[convenientlymike]

What

Adds adopt_reservation to the Fleet SessionStart hook (register.sh), the authoritative path for a trackboard reservation to become a live agent on the target host. This is scope #3 of the trackboard fleet-agent-D design (docs/fleet-agent-D-v2-design.md §D.4 Path 1) — the signed companion to the daemon/launcher already landed on the trackboard side.

When trackboard mints a reservation targeting this window's cwd + device, register.sh (between reap and the agent-file write) adopts it on-host, deterministically, with no roster-reconcile race:

• (a) writes identities/<sid>.json — the name/role overlay trackboard's roster reads (survives the heartbeat rewrite by construction).
• (b) seeds the mission into the window-keyed goalstack on this host (the only reliable cross-device seed, §D.6).
• (c) hands the device slug to the agent-file writer (a host field).
• (d) stamps the reservation adopted/bound_sid/bound_host/adopted_via=native and re-signs so trackboard's read path still accepts it.

Why it's safe on a hook that runs on every window

• Authenticity gate. Reservations are HMAC-SHA256-signed by trackboard; a record whose sig does not verify is a forgery and is ignored (the shared state dir is unauthenticated on the default box). Verify + re-sign reuse trackboard's exact canonicalization via python3 — zero drift; the A1 re-sign-still-verifies selftest is the anti-drift forcing function. Canonical source: trackboard fleet.py:_reservation_sig.
• Never-guess. Match by explicit $FLEET_RESERVATION (preferred, unambiguous) else a unique cwd+device fallback; ambiguity (>1 match) or a foreign device → adopt NONE, leave pending. Requires a device slug from env — never hostname (a fleet must not guess its own identity).
• Back-compat, proven by byproduct. With no adopted reservation, ADOPT_HOST is empty and the agent file is byte-identical to the pre-feature baseline (the A2 selftest runs the real register.sh and asserts no host key). Fail-closed (no python3/key) degrades to trackboard's reconcile path — never worse than an un-patched checkout.
• Guarded so it can never block a normal registration (always returns 0).

Forcing function

selftest-adopt.sh — 12 hermetic bites (each paired with a control that fires), wired into the CI selftest job:

#	Bites
A1	explicit-rid adoption writes all four artifacts + a still-valid re-sign (anti-drift)
A2	back-compat: real register.sh writes NO host on a baseline reg; DOES on adopt
A3	unique cwd+device fallback adopts; ambiguity adopts NONE
A4	forged/unsigned reservation ignored; validly-signed adopted
A5	foreign-device reservation never cwd-bound on this host

Verification

• selftest-adopt.sh — 12/12 green.
• shellcheck --severity=warning clean on lib.sh / register.sh / selftest-adopt.sh + full-tree sweep.
• Existing selftest-labels / selftest-collateral still green (no regression).

Host-verify owed (not checkable in CI)

The exact goalstack binary resolution + the launcher exporting $FLEET_RESERVATION/TRACKBOARD_DEVICE_SLUG are runtime facts on the deploy host — smoke with a live trackboard mint before relying on the on-host mission seed.

🤖 Generated with Claude Code

[convenientlymike]

Superseded — native reservation adoption was already merged by #13 (feat/native-reservation-adopt, 2026-09-11) while my local main was stale. The merged adopt.sh is strictly more complete than this branch: it has the same HMAC authenticity gate, explicit-$FLEET_RESERVATION path (with path-traversal sanitization), cwd+host fallback with ambiguity→adopt-NONE, re-sign, and fail-OPEN — and is jq/openssl-native (no python3 hard-dependency), in a cleanly separated adopt.sh file. Shipping this would create a second divergent implementation (canonical-single-source violation) and conflict on selftest-adopt.sh. Closing; the merged implementation stands.