustworthy status for {@code target}. Any non-{@code UNKNOWN} {@code raw} is returned
-     * unchanged; an {@code UNKNOWN} triggers a pane read (through {@code control}) and content
-     * classification. A read failure leaves it {@code UNKNOWN} (the safe default: no delivery, and
-     * the stall path still applies).
-     *
-     * <p>CB-185: {@code control} must be the {@link AgentControl} for the <em>same</em> daemon the
-     * raw status was sampled from — a router splits lead and member targets across two herdr
-     * daemons, and reading a lead's pane through the member client (or vice versa) fails to find
-     * the pane and leaves the target wedged at {@code UNKNOWN} forever. Callers that route per
-     * target (e.g. {@code StatusPoller}) must pass that target's control explicitly rather than
-     * relying on the control fixed at construction.
-     */
-    public AgentStatus refine(String target, AgentStatus raw, AgentControl control) {
        if (raw != AgentStatus.UNKNOWN) return raw;
        String pane;
        try {
-            pane = control.read(target, PROBE_SOURCE);
+            pane = agents.read(target, PROBE_SOURCE);
        } catch (RuntimeException e) {
            log.debug("status refine read for {} failed; leaving UNKNOWN: {}", target, e.getMessage());
            return AgentStatus.UNKNOWN;
@@ -1,12 +1,10 @@
-package dev.ltms.fleet.inject;
-
-import dev.ltms.fleet.msg.TurnToken;
+package dev.ltms.bridged.inject;

 /**
 * Notified when a worker's delegated turn is observed to complete — a confirmed
 * {@code WORKING → IDLE} transition after a delivery. This is the CB-106 completion signal the
 * {@code CompletionResolver} uses to resolve a blocked send whose worker never called
- * {@code fleet_reply}. Kept as a seam so the {@link Injector} needs no dependency on the message
+ * {@code bridge_reply}. Kept as a seam so the {@link Injector} needs no dependency on the message
 * layer and stays unit-testable with a capturing fake.
 */
@FunctionalInterface
@@ -43,14 +41,6 @@ public interface TurnListener {
    default void onTurnFailed(String target) {
    }

-    /**
-     * As {@link #onTurnFailed(String)}, carrying the reason a worker became unreachable. The default
-     * keeps existing listeners working while allowing the completion resolver to report a useful cause.
-     */
-    default void onTurnFailed(String target, String reason) {
-        onTurnFailed(target);
-    }
-
    /**
     * A message was just delivered into {@code target}'s pane (CB-115). Fired so the completion
     * resolver can snapshot the pane's pre-turn content: a later {@link #onTurnComplete} whose
@@ -59,7 +49,7 @@ public interface TurnListener {
     * resolve the send with the previous turn's stale answer. A default no-op keeps the interface
     * functional for callers that don't scrape.
     */
-    default void onDelivered(String target, TurnToken token) {
+    default void onDelivered(String target) {
    }

    /** No-op default for callers that only need delivery, not completion signalling. */
@@ -1,12 +1,12 @@
-package dev.ltms.fleet.lead;
+package dev.ltms.bridged.lead;

-import dev.ltms.fleet.config.FleetConfig;
-import dev.ltms.fleet.herdr.Agent;
-import dev.ltms.fleet.herdr.AgentControl;
-import dev.ltms.fleet.herdr.HerdrException;
-import dev.ltms.fleet.herdr.Tab;
-import dev.ltms.fleet.herdr.Workspace;
-import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.bridged.config.BridgedConfig;
+import dev.ltms.bridged.herdr.Agent;
+import dev.ltms.bridged.herdr.AgentControl;
+import dev.ltms.bridged.herdr.HerdrException;
+import dev.ltms.bridged.herdr.Tab;
+import dev.ltms.bridged.herdr.Workspace;
+import dev.ltms.bridged.herdr.WorkspaceControl;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -15,7 +15,8 @@ import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
-import dev.ltms.fleet.peer.PeerLauncher;
+import java.util.Set;
+import java.util.stream.Collectors;

 /**
 * Starts the leads {@code fleet.leaders:} declares, when none is already running (CB-558).
@@ -25,7 +26,7 @@ import dev.ltms.fleet.peer.PeerLauncher;
 * must never receive:
 * <ol>
 *   <li>it appends the <em>reply charter</em> — "you are an off-subscription worker … end every turn
- *       with {@code fleet_reply}". A lead is the orchestrator; telling it that it is a worker is
+ *       with {@code bridge_reply}". A lead is the orchestrator; telling it that it is a worker is
 *       exactly backwards.</li>
 *   <li>it registers the session with {@code SessionManager}, which subjects it to the idle reaper,
 *       the context cap and the shutdown drain. An idle lead is the normal state of a lead, so the
@@ -39,7 +40,7 @@ import dev.ltms.fleet.peer.PeerLauncher;
 * broken later, quietly.
 *
 * <p><strong>Liveness, and the label round-trip.</strong> {@code LeadTabScanner} used to be able to
- * promise that fleetd never writes a lead label. That is no longer true — an auto-launched lead is
+ * promise that bridged never writes a lead label. That is no longer true — an auto-launched lead is
 * labelled by this class, and the scanner reads that label back. The risk this opens is not
 * privilege escalation (the tab label never granted anything a pane could take for itself; see that
 * class's javadoc), but <em>staleness</em>: a label left behind by a crashed session would otherwise
@@ -53,14 +54,14 @@ public final class LeadLauncher {

    private final AgentControl agents;
    private final WorkspaceControl spaces;
-    private final FleetConfig cfg;
+    private final BridgedConfig cfg;

    /**
     * @param agents herdr agent control (start, list)
     * @param spaces workspace / tab control (ensure, create, label, list)
-     * @param cfg    the loaded config — {@code fleet.leaders}, {@code profiles} and each lead's tab
+     * @param cfg    the loaded config — {@code fleet.leaders}, {@code profiles} and the lead pins
     */
-    public LeadLauncher(AgentControl agents, WorkspaceControl spaces, FleetConfig cfg) {
+    public LeadLauncher(AgentControl agents, WorkspaceControl spaces, BridgedConfig cfg) {
        this.agents = agents;
        this.spaces = spaces;
        this.cfg = cfg;
@@ -74,7 +75,7 @@ public final class LeadLauncher {
     * the remaining leads are still attempted.
     */
    public int ensureLeads() {
-        Map<String, FleetConfig.Leader> leaders = cfg.fleet().leaders();
+        Map<String, BridgedConfig.Leader> leaders = cfg.fleet().leaders();
        if (leaders.isEmpty()) {
            return 0;
        }
@@ -90,9 +91,9 @@ public final class LeadLauncher {
        }

        int started = 0;
-        for (Map.Entry<String, FleetConfig.Leader> e : leaders.entrySet()) {
+        for (Map.Entry<String, BridgedConfig.Leader> e : leaders.entrySet()) {
            String name = e.getKey();
-            FleetConfig.Leader lead = e.getValue();
+            BridgedConfig.Leader lead = e.getValue();
            int running = live.getOrDefault(name, 0);
            int wanted = lead.instances();

@@ -101,15 +102,15 @@ public final class LeadLauncher {
                continue;
            }
            if (!lead.isCreatable()) {
-                // A lead with a `tab:` but no `profile:` is recognise-only by design: the operator
-                // opens it by hand. Say so once rather than looking like a silent failure.
+                // A lead with a `terminal:` pin and no `profile:` is recognise-only by design: the
+                // operator opens it by hand. Say so once rather than looking like a silent failure.
                log.info("lead '{}' is not live, and names no profile — it can be recognised but not "
-                        + "launched. Add `profile:` under fleet.leaders.{} to have fleetd start it.",
+                        + "launched. Add `profile:` under fleet.leaders.{} to have bridged start it.",
                        name, name);
                continue;
            }

-            FleetConfig.Profile profile = cfg.profiles().get(lead.profile());
+            BridgedConfig.Profile profile = cfg.profiles().get(lead.profile());
            if (profile == null) {
                log.warn("lead '{}' names profile '{}', which is not configured — not launching",
                        name, lead.profile());
@@ -126,27 +127,29 @@ public final class LeadLauncher {
    }

    /**
-     * How many live leads exist per configured name: a running agent in a tab labelled with that
-     * lead's exact {@code tab} (CB-579). Member workspaces are excluded, exactly as the scanner
-     * excludes them: a member must not be counted as a lead because it happens to sit in a matching
-     * tab.
+     * How many live leads exist per configured name.
     *
-     * <p>There used to be a second path here — a running agent on the terminal a
-     * {@code fleet.leaders.<name>.terminal} pin named, for a lead opened and pinned by hand. That
-     * pin is retired: {@code tab} is now the only field identity depends on, and {@link Agent}
-     * already carries {@link Agent#tabId()} directly, so a hand-opened lead is found the same way an
-     * auto-launched one is — by labelling its tab to match.
+     * <p>Two independent pieces of evidence, because either alone double-spawns:
+     * <ul>
+     *   <li>a running agent in a tab labelled {@code "<tabPrefix> <name>"} — how an auto-launched
+     *       lead, or an operator following the labelling convention, is found;</li>
+     *   <li>a running agent on a terminal the config pins in {@code fleet.leaders.<name>.terminal} —
+     *       how a lead the operator opened and pinned by hand is found. Without this, a pinned lead
+     *       whose tab carries no matching label would be relaunched on every boot.</li>
+     * </ul>
+     * Member workspaces are excluded, exactly as the scanner excludes them: a member must not be
+     * counted as a lead because it happens to sit in a matching tab.
     */
-    private Map<String, Integer> liveLeads(Map<String, FleetConfig.Leader> leaders) {
-        // A lead and the members share ONE workspace now (the operator asked for a single "session"
-        // with many tabs), so a workspace can no longer be excluded wholesale — the lead lives in the
-        // member workspace by design. The sole discriminator is the exact tab label: a lead carries
-        // its configured `fleet.leaders.<name>.tab` ("lead: opus"), while a member carries its
-        // profile's `worker: {profile} #{n}` template. These never collide, so an exact-label match
-        // separates them without needing to know which workspace anyone is in.
+    private Map<String, Integer> liveLeads(Map<String, BridgedConfig.Leader> leaders) {
+        Set<String> memberSpaces = cfg.profiles().values().stream()
+                .map(BridgedConfig.Profile::workspace)
+                .filter(w -> w != null && !w.isBlank())
+                .collect(Collectors.toSet());
+
+        // tabId → the lead name its label declares.
        Map<String, String> nameByTab = new LinkedHashMap<>();
        for (Workspace ws : spaces.listWorkspaces()) {
-            if (ws.workspaceId() == null) {
+            if (ws.workspaceId() == null || memberSpaces.contains(ws.label())) {
                continue;
            }
            for (Tab tab : spaces.listTabs(ws.workspaceId())) {
@@ -157,9 +160,20 @@ public final class LeadLauncher {
            }
        }

+        // terminalId → the lead name the config pins it to.
+        Map<String, String> nameByPinnedTerminal = new LinkedHashMap<>();
+        leaders.forEach((name, lead) -> {
+            if (lead.terminal() != null && !lead.terminal().isBlank()) {
+                nameByPinnedTerminal.put(lead.terminal().strip(), name);
+            }
+        });
+
        Map<String, Integer> counts = new LinkedHashMap<>();
        for (Agent a : agents.list()) {
            String name = nameByTab.get(a.tabId());
+            if (name == null) {
+                name = nameByPinnedTerminal.get(a.terminalId());
+            }
            if (name != null) {
                counts.merge(name, 1, Integer::sum);
            }
@@ -170,17 +184,16 @@ public final class LeadLauncher {
    /**
     * The configured lead a tab label names, or {@code null} for a label that names none.
     *
-     * <p>Matched exactly (case-insensitively) against each lead's configured {@code tab}, so an
+     * <p>Matched against the declared lead names rather than by splitting on the prefix, so an
     * operator's {@code "lead: something-else"} tab is not mistaken for a configured lead.
     */
-    private String leadNameOf(String label, Map<String, FleetConfig.Leader> leaders) {
+    private String leadNameOf(String label, Map<String, BridgedConfig.Leader> leaders) {
        if (label == null) {
            return null;
        }
        String l = label.strip();
-        for (Map.Entry<String, FleetConfig.Leader> e : leaders.entrySet()) {
-            String tab = e.getValue().tabLabel();
-            if (tab != null && l.equalsIgnoreCase(tab.strip())) {
+        for (Map.Entry<String, BridgedConfig.Leader> e : leaders.entrySet()) {
+            if (l.equalsIgnoreCase(e.getValue().tabLabel(e.getKey()).strip())) {
                return e.getKey();
            }
        }
@@ -188,8 +201,8 @@ public final class LeadLauncher {
    }

    /** Start one lead. Returns false (having logged) rather than throwing on any failure. */
-    private boolean launch(String name, FleetConfig.Leader lead, FleetConfig.Profile profile) {
-        String label = lead.tabLabel();
+    private boolean launch(String name, BridgedConfig.Leader lead, BridgedConfig.Profile profile) {
+        String label = lead.tabLabel(name);
        String cwd = (lead.cwd() == null || lead.cwd().isBlank())
                ? System.getProperty("user.dir") : lead.cwd();

@@ -235,7 +248,7 @@ public final class LeadLauncher {
     * The herdr agent kind for this profile — the same value the matching member adapter passes, so
     * herdr resolves the same executable for a lead as it does for a member on that backend.
     */
-    private static String herdrKind(FleetConfig.Profile profile) {
+    private static String herdrKind(BridgedConfig.Profile profile) {
        return profile.isOpenCode() ? "opencode" : "claude";
    }

@@ -247,12 +260,11 @@ public final class LeadLauncher {
     * any other primary. This is the single most important difference from the member launchers;
     * do not "unify" it back.
     */
-    private List<String> leadArgv(FleetConfig.Profile profile) {
+    private List<String> leadArgv(BridgedConfig.Profile profile) {
        List<String> argv = new ArrayList<>(profile.argv());
        if (profile.hasMcp()) {
            argv.add("--mcp-config");
-            argv.add("{\"mcpServers\":{\"" + PeerLauncher.MCP_MOUNT_NAME
-                    + "\":{\"type\":\"http\",\"url\":\""
+            argv.add("{\"mcpServers\":{\"bridge\":{\"type\":\"http\",\"url\":\""
                    + profile.mcpUrl() + "\"}}}");
        }
        // Appended last, for the same reason the member launcher does it (CB-533): the argv is
@@ -274,7 +286,7 @@ public final class LeadLauncher {
     * definition, so there is no configuration under which pointing it elsewhere is correct, and a
     * profile that carries them (a member profile reused as a lead's backend) must not leak them in.
     */
-    private Map<String, String> leadEnv(FleetConfig.Profile profile) {
+    private Map<String, String> leadEnv(BridgedConfig.Profile profile) {
        Map<String, String> out = new LinkedHashMap<>();
        if (profile.env() != null) {
            out.putAll(profile.env());
@@ -0,0 +1,970 @@
+package dev.ltms.bridged.mcp;
+
+import dev.ltms.bridged.auth.AuditLog;
+import dev.ltms.bridged.auth.Authz;
+import dev.ltms.bridged.auth.CallerResolver;
+import dev.ltms.bridged.auth.Principal;
+import dev.ltms.bridged.auth.Role;
+import dev.ltms.bridged.guard.GuardException;
+import dev.ltms.bridged.herdr.Agent;
+import dev.ltms.bridged.metrics.BridgedMetrics;
+import dev.ltms.bridged.metrics.Metrics;
+import dev.ltms.bridged.inject.MemberPresence;
+import dev.ltms.bridged.herdr.HerdrException;
+import dev.ltms.bridged.msg.MessageService;
+import dev.ltms.bridged.msg.Rendezvous;
+import dev.ltms.bridged.peer.PeerUnreachableException;
+import dev.ltms.bridged.session.SessionManager;
+import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.bridged.session.WorktreeRequest;
+import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.bridged.peer.PeerLauncher;
+import io.modelcontextprotocol.common.McpTransportContext;
+import io.modelcontextprotocol.json.McpJsonMapper;
+import io.modelcontextprotocol.json.jackson3.JacksonMcpJsonMapperSupplier;
+import io.modelcontextprotocol.server.McpServer;
+import io.modelcontextprotocol.server.McpSyncServer;
+import io.modelcontextprotocol.server.McpSyncServerExchange;
+import io.modelcontextprotocol.server.transport.HttpServletStreamableServerTransportProvider;
+import io.modelcontextprotocol.spec.McpSchema;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import jakarta.servlet.http.HttpServlet;
+
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+/**
+ * The MCP SERVER face (CB-105): a Streamable-HTTP MCP server whose tools are <em>thin adapters</em>
+ * over the same {@link MessageService}/{@link Rendezvous} the REST routes use — so the two are
+ * validated by parity, not by re-implementing behaviour. The primary Opus calls {@code bridge_send}
+ * / {@code bridge_status}; the worker calls {@code bridge_reply}.
+ *
+ * <p>Beyond delegation the primary also manages the fleet here (CB-108): {@code bridge_spawn} /
+ * {@code bridge_list} / {@code bridge_stop} drive the {@link PeerLauncher} SPI so a worker's whole
+ * lifecycle is managed through MCP, with each adapter's subscription boundary enforced inside it.
+ *
+ * <p>The tool <em>logic</em> lives in package-private static methods returning a
+ * {@link McpSchema.CallToolResult}, so it is unit-testable without standing up the HTTP transport;
+ * the SDK owns the wire protocol. Mount {@link #servlet()} at {@code /mcp} on the daemon's Jetty.
+ */
+public final class BridgeMcp {
+
+    private static final long DEFAULT_TIMEOUT_MS = 25_000;
+    private static final long MAX_TIMEOUT_MS = 120_000;
+    // bridge_ask blocks the WORKER's own MCP call, which its client caps near 60s — default under
+    // that so the bridge returns a clean timeout before the client severs the call (CB-205).
+    private static final long ASK_DEFAULT_TIMEOUT_MS = 55_000;
+    private static final long ASK_MAX_TIMEOUT_MS = 115_000;
+    private static final ObjectMapper MAPPER = new ObjectMapper(); // worker-view JSON projections
+
+    /** Transport-context key under which the extractor stashes the resolved caller identity. */
+    static final String CALLER_TERMINAL = "callerTerminal";
+    /** Transport-context key under which the extractor stashes the caller's PID (for cwd inherit). */
+    static final String CALLER_PID = "callerPid";
+    /** Transport-context key under which the extractor stashes the resolved {@link Role} (CB-501). */
+    static final String CALLER_ROLE = "callerRole";
+    /** Transport-context key for the lead's configured name, when the caller is one (CB-530). */
+    static final String CALLER_NAME = "callerName";
+
+    private final HttpServletStreamableServerTransportProvider transport;
+    private final McpSyncServer server;
+    private final CallerResolver authz; // CB-501: null → authorization not enforced (legacy)
+    private final Metrics metrics;      // CB-502: null → auth failures not counted
+
+    /**
+     * Legacy constructor — no authorization. Retained so existing tests exercise tool behaviour
+     * without an auth fixture.
+     */
+    public BridgeMcp(MessageService messages, PeerLauncher workers,
+                     SessionManager sessions, ConnectionIdentity identity, MemberPresence presence,
+                     PrimaryRegistry primaryRegistry) {
+        this(messages, workers, sessions, identity, presence, primaryRegistry, null, null);
+    }
+
+    /**
+     * @param callers resolves each call's {@link Principal}; {@code null} disables authorization.
+     *                This surface needs its own enforcement: {@code /mcp} is a raw servlet on
+     *                Jetty's context handler and never passes through Javalin's {@code before}
+     *                filter, so the REST guard does not cover it.
+     * @param metrics registry for auth-failure counting; may be {@code null}
+     */
+    public BridgeMcp(MessageService messages, PeerLauncher workers,
+                     SessionManager sessions, ConnectionIdentity identity, MemberPresence presence,
+                     PrimaryRegistry primaryRegistry, CallerResolver callers, Metrics metrics) {
+        McpJsonMapper json = new JacksonMcpJsonMapperSupplier().get();
+        this.transport = HttpServletStreamableServerTransportProvider.builder()
+                .jsonMapper(json)
+                .mcpEndpoint("/mcp")
+                // Resolve the caller from the connection (peer PID → herdr pane) in one lookup: the
+                // worker terminal for bridge_reply (no spoofable arg), and the PID so bridge_spawn can
+                // inherit the primary's cwd (CB-112). Any contact from a worker marks it available
+                // (CB-113) — its MCP initialize is the reliable "the agent is up" signal.
+                .contextExtractor(req -> {
+                    // One resolution per call, shared with the REST surface via CallerResolver so
+                    // the two paths cannot drift on who a caller is.
+                    Principal p = callers != null
+                            ? callers.resolve(req.getRemoteAddr(), req.getRemotePort(),
+                                    req.getHeader("Authorization"))
+                            : legacyPrincipal(identity, req.getRemoteAddr(), req.getRemotePort());
+                    // CB-532: guard on the ROLE, not on the terminal being null. This excludes a
+                    // lead, which carries its pane too, while including every spawned member role.
+                    // Enrolling a lead would count it as an available member in the roster.
+                    markSpawnedMemberPresent(p, presence);
+                    return McpTransportContext.create(Map.of(
+                            CALLER_TERMINAL, orEmpty(p.terminal()),
+                            CALLER_PID, Long.toString(p.pid()),
+                            CALLER_ROLE, p.role().name(),
+                            CALLER_NAME, orEmpty(p.name())));
+                })
+                .build();
+        this.server = McpServer.sync(transport)
+                .serverInfo("bridge", "0.1.0")
+                .capabilities(McpSchema.ServerCapabilities.builder().tools(true).build())
+                .toolCall(sendTool(), (exchange, req) -> {
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.SEND,
+                            str(req.arguments(), "sessionId"));
+                    if (denied != null) return denied;
+                    String caller = callerTerminal(exchange);
+                    // CB-548: only a PRIMARY caller may claim the legacy singleton "primary" fallback.
+                    // An architect delegates as its own pane but must never become the fallback that
+                    // no-delegation inbox nudges target as if it were the primary (the per-target
+                    // delegation map does not cure the singleton).
+                    recordPrimarySingleton(primaryRegistry, caller, principal(exchange));
+                    Map<String, Object> a = req.arguments();
+                    String target = str(a, "sessionId");
+                    String content = str(a, "content");
+                    String turnId = str(a, "turnId");
+                    if (turnId != null && !turnId.isBlank()) {
+                        // Answering a worker's bridge_ask (CB-205): resolve its blocked question and
+                        // block for the worker's reply as it resumes the same turn. This is the same
+                        // delegation, so ownership is left untouched (CB-548) — never re-recorded.
+                        return answer(messages, turnId, content, timeoutMs(a));
+                    }
+                    // CB-548: delegator ownership (which lead's reply nudge this worker routes to,
+                    // CB-532) is recorded only once the send is ACCEPTED — MessageService has won the
+                    // session lock and queued delivery — via the accepted-delivery callback, never at
+                    // request time. A concurrent sender that times out BUSY therefore cannot steal a
+                    // live turn's reply routing without ever owning the turn.
+                    Runnable onAccepted = () -> primaryRegistry.recordDelegation(target, caller);
+                    // wait defaults to true (block for the reply); wait:false is fire-and-poll.
+                    return Boolean.FALSE.equals(a.get("wait"))
+                            ? sendAsync(messages, target, content, onAccepted)
+                            : send(messages, target, content, timeoutMs(a), onAccepted);
+                })
+                // bridge_reply's identity is the CONNECTION, never an argument — so the authz check
+                // is "is this caller a worker at all", and it can only ever reply as itself.
+                .toolCall(replyTool(), (exchange, req) -> {
+                    String self = callerTerminal(exchange);
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.REPLY, self);
+                    if (denied != null) return denied;
+                    return reply(messages, self, str(req.arguments(), "content"));
+                })
+                // bridge_ask (CB-205): a worker's mid-turn question — identity from the CONNECTION.
+                .toolCall(askTool(), (exchange, req) -> {
+                    String self = callerTerminal(exchange);
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.ASK, self);
+                    if (denied != null) return denied;
+                    return ask(messages, self, str(req.arguments(), "question"), timeoutMs(req.arguments()));
+                })
+                .toolCall(statusTool(), (exchange, req) -> {
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
+                    if (denied != null) return denied;
+                    return status(messages, str(req.arguments(), "sessionId"));
+                })
+                .toolCall(pollTool(), (exchange, req) -> {
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
+                    if (denied != null) return denied;
+                    Map<String, Object> a = req.arguments();
+                    return poll(messages, str(a, "ticket"), str(a, "target"));
+                })
+                // CB-307 Increment 3: per-msgId ack (not needed in v1 but supported by the inbox).
+                // Acking removes a reply from the inbox, so it is a drain, not a read.
+                .toolCall(ackTool(), (exchange, req) -> {
+                    Map<String, Object> a = req.arguments();
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.DRAIN, str(a, "target"));
+                    if (denied != null) return denied;
+                    return ack(messages, str(a, "target"), str(a, "msgId"));
+                })
+                // Fleet management (CB-108): spawn/list/stop over ClaudeCodeLauncher.
+                .toolCall(spawnTool(), (exchange, req) -> {
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.SPAWN, null);
+                    if (denied != null) return denied;
+                    String caller = callerTerminal(exchange);
+                    // SPAWN is already auth-gated to PRIMARY (architects can never call it), but
+                    // enforce the same invariant here: only a PRIMARY may claim the legacy singleton.
+                    recordPrimarySingleton(primaryRegistry, caller, principal(exchange));
+                    Map<String, Object> a = req.arguments();
+                    // CB-112: worker inherits the primary's cwd unless the call pins one.
+                    // CB-301: carry the caller's identity as the session owner (null for the primary).
+                    // CB-301-ext: optional isolated worktree for parallel implementers.
+                    String callerCwd = identity.cwdForPid(callerPid(exchange));
+                    return spawn(sessions, str(a, "profile"), str(a, "role"), str(a, "cwd"), callerCwd,
+                            callerTerminal(exchange), worktreeRequest(a));
+                })
+                .toolCall(listTool(), (exchange, _) -> {
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
+                    if (denied != null) return denied;
+                    return listFleet(workers, sessions,
+                            callers == null ? Map.of() : callers.leads(),
+                            callerTerminal(exchange));
+                })
+                .toolCall(stopTool(), (exchange, req) -> {
+                    String paneId = str(req.arguments(), "paneId");
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.STOP, paneId);
+                    if (denied != null) return denied;
+                    return stop(sessions, paneId);
+                })
+                .toolCall(profilesTool(), (exchange, _) -> {
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
+                    if (denied != null) return denied;
+                    return profiles(workers);
+                })
+                .toolCall(whoamiTool(), (exchange, _) -> {
+                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
+                    if (denied != null) return denied;
+                    return whoami(principal(exchange), sessions);
+                })
+                .build();
+        this.authz = callers;
+        this.metrics = metrics;
+    }
+
+    /**
+     * Pre-CB-501 identity: worker if the connection maps to a pane, otherwise the primary. Used
+     * only by the legacy constructor, where authorization is not enforced anyway.
+     */
+    private static Principal legacyPrincipal(ConnectionIdentity identity, String addr, int port) {
+        ConnectionIdentity.Caller c = identity.resolve(addr, port);
+        return c.terminal() != null
+                ? Principal.worker(c.terminal(), c.pid())
+                : Principal.primary(c.pid());
+    }
+
+    /** The caller reconstructed from the transport context. */
+    private static Principal principal(McpSyncServerExchange exchange) {
+        return principalFrom(exchange.transportContext().get(CALLER_ROLE),
+                callerTerminal(exchange), callerPid(exchange), callerName(exchange));
+    }
+
+    /**
+     * Rebuild a {@link Principal} from the three values the context extractor stashed.
+     *
+     * <p>Split out from {@link #principal(McpSyncServerExchange)} so the identity rules are
+     * reachable without an {@code McpSyncServerExchange} — that is an SDK type this project has no
+     * mocking library to fabricate, which is why this logic had no test at all until CB-513.
+     *
+     * @param role     the stashed {@link Role} name, or {@code null} on the legacy path
+     * @param terminal the worker terminal, or {@code null} for a non-worker
+     * @param pid      the calling pid, or {@code -1}
+     */
+    static Principal principalFrom(Object role, String terminal, long pid) {
+        return principalFrom(role, terminal, pid, null);
+    }
+
+    /** As {@link #principalFrom(Object, String, long)}, carrying a lead's name (CB-530). */
+    static Principal principalFrom(Object role, String terminal, long pid, String name) {
+        if (role == null) {
+            // No role stashed (legacy path): fall back to the historical interpretation.
+            return terminal != null ? Principal.worker(terminal, pid) : Principal.primary(pid);
+        }
+        return new Principal(Role.valueOf(role.toString()), terminal, pid, name);
+    }
+
+    /**
+     * Gate a tool call on the CB-505 table. Returns {@code null} when the call may proceed, or the
+     * error result to return when it may not.
+     */
+    private McpSchema.CallToolResult deny(McpSyncServerExchange exchange, Authz.Action action,
+                                          String target) {
+        return denyFor(principal(exchange), action, target);
+    }
+
+    /**
+     * The policy half of {@link #deny}: everything except pulling the caller out of the MCP
+     * exchange. Kept separate so the authorization decision — the actual control — is unit-testable
+     * without fabricating an SDK {@code McpSyncServerExchange}.
+     *
+     * <p>This surface exists because the enforcement was previously unreachable from a test: no
+     * test constructs a {@code BridgeMcp}, so the whole MCP-side gate ran zero times in the suite
+     * while the REST-side equivalent had ten tests. A security control nothing exercises is a
+     * claim, not a control.
+     *
+     * @return {@code null} when the call may proceed, or the error result to return when it may not
+     */
+    McpSchema.CallToolResult denyFor(Principal caller, Authz.Action action, String target) {
+        // The enforcement switch lives HERE rather than in the exchange-facing wrapper: any future
+        // tool that calls this directly must not be able to skip the gate by accident.
+        if (authz == null) {
+            return null; // legacy constructor: authorization not enforced
+        }
+        if (Authz.permits(caller, action, target)) {
+            if (action != Authz.Action.READ) {
+                AuditLog.allowed(caller, action, target); // reads would drown the trail
+            }
+            return null;
+        }
+        String reason = Authz.isUnauthenticated(caller) ? "unauthenticated" : "forbidden";
+        AuditLog.denied(caller, action, target, reason);
+        if (metrics != null) {
+            metrics.inc(BridgedMetrics.AUTH_FAILURES, "reason", reason);
+        }
+        return error(reason + ": " + caller.describe() + " may not " + action);
+    }
+
+    /**
+     * Update the legacy singleton "primary" fallback used for no-delegation inbox nudges (CB-548).
+     *
+     * <p>Only {@link Role#PRIMARY} callers — the unnamed primary and named leads alike — may claim
+     * it. An architect delegates as its own pane but must never become the fallback: the per-target
+     * delegation map ({@code PrimaryRegistry#recordDelegation}) does not cure the singleton, so an
+     * architect left here would draw nudges that belong to a primary. The decision uses the resolved
+     * role, never name/kind sniffing. A null {@code caller} (legacy/no-auth path) records nothing.
+     *
+     * <p>Split out of the tool handlers so the guard is unit-testable without fabricating an SDK
+     * {@code McpSyncServerExchange} (same pattern as {@link #denyFor}/{@link #principalFrom}).
+     */
+    static void recordPrimarySingleton(PrimaryRegistry registry, String callerTerminal, Principal caller) {
+        if (caller != null && caller.isPrimary()) {
+            registry.record(callerTerminal);
+        }
+    }
+
+    /** The worker identity resolved from this call's connection, or {@code null} if the primary. */
+    private static String callerTerminal(McpSyncServerExchange exchange) {
+        Object v = exchange.transportContext().get(CALLER_TERMINAL);
+        String s = v == null ? null : v.toString();
+        return (s == null || s.isBlank()) ? null : s;
+    }
+
+    /** The lead name resolved from this call's connection, or {@code null} (CB-530). */
+    private static String callerName(McpSyncServerExchange exchange) {
+        Object v = exchange.transportContext().get(CALLER_NAME);
+        String s = v == null ? null : v.toString();
+        return (s == null || s.isBlank()) ? null : s;
+    }
+
+    /** The caller's PID resolved from this call's connection, or {@code -1} if unknown. */
+    private static long callerPid(McpSyncServerExchange exchange) {
+        Object v = exchange.transportContext().get(CALLER_PID);
+        try {
+            return v == null ? -1 : Long.parseLong(v.toString());
+        } catch (NumberFormatException e) {
+            return -1;
+        }
+    }
+
+    private static String orEmpty(String s) {
+        return s == null ? "" : s;
+    }
+
+    /** The Streamable-HTTP servlet to mount at {@code /mcp} on the daemon's Jetty. */
+    public HttpServlet servlet() {
+        return transport;
+    }
+
+    /** Mark a connected spawned member available for the injector readiness gate. */
+    static void markSpawnedMemberPresent(Principal caller, MemberPresence presence) {
+        if (caller.isSpawnedMember()) {
+            presence.markPresent(caller.terminal());
+        }
+    }
+
+    /** Graceful shutdown of the MCP server. */
+    public void close() {
+        server.closeGracefully();
+    }
+
+    // --- tool logic (thin adapters over the services; unit-testable) ---------------------------
+
+    /** {@code bridge_send}: delegate {@code content} to a worker session and block for its reply. */
+    static McpSchema.CallToolResult send(MessageService messages, String sessionId, String content, Long timeoutMs) {
+        return send(messages, sessionId, content, timeoutMs, null);
+    }
+
+    /**
+     * As {@link #send(MessageService, String, String, Long)}, wiring an accepted-delivery hook
+     * (CB-548): {@code onAccepted} records delegator ownership the instant the send is accepted, so
+     * a BUSY interloper never claims a turn it did not win. {@code null} disables recording.
+     */
+    static McpSchema.CallToolResult send(MessageService messages, String sessionId, String content,
+                                         Long timeoutMs, Runnable onAccepted) {
+        if (isBlank(sessionId) || isBlank(content)) {
+            return error("sessionId and content are required");
+        }
+        long timeout = clamp(timeoutMs == null ? DEFAULT_TIMEOUT_MS : timeoutMs);
+        try {
+            return formatReply(messages.send(sessionId, content, timeout, onAccepted), timeout);
+        } catch (HerdrException e) {
+            return error("herdr error contacting session " + sessionId + ": " + e.getMessage());
+        }
+    }
+
+    /**
+     * {@code bridge_send} carrying a {@code turnId}: the primary's answer to a worker's
+     * {@code bridge_ask} (CB-205). Resolves the worker's blocked question and blocks for its reply as
+     * it resumes the same turn — surfaced to the primary identically to a normal send.
+     */
+    static McpSchema.CallToolResult answer(MessageService messages, String turnId, String content, Long timeoutMs) {
+        if (isBlank(turnId) || isBlank(content)) {
+            return error("turnId and content are required to answer a worker's question");
+        }
+        long timeout = clamp(timeoutMs == null ? DEFAULT_TIMEOUT_MS : timeoutMs);
+        return formatReply(messages.answer(turnId, content, timeout), timeout);
+    }
+
+    /**
+     * {@code bridge_ask} (CB-205): a worker pauses its delegated turn to ask the primary, blocking
+     * until the primary answers. The worker is identified by its connection ({@code callerTerminal}),
+     * never an argument — a {@code null} means the caller is not a known worker.
+     */
+    static McpSchema.CallToolResult ask(MessageService messages, String callerTerminal, String question, Long timeoutMs) {
+        if (callerTerminal == null) {
+            return error("bridge_ask is for workers only — could not identify the calling worker "
+                    + "from the connection");
+        }
+        if (isBlank(question)) {
+            return error("question is required");
+        }
+        long timeout = Math.clamp(timeoutMs == null ? ASK_DEFAULT_TIMEOUT_MS : timeoutMs, 1, ASK_MAX_TIMEOUT_MS);
+        MessageService.AskResult r = messages.ask(callerTerminal, question, timeout);
+        return switch (r.outcome()) {
+            case ANSWERED -> text(r.answer());
+            case NO_WAITER -> error("no primary is awaiting this turn — bridge_ask only works while a "
+                    + "bridge_send delegation is open to answer it");
+            case TIMED_OUT -> text("[no answer within " + timeout + "ms — the primary did not respond; "
+                    + "proceed on your best judgement, then call bridge_reply to end the turn]");
+        };
+    }
+
+    /** Render a {@link MessageService.Reply} as a tool result — shared by {@link #send} and {@link #answer}. */
+    private static McpSchema.CallToolResult formatReply(MessageService.Reply r, long timeout) {
+        return switch (r.outcome()) {
+            case REPLIED -> text(r.text());
+            // The worker's turn finished but it never called bridge_reply — hand back the scraped
+            // transcript tail, flagged so the primary knows it isn't a structured reply.
+            case COMPLETED_UNREPLIED -> text(
+                    "[worker finished without a structured bridge_reply — transcript tail follows]\n" + r.text());
+            // The worker ran the turn then wedged (CB-109) — surface the error context.
+            case WORKER_FAILED -> text("[worker failed — turn ended in an unrecoverable state]\n" + r.text());
+            // The worker paused mid-turn to ask (CB-205) — tell the primary how to answer in-turn.
+            case QUESTION -> text("[question] the worker paused to ask before it can finish:\n" + r.text()
+                    + "\n\nAnswer it by calling bridge_send again with turnId=\"" + r.turnId()
+                    + "\" and content set to your answer; the worker resumes the same turn.");
+            case STALE_TURN -> error("that question is no longer open — it timed out or was already "
+                    + "answered (turnId stale)");
+            case TIMED_OUT_WORKING, TIMED_OUT_QUEUED, BUSY -> text("[no reply within " + timeout + "ms — worker "
+                    + r.outcome().name().toLowerCase().replace("timed_out_", "") + "; retry or poll status]");
+        };
+    }
+
+    /**
+     * {@code bridge_send} with {@code wait:false}: delegate {@code content} and return a ticket
+     * immediately (fire-and-poll), so a long task isn't cut off by the caller's MCP call timeout.
+     */
+    static McpSchema.CallToolResult sendAsync(MessageService messages, String sessionId, String content) {
+        return sendAsync(messages, sessionId, content, null);
+    }
+
+    /**
+     * As {@link #sendAsync(MessageService, String, String)}, wiring the accepted-delivery hook
+     * (CB-548) so an async flooding send records delegator ownership exactly once it is accepted.
+     */
+    static McpSchema.CallToolResult sendAsync(MessageService messages, String sessionId, String content,
+                                              Runnable onAccepted) {
+        if (isBlank(sessionId) || isBlank(content)) {
+            return error("sessionId and content are required");
+        }
+        String ticket = messages.sendAsync(sessionId, content, onAccepted);
+        return text("accepted — task delegated. Poll bridge_poll with ticket=" + ticket);
+    }
+
+    /** {@code bridge_poll}: check an async delegation by ticket, or drain a worker's inbox by target. */
+    static McpSchema.CallToolResult poll(MessageService messages, String ticket, String target) {
+        if (!isBlank(target)) {
+            var replies = messages.drainReplies(target);
+            if (replies.isEmpty()) {
+                return text("[]");
+            }
+            return text(json(replies));
+        }
+        if (isBlank(ticket)) {
+            return error("ticket (or target) is required");
+        }
+        MessageService.TaskView v = messages.poll(ticket);
+        if (v == null) {
+            return error("unknown ticket: " + ticket + " (never issued, or expired)");
+        }
+        return switch (v.phase()) {
+            case DONE -> text(v.replySource() != null && v.replySource().equals("transcript")
+                    ? "[done — worker finished without a structured bridge_reply; transcript tail follows]\n" + v.reply()
+                    : v.reply());
+            case PENDING -> text("[pending — " + v.detail() + "]");
+            case FAILED -> text("[failed — " + v.detail() + "]");
+        };
+    }
+
+    /**
+     * {@code bridge_reply}: the worker returns its structured answer, resolving the awaiting send
+     * or — when no send is open — queueing the reply in the inbox for later drain (CB-307).
+     * {@code callerTerminal} is resolved from the connection (never an argument); a {@code null}
+     * means the caller is not a known worker (e.g. the primary called it by mistake).
+     */
+    static McpSchema.CallToolResult reply(MessageService messages, String callerTerminal, String content) {
+        if (callerTerminal == null) {
+            return error("bridge_reply is for workers only — could not identify the calling worker "
+                    + "from the connection");
+        }
+        if (content == null) {
+            return error("content is required");
+        }
+        messages.reply(callerTerminal, content);
+        return text("delivered");
+    }
+
+    /** {@code bridge_ack}: acknowledge (remove) a specific reply from the inbox. */
+    static McpSchema.CallToolResult ack(MessageService messages, String target, String msgId) {
+        if (isBlank(target) || isBlank(msgId)) {
+            return error("target and msgId are required");
+        }
+        messages.ackReply(target, msgId);
+        return text("acknowledged " + msgId);
+    }
+
+    /** {@code bridge_status}: the live lifecycle status of a worker session. */
+    static McpSchema.CallToolResult status(MessageService messages, String sessionId) {
+        if (isBlank(sessionId)) {
+            return error("sessionId is required");
+        }
+        try {
+            return text(messages.status(sessionId).name().toLowerCase());
+        } catch (HerdrException e) {
+            return error("herdr error for session " + sessionId + ": " + e.getMessage());
+        }
+    }
+
+    /**
+     * {@code bridge_whoami}: the caller's own identity, as the daemon already resolved it.
+     *
+     * <p>Every other tool <em>consumes</em> this identity — the authorization gate, the reply
+     * rendezvous, the cwd inherit — but none reported it, so an agent had to infer its own role
+     * from side channels the daemon does not control: a charter string in its system prompt, the
+     * name its MCP mount happens to carry, or {@code ANTHROPIC_BASE_URL} (which Claude-model
+     * workers do not set). The failure mode of guessing is asymmetric and silent: a primary that
+     * mistakes itself for a worker is refused by {@link Authz} and learns immediately, while a
+     * worker that mistakes itself for the primary ends its turn without {@code bridge_reply} and
+     * the sender simply receives nothing. This tool removes the guess.
+     *
+     * <p>For a worker the session registry adds what it knows about that session. A worker the
+     * registry has no record of — one that outlived a daemon restart — still gets its role and
+     * {@code sessionId}, which is the load-bearing part.
+     */
+    static McpSchema.CallToolResult whoami(Principal caller, SessionManager sessions) {
+        Map<String, Object> m = new LinkedHashMap<>();
+        m.put("role", caller.role().name().toLowerCase());
+        if (caller.isArchitect()) {
+            // CB-548: the role reads "architect"; the name is the gateway-local slot the pane is
+            // bound to, and the pane itself so a peer knows where to reach it.
+            if (caller.name() != null) {
+                m.put("architect", caller.name());
+            }
+            if (caller.terminal() != null) {
+                m.put("sessionId", caller.terminal());
+            }
+            return text(json(m));
+        }
+        if (!caller.isWorker()) {
+            // CB-530: which lead, once more than one pane is configured as one. `role` deliberately
+            // still reads "primary" — the fallback ladder in CLAUDE.md keys on it, and a lead IS a
+            // primary for authorization; the name is additive so no existing reader breaks.
+            if (caller.name() != null) {
+                m.put("leader", caller.name());
+            }
+            // CB-532: a lead's own pane, so it can tell a peer where to reach it — and so an
+            // operator can read off which tab hosts which lead without going to herdr.
+            if (caller.terminal() != null) {
+                m.put("sessionId", caller.terminal());
+            }
+            return text(json(m));
+        }
+        m.put("sessionId", caller.terminal());
+        sessions.roster().stream()
+                .filter(s -> caller.terminal().equals(s.terminalId()))
+                .findFirst()
+                .ifPresent(s -> {
+                    m.put("paneId", s.paneId());
+                    m.put("profile", s.profile());
+                    m.put("state", s.state().name().toLowerCase());
+                    if (s.worktree() != null) {
+                        m.put("worktree", s.worktree());
+                    }
+                    if (s.branch() != null) {
+                        m.put("branch", s.branch());
+                    }
+                    if (s.ownerTerminal() != null) {
+                        m.put("owner", s.ownerTerminal());
+                    }
+                });
+        return text(json(m));
+    }
+
+    // --- fleet management logic (CB-108 / CB-301) --------------------------------------------
+
+    /** {@code bridge_spawn} without cwd/caller context (default resolution). */
+    static McpSchema.CallToolResult spawn(SessionManager sessions, String profile) {
+        return spawn(sessions, profile, null, null, null, null, null);
+    }
+
+    /**
+     * {@code bridge_spawn}: launch a guard-checked member for {@code profile} (blank → the default
+     * profile) under {@code role} (blank → {@code dev}), and return its session id + pane id. The
+     * member's cwd is {@code requestedCwd} if given, else the profile's config, else
+     * {@code callerCwd} (the primary's directory), else the daemon's.
+     * CB-301: the session is registered with {@code ownerTerminal} as its owner.
+     * CB-301-ext: {@code worktreeRequest} non-null provisions an isolated git worktree.
+     *
+     * <p>{@code role} and {@code profile} are independent: the role picks the contract, the profile
+     * picks the backend. A reviewer on the same profile as the dev it reviews is a normal spawn.
+     */
+    static McpSchema.CallToolResult spawn(SessionManager sessions, String profile, String role,
+                                          String requestedCwd, String callerCwd,
+                                          String ownerTerminal, WorktreeRequest worktreeRequest) {
+        MemberRole memberRole;
+        try {
+            memberRole = isBlank(role) ? MemberRole.DEV : MemberRole.parse(role);
+        } catch (IllegalArgumentException e) {
+            return error(e.getMessage());
+        }
+        try {
+            MemberSession member = sessions.acquire(isBlank(profile) ? null : profile, memberRole,
+                    requestedCwd, callerCwd, ownerTerminal, worktreeRequest);
+            return text(json(memberView(member)));
+        } catch (GuardException e) {
+            return error("subscription boundary: " + e.getMessage());
+        } catch (IllegalArgumentException e) {
+            return error(e.getMessage()); // unknown / no-default profile
+        } catch (PeerUnreachableException e) {
+            return error("spawn timed out — worker pane never reached injectable state: " + e.getMessage());
+        } catch (HerdrException e) {
+            return error("herdr error spawning worker: " + e.getMessage());
+        }
+    }
+
+    /** Build a {@link WorktreeRequest} from {@code bridge_spawn}'s optional {@code worktree}/{@code ticket} args. */
+    private static WorktreeRequest worktreeRequest(Map<String, Object> a) {
+        Object w = a.get("worktree");
+        if (w == null || Boolean.FALSE.equals(w)) {
+            return null;
+        }
+        String ticket = str(a, "ticket");
+        if (w instanceof String s) {
+            if (s.isBlank() || "false".equalsIgnoreCase(s)) {
+                return null;
+            }
+            if ("true".equalsIgnoreCase(s)) {
+                if (isBlank(ticket)) {
+                    throw new IllegalArgumentException("worktree=true requires a ticket slug");
+                }
+                return new WorktreeRequest(ticket, null);
+            }
+            return new WorktreeRequest(s, null);
+        }
+        if (w instanceof Boolean b && b) {
+            if (isBlank(ticket)) {
+                throw new IllegalArgumentException("worktree=true requires a ticket slug");
+            }
+            return new WorktreeRequest(ticket, null);
+        }
+        return null;
+    }
+
+    /** {@code bridge_profiles}: the configured worker profiles and the default. */
+    static McpSchema.CallToolResult profiles(PeerLauncher workers) {
+        return text(json(Map.of(
+                "profiles", workers.profiles(),
+                "default", workers.defaultProfile() == null ? "" : workers.defaultProfile())));
+    }
+
+    /**
+     * {@code bridge_list}: the whole fleet — {@code leads} and {@code workers} — each merged with
+     * live herdr status. CB-519 decoupled the registry key (a host-unique id) from the herdr pane
+     * coordinate, so the join is on the terminal id, which both the session and the live agent carry.
+     *
+     * <p>CB-535 added the {@code leads} half. Until then this listed the worker roster alone, and a
+     * lead asking "who else is here?" got an empty array — which reads as <em>no peers</em> but
+     * actually means <em>no workers spawned</em>. There was no way at all for a lead to learn a
+     * peer's address; it had to be carried across by a human. Both halves are reported even when a
+     * half is empty, so an empty {@code workers} can no longer be mistaken for an empty fleet.
+     *
+     * <p>Leads are drawn from the resolver rather than from a second registry, so an address listed
+     * here is one that would actually resolve as a lead — see {@link CallerResolver#leads()}. The
+     * caller's own row is flagged {@code "self": true}: a peer needs to tell its own pane apart from
+     * a peer's, and the alternative is every lead calling {@code bridge_whoami} to subtract itself.
+     *
+     * @param leads    terminal_id → lead name, live from the resolver
+     * @param selfTerm the calling pane's terminal id, or blank for a caller with no pane
+     */
+    static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions,
+                                              Map<String, String> leads, String selfTerm) {
+        try {
+            Map<String, Agent> live = workers.list().stream()
+                    .map(Agent.class::cast)
+                    .filter(a -> a.terminalId() != null)
+                    .collect(Collectors.toMap(Agent::terminalId, Function.identity(), (_, b) -> b));
+            List<Map<String, Object>> leadRows = leads.entrySet().stream()
+                    .sorted(Map.Entry.comparingByValue())
+                    .map(e -> leadView(e.getKey(), e.getValue(), live.get(e.getKey()), selfTerm))
+                    .toList();
+            List<Map<String, Object>> out = sessions.roster().stream()
+                    .map(s -> SessionManager.rosterView(s, live.get(s.terminalId())))
+                    .toList();
+            return text(json(Map.of("leads", leadRows, "members", out)));
+        } catch (HerdrException e) {
+            return error("herdr error listing the fleet: " + e.getMessage());
+        }
+    }
+
+    /**
+     * One lead's row: its address, its name, and whether it can be reached right now.
+     *
+     * <p>{@code status} is herdr's live view, and {@code unknown} when herdr is not tracking that
+     * pane as an agent — the honest answer, and the one that matters: a lead whose pane herdr cannot
+     * see is a lead a {@code bridge_send} cannot be typed into. It is reported rather than hidden,
+     * because a peer that has gone unreachable is exactly what the sender needs to know.
+     */
+    private static Map<String, Object> leadView(String terminal, String name, Agent live,
+                                                String selfTerm) {
+        Map<String, Object> m = new LinkedHashMap<>();
+        m.put("sessionId", terminal);
+        m.put("name", name);
+        m.put("status", live == null || live.status() == null
+                ? "unknown" : live.status().name().toLowerCase());
+        if (terminal.equals(selfTerm)) {
+            m.put("self", true);
+        }
+        return m;
+    }
+
+    /** {@code bridge_stop}: tear a worker down by its pane id. */
+    static McpSchema.CallToolResult stop(SessionManager sessions, String paneId) {
+        if (isBlank(paneId)) {
+            return error("paneId is required");
+        }
+        try {
+            sessions.release(paneId);
+            return text("stopped " + paneId);
+        } catch (HerdrException e) {
+            return error("herdr error stopping " + paneId + ": " + e.getMessage());
+        }
+    }
+
+    /** CB-301 projection from the authoritative session registry. */
+    private static Map<String, Object> memberView(MemberSession s) {
+        Map<String, Object> m = new LinkedHashMap<>();
+        m.put("sessionId", s.terminalId());
+        m.put("paneId", s.paneId());
+        // Echo the role back so the caller can see what it actually got, not what it meant to ask
+        // for — a spawn that silently fell back to dev is otherwise invisible.
+        m.put("role", s.role() == null ? "dev" : s.role().wireName());
+        m.put("profile", s.profile());
+        m.put("status", s.state().name().toLowerCase());
+        if (s.worktree() != null) {
+            m.put("worktree", s.worktree());
+        }
+        if (s.branch() != null) {
+            m.put("branch", s.branch());
+        }
+        return m;
+    }
+
+    private static String json(Object o) {
+        try {
+            return MAPPER.writeValueAsString(o);
+        } catch (Exception e) {
+            return String.valueOf(o);
+        }
+    }
+
+    // --- tool schemas --------------------------------------------------------------------------
+
+    private static McpSchema.Tool sendTool() {
+        return tool("bridge_send",
+                "Delegate a task to a worker session. By default blocks until the worker replies and "
+                        + "returns its reply (or a 'still working / queued' note on timeout). Pass wait:false "
+                        + "for a long task to return a ticket immediately, then poll it with bridge_poll. To "
+                        + "answer a worker's bridge_ask, pass its turnId (with content) instead of sessionId.",
+                objectSchema(Map.of(
+                        "sessionId", stringProp("The worker session id (herdr terminal_id) to delegate to"),
+                        "content", stringProp("The task/message to send to the worker (or your answer, with turnId)"),
+                        "timeoutMs", Map.of("type", "integer", "description", "Max ms to wait for a reply (blocking mode)"),
+                        "wait", Map.of("type", "boolean",
+                                "description", "Block for the reply (default true); false returns a ticket to poll"),
+                        "turnId", stringProp("When answering a worker's bridge_ask, its question turnId — "
+                                + "routes your answer back into the same turn (omit for a normal delegation)")),
+                        List.of("content")));
+    }
+
+    private static McpSchema.Tool askTool() {
+        // No target/session arg — the worker's identity is resolved from the connection.
+        return tool("bridge_ask",
+                "Pause your current delegated turn to ask the primary a question, blocking until it "
+                        + "answers — then resume the same turn with the answer. Use this when only the "
+                        + "primary has a decision or detail you need to continue. You do not address the "
+                        + "primary; identity is resolved from your connection.",
+                objectSchema(Map.of(
+                        "question", stringProp("The question to put to the primary"),
+                        "timeoutMs", Map.of("type", "integer",
+                                "description", "Max ms to wait for the primary's answer")),
+                        List.of("question")));
+    }
+
+    private static McpSchema.Tool pollTool() {
+        return tool("bridge_poll",
+                "Check an async delegation (a bridge_send with wait:false) by its ticket: "
+                        + "pending, done (with the worker's reply), or failed. When target (a worker "
+                        + "session id) is present instead of ticket, drain that worker's inbox of "
+                        + "replies delivered when no send was open.",
+                objectSchema(Map.of(
+                        "ticket", stringProp("The ticket returned by bridge_send wait:false"),
+                        "target", stringProp("Worker session id to drain pending replies from (optional)")),
+                        List.of()));
+    }
+
+    private static McpSchema.Tool ackTool() {
+        return tool("bridge_ack",
+                "Acknowledge (remove) a specific reply from a worker's inbox. Use when the primary "
+                        + "has processed a reply and wants to confirm it, leaving other pending replies "
+                        + "in the inbox for later drain.",
+                objectSchema(Map.of(
+                        "target", stringProp("Worker session id whose inbox to ack from"),
+                        "msgId", stringProp("The message id to acknowledge")),
+                        List.of("target", "msgId")));
+    }
+
+    private static McpSchema.Tool spawnTool() {
+        return tool("bridge_spawn",
+                "Spawn a new off-subscription member session. A member has two independent attributes: "
+                        + "role (what it is for) and profile (which backend it runs on). Pass role to pick "
+                        + "the contract — 'dev' implements a unit and opens its own PR, 'reviewer' reviews a "
+                        + "diff it did not write, 'architect' refines a ticket before anyone builds it; omit "
+                        + "it for 'dev'. Pass profile (from bridge_profiles) to pick the backend, or omit it "
+                        + "for the default. The two are independent: a reviewer may run on the same profile "
+                        + "as the dev it reviews. The member opens your current directory by default; pass "
+                        + "cwd to pin a different one. Pass worktree:true (with ticket) or "
+                        + "worktree:<ticket-slug> to provision an isolated git worktree. Returns the member's "
+                        + "sessionId (use with bridge_send) and paneId (use with bridge_stop).",
+                objectSchema(Map.of(
+                        "role", stringProp("What the member is for: architect, dev or reviewer (default dev)"),
+                        "profile", stringProp("Which backend to run it on (omit for the default profile)"),
+                        "cwd", stringProp("Working directory for the member (omit to inherit yours)"),
+                        "worktree", Map.of("type", "string", "description", "'true' or a ticket slug — requests an isolated git worktree"),
+                        "ticket", stringProp("Ticket slug when worktree:true")),
+                        List.of()));
+    }
+
+    private static McpSchema.Tool profilesTool() {
+        return tool("bridge_profiles",
+                "List the configured worker profiles (backends) and which one bridge_spawn uses by default.",
+                objectSchema(Map.of(), List.of()));
+    }
+
+    private static McpSchema.Tool listTool() {
+        return tool("bridge_list",
+                "List the whole fleet the bridge tracks, in two parts. 'leads' are your PEERS — other "
+                        + "orchestrators, each with its sessionId (the address to bridge_send to), "
+                        + "name, live status, and 'self': true on your own row; this is how you "
+                        + "discover a peer lead without being told its address. 'members' are the "
+                        + "sessions delegated to — each with sessionId, paneId, role (architect/dev/"
+                        + "reviewer), profile (the backend it runs on), state, optional "
+                        + "worktree/branch/owner, and live herdr status. An empty 'members' "
+                        + "means no members are spawned; it says nothing about peers.",
+                objectSchema(Map.of(), List.of()));
+    }
+
+    private static McpSchema.Tool stopTool() {
+        return tool("bridge_stop",
+                "Tear down a worker session by its paneId (from bridge_spawn or bridge_list).",
+                objectSchema(Map.of(
+                        "paneId", stringProp("The worker's paneId to stop")),
+                        List.of("paneId")));
+    }
+
+    private static McpSchema.Tool replyTool() {
+        // No session/target arg — the caller's identity is resolved from the connection.
+        return tool("bridge_reply",
+                "Return your structured answer for a message you were sent, resolving the sender's "
+                        + "blocked bridge_send. A worker MUST end every delegated turn with exactly "
+                        + "one of these. A lead uses it only to answer another lead that messaged "
+                        + "it — never to answer a worker, whose turn it is not.",
+                objectSchema(Map.of(
+                        "content", stringProp("Your reply/answer")),
+                        List.of("content")));
+    }
+
+    private static McpSchema.Tool statusTool() {
+        return tool("bridge_status",
+                "Get the live lifecycle status (idle/working/blocked/unknown) of a worker session.",
+                objectSchema(Map.of(
+                        "sessionId", stringProp("The worker session id to query")),
+                        List.of("sessionId")));
+    }
+
+    private static McpSchema.Tool whoamiTool() {
+        return tool("bridge_whoami",
+                "Report who YOU are on the bridge — your role is resolved from your connection "
+                        + "(unforgeable), never from anything you claim. Returns role 'primary' (you "
+                        + "orchestrate: spawn/send/stop; reply ONLY to answer a peer lead that "
+                        + "messaged you, never to answer a worker), 'architect' (you delegate turns "
+                        + "and reply/ask as your own pane, but cannot spawn/stop/drain), or 'worker' "
+                        + "(you were delegated to: you must end every turn with exactly one "
+                        + "bridge_reply, and cannot spawn or send), plus 'leader'/'architect' naming "
+                        + "which one you are, your own sessionId, and profile/worktree/branch when "
+                        + "you are a worker. Call this first when following role-conditional "
+                        + "instructions rather than guessing.",
+                objectSchema(Map.of(), List.of()));
+    }
+
+    // --- small helpers -------------------------------------------------------------------------
+
+    // The SDK 2.0.0 deprecates its own Tool builders without a stable replacement — isolate it here.
+    @SuppressWarnings("deprecation")
+    private static McpSchema.Tool tool(String name, String description, Map<String, Object> inputSchema) {
+        return McpSchema.Tool.builder(name).description(description).inputSchema(inputSchema).build();
+    }
+
+    private static Map<String, Object> objectSchema(Map<String, Object> properties, List<String> required) {
+        return Map.of("type", "object", "properties", properties, "required", required);
+    }
+
+    private static Map<String, Object> stringProp(String description) {
+        return Map.of("type", "string", "description", description);
+    }
+
+    private static McpSchema.CallToolResult text(String s) {
+        return McpSchema.CallToolResult.builder().addTextContent(s == null ? "" : s).build();
+    }
+
+    private static McpSchema.CallToolResult error(String s) {
+        return McpSchema.CallToolResult.builder().addTextContent(s).isError(true).build();
+    }
+
+    private static String str(Map<String, Object> args, String key) {
+        Object v = args.get(key);
+        return v == null ? null : v.toString();
+    }
+
+    private static Long timeoutMs(Map<String, Object> args) {
+        Object v = args.get("timeoutMs");
+        return v instanceof Number n ? n.longValue() : null;
+    }
+
+    private static long clamp(long ms) {
+        return Math.clamp(ms, 1, MAX_TIMEOUT_MS);
+    }
+
+    private static boolean isBlank(String s) {
+        return s == null || s.isBlank();
+    }
+}
@@ -0,0 +1,66 @@
+package dev.ltms.bridged.mcp;
+
+import dev.ltms.bridged.herdr.PaneLocator;
+
+/**
+ * Resolves <em>who is calling</em> an MCP tool from the connection alone — the anti-spoofing
+ * identity model of the MCP contract. It ties the connection's loopback peer PID (from the OS)
+ * to a herdr agent pane (from herdr), yielding the caller's worker {@code terminal_id}. A caller
+ * that maps to no worker pane — the primary, or an off-host client — resolves to {@code null}.
+ *
+ * <p>Both sources are authoritative and unforgeable: the OS reports the real connecting PID, and
+ * herdr owns the PID→pane mapping. A worker cannot claim to be another worker, nor the primary.
+ * Single-host only (the herd shares the {@code bridged} host); the token path is the split-host
+ * fallback.
+ */
+public final class ConnectionIdentity {
+
+    private final PaneLocator panes;
+    private final PeerPidLookup pids;
+    private final ProcessCwdLookup cwds;
+
+    /** Identity only (no cwd resolution — {@link #cwdForPid} returns {@code null}). */
+    public ConnectionIdentity(PaneLocator panes, PeerPidLookup pids) {
+        this(panes, pids, _ -> null);
+    }
+
+    /** Identity plus cwd resolution (CB-112 — inherit the primary's directory on spawn). */
+    public ConnectionIdentity(PaneLocator panes, PeerPidLookup pids, ProcessCwdLookup cwds) {
+        this.panes = panes;
+        this.pids = pids;
+        this.cwds = cwds;
+    }
+
+    /**
+     * The caller resolved from the connection: its worker {@code terminal} (or {@code null} for the
+     * primary / an off-host client) and its {@code pid} (or {@code -1} if not resolvable).
+     */
+    public record Caller(String terminal, long pid) {
+    }
+
+    /** Resolve the caller's terminal and PID from one peer-PID lookup. */
+    public Caller resolve(String remoteAddr, int remotePort) {
+        if (!isLoopback(remoteAddr)) {
+            return new Caller(null, -1); // only same-host callers can be workers
+        }
+        long pid = pids.pidForLocalPort(remotePort);
+        return new Caller(panes.terminalForPid(pid), pid);
+    }
+
+    /**
+     * The calling worker's {@code terminal_id}, or {@code null} if the caller is not a known
+     * on-host worker (treat as the primary).
+     */
+    public String callerTerminal(String remoteAddr, int remotePort) {
+        return resolve(remoteAddr, remotePort).terminal();
+    }
+
+    /** The working directory of {@code pid} (the primary's cwd on an MCP spawn), or {@code null}. */
+    public String cwdForPid(long pid) {
+        return pid > 0 ? cwds.cwdForPid(pid) : null;
+    }
+
+    private static boolean isLoopback(String addr) {
+        return "127.0.0.1".equals(addr) || "::1".equals(addr) || "0:0:0:0:0:0:0:1".equals(addr);
+    }
+}
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.mcp;
+package dev.ltms.bridged.mcp;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -41,14 +41,6 @@ public final class LsofPeerPidLookup implements PeerPidLookup {
            if (!p.waitFor(2, TimeUnit.SECONDS)) {
                p.destroyForcibly();
            }
-            if (found < 0) {
-                // fleetd #317: this is the silent path — lsof ran clean and simply reported no
-                // matching process (e.g. queried before the OS socket table settles). Previously
-                // this logged nothing at all, which is exactly why the escalation went unnoticed;
-                // the exception path below already logs. A caller now refused because of this is
-                // still refused (never promoted) — this line only makes the refusal diagnosable.
-                log.debug("lsof peer-pid lookup for port {} found no matching process", port);
-            }
            return found;
        } catch (Exception e) {
            log.debug("lsof peer-pid lookup for port {} failed: {}", port, e.getMessage());
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.mcp;
+package dev.ltms.bridged.mcp;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.mcp;
+package dev.ltms.bridged.mcp;

 /**
 * Resolves the OS PID that owns a loopback TCP source port — the OS half of connection-based MCP
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.mcp;
+package dev.ltms.bridged.mcp;

 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -11,7 +11,7 @@ import java.util.concurrent.atomic.AtomicReference;
 * Single-slot, thread-safe registry for the primary's herdr {@code terminal_id}.
 *
 * <p>Populated from the caller terminal of orchestration-side MCP tools
- * ({@code fleet_send}, {@code fleet_spawn}) — tools that only the primary calls.
+ * ({@code bridge_send}, {@code bridge_spawn}) — tools that only the primary calls.
 * A pinned terminal (from config) seeds the registry at construction and makes
 * subsequent {@link #record(String)} calls no-ops.
 *
@@ -29,7 +29,7 @@ public final class PrimaryRegistry {
    /**
     * CB-532: worker terminal → the lead that delegated to it. The single slot above answers "who is
     * THE primary", a question with no correct answer once two leads orchestrate the same fleet:
-     * whichever called {@code fleet_send} first captured every nudge, including nudges for the
+     * whichever called {@code bridge_send} first captured every nudge, including nudges for the
     * other lead's delegations. This map answers the question that actually matters — "who is
     * waiting on THIS worker" — and is what lets {@code primary.terminal} be retired.
     */
@@ -71,7 +71,7 @@ public final class PrimaryRegistry {
     *
     * <p>Called from the {@code MessageService} accepted-delivery hook — only after a send has won
     * the session's send lock and queued delivery — where both halves are known (CB-548). It is
-     * deliberately <em>not</em> called at {@code fleet_send} request time: a concurrent sender that
+     * deliberately <em>not</em> called at {@code bridge_send} request time: a concurrent sender that
     * times out {@code BUSY} must not steal a live delegation's reply routing without ever owning
     * the turn. Last writer wins — if a second lead's later send is accepted, replies follow the
     * lead that most recently delegated to it, which is the one waiting.
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.mcp;
+package dev.ltms.bridged.mcp;

 /**
 * Resolves a process's current working directory from its PID — the OS half of CB-112's
@@ -0,0 +1,350 @@
+package dev.ltms.bridged.member;
+
+import dev.ltms.bridged.config.BridgedConfig;
+import dev.ltms.bridged.guard.SubscriptionGuard;
+import dev.ltms.bridged.herdr.Agent;
+import dev.ltms.bridged.herdr.AgentControl;
+import dev.ltms.bridged.herdr.WorkspaceControl;
+import dev.ltms.bridged.peer.Capability;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.EnumSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+import java.util.function.Function;
+import java.util.function.LongSupplier;
+import java.util.function.Supplier;
+
+/**
+ * The {@link HerdrPeerLauncher} adapter for <strong>Claude Code</strong> — the safe path from a
+ * delegation request to a running off-subscription Claude.
+ *
+ * <p>Everything transport-related (tab/pane placement, the CB-306 spawn-readiness gate, unique
+ * naming, CB-117 orphan reap, teardown, listing, cwd resolution) lives in the base. This class
+ * supplies only the two Claude-specific seams:
+ * <ul>
+ *   <li>the {@code claude} name prefix (so reap matches {@code claude-*} panes, never another
+ *       adapter's), and</li>
+ *   <li>{@link #buildLaunch}, which encodes the subscription boundary: build the worker env with
+ *       {@code ANTHROPIC_BASE_URL}, assert that host is on the allowlist <em>before</em> touching
+ *       herdr, and mount the bridge MCP + reply charter as inline launch flags. A worker's base_url
+ *       lives in the env map handed to herdr and nowhere else; {@code bridged}'s own environment is
+ *       never mutated, and nothing is written to the worker's profile.</li>
+ * </ul>
+ */
+public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
+
+    /** Label prefix for this adapter's herdr agent names (drives naming + orphan reap). */
+    private static final String NAME_PREFIX = "claude";
+
+    private static final Logger log = LoggerFactory.getLogger(ClaudeCodeLauncher.class);
+
+    private final SubscriptionGuard guard;
+
+    /**
+     * Standing instruction appended to the worker's system prompt so it returns its result via
+     * {@code bridge_reply}. Injected as a launch flag, so nothing is written to the worker's
+     * profile — it is guidance, and a worker that never replies is caught by the send's timeout.
+     */
+    static final String REPLY_CHARTER =
+            "You are an off-subscription worker in the claude-bridge fleet. Every message you "
+            + "receive arrives through the bridge, and the ONLY channel back to the sender is the "
+            + "bridge_reply MCP tool. Text you write in your terminal is NOT sent anywhere — the "
+            + "sender cannot see your screen, so an in-terminal answer is silently discarded. "
+            + "Therefore you MUST end EVERY turn by calling bridge_reply with `content` set to your "
+            + "complete response. This holds for every message without exception — tasks, questions, "
+            + "clarifications, acknowledgements, and ordinary back-and-forth conversation. Call "
+            + "bridge_reply exactly once, as the final action of your turn, with your full answer in "
+            + "`content`; never wait for confirmation first. If you end a turn without calling "
+            + "bridge_reply, the sender receives nothing and the exchange stalls.";
+
+    /**
+     * Production constructor — disables the spawn-ready gate ({@code spawnReadyTimeoutMs == 0}) so
+     * existing deployments and tests keep the legacy non-blocking spawn semantics.
+     */
+    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
+                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Function<String, String> env) {
+        this(agents, spaces, guard, profiles, defaultProfile, env, 0,
+                System::currentTimeMillis, () -> sleepUninterruptibly(300));
+    }
+
+    /**
+     * Production constructor with spawn-ready gate enabled. The gate polls {@code agents.status()}
+     * until the pane reports an injectable state or {@code spawnReadyTimeoutMs} elapses.
+     */
+    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
+                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Function<String, String> env,
+                              long spawnReadyTimeoutMs, long spawnReadyPollMs) {
+        this(agents, spaces, guard, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs, spawnReadyPollMs, null);
+    }
+
+    /**
+     * Production constructor carrying the fleet-wide tab-label template (CB-557). The template comes
+     * from {@code fleet.tabLabel}, which a profile cannot know because it names the member's
+     * <em>role</em>; a profile may still override it with its own {@code tabLabel}.
+     */
+    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
+                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Function<String, String> env,
+                              long spawnReadyTimeoutMs, long spawnReadyPollMs,
+                              Supplier<String> tabLabelTemplate) {
+        this(agents, spaces, guard, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs,
+                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
+                tabLabelTemplate);
+    }
+
+    /**
+     * Full testability constructor. Every injectable collaborator is explicit so unit tests supply
+     * fakes for the clock ({@code nowMillis}) and poll-loop wait ({@code sleeper}). The
+     * {@code sleeper} is never called when the gate is disabled ({@code spawnReadyTimeoutMs == 0}).
+     *
+     * @param agents               herdr agent control (start, status, close)
+     * @param spaces               workspace / tab control (ensure, create, close)
+     * @param guard                subscription-boundary guard (checked before spawning)
+     * @param profiles             configured worker profiles
+     * @param defaultProfile       profile a no-argument spawn uses (nullable)
+     * @param env                  host env lookup (injectable for tests)
+     * @param spawnReadyTimeoutMs  max ms to wait for injectable state (0 disables the gate)
+     * @param nowMillis            monotonic clock source (e.g. {@code System::currentTimeMillis})
+     * @param sleeper              sleep/wait hook (e.g. {@code () -> Thread.sleep(pollMs)}); it
+     *                             already encodes the poll interval, so the 8th positional argument
+     *                             (poll ms) is accepted for API symmetry but otherwise unused here
+     */
+    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
+                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Function<String, String> env,
+                              long spawnReadyTimeoutMs,
+                              LongSupplier nowMillis, Runnable sleeper) {
+        this(agents, spaces, guard, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs, nowMillis, sleeper, null);
+    }
+
+    /**
+     * Full testability constructor, plus the fleet-wide tab-label template (CB-557).
+     *
+     * @param tabLabelTemplate {@code fleet.tabLabel}; {@code null}/blank ⇒
+     *                         {@link BridgedConfig.Fleet#DEFAULT_TAB_LABEL}
+     */
+    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
+                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Function<String, String> env,
+                              long spawnReadyTimeoutMs,
+                              LongSupplier nowMillis, Runnable sleeper,
+                              Supplier<String> tabLabelTemplate) {
+        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs, nowMillis, sleeper, tabLabelTemplate);
+        this.guard = guard;
+    }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>A legacy spawn with no session identity is a fresh, launcher-derived session — delegate to
+     * the session-aware form with no name and no resume id.
+     */
+    @Override
+    protected Launch buildLaunch(BridgedConfig.Profile cfg) {
+        return buildLaunch(cfg, null, null);
+    }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>The spawn sequence encodes the subscription boundary: assert the profile's base_url is on
+     * the allowlist <em>before</em> any herdr call, then build the worker env with
+     * {@code ANTHROPIC_*}, the parity-neutral git-forge grant, and the bridge MCP + reply charter
+     * mounted as inline launch flags. When the request carries session identity (CB-547a) it is
+     * applied here — see {@link #applySessionIdentity}.
+     */
+    @Override
+    protected Launch buildLaunch(BridgedConfig.Profile cfg, String sessionName, String resumeSessionId) {
+        // CB-539: a profile may deliberately opt into the subscription (subscription: true) when no
+        // off-subscription endpoint exists for it — e.g. `sonnet` on `ccs`. That profile gets no
+        // ANTHROPIC_BASE_URL/AUTH_TOKEN (there is nothing to point them at) and the guard's base_url
+        // requirement is skipped FOR IT ONLY. Every other profile keeps the hard boundary below.
+        boolean onSubscription = cfg.isSubscription();
+        String baseUrl = cfg.baseUrl();
+
+        if (onSubscription) {
+            // NO SILENT CONTRADICTION: subscription:true + a baseUrl state opposite intents; refuse
+            // loudly rather than pick a winner.
+            if (baseUrl != null && !baseUrl.isBlank()) {
+                throw new IllegalStateException("profile '" + cfg.profile()
+                        + "' sets both subscription: true and a baseUrl ('" + baseUrl + "') — the two "
+                        + "are contradictory: a subscription profile must not point at an endpoint. "
+                        + "Drop baseUrl, or drop subscription: true.");
+            }
+            // Visible without anyone going looking for it: this worker bills the subscription.
+            log.warn("spawning profile '{}' on the Claude subscription (subscription: true) — this "
+                    + "worker WILL bill the operator's subscription", cfg.profile());
+        } else {
+            guard.assertWorker(baseUrl); // hard stop before we spawn anything
+        }
+
+        Map<String, String> workerEnv = baseEnv(cfg);
+        if (onSubscription) {
+            // CB-542 belt-and-braces: on the subscription path no guard vets these two keys, and the
+            // profile's env: is layered in by baseEnv — so strip any that rode in there. Config load
+            // already rejects this (loudly, naming the profile); this makes the boundary hold even
+            // for a profile built in code that never passed through that validation.
+            workerEnv.remove("ANTHROPIC_BASE_URL");
+            workerEnv.remove("ANTHROPIC_AUTH_TOKEN");
+        } else {
+            workerEnv.put("ANTHROPIC_BASE_URL", baseUrl);
+            putIfPresent(workerEnv, "ANTHROPIC_AUTH_TOKEN", env.apply(cfg.tokenEnv()));
+        }
+        putIfPresent(workerEnv, "ANTHROPIC_MODEL", cfg.model());
+        putIfPresent(workerEnv, "CLAUDE_CONFIG_DIR", cfg.configDir());
+        applyGitToken(workerEnv, cfg);
+
+        // CB-547a: Claude Code can MINT its own session id, so bridged chooses it — a fresh spawn
+        // gets a UUID we pass as --session-id and return from agentSessionId(), so the resume
+        // handle is known BEFORE the agent has written anything; a resume spawn adopts its prior
+        // id via -r and passes no --session-id (the two conflict). Both are injected before the
+        // model flag so --model keeps outranking the operator's own argv.
+        // mutableArgv: argvWithBridge may hand back the profile's own (immutable) List.of when it
+        // has no MCP — session flags must be added into a list we own.
+        List<String> argv = mutableArgv(argvWithBridge(cfg));
+        String agentSessionId = applySessionIdentity(argv, sessionName, resumeSessionId);
+        return new Launch(workerEnv, argvWithModel(argv, cfg), agentSessionId);
+    }
+
+    /**
+     * Add the Claude-specific session-identity flags to {@code argv} and return the peer's OWN
+     * session id — the resume handle. A resume request passes the prior id via {@code -r} and
+     * returns that id; a fresh named session mints a new UUID, passes it via {@code --session-id},
+     * and returns the mint. The bridge's logical name rides along as {@code -n} when present. When
+     * <em>no</em> identity is requested (sessionName and resumeSessionId both blank) this adds
+     * nothing and returns {@code null}, keeping the legacy no-identity launch byte-identical.
+     */
+    private static String applySessionIdentity(List<String> argv, String sessionName, String resumeSessionId) {
+        boolean resuming = resumeSessionId != null && !resumeSessionId.isBlank();
+        boolean named = sessionName != null && !sessionName.isBlank();
+        if (!resuming && !named) {
+            return null; // no identity requested — keep the legacy launch byte-identical
+        }
+        if (named) {
+            argv.add("-n");
+            argv.add(sessionName);
+        }
+        if (resuming) {
+            argv.add("-r");
+            argv.add(resumeSessionId);
+            return resumeSessionId;
+        }
+        String minted = UUID.randomUUID().toString();
+        argv.add("--session-id");
+        argv.add(minted);
+        return minted;
+    }
+
+    /**
+     * The launch argv, plus — when {@code worker.mcpUrl} is set — inline {@code --mcp-config} for
+     * the bridge server and {@code --append-system-prompt} for the {@link #REPLY_CHARTER}. Neither
+     * touches the profile's config; both are pure command-line flags. This inline-flag mount is
+     * Claude Code specific — other adapters mount MCP and instructions their own way.
+     */
+    private List<String> argvWithBridge(BridgedConfig.Profile cfg) {
+        if (!cfg.hasMcp()) {
+            return cfg.argv();
+        }
+        String mcpJson = "{\"mcpServers\":{\"bridge\":{\"type\":\"http\",\"url\":\""
+                + cfg.mcpUrl() + "\"}}}";
+        List<String> argv = mutableArgv(cfg.argv());
+        argv.add("--mcp-config");
+        argv.add(mcpJson);
+        argv.add("--append-system-prompt");
+        argv.add(REPLY_CHARTER);
+        return argv;
+    }
+
+    /**
+     * Pin the model on the command line as well as in {@code ANTHROPIC_MODEL} (CB-533).
+     *
+     * <p>The env var alone is not a reliable pin for this adapter, because the argv is usually a
+     * launcher rather than {@code claude} itself — {@code ["ccs", "<profile>"]} — and {@code ccs}
+     * exports its profile's own model family ({@code ANTHROPIC_MODEL}, {@code DEFAULT_OPUS/SONNET/
+     * HAIKU}, {@code CLAUDE_CODE_SUBAGENT_MODEL}) over whatever it inherited. A worker profile that
+     * set {@code model:} therefore got silently overruled by its own launcher. Claude Code's
+     * {@code --model} flag outranks the environment, and {@code ccs <profile> [claude-args...]}
+     * passes trailing arguments through, so the flag survives the wrapper.
+     *
+     * <p>Appended last so it also outranks anything in the operator's own {@code argv}. Profiles
+     * that deliberately leave {@code model:} unset (letting {@code ccs} own model selection, as
+     * {@code gx10} does) are untouched — this adds nothing when there is nothing to add. This is
+     * the {@code kind: claude} counterpart of the opencode adapter's {@code -m provider/model}.
+     */
+    private static List<String> argvWithModel(List<String> argv, BridgedConfig.Profile cfg) {
+        if (cfg.model() == null || cfg.model().isBlank()) {
+            return argv;
+        }
+        List<String> withModel = mutableArgv(argv);
+        withModel.add("--model");
+        withModel.add(cfg.model());
+        return withModel;
+    }
+
+    // --- Agent-returning convenience spawns (used by callers/tests that want the herdr Agent) ---
+
+    /** Spawn a worker for the default profile in the resolved default cwd. */
+    public Agent spawn() {
+        return spawnInternal(null, null, null);
+    }
+
+    /** Spawn a worker for a named profile (null → default) in the resolved default cwd. */
+    public Agent spawn(String profileName) {
+        return spawnInternal(profileName, null, null);
+    }
+
+    /** Spawn a worker for a named profile with an explicit requested/caller cwd (CB-112). */
+    public Agent spawn(String profileName, String requestedCwd, String callerCwd) {
+        return spawnInternal(profileName, requestedCwd, callerCwd);
+    }
+
+    // --- capabilities --------------------------------------------------------------------------
+
+    @Override
+    public Set<Capability> capabilities() {
+        Set<Capability> caps = EnumSet.of(Capability.MID_TURN_ASK, Capability.WORKTREE,
+                Capability.CONTEXT_RESET, Capability.ORPHAN_REAP,
+                Capability.SESSION_NAME, Capability.SESSION_RESUME);
+        if (hasGitTokenProfile()) {
+            caps.add(Capability.SELF_PR);
+        }
+        return Set.copyOf(caps);
+    }
+
+    @Override
+    public boolean clearContext(String id) {
+        String target = agentTarget(id);
+        if (target == null) {
+            return false;
+        }
+        // This deliberately bypasses Injector: /clear is housekeeping, not a delegated turn.
+        agents().send(target, "/clear");
+        return true;
+    }
+
+    /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
+    private boolean hasGitTokenProfile() {
+        return profileConfigs().stream().anyMatch(BridgedConfig.Profile::hasGitToken);
+    }
+
+    // --- CB-117 reap predicate (Claude prefix), kept for direct unit testing -------------------
+
+    /**
+     * Whether {@code name} is a Claude Code bridge worker started by a <em>different</em> process
+     * than {@code currentNonce}. A thin {@code claude}-prefix binding of
+     * {@link HerdrPeerLauncher#isForeignWorker(String, String, String)}.
+     */
+    static boolean isForeignWorker(String name, String currentNonce) {
+        return HerdrPeerLauncher.isForeignWorker(NAME_PREFIX, name, currentNonce);
+    }
+}
@@ -0,0 +1,422 @@
+package dev.ltms.bridged.member;
+
+import dev.ltms.bridged.config.BridgedConfig;
+import dev.ltms.bridged.herdr.Agent;
+import dev.ltms.bridged.peer.Capability;
+import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.bridged.peer.PeerHandle;
+import dev.ltms.bridged.peer.PeerLauncher;
+import dev.ltms.bridged.peer.PeerUnreachableException;
+import dev.ltms.bridged.peer.SpawnRequest;
+import dev.ltms.bridged.placement.PlacementCandidate;
+import dev.ltms.bridged.placement.PlacementContext;
+import dev.ltms.bridged.placement.PlacementException;
+import dev.ltms.bridged.placement.PlacementPolicies;
+import dev.ltms.bridged.placement.PlacementPolicy;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.EnumSet;
+import java.util.HashSet;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.function.Function;
+import java.util.function.Supplier;
+
+/**
+ * The {@link PeerLauncher} the core actually holds when more than one adapter is configured — a thin
+ * router in front of one {@link HerdrPeerLauncher} per peer {@code kind} (Claude Code, opencode, …).
+ * It owns no transport of its own; it dispatches each SPI call to the delegate that owns the profile
+ * involved, and fans the fleet-wide queries (list/reap/caps/profiles) across all delegates.
+ *
+ * <p>Routing rules:
+ * <ul>
+ *   <li><strong>By profile</strong> — {@link #spawn}, {@link #effectiveCwd}, {@link #parityOverlay}
+ *       resolve the profile (a null/blank name → the global {@link #defaultProfile}) and delegate to
+ *       the single adapter that declares it. Profiles partition cleanly across adapters: the
+ *       constructor rejects a name claimed by two.</li>
+ *   <li><strong>By pane id</strong> — {@link #stop} routes to the adapter that spawned that pane
+ *       (recorded at spawn time). A pane the composite never spawned (only real for a caller that
+ *       hand-rolls an id) falls back to the first delegate; teardown is pane-id addressed and
+ *       tab cleanup is single-occupant guarded, so it is safe either way.</li>
+ *   <li><strong>Fleet-wide</strong> — {@link #reapOrphanWorkers} and {@link #capabilities} fan out
+ *       and combine. {@link #list} is deduplicated by pane id because every herdr-backed delegate
+ *       shares one herdr connection and so reports the same global agent set.</li>
+ * </ul>
+ *
+ * <p>CB-518: an unqualified spawn is routed through a {@link PlacementPolicy}. The default
+ * {@code fixed} policy reproduces the historical default-profile behaviour; {@code weighted} uses
+ * smooth weighted round-robin with {@code maxLoad} gating. If a chosen profile fails with
+ * {@link PeerUnreachableException}, the composite advances to the next available candidate and
+ * retries, bounded by the number of candidates.
+ */
+public final class CompositePeerLauncher implements PeerLauncher {
+
+    private static final Logger log = LoggerFactory.getLogger(CompositePeerLauncher.class);
+
+    private final List<HerdrPeerLauncher> delegates;
+    private final Map<String, HerdrPeerLauncher> byProfile;
+    private final String defaultProfile;
+
+    /** paneId → the delegate that spawned it, so {@link #stop} tears down through the right adapter. */
+    private final Map<String, HerdrPeerLauncher> spawnedBy = new ConcurrentHashMap<>();
+
+    private final Function<String, Integer> liveCount;
+
+    /**
+     * CB-559: the placement inputs are read <em>per spawn</em>, not captured at construction, so a
+     * config reload changes where the next member lands without a restart. These are the hot keys —
+     * role pools, an existing profile's weight/maxLoad, and the placement policy. What cannot change
+     * this way is the set of adapters ({@link #byProfile}), because a new backend needs a launcher
+     * and launchers are built once; {@code ConfigRef} classifies that as deferred and says so.
+     */
+    private final Supplier<Map<String, BridgedConfig.Profile>> profileConfigs;
+    private final Supplier<PlacementPolicy> placementPolicy;
+
+    /**
+     * CB-557: the role pools an unqualified spawn draws its candidates from. A supplier that yields
+     * {@code null}, and an empty pool for a role, both fall back to every configured profile — the
+     * pre-CB-557 behaviour.
+     */
+    private final Supplier<BridgedConfig.Fleet> fleet;
+
+    /**
+     * Backward-compatible constructor: fixed placement, no live-counting. Use this for tests and
+     * simple wiring; it preserves the pre-CB-518 behaviour exactly.
+     *
+     * @param delegates      one adapter per configured peer kind; must be non-empty and declare
+     *                       disjoint profile-name sets
+     * @param defaultProfile the profile a no-argument spawn resolves to (may be null)
+     * @throws IllegalArgumentException if {@code delegates} is empty or two adapters claim one profile
+     */
+    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates, String defaultProfile) {
+        this(delegates, defaultProfile, Map.of(), PlacementPolicies.fixed(), _ -> 0);
+    }
+
+    /**
+     * Production constructor with a placement policy and live-worker counter.
+     *
+     * @param delegates      one adapter per configured peer kind; must be non-empty and declare
+     *                       disjoint profile-name sets
+     * @param defaultProfile the profile a no-argument spawn resolves to under {@code fixed} policy
+     * @param profileConfigs all configured worker profiles (used for candidate weights/caps)
+     * @param placementPolicy which policy governs unqualified spawns
+     * @param liveCount      live worker count per profile (must never return {@code null})
+     */
+    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
+                                 String defaultProfile,
+                                 Map<String, BridgedConfig.Profile> profileConfigs,
+                                 PlacementPolicy placementPolicy,
+                                 Function<String, Integer> liveCount) {
+        this(delegates, defaultProfile, profileConfigs, placementPolicy, liveCount, null);
+    }
+
+    /**
+     * Production constructor with role pools (CB-557). An unqualified spawn draws its candidates from
+     * {@code fleet.<role>} instead of from every configured profile, so a reviewer is placed on a
+     * reviewer backend and never on, say, the architect-only one.
+     *
+     * @param fleet the configured role pools; {@code null} ⇒ every profile is a candidate for every
+     *              role, which is the pre-CB-557 behaviour
+     */
+    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
+                                 String defaultProfile,
+                                 Map<String, BridgedConfig.Profile> profileConfigs,
+                                 PlacementPolicy placementPolicy,
+                                 Function<String, Integer> liveCount,
+                                 BridgedConfig.Fleet fleet) {
+        // LinkedHashMap, not Map.copyOf: candidates() promises definition order and the weighted
+        // policy breaks exact-weight ties on it, so a salted iteration order would make placement
+        // differ from one JVM run to the next.
+        this(delegates, defaultProfile,
+                constant(Collections.unmodifiableMap(new LinkedHashMap<>(profileConfigs))),
+                constant(placementPolicy), liveCount, constant(fleet));
+    }
+
+    /**
+     * Production constructor that re-reads its placement inputs per spawn (CB-559), so a config
+     * reload retargets the next member without a restart.
+     *
+     * @param config the live configuration — read at every spawn, never captured
+     */
+    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
+                                 String defaultProfile,
+                                 Supplier<BridgedConfig> config,
+                                 Function<String, Integer> liveCount) {
+        this(delegates, defaultProfile,
+                () -> config.get().profiles(),
+                () -> PlacementPolicies.fromName(config.get().placement()),
+                liveCount,
+                () -> config.get().fleet());
+    }
+
+    /** The all-suppliers form every other constructor funnels into. */
+    private CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
+                                  String defaultProfile,
+                                  Supplier<Map<String, BridgedConfig.Profile>> profileConfigs,
+                                  Supplier<PlacementPolicy> placementPolicy,
+                                  Function<String, Integer> liveCount,
+                                  Supplier<BridgedConfig.Fleet> fleet) {
+        this.fleet = fleet;
+        if (delegates.isEmpty()) {
+            throw new IllegalArgumentException("at least one peer adapter must be configured");
+        }
+        this.delegates = List.copyOf(delegates);
+        this.defaultProfile = defaultProfile;
+        this.profileConfigs = profileConfigs;
+        this.placementPolicy = placementPolicy;
+        this.liveCount = liveCount;
+        Map<String, HerdrPeerLauncher> index = new LinkedHashMap<>();
+        for (HerdrPeerLauncher d : this.delegates) {
+            for (String profile : d.profiles()) {
+                HerdrPeerLauncher prev = index.putIfAbsent(profile, d);
+                if (prev != null) {
+                    throw new IllegalArgumentException(
+                            "worker profile '" + profile + "' is claimed by two peer adapters");
+                }
+            }
+        }
+        // Order-preserving for the same reason, and because profiles() is user-visible (bridge_profiles).
+        this.byProfile = Collections.unmodifiableMap(index);
+    }
+
+    /** A supplier of a value fixed at construction — how the non-reloading constructors funnel in. */
+    private static <T> Supplier<T> constant(T value) {
+        return () -> value;
+    }
+
+    /**
+     * The currently-configured profiles, never null.
+     *
+     * <p>Read fresh on every call so a reload is visible; a caller that needs two consistent reads
+     * takes one local, as {@link #poolFor} does.
+     */
+    private Map<String, BridgedConfig.Profile> profiles0() {
+        Map<String, BridgedConfig.Profile> m = profileConfigs.get();
+        return m == null ? Map.of() : m;
+    }
+
+    /** The adapter owning {@code profileName} (null/blank → the default). Throws on an unknown profile. */
+    private HerdrPeerLauncher route(String profileName) {
+        String resolved = (profileName == null || profileName.isBlank()) ? defaultProfile : profileName;
+        if (resolved == null) {
+            // No profile and no default configured — hand to the first delegate so it raises the
+            // same "no default" error it would on its own; keeps the SPI contract single-sourced.
+            return delegates.getFirst();
+        }
+        HerdrPeerLauncher d = byProfile.get(resolved);
+        if (d == null) {
+            throw new IllegalArgumentException("unknown worker profile: " + resolved);
+        }
+        return d;
+    }
+
+    @Override
+    public PeerHandle spawn(SpawnRequest req) {
+        String requestedProfile = req.profileName();
+        if (requestedProfile != null && !requestedProfile.isBlank()) {
+            // An explicit profile bypasses the placement policy, but not the capacity cap: maxLoad
+            // is documented as an unconditional limit on this profile (BridgedConfig.Profile), and
+            // the charter makes explicit-profile spawns the normal path — so skipping the check
+            // here would leave the cap dead config in real operation.
+            HerdrPeerLauncher d = route(requestedProfile);
+            enforceMaxLoad(requestedProfile);
+            PeerHandle handle = d.spawn(req);
+            spawnedBy.put(handle.id(), d);
+            return handle;
+        }
+
+        // CB-557: an unqualified spawn is placed inside the pool of the role it asked for, not across
+        // the whole profile list. An EXPLICIT profile (above) is left alone on purpose — it is the
+        // operator overriding, and refusing it would break `bridge_spawn{profile:"opus"}`, which
+        // carries no role and so would be judged against the dev pool it was never meant for.
+        List<PlacementCandidate> candidates = candidates(req.role());
+        String roleDefault = defaultProfileFor(req.role());
+        Set<String> unreachable = new HashSet<>();
+        PlacementContext ctx = new PlacementContext(roleDefault, candidates, liveCount, unreachable);
+
+        int maxAttempts = candidates.isEmpty() ? 1 : candidates.size();
+        for (int attempt = 0; attempt < maxAttempts; attempt++) {
+            // Deliberately uncaught: when no candidate is left (all at cap, or all unreachable) the
+            // policy already throws a clear message. Catching it to rethrow a generic
+            // PeerUnreachableException would replace a precise diagnosis with a vague one.
+            PlacementCandidate chosen = placementPolicy.get().select(ctx);
+
+            HerdrPeerLauncher d = byProfile.get(chosen.profile());
+            if (d == null) {
+                // A configured profile with no adapter is a wiring bug; fail fast.
+                unreachable.add(chosen.profile());
+                continue;
+            }
+
+            // CB-547a: route the chosen profile but keep the caller's session identity — dropping it
+            // here would silently sever the resume handle on every policy-routed spawn. CB-557: the
+            // role rides along for the same reason, or a routed spawn would be labelled as a dev.
+            SpawnRequest routedReq = new SpawnRequest(chosen.profile(), req.requestedCwd(), req.callerCwd(),
+                    req.sessionName(), req.resumeSessionId(), req.role());
+            try {
+                PeerHandle handle = d.spawn(routedReq);
+                spawnedBy.put(handle.id(), d);
+                return handle;
+            } catch (PeerUnreachableException e) {
+                log.warn("spawn on profile {} unreachable, will retry next candidate if any: {}",
+                        chosen.profile(), e.getMessage());
+                unreachable.add(chosen.profile());
+                // Update the context for the next selection so the policy excludes this profile.
+                ctx = new PlacementContext(roleDefault, candidates, liveCount, unreachable);
+            }
+        }
+
+        throw new PeerUnreachableException(
+                "no reachable worker profile available after trying " + unreachable.size()
+                        + " candidate(s): " + String.join(", ", unreachable));
+    }
+
+    /**
+     * Refuse an explicit-profile spawn when the profile is at its {@code maxLoad} cap.
+     *
+     * <p>maxLoad is a documented, unconditional capacity limit (see {@code BridgedConfig.Profile#maxLoad}),
+     * and the charter makes explicit-profile spawns the normal path — so enforcing it only in placement
+     * ({@code PlacementPolicyUtil}, package-private, hence not linked) would leave the cap dead config
+     * on every call that names a profile. Same rule as placement: {@code live >= cap} is at capacity.
+     *
+     * <p>Deliberately no fallback to another profile: the caller named {@code profile} for a cost/model
+     * reason, and silently re-routing a paid-tier (subscription) request elsewhere is worse than
+     * refusing it. A caller that wants placement should omit the profile and let the policy pick.
+     *
+     * <p>Known TOCTOU limitation — documented, not fixed. {@link #liveCount} is read outside any lock and
+     * {@code SessionManager} registers a session only after {@code launcher.spawn} returns, so two
+     * genuinely concurrent spawns can both pass this check. The race already exists on the placement
+     * path. Closing it needs slot reservation in the registry; serializing spawn here would block on
+     * the readiness gate and is a far worse trade.
+     *
+     * @param profile the profile the caller explicitly named
+     * @throws PlacementException when the profile is at capacity
+     */
+    private void enforceMaxLoad(String profile) {
+        // Absent config, or a config whose maxLoad normalized to null (non-positive ⇒ unlimited at
+        // load), means no cap — never cap what wasn't configured.
+        BridgedConfig.Profile cfg = profiles0().get(profile);
+        Integer cap = (cfg == null) ? null : cfg.maxLoad();
+        if (cap == null) {
+            return;
+        }
+        int live = liveCount.apply(profile);
+        if (live >= cap) {
+            throw new PlacementException("worker profile '" + profile + "' is at maxLoad: " + live
+                    + " live >= " + cap + " cap; refusing spawn — no fallback to another profile");
+        }
+    }
+
+    /**
+     * The profile names {@code role} may be placed on, in definition order.
+     *
+     * <p>An empty or absent pool means "unconstrained", not "nothing allowed": a config that declares
+     * no pool for a role must keep spawning, so it falls back to every configured profile. Names in a
+     * pool that no adapter declares are dropped here rather than thrown — config load already rejects
+     * a pool entry with no profile, so a survivor is a profile this particular composite does not own.
+     */
+    private List<String> poolFor(MemberRole role) {
+        Map<String, BridgedConfig.Profile> configured = profiles0();
+        BridgedConfig.Fleet f = fleet.get();
+        List<String> pool = (f == null) ? List.of() : f.profilesFor(role);
+        List<String> known = pool.stream().filter(configured::containsKey).toList();
+        return known.isEmpty() ? List.copyOf(configured.keySet()) : known;
+    }
+
+    /** The profile an unqualified spawn for {@code role} falls back to under {@code fixed} placement. */
+    private String defaultProfileFor(MemberRole role) {
+        List<String> pool = poolFor(role);
+        return pool.isEmpty() ? defaultProfile : pool.getFirst();
+    }
+
+    /** Build the candidate list from {@code role}'s pool, in definition order. */
+    private List<PlacementCandidate> candidates(MemberRole role) {
+        List<PlacementCandidate> out = new ArrayList<>();
+        for (String name : poolFor(role)) {
+            BridgedConfig.Profile w = profiles0().get(name);
+            if (w != null) {
+                out.add(new PlacementCandidate(name, null, w.weight(), w.maxLoad()));
+            }
+        }
+        return out;
+    }
+
+    @Override
+    public String effectiveCwd(SpawnRequest req) {
+        return route(req.profileName()).effectiveCwd(req);
+    }
+
+    @Override
+    public List<String> parityOverlay(String profileName) {
+        return route(profileName).parityOverlay(profileName);
+    }
+
+    @Override
+    public void stop(String id) {
+        HerdrPeerLauncher d = spawnedBy.remove(id);
+        if (d == null) {
+            log.debug("stop({}) — no recorded owner, routing to the first adapter (pane-addressed)", id);
+            d = delegates.getFirst();
+        }
+        d.stop(id);
+    }
+
+    @Override
+    public boolean clearContext(String id) {
+        HerdrPeerLauncher delegate = spawnedBy.get(id);
+        if (delegate == null) {
+            log.debug("clearContext({}) ignored — no recorded owning adapter", id);
+            return false;
+        }
+        return delegate.clearContext(id);
+    }
+
+    @Override
+    public Set<String> profiles() {
+        return byProfile.keySet();
+    }
+
+    @Override
+    public String defaultProfile() {
+        return defaultProfile;
+    }
+
+    /** Every herdr agent, deduplicated by pane id (all delegates share one herdr and list globally). */
+    @Override
+    public List<Agent> list() {
+        Map<String, Agent> byPane = new LinkedHashMap<>();
+        for (HerdrPeerLauncher d : delegates) {
+            for (Agent a : d.list()) {
+                if (a.paneId() != null) {
+                    byPane.putIfAbsent(a.paneId(), a);
+                }
+            }
+        }
+        return List.copyOf(byPane.values());
+    }
+
+    @Override
+    public int reapOrphanWorkers() {
+        int reaped = 0;
+        for (HerdrPeerLauncher d : delegates) {
+            reaped += d.reapOrphanWorkers();
+        }
+        return reaped;
+    }
+
+    /** The union of every adapter's capabilities — a capability any adapter offers, the fleet offers. */
+    @Override
+    public Set<Capability> capabilities() {
+        EnumSet<Capability> caps = EnumSet.noneOf(Capability.class);
+        for (HerdrPeerLauncher d : delegates) {
+            caps.addAll(d.capabilities());
+        }
+        return Set.copyOf(caps);
+    }
+}
@@ -0,0 +1,738 @@
+package dev.ltms.bridged.member;
+
+import dev.ltms.bridged.config.BridgedConfig;
+import dev.ltms.bridged.herdr.Agent;
+import dev.ltms.bridged.herdr.AgentControl;
+import dev.ltms.bridged.herdr.HerdrException;
+import dev.ltms.bridged.herdr.Tab;
+import dev.ltms.bridged.herdr.Workspace;
+import dev.ltms.bridged.herdr.WorkspaceControl;
+import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.bridged.peer.PeerHandle;
+import dev.ltms.bridged.peer.PeerLauncher;
+import dev.ltms.bridged.peer.PeerUnreachableException;
+import dev.ltms.bridged.peer.SpawnRequest;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.security.SecureRandom;
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ConcurrentMap;
+import java.util.concurrent.atomic.AtomicBoolean;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.function.Function;
+import java.util.function.LongSupplier;
+import java.util.function.Supplier;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * Abstract base for {@link PeerLauncher} adapters that materialize a peer as a <em>herdr</em>
+ * agent (a CLI coding agent running in a herdr tab/pane). It owns everything that is the same
+ * regardless of <em>which</em> coding agent runs: tab/pane placement, the CB-306 spawn-readiness
+ * gate, unique naming, CB-117 orphan reap, teardown, {@link #list() listing}, and cwd resolution.
+ *
+ * <p>Two seams are peer-specific and supplied by the concrete adapter:
+ * <ul>
+ *   <li>{@code namePrefix} (constructor arg) — the label prefix ({@code claude}, {@code opencode})
+ *       that drives both unique naming and the orphan-reap pattern, so each adapter reaps only its
+ *       own kind of pane and never another's.</li>
+ *   <li>{@link #buildLaunch(BridgedConfig.Profile)} — the peer-specific env map + argv, including any
+ *       subscription/guard check, MCP mount, and instruction injection. The base never sees how the
+ *       peer is configured; it only places and starts the returned {@link Launch}.</li>
+ * </ul>
+ *
+ * <p>Placement: in the default {@code tab} policy a peer lands in its own tab inside a dedicated
+ * worker space (found-or-created once, then shared), so peers never split or clutter the user's
+ * real work spaces. Teardown removes the peer's pane <em>and</em> its now-empty tab, tolerating an
+ * already-gone peer so a repeated DELETE is harmless.
+ */
+public abstract class HerdrPeerLauncher implements PeerLauncher {
+
+    private static final Logger log = LoggerFactory.getLogger(HerdrPeerLauncher.class);
+
+    /** herdr rejects a duplicate agent {@code name}; we retry a bumped name this many times. */
+    private static final int NAME_RETRIES = 8;
+
+    /**
+     * Retries for {@code agent.start} against a seed pane whose shell has not reached its prompt
+     * yet — {@code tab.create}/{@code pane.split} return as soon as the pane exists, and herdr
+     * refuses to start an agent in a pane that is not "an available shell" ({@code agent_pane_busy}).
+     */
+    private static final int SHELL_READY_RETRIES = 20;
+
+    private final String namePrefix;                       // label prefix: naming + reap scheme
+    private final AgentControl agents;
+    private final WorkspaceControl spaces;
+    private final Map<String, BridgedConfig.Profile> profiles; // profile name → spawn settings
+    private final String defaultProfile;                      // profile a no-arg spawn uses (nullable)
+
+    /** Host env lookup (injectable for tests); adapters read it in {@link #buildLaunch}. */
+    protected final Function<String, String> env;
+
+    private final AtomicLong nameSeq = new AtomicLong(); // per-peer counter (herdr agent names only)
+
+    /**
+     * The {@code fleet.tabLabel} template; a {@code null} supplier or a {@code null}/blank value ⇒
+     * {@link BridgedConfig.Fleet#DEFAULT_TAB_LABEL}. A profile's own {@code tabLabel} still
+     * overrides it.
+     *
+     * <p>CB-559: a supplier rather than a String, so a config reload renames the <em>next</em> tab
+     * without a restart. Existing tabs keep the label they were given — bridged does not rewrite a
+     * label it already wrote.
+     */
+    private final Supplier<String> tabLabelTemplate;
+
+    /**
+     * Tab numbers, counted per {@code role/profile} pair (CB-557).
+     *
+     * <p>Deliberately not {@link #nameSeq}. That counter is shared by every profile this launcher
+     * serves, because its job is to make herdr <em>agent names</em> unique. Reusing it for the tab
+     * label made the numbers global, so sibling tabs read {@code #4}, {@code #9}, {@code #17} — gaps
+     * that look like a member died. Counting per role+profile makes {@code dev: sonnet #2} mean the
+     * second sonnet dev, which is what a reader assumes it means.
+     *
+     * <p>Resets when the daemon restarts, and that is fine: the label is a human-facing hint, not an
+     * identity. Identity is {@link PeerHandle#id()}.
+     */
+    private final ConcurrentMap<String, AtomicLong> labelSeq = new ConcurrentHashMap<>();
+
+    private final long spawnReadyTimeoutMs; // 0 = disable gate (legacy non-blocking spawn)
+    private final LongSupplier nowMillis; // monotonic clock (injectable for tests)
+    private final Runnable sleeper; // sleep/wait hook (injectable for tests; never real-sleep in unit tests)
+
+    // Per-process token mixed into each peer name so a fresh process (nameSeq back at 0) cannot
+    // collide with same-profile peers that outlived a restart. See startUniquelyNamed.
+    private final String nameNonce = String.format("%06x", new SecureRandom().nextInt(1 << 24));
+
+    // CB-519: PeerHandle.id() is a host-unique opaque UUID, decoupled from the herdr pane id. The
+    // routing/registry key is the UUID; the herdr pane id is a launcher-private placement/teardown
+    // coordinate. This map bridges the two so stop(id) can resolve a host-unique key back to the
+    // exact pane it must tear down. The pane id is launcher-private (never the routing key) — see
+    // PeerHandle.id().
+    private final ConcurrentMap<String, String> paneByAgentId = new ConcurrentHashMap<>();
+    private final AtomicBoolean resetUnsupportedLogged = new AtomicBoolean();
+
+    /**
+     * @param namePrefix          label prefix for this peer kind (drives naming and reap)
+     * @param agents              herdr agent control (start, status, close)
+     * @param spaces              workspace / tab control (ensure, create, close)
+     * @param profiles            configured peer profiles
+     * @param defaultProfile      profile a no-argument spawn uses (nullable)
+     * @param env                 host env lookup (injectable for tests)
+     * @param spawnReadyTimeoutMs max ms to wait for injectable state (0 disables the gate)
+     * @param nowMillis           monotonic clock source (e.g. {@code System::currentTimeMillis})
+     * @param sleeper             sleep/wait hook (never called when the gate is disabled); the poll
+     *                            interval is baked into this hook, so the base needs no poll field
+     */
+    protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
+                                Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                                Function<String, String> env,
+                                long spawnReadyTimeoutMs,
+                                LongSupplier nowMillis, Runnable sleeper) {
+        this(namePrefix, agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
+                nowMillis, sleeper, null);
+    }
+
+    /**
+     * As above, plus the {@code fleet.tabLabel} template (CB-557).
+     *
+     * @param tabLabelTemplate fleet-wide tab-label template, read per spawn (CB-559); {@code null},
+     *                         or a supplier yielding {@code null}/blank ⇒
+     *                         {@link BridgedConfig.Fleet#DEFAULT_TAB_LABEL}. A separate constructor
+     *                         rather than a new parameter on the one above, so every existing call
+     *                         site keeps the default without an edit.
+     */
+    protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
+                                Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                                Function<String, String> env,
+                                long spawnReadyTimeoutMs,
+                                LongSupplier nowMillis, Runnable sleeper,
+                                Supplier<String> tabLabelTemplate) {
+        this.tabLabelTemplate = tabLabelTemplate;
+        this.namePrefix = namePrefix;
+        this.agents = agents;
+        this.spaces = spaces;
+        this.profiles = Map.copyOf(profiles);
+        this.defaultProfile = defaultProfile;
+        this.env = env;
+        this.spawnReadyTimeoutMs = spawnReadyTimeoutMs;
+        this.nowMillis = nowMillis;
+        this.sleeper = sleeper;
+    }
+
+    // --- adapter seams -------------------------------------------------------------------------
+
+    /**
+     * Build the peer-specific launch for {@code cfg}: the environment map and argv handed to herdr.
+     * Any subscription/guard check, MCP mount, and instruction injection happen here. The env map
+     * and argv are adapter-private; the base only places and starts what is returned.
+     */
+    protected abstract Launch buildLaunch(BridgedConfig.Profile cfg);
+
+    /**
+     * Session-aware variant of {@link #buildLaunch(BridgedConfig.Profile)} (CB-547a). Default
+     * discards the session identity and delegates to the profile-only form, so an adapter that
+     * carries no durable peer session (opencode, say) inherits byte-identical behaviour and needs
+     * no change. An adapter that does (Claude Code) overrides this to mint/resume the id and to
+     * surface it on the returned {@link Launch#agentSessionId()}.
+     *
+     * @param cfg               the resolved profile to spawn
+     * @param sessionName       the bridge's logical session name, or null/blank for launcher-derived
+     * @param resumeSessionId   the peer's own prior session id to resume, or null/blank for fresh
+     */
+    protected Launch buildLaunch(BridgedConfig.Profile cfg, String sessionName, String resumeSessionId) {
+        return buildLaunch(cfg);
+    }
+
+    /** Direct transport access for peer-specific, non-turn control operations. */
+    protected final AgentControl agents() {
+        return agents;
+    }
+
+    /** Resolve the public peer id to the launcher's private herdr target. */
+    protected final String agentTarget(String id) {
+        return paneByAgentId.get(id);
+    }
+
+    @Override
+    public boolean clearContext(String id) {
+        if (resetUnsupportedLogged.compareAndSet(false, true)) {
+            log.warn("context reset is unsupported for peer kind {}; clearAfterTurn is a no-op",
+                    namePrefix);
+        }
+        return false;
+    }
+
+    /**
+     * A peer-specific launch: the herdr {@code env} map and {@code argv}, plus — for an adapter
+     * that carries durable session identity (CB-547a) — the peer's OWN session id
+     * ({@link PeerHandle#agentSessionId()}), known before the peer has written anything. Null for
+     * a launch that carries no identity.
+     */
+    protected record Launch(Map<String, String> env, List<String> argv, String agentSessionId) {
+
+        /** A launch without a discoverable agent session id (an adapter that carries none). */
+        Launch(Map<String, String> env, List<String> argv) {
+            this(env, argv, null);
+        }
+    }
+
+    // --- profile surface -----------------------------------------------------------------------
+
+    /** The configured peer profile names (what {@code spawn(profile)} accepts). */
+    @Override
+    public Set<String> profiles() {
+        return profiles.keySet();
+    }
+
+    /** The parity-overlay file list for {@code profileName} (default list when unset). */
+    @Override
+    public List<String> parityOverlay(String profileName) {
+        String name = (profileName == null || profileName.isBlank()) ? defaultProfile : profileName;
+        if (name == null || name.isBlank()) {
+            return List.of();
+        }
+        BridgedConfig.Profile cfg = profiles.get(name);
+        return cfg == null ? List.of() : cfg.parityOverlay();
+    }
+
+    /** The profile a no-argument spawn uses, or {@code null} if none is configured. */
+    @Override
+    public String defaultProfile() {
+        return defaultProfile;
+    }
+
+    /** The configured profiles, for adapter capability decisions (e.g. any git-token grant). */
+    protected Collection<BridgedConfig.Profile> profileConfigs() {
+        return profiles.values();
+    }
+
+    /** Resolve {@code profileName} (null/blank → default) to its config, or throw with the options. */
+    protected BridgedConfig.Profile requireProfile(String profileName) {
+        String name = (profileName == null || profileName.isBlank()) ? defaultProfile : profileName;
+        if (name == null || name.isBlank()) {
+            throw new IllegalArgumentException("no default worker profile is configured — "
+                    + "pass a profile; configured: " + profiles.keySet());
+        }
+        BridgedConfig.Profile cfg = profiles.get(name);
+        if (cfg == null) {
+            throw new IllegalArgumentException("unknown worker profile '" + name
+                    + "' — configured: " + profiles.keySet());
+        }
+        return cfg;
+    }
+
+    // --- spawn ---------------------------------------------------------------------------------
+
+    /** A started peer plus the launch's agent-session id (the resume handle, or null). */
+    private record Spawned(Agent agent, String agentSessionId) {
+    }
+
+    /**
+     * Spawn a peer. {@code profileName} null/blank → the default profile. The working directory
+     * (CB-112) is resolved by {@link #resolveCwd}: an explicit {@code requestedCwd}, else the
+     * profile's configured {@code cwd}, else {@code callerCwd} (the primary's cwd, when the spawn
+     * came from the primary over MCP), else the daemon's cwd — never assumed to be {@code $HOME}.
+     * The adapter's {@link #buildLaunch} runs before any herdr call.
+     */
+    protected Agent spawnInternal(String profileName, String requestedCwd, String callerCwd) {
+        return spawnInternal(profileName, requestedCwd, callerCwd, null, null).agent();
+    }
+
+    /** Pre-CB-557 shape: no explicit role, so the tab is labelled as a {@code dev}. */
+    protected Spawned spawnInternal(String profileName, String requestedCwd, String callerCwd,
+                                    String sessionName, String resumeSessionId) {
+        return spawnInternal(profileName, requestedCwd, callerCwd, sessionName, resumeSessionId,
+                MemberRole.DEV);
+    }
+
+    /**
+     * Spawn a peer with session identity (CB-547a). {@code sessionName} and {@code resumeSessionId}
+     * are threaded from the {@link SpawnRequest} into {@link #buildLaunch(BridgedConfig.Profile,
+     * String, String)}, and the launch's resolved agent-session id is returned alongside the agent
+     * so the caller can put it on the {@link PeerHandle}.
+     */
+    protected Spawned spawnInternal(String profileName, String requestedCwd, String callerCwd,
+                                    String sessionName, String resumeSessionId, MemberRole role) {
+        BridgedConfig.Profile cfg = requireProfile(profileName);
+        Launch launch = buildLaunch(cfg, sessionName, resumeSessionId);
+        String cwd = resolveCwd(requestedCwd, cfg, callerCwd);
+        Agent agent = cfg.tabPlacement()
+                ? spawnInTab(cfg, launch.env(), launch.argv(), cwd, role)
+                : spawnAsPane(cfg, launch.env(), launch.argv(), cwd);
+        return new Spawned(agent, launch.agentSessionId());
+    }
+
+    /**
+     * The next tab number for {@code role} on {@code profile}, starting at 1.
+     *
+     * <p>Starts at 1 rather than 0 because the number is read by a person: {@code "dev: sonnet #1"}
+     * is the first one, and {@code #0} invites the question of where {@code #1} went.
+     */
+    private long nextLabelSeq(MemberRole role, String profile) {
+        String key = (role == null ? "" : role.wireName()) + "/" + profile;
+        return labelSeq.computeIfAbsent(key, _ -> new AtomicLong()).incrementAndGet();
+    }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>Delegates to {@link #spawnInternal} and wraps the resulting herdr {@link Agent} in a
+     * {@link WorkerHandle} whose {@link PeerHandle#id()} is a fresh <em>host-unique</em> opaque
+     * UUID (CB-519), deliberately decoupled from the herdr pane id: the id is the registry/routing
+     * key and must never collide across daemon processes on the same host, while the herdr pane id
+     * stays a launcher-private placement/teardown coordinate, remembered here so {@link #stop}
+     * can resolve the host-unique key back to its pane. When {@code spawnReadyTimeoutMs > 0},
+     * blocks until the peer's herdr status is injectable or the timeout elapses; on timeout the
+     * pane is closed (no orphan) and a {@link PeerUnreachableException} is thrown.
+     */
+    @Override
+    public PeerHandle spawn(SpawnRequest req) {
+        Spawned spawned = spawnInternal(req.profileName(), req.requestedCwd(), req.callerCwd(),
+                req.sessionName(), req.resumeSessionId(), req.role());
+        Agent agent = spawned.agent();
+        String paneId = agent.paneId();
+        if (spawnReadyTimeoutMs > 0) {
+            waitUntilInjectableOrThrow(paneId);
+        }
+        // CB-519: the handle id is a host-unique UUID; the herdr pane it maps to stays internal.
+        String id = UUID.randomUUID().toString();
+        paneByAgentId.put(id, paneId);
+        return new WorkerHandle(id, agent.terminalId(), requireProfile(req.profileName()).profile(),
+                req.sessionName(), spawned.agentSessionId());
+    }
+
+    @Override
+    public String effectiveCwd(SpawnRequest req) {
+        return effectiveCwd(req.profileName(), req.requestedCwd(), req.callerCwd());
+    }
+
+    /**
+     * CB-301: the effective working directory a spawn for {@code profileName} would use, without
+     * actually spawning.
+     */
+    private String effectiveCwd(String profileName, String requestedCwd, String callerCwd) {
+        return resolveCwd(requestedCwd, requireProfile(profileName), callerCwd);
+    }
+
+    /**
+     * CB-112 cwd resolution: spawn arg → profile config → the primary's cwd → the daemon's cwd.
+     * Never returns {@code null}/blank: {@code "."} (the daemon's own working directory) is the
+     * guaranteed last resort so a pathological environment with an unset {@code user.dir} still
+     * honours the "never assume {@code $HOME}" contract rather than letting herdr default the pane.
+     */
+    private static String resolveCwd(String requestedCwd, BridgedConfig.Profile cfg, String callerCwd) {
+        return firstNonBlank(requestedCwd, cfg.cwd(), callerCwd, System.getProperty("user.dir"), ".");
+    }
+
+    private static String firstNonBlank(String... values) {
+        for (String v : values) {
+            if (v != null && !v.isBlank()) return v;
+        }
+        return null;
+    }
+
+    /** Dedicated worker space → own tab (carrying cwd+env) → start the peer into the seed pane. */
+    private Agent spawnInTab(BridgedConfig.Profile cfg, Map<String, String> workerEnv,
+                             List<String> argv, String cwd, MemberRole role) {
+        Workspace space = spaces.ensureWorkspace(cfg.workspace());
+        Tab.Created tab = spaces.createTab(space.workspaceId(), cwd, workerEnv);
+        log.info("spawning {} profile={} space={} tab={} cwd={}",
+                namePrefix, cfg.profile(), space.workspaceId(), tab.tab().tabId(), cwd);
+
+        Started started;
+        try {
+            if (tab.rootPaneId() == null) {
+                // Protocol 19 starts the agent INTO the seed pane — without one there is nowhere
+                // to start, and a partial tab would be left behind.
+                throw new IllegalStateException("tab " + tab.tab().tabId()
+                        + " had no seed pane in the create response — cannot start a peer in it");
+            }
+            started = startUniquelyNamed(cfg, argv, tab.rootPaneId());
+        } catch (RuntimeException e) {
+            // The peer never started — don't leave the tab we just created orphaned.
+            // Best-effort cleanup; never let it mask the real spawn failure.
+            try {
+                spaces.closeTab(tab.tab().tabId());
+            } catch (RuntimeException cleanup) {
+                log.warn("failed to close orphaned tab {} after spawn error: {}",
+                        tab.tab().tabId(), cleanup.getMessage());
+            }
+            throw e;
+        }
+
+        // The peer is LIVE now, in the seed pane itself (no shell pane to drop — protocol 19).
+        // Labelling is cosmetic: it must not fail the spawn or orphan the running peer — on error
+        // we log and still return it so the caller gets its paneId and can tear it down.
+        tidy("label tab " + tab.tab().tabId(),
+                () -> spaces.renameTab(tab.tab().tabId(),
+                        cfg.renderTabLabel(
+                                tabLabelTemplate == null ? null : tabLabelTemplate.get(),
+                                role, nextLabelSeq(role, cfg.profile()))));
+        log.info("{} started pane={} tab={} terminal={}",
+                namePrefix, started.agent().paneId(), started.agent().tabId(), started.agent().terminalId());
+        return started.agent();
+    }
+
+    /** Run a best-effort post-start cleanup step, logging (not throwing) on failure. */
+    private void tidy(String what, Runnable step) {
+        try {
+            step.run();
+        } catch (RuntimeException e) {
+            log.warn("post-start step failed ({}) — peer is running regardless: {}", what, e.getMessage());
+        }
+    }
+
+    /** Legacy placement: split the currently-focused tab; the peer still starts in {@code cwd}. */
+    private Agent spawnAsPane(BridgedConfig.Profile cfg, Map<String, String> workerEnv,
+                              List<String> argv, String cwd) {
+        log.info("spawning {} (pane placement) profile={} cwd={} argv={}",
+                namePrefix, cfg.profile(), cwd, argv);
+        String paneId = spaces.splitPane(cwd, workerEnv);
+        if (paneId == null) {
+            throw new IllegalStateException("pane.split returned no pane — cannot start a peer");
+        }
+        Agent peer = startUniquelyNamed(cfg, argv, paneId).agent();
+        log.info("{} started pane={} terminal={}", namePrefix, peer.paneId(), peer.terminalId());
+        return peer;
+    }
+
+    /** A started peer together with the sequence its unique name/label used. */
+    private record Started(Agent agent, long seq) {
+    }
+
+    /**
+     * Start the peer under a unique herdr agent name. herdr requires each running agent's
+     * {@code name} to be distinct (a 2nd identical {@code name} fails {@code agent_name_taken}) —
+     * the exact case that makes multiple peers useful. The name is
+     * {@code <prefix>-<profile>-<nonce>-<seq>}: {@code seq} distinguishes peers within this process,
+     * and the per-process {@code nonce} keeps a fresh process (whose {@code seq} restarts at 0) from
+     * colliding with same-profile peers that outlived a restart. The retry is a belt-and-braces
+     * backstop for the astronomically unlikely nonce+seq clash; the name is a label only — herdr
+     * detects kind and status from terminal output, not from it.
+     */
+    private Started startUniquelyNamed(BridgedConfig.Profile cfg, List<String> argv, String paneId) {
+        // Protocol 19 resolves the executable from the agent kind (== namePrefix here), so
+        // argv[0] — the configured executable — is dropped and only the extra args are passed.
+        List<String> args = argv.isEmpty() ? argv : argv.subList(1, argv.size());
+        HerdrException last = null;
+        for (int attempt = 0; attempt < NAME_RETRIES; attempt++) {
+            long seq = nameSeq.incrementAndGet();
+            String name = namePrefix + "-" + cfg.profile() + "-" + nameNonce + "-" + seq;
+            try {
+                return new Started(startAwaitingShellPrompt(name, args, paneId), seq);
+            } catch (HerdrException e) {
+                if (!"agent_name_taken".equals(e.code())) throw e;
+                log.debug("peer name '{}' taken, retrying", name);
+                last = e;
+            }
+        }
+        throw last;
+    }
+
+    /** Start the agent into {@code paneId}, waiting out the seed shell's boot with the sleeper. */
+    private Agent startAwaitingShellPrompt(String name, List<String> args, String paneId) {
+        HerdrException busy = null;
+        for (int attempt = 0; attempt < SHELL_READY_RETRIES; attempt++) {
+            try {
+                return agents.start(name, namePrefix, args, paneId);
+            } catch (HerdrException e) {
+                if (!"agent_pane_busy".equals(e.code())) throw e;
+                log.debug("pane {} not at its shell prompt yet, retrying agent.start", paneId);
+                busy = e;
+                sleeper.run();
+            }
+        }
+        throw busy;
+    }
+
+    // --- discovery + reap ----------------------------------------------------------------------
+
+    /** All herdr-tracked agents — discovery for "what peers exist". */
+    @Override
+    public List<Agent> list() {
+        return agents.list();
+    }
+
+    /**
+     * Reap peer panes left behind by an earlier daemon process (CB-117). herdr keeps a peer's pane
+     * alive across a daemon restart <em>by design</em>, and that pane's id is held only by its
+     * spawner — so a peer whose owning process exited before issuing the matching teardown leaks
+     * with nothing tracking it. On boot we scan herdr for agents whose name matches our
+     * {@code <prefix>-<profile>-<nonce>-<seq>} scheme with a nonce <em>other</em> than this
+     * process's {@link #nameNonce}, and tear each one down (its pane and, via {@link #stop}, its
+     * now-empty dedicated tab). A current-nonce peer is ours and live, so it is left running; a
+     * user's own session carries no such name and is never touched. A peer from a <em>different</em>
+     * adapter (different prefix) is likewise never touched. Best-effort: a failed listing, or a
+     * failure to stop any one peer, is logged and never aborts startup.
+     *
+     * @return the number of orphaned peers reaped
+     */
+    @Override
+    public int reapOrphanWorkers() {
+        List<Agent> all;
+        try {
+            all = agents.list();
+        } catch (RuntimeException e) {
+            log.warn("orphan-peer reap skipped — agent.list failed: {}", e.getMessage());
+            return 0;
+        }
+        int reaped = 0;
+        for (Agent a : all) {
+            if (!isForeignWorker(namePrefix, a.name(), nameNonce)) continue;
+            try {
+                stop(a.paneId());
+                reaped++;
+                log.info("reaped orphan {} {} (pane={} tab={}) left by a prior daemon",
+                        namePrefix, a.name(), a.paneId(), a.tabId());
+            } catch (RuntimeException e) {
+                log.warn("could not reap orphan {} {} (pane={}): {}",
+                        namePrefix, a.name(), a.paneId(), e.getMessage());
+            }
+        }
+        if (reaped > 0) {
+            log.info("orphan-peer reap complete — {} stale {} peer(s) removed at startup", reaped, namePrefix);
+        }
+        return reaped;
+    }
+
+    /** The {@code <prefix>-<profile>-<nonce>-<seq>} name pattern; group 1 captures the 6-hex nonce. */
+    static Pattern workerNamePattern(String prefix) {
+        return Pattern.compile(prefix + "-.*-([0-9a-f]{6})-\\d+");
+    }
+
+    /**
+     * Whether {@code name} is a peer of kind {@code prefix} started by a <em>different</em> process
+     * than {@code currentNonce} — the reap predicate (CB-117). True only for the prefix's naming
+     * scheme with a foreign nonce: a non-peer name, a different adapter's name, or our own live
+     * nonce is excluded. Pure and package-private so the decision is unit-testable without herdr.
+     */
+    static boolean isForeignWorker(String prefix, String name, String currentNonce) {
+        String nonce = workerNonce(prefix, name);
+        return nonce != null && !nonce.equals(currentNonce);
+    }
+
+    /** The 6-hex nonce embedded in a {@code prefix} peer name, or {@code null} if not one. */
+    static String workerNonce(String prefix, String name) {
+        if (name == null) return null;
+        Matcher m = workerNamePattern(prefix).matcher(name);
+        return m.matches() ? m.group(1) : null;
+    }
+
+    /** This process's peer-name nonce (a label component only; exposed for reaper tests). */
+    String nameNonce() {
+        return nameNonce;
+    }
+
+    // --- teardown ------------------------------------------------------------------------------
+
+    /**
+     * Tear a peer down: close the pane, and close its tab <em>only</em> when the peer is that tab's
+     * sole occupant. The single-pane check is what makes this safe regardless of how the peer was
+     * placed (or a placement-config change across a restart): a pane-placement peer sitting in one
+     * of the user's shared tabs has siblings, so its tab is never closed — we only ever remove a
+     * tab we created to hold one peer.
+     *
+     * <p>{@code idOrPane} is the {@link PeerHandle#id()} of a peer this launcher spawned (CB-519's
+     * host-unique opaque UUID), resolved through {@link #paneByAgentId} to the pane it must tear
+     * down. An argument that is not one of our ids is treated as a raw herdr pane id — the
+     * {@link #reapOrphanWorkers() orphan-reap} and spawn-gate-timeout paths, plus any caller that
+     * passes a pane directly, keep working without an owning id.
+     *
+     * <p>Resolves the tab from the pane <em>before</em> closing it. An already-gone pane/tab
+     * (repeated DELETE, crashed peer) is treated as success; any other failure propagates so a
+     * genuinely failed teardown is not reported as done.
+     */
+    @Override
+    public void stop(String idOrPane) {
+        // Teardown knows only the pane, not which profile spawned it. Attempt tab cleanup when any
+        // profile uses tab placement (so the bridge may have created a dedicated peer tab); the
+        // single-occupant check below is what actually protects the user's shared tabs.
+        String paneId = paneByAgentId.remove(idOrPane);
+        if (paneId == null) {
+            paneId = idOrPane; // raw-pane fallback (reap, gate timeout, pane-addressed callers)
+        }
+        WorkspaceControl.PaneLocation loc = usesTabPlacement() ? spaces.locatePane(paneId) : null;
+        try {
+            agents.close(paneId);
+        } catch (HerdrException e) {
+            if (!isAlreadyGone(e)) throw e;
+            log.debug("pane.close({}) ignored — already gone: {}", paneId, e.getMessage());
+        }
+        if (loc != null && loc.tabPaneCount() == 1) {
+            spaces.closeTab(loc.tabId());
+        } else if (loc != null) {
+            log.debug("not closing tab {} — it holds {} panes (not a dedicated peer tab)",
+                    loc.tabId(), loc.tabPaneCount());
+        }
+    }
+
+    /** Whether any configured profile places peers in their own tab (so tabs may need cleanup). */
+    private boolean usesTabPlacement() {
+        return profiles.values().stream().anyMatch(BridgedConfig.Profile::tabPlacement);
+    }
+
+    /** True when a herdr error means the target is already gone (safe to treat as done). */
+    private static boolean isAlreadyGone(HerdrException e) {
+        return e.code() != null && e.code().endsWith("_not_found");
+    }
+
+    // --- spawn-readiness gate (CB-306) ---------------------------------------------------------
+
+    /**
+     * Poll {@link AgentControl#status} until the pane reports an injectable state or the configured
+     * timeout elapses. On timeout, close the pane (self-reap) and throw.
+     */
+    private void waitUntilInjectableOrThrow(String paneId) {
+        long deadline = nowMillis.getAsLong() + spawnReadyTimeoutMs;
+        while (nowMillis.getAsLong() < deadline) {
+            if (agents.status(paneId).injectable()) {
+                log.debug("peer pane={} reached injectable state", paneId);
+                return;
+            }
+            sleeper.run();
+        }
+        log.warn("peer pane={} did not become injectable within {}ms — closing", paneId, spawnReadyTimeoutMs);
+        stop(paneId);
+        throw new PeerUnreachableException(
+                "worker pane " + paneId + " did not reach injectable state within "
+                        + spawnReadyTimeoutMs + "ms");
+    }
+
+    /**
+     * A concrete {@link PeerHandle} wrapping herdr agent coordinates, the profile that spawned it,
+     * and the session identity the launch resolved (CB-547a): the bridge's logical name and the
+     * peer's own session id, both null when the spawn carried no identity.
+     */
+    private record WorkerHandle(String id, String terminalId, String profile,
+                                String sessionName, String agentSessionId) implements PeerHandle {
+    }
+
+    // --- shared helpers ------------------------------------------------------------------------
+
+    /** Put {@code k → v} only when {@code v} is present (non-null, non-blank). */
+    protected static void putIfPresent(Map<String, String> m, String k, String v) {
+        if (v != null && !v.isBlank()) {
+            m.put(k, v);
+        }
+    }
+
+    /** Host env lookup that tolerates an unconfigured (null/blank) var name — returns null then. */
+    protected String resolveEnv(String name) {
+        return (name == null || name.isBlank()) ? null : env.apply(name);
+    }
+
+    /**
+     * The parity-neutral git-forge token grant (CB-302): when {@code cfg} opts in via
+     * {@code gitTokenEnv} and the token resolves, inject {@code GITEA_TOKEN} plus its paired
+     * {@code GITEA_HOST}. Push over SSH is unaffected; the only incremental grant is PR-create.
+     * Peer-neutral, so every herdr adapter reuses it unchanged.
+     */
+    protected void applyGitToken(Map<String, String> workerEnv, BridgedConfig.Profile cfg) {
+        if (!cfg.hasGitToken()) {
+            return;
+        }
+        String gitToken = resolveEnv(cfg.gitTokenEnv());
+        if (gitToken != null) {
+            workerEnv.put("GITEA_TOKEN", gitToken);
+            putIfPresent(workerEnv, "GITEA_HOST", resolveEnv(cfg.gitHostEnv()));
+        }
+    }
+
+    /** A fresh mutable env map — the conventional starting point for {@link #buildLaunch}. */
+    /**
+     * Seed a worker's environment (CB-511): the daemon's own {@code PATH}, then the profile's
+     * {@code env:} entries.
+     *
+     * <p>Why this exists: bridged passes herdr an explicit env map, and herdr merges it into
+     * <em>its own</em> process environment. So before this, a worker inherited whatever PATH the
+     * herdr server happened to be started with — on this host, one from weeks earlier with no JDK
+     * and no Maven, which left workers unable to run the build they were being asked to run. The
+     * worker's toolchain must follow from configuration, not from how a long-lived daemon was
+     * launched.
+     *
+     * <p>Adapter-specific variables are layered on top of this by {@code buildLaunch} and therefore
+     * win. That ordering is deliberate and load-bearing: it stops a profile's {@code env:} from
+     * overriding {@code ANTHROPIC_BASE_URL} and slipping past {@link
+     * dev.ltms.bridged.guard.SubscriptionGuard}, which is checked against the profile's
+     * {@code baseUrl} and nothing else.
+     */
+    protected Map<String, String> baseEnv(BridgedConfig.Profile cfg) {
+        Map<String, String> workerEnv = new LinkedHashMap<>();
+        String path = env.apply("PATH");
+        if (path != null && !path.isBlank()) {
+            workerEnv.put("PATH", path);
+        }
+        if (cfg != null && cfg.env() != null) {
+            workerEnv.putAll(cfg.env());
+        }
+        return workerEnv;
+    }
+
+    /** Defensive copy of {@code argv} plus room to append launch flags. */
+    protected static List<String> mutableArgv(List<String> argv) {
+        return new ArrayList<>(argv);
+    }
+
+    /**
+     * Uninterruptible sleep — the production {@link #sleeper}. Tests supply their own no-op /
+     * fast-faking sleeper so they never real-sleep.
+     */
+    protected static void sleepUninterruptibly(long ms) {
+        try {
+            Thread.sleep(ms);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            // preserve the interrupt flag but continue — poll loops should not be aborted by an
+            // interrupt that was not meant for them.
+        }
+    }
+}
@@ -0,0 +1,507 @@
+package dev.ltms.bridged.member;
+
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ObjectNode;
+import dev.ltms.bridged.config.BridgedConfig;
+import dev.ltms.bridged.herdr.Agent;
+import dev.ltms.bridged.herdr.AgentControl;
+import dev.ltms.bridged.herdr.WorkspaceControl;
+import dev.ltms.bridged.peer.Capability;
+import dev.ltms.bridged.peer.PeerHandle;
+import dev.ltms.bridged.peer.SpawnRequest;
+
+import java.io.IOException;
+import java.io.UncheckedIOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.EnumSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.Function;
+import java.util.function.LongSupplier;
+import java.util.function.Supplier;
+
+/**
+ * The {@link HerdrPeerLauncher} adapter for <strong>opencode</strong> — an open-source,
+ * provider-agnostic terminal coding agent. Its whole reason for existing is to prove the
+ * {@code PeerLauncher} SPI is genuinely provider-neutral: opencode shares none of Claude Code's
+ * private launch seams, yet reuses every line of shared transport in the base (tab/pane placement,
+ * the CB-306 readiness gate, unique naming + CB-117 reap, teardown, listing, cwd).
+ *
+ * <p>The divergences from {@link ClaudeCodeLauncher}, all confined to {@link #buildLaunch}:
+ * <ul>
+ *   <li><strong>No subscription boundary.</strong> opencode carries no {@code ANTHROPIC_BASE_URL}
+ *       and there is no {@link dev.ltms.bridged.guard.SubscriptionGuard} — the guard is a
+ *       Claude-private concern, not part of the SPI. opencode reads the operator's own provider
+ *       credentials from its global {@code auth.json}; the bridge injects none.</li>
+ *   <li><strong>File-based MCP mount + instructions.</strong> opencode has no inline
+ *       {@code --mcp-config}/{@code --append-system-prompt}. Instead the bridge writes an ephemeral
+ *       {@code opencode.json} that declares the bridge as a {@code remote} MCP server and lists a
+ *       reply-charter file under {@code instructions}, then points the worker at it with
+ *       {@code OPENCODE_CONFIG}. This is the one place the launcher touches disk — Claude never did.</li>
+ *   <li><strong>Model as a flag.</strong> the {@code provider/model} selector is passed as
+ *       {@code -m}, not an env var.</li>
+ *   <li><strong>{@code opencode} name prefix</strong> so reap matches {@code opencode-*} panes and
+ *       never another adapter's.</li>
+ * </ul>
+ */
+public final class OpenCodeLauncher extends HerdrPeerLauncher {
+
+    /** Label prefix for this adapter's herdr agent names (drives naming + orphan reap). */
+    private static final String NAME_PREFIX = "opencode";
+
+    /** Writer for the generated {@code opencode.json}. */
+    private static final ObjectMapper JSON = new ObjectMapper();
+
+    /**
+     * Standing instruction written to the charter file and mounted via the config's
+     * {@code instructions} so the worker returns its result through {@code bridge_reply}. Kept on
+     * disk (not a launch flag) because opencode's {@code instructions} takes file paths, not inline
+     * text — the file is regenerated per spawn and never touches the worker's own profile.
+     */
+    static final String REPLY_CHARTER =
+            "You are an off-subscription worker in the claude-bridge fleet, running under opencode. "
+            + "Every message you receive arrives through the bridge, and the ONLY channel back to the "
+            + "sender is the bridge_reply MCP tool. Text you write in your terminal is NOT sent "
+            + "anywhere — the sender cannot see your screen, so an in-terminal answer is silently "
+            + "discarded. Therefore you MUST end EVERY turn by calling bridge_reply with `content` set "
+            + "to your complete response. This holds for every message without exception — tasks, "
+            + "questions, clarifications, acknowledgements, and ordinary back-and-forth conversation. "
+            + "Call bridge_reply exactly once, as the final action of your turn, with your full answer "
+            + "in `content`; never wait for confirmation first. If you end a turn without calling "
+            + "bridge_reply, the sender receives nothing and the exchange stalls.";
+
+    /** Root under which per-spawn opencode config dirs are created (injectable for tests). */
+    private final Path configRoot;
+
+    /**
+     * The current spawn's resume-target session id, threaded from {@link #spawn(SpawnRequest)} to
+     * {@link #buildLaunch} across the base's {@code spawn -> spawnInternal -> buildLaunch} chain,
+     * which carries no request. A plain field would race under concurrent spawns (the base supports
+     * them), so it is thread-local: each spawn captures its own request's id on its own thread, and
+     * {@code buildLaunch}, synchronous and same-thread, reads exactly that one. Set only around the
+     * {@code super.spawn} call and cleared in {@code finally}, so a paused/leftover value can never
+     * bleed into the next spawn.
+     */
+    private final ThreadLocal<String> resumeSessionId = new ThreadLocal<>();
+
+    /**
+     * Session discovery against opencode's on-disk storage ({@link OpenCodeSessionDiscovery}) —
+     * the one seam that knows opencode's private session-file layout. Its root is injectable for
+     * tests so they never touch the operator's real {@code ~/.local/share/opencode}.
+     */
+    private final OpenCodeSessionDiscovery discovery;
+
+    /**
+     * Production constructor — disables the spawn-ready gate ({@code spawnReadyTimeoutMs == 0}) so it
+     * matches the legacy non-blocking spawn semantics. Config dirs are created under the JVM temp dir.
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Function<String, String> env) {
+        this(agents, spaces, profiles, defaultProfile, env, 0,
+                System::currentTimeMillis, () -> sleepUninterruptibly(300),
+                defaultConfigRoot(), defaultDiscoveryRoot());
+    }
+
+    /**
+     * Production constructor with the spawn-ready gate enabled. Polls {@code agents.status()} until
+     * the pane reports an injectable state or {@code spawnReadyTimeoutMs} elapses.
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Function<String, String> env,
+                            long spawnReadyTimeoutMs, long spawnReadyPollMs) {
+        this(agents, spaces, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs, spawnReadyPollMs, null);
+    }
+
+    /**
+     * Production constructor carrying the fleet-wide tab-label template (CB-557). The template comes
+     * from {@code fleet.tabLabel}, which a profile cannot know because it names the member's
+     * <em>role</em>; a profile may still override it with its own {@code tabLabel}.
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Function<String, String> env,
+                            long spawnReadyTimeoutMs, long spawnReadyPollMs,
+                            Supplier<String> tabLabelTemplate) {
+        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
+                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
+                defaultConfigRoot(), defaultDiscoveryRoot(), tabLabelTemplate);
+    }
+
+    /**
+     * Full testability constructor. Every injectable collaborator is explicit so unit tests supply a
+     * fake clock ({@code nowMillis}), poll-loop wait ({@code sleeper}), and a temp {@code configRoot}
+     * they can inspect the generated {@code opencode.json}/charter under.
+     *
+     * @param agents              herdr agent control (start, status, close)
+     * @param spaces              workspace / tab control (ensure, create, close)
+     * @param profiles            configured worker profiles
+     * @param defaultProfile      profile a no-argument spawn uses (nullable)
+     * @param env                 host env lookup (injectable for tests)
+     * @param spawnReadyTimeoutMs max ms to wait for injectable state (0 disables the gate)
+     * @param nowMillis           monotonic clock source (e.g. {@code System::currentTimeMillis})
+     * @param sleeper             sleep/wait hook (encodes the poll interval; never called when the
+     *                            gate is disabled)
+     * @param configRoot          existing directory under which per-spawn config dirs are created
+     * @param discoveryRoot       opencode's on-disk storage root to scan for session records
+     *                            (injectable for tests; opencode's layout is matched at
+     *                            {@link OpenCodeSessionDiscovery})
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Function<String, String> env,
+                            long spawnReadyTimeoutMs,
+                            LongSupplier nowMillis, Runnable sleeper,
+                            Path configRoot, Path discoveryRoot) {
+        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
+                nowMillis, sleeper, configRoot, discoveryRoot, null);
+    }
+
+    /**
+     * Full testability constructor, plus the fleet-wide tab-label template (CB-557).
+     *
+     * @param tabLabelTemplate {@code fleet.tabLabel}; {@code null}/blank ⇒
+     *                         {@link BridgedConfig.Fleet#DEFAULT_TAB_LABEL}
+     */
+    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
+                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Function<String, String> env,
+                            long spawnReadyTimeoutMs,
+                            LongSupplier nowMillis, Runnable sleeper,
+                            Path configRoot, Path discoveryRoot,
+                            Supplier<String> tabLabelTemplate) {
+        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs, nowMillis, sleeper, tabLabelTemplate);
+        this.configRoot = configRoot;
+        this.discovery = new OpenCodeSessionDiscovery(discoveryRoot);
+    }
+
+    private static Path defaultConfigRoot() {
+        return Path.of(System.getProperty("java.io.tmpdir"));
+    }
+
+    /** The default opencode storage root: {@code ~/.local/share/opencode} (the XDG data dir). */
+    private static Path defaultDiscoveryRoot() {
+        return Path.of(System.getProperty("user.home"), ".local", "share", "opencode");
+    }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>Builds the opencode launch: no {@code ANTHROPIC_*} and no guard (opencode reads its own
+     * provider credentials); when the profile mounts the bridge MCP, generate an ephemeral
+     * {@code opencode.json} (remote MCP server + reply-charter instructions) and point the worker at
+     * it via {@code OPENCODE_CONFIG}; carry the parity-neutral git-forge grant; and select the model
+     * with {@code -m}.
+     */
+    @Override
+    protected Launch buildLaunch(BridgedConfig.Profile cfg) {
+        Map<String, String> workerEnv = baseEnv(cfg);
+        // A config file is needed for the bridge MCP mount, for a pinned endpoint (CB-508), or both.
+        if (cfg.hasMcp() || hasCustomProvider(cfg)) {
+            workerEnv.put("OPENCODE_CONFIG", writeConfig(cfg).toString());
+        }
+        applyGitToken(workerEnv, cfg);
+        return new Launch(workerEnv, argvWithResume(argvWithModel(argvWithAuto(cfg), cfg)));
+    }
+
+    /**
+     * True when this profile pins its own OpenAI-compatible endpoint (CB-508) rather than using
+     * whatever provider opencode resolves by default.
+     *
+     * <p>Note this reuses {@code baseUrl}, the same field the Claude adapter injects as
+     * {@code ANTHROPIC_BASE_URL} — but it does <em>not</em> go through {@code SubscriptionGuard}.
+     * That asymmetry is deliberate and safe: the guard exists to stop a worker borrowing the
+     * primary's Anthropic subscription, and an opencode process has no Anthropic credential path
+     * at all. Pointing it at a local vLLM cannot leak the subscription.
+     */
+    private static boolean hasCustomProvider(BridgedConfig.Profile cfg) {
+        return cfg.baseUrl() != null && !cfg.baseUrl().isBlank();
+    }
+
+    /**
+     * The launch argv plus the unconditional {@code --auto} flag, which auto-approves the
+     * permissions opencode does not explicitly deny. It is unconditional, not a preference: a
+     * spawned peer has no human at its pane — the bridge spawned it — so one that stops at an
+     * approval prompt is a wedged agent, indistinguishable from a legitimate mid-turn wait and
+     * unable to end its turn with {@code bridge_reply}. opencode's own help calls this
+     * "dangerous!", but the blast radius here is already bounded by design: a worker runs in its
+     * own git worktree on its own branch, is off-subscription, and cannot merge — the lead is the
+     * gate.
+     */
+    private List<String> argvWithAuto(BridgedConfig.Profile cfg) {
+        List<String> argv = mutableArgv(cfg.argv());
+        argv.add("--auto");
+        return argv;
+    }
+
+    /**
+     * The launch argv plus, on a resumed spawn, opencode's {@code -s <id>} flag to continue a prior
+     * conversation by its session id. {@code -s, --session <id>} resumes an existing session; on a
+     * fresh spawn (no resume target) no flag is added, letting opencode start a brand-new session.
+     * The id comes from the current spawn request's {@code resumeSessionId}, threaded per-thread by
+     * {@link #spawn(SpawnRequest)}.
+     */
+    private List<String> argvWithResume(List<String> argv) {
+        String id = resumeSessionId.get();
+        if (id == null || id.isBlank()) {
+            return argv;
+        }
+        List<String> withResume = mutableArgv(argv);
+        withResume.add("-s");
+        withResume.add(id);
+        return withResume;
+    }
+
+    /** The launch argv plus, when a model is configured, the opencode {@code -m provider/model} flag. */
+    private List<String> argvWithModel(List<String> argv, BridgedConfig.Profile cfg) {
+        if (cfg.model() != null && !cfg.model().isBlank()) {
+            argv.add("-m");
+            argv.add(cfg.model());
+        }
+        return argv;
+    }
+
+    /**
+     * Write an ephemeral {@code opencode.json} (and the reply-charter file it references) into a
+     * fresh per-spawn directory under {@link #configRoot}, and return the config file's path for
+     * {@code OPENCODE_CONFIG}. The dir is unique per spawn so concurrent workers never race on it;
+     * it is best-effort cleaned on JVM exit (worker config is disposable — regenerated every spawn).
+     */
+    private Path writeConfig(BridgedConfig.Profile cfg) {
+        try {
+            Path dir = Files.createTempDirectory(configRoot, "bridged-opencode-");
+            dir.toFile().deleteOnExit();
+
+            ObjectNode root = JSON.createObjectNode();
+            root.put("$schema", "https://opencode.ai/config.json");
+            // CB-523, opencode side: a worker that runs out of context dies mid-turn, and its reply
+            // — the entire point of the turn — is lost with it. Auto-compaction is therefore not an
+            // operator preference for a bridged worker, it is a condition of the turn contract.
+            //
+            // Stated deliberately even though it is redundant today: OPENCODE_CONFIG is MERGED over
+            // ~/.config/opencode/config.json rather than replacing it, so a worker already inherits
+            // an `auto: true` set at home. We do not want that inheritance to be what the guarantee
+            // rests on — the home file is outside this repo, differs per machine, and is not ours.
+            //
+            // Know the cost before removing it: this key WINS over the home config (verified — an
+            // OPENCODE_CONFIG value overrides the home value, it does not defer to it), so an
+            // operator who sets `compaction.auto: false` at home cannot turn it off for bridged
+            // workers. That is the intended trade for peers we spawn and whose turns we must land;
+            // if per-profile control is ever wanted, add a profile knob rather than dropping this.
+            root.putObject("compaction").put("auto", true);
+
+            if (cfg.hasMcp()) {
+                Path charter = dir.resolve("reply-charter.md");
+                Files.writeString(charter, REPLY_CHARTER);
+                charter.toFile().deleteOnExit();
+
+                ObjectNode bridge = root.putObject("mcp").putObject("bridge");
+                bridge.put("type", "remote");
+                bridge.put("url", cfg.mcpUrl());
+                bridge.put("enabled", true);
+                root.putArray("instructions").add(charter.toAbsolutePath().toString());
+            }
+            if (hasCustomProvider(cfg)) {
+                addCustomProvider(root, cfg);
+            }
+
+            Path cfgFile = dir.resolve("opencode.json");
+            // Built with Jackson rather than string concatenation: the provider block is nested and
+            // carries operator-supplied values (URL, model id, api key), so escaping must be real.
+            Files.writeString(cfgFile, JSON.writerWithDefaultPrettyPrinter().writeValueAsString(root));
+            cfgFile.toFile().deleteOnExit();
+            return cfgFile;
+        } catch (IOException e) {
+            throw new UncheckedIOException(
+                    "cannot write opencode config for profile " + cfg.profile(), e);
+        }
+    }
+
+    /**
+     * Declare a custom OpenAI-compatible provider so the worker talks to a pinned endpoint (a local
+     * vLLM, say) instead of opencode's default gateway (CB-508).
+     *
+     * <p>The provider id comes from the {@code provider/model} selector in {@code model:}, so one
+     * field drives both the declaration and the {@code -m} flag and they cannot drift apart.
+     */
+    private void addCustomProvider(ObjectNode root, BridgedConfig.Profile cfg) {
+        String[] parts = splitModelSelector(cfg);
+        String providerId = parts[0];
+        String modelId = parts[1];
+
+        ObjectNode provider = root.putObject("provider").putObject(providerId);
+        provider.put("npm", "@ai-sdk/openai-compatible");
+        provider.put("name", providerId + " (bridged)");
+
+        ObjectNode options = provider.putObject("options");
+        options.put("baseURL", openAiBaseUrl(cfg.baseUrl()));
+        // vLLM and friends usually ignore the key, but the AI SDK still requires a non-empty one.
+        String token = resolveEnv(cfg.tokenEnv());
+        options.put("apiKey", (token == null || token.isBlank()) ? "bridged-local-noauth" : token);
+
+        provider.putObject("models").putObject(modelId).put("name", modelId);
+    }
+
+    /**
+     * Split {@code model:} into its {@code provider} and {@code model} halves. A pinned endpoint
+     * needs both, so a bare model name is rejected loudly rather than silently falling back to the
+     * default gateway — a worker quietly talking to the wrong endpoint is the failure this avoids.
+     */
+    private static String[] splitModelSelector(BridgedConfig.Profile cfg) {
+        String model = cfg.model();
+        int slash = model == null ? -1 : model.indexOf('/');
+        if (model == null || model.isBlank() || slash <= 0 || slash == model.length() - 1) {
+            throw new IllegalArgumentException(
+                    "profile " + cfg.profile() + " sets baseUrl (a pinned opencode endpoint) so"
+                            + " model: must be \"<provider>/<model>\", e.g."
+                            + " \"local-vllm/deepseek-v4-flash\"; got "
+                            + (model == null ? "null" : '"' + model + '"'));
+        }
+        return new String[]{model.substring(0, slash), model.substring(slash + 1)};
+    }
+
+    /**
+     * The OpenAI-compatible base URL for {@code baseUrl}. A bare {@code host:port} gets {@code /v1}
+     * appended (where these servers put the API); a URL that already carries a path is taken as-is,
+     * so an endpoint mounted somewhere unusual is still reachable.
+     */
+    private static String openAiBaseUrl(String baseUrl) {
+        String trimmed = baseUrl.trim();
+        while (trimmed.endsWith("/")) {
+            trimmed = trimmed.substring(0, trimmed.length() - 1);
+        }
+        int schemeEnd = trimmed.indexOf("://");
+        String afterScheme = schemeEnd < 0 ? trimmed : trimmed.substring(schemeEnd + 3);
+        return afterScheme.contains("/") ? trimmed : trimmed + "/v1";
+    }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>adds this adapter's session-identity work around the base's spawn — as opencode cannot be
+     * told its session id at spawn (see {@link Capability#SESSION_RESUME} vs
+     * {@link Capability#SESSION_NAME}), identity is only ever adopted after the fact:
+     * <ul>
+     *   <li>the request's {@code resumeSessionId} is remembered for {@link #buildLaunch} to turn
+     *       into {@code -s <id>}; and</li>
+     *   <li>the returned handle is wrapped so its
+     *       {@link dev.ltms.bridged.peer.PeerHandle#agentSessionId()} performs lazy session
+     *       discovery against opencode's storage (see {@link OpenCodeSessionDiscovery}) — always
+     *       non-blocking, {@code null} until opencode has persisted the session record.</li>
+     * </ul>
+     */
+    @Override
+    public PeerHandle spawn(SpawnRequest req) {
+        resumeSessionId.set(req.resumeSessionId());
+        try {
+            PeerHandle inner = super.spawn(req);
+            return new SessionAwareHandle(inner, discovery, effectiveCwd(req));
+        } finally {
+            // Never let a paused/leftover resume id bleed into the next spawn on this thread.
+            resumeSessionId.remove();
+        }
+    }
+
+    /**
+     * A {@link PeerHandle} that delegates everything to the base's worker handle but resolves
+     * {@link #agentSessionId()} lazily through opencode session discovery. Delegate-only, so the
+     * base's id/terminalId/profile semantics (CB-519's host-unique routing key, herdr coordinates)
+     * are untouched — only the opencode-specific identity answer is added. {@code sessionName()}
+     * stays null: opencode has no display-name seam, so the logical name lives only in the bridge's
+     * roster (see the SESSION_NAME capability).
+     */
+    private static final class SessionAwareHandle implements PeerHandle {
+        private final PeerHandle delegate;
+        private final OpenCodeSessionDiscovery discovery;
+        private final String cwd;
+
+        SessionAwareHandle(PeerHandle delegate, OpenCodeSessionDiscovery discovery, String cwd) {
+            this.delegate = delegate;
+            this.discovery = discovery;
+            this.cwd = cwd;
+        }
+
+        @Override
+        public String id() {
+            return delegate.id();
+        }
+
+        @Override
+        public String terminalId() {
+            return delegate.terminalId();
+        }
+
+        @Override
+        public String profile() {
+            return delegate.profile();
+        }
+
+        @Override
+        public String sessionName() {
+            return delegate.sessionName();
+        }
+
+        @Override
+        public String agentSessionId() {
+            // Lazy + retried, never a spawn-time blocker: opencode writes the session record only
+            // when the session is first persisted, so null here is the correct interim answer and
+            // the caller re-calls later (each call re-scans, picking up a record that has since
+            // appeared).
+            return discovery.sessionIdForDirectory(cwd);
+        }
+    }
+
+    // --- Agent-returning convenience spawns (used by callers/tests that want the herdr Agent) ---
+
+    /** Spawn a worker for the default profile in the resolved default cwd. */
+    public Agent spawn() {
+        return spawnInternal(null, null, null);
+    }
+
+    /** Spawn a worker for a named profile (null → default) in the resolved default cwd. */
+    public Agent spawn(String profileName) {
+        return spawnInternal(profileName, null, null);
+    }
+
+    /** Spawn a worker for a named profile with an explicit requested/caller cwd (CB-112). */
+    public Agent spawn(String profileName, String requestedCwd, String callerCwd) {
+        return spawnInternal(profileName, requestedCwd, callerCwd);
+    }
+
+    // --- capabilities --------------------------------------------------------------------------
+
+    @Override
+    public Set<Capability> capabilities() {
+        Set<Capability> caps = EnumSet.of(Capability.MID_TURN_ASK, Capability.WORKTREE,
+                Capability.ORPHAN_REAP, Capability.SESSION_RESUME);
+        if (hasGitTokenProfile()) {
+            caps.add(Capability.SELF_PR);
+        }
+        // Deliberately NOT SESSION_NAME: opencode has no display-name flag, so the bridge's logical
+        // name can't surface in the peer's own UI — declaring the capability would hide that
+        // asymmetry rather than make it honest. For opencode the name lives only in the bridge's
+        // roster (see PeerHandle.sessionName() returning null).
+        return Set.copyOf(caps);
+    }
+
+    /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
+    private boolean hasGitTokenProfile() {
+        return profileConfigs().stream().anyMatch(BridgedConfig.Profile::hasGitToken);
+    }
+
+    // --- CB-117 reap predicate (opencode prefix), kept for direct unit testing -----------------
+
+    /**
+     * Whether {@code name} is an opencode bridge worker started by a <em>different</em> process than
+     * {@code currentNonce}. A thin {@code opencode}-prefix binding of
+     * {@link HerdrPeerLauncher#isForeignWorker(String, String, String)}.
+     */
+    static boolean isForeignWorker(String name, String currentNonce) {
+        return HerdrPeerLauncher.isForeignWorker(NAME_PREFIX, name, currentNonce);
+    }
+}
@@ -0,0 +1,122 @@
+package dev.ltms.bridged.member;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.stream.Stream;
+
+/**
+ * Resolves the opencode session id for a bridged worker from opencode's on-disk storage — the
+ * only place this adapter touches opencode's private layout, and deliberately the <em>only</em>
+ * class that does.
+ *
+ * <p><strong>Why this is isolated behind one seam.</strong> The layout is version-coupled and not a
+ * stable contract: opencode writes one JSON file per session under
+ * {@code <storageRoot>/session/<projectID>/<ses_*.json>}, and each record carries a
+ * {@code "version"} field (e.g. {@code "1.1.31"}), so the exact directory shape, file naming, and
+ * field names can move between opencode releases. opencode also ships a headless HTTP server that
+ * may supersede file scanning entirely. Everything this adapter knows about that private storage —
+ * its shape, naming, and field names — lives here, so a layout change, or a switch to the HTTP
+ * server, changes exactly one class and nothing in {@link OpenCodeLauncher}.
+ *
+ * <p>The determinism that makes this useful is structural, not a guess: every bridged worker runs
+ * in its own unique git worktree, so the record's {@code directory} (its project root) equals the
+ * worker's cwd identifies <em>its</em> session unambiguously. We match on {@code directory} rather
+ * than diffing {@code opencode session list} before/after — that races under concurrent spawns, and
+ * the CLI listing does not even show the directory.
+ *
+ * <p>All reads are best-effort and never throw: a missing or unreadable storage root, a record that
+ * fails to parse, or a directory with no record yet all yield {@code null}, and the caller (the
+ * session handle) treats that as "identity not resolved yet" and retries later.
+ */
+final class OpenCodeSessionDiscovery {
+
+    private final Path storageRoot;   // e.g. ~/.local/share/opencode (injectable for tests)
+    private final ObjectMapper json;
+
+    OpenCodeSessionDiscovery(Path storageRoot) {
+        this.storageRoot = storageRoot;
+        this.json = new ObjectMapper();
+    }
+
+    /**
+     * The opencode session id whose record references {@code directory} (the worker's cwd), or
+     * {@code null} when no record matches yet. When several records share the directory — e.g.
+     * repeated spawns into the same worktree — the <em>most recently modified</em> one wins: it is
+     * the session the pane most likely corresponds to.
+     *
+     * <p>Never throws: a missing {@code storageRoot}, an unreadable/malformed record, or a
+     * directory that has not been persisted yet all resolve to {@code null} rather than failing a
+     * spawn. A bridged worker's session record is written lazily (when the session is first
+     * persisted), so {@code null} here is the normal answer right after the pane is ready, and the
+     * caller retries later.
+     *
+     * @param directory the worker's cwd, as resolved for this spawn
+     * @return the matching session id, or {@code null} if none is known yet
+     */
+    String sessionIdForDirectory(String directory) {
+        if (directory == null || directory.isBlank()) {
+            return null;
+        }
+        Path sessionRoot = storageRoot.resolve("session");
+        if (!Files.isDirectory(sessionRoot)) {
+            return null;
+        }
+        String best = null;
+        long bestMtime = Long.MIN_VALUE;
+        try (Stream<Path> projectDirs = Files.list(sessionRoot)) {
+            for (Path projectDir : projectDirs.filter(Files::isDirectory).toList()) {
+                try (Stream<Path> records = Files.list(projectDir)) {
+                    for (Path record : records.toList()) {
+                        String id = matchId(record, directory);
+                        if (id == null) {
+                            continue;
+                        }
+                        long mtime = lastModifiedEpochMillis(record);
+                        if (mtime > bestMtime) {
+                            bestMtime = mtime;
+                            best = id;
+                        }
+                    }
+                } catch (IOException ignored) {
+                    // one project dir unreadable — skip it; another may still match
+                }
+            }
+        } catch (IOException ignored) {
+            // storage root vanished or became unreadable — "no session known yet"
+            return null;
+        }
+        return best;
+    }
+
+    /**
+     * The record's session id when it references {@code directory}, else {@code null}. A record
+     * that is not JSON, lacks {@code id}/{@code directory}, or points at a different directory is
+     * simply not our session; a malformed one is skipped, never fatal.
+     */
+    private String matchId(Path record, String directory) {
+        try {
+            JsonNode node = json.readTree(record.toFile());
+            JsonNode id = node == null ? null : node.get("id");
+            JsonNode dir = node == null ? null : node.get("directory");
+            if (id == null || dir == null || !directory.equals(dir.asText())) {
+                return null;
+            }
+            return id.asText();
+        } catch (IOException e) {
+            return null;
+        }
+    }
+
+    /** The record's last-modified epoch ms, or {@code Long.MIN_VALUE} if unreadable (never wins). */
+    private static long lastModifiedEpochMillis(Path record) {
+        try {
+            return Files.getLastModifiedTime(record).toMillis();
+        } catch (IOException e) {
+            return Long.MIN_VALUE;
+        }
+    }
+}
@@ -1,8 +1,8 @@
-package dev.ltms.fleet.metrics;
+package dev.ltms.bridged.metrics;

-import dev.ltms.fleet.msg.ReplyInbox;
-import dev.ltms.fleet.session.SessionManager;
-import dev.ltms.fleet.session.MemberSession;
+import dev.ltms.bridged.msg.ReplyInbox;
+import dev.ltms.bridged.session.SessionManager;
+import dev.ltms.bridged.session.MemberSession;

 import java.util.LinkedHashMap;
 import java.util.Map;
@@ -13,33 +13,33 @@ import java.util.Map;
 *
 * <p>The set is deliberately small: each series maps to a failure mode this project has actually
 * hit, not to whatever was easy to count. The two worth watching in practice are
- * {@code fleet_sends_total{outcome="completion_fallback"}} — a rising share means turn detection
+ * {@code bridged_sends_total{outcome="completion_fallback"}} — a rising share means turn detection
 * is degrading, the CB-115/116/118 failure family — and
- * {@code fleet_push_nudges_total{outcome="exhausted"}}, which means the primary stopped draining
+ * {@code bridged_push_nudges_total{outcome="exhausted"}}, which means the primary stopped draining
 * its inbox and CB-307's active push gave up.
 */
-public final class FleetMetrics {
+public final class BridgedMetrics {

    /** Counter: delegated sends by terminal outcome. */
-    public static final String SENDS = "fleet_sends_total";
+    public static final String SENDS = "bridged_sends_total";
    /** Counter: worker replies by the path that carried them (rendezvous vs stranded-to-inbox). */
-    public static final String REPLIES = "fleet_replies_total";
+    public static final String REPLIES = "bridged_replies_total";
    /** Counter: push-loop nudges to the primary, by outcome. */
-    public static final String PUSH_NUDGES = "fleet_push_nudges_total";
+    public static final String PUSH_NUDGES = "bridged_push_nudges_total";
    /** Counter: idle-lead heartbeat nudges to the lead, by outcome (CB-551). */
-    public static final String HEARTBEAT_NUDGES = "fleet_lead_heartbeat_nudges_total";
+    public static final String HEARTBEAT_NUDGES = "bridged_lead_heartbeat_nudges_total";
    /** Counter: spawn attempts by peer kind and outcome. */
-    public static final String SPAWNS = "fleet_spawns_total";
+    public static final String SPAWNS = "bridged_spawns_total";
    /** Counter: herdr socket calls by method and outcome. */
-    public static final String HERDR_CALLS = "fleet_herdr_calls_total";
+    public static final String HERDR_CALLS = "bridged_herdr_calls_total";
    /** Counter: rejected requests by reason (CB-501). */
-    public static final String AUTH_FAILURES = "fleet_auth_failures_total";
+    public static final String AUTH_FAILURES = "bridged_auth_failures_total";
    /** Gauge: session census by lifecycle state. */
-    public static final String SESSIONS = "fleet_sessions";
+    public static final String SESSIONS = "bridged_sessions";
    /** Gauge: undrained replies held per target. */
-    public static final String INBOX_DEPTH = "fleet_inbox_depth";
+    public static final String INBOX_DEPTH = "bridged_inbox_depth";

-    private FleetMetrics() {
+    private BridgedMetrics() {
    }

    /**
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.metrics;
+package dev.ltms.bridged.metrics;

 import java.util.Map;
 import java.util.NavigableMap;
@@ -0,0 +1,242 @@
+package dev.ltms.bridged.msg;
+
+import com.rabbitmq.client.AMQP;
+import com.rabbitmq.client.Channel;
+import com.rabbitmq.client.Connection;
+import com.rabbitmq.client.ConnectionFactory;
+import com.rabbitmq.client.DeliverCallback;
+import com.rabbitmq.client.Recoverable;
+import com.rabbitmq.client.RecoveryListener;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.concurrent.ConcurrentHashMap;
+
+/**
+ * AMQP-backed {@link ReplyInbox} (CB-307 Stage 2): genuine cross-restart durability behind the same
+ * port {@link InMemoryReplyInbox} implements as soft state.
+ *
+ * <p><strong>Mapping — consume-and-hold with deferred manual ack.</strong> Each target has a durable
+ * queue {@code agent.<target>.inbox}. The gateway that owns the target starts a manual-ack consumer
+ * ({@link #own}) that pulls persistent messages off that queue into an in-memory <em>held</em> map
+ * (keyed by {@code msgId}) but does <em>not</em> ack them. {@link #peek} returns that snapshot;
+ * {@link #ack} acks the broker delivery-tag and drops the entry. Because messages stay unacked until
+ * the owning gateway actually drains them, a crash (or a {@code java -jar} bounce) before caller-ack
+ * leaves them on the broker — it redelivers on reconnect. That is the durability the in-memory
+ * adapter cannot give, with the port contract preserved.
+ *
+ * <p><strong>Ownership is explicit.</strong> {@link #own} declares the queue and starts the consumer;
+ * {@link #release} cancels it. {@link #publish} sends to the queue but does <em>not</em> imply ownership
+ * and does not attach a consumer. This split is required by CB-308 federation, where one gateway may
+ * publish to an agent owned by another gateway; in that case the publisher must not compete for
+ * deliveries.
+ *
+ * <p><strong>Dedup.</strong> The consumer keys the held map by {@code msgId}; a redelivered duplicate
+ * (at-least-once, or a producer double-publish) is acked-and-dropped on arrival, so it never
+ * double-queues.
+ *
+ * <p><strong>Visibility.</strong> Unlike the in-memory adapter, publish → broker → consumer is
+ * asynchronous, so a {@link #peek} immediately after {@link #publish} may not yet see the message
+ * (broker delivery latency). Callers that need the reply drained poll (as the primary already does);
+ * the contract test waits for visibility. This is inherent to broker-backed delivery, not a defect.
+ *
+ * <p>The default deploy targets LavinMQ; a stock RabbitMQ speaks the same AMQP 0-9-1 (URI-only swap),
+ * so the {@code @Tag("contract")} integration test runs against a RabbitMQ container.
+ */
+public final class AmqpReplyInbox implements ReplyInbox, AutoCloseable {
+
+    private static final Logger log = LoggerFactory.getLogger(AmqpReplyInbox.class);
+
+    private static final String QUEUE_PREFIX = "agent.";
+    private static final String QUEUE_SUFFIX = ".inbox";
+
+    private final Connection connection;
+    private final Channel channel;
+    /** All channel operations (publish/declare/ack/cancel) serialize on this — a Channel is not thread-safe. */
+    private final Object channelLock = new Object();
+    /** target → (msgId → held delivery). Per-target map is guarded by synchronizing on itself. */
+    private final ConcurrentHashMap<String, LinkedHashMap<String, Held>> held = new ConcurrentHashMap<>();
+    /** Targets whose queue is declared and consumer is running, mapped to their broker consumer tag. */
+    private final ConcurrentHashMap<String, String> consumerTags = new ConcurrentHashMap<>();
+
+    /** A message pulled off the broker but not yet acked: its delivery-tag plus the port payload. */
+    private record Held(long deliveryTag, InboxMessage message) {}
+
+    /** Connect to {@code uri} (e.g. {@code amqp://guest:guest@127.0.0.1:5672/}) and open the inbox. */
+    public static AmqpReplyInbox open(String uri) {
+        try {
+            ConnectionFactory factory = new ConnectionFactory();
+            factory.setUri(uri);
+            // Self-heal transient blips; topology recovery re-declares queues and re-attaches consumers.
+            factory.setAutomaticRecoveryEnabled(true);
+            factory.setTopologyRecoveryEnabled(true);
+            return new AmqpReplyInbox(factory.newConnection("bridged-reply-inbox"));
+        } catch (Exception e) {
+            throw new IllegalStateException("cannot connect to AMQP broker at " + uri, e);
+        }
+    }
+
+    /** Wrap an already-open connection (injection seam for the contract test). */
+    AmqpReplyInbox(Connection connection) {
+        this.connection = connection;
+        try {
+            this.channel = connection.createChannel();
+        } catch (IOException e) {
+            throw new IllegalStateException("cannot open AMQP channel", e);
+        }
+        // On automatic recovery the broker redelivers unacked messages with FRESH delivery-tags; the
+        // tags we were holding are now stale. Drop the held snapshot so the re-attached consumer
+        // repopulates it with valid tags (dedup by msgId still prevents any double-queue).
+        if (connection instanceof Recoverable recoverable) {
+            recoverable.addRecoveryListener(new RecoveryListener() {
+                @Override
+                public void handleRecovery(Recoverable recoverable) {
+                    held.clear();
+                    log.info("AMQP connection recovered; cleared held replies for fresh redelivery");
+                }
+
+                @Override
+                public void handleRecoveryStarted(Recoverable recoverable) {
+                    // no-op: we act once recovery completes
+                }
+            });
+        }
+    }
+
+    @Override
+    public void own(String target) {
+        synchronized (channelLock) {
+            if (consumerTags.containsKey(target)) {
+                return;                            // already owning this target
+            }
+            String queue = queueName(target);
+            try {
+                channel.queueDeclare(queue, true, false, false, null); // durable, non-exclusive, keep on idle
+                String tag = channel.basicConsume(queue, false, deliverCallback(target), _ -> { });
+                consumerTags.put(target, tag);
+                log.debug("AMQP inbox owns queue {} for target {}", queue, target);
+            } catch (IOException e) {
+                throw new IllegalStateException("cannot own queue " + queue, e);
+            }
+        }
+    }
+
+    @Override
+    public void release(String target) {
+        synchronized (channelLock) {
+            String tag = consumerTags.remove(target);
+            held.remove(target);                   // stale delivery tags must not survive release
+            if (tag == null) {
+                return;
+            }
+            try {
+                channel.basicCancel(tag);
+            } catch (IOException e) {
+                throw new IllegalStateException("cannot cancel consumer for " + target, e);
+            }
+        }
+    }
+
+    @Override
+    public void publish(String target, String msgId, String content) {
+        AMQP.BasicProperties props = new AMQP.BasicProperties.Builder()
+                .messageId(msgId)
+                .deliveryMode(2)                   // persistent — survives a broker restart
+                .contentType("text/plain")
+                .build();
+        try {
+            synchronized (channelLock) {
+                channel.basicPublish("", queueName(target), props, content.getBytes(StandardCharsets.UTF_8));
+            }
+        } catch (IOException e) {
+            throw new IllegalStateException("cannot publish reply to " + queueName(target), e);
+        }
+    }
+
+    @Override
+    public List<InboxMessage> peek(String target) {
+        var perTarget = held.get(target);
+        if (perTarget == null) {
+            return List.of();
+        }
+        synchronized (perTarget) {
+            return perTarget.values().stream().map(Held::message).toList();
+        }
+    }
+
+    @Override
+    public void ack(String target, String msgId) {
+        var perTarget = held.get(target);
+        if (perTarget == null) {
+            return;
+        }
+        Held h;
+        synchronized (perTarget) {
+            h = perTarget.remove(msgId);
+        }
+        if (h == null) {
+            return;                                // never held (or already acked) — no-op
+        }
+        try {
+            synchronized (channelLock) {
+                channel.basicAck(h.deliveryTag(), false);
+            }
+        } catch (IOException e) {
+            // Ack didn't reach the broker: restore the entry so a later ack (or a redelivery after
+            // reconnect) can retry. Keeps the at-least-once contract — a reply is never silently lost.
+            synchronized (perTarget) {
+                perTarget.putIfAbsent(msgId, h);
+            }
+            throw new IllegalStateException("cannot ack reply " + msgId + " on " + queueName(target), e);
+        }
+    }
+
+    private DeliverCallback deliverCallback(String target) {
+        return (_, delivery) -> {
+            String msgId = delivery.getProperties().getMessageId();
+            long tag = delivery.getEnvelope().getDeliveryTag();
+            if (msgId == null || msgId.isBlank()) {
+                msgId = Long.toHexString(tag);     // synthesize an id so dedup still has a key
+            }
+            String content = new String(delivery.getBody(), StandardCharsets.UTF_8);
+            var perTarget = held.computeIfAbsent(target, _ -> new LinkedHashMap<>());
+            boolean duplicate;
+            synchronized (perTarget) {
+                if (perTarget.containsKey(msgId)) {
+                    duplicate = true;
+                } else {
+                    perTarget.put(msgId, new Held(tag, new InboxMessage(msgId, target, content)));
+                    duplicate = false;
+                }
+            }
+            if (duplicate) {
+                // Redelivered duplicate: ack the new tag and drop it so the broker stops resending.
+                synchronized (channelLock) {
+                    channel.basicAck(tag, false);
+                }
+            }
+        };
+    }
+
+    private static String queueName(String target) {
+        return QUEUE_PREFIX + target + QUEUE_SUFFIX;
+    }
+
+    @Override
+    public void close() {
+        try {
+            channel.close();
+        } catch (Exception e) {
+            log.debug("AMQP channel close: {}", e.toString());
+        }
+        try {
+            connection.close();
+        } catch (Exception e) {
+            log.debug("AMQP connection close: {}", e.toString());
+        }
+    }
+}
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.msg;
+package dev.ltms.bridged.msg;

 import java.util.LinkedHashMap;
 import java.util.List;
@@ -16,7 +16,7 @@ import java.util.concurrent.ConcurrentHashMap;
 * non-broker path stays interchangeable.
 *
 * <p><strong>This is soft-state, NOT persistence.</strong> Lost on a {@code java -jar} bounce — that
- * is correct and consistent with "fleetd stays soft-state." The Stage-2 AMQP adapter replaces this.
+ * is correct and consistent with "bridged stays soft-state." The Stage-2 AMQP adapter replaces this.
 */
 public final class InMemoryReplyInbox implements ReplyInbox {

@@ -1,11 +1,11 @@
-package dev.ltms.fleet.msg;
+package dev.ltms.bridged.msg;

-import dev.ltms.fleet.herdr.AgentControl;
-import dev.ltms.fleet.herdr.AgentStatus;
-import dev.ltms.fleet.mcp.PrimaryRegistry;
-import dev.ltms.fleet.metrics.FleetMetrics;
-import dev.ltms.fleet.metrics.Metrics;
-import dev.ltms.fleet.session.MemberSession;
+import dev.ltms.bridged.herdr.AgentControl;
+import dev.ltms.bridged.herdr.AgentStatus;
+import dev.ltms.bridged.mcp.PrimaryRegistry;
+import dev.ltms.bridged.metrics.BridgedMetrics;
+import dev.ltms.bridged.metrics.Metrics;
+import dev.ltms.bridged.session.MemberSession;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -18,7 +18,7 @@ import java.util.function.Supplier;

 /**
 * CB-551: an opt-in heartbeat that nudges the single idle lead back to work once it has been
- * continuously idle past a quiet period with no open {@code fleet_send} driving it.
+ * continuously idle past a quiet period with no open {@code bridge_send} driving it.
 *
 * <p>Why this exists: the fleet is ONE lead + architects + workers, so an idle, stalled lead is a
 * single point of failure for the fleet's progress. {@link ReplyPushLoop} nudges the lead only when
@@ -99,7 +99,7 @@ public final class LeadHeartbeatLoop {
    /** Count one nudge outcome when a registry is wired; a no-op in unit tests. */
    private void countNudge(String outcome) {
        if (metrics != null) {
-            metrics.inc(FleetMetrics.HEARTBEAT_NUDGES, "outcome", outcome);
+            metrics.inc(BridgedMetrics.HEARTBEAT_NUDGES, "outcome", outcome);
        }
    }

@@ -290,7 +290,7 @@ public final class LeadHeartbeatLoop {
        /** The nudge body, phrased for the two cases the heartbeat distinguishes. */
        String nudgeText() {
            StringBuilder sb = new StringBuilder(
-                    "Heartbeat: you are idle and no fleet_send is waiting on you.");
+                    "Heartbeat: you are idle and no bridge_send is waiting on you.");
            if (hasPending()) {
                sb.append(" The fleet has state to collect: ").append(pendingDetail());
            } else {
@@ -309,10 +309,10 @@ public final class LeadHeartbeatLoop {
                    .append(" pending collection");
            if (!replyTargets.isEmpty()) {
                // Render each as the exact command so the lead can act without parsing: the nearest
-                // analogue to ReplyPushLoop's fleet_poll(target=...) nudge.
+                // analogue to ReplyPushLoop's bridge_poll(target=...) nudge.
                sb.append(" (")
                        .append(String.join(", ",
-                                replyTargets.stream().map(t -> "fleet_poll(target=" + t + ")").toList()))
+                                replyTargets.stream().map(t -> "bridge_poll(target=" + t + ")").toList()))
                        .append(")");
            }
            sb.append(", ").append(doneSessions).append(" DONE session").append(doneSessions == 1 ? "" : "s")
@@ -0,0 +1,569 @@
+package dev.ltms.bridged.msg;
+
+import dev.ltms.bridged.herdr.AgentControl;
+import dev.ltms.bridged.herdr.AgentStatus;
+import dev.ltms.bridged.inject.Injector;
+import dev.ltms.bridged.metrics.BridgedMetrics;
+import dev.ltms.bridged.metrics.Metrics;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.List;
+import java.util.UUID;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.CompletionException;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.concurrent.locks.ReentrantLock;
+
+/**
+ * The blocking delegation feature (CB-104): deliver {@code content} into a worker and block until
+ * the worker returns a <em>structured reply</em> via {@code bridge_reply} (the {@link Rendezvous}),
+ * then hand that reply back. Delivery is the {@link Injector}'s job (the background poller sends it
+ * when the worker is injectable); this service never drives the injector or scrapes the terminal —
+ * completion is the worker's explicit reply, not a guess about {@code agent_status}.
+ *
+ * <p>Sends are serialized per session so exactly one reply can be outstanding per worker, which is
+ * what lets a reply map unambiguously to its send (no cross-talk between concurrent callers).
+ *
+ * <p>If the worker never replies within the timeout, the caller gets a typed "still working" /
+ * "queued" outcome — the message may still be mid-flight. A finished-but-unreplied turn is caught
+ * by the CB-106 completion fallback (see {@link Rendezvous#resolveCompletion}).
+ *
+ * <p><strong>Async fire-and-poll (CB-107).</strong> A caller's MCP client caps a blocking call at
+ * ~60s, but a real delegated task runs for minutes. {@link #sendAsync} therefore runs the same
+ * blocking {@link #send} on a background virtual thread and hands back a <em>ticket</em> the caller
+ * polls with {@link #poll}. The blocking and async paths share one code path (and the same per-target
+ * serialization), so async inherits the reply + completion resolution behaviour for free.
+ */
+public final class MessageService {
+
+    private static final Logger log = LoggerFactory.getLogger(MessageService.class);
+
+    /**
+     * The window a fire-and-poll send waits for resolution — generous, since no caller is blocked on
+     * it; a real delegated task resolves (reply or completion) well within this, and only a genuinely
+     * hung worker rides it out.
+     */
+    private static final long ASYNC_TIMEOUT_MS = 30 * 60 * 1_000L;
+
+    /** How long a finished (terminal) ticket is retained for polling before it is pruned. */
+    private static final long TICKET_TTL_NANOS = 10 * 60 * 1_000_000_000L;
+
+    /** Outcome of a blocking send. */
+    public enum Outcome {
+        /** The worker called {@code bridge_reply}; {@code text} holds the structured answer. */
+        REPLIED,
+        /**
+         * The worker's delegated turn finished without a {@code bridge_reply} (CB-106 fallback);
+         * {@code text} is the scraped transcript tail rather than a structured answer.
+         */
+        COMPLETED_UNREPLIED,
+        /**
+         * The worker ran the turn then wedged in an unrecoverable state (CB-109); {@code text} is the
+         * failure context (e.g. the error screen). Terminal, but not a successful completion.
+         */
+        WORKER_FAILED,
+        /**
+         * The worker paused mid-turn to ask the primary a question (CB-205); {@code text} is the
+         * question and {@code turnId} correlates the answer. Not terminal — the primary answers with
+         * {@link #answer(String, String, long)} and the turn resumes.
+         */
+        QUESTION,
+        /** Timed out after the message was delivered — the worker is still working. */
+        TIMED_OUT_WORKING,
+        /** Timed out before delivery — the message is still queued for the worker. */
+        TIMED_OUT_QUEUED,
+        /** Another send to this session was in flight for the whole window. */
+        BUSY,
+        /**
+         * An answer ({@link #answer(String, String, long)}) referenced a {@code turnId} that is no
+         * longer open — the worker's {@code bridge_ask} already timed out or was answered.
+         */
+        STALE_TURN
+    }
+
+    /**
+     * @param outcome how the send ended (or paused)
+     * @param text    the worker's answer when {@link #completed()} (a structured {@code bridge_reply}
+     *                for {@link Outcome#REPLIED}, a scraped transcript tail for
+     *                {@link Outcome#COMPLETED_UNREPLIED}), or the question for {@link Outcome#QUESTION},
+     *                else {@code null}
+     * @param turnId  correlation id for a {@link Outcome#QUESTION} (answered via
+     *                {@link #answer(String, String, long)}), else {@code null}
+     */
+    public record Reply(Outcome outcome, String text, String turnId) {
+        /** A reply with no correlation id (the common terminal outcomes). */
+        public Reply(Outcome outcome, String text) {
+            this(outcome, text, null);
+        }
+
+        /** Whether the worker's turn actually finished with an answer (replied or scraped). */
+        public boolean completed() {
+            return outcome == Outcome.REPLIED || outcome == Outcome.COMPLETED_UNREPLIED;
+        }
+    }
+
+    /** How a worker's {@code bridge_ask} (CB-205) resolved. */
+    public enum AskOutcome {
+        /** The primary answered; {@link AskResult#answer} carries it. */
+        ANSWERED,
+        /** No delegation was open to surface the question to — the worker has no one to ask. */
+        NO_WAITER,
+        /** The primary did not answer within the window. */
+        TIMED_OUT
+    }
+
+    /** The outcome of a worker's {@code bridge_ask}: how it resolved and (if answered) the answer. */
+    public record AskResult(AskOutcome outcome, String answer) {
+    }
+
+    /** Lifecycle phase of an async delegation ticket. */
+    public enum Phase {
+        /** Delegated and in flight — queued for the worker or being worked. */
+        PENDING,
+        /** The worker's turn finished; {@link TaskView#reply} holds the answer. */
+        DONE,
+        /** The delegation could not complete (timed out, worker gone, or busy). */
+        FAILED
+    }
+
+    /**
+     * A poll snapshot of an async delegation.
+     *
+     * @param reply       the answer when {@link #phase} is {@link Phase#DONE}, else {@code null}
+     * @param replySource {@code "reply"} (structured {@code bridge_reply}) or {@code "transcript"}
+     *                    (completion scrape) when {@link Phase#DONE}, else {@code null}
+     * @param detail      a human note (live worker status while pending, or the failure reason)
+     */
+    public record TaskView(String ticket, Phase phase, String reply, String replySource, String detail) {
+    }
+
+    /** An in-flight or finished async delegation, keyed by its ticket. */
+    private record Task(String target, CompletableFuture<Reply> future, long createdNanos) {
+    }
+
+    private final AgentControl agents;
+    private final Injector injector;
+    private final Rendezvous rendezvous;
+    private final ReplyInbox inbox;
+    private final ReplyPushLoop pushLoop;
+    private final Metrics metrics; // CB-502: nullable — no registry in unit tests
+    private final ConcurrentHashMap<String, ReentrantLock> sessionLocks = new ConcurrentHashMap<>();
+    private final ConcurrentHashMap<String, Task> tasks = new ConcurrentHashMap<>();
+    private final AtomicLong ticketSeq = new AtomicLong();
+    private final ExecutorService asyncExecutor = Executors.newThreadPerTaskExecutor(
+            Thread.ofVirtual().name("bridge-async-", 0).factory());
+
+    /**
+     * Create with an explicit {@link ReplyInbox} and optional {@link ReplyPushLoop}.
+     *
+     * @param pushLoop nullable — when non-null, the push loop is notified on the no-waiter reply
+     *                 branch ({@link #reply}) so it can nudge the primary to drain the inbox
+     */
+    public MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous,
+                          ReplyInbox inbox, ReplyPushLoop pushLoop) {
+        this(agents, injector, rendezvous, inbox, pushLoop, null);
+    }
+
+    /**
+     * As above, with a metric registry (CB-502). Instrumenting here rather than at the REST and MCP
+     * edges means both surfaces are counted by one piece of code and cannot drift.
+     *
+     * @param metrics nullable — when null, nothing is recorded
+     */
+    public MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous,
+                          ReplyInbox inbox, ReplyPushLoop pushLoop, Metrics metrics) {
+        this.agents = agents;
+        this.injector = injector;
+        this.rendezvous = rendezvous;
+        this.inbox = inbox;
+        this.pushLoop = pushLoop;
+        this.metrics = metrics;
+    }
+
+    /** Create with an explicit {@link ReplyInbox} and no push loop. */
+    public MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous, ReplyInbox inbox) {
+        this(agents, injector, rendezvous, inbox, null);
+    }
+
+    /** Backward-compatible constructor that uses a default {@link InMemoryReplyInbox}. */
+    public MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous) {
+        this(agents, injector, rendezvous, new InMemoryReplyInbox());
+    }
+
+    /** Current lifecycle status of a worker (the {@code GET /sessions/{id}/status} surface). */
+    public AgentStatus status(String target) {
+        return agents.status(target);
+    }
+
+    /**
+     * Route a worker's explicit {@code bridge_reply}: resolve an open send, or queue it in the
+     * inbox if no send is currently open. Unlike the bare {@link Rendezvous#resolve}, a no-waiter
+     * result is <em>not</em> a failure — the reply is held for later drain.
+     *
+     * <p><strong>Do NOT use this for mid-turn questions.</strong> {@code bridge_ask} /
+     * {@link Rendezvous#resolveQuestion} must keep today's {@code NO_WAITER} behaviour — questions
+     * are interactive and must never be queued.
+     *
+     * @return always {@code true} — the reply either resolved a live send or was queued
+     */
+    public boolean reply(String session, String content) {
+        if (rendezvous.resolve(session, content)) {
+            count(BridgedMetrics.REPLIES, "path", "rendezvous");
+            return true;                       // a live send took it — unchanged fast path
+        }
+        inbox.publish(session, UUID.randomUUID().toString(), content);
+        // A rising inbox share is the signal CB-307 exists to make visible: the worker finished but
+        // nobody was waiting, so delivery now depends on the push loop and a drain.
+        count(BridgedMetrics.REPLIES, "path", "inbox");
+        if (pushLoop != null) {
+            pushLoop.onReplyQueued(session);
+        }
+        return true;                           // held, not lost
+    }
+
+    /** Record a counter sample when a registry is wired; a no-op in unit tests. */
+    private void count(String name, String... labels) {
+        if (metrics != null) {
+            metrics.inc(name, labels);
+        }
+    }
+
+    /** Count a send's terminal outcome and pass the reply through unchanged. */
+    private Reply recorded(Reply r) {
+        String label = sendOutcomeLabel(r.outcome());
+        if (label != null) {
+            count(BridgedMetrics.SENDS, "outcome", label);
+        }
+        return r;
+    }
+
+    /** Map a terminal send outcome to its metric label, or {@code null} for non-terminal ones. */
+    private static String sendOutcomeLabel(Outcome o) {
+        return switch (o) {
+            case REPLIED -> "replied";
+            case COMPLETED_UNREPLIED -> "completion_fallback";
+            case TIMED_OUT_WORKING, TIMED_OUT_QUEUED, BUSY -> "timeout";
+            case WORKER_FAILED -> "failed";
+            case STALE_TURN, QUESTION -> null; // not a completed delegation
+        };
+    }
+
+    /**
+     * Abandon any send still waiting on {@code target} because its session has gone away (CB-516).
+     *
+     * <p>Without this, tearing a worker down left its rendezvous waiter open: a blocking
+     * {@code bridge_send} kept blocking, and an async one kept reporting {@code PENDING} until
+     * {@link #ASYNC_TIMEOUT_MS} — thirty minutes — even though the worker provably no longer
+     * existed and the delegation could never complete. Worse, {@code poll} already had the evidence
+     * (it calls {@code liveStatus} to build its detail string and gets back {@code "unknown"}) and
+     * reported {@code PENDING} anyway.
+     *
+     * <p>Resolving the waiter as a failure — rather than letting it time out — also means the
+     * outcome is counted, so a torn-down delegation stops being invisible to {@code /metrics}.
+     *
+     * @return true if a live waiter was failed
+     */
+    public boolean abandon(String target, String reason) {
+        CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.currentWaiter(target);
+        if (waiter == null || waiter.isDone()) {
+            return false; // nobody is blocked on this worker — nothing to abandon
+        }
+        boolean failed = rendezvous.resolveFailure(waiter, reason);
+        if (failed) {
+            log.warn("abandoning the blocked send to {}: {}", target, reason);
+        }
+        return failed;
+    }
+
+    /**
+     * Acknowledge a specific reply by {@code msgId} for {@code target}. Removes it from the inbox
+     * so that a subsequent drain or peek no longer returns it.
+     */
+    public void ackReply(String target, String msgId) {
+        inbox.ack(target, msgId);
+    }
+
+    /**
+     * Drain (peek + ack) all pending inbox replies for {@code target}. At-least-once: returns the
+     * messages and acknowledges them; an in-flight failure between returning and the caller
+     * processing them re-surfaces them on a subsequent drain (the ack is local).
+     *
+     * @return the drained messages, newest last (FIFO); empty list if none
+     */
+    public List<ReplyInbox.InboxMessage> drainReplies(String target) {
+        var messages = inbox.peek(target);
+        for (var msg : messages) {
+            inbox.ack(target, msg.msgId());
+        }
+        return messages;
+    }
+
+    /**
+     * Deliver {@code content} to {@code target} (a herdr {@code terminal_id}) and block until the
+     * worker replies via {@link Rendezvous} or {@code timeoutMillis} elapses.
+     */
+    public Reply send(String target, String content, long timeoutMillis) {
+        return send(target, content, timeoutMillis, null);
+    }
+
+    /**
+     * As {@link #send(String, String, long)}, but with an accepted-delivery hook.
+     *
+     * <p>{@code onAccepted} is invoked exactly once, once this send has won {@code target}'s send
+     * lock and so become the <em>accepted target turn</em> — it runs <em>before</em> delivery is
+     * queued, so a throwing hook fails the send cleanly (the waiter it already opened is closed and
+     * nothing is left queued). It is <em>not</em> invoked when the send is {@link Outcome#BUSY}
+     * (lock never taken). A caller uses this to record that <em>it</em> now owns the delegation's
+     * reply routing (CB-548: {@code PrimaryRegistry} delegator ownership) — recording only on
+     * acceptance means a concurrent sender that times out {@code BUSY} can never steal ownership it
+     * never earned. {@code null} disables the hook.
+     */
+    public Reply send(String target, String content, long timeoutMillis, Runnable onAccepted) {
+        long deadlineNanos = System.nanoTime() + timeoutMillis * 1_000_000L;
+        ReentrantLock lock = sessionLocks.computeIfAbsent(target, _ -> new ReentrantLock());
+
+        if (!tryLock(lock, remainingMillis(deadlineNanos))) {
+            return new Reply(Outcome.BUSY, null); // another send held the session the whole window
+        }
+        try {
+            // Open the waiter BEFORE queueing delivery (CB-548). A fast reply — the worker already
+            // injectable the instant we enqueue — otherwise arrives before the waiter is registered
+            // and orphans into the inbox while this send blocks to the timeout (the enqueue-before-
+            // open race). Opening first also means a throwing onAccepted (fired before enqueue) or an
+            // enqueue failure is safely closed by the finally below: nothing is left queued, and the
+            // failed send leaves no stale waiter behind.
+            CompletableFuture<Rendezvous.Resolution> reply = rendezvous.open(target);
+            try {
+                // The send has won the lock; the accepted-delivery hook records delegator ownership
+                // here (CB-548). It runs BEFORE enqueue so a throwing hook — onAccepted is now a
+                // public callback — fails the send without queuing a message that would orphan.
+                if (onAccepted != null) {
+                    onAccepted.run();
+                }
+                CompletableFuture<Void> delivered = injector.enqueue(target, content);
+                try {
+                    Rendezvous.Resolution r = reply.get(remainingMillis(deadlineNanos), TimeUnit.MILLISECONDS);
+                    return recorded(new Reply(outcomeOf(r.kind()), r.text(), r.turnId()));
+                } catch (TimeoutException e) {
+                    boolean wasDelivered = delivered.isDone() && !delivered.isCompletedExceptionally();
+                    log.debug("send to {} timed out (delivered={})", target, wasDelivered);
+                    return recorded(new Reply(
+                            wasDelivered ? Outcome.TIMED_OUT_WORKING : Outcome.TIMED_OUT_QUEUED, null));
+                } catch (ExecutionException e) {
+                    Throwable cause = e.getCause();
+                    throw cause instanceof RuntimeException re ? re : new IllegalStateException(cause);
+                } catch (InterruptedException e) {
+                    Thread.currentThread().interrupt();
+                    throw new IllegalStateException("interrupted awaiting reply from " + target, e);
+                }
+            } finally {
+                rendezvous.close(target, reply);
+            }
+        } finally {
+            lock.unlock();
+        }
+    }
+
+    /**
+     * A worker's mid-turn question (CB-205 reverse rendezvous): surface {@code question} to the
+     * primary by resolving its open blocking {@code bridge_send}, then block this (worker) call until
+     * the primary answers via {@link #answer} or {@code timeoutMillis} elapses. Identity is the
+     * worker's own session — it does not address the primary.
+     *
+     * <p>Returns {@link AskOutcome#NO_WAITER} when no delegation is open to surface the question to
+     * (nothing to answer it), {@link AskOutcome#ANSWERED} with the primary's answer, or
+     * {@link AskOutcome#TIMED_OUT} if the primary stayed silent. The worker resumes its turn either
+     * way — an answered ask hands back the answer; an unanswered one leaves it to proceed alone.
+     */
+    public AskResult ask(String workerSession, String question, long timeoutMillis) {
+        Rendezvous.AskTicket ticket = rendezvous.openAsk(workerSession);
+        // Only the freshly-opening caller surfaces the question; a coalesced duplicate simply blocks on
+        // the shared answer future that the fresh owner is already responsible for.
+        if (ticket.fresh()) {
+            // Register the reverse waiter first, then surface the question — so the answer, which can
+            // arrive the instant the primary reacts, always finds an open waiter to resolve.
+            if (!rendezvous.resolveQuestion(workerSession, question, ticket.turnId())) {
+                rendezvous.closeAsk(ticket.turnId());
+                return new AskResult(AskOutcome.NO_WAITER, null); // no primary is blocked on this worker
+            }
+        }
+        try {
+            String answer = ticket.answer().get(timeoutMillis, TimeUnit.MILLISECONDS);
+            return new AskResult(AskOutcome.ANSWERED, answer);
+        } catch (TimeoutException e) {
+            log.debug("bridge_ask from {} went unanswered in {}ms", workerSession, timeoutMillis);
+            return new AskResult(AskOutcome.TIMED_OUT, null);
+        } catch (ExecutionException e) {
+            Throwable cause = e.getCause();
+            throw cause instanceof RuntimeException re ? re : new IllegalStateException(cause);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new IllegalStateException("interrupted awaiting the primary's answer for " + workerSession, e);
+        } finally {
+            // Only the fresh owner tears down the shared turn; a duplicate must leave it open.
+            if (ticket.fresh()) {
+                rendezvous.closeAsk(ticket.turnId());
+            }
+        }
+    }
+
+    /**
+     * The primary's answer to a worker's {@code bridge_ask} (CB-205): resolve the worker's blocked
+     * question identified by {@code turnId}, then — like a fresh {@link #send} — block for the worker's
+     * eventual {@code bridge_reply} as it finishes the resumed turn. The worker session is derived from
+     * {@code turnId}, never a caller argument.
+     *
+     * <p>Unlike {@link #send} this does not re-inject through the {@link Injector}: the worker is
+     * mid-turn (already picked up), so the answer flows back through its own open {@code bridge_ask}
+     * call, not a new status-gated delivery. The forward waiter is opened <em>before</em> the worker
+     * is unblocked so a reply that lands the instant it resumes is not lost.
+     */
+    public Reply answer(String turnId, String content, long timeoutMillis) {
+        String workerSession = rendezvous.askSession(turnId);
+        if (workerSession == null) {
+            return new Reply(Outcome.STALE_TURN, null); // the ask lapsed (timed out or already answered)
+        }
+        long deadlineNanos = System.nanoTime() + timeoutMillis * 1_000_000L;
+        ReentrantLock lock = sessionLocks.computeIfAbsent(workerSession, _ -> new ReentrantLock());
+        if (!tryLock(lock, remainingMillis(deadlineNanos))) {
+            return new Reply(Outcome.BUSY, null);
+        }
+        try {
+            CompletableFuture<Rendezvous.Resolution> reply = rendezvous.open(workerSession);
+            if (!rendezvous.answerAsk(turnId, content)) {
+                rendezvous.close(workerSession, reply);
+                return new Reply(Outcome.STALE_TURN, null); // lapsed between the lookup and the unblock
+            }
+            try {
+                Rendezvous.Resolution r = reply.get(remainingMillis(deadlineNanos), TimeUnit.MILLISECONDS);
+                return new Reply(outcomeOf(r.kind()), r.text(), r.turnId());
+            } catch (TimeoutException e) {
+                // The worker resumed but hasn't replied yet — no completion fallback arms an answered
+                // turn (it never re-entered the injector), so a silent worker rides out the window.
+                return new Reply(Outcome.TIMED_OUT_WORKING, null);
+            } catch (ExecutionException e) {
+                Throwable cause = e.getCause();
+                throw cause instanceof RuntimeException re ? re : new IllegalStateException(cause);
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+                throw new IllegalStateException("interrupted awaiting reply from " + workerSession, e);
+            } finally {
+                rendezvous.close(workerSession, reply);
+            }
+        } finally {
+            lock.unlock();
+        }
+    }
+
+    /**
+     * Fire-and-poll variant of {@link #send}: deliver {@code content} to {@code target} on a
+     * background virtual thread and return immediately with a ticket to {@link #poll}. This is how a
+     * long task is delegated without tripping the caller's MCP client call timeout.
+     *
+     * @return the ticket to poll for the eventual result
+     */
+    public String sendAsync(String target, String content) {
+        return sendAsync(target, content, null);
+    }
+
+    /**
+     * As {@link #sendAsync(String, String)}, with the accepted-delivery hook of
+     * {@link #send(String, String, long, Runnable)} — the running {@code send} invokes {@code onAccepted}
+     * the moment it becomes the accepted target turn, so async flooding records delegator ownership
+     * exactly as the blocking path does (CB-548).
+     *
+     * @return the ticket to poll for the eventual result
+     */
+    public String sendAsync(String target, String content, Runnable onAccepted) {
+        String ticket = "task-" + ticketSeq.incrementAndGet();
+        CompletableFuture<Reply> future = CompletableFuture.supplyAsync(
+                () -> send(target, content, ASYNC_TIMEOUT_MS, onAccepted), asyncExecutor);
+        tasks.put(ticket, new Task(target, future, System.nanoTime()));
+        pruneTerminalTickets();
+        log.debug("async send {} -> {}", ticket, target);
+        return ticket;
+    }
+
+    /**
+     * Snapshot the state of an async delegation. Returns {@code null} for an unknown/expired ticket;
+     * otherwise a {@link Phase#PENDING} view (with the live worker status as detail), a
+     * {@link Phase#DONE} view carrying the reply, or a {@link Phase#FAILED} view with the reason.
+     */
+    public TaskView poll(String ticket) {
+        Task task = tasks.get(ticket);
+        if (task == null) {
+            return null;
+        }
+        CompletableFuture<Reply> f = task.future();
+        if (!f.isDone()) {
+            return new TaskView(ticket, Phase.PENDING, null, null, "worker " + liveStatus(task.target()));
+        }
+        Reply r;
+        try {
+            r = f.getNow(null);
+        } catch (CompletionException | java.util.concurrent.CancellationException e) {
+            Throwable cause = (e instanceof CompletionException ce && ce.getCause() != null) ? ce.getCause() : e;
+            return new TaskView(ticket, Phase.FAILED, null, null, cause.getMessage());
+        }
+        if (r.completed()) {
+            String source = r.outcome() == Outcome.REPLIED ? "reply" : "transcript";
+            return new TaskView(ticket, Phase.DONE, r.text(), source, null);
+        }
+        // A wedged worker (CB-109) carries the error context as its reason; the timeout/busy
+        // outcomes carry none, so fall back to the outcome name.
+        String detail = r.outcome() == Outcome.WORKER_FAILED && r.text() != null
+                ? r.text()
+                : "no reply — " + r.outcome().name().toLowerCase();
+        return new TaskView(ticket, Phase.FAILED, null, null, detail);
+    }
+
+    /** Best-effort live worker status for a pending poll; never throws (a lookup error is just noise). */
+    private String liveStatus(String target) {
+        try {
+            return agents.status(target).name().toLowerCase();
+        } catch (RuntimeException e) {
+            return "unknown";
+        }
+    }
+
+    /** Drop finished tickets older than the TTL so the registry cannot grow without bound. */
+    private void pruneTerminalTickets() {
+        long cutoff = System.nanoTime() - TICKET_TTL_NANOS;
+        tasks.values().removeIf(t -> t.future().isDone() && t.createdNanos() < cutoff);
+    }
+
+    /** Release the async executor. */
+    public void close() {
+        asyncExecutor.shutdown();
+    }
+
+    /** Map a rendezvous {@link Rendezvous.Kind} onto its send {@link Outcome} (shared by send/answer). */
+    private static Outcome outcomeOf(Rendezvous.Kind kind) {
+        return switch (kind) {
+            case REPLY -> Outcome.REPLIED;
+            case COMPLETION -> Outcome.COMPLETED_UNREPLIED;
+            case FAILED -> Outcome.WORKER_FAILED;
+            case QUESTION -> Outcome.QUESTION;
+        };
+    }
+
+    private static boolean tryLock(ReentrantLock lock, long millis) {
+        try {
+            return lock.tryLock(Math.max(0, millis), TimeUnit.MILLISECONDS);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new IllegalStateException("interrupted awaiting the session send lock", e);
+        }
+    }
+
+    private static long remainingMillis(long deadlineNanos) {
+        return (deadlineNanos - System.nanoTime()) / 1_000_000L;
+    }
+}
@@ -1,13 +1,13 @@
-package dev.ltms.fleet.msg;
+package dev.ltms.bridged.msg;

 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.atomic.AtomicLong;

 /**
- * The reply rendezvous: where a blocking {@code fleet_send} awaits how the worker's delegated turn
+ * The reply rendezvous: where a blocking {@code bridge_send} awaits how the worker's delegated turn
 * ends. The sending (primary) request thread {@link #open}s a waiter; it is resolved either by the
- * worker's explicit {@code fleet_reply} ({@link #resolve}, arriving on a different thread via
+ * worker's explicit {@code bridge_reply} ({@link #resolve}, arriving on a different thread via
 * {@code POST /sessions/{id}/reply}) or — the CB-106 fallback — by the injector observing the
 * worker's delegated turn return to idle without a reply ({@link #resolveCompletion}).
 *
@@ -27,23 +27,16 @@ public final class Rendezvous {

    /** How a delegated turn ended (or paused). */
    public enum Kind {
-        /** The worker called {@code fleet_reply} with a structured answer. */
+        /** The worker called {@code bridge_reply} with a structured answer. */
        REPLY,
-        /** The worker's turn finished without a {@code fleet_reply}; {@code text} is a scrape. */
+        /** The worker's turn finished without a {@code bridge_reply}; {@code text} is a scrape. */
        COMPLETION,
        /** The worker ran the turn then wedged (CB-109); {@code text} is the failure context. */
        FAILED,
-        /**
-         * The turn finished without a {@code fleet_reply}, and the scrape matched the backend's
-         * configured usage-limit refusal pattern (CB-578 stage A); {@code text} is the reason,
-         * carrying the matched line. The pane is healthy — only the account is refusing — so this
-         * is kept separate from a session simply going {@code GONE}.
-         */
-        BACKEND_EXHAUSTED,
        /**
         * The worker paused mid-turn to ask the primary a question (CB-205 reverse rendezvous);
         * {@code text} is the question and {@code turnId} correlates the primary's answer back to
-         * the worker's blocked {@code fleet_ask}. Not terminal — the turn resumes after the answer.
+         * the worker's blocked {@code bridge_ask}. Not terminal — the turn resumes after the answer.
         */
        QUESTION
    }
@@ -75,7 +68,7 @@ public final class Rendezvous {
    /** Reverse rendezvous (CB-205): worker questions awaiting the primary's answer, keyed by {@code turnId}. */
    private final ConcurrentHashMap<String, AskWaiter> asks = new ConcurrentHashMap<>();
    private final AtomicLong askSeq = new AtomicLong();
-    /** Per-session index of the currently-open ask, so duplicate fleet_ask calls coalesce onto one turn. */
+    /** Per-session index of the currently-open ask, so duplicate bridge_ask calls coalesce onto one turn. */
    private final ConcurrentHashMap<String, String> openAsksBySession = new ConcurrentHashMap<>();

    /**
@@ -132,7 +125,7 @@ public final class Rendezvous {
        return complete(session, new Resolution(Kind.REPLY, content));
    }

-    // --- reverse rendezvous (CB-205 fleet_ask) ------------------------------------------------
+    // --- reverse rendezvous (CB-205 bridge_ask) ------------------------------------------------

    /**
     * Open a reverse-rendezvous waiter for a worker's mid-turn question. If {@code session} already has
@@ -166,7 +159,7 @@ public final class Rendezvous {
    }

    /**
-     * Surface a worker's mid-turn {@code question} by resolving the primary's open {@code fleet_send}
+     * Surface a worker's mid-turn {@code question} by resolving the primary's open {@code bridge_send}
     * with a {@link Kind#QUESTION} carrying {@code turnId}. Same session-keyed semantics as
     * {@link #resolve}: the one outstanding send for {@code session} unblocks with the question.
     *
@@ -184,7 +177,7 @@ public final class Rendezvous {
    }

    /**
-     * Resolve a worker's blocked {@code fleet_ask} with the primary's {@code answer}, unblocking it
+     * Resolve a worker's blocked {@code bridge_ask} with the primary's {@code answer}, unblocking it
     * to resume its turn.
     *
     * @return {@code true} if the ask was still open and got the answer; {@code false} if the
@@ -195,7 +188,7 @@ public final class Rendezvous {
        return w != null && w.answer().complete(answer);
    }

-    /** Drop a reverse-rendezvous turn once its {@code fleet_ask} has resolved (answered or lapsed). */
+    /** Drop a reverse-rendezvous turn once its {@code bridge_ask} has resolved (answered or lapsed). */
    public void closeAsk(String turnId) {
        AskWaiter w = asks.get(turnId);
        if (w == null) {
@@ -209,9 +202,9 @@ public final class Rendezvous {

    /**
     * Resolve a specific captured {@code waiter} as a completion (the delegated turn finished with no
-     * {@code fleet_reply}); {@code text} is the scraped transcript tail. The waiter is the one
+     * {@code bridge_reply}); {@code text} is the scraped transcript tail. The waiter is the one
     * captured when this turn was delivered, so a late completion for turn N cannot land on turn N+1's
-     * send (CB-116). A no-op if that waiter was already resolved — a raced {@code fleet_reply} wins.
+     * send (CB-116). A no-op if that waiter was already resolved — a raced {@code bridge_reply} wins.
     *
     * @return {@code true} if this call resolved the waiter, {@code false} if it was null or already resolved
     */
@@ -231,19 +224,6 @@ public final class Rendezvous {
        return waiter != null && waiter.complete(new Resolution(Kind.FAILED, reason));
    }

-    /**
-     * Resolve a specific captured {@code waiter} as {@link Kind#BACKEND_EXHAUSTED} (CB-578 stage A):
-     * the turn finished with no {@code fleet_reply} and the scrape matched the backend's configured
-     * usage-limit pattern; {@code reason} carries the matched line. Like
-     * {@link #resolveCompletion(CompletableFuture, String)} it targets the exact captured send
-     * (CB-116). A no-op if that waiter was already resolved — first resolution wins.
-     *
-     * @return {@code true} if this call resolved the waiter, {@code false} if it was null or already resolved
-     */
-    public boolean resolveExhausted(CompletableFuture<Resolution> waiter, String reason) {
-        return waiter != null && waiter.complete(new Resolution(Kind.BACKEND_EXHAUSTED, reason));
-    }
-
    private boolean complete(String session, Resolution resolution) {
        CompletableFuture<Resolution> waiter = waiters.get(session);
        return waiter != null && waiter.complete(resolution);
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.msg;
+package dev.ltms.bridged.msg;

 import java.util.List;

@@ -0,0 +1,199 @@
+package dev.ltms.bridged.msg;
+
+import dev.ltms.bridged.herdr.AgentControl;
+import dev.ltms.bridged.herdr.AgentStatus;
+import dev.ltms.bridged.mcp.PrimaryRegistry;
+import dev.ltms.bridged.metrics.BridgedMetrics;
+import dev.ltms.bridged.metrics.Metrics;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+
+/**
+ * Mechanism (b) of CB-307: a dedicated, status-gated push loop that nudges the primary's own
+ * herdr pane when a worker reply lands with no live {@code bridge_send} to resolve it.
+ *
+ * <p>The loop is triggered by {@link #onReplyQueued(String)} (called from
+ * {@link MessageService#reply} after the durable inbox publish). It checks four conditions
+ * at each tick via {@link #decide(String, int)}, then either injects a drain nudge,
+ * waits for the primary to become injectable, or stops reminding.
+ *
+ * <p>Bounded: at most {@link #maxReminders} nudges per target, with a configurable backoff
+ * between them. The reply is never lost — the durable inbox is the backstop.
+ */
+public final class ReplyPushLoop {
+
+    private static final Logger log = LoggerFactory.getLogger(ReplyPushLoop.class);
+    static final String NUDGE_FORMAT = "Worker %s returned a reply — run bridge_poll(target=%s) to collect it";
+
+    private final PrimaryRegistry primaryRegistry;
+    private final AgentControl agents;
+    private final ReplyInbox inbox;
+    private final ScheduledExecutorService scheduler;
+    private final int maxReminders;
+    private final long backoffMs;
+    private final Metrics metrics; // CB-512: nullable — no registry in unit tests
+
+    /** Track targets that have an active schedule. */
+    private final ConcurrentHashMap<String, Boolean> activeTargets = new ConcurrentHashMap<>();
+
+    public ReplyPushLoop(PrimaryRegistry primaryRegistry, AgentControl agents, ReplyInbox inbox,
+                         ScheduledExecutorService scheduler,
+                         int maxReminders, long backoffMs) {
+        this(primaryRegistry, agents, inbox, scheduler, maxReminders, backoffMs, null);
+    }
+
+    /** As above, with a metric registry (CB-512) so push outcomes are counted. */
+    public ReplyPushLoop(PrimaryRegistry primaryRegistry, AgentControl agents, ReplyInbox inbox,
+                         ScheduledExecutorService scheduler,
+                         int maxReminders, long backoffMs, Metrics metrics) {
+        this.primaryRegistry = primaryRegistry;
+        this.agents = agents;
+        this.inbox = inbox;
+        this.scheduler = scheduler;
+        this.maxReminders = maxReminders;
+        this.backoffMs = backoffMs;
+        this.metrics = metrics;
+    }
+
+    /** Count one nudge outcome when a registry is wired; a no-op in unit tests. */
+    private void countNudge(String outcome) {
+        if (metrics != null) {
+            metrics.inc(BridgedMetrics.PUSH_NUDGES, "outcome", outcome);
+        }
+    }
+
+    // --- decision logic (package-private for unit-testing) -------------------------------------
+
+    /** The action the loop should take for a target at the given reminder count. */
+    enum Action { INJECT, WAIT_BUSY, STOP }
+
+    /**
+     * Pure decision function: examine the current state and return what the loop should do.
+     *
+     * @param target        the worker session (target terminal id)
+     * @param reminderCount how many nudges have been sent so far for this target
+     * @return the action the caller should take
+     */
+    Action decide(String target, int reminderCount) {
+        // CB-532: the destination is per-delegation — the lead that sent this worker its work, not
+        // "the primary". With two leads orchestrating one fleet the singular question has no right
+        // answer, and answering it anyway interrupted whichever lead happened to call bridge_send
+        // first with results it never asked for.
+        var nudgeTarget = primaryRegistry.nudgeTargetFor(target);
+        if (nudgeTarget.isEmpty()) {
+            log.debug("push: no lead is known to be waiting on {}, stopping reminder", target);
+            return Action.STOP;
+        }
+        if (inbox.peek(target).isEmpty()) {
+            log.debug("push: inbox empty for {}, stopping reminder", target);
+            return Action.STOP;
+        }
+        if (reminderCount >= maxReminders) {
+            log.debug("push: reminder cap ({}) reached for {}, stopping", maxReminders, target);
+            countNudge("exhausted");
+            return Action.STOP;
+        }
+        String leadTerminal = nudgeTarget.get();
+        AgentStatus status;
+        try {
+            status = agents.status(leadTerminal);
+        } catch (RuntimeException e) {
+            log.debug("push: status check failed for lead {}, will retry", leadTerminal, e);
+            return Action.WAIT_BUSY;
+        }
+        if (status.injectable()) {
+            return Action.INJECT;
+        }
+        log.debug("push: lead {} is {} (not injectable), waiting", leadTerminal, status);
+        return Action.WAIT_BUSY;
+    }
+
+    // --- public entrypoint ---------------------------------------------------------------------
+
+    /**
+     * Called when a reply is queued for {@code target}. Idempotent per target: a second call while
+     * a schedule is active is a no-op. The schedule nudges the primary, then schedules a follow-up
+     * check (reminder on backoff, or re-check on WAIT_BUSY), until the inbox is empty or the cap
+     * is reached.
+     */
+    public void onReplyQueued(String target) {
+        if (activeTargets.putIfAbsent(target, Boolean.TRUE) != null) {
+            log.debug("push: already active for {}, ignoring duplicate trigger", target);
+            return; // already scheduled
+        }
+        log.debug("push: starting reminder loop for {}", target);
+        scheduleNext(target, 0);
+    }
+
+    /** Execute one loop tick — called on the scheduler thread. */
+    private void tick(String target, int reminderCount) {
+        var action = decide(target, reminderCount);
+        switch (action) {
+            case INJECT -> {
+                injectNudge(target, reminderCount);
+                scheduleNext(target, reminderCount + 1);
+            }
+            // Re-check after the configured backoff; the primary may become injectable soon.
+            case WAIT_BUSY -> scheduleNext(target, reminderCount);
+            case STOP -> {
+                activeTargets.remove(target);
+                log.debug("push: reminder loop ended for {}", target);
+            }
+        }
+    }
+
+    /** Send the nudge and log the event. */
+    private void injectNudge(String target, int reminderCount) {
+        // Re-read rather than threading it down from decide(): the delegating lead can change
+        // between the decision and the injection, and the nudge should follow the current one.
+        var lead = primaryRegistry.nudgeTargetFor(target);
+        if (lead.isEmpty()) {
+            log.debug("push: lead for {} disappeared before the nudge could be sent", target);
+            return;
+        }
+        String leadTerminal = lead.get();
+        String nudge = NUDGE_FORMAT.formatted(target, target);
+        try {
+            agents.send(leadTerminal, nudge);
+            log.debug("push: nudge {}/{} sent to lead {} for target {}",
+                    reminderCount + 1, maxReminders, leadTerminal, target);
+            countNudge("delivered");
+        } catch (RuntimeException e) {
+            log.warn("push: failed to nudge lead {} for target {} (reminder {}/{}): {}",
+                    leadTerminal, target, reminderCount + 1, maxReminders, e.toString());
+        }
+    }
+
+    /** Schedule the next tick on the scheduler thread pool. */
+    private void scheduleNext(String target, int nextReminderCount) {
+        scheduler.schedule(() -> tick(target, nextReminderCount), backoffMs, TimeUnit.MILLISECONDS);
+    }
+
+    // --- lifecycle -----------------------------------------------------------------------------
+
+    /**
+     * Whether any reminder loop is currently active for some target (CB-551). The idle-lead heartbeat
+     * uses this to stand aside: while the push loop is actively nudging the lead, a concurrent
+     * heartbeat injection would start a second competing turn in the same pane — racing loops multiply
+     * turns and context burn. "Active" means a schedule exists in {@link #activeTargets}; the set is
+     * bounded by what has been triggered, not by any persistent state.
+     */
+    public boolean isActive() {
+        return !activeTargets.isEmpty();
+    }
+
+    /** Shut down the scheduler. Outstanding reminders are cancelled. */
+    public void stop() {
+        scheduler.shutdownNow();
+        activeTargets.clear();
+    }
+
+    /** @see #stop() */
+    public void close() {
+        stop();
+    }
+}
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.peer;
+package dev.ltms.bridged.peer;

 /**
 * Declared capabilities of a {@link PeerLauncher}. The protocol is the union across all
@@ -9,7 +9,7 @@ package dev.ltms.fleet.peer;
 public enum Capability {

    /**
-     * The peer supports {@code fleet_ask} rendezvous — pausing its delegated turn to ask
+     * The peer supports {@code bridge_ask} rendezvous — pausing its delegated turn to ask
     * the primary a question, then resuming once answered. All Claude Code peers support this.
     */
    MID_TURN_ASK,
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.peer;
+package dev.ltms.bridged.peer;

 import java.util.Locale;

@@ -1,4 +1,4 @@
-package dev.ltms.fleet.peer;
+package dev.ltms.bridged.peer;

 /**
 * An opaque handle returned by {@link PeerLauncher#spawn(SpawnRequest)}. The core routes on
@@ -62,27 +62,9 @@ public interface PeerHandle {
     * non-null for a spawn that requested session identity, because it knows the id before the
     * peer has written anything.
     *
-     * <p>Deliberately not a {@code default} (CB-584, the same fix CB-571 made for
-     * {@link #charterReceipt()} one method below): a decorator that forgets to override this
-     * silently answers {@code null} for a question it has no basis to answer, and the gap surfaces
-     * only as a resume that quietly starts a cold session, not a compile error. Every
-     * implementation must answer explicitly.
-     *
     * @return the peer's own session id, or {@code null} when not determinable
     */
-    String agentSessionId();
-
-    /**
-     * The charter receipt (CB-571) for this peer's launch — the fingerprint of the exact charter
-     * bytes it was started with. {@code null} when the launcher records none (a non-instrumented
-     * adapter, or a launcher before this field); the session registry stores it so the spawn result
-     * and the roster row can show an operator which charter a member actually got.
-     *
-     * <p>Deliberately not a {@code default}: a decorator that forgets to override this silently
-     * answers {@code null} for a question it has no basis to answer, and the gap surfaces only as
-     * a missing roster field, not a compile error. Every implementation must answer explicitly.
-     *
-     * @return the fingerprint, or {@code null} when the launcher carries none
-     */
-    CharterReceipt charterReceipt();
+    default String agentSessionId() {
+        return null;
+    }
 }
@@ -0,0 +1,94 @@
+package dev.ltms.bridged.peer;
+
+import java.util.List;
+import java.util.Set;
+
+/**
+ * SPI for materializing a connected peer — the only way the bridge core creates or tears down
+ * a peer process. Every launcher is a first-party, in-tree adapter selected by (future) profile
+ * config; today's single adapter is the {@code ClaudeCodeLauncher} / Claude Code over herdr.
+ *
+ * <p>The core delegates spawn and teardown to this interface without knowing how the peer is set
+ * up. Environment variables, CLI flags, subscription guards, transport (herdr tab/pane) layout,
+ * and naming conventions are all adapter-private — the core sees only the returned
+ * {@link PeerHandle} whose {@code id()} is the registry/routing key.
+ *
+ * <p>The interface is a superset of what {@code SessionManager} and {@code Bridged.main} call
+ * on the concrete launcher today.
+ */
+public interface PeerLauncher {
+
+    /**
+     * The set of {@link Capability capabilities} this launcher declares. A peer whose profile
+     * opts into a git-forge token should include {@link Capability#SELF_PR}; the base set for
+     * the Claude Code herdr adapter is always {@code MID_TURN_ASK, WORKTREE, ORPHAN_REAP}.
+     */
+    Set<Capability> capabilities();
+
+    /**
+     * {@code profileName}/requestedCwd null/blank → default resolution. Returns after the peer
+     * process is live (env + argv + placement complete). Never returns {@code null}.
+     *
+     * @param req the spawn parameters (profile, requested cwd, caller cwd)
+     * @return a handle whose {@link PeerHandle#id()} is the registry/routing key
+     * @throws IllegalArgumentException if the profile is unknown and no default is configured
+     */
+    PeerHandle spawn(SpawnRequest req);
+
+    /**
+     * The configured worker profile names — the set of names {@code spawn(profileName)} accepts.
+     */
+    Set<String> profiles();
+
+    /**
+     * The profile a no-argument {@link #spawn(SpawnRequest)} uses, or {@code null} if none is configured.
+     */
+    String defaultProfile();
+
+    /**
+     * Resolve the effective working directory for a spawn {@code req} without actually spawning.
+     * Resolution order: requestedCwd → profile cwd → callerCwd → daemon cwd.
+     *
+     * @return the resolved absolute path, never null/blank
+     */
+    String effectiveCwd(SpawnRequest req);
+
+    /**
+     * The parity-overlay file list for {@code profileName} (default list when unset). Used by
+     * worktree provisioning to copy config files into the isolated checkout before spawning.
+     */
+    List<String> parityOverlay(String profileName);
+
+    /**
+     * The set of all agents this launcher currently tracks, transport-specific. Each element
+     * exposes at minimum a pane-like {@code id()} matching this launcher's {@link PeerHandle}
+     * scheme, plus transport-level status. Callers merge this set with the session registry to
+     * build a live roster view.
+     */
+    List<?> list();
+
+    /**
+     * Reap orphaned peers left behind by a prior daemon process. Only peers whose naming scheme
+     * matches this launcher's and whose nonce differs from the current process are eligible.
+     * Best-effort: a failure to list or to stop any one peer is logged and never aborts startup.
+     *
+     * @return the number of orphaned peers reaped
+     */
+    int reapOrphanWorkers();
+
+    /**
+     * Tear a peer down by its registry/routing key ({@link PeerHandle#id()}). Tolerates an
+     * already-gone peer. Also cleans up launcher-private resources (e.g. empty dedicated tabs)
+     * when safe to do so.
+     */
+    void stop(String id);
+
+    /**
+     * Discard the context of the peer identified by {@code id}. Implementations must bypass normal
+     * bridge delivery/turn accounting. Unsupported peer kinds return {@code false} without sending
+     * a guessed command.
+     *
+     * @return {@code true} when a reset was sent and its status transition must settle before reuse
+     */
+    boolean clearContext(String id);
+}
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.peer;
+package dev.ltms.bridged.peer;

 /**
 * Thrown when a {@link PeerLauncher} starts a peer process but the peer
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.peer;
+package dev.ltms.bridged.peer;

 /**
 * What a caller asks for when spawning a peer.
@@ -0,0 +1,22 @@
+package dev.ltms.bridged.placement;
+
+/**
+ * Backward-compatible placement: an unqualified spawn always resolves to the configured default
+ * profile, exactly as {@code CompositePeerLauncher} did before CB-518. This ignores caps and
+ * reachability so that a pre-existing config behaves identically after upgrade.
+ */
+final class FixedPlacementPolicy implements PlacementPolicy {
+
+    @Override
+    public PlacementCandidate select(PlacementContext ctx) {
+        String d = ctx.defaultProfile();
+        if (d != null && !d.isBlank()) {
+            return new PlacementCandidate(d, null, 1.0f, null);
+        }
+        if (!ctx.candidates().isEmpty()) {
+            PlacementCandidate first = ctx.candidates().getFirst();
+            return new PlacementCandidate(first.profile(), null, first.weight(), first.maxLoad());
+        }
+        throw new PlacementException("no worker profiles configured");
+    }
+}
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.placement;
+package dev.ltms.bridged.placement;

 /**
 * A profile (and, in CB-308, a host) that can be chosen by a {@link PlacementPolicy}.
@@ -17,18 +17,4 @@ public record PlacementCandidate(String profile, String host, float weight, Inte
    public static PlacementCandidate profile(String profile) {
        return new PlacementCandidate(profile, null, 1.0f, null);
    }
-
-    /**
-     * True when this candidate carries an explicit {@code weight <= 0} (CB-554) and must be
-     * skipped by every automatic policy — the same way a quarantined or unreachable candidate is
-     * skipped. {@code FleetConfig.Profile}'s compact constructor already normalises "absent" to
-     * {@code 1.0} and "negative" to {@code 0.0}, so this is a plain threshold check here; it does
-     * not need to distinguish "explicit 0" from "absent" itself.
-     *
-     * <p>Exclusion is about <em>automatic</em> selection only — an explicit
-     * {@code fleet_spawn{profile:"..."}} bypasses placement entirely and is unaffected.
-     */
-    public boolean excluded() {
-        return weight <= 0.0f;
-    }
 }
@@ -0,0 +1,19 @@
+package dev.ltms.bridged.placement;
+
+import java.util.List;
+import java.util.Set;
+import java.util.function.Function;
+
+/**
+ * Everything a {@link PlacementPolicy} needs to make one selection.
+ *
+ * @param defaultProfile profile a {@code fixed} policy should return (may be {@code null})
+ * @param candidates     every configured candidate; the policy filters out those at cap or unreachable
+ * @param liveCount      current live worker count per profile (from the session registry)
+ * @param unreachable    profiles already known to have failed in this spawn attempt
+ */
+public record PlacementContext(String defaultProfile,
+                               List<PlacementCandidate> candidates,
+                               Function<String, Integer> liveCount,
+                               Set<String> unreachable) {
+}
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.placement;
+package dev.ltms.bridged.placement;

 /**
 * Thrown when a {@link PlacementPolicy} has no candidate available. Kept as a distinct type so
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.placement;
+package dev.ltms.bridged.placement;

 /**
 * Factory for the built-in placement policies.
@@ -1,7 +1,7 @@
-package dev.ltms.fleet.placement;
+package dev.ltms.bridged.placement;

 /**
- * How {@code fleetd} chooses a worker profile when a spawn names none. Implementations are
+ * How {@code bridged} chooses a worker profile when a spawn names none. Implementations are
 * deterministic and unit-testable; the caller (the composite launcher) handles failover retries.
 */
 public interface PlacementPolicy {
@@ -0,0 +1,65 @@
+package dev.ltms.bridged.placement;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * Shared filtering and empty-set reporting used by the built-in placement policies.
+ */
+final class PlacementPolicyUtil {
+
+    private PlacementPolicyUtil() {
+    }
+
+    /**
+     * Candidates that are not known-unreachable and have not reached their maxLoad.
+     * A {@code null} maxLoad means unlimited.
+     */
+    static List<PlacementCandidate> available(PlacementContext ctx) {
+        List<PlacementCandidate> out = new ArrayList<>();
+        for (PlacementCandidate c : ctx.candidates()) {
+            if (ctx.unreachable().contains(c.profile())) {
+                continue;
+            }
+            Integer cap = c.maxLoad();
+            if (cap != null) {
+                int live = ctx.liveCount().apply(c.profile());
+                if (live >= cap) {
+                    continue;
+                }
+            }
+            out.add(c);
+        }
+        return out;
+    }
+
+    /**
+     * Build a clear exception describing why every candidate was dropped: all at capacity,
+     * all unreachable, or a mix.
+     */
+    static PlacementException emptyException(PlacementContext ctx) {
+        int atCap = 0;
+        int unreachable = 0;
+        for (PlacementCandidate c : ctx.candidates()) {
+            Integer cap = c.maxLoad();
+            if (ctx.unreachable().contains(c.profile())) {
+                unreachable++;
+            } else if (cap != null && ctx.liveCount().apply(c.profile()) >= cap) {
+                atCap++;
+            }
+        }
+
+        int total = ctx.candidates().size();
+        if (total == 0) {
+            return new PlacementException("no worker profiles configured");
+        }
+        if (atCap == total) {
+            return new PlacementException("all worker profiles are at maxLoad");
+        }
+        if (unreachable == total) {
+            return new PlacementException("all worker profiles are unreachable");
+        }
+        return new PlacementException("no worker profile available: " + atCap + " at maxLoad, "
+                + unreachable + " unreachable, " + (total - atCap - unreachable) + " remaining");
+    }
+}
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.placement;
+package dev.ltms.bridged.placement;

 import java.util.List;
 import java.util.concurrent.atomic.AtomicInteger;
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.placement;
+package dev.ltms.bridged.placement;

 import java.util.List;
 import java.util.Map;
@@ -0,0 +1,574 @@
+package dev.ltms.bridged.rest;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import dev.ltms.bridged.auth.AuditLog;
+import dev.ltms.bridged.auth.Authz;
+import dev.ltms.bridged.auth.CallerResolver;
+import dev.ltms.bridged.auth.Principal;
+import dev.ltms.bridged.guard.GuardException;
+import dev.ltms.bridged.metrics.Metrics;
+import dev.ltms.bridged.herdr.Agent;
+import dev.ltms.bridged.herdr.HerdrClient;
+import dev.ltms.bridged.herdr.HerdrException;
+import dev.ltms.bridged.inject.MemberPresence;
+import dev.ltms.bridged.peer.PeerUnreachableException;
+import dev.ltms.bridged.msg.MessageService;
+import dev.ltms.bridged.session.SessionManager;
+import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.bridged.session.WorktreeRequest;
+import dev.ltms.bridged.peer.PeerLauncher;
+import io.javalin.Javalin;
+import io.javalin.http.Context;
+import jakarta.servlet.http.HttpServlet;
+import org.eclipse.jetty.servlet.ServletHolder;
+
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+/**
+ * The REST surface — {@code bridged}'s contract and its testability seam. Every
+ * feature is reachable here without Claude or MCP in the loop, so each is an
+ * acceptance test against plain HTTP. MCP tools (later) are thin adapters over these
+ * same endpoints and are validated by parity, not by re-implementing behaviour.
+ *
+ * <p>Built from injected collaborators so tests supply fakes and run on an ephemeral
+ * port; {@code main} supplies the real Unix-socket client and worker service.
+ */
+public final class BridgedApp {
+
+    /** Default blocking window for a message; kept under typical HTTP idle timeouts. */
+    private static final long DEFAULT_MESSAGE_TIMEOUT_MS = 25_000;
+    private static final long MAX_MESSAGE_TIMEOUT_MS = 120_000;
+    /** Blocking window for a worker's bridge_ask (CB-205); the worker's MCP client caps its own call. */
+    private static final long DEFAULT_ASK_TIMEOUT_MS = 55_000;
+    private static final long MAX_ASK_TIMEOUT_MS = 115_000;
+
+    /** Context attribute under which the resolved caller is stashed by the auth filter. */
+    private static final String CALLER = "bridged.caller";
+
+    private final HerdrClient herdr;
+    private final PeerLauncher workers;
+    private final SessionManager sessions; // CB-301: authoritative session registry
+    private final MessageService messages;
+    private final MemberPresence presence; // CB-113: which workers are MCP-connected (available)
+    private final HttpServlet mcpServlet; // MCP Streamable-HTTP endpoint, mounted at /mcp (nullable)
+    private final CallerResolver auth;    // CB-501: null → authz not enforced (legacy behaviour)
+    private final Metrics metrics;        // CB-502: null → /metrics not exposed
+    private final ObjectMapper mapper = new ObjectMapper();
+
+    /**
+     * Legacy constructor — no identity resolution and no authorization, exactly as the REST surface
+     * behaved before CB-501. Retained so existing acceptance tests keep exercising handler
+     * behaviour without each needing an auth fixture.
+     */
+    public BridgedApp(HerdrClient herdr, PeerLauncher workers, SessionManager sessions,
+                      MessageService messages, MemberPresence presence,
+                      HttpServlet mcpServlet) {
+        this(herdr, workers, sessions, messages, presence, mcpServlet, null, null);
+    }
+
+    /**
+     * @param auth    resolves each request's {@link Principal}; {@code null} disables authorization
+     *                entirely (legacy). {@code main} always supplies one.
+     * @param metrics registry to instrument and expose at {@code GET /metrics}; {@code null} omits
+     *                the endpoint
+     */
+    public BridgedApp(HerdrClient herdr, PeerLauncher workers, SessionManager sessions,
+                      MessageService messages, MemberPresence presence,
+                      HttpServlet mcpServlet, CallerResolver auth, Metrics metrics) {
+        this.herdr = herdr;
+        this.workers = workers;
+        this.sessions = sessions;
+        this.messages = messages;
+        this.presence = presence;
+        this.mcpServlet = mcpServlet;
+        this.auth = auth;
+        this.metrics = metrics;
+    }
+
+    /** Wire routes onto a fresh, unstarted Javalin instance. Caller starts it. */
+    public Javalin build() {
+        Javalin app = Javalin.create(cfg -> {
+            cfg.showJavalinBanner = false;
+            if (mcpServlet != null) {
+                // The MCP server shares the daemon's port; Jetty routes /mcp to its servlet.
+                cfg.jetty.modifyServletContextHandler(h ->
+                        h.addServlet(new ServletHolder(mcpServlet), "/mcp"));
+            }
+        });
+        // CB-501: resolve identity once per request, before any handler. /mcp does NOT pass through
+        // here — it is a raw servlet on Jetty's context handler — so BridgeMcp enforces separately
+        // against the same CallerResolver. Any check that lives in only one place is not a control.
+        if (auth != null) {
+            app.before(ctx -> ctx.attribute(CALLER,
+                    auth.resolve(ctx.req().getRemoteAddr(), ctx.req().getRemotePort(),
+                            ctx.header("Authorization"))));
+        }
+        app.get("/healthz", this::healthz);
+        if (metrics != null) {
+            app.get("/metrics", this::metrics);
+        }
+        app.get("/sessions", this::sessions);
+        app.get("/agents", this::agents);
+        app.get("/members", this::listMembers);                  // CB-304: registry roster + live herdr status
+        app.get("/profiles", this::profiles);                    // configured backend profiles
+        app.post("/members", this::spawnMember);                 // optional ?role=&profile= or {"role":…,"profile":…}
+        app.delete("/members/{paneId}", this::stopMember);
+        app.post("/sessions/{id}/message", this::sendMessage);   // bridge_send (primary; blocking, wait:false, or answer via turnId)
+        app.post("/sessions/{id}/reply", this::replyMessage);    // bridge_reply (worker)
+        app.get("/sessions/{id}/replies", this::drainReplies);   // drain reply inbox (CB-307)
+        app.post("/sessions/{id}/ask", this::askMessage);        // bridge_ask (worker → primary, CB-205)
+        app.get("/sessions/{id}/status", this::sessionStatus);   // bridge_status
+        app.get("/tasks/{ticket}", this::taskStatus);            // poll an async (wait:false) send
+        return app;
+    }
+
+    /**
+     * Gate a handler on the CB-505 authorization table. Returns {@code true} when the request may
+     * proceed; otherwise writes the error response and returns {@code false}.
+     *
+     * <p>401 vs 403 is a real distinction here: 401 means "you presented no usable identity" (a
+     * credential problem the caller can fix), 403 means "you are authenticated, but this is not
+     * yours" (a worker reaching for another worker's session, or for orchestration).
+     */
+    private boolean allow(Context ctx, Authz.Action action, String target) {
+        if (auth == null) {
+            return true; // legacy: authorization not enforced
+        }
+        Principal caller = ctx.attribute(CALLER);
+        if (Authz.permits(caller, action, target)) {
+            if (action != Authz.Action.READ && action != Authz.Action.METRICS) {
+                AuditLog.allowed(caller, action, target); // reads would drown the trail
+            }
+            return true;
+        }
+        if (Authz.isUnauthenticated(caller)) {
+            AuditLog.denied(caller, action, target, "unauthenticated");
+            countAuthFailure("unauthenticated");
+            ctx.status(401).json(Map.of("error", "unauthenticated",
+                    "detail", "present Authorization: Bearer <token>"));
+        } else {
+            AuditLog.denied(caller, action, target, "forbidden");
+            countAuthFailure("forbidden");
+            ctx.status(403).json(Map.of("error", "forbidden",
+                    "detail", caller.describe() + " may not " + action + " on "
+                            + (target == null ? "this resource" : target)));
+        }
+        return false;
+    }
+
+    private void countAuthFailure(String reason) {
+        if (metrics != null) {
+            metrics.inc("bridged_auth_failures_total", "reason", reason);
+        }
+    }
+
+    /** Prometheus scrape endpoint (CB-502). */
+    private void metrics(Context ctx) {
+        if (!allow(ctx, Authz.Action.METRICS, null)) {
+            return;
+        }
+        ctx.status(200).contentType("text/plain; version=0.0.4; charset=utf-8").result(metrics.render());
+    }
+
+    /** Liveness + herdr reachability. 200 when herdr answers ping, 503 otherwise. */
+    private void healthz(Context ctx) {
+        try {
+            JsonNode pong = herdr.call("ping");
+            ctx.status(200).json(Map.of(
+                    "status", "ok",
+                    "herdr", Map.of(
+                            "version", pong.path("version").asText(""),
+                            "protocol", pong.path("protocol").asInt())));
+        } catch (HerdrException e) {
+            ctx.status(503).json(Map.of(
+                    "status", "degraded",
+                    "herdr", "unreachable",
+                    "detail", e.getMessage()));
+        }
+    }
+
+    /** Sessions view derived from herdr {@code workspace.list} (one workspace → one row). */
+    private void sessions(Context ctx) {
+        if (!allow(ctx, Authz.Action.READ, null)) {
+            return;
+        }
+        JsonNode result = herdr.call("workspace.list");
+        List<Map<String, Object>> out = new ArrayList<>();
+        for (JsonNode w : result.path("workspaces")) {
+            out.add(Map.of(
+                    "id", w.path("workspace_id").asText(""),
+                    "label", w.path("label").asText(""),
+                    "focused", w.path("focused").asBoolean(false),
+                    "paneCount", w.path("pane_count").asInt(),
+                    "agentStatus", w.path("agent_status").asText("unknown")));
+        }
+        ctx.status(200).json(Map.of("sessions", out));
+    }
+
+    /** Discovery: every agent herdr tracks, keyed by its Claude session UUID. */
+    private void agents(Context ctx) {
+        if (!allow(ctx, Authz.Action.READ, null)) {
+            return;
+        }
+        ctx.status(200).json(Map.of("agents",
+                workers.list().stream().map(Agent.class::cast).map(BridgedApp::view).toList()));
+    }
+
+    /** CB-304: bridge-owned roster merged with live herdr status by paneId. */
+    private void listMembers(Context ctx) {
+        if (!allow(ctx, Authz.Action.READ, null)) {
+            return;
+        }
+        // CB-519: the registry key is a host-unique id, not the pane coordinate — join on terminal.
+        Map<String, Agent> live = workers.list().stream()
+                .map(Agent.class::cast)
+                .filter(a -> a.terminalId() != null)
+                .collect(Collectors.toMap(Agent::terminalId, Function.identity(), (_, b) -> b));
+        List<Map<String, Object>> out = sessions.roster().stream()
+                .map(s -> SessionManager.rosterView(s, live.get(s.terminalId())))
+                .toList();
+        ctx.status(200).json(Map.of("workers", out));
+    }
+
+    /** The configured worker profiles and which one a no-argument spawn uses. */
+    private void profiles(Context ctx) {
+        if (!allow(ctx, Authz.Action.READ, null)) {
+            return;
+        }
+        ctx.status(200).json(Map.of(
+                "profiles", workers.profiles(),
+                "default", workers.defaultProfile() == null ? "" : workers.defaultProfile()));
+    }
+
+    /**
+     * Spawn a guard-checked worker. An optional {@code profile} (query param or {@code {"profile":…}}
+     * body) picks which configured profile; omitted → the default. 403 if the base_url would breach
+     * the subscription boundary, 400 for an unknown profile.
+     */
+    private void spawnMember(Context ctx) {
+        if (!allow(ctx, Authz.Action.SPAWN, null)) {
+            return;
+        }
+        String role = ctx.queryParam("role");
+        String profile = ctx.queryParam("profile");
+        String cwd = ctx.queryParam("cwd");
+        String worktree = ctx.queryParam("worktree");
+        String ticket = ctx.queryParam("ticket");
+        if (profile == null || profile.isBlank() || cwd == null || cwd.isBlank()
+                || worktree == null || worktree.isBlank()) {
+            try {
+                String body = ctx.body();
+                if (!body.isBlank()) {
+                    JsonNode b = mapper.readTree(body);
+                    if (role == null || role.isBlank()) role = b.path("role").asText(null);
+                    if (profile == null || profile.isBlank()) profile = b.path("profile").asText(null);
+                    if (cwd == null || cwd.isBlank()) cwd = b.path("cwd").asText(null);
+                    if (worktree == null || worktree.isBlank()) worktree = b.path("worktree").asText(null);
+                    if (ticket == null || ticket.isBlank()) ticket = b.path("ticket").asText(null);
+                }
+            } catch (Exception ignored) {
+                // A malformed/empty body just means "no overrides" → fall through to defaults.
+            }
+        }
+        WorktreeRequest wt = worktreeRequest(worktree, ticket);
+        MemberRole memberRole;
+        try {
+            memberRole = (role == null || role.isBlank()) ? MemberRole.DEV : MemberRole.parse(role);
+        } catch (IllegalArgumentException e) {
+            ctx.status(400).json(Map.of("error", "unknown_role", "detail", e.getMessage()));
+            return;
+        }
+        try {
+            // No MCP caller over REST, so callerCwd and ownerTerminal are null.
+            MemberSession member = sessions.acquire(blankToNull(profile), memberRole,
+                    blankToNull(cwd), null, null, wt);
+            ctx.status(201).json(view(member));
+        } catch (GuardException e) {
+            ctx.status(403).json(Map.of("error", "subscription_boundary", "detail", e.getMessage()));
+        } catch (IllegalArgumentException e) {
+            ctx.status(400).json(Map.of("error", "unknown_profile", "detail", e.getMessage()));
+        } catch (PeerUnreachableException e) {
+            ctx.status(502).json(Map.of("error", "spawn_timeout", "detail", e.getMessage()));
+        }
+    }
+
+    private static WorktreeRequest worktreeRequest(String worktree, String ticket) {
+        if (worktree == null || worktree.isBlank() || "false".equalsIgnoreCase(worktree)) {
+            return null;
+        }
+        if ("true".equalsIgnoreCase(worktree)) {
+            if (ticket == null || ticket.isBlank()) {
+                throw new IllegalArgumentException("worktree=true requires a ticket slug");
+            }
+            return new WorktreeRequest(ticket, null);
+        }
+        return new WorktreeRequest(worktree, null);
+    }
+
+    private static String blankToNull(String s) {
+        return (s == null || s.isBlank()) ? null : s;
+    }
+
+    /** Tear a worker down by pane id. */
+    private void stopMember(Context ctx) {
+        String paneId = ctx.pathParam("paneId");
+        if (!allow(ctx, Authz.Action.STOP, paneId)) {
+            return;
+        }
+        sessions.release(paneId);
+        ctx.status(204);
+    }
+
+    /**
+     * The blocking delegation call (CB-104): inject {@code content} into the worker via the
+     * status-gated injector and block until the worker returns a structured {@code bridge_reply}.
+     * Times out with a typed 202 (working / queued / busy) rather than an error — the message may
+     * still land.
+     */
+    private void sendMessage(Context ctx) {
+        String id = ctx.pathParam("id");
+        if (!allow(ctx, Authz.Action.SEND, id)) {
+            return;
+        }
+        String content;
+        String turnId;
+        long timeout;
+        boolean wait;
+        try {
+            JsonNode body = mapper.readTree(ctx.body());
+            content = body.path("content").asText("");
+            turnId = body.path("turnId").asText(null);
+            timeout = body.path("timeoutMs").asLong(DEFAULT_MESSAGE_TIMEOUT_MS);
+            wait = body.path("wait").asBoolean(true); // default: block for the reply (CB-104)
+        } catch (Exception e) {
+            ctx.status(400).json(Map.of("error", "bad_request", "detail", "body must be JSON"));
+            return;
+        }
+        if (content.isBlank()) {
+            ctx.status(400).json(Map.of("error", "bad_request", "detail", "content is required"));
+            return;
+        }
+        timeout = Math.clamp(timeout, 1, MAX_MESSAGE_TIMEOUT_MS);
+
+        // Answering a worker's bridge_ask (CB-205): always blocks, and derives the worker from turnId.
+        if (turnId != null && !turnId.isBlank()) {
+            writeReply(ctx, id, messages.answer(turnId, content, timeout), timeout);
+            return;
+        }
+
+        if (!wait) {
+            // Fire-and-poll (CB-107): return a ticket immediately; the caller polls GET /tasks/{ticket}.
+            String ticket = messages.sendAsync(id, content);
+            ctx.status(202).json(Map.of("sessionId", id, "ticket", ticket, "status", "accepted"));
+            return;
+        }
+
+        try {
+            writeReply(ctx, id, messages.send(id, content, timeout), timeout);
+        } catch (HerdrException e) {
+            herdrError(ctx, e);
+        }
+    }
+
+    /**
+     * Render a {@link MessageService.Reply} onto the response — shared by a normal send and a
+     * bridge_ask answer. A structured/scraped completion is 200; a worker's mid-turn question a 202
+     * (with its {@code turnId}); a stale answer a 409; every other non-terminal outcome a typed 202.
+     */
+    private void writeReply(Context ctx, String id, MessageService.Reply reply, long timeout) {
+        switch (reply.outcome()) {
+            case QUESTION -> ctx.status(202).json(Map.of(
+                    "sessionId", id, "status", "question",
+                    "question", reply.text(), "turnId", reply.turnId()));
+            case STALE_TURN -> ctx.status(409).json(Map.of(
+                    "sessionId", id, "error", "stale_turn",
+                    "detail", "that question is no longer open (timed out or already answered)"));
+            case REPLIED, COMPLETED_UNREPLIED -> {
+                // replySource distinguishes a structured bridge_reply from the CB-106 completion
+                // fallback (a scrape of the worker's transcript when it finished without replying).
+                String source = reply.outcome() == MessageService.Outcome.REPLIED ? "reply" : "transcript";
+                ctx.status(200).json(Map.of("sessionId", id, "reply", reply.text(), "replySource", source));
+            }
+            default -> ctx.status(202).json(Map.of(
+                    "sessionId", id,
+                    "status", switch (reply.outcome()) {
+                        case TIMED_OUT_WORKING -> "working";
+                        case TIMED_OUT_QUEUED -> "queued";
+                        case BUSY -> "busy";
+                        case WORKER_FAILED -> "failed";
+                        default -> "done"; // unreachable (terminal outcomes handled above)
+                    },
+                    "detail", reply.outcome() == MessageService.Outcome.WORKER_FAILED && reply.text() != null
+                            ? reply.text()
+                            : "no reply within " + timeout + "ms; poll status or retry"));
+        }
+    }
+
+    /**
+     * A worker's mid-turn question ({@code bridge_ask}, CB-205) — surfaces to the primary's open
+     * blocking send and blocks until it answers. 200 with the answer, 409 if no delegation is open,
+     * 202 if the primary stayed silent.
+     */
+    private void askMessage(Context ctx) {
+        String id = ctx.pathParam("id");
+        if (!allow(ctx, Authz.Action.ASK, id)) {
+            return;
+        }
+        String question;
+        long timeout;
+        try {
+            JsonNode body = mapper.readTree(ctx.body());
+            question = body.path("question").asText("");
+            timeout = body.path("timeoutMs").asLong(DEFAULT_ASK_TIMEOUT_MS);
+        } catch (Exception e) {
+            ctx.status(400).json(Map.of("error", "bad_request", "detail", "body must be JSON"));
+            return;
+        }
+        if (question.isBlank()) {
+            ctx.status(400).json(Map.of("error", "bad_request", "detail", "question is required"));
+            return;
+        }
+        timeout = Math.clamp(timeout, 1, MAX_ASK_TIMEOUT_MS);
+        MessageService.AskResult r = messages.ask(id, question, timeout);
+        switch (r.outcome()) {
+            case ANSWERED -> ctx.status(200).json(Map.of("sessionId", id, "answered", true, "answer", r.answer()));
+            case NO_WAITER -> ctx.status(409).json(Map.of(
+                    "sessionId", id, "error", "no_pending_send",
+                    "detail", "no primary is awaiting this turn to answer a question"));
+            case TIMED_OUT -> ctx.status(202).json(Map.of(
+                    "sessionId", id, "status", "no_answer",
+                    "detail", "the primary did not answer within " + timeout + "ms"));
+        }
+    }
+
+    /**
+     * The worker's structured reply ({@code bridge_reply}) — resolves the blocking send awaiting
+     * on this session, or queues the reply in the inbox when no send is open (CB-307).
+     */
+    private void replyMessage(Context ctx) {
+        String id = ctx.pathParam("id");
+        // The rule that matters: a worker may reply only as itself. Over MCP this was already true
+        // structurally (identity comes from the connection, never an argument); over REST the path
+        // id was simply trusted, so this is where the invariant actually gets enforced.
+        if (!allow(ctx, Authz.Action.REPLY, id)) {
+            return;
+        }
+        String content;
+        try {
+            content = mapper.readTree(ctx.body()).path("content").asText("");
+        } catch (Exception e) {
+            ctx.status(400).json(Map.of("error", "bad_request", "detail", "body must be JSON"));
+            return;
+        }
+        messages.reply(id, content);
+        ctx.status(200).json(Map.of("sessionId", id, "delivered", true));
+    }
+
+    /**
+     * Drain the reply inbox for a worker session — peek + ack any replies that arrived when no send
+     * was open. At-least-once: draining removes them from the inbox so a subsequent read returns
+     * nothing; an in-flight failure between the drain and the caller's processing re-surfaces them.
+     */
+    private void drainReplies(Context ctx) {
+        String id = ctx.pathParam("id");
+        if (!allow(ctx, Authz.Action.DRAIN, id)) {
+            return;
+        }
+        var replies = messages.drainReplies(id);
+        ctx.status(200).json(Map.of("sessionId", id, "replies",
+                replies.stream().map(m -> Map.of(
+                        "msgId", m.msgId(),
+                        "content", m.content())).toList()));
+    }
+
+    /**
+     * Live lifecycle status of a worker (MCP `bridge_status` wraps this in CB-105), plus its
+     * <em>readiness</em> (CB-113): {@code ready} is true once the worker's Claude has connected the
+     * bridge MCP — the reliable "available to receive a task" signal, unlike bare {@code idle}, which
+     * is also true during boot.
+     */
+    private void sessionStatus(Context ctx) {
+        String id = ctx.pathParam("id");
+        if (!allow(ctx, Authz.Action.READ, id)) {
+            return;
+        }
+        try {
+            ctx.status(200).json(Map.of(
+                    "sessionId", id,
+                    "status", messages.status(id).name().toLowerCase(),
+                    "ready", presence.isPresent(id)));
+        } catch (HerdrException e) {
+            herdrError(ctx, e);
+        }
+    }
+
+    /** Poll an async (wait:false) delegation by ticket. 404 for an unknown/expired ticket. */
+    private void taskStatus(Context ctx) {
+        if (!allow(ctx, Authz.Action.READ, null)) {
+            return;
+        }
+        MessageService.TaskView v = messages.poll(ctx.pathParam("ticket"));
+        if (v == null) {
+            ctx.status(404).json(Map.of("error", "unknown_ticket", "detail", "no such task (or it has expired)"));
+            return;
+        }
+        Map<String, Object> body = new LinkedHashMap<>();
+        body.put("ticket", v.ticket());
+        body.put("phase", v.phase().name().toLowerCase());
+        if (v.reply() != null) {
+            body.put("reply", v.reply());
+            body.put("replySource", v.replySource());
+        }
+        if (v.detail() != null) {
+            body.put("detail", v.detail());
+        }
+        ctx.status(200).json(body);
+    }
+
+    /** Map a herdr failure: unknown target → 404, anything else → 502 (herdr is upstream). */
+    private static void herdrError(Context ctx, HerdrException e) {
+        if (e.code() != null && e.code().endsWith("_not_found")) {
+            ctx.status(404).json(Map.of("error", "session_not_found", "detail", e.getMessage()));
+        } else {
+            ctx.status(502).json(Map.of("error", "herdr_error", "detail", e.getMessage()));
+        }
+    }
+
+    /** Stable JSON projection of an agent (null-safe for the start-time shape). */
+    private static Map<String, Object> view(Agent a) {
+        Map<String, Object> m = new LinkedHashMap<>();
+        m.put("terminalId", a.terminalId());
+        m.put("paneId", a.paneId());
+        m.put("workspaceId", a.workspaceId());
+        m.put("tabId", a.tabId());
+        m.put("sessionId", a.sessionId());
+        m.put("agentType", a.agentType());
+        m.put("status", a.status().name().toLowerCase());
+        return m;
+    }
+
+    /** CB-301 projection of an authoritative bridge-owned session. */
+    private static Map<String, Object> view(MemberSession s) {
+        Map<String, Object> m = new LinkedHashMap<>();
+        m.put("terminalId", s.terminalId());
+        m.put("paneId", s.paneId());
+        m.put("profile", s.profile());
+        m.put("cwd", s.cwd());
+        m.put("ownerTerminal", s.ownerTerminal());
+        m.put("state", s.state().name().toLowerCase());
+        if (s.worktree() != null) {
+            m.put("worktree", s.worktree());
+        }
+        if (s.branch() != null) {
+            m.put("branch", s.branch());
+        }
+        return m;
+    }
+}
@@ -0,0 +1,277 @@
+package dev.ltms.bridged.session;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.io.UncheckedIOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.security.SecureRandom;
+import java.util.List;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.stream.Collectors;
+
+/**
+ * Production {@link Worktrees} implementation that shells {@code git} via {@link ProcessBuilder}.
+ * Non-zero exits become {@link WorktreeException}. Worktree directories live under a configurable
+ * root (default: a sibling {@code .bridged-worktrees} of the repo root) so they are never nested
+ * inside the primary working tree.
+ */
+public final class GitWorktrees implements Worktrees {
+
+    private static final Logger log = LoggerFactory.getLogger(GitWorktrees.class);
+
+    /** Project-level MCP config. Present in the repo, so every worktree would otherwise inherit the
+     *  primary's IDE server mounts (a CB-523 worker edited the primary checkout; see the isolation
+     *  javadoc). Neutralized unconditionally. */
+    private static final String MCP_CONFIG = ".mcp.json";
+
+    /** What {@link #isolateToolSurface} writes for {@code .mcp.json}: a valid, explicitly empty server map. */
+    private static final String NEUTRAL_MCP_CONFIG = "{\n  \"mcpServers\": {}\n}\n";
+
+    /** OpenCode's repo-level config. Tracked here, so it lands in every worktree, and it mounts the
+     *  primary's gitea and context7 servers with the primary's credentials. Neutralized so the worker
+     *  gets only the config its launcher writes via {@code OPENCODE_CONFIG}.
+     *
+     *  <p>The reason has changed shape and is now stronger. It used to be a crash: the file carried
+     *  {@code {file:.secrets/...}} references to gitignored files that never reached a worktree, and
+     *  opencode refuses to start on a dangling reference (CB-543). Those credentials now live in one
+     *  shell-level store and the file reads them as {@code {env:...}}, so in a worktree the reference
+     *  resolves instead of failing. That is worse, not better: a member would silently inherit the
+     *  primary's admin-scoped {@code GITEA_ACCESS_TOKEN}. A loud crash became a quiet privilege leak,
+     *  so this entry protects a boundary now rather than papering over a startup error. */
+    private static final String OPENCODE_CONFIG = "opencode.json";
+
+    /** What {@link #isolateToolSurface} writes for {@code opencode.json}: a valid, empty JSON object. */
+    private static final String NEUTRAL_OPENCODE_CONFIG = "{}\n";
+
+    /** Autoenv's repo-level config. Not tracked today, but re-landing it must stay safe: autoenv
+     *  authorizes by path, so a fresh worktree path is always unauthorized and its interactive prompt
+     *  would block every spawn — neutralize it so it can never be committed. */
+    private static final String AUTOENV_CONFIG = ".autoenv";
+
+    /** What {@link #isolateToolSurface} writes for {@code .autoenv}: a valid, empty env file. */
+    private static final String NEUTRAL_AUTOENV_CONFIG = "";
+
+    /**
+     * A tracked project config that is hostile in a provisioned worktree, and what to replace it
+     * with. {@link #file} is the repo-relative path; {@link #stub} is a neutral but VALID payload for
+     * that file's format — a malformed stub would only trade one crash for another;
+     * {@link #createIfAbsent} keeps {@code .mcp.json}'s long-standing behaviour of writing its stub
+     * even when the repo carries no such file, whereas the others are only touched when present.
+     */
+    private record WorktreeHostileConfig(String file, String stub, boolean createIfAbsent) {}
+
+    /** The worktree-hostile configs neutralized in every provisioned worktree, in order. */
+    private static final List<WorktreeHostileConfig> WORKTREE_HOSTILE_CONFIGS = List.of(
+            new WorktreeHostileConfig(MCP_CONFIG, NEUTRAL_MCP_CONFIG, true),
+            new WorktreeHostileConfig(OPENCODE_CONFIG, NEUTRAL_OPENCODE_CONFIG, false),
+            new WorktreeHostileConfig(AUTOENV_CONFIG, NEUTRAL_AUTOENV_CONFIG, false)
+    );
+
+    private final String configuredRoot;
+    private final SecureRandom random = new SecureRandom();
+    private final AtomicLong seq = new AtomicLong();
+
+    /** Default constructor: worktree root is derived per-repo as {@code <repoRoot>/../.bridged-worktrees}. */
+    public GitWorktrees() {
+        this(null);
+    }
+
+    /** @param configuredRoot nullable absolute or relative path; null/blank derives a sibling of the repo root. */
+    public GitWorktrees(String configuredRoot) {
+        this.configuredRoot = configuredRoot;
+    }
+
+    @Override
+    public String add(String repoRoot, String branch, String baseRef) {
+        String base = (baseRef == null || baseRef.isBlank()) ? "HEAD" : baseRef;
+        String nonce = nonce();
+        Path root = resolveRoot(repoRoot);
+        Path path = root.resolve(nonce);
+        try {
+            Files.createDirectories(root);
+        } catch (IOException e) {
+            throw new WorktreeException("cannot create worktree root " + root + ": " + e.getMessage(), e);
+        }
+        String wt = path.toAbsolutePath().toString();
+        log.info("adding worktree branch={} path={} base={}", branch, wt, base);
+        exec("git", "-C", repoRoot, "worktree", "add", wt, "-b", branch, base);
+        isolateToolSurface(wt);
+        return wt;
+    }
+
+    /**
+     * Neutralize the worktree's worktree-hostile project configs so a worker inherits only the tools
+     * and environment its launcher mounts (the bridge via {@code --mcp-config}, the opencode config
+     * via {@code OPENCODE_CONFIG}) — never the primary's.
+     *
+     * <p>This is unconditional, and it is not the same job as the parity overlay. The repo's own
+     * committed {@code .mcp.json} declares the primary's IDE servers, so a fresh checkout mounts them
+     * whether or not the overlay copies anything; a worker that inherits them navigates and edits
+     * through tools bound to the <em>primary's</em> IntelliJ project, which silently hands it absolute
+     * paths outside its own worktree. That is not hypothetical: a CB-523 worker made all 59 of its
+     * edits in the primary checkout while compiling its worktree, so every build it ran was of code
+     * that did not contain its changes. {@code opencode.json} is the same trap one tool over — tracked,
+     * so it lands in every worktree, and it mounts gitea and context7 with the primary's own
+     * credentials, which a member must never hold. {@code .autoenv} extends the principle to a
+     * config that is not tracked today: autoenv authorizes by path, so a fresh worktree path is always
+     * unauthorized and its interactive prompt would block every spawn, so re-landing one must be safe.
+     *
+     * <p>Where a config exists it is replaced by a valid neutral stub (an explicitly empty
+     * map/object, or an empty env file — never a deletion, which would still let a later
+     * {@code git checkout} restore the hostile copy). The {@code --skip-worktree} bit keeps the
+     * neutralized copy from ever showing up as a local modification the worker might commit. A config
+     * the repo does not carry is skipped silently — no stub is invented for a file the repo does not
+     * have, and one missing file must never fail provisioning.
+     */
+    private void isolateToolSurface(String worktreePath) {
+        Path root = Path.of(worktreePath).toAbsolutePath().normalize();
+        for (WorktreeHostileConfig cfg : WORKTREE_HOSTILE_CONFIGS) {
+            neutralize(root, worktreePath, cfg);
+        }
+    }
+
+    private void neutralize(Path root, String worktreePath, WorktreeHostileConfig cfg) {
+        Path target = root.resolve(cfg.file());
+        if (!Files.exists(target) && !cfg.createIfAbsent()) {
+            log.debug("{} absent in the worktree — skipping (repo does not carry it)", cfg.file());
+            return;
+        }
+        try {
+            Files.writeString(target, cfg.stub());
+        } catch (IOException e) {
+            throw new WorktreeException("cannot neutralize " + cfg.file() + " in the worktree: "
+                    + e.getMessage(), e);
+        }
+        if (isTracked(root, cfg.file())) {
+            exec("git", "-C", worktreePath, "update-index", "--skip-worktree", cfg.file());
+        }
+        log.debug("neutralized {} — worker tool surface is launcher-mounted only", cfg.file());
+    }
+
+    @Override
+    public void remove(String repoRoot, String worktreePath) {
+        Path p = Path.of(worktreePath);
+        if (!Files.exists(p)) {
+            log.debug("worktree {} already gone — nothing to remove", worktreePath);
+            return;
+        }
+        log.info("removing worktree {}", worktreePath);
+        exec("git", "-C", repoRoot, "worktree", "remove", "--force", worktreePath);
+    }
+
+    @Override
+    public void overlayParity(String repoRoot, String worktreePath, List<String> overlay) {
+        if (overlay == null || overlay.isEmpty()) {
+            return;
+        }
+        Path srcRoot = Path.of(repoRoot).toAbsolutePath().normalize();
+        Path dstRoot = Path.of(worktreePath).toAbsolutePath().normalize();
+        for (String rel : overlay) {
+            Path src = srcRoot.resolve(rel).normalize();
+            if (!Files.exists(src)) {
+                log.debug("parity overlay source missing — skipping {}", rel);
+                continue;
+            }
+            Path dst = dstRoot.resolve(rel).normalize();
+            try {
+                Files.createDirectories(dst.getParent());
+                Files.copy(src, dst, StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.COPY_ATTRIBUTES);
+                log.debug("copied parity overlay {}", rel);
+            } catch (IOException e) {
+                throw new WorktreeException("cannot copy overlay " + rel + ": " + e.getMessage(), e);
+            }
+            if (isTracked(dstRoot, rel)) {
+                exec("git", "-C", worktreePath, "update-index", "--skip-worktree", rel);
+                log.debug("marked overlay --skip-worktree {}", rel);
+            }
+        }
+    }
+
+    @Override
+    public String repoRoot(String cwd) {
+        String out = exec("git", "-C", cwd, "rev-parse", "--show-toplevel");
+        return Path.of(out.trim()).toAbsolutePath().normalize().toString();
+    }
+
+    /** Resolve the directory that will hold per-session worktree checkouts. */
+    private Path resolveRoot(String repoRoot) {
+        if (configuredRoot != null && !configuredRoot.isBlank()) {
+            return Path.of(configuredRoot).toAbsolutePath().normalize();
+        }
+        Path repo = Path.of(repoRoot).toAbsolutePath().normalize();
+        return repo.resolveSibling(".bridged-worktrees");
+    }
+
+    private String nonce() {
+        return String.format("%06x", random.nextInt(1 << 24)) + "-" + seq.incrementAndGet();
+    }
+
+    private boolean isTracked(Path worktreeRoot, String rel) {
+        return exitCode("git", "-C", worktreeRoot.toString(), "ls-files", "--error-unmatch", rel) == 0;
+    }
+
+    /**
+     * Run a command and return its stdout. Non-zero exit → {@link WorktreeException} with both
+     * stdout and stderr (merged by redirectErrorStream).
+     */
+    private String exec(String... command) {
+        String out;
+        int code;
+        Process p;
+        try {
+            p = new ProcessBuilder(command).redirectErrorStream(true).start();
+        } catch (IOException e) {
+            throw new WorktreeException("failed to start " + command[0] + ": " + e.getMessage(), e);
+        }
+        try (BufferedReader r = new BufferedReader(new InputStreamReader(p.getInputStream(), StandardCharsets.UTF_8))) {
+            out = r.lines().collect(Collectors.joining("\n"));
+        } catch (IOException e) {
+            p.destroyForcibly();
+            throw new UncheckedIOException(e);
+        }
+        try {
+            if (!p.waitFor(30, TimeUnit.SECONDS)) {
+                p.destroyForcibly();
+                throw new WorktreeException("command timed out: " + String.join(" ", command) + "\n" + out);
+            }
+            code = p.exitValue();
+        } catch (InterruptedException e) {
+            p.destroyForcibly();
+            Thread.currentThread().interrupt();
+            throw new WorktreeException("interrupted waiting for command: " + String.join(" ", command), e);
+        }
+        if (code != 0) {
+            throw new WorktreeException("exit " + code + " for: " + String.join(" ", command)
+                    + (out.isBlank() ? "" : "\n" + out));
+        }
+        return out;
+    }
+
+    private int exitCode(String... command) {
+        Process p;
+        try {
+            p = new ProcessBuilder(command).redirectErrorStream(true).start();
+        } catch (IOException e) {
+            throw new WorktreeException("failed to start " + command[0] + ": " + e.getMessage(), e);
+        }
+        try {
+            if (!p.waitFor(30, TimeUnit.SECONDS)) {
+                p.destroyForcibly();
+                throw new WorktreeException("command timed out: " + String.join(" ", command));
+            }
+            return p.exitValue();
+        } catch (InterruptedException e) {
+            p.destroyForcibly();
+            Thread.currentThread().interrupt();
+            throw new WorktreeException("interrupted waiting for command: " + String.join(" ", command), e);
+        }
+    }
+}
@@ -0,0 +1,68 @@
+package dev.ltms.bridged.session;
+
+import dev.ltms.bridged.peer.MemberRole;
+
+/**
+ * A bridge-owned worker session — the authoritative in-daemon record of a worker this
+ * process spawned. Immutable; state transitions are performed by replacing the record in
+ * {@link SessionManager}'s registry.
+ *
+ * @param paneId         the host-unique opaque id (CB-519) — the registry key and the argument to
+ *                       teardown. Despite the historical name this is the {@link
+ *                       dev.ltms.bridged.peer.PeerHandle#id()}, a UUID, and is distinct from the
+ *                       launcher-private herdr pane coordinate.
+ * @param terminalId     herdr terminal handle — the {@code target} for send/read/status
+ * @param profile        the profile name that spawned this session — WHICH BACKEND
+ * @param role           the contract this member runs under — WHAT IT IS FOR. Independent of
+ *                       {@code profile}: a reviewer may run on the same profile as the dev
+ *                       whose diff it reads. {@code null} only for a session recorded before
+ *                       the role was known
+ * @param cwd            the resolved working directory the worker started in
+ * @param ownerTerminal  the caller that requested this worker ({@code null} = daemon/anon)
+ * @param spawnedAtNanos     {@link System#nanoTime()} when the session was registered
+ * @param lastActivityAtNanos {@link System#nanoTime()} of the most recent lifecycle event
+ * @param turnCount          number of delegated turns that have been delivered to this session
+ * @param state              current lifecycle state in the one-shot FSM
+ */
+public record MemberSession(
+        String paneId,
+        String terminalId,
+        String profile,
+        MemberRole role,
+        String cwd,
+        String ownerTerminal,
+        long spawnedAtNanos,
+        long lastActivityAtNanos,
+        int turnCount,
+        State state,
+        String worktree,
+        String branch) {
+
+    /** One-shot worker lifecycle states. */
+    public enum State {
+        SPAWNING,
+        READY,
+        BUSY,
+        DONE,
+        FAILED,
+        RELEASED
+    }
+
+    /** Return a copy of this session in {@code state}. */
+    public MemberSession withState(State state) {
+        return new MemberSession(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
+                lastActivityAtNanos, turnCount, state, worktree, branch);
+    }
+
+    /** Return a copy with {@code lastActivityAtNanos} updated to {@code nowNanos}. */
+    public MemberSession withActivity(long nowNanos) {
+        return new MemberSession(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
+                nowNanos, turnCount, state, worktree, branch);
+    }
+
+    /** Return a copy with the turn count incremented and activity timestamped at {@code nowNanos}. */
+    public MemberSession bumpTurn(long nowNanos) {
+        return new MemberSession(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
+                nowNanos, turnCount + 1, state, worktree, branch);
+    }
+}
@@ -0,0 +1,629 @@
+package dev.ltms.bridged.session;
+
+import dev.ltms.bridged.auth.MemberLifecycle;
+import dev.ltms.bridged.herdr.Agent;
+import dev.ltms.bridged.inject.TurnListener;
+import dev.ltms.bridged.inject.MemberPresence;
+import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.bridged.peer.PeerHandle;
+import dev.ltms.bridged.peer.PeerLauncher;
+import dev.ltms.bridged.peer.SpawnRequest;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.security.SecureRandom;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.function.Consumer;
+import java.util.function.LongSupplier;
+
+/**
+ * Authoritative in-daemon registry of the worker sessions this {@code bridged} process spawned.
+ * Delegates spawn/teardown to a {@link PeerLauncher} (which performs subscription-guarded env
+ * setup and process/materialization) and adds lifecycle tracking, ownership, and deterministic
+ * teardown on top.
+ *
+ * <p>The state machine is intentionally one-shot / no-reuse: every acquired worker is fresh,
+ * and a finished or released worker is torn down, never pooled or reused.
+ *
+ * <p>The manager implements {@link TurnListener} so the injector's turn boundaries drive
+ * {@code READY → BUSY → DONE} (or {@code FAILED}). It exposes a {@link MemberPresence} view via
+ * {@link #asPresence()}: any MCP contact from a worker marks it present and simultaneously
+ * transitions the session {@code SPAWNING → READY}.
+ */
+public final class SessionManager implements TurnListener {
+
+    private static final Logger log = LoggerFactory.getLogger(SessionManager.class);
+
+    private final PeerLauncher launcher;
+    private final Worktrees worktrees;
+    private final ConcurrentHashMap<String /*paneId*/, MemberSession> registry = new ConcurrentHashMap<>();
+    private final MemberPresence presence;
+    private final SecureRandom nonceRandom = new SecureRandom();
+    private final AtomicLong nonceSeq = new AtomicLong();
+    private final LongSupplier nowNanos;
+    private final int contextCap;
+    private final boolean clearAfterTurn;
+    private volatile MemberLifecycle memberLifecycle = MemberLifecycle.NONE;
+
+    /** CB-520: notified with a terminalId on every acquire; no-op until wired. */
+    private final List<Consumer<String>> acquireListeners = new java.util.concurrent.CopyOnWriteArrayList<>();
+    /** CB-516: notified with a terminalId on every release; no-op until wired. */
+    private final List<Consumer<String>> releaseListeners = new java.util.concurrent.CopyOnWriteArrayList<>();
+
+    /** Backward-compatible constructor: shared-tree sessions, production git seam. */
+    public SessionManager(PeerLauncher launcher) {
+        this(launcher, new GitWorktrees(), System::nanoTime, 0, false);
+    }
+
+    /** Backward-compatible constructor with an injectable worktree seam. */
+    public SessionManager(PeerLauncher launcher, Worktrees worktrees) {
+        this(launcher, worktrees, System::nanoTime, 0, false);
+    }
+
+    /** Test constructor with an injectable clock. */
+    public SessionManager(PeerLauncher launcher, Worktrees worktrees, LongSupplier nowNanos) {
+        this(launcher, worktrees, nowNanos, 0, false);
+    }
+
+    /** Production constructor with a configured context turn cap. */
+    public SessionManager(PeerLauncher launcher, Worktrees worktrees, int contextCap) {
+        this(launcher, worktrees, System::nanoTime, contextCap, false);
+    }
+
+    public SessionManager(PeerLauncher launcher, Worktrees worktrees, LongSupplier nowNanos,
+                           int contextCap) {
+        this(launcher, worktrees, nowNanos, contextCap, false);
+    }
+
+    public SessionManager(PeerLauncher launcher, Worktrees worktrees, LongSupplier nowNanos,
+                          int contextCap, boolean clearAfterTurn) {
+        this.launcher = launcher;
+        this.worktrees = worktrees;
+        this.presence = new PresenceBridge(this);
+        this.nowNanos = nowNanos;
+        this.contextCap = contextCap;
+        this.clearAfterTurn = clearAfterTurn;
+    }
+
+    /**
+     * The single {@link MemberPresence} view of this manager: it records availability and forwards
+     * the signal to the {@code SPAWNING → READY} transition. Pass this to the {@code Injector} and
+     * {@code BridgeMcp} where they previously accepted a plain {@link MemberPresence}. The same
+     * instance is returned every call — presence is shared state, so a fresh bridge per call would
+     * fragment the {@code present} set and lose signals across callers.
+     */
+    public MemberPresence asPresence() {
+        return presence;
+    }
+
+    /**
+     * Spawn a worker and register it as {@link MemberSession.State#SPAWNING}. The caller's
+     * identity is recorded as {@code ownerTerminal} ({@code null} for daemon/anon callers).
+     */
+    public MemberSession acquire(String profile, String requestedCwd, String callerCwd,
+                                 String ownerTerminal) {
+        return acquire(profile, requestedCwd, callerCwd, ownerTerminal, null);
+    }
+
+    /**
+     * Spawn a member, optionally inside a fresh git worktree, defaulting the role to
+     * {@link MemberRole#DEV}.
+     *
+     * <p>{@code DEV} is the right default because it is exactly what the old "worker" meant: an
+     * unqualified spawn is a unit of implementation work. An architect or a reviewer is always
+     * asked for on purpose, so neither is ever what a caller silently gets.
+     */
+    public MemberSession acquire(String profile, String requestedCwd, String callerCwd,
+                                 String ownerTerminal, WorktreeRequest wt) {
+        return acquire(profile, MemberRole.DEV, requestedCwd, callerCwd, ownerTerminal, wt);
+    }
+
+    /**
+     * Spawn a member, optionally inside a fresh git worktree. When {@code wt} is non-null the
+     * worktree is provisioned, parity-overlaid, and its path becomes the member's cwd. On any
+     * failure before registration the worktree is removed so no dangling checkout is left.
+     *
+     * @param profile which backend to run on — a {@code profiles:} key
+     * @param role    which contract the member runs under; never {@code null}
+     */
+    public MemberSession acquire(String profile, MemberRole role, String requestedCwd, String callerCwd,
+                                 String ownerTerminal, WorktreeRequest wt) {
+        MemberRole memberRole = (role == null) ? MemberRole.DEV : role;
+        if (wt == null) {
+            // CB-557: the role must ride on the SpawnRequest, not stay a local. The launcher needs it
+            // to pick the profile out of that role's pool and to label the tab; a role kept only on
+            // the MemberSession is recorded after the spawn it was supposed to steer.
+            SpawnRequest req = new SpawnRequest(profile, requestedCwd, callerCwd, null, null, memberRole);
+            PeerHandle handle;
+            try {
+                handle = launcher.spawn(req);
+            } catch (RuntimeException e) {
+                log.warn("spawn failed for profile={} role={}: {}", profile, memberRole, e.getMessage());
+                throw e;
+            }
+            String resolvedProfile = resolveProfile(handle, profile);
+            String cwd = launcher.effectiveCwd(new SpawnRequest(resolvedProfile, requestedCwd, callerCwd));
+            long now = nowNanos.getAsLong();
+            MemberSession session = new MemberSession(
+                    handle.id(),
+                    handle.terminalId(),
+                    resolvedProfile,
+                    memberRole,
+                    cwd,
+                    ownerTerminal,
+                    now,
+                    now,
+                    0,
+                    MemberSession.State.SPAWNING,
+                    null,
+                    null);
+            registry.put(handle.id(), session);
+            memberLifecycle.acquired(session.role(), session.profile(), session.terminalId());
+            log.debug("acquired session id={} terminal={} profile={} owner={}",
+                    handle.id(), handle.terminalId(), session.profile(), session.ownerTerminal());
+            notifyAcquired(session.terminalId());
+            return session;
+        }
+        return acquireWithWorktree(profile, memberRole, requestedCwd, callerCwd, ownerTerminal, wt);
+    }
+
+    /** Tear a worker down by pane id and remove it from the registry. Idempotent. */
+    public void release(String paneId) {
+        release(paneId, ReleaseCause.COMPLETED);
+    }
+
+    /**
+     * Core teardown: always stops the worker pane and deregisters the session; whether the worker's
+     * git worktree is also removed depends on {@code cause}.
+     *
+     * <p>CB-544: these are two concerns that used to be fused. Stopping the pane is correct on every
+     * teardown — the worker process must end. Removing the worktree is a destructive act that is only
+     * correct for a deliberately-finished teardown (an explicit stop of a completed session, the
+     * reaper releasing a genuinely idle one, or a context-capped session). A shutdown drain
+     * must stop panes but preserve worktrees: a worker's uncommitted work exists in exactly one
+     * place — its worktree — so deleting it while the daemon simply goes down is silent data loss,
+     * with no copy and no error. Do NOT fuse these back together; the cost of an orphaned worktree
+     * is a logged path an operator can reclaim, the cost of a deleted one is unrecoverable work.
+     */
+    private void release(String paneId, ReleaseCause cause) {
+        MemberSession removed = registry.remove(paneId);
+        boolean preserveWorktree = cause == ReleaseCause.SHUTDOWN;
+        if (removed != null) {
+            memberLifecycle.released(removed.terminalId());
+            log.debug("releasing session pane={} terminal={} state={} cause={}",
+                    removed.paneId(), removed.terminalId(), removed.state(), cause);
+            if (preserveWorktree && removed.worktree() != null) {
+                logPreservedForShutdown(removed);
+            }
+            // CB-516: a send still waiting on this worker can never be answered now. Tell the
+            // listener BEFORE the pane is torn down, so a blocked caller fails fast with a real
+            // reason instead of sitting on a rendezvous nothing will ever resolve.
+            notifyReleased(removed.terminalId());
+        }
+        launcher.stop(paneId);
+        if (removed != null && !preserveWorktree && removed.worktree() != null) {
+            worktrees.remove(worktrees.repoRoot(removed.cwd()), removed.worktree());
+        }
+    }
+
+    /**
+     * Why a session is being released — governs whether its worktree is preserved or removed.
+     * Worktree removal is reserved for the one case that is genuinely finished; everything else
+     * must keep the worker's only copy of its work.
+     */
+    public enum ReleaseCause {
+        /** Deliberate teardown of a finished session. Stops the pane and removes the worktree. */
+        COMPLETED,
+        /** Daemon shutdown drain. Stops the pane but PRESERVES the worktree. */
+        SHUTDOWN
+    }
+
+    /**
+     * CB-544 shutdown drain log for a worktree we deliberately kept. A session still {@code BUSY}
+     * when the drain timeout expired was abandoned mid-turn — that work may be uncommitted and is
+     * the only copy — so the message is loud and points at the path an operator needs to reclaim.
+     */
+    private void logPreservedForShutdown(MemberSession session) {
+        if (session.state() == MemberSession.State.BUSY) {
+            log.warn("shutdown drain abandoned BUSY session pane={} terminal={} mid-turn; "
+                    + "worktree preserved at {}", session.paneId(), session.terminalId(),
+                    session.worktree());
+        } else {
+            log.info("shutdown drain preserved worktree at {} for pane={}",
+                    session.worktree(), session.paneId());
+        }
+    }
+
+    /**
+     * Register a callback invoked with a session's {@code terminalId} whenever it is acquired
+     * (CB-520). This is the hook that lets the reply inbox {@code own} a target's queue.
+     */
+    public void onAcquire(Consumer<String> listener) {
+        if (listener != null) {
+            acquireListeners.add(listener);
+        }
+    }
+
+    /**
+     * Register a callback invoked with a session's {@code terminalId} whenever it is released
+     * (CB-516). Every teardown path funnels through {@link #release}, so one hook covers the REST
+     * and MCP stop tools, the idle-TTL reaper, and shutdown drain alike.
+     *
+     * <p>Added rather than injected because {@code MessageService} — one intended listener — is
+     * constructed after this manager (it needs the injector and rendezvous, which need the session
+     * presence view this manager exposes). Wiring it at construction would require breaking that
+     * cycle for one callback.
+     */
+    public void onRelease(Consumer<String> listener) {
+        if (listener != null) {
+            releaseListeners.add(listener);
+        }
+    }
+
+    /** Inject the optional member-slot lifecycle after construction without changing constructors. */
+    public void setMemberLifecycle(MemberLifecycle memberLifecycle) {
+        this.memberLifecycle = memberLifecycle == null ? MemberLifecycle.NONE : memberLifecycle;
+    }
+
+    /** A listener failure must never prevent the acquisition it is reacting to. */
+    private void notifyAcquired(String terminalId) {
+        if (terminalId == null) {
+            return;
+        }
+        for (Consumer<String> listener : acquireListeners) {
+            try {
+                listener.accept(terminalId);
+            } catch (RuntimeException e) {
+                log.warn("acquire listener failed for terminal {}: {}", terminalId, e.toString());
+            }
+        }
+    }
+
+    /** A listener failure must never prevent the teardown it is reacting to. */
+    private void notifyReleased(String terminalId) {
+        if (terminalId == null) {
+            return;
+        }
+        for (Consumer<String> listener : releaseListeners) {
+            try {
+                listener.accept(terminalId);
+            } catch (RuntimeException e) {
+                log.warn("release listener failed for terminal {}: {}", terminalId, e.toString());
+            }
+        }
+    }
+
+    private MemberSession acquireWithWorktree(String profile, MemberRole memberRole, String requestedCwd, String callerCwd,
+                                              String ownerTerminal, WorktreeRequest wt) {
+        String preResolvedProfile = (profile == null || profile.isBlank())
+                ? launcher.defaultProfile() : profile;
+        // CB-507: resolve through the launcher's CB-112 chain (requested → profile cwd → caller →
+        // daemon cwd → "."), never the raw args. A plain REST spawn supplies neither a requested
+        // nor a caller cwd, so taking the first non-blank of those two yielded null and put
+        // `git -C null` on the command line — an NPE out of ProcessBuilder, surfacing as HTTP 500.
+        // The non-worktree path always used this chain; only this branch was missed.
+        String repoRoot = worktrees.repoRoot(
+                launcher.effectiveCwd(new SpawnRequest(preResolvedProfile, requestedCwd, callerCwd)));
+        String branch = "worker/" + slug(wt.ticketSlug()) + "-" + nonce();
+        String path = null;
+        PeerHandle handle;
+        try {
+            path = worktrees.add(repoRoot, branch, wt.baseRef());
+            worktrees.overlayParity(repoRoot, path, launcher.parityOverlay(preResolvedProfile));
+            handle = launcher.spawn(new SpawnRequest(profile, path, callerCwd, null, null, memberRole));
+        } catch (RuntimeException e) {
+            log.warn("spawn failed for profile={} role={} branch={} path={}: {}",
+                    preResolvedProfile, memberRole, branch, path, e.getMessage());
+            if (path != null) {
+                try {
+                    worktrees.remove(repoRoot, path);
+                } catch (RuntimeException cleanup) {
+                    log.warn("failed to clean up worktree {} after spawn error: {}", path, cleanup.getMessage());
+                }
+            }
+            throw e;
+        }
+        String resolvedProfile = resolveProfile(handle, profile);
+        String cwd = launcher.effectiveCwd(new SpawnRequest(resolvedProfile, path, callerCwd));
+        long now = nowNanos.getAsLong();
+        MemberSession session = new MemberSession(
+                handle.id(),
+                handle.terminalId(),
+                resolvedProfile,
+                memberRole,
+                cwd,
+                ownerTerminal,
+                now,
+                now,
+                0,
+                MemberSession.State.SPAWNING,
+                path,
+                branch);
+        registry.put(handle.id(), session);
+        memberLifecycle.acquired(session.role(), session.profile(), session.terminalId());
+        log.debug("acquired worktree session id={} terminal={} profile={} branch={} path={}",
+                handle.id(), handle.terminalId(), session.profile(), session.branch(), session.worktree());
+        notifyAcquired(session.terminalId());
+        return session;
+    }
+
+    private String slug(String raw) {
+        return raw == null ? "ticket" : raw.toLowerCase().replaceAll("[^a-z0-9]+", "-").replaceAll("^-+|-+$", "");
+    }
+
+    private String nonce() {
+        return String.format("%06x", nonceRandom.nextInt(1 << 24)) + "-" + nonceSeq.incrementAndGet();
+    }
+
+    /**
+     * The profile to record for a session. A launcher that performed dynamic selection tells us
+     * the actual profile via {@link PeerHandle#profile()}; otherwise fall back to what the caller
+     * requested (or the launcher's default for a no-profile spawn).
+     */
+    private String resolveProfile(PeerHandle handle, String requestedProfile) {
+        String fromHandle = handle.profile();
+        if (fromHandle != null && !fromHandle.isBlank()) {
+            return fromHandle;
+        }
+        if (requestedProfile != null && !requestedProfile.isBlank()) {
+            return requestedProfile;
+        }
+        return launcher.defaultProfile();
+    }
+
+    /** The session for {@code paneId}, if it is still registered and not released. */
+    public Optional<MemberSession> get(String paneId) {
+        return Optional.ofNullable(registry.get(paneId));
+    }
+
+    /** Bridge-owned roster: all registered sessions (acquired minus released). */
+    public List<MemberSession> roster() {
+        return List.copyOf(registry.values());
+    }
+
+    /**
+     * CB-304 merged roster+live view. The registry is authoritative for worktree, branch,
+     * profile, owner, and state; the optional live agent supplies the herdr-reported status.
+     */
+    public static Map<String, Object> rosterView(MemberSession session, Agent live) {
+        Map<String, Object> m = new LinkedHashMap<>();
+        m.put("sessionId", session.terminalId());
+        m.put("paneId", session.paneId());
+        // Both axes, always: profile says which backend this member runs on, role says what it is
+        // for. A lead reading the roster needs both — two rows may share a profile and still be
+        // allowed to do entirely different things.
+        m.put("profile", session.profile());
+        m.put("role", session.role() == null ? "dev" : session.role().wireName());
+        m.put("state", session.state().name().toLowerCase());
+        if (session.worktree() != null) {
+            m.put("worktree", session.worktree());
+        }
+        if (session.branch() != null) {
+            m.put("branch", session.branch());
+        }
+        if (session.ownerTerminal() != null) {
+            m.put("owner", session.ownerTerminal());
+        }
+        m.put("liveStatus", live == null ? "unknown" : live.status().name().toLowerCase());
+        return m;
+    }
+
+    /** Lifecycle hook: worker became available on the bridge MCP. */
+    void onReady(String terminalId) {
+        transitionByTerminal(terminalId, MemberSession.State.SPAWNING, MemberSession.State.READY);
+    }
+
+    /**
+     * Lifecycle hook: a message was delivered into the worker — it is now busy on a turn.
+     * The turn count is bumped and the activity timestamp is refreshed. A {@code DONE} session
+     * can be re-delivered for multi-turn reuse until it is released.
+     */
+    @Override
+    public void onDelivered(String target) {
+        MemberSession current = findByTerminal(target);
+        if (current == null) return;
+        if (current.state() != MemberSession.State.READY && current.state() != MemberSession.State.DONE) {
+            return;
+        }
+        long now = nowNanos.getAsLong();
+        MemberSession updated = current.withState(MemberSession.State.BUSY).bumpTurn(now);
+        if (replace(current, updated)) {
+            log.debug("session transitioned terminal={} pane={} {} -> BUSY turn={}",
+                    target, current.paneId(), current.state(), updated.turnCount());
+        }
+    }
+
+    /** Lifecycle hook: the worker's delegated turn completed successfully. */
+    @Override
+    public void onTurnComplete(String target) {
+        completeTurn(target, false);
+    }
+
+    @Override
+    public boolean hasPostTurnAction(String target) {
+        if (!clearAfterTurn) return false;
+        MemberSession current = findByTerminal(target);
+        return current != null && current.state() == MemberSession.State.BUSY
+                && (contextCap <= 0 || current.turnCount() < contextCap);
+    }
+
+    @Override
+    public boolean onTurnCompleteWithPostAction(String target) {
+        return completeTurn(target, true);
+    }
+
+    private boolean completeTurn(String target, boolean startContextReset) {
+        MemberSession current = findByTerminal(target);
+        if (current == null || current.state() != MemberSession.State.BUSY) return false;
+        long now = nowNanos.getAsLong();
+        MemberSession updated = current.withState(MemberSession.State.DONE).withActivity(now);
+        if (replace(current, updated)) {
+            log.debug("session transitioned terminal={} pane={} BUSY -> DONE turn={}",
+                    target, current.paneId(), updated.turnCount());
+        }
+        if (contextCap > 0 && updated.turnCount() >= contextCap) {
+            release(current.paneId());
+            return false;
+        }
+        if (!startContextReset || !clearAfterTurn) return false;
+        try {
+            return launcher.clearContext(current.paneId());
+        } catch (RuntimeException e) {
+            log.warn("context reset failed for terminal={} pane={}; continuing without reset: {}",
+                    target, current.paneId(), e.getMessage());
+            return false;
+        }
+    }
+
+    /** Lifecycle hook: the worker's delegated turn failed. */
+    @Override
+    public void onTurnFailed(String target) {
+        onFailed(target);
+    }
+
+    /** Lifecycle hook: the worker vanished or was dropped mid-life. */
+    void onFailed(String target) {
+        MemberSession current = findByTerminal(target);
+        if (current == null) return;
+        if (current.state() == MemberSession.State.RELEASED) return;
+        MemberSession.State priorState = current.state();
+        if (replace(current, current.withState(MemberSession.State.FAILED))) {
+            log.warn("member terminal={} pane={} can no longer be delegated to: its turn never resolved "
+                    + "(was {} when it failed)", target, current.paneId(), priorState);
+        }
+    }
+
+    /**
+     * Best-effort reap of sessions that have been idle longer than {@code idleTtlNanos}. Only
+     * {@code READY} and {@code DONE} sessions are eligible — never a {@code SPAWNING} or
+     * {@code BUSY} worker. Returns the number of sessions released.
+     */
+    int reapIdle(long idleTtlNanos) {
+        long now = nowNanos.getAsLong();
+        int reaped = 0;
+        for (MemberSession s : roster()) {
+            if (s.state() != MemberSession.State.READY && s.state() != MemberSession.State.DONE) {
+                continue;
+            }
+            long idleNanos = now - s.lastActivityAtNanos();
+            if (idleNanos > idleTtlNanos) {
+                log.debug("reaping idle session terminal={} pane={}: idle {}s exceeds the {}s ttl",
+                        s.terminalId(), s.paneId(), TimeUnit.NANOSECONDS.toSeconds(idleNanos),
+                        TimeUnit.NANOSECONDS.toSeconds(idleTtlNanos));
+                release(s.paneId());
+                reaped++;
+            }
+        }
+        return reaped;
+    }
+
+    /**
+     * Gracefully drain all registered sessions on daemon shutdown. For each session that is
+     * {@code BUSY}, poll up to {@code timeoutNanos} for it to leave {@code BUSY}, then release it
+     * regardless. Non-busy sessions are released immediately. A failure releasing one session is
+     * logged and does not abort the rest.
+     *
+     * <p>CB-544: this is a {@link ReleaseCause#SHUTDOWN} release — the worker's pane is stopped
+     * (the process must end) but its worktree is preserved and its path logged. Shutdown is never
+     * a reason to delete a worker's only copy of its uncommitted work. A session still {@code BUSY}
+     * when the timeout expired is abandoned mid-turn and logged loudly so an operator can find its
+     * kept worktree.
+     */
+    void drainAll(long timeoutNanos) {
+        long deadline = System.nanoTime() + timeoutNanos;
+        for (MemberSession s : roster()) {
+            try {
+                if (s.state() == MemberSession.State.BUSY) {
+                    while (System.nanoTime() < deadline) {
+                        MemberSession current = registry.get(s.paneId());
+                        if (current == null || current.state() != MemberSession.State.BUSY) {
+                            break;
+                        }
+                        try {
+                            long remaining = deadline - System.nanoTime();
+                            Thread.sleep(Math.min(TimeUnit.NANOSECONDS.toMillis(remaining), 50));
+                        } catch (InterruptedException e) {
+                            Thread.currentThread().interrupt();
+                            break;
+                        }
+                    }
+                }
+                release(s.paneId(), ReleaseCause.SHUTDOWN);
+            } catch (RuntimeException e) {
+                log.warn("drain failed for pane={}; continuing with remaining sessions", s.paneId(), e);
+            }
+        }
+    }
+
+    /**
+     * Close this manager by draining all sessions. The timeout comes from configuration when set,
+     * otherwise a sensible default.
+     */
+    public void close(Integer drainTimeoutSeconds) {
+        int seconds = (drainTimeoutSeconds != null && drainTimeoutSeconds > 0) ? drainTimeoutSeconds : 5;
+        drainAll(TimeUnit.SECONDS.toNanos(seconds));
+    }
+
+    /** Number of sessions currently registered. */
+    public int size() {
+        return registry.size();
+    }
+
+    /**
+     * The registered session owning {@code terminalId}, or {@code null} if none does.
+     *
+     * <p>A null {@code terminalId} is a normal input, not a caller bug: every lifecycle hook here is
+     * fed from the MCP transport, where the <em>primary</em> resolves to a {@link
+     * dev.ltms.bridged.auth.Principal} with no terminal. {@code BridgeMcp} documents that contact as
+     * a no-op, and {@link dev.ltms.bridged.inject.MemberPresence#markPresent} honours it — but
+     * {@code PresenceBridge} then forwards the same null here. Matching on a null id can never
+     * succeed anyway (a registered session always has a terminal), so answer "no match" rather than
+     * throwing: an NPE on this path takes down an unrelated tool call for the primary.
+     */
+    private MemberSession findByTerminal(String terminalId) {
+        if (terminalId == null) return null;
+        for (MemberSession s : registry.values()) {
+            if (terminalId.equals(s.terminalId())) return s;
+        }
+        return null;
+    }
+
+    private void transitionByTerminal(String terminalId, MemberSession.State from,
+                                      MemberSession.State to) {
+        MemberSession current = findByTerminal(terminalId);
+        if (current == null || current.state() != from) return;
+        long now = nowNanos.getAsLong();
+        if (replace(current, current.withState(to).withActivity(now))) {
+            log.debug("session transitioned terminal={} pane={} {} -> {}",
+                    terminalId, current.paneId(), from, to);
+        }
+    }
+
+    private boolean replace(MemberSession expected, MemberSession updated) {
+        return registry.replace(expected.paneId(), expected, updated);
+    }
+
+    /** MemberPresence bridge that also drives the manager's READY transition. */
+    private static final class PresenceBridge extends MemberPresence {
+        private final SessionManager sessions;
+
+        PresenceBridge(SessionManager sessions) {
+            this.sessions = sessions;
+        }
+
+        @Override
+        public void markPresent(String terminal) {
+            if (terminal == null || terminal.isBlank()) {
+                return; // the primary's contact carries no worker terminal — not a readiness signal
+            }
+            super.markPresent(terminal);
+            sessions.onReady(terminal);
+        }
+    }
+}
@@ -0,0 +1,70 @@
+package dev.ltms.bridged.session;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.concurrent.TimeUnit;
+
+/**
+ * Periodic virtual-thread reaper that tears down {@code READY}/{@code DONE} sessions which have
+ * exceeded their idle TTL. Modeled on {@link dev.ltms.bridged.inject.StatusPoller}: a single
+ * virtual-thread loop, idempotent start/stop, and no {@code ScheduledExecutorService}.
+ */
+public final class SessionReaper {
+
+    private static final Logger log = LoggerFactory.getLogger(SessionReaper.class);
+    private static final long DEFAULT_INTERVAL_MILLIS = 5000;
+
+    private final SessionManager sessions;
+    private final long idleTtlNanos;
+    private final long intervalMillis;
+    private volatile boolean running;
+    private Thread thread;
+
+    /** Construct a reaper with the default 5-second polling interval. */
+    public SessionReaper(SessionManager sessions, long idleTtlSeconds) {
+        this(sessions, idleTtlSeconds, DEFAULT_INTERVAL_MILLIS);
+    }
+
+    /** Construct a reaper with an explicit polling interval (useful for tests). */
+    public SessionReaper(SessionManager sessions, long idleTtlSeconds, long intervalMillis) {
+        this.sessions = sessions;
+        this.idleTtlNanos = TimeUnit.SECONDS.toNanos(idleTtlSeconds);
+        this.intervalMillis = intervalMillis;
+    }
+
+    /** Start the reaper loop on a virtual thread. Idempotent. */
+    public synchronized void start() {
+        if (running) return;
+        running = true;
+        thread = Thread.ofVirtual().name("session-reaper").start(this::loop);
+        log.info("session reaper started (idle ttl {}s, interval {}ms)",
+                TimeUnit.NANOSECONDS.toSeconds(idleTtlNanos), intervalMillis);
+    }
+
+    private void loop() {
+        while (running) {
+            try {
+                sessions.reapIdle(idleTtlNanos);
+            } catch (RuntimeException e) {
+                log.warn("session reaper iteration failed; continuing", e);
+            }
+            sleep();
+        }
+    }
+
+    private void sleep() {
+        try {
+            Thread.sleep(intervalMillis);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            running = false;
+        }
+    }
+
+    /** Stop the reaper loop. Idempotent. */
+    public synchronized void stop() {
+        running = false;
+        if (thread != null) thread.interrupt();
+    }
+}
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.session;
+package dev.ltms.bridged.session;

 /** Non-zero exit or I/O failure from a git worktree operation. */
 public final class WorktreeException extends RuntimeException {
@@ -1,4 +1,4 @@
-package dev.ltms.fleet.session;
+package dev.ltms.bridged.session;

 /** Ask {@link SessionManager#acquire} to provision an isolated worktree. null ⇒ run in the shared primary tree. */
 public record WorktreeRequest(String ticketSlug, String baseRef) {
@@ -0,0 +1,18 @@
+package dev.ltms.bridged.session;
+
+import java.util.List;
+
+/** Seam between {@link SessionManager} and git worktree operations. Tests use a recording fake. */
+public interface Worktrees {
+    /** git -C <repoRoot> worktree add <path> -b <branch> <baseRef|HEAD>. Returns the worktree path. */
+    String add(String repoRoot, String branch, String baseRef);
+
+    /** git -C <repoRoot> worktree remove --force <path>. Idempotent (already-gone tolerated). */
+    void remove(String repoRoot, String worktreePath);
+
+    /** Copy each existing overlay path repoRoot→worktree; mark tracked ones --skip-worktree. */
+    void overlayParity(String repoRoot, String worktreePath, List<String> overlay);
+
+    /** git -C <cwd> rev-parse --show-toplevel — the repo root that owns cwd. */
+    String repoRoot(String cwd);
+}
@@ -1,13 +1,4 @@
 <configuration>
-    <!--
-      CB-575: MCP SDK 2.0.0 has no public notification registration API. It registers only
-      notifications/initialized and notifications/roots/list_changed, so other client notifications
-      still warn when unhandled. Clients may legitimately send notifications/cancelled; suppress only
-      that SDK WARN because it would devalue the action-needed WARN level used by M4 fleet health.
-      If a later SDK handles cancellation, this filter simply stops matching and can be removed.
-    -->
-    <turboFilter class="dev.ltms.fleet.logging.McpCancelledNotificationFilter"/>
-
    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
        <encoder>
            <pattern>%d{HH:mm:ss.SSS} %-5level [%thread] %logger{28} - %msg%n</pattern>
@@ -38,7 +29,7 @@
        </encoder>
    </appender>

-    <logger name="dev.ltms.fleet" level="DEBUG"/>
+    <logger name="dev.ltms.bridged" level="DEBUG"/>
    <logger name="io.javalin" level="INFO"/>
    <logger name="org.eclipse.jetty" level="WARN"/>

@@ -1,6 +1,6 @@
-package dev.ltms.fleet;
+package dev.ltms.bridged;

-import dev.ltms.fleet.inject.MemberPresence;
+import dev.ltms.bridged.inject.MemberPresence;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;

@@ -19,7 +19,7 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
 * every lead→lead delivery sat on the gate for the full readiness grace and failed ~60s later without
 * a keystroke ever reaching the pane.
 */
-class FleetDeliverabilityTest {
+class BridgedDeliverabilityTest {

    private static Supplier<Map<String, String>> leads(Map<String, String> m) {
        return () -> m;
@@ -31,13 +31,13 @@ class FleetDeliverabilityTest {
        MemberPresence presence = new MemberPresence();
        presence.markPresent("term_worker");

-        assertTrue(Fleetd.deliverableTo(presence, leads(Map.of())).test("term_worker"));
+        assertTrue(Bridged.deliverableTo(presence, leads(Map.of())).test("term_worker"));
    }

    @Test
    @DisplayName("a worker still in its boot window is held back")
    void absentWorkerIsNotDeliverable() {
-        assertFalse(Fleetd.deliverableTo(new MemberPresence(), leads(Map.of())).test("term_booting"));
+        assertFalse(Bridged.deliverableTo(new MemberPresence(), leads(Map.of())).test("term_booting"));
    }

    @Test
@@ -45,7 +45,7 @@ class FleetDeliverabilityTest {
    void leadIsDeliverableWithoutPresence() {
        MemberPresence presence = new MemberPresence();
        Predicate<String> deliverable =
-                Fleetd.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")));
+                Bridged.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")));

        assertFalse(presence.isPresent("term_lead"), "a lead is never enrolled in worker presence");
        assertTrue(deliverable.test("term_lead"), "…and must be deliverable anyway");
@@ -57,7 +57,7 @@ class FleetDeliverabilityTest {
        MemberPresence presence = new MemberPresence();
        presence.markPresent("term_worker");

-        assertFalse(Fleetd.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")))
+        assertFalse(Bridged.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")))
                .test("term_stranger"));
    }

@@ -65,7 +65,7 @@ class FleetDeliverabilityTest {
    @DisplayName("a lead discovered after startup becomes deliverable with no restart")
    void leadSetIsReadThroughOnEveryCall() {
        Map<String, String> discovered = new HashMap<>();
-        Predicate<String> deliverable = Fleetd.deliverableTo(new MemberPresence(), leads(discovered));
+        Predicate<String> deliverable = Bridged.deliverableTo(new MemberPresence(), leads(discovered));

        assertFalse(deliverable.test("term_late"));
        discovered.put("term_late", "gpt-sol-5.6"); // leadScan picks up a newly labelled tab
@@ -77,7 +77,7 @@ class FleetDeliverabilityTest {
    void forgetDoesNotDisarmALead() {
        MemberPresence presence = new MemberPresence();
        Predicate<String> deliverable =
-                Fleetd.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")));
+                Bridged.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")));

        presence.forget("term_lead"); // the injector's cleanup path runs against every target

@@ -1,4 +1,4 @@
-package dev.ltms.fleet.auth;
+package dev.ltms.bridged.auth;

 import ch.qos.logback.classic.Level;
 import ch.qos.logback.classic.LoggerContext;
--- a/Show More
+++ b/Show More