fix(issue-23): the caller's server comes from HERDR_SOCKET_PATH, not only HERDR_SESSION

The live trial of this branch found the cross-server verdict inert on this
host: _herdr_call_is_cross_server read the caller's server from HERDR_SESSION,
and herdr 0.8.2 does not export that variable to a pane of the default server
- the orchestrator's usual home, and exactly the pane the #23 leak comes from.
Every call was judged "not crossing", the three ids were never dropped, and
all four trial onboardings ended "no started within 180s". My own pane sits in
a named server and does carry HERDR_SESSION, which is how the assumption got
past me.

HERDR_SOCKET_PATH is exported to every pane and its layout names the server:
.../.config/herdr/herdr.sock is the default server and
.../.config/herdr/sessions/<name>/herdr.sock a named one - the convention
`herdr session list --json` reports and the shim already uses to find a named
server's socket. _herdr_caller_server prefers HERDR_SESSION when a herdr does
export it, otherwise reads the socket's shape (suffix-matched, not $HOME-
anchored), and yields "" for anything unrecognised so an exported scope is
respected rather than guessed away. The rest of the rule is unchanged from
3bcaa39: a `default` or empty target is the ambient server, no caller server
means no pane, caller == target is the same server. watcher.caller_server
applies the same rule for the loop's own herdr calls.

Reproduced against the live server in the trial's exact env: 10a678c answers
"NOT crossing / has-session NOT FOUND"; this commit answers "caller server
default / crossing / FOUND". S1c pins that env end to end with the recorder
asserting the ids never reach herdr; S1d-S1h pin the verdict, the named-socket
same-server and cross-server cases, HERDR_SESSION precedence, and the
unrecognised layout. The 3bcaa39 tests are unchanged and still pass.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

.agents/skills/lib.sh

@@ -1384,19 +1384,62 @@ EOF
 # live session as absent: has-session, kill-session, agent prompt and the
 # delegate-job preflight all answer "no such session".
 #
+# _herdr_caller_server — the name of the server whose pane this process runs
+# in; empty when it is not in a pane at all.
+#
+# HERDR_SESSION is used when present, but herdr 0.8.2 does not export it to a
+# pane of the *default* server (the orchestrator's usual home), which is
+# exactly the pane the #23 leak comes from - the live trial of this branch
+# found every call judged "not crossing" for that reason. HERDR_SOCKET_PATH is
+# exported to every pane, and its layout names the server:
+#
+#   $HOME/.config/herdr/herdr.sock                 -> default
+#   $HOME/.config/herdr/sessions/<name>/herdr.sock -> <name>
+#
+# (the same convention lib.sh's shim already relies on to find a named
+# server's socket). Matched by shape, not by $HOME, so a redirected HOME does
+# not break it. An unrecognised layout yields "" - treated as "not in a pane",
+# which keeps today's behaviour rather than guessing.
+_herdr_caller_server() {
+  if [ -n "${HERDR_SESSION:-}" ]; then
+    printf '%s\n' "$HERDR_SESSION"
+    return 0
+  fi
+  local sock="${HERDR_SOCKET_PATH:-}"
+  case "$sock" in
+    */.config/herdr/herdr.sock)
+      printf 'default\n'
+      ;;
+    */.config/herdr/sessions/*/herdr.sock)
+      local d="${sock%/herdr.sock}"
+      printf '%s\n' "${d##*/}"
+      ;;
+    *)
+      printf '\n'
+      ;;
+  esac
+  return 0
+}
+
 # True only for a call aimed at a *named* server other than the caller's own:
 #
 #   * target unset or `default` (the lib.sh:97 fallback) is the shim's sentinel
 #     for "pass no session flag", so herdr answers on the ambient server, which
 #     for a caller inside a pane is that same caller's server - not a crossing;
-#   * no HERDR_SESSION means the caller is not in a pane at all, so an exported
-#     HERDR_WORKSPACE_ID is a deliberate scope, not a leak (H-18/H-21/H-23);
+#   * no caller server (_herdr_caller_server empty) means the caller is not in
+#     a pane at all, so an exported HERDR_WORKSPACE_ID is a deliberate scope,
+#     not a leak (H-18/H-21/H-23);
 #   * caller == target is the same server.
+#
+# A caller in the default server's pane targeting a named server IS a crossing
+# (the reported #23 scenario): `default` is a real server name on the caller's
+# side, only as a *target* is it the "ambient" sentinel.
 _herdr_call_is_cross_server() {
-  local caller="${HERDR_SESSION:-}" target="${HERDR_SESSION_NAME:-}"
+  local caller target="${HERDR_SESSION_NAME:-}"
   case "$target" in
     ""|default) return 1 ;;
   esac
+  caller="$(_herdr_caller_server)"
   if [ -n "$caller" ] && [ "$caller" != "$target" ]; then
     return 0
   fi
@@ -1412,7 +1455,7 @@ mam_herdr() {
   if _herdr_call_is_cross_server; then
     _scope_strip=(env -u HERDR_WORKSPACE_ID -u HERDR_PANE_ID -u HERDR_TAB_ID)
     if [ "${MAM_SHIM_DEBUG:-0}" = "1" ]; then
-      echo "mam_herdr: dropping caller pane scope ids (caller server '${HERDR_SESSION:-}' != target '${HERDR_SESSION_NAME:-}')" >&2
+      echo "mam_herdr: dropping caller pane scope ids (caller server '$(_herdr_caller_server)' != target '${HERDR_SESSION_NAME:-}')" >&2
     fi
   fi
   ${_scope_strip[@]+"${_scope_strip[@]}"} "$WORKSPACE_ROOT/.mam/shim/herdr" "$@"

.agents/skills/lib_py/loop/watcher.py

@@ -47,15 +47,42 @@ BACKOFF_MAX_S = 16.0
 CALLER_SCOPE_VARS = ("HERDR_WORKSPACE_ID", "HERDR_PANE_ID", "HERDR_TAB_ID")
 
 
+def caller_server(environ=None):
+    """The server whose pane this process runs in, "" when not in a pane.
+
+    HERDR_SESSION when present; otherwise the shape of HERDR_SOCKET_PATH, which
+    herdr exports to every pane (HERDR_SESSION is absent in a default-server
+    pane on herdr 0.8.2 - the orchestrator's usual home, and where the #23 leak
+    comes from). Same convention as lib.sh's _herdr_caller_server:
+
+        .../.config/herdr/herdr.sock                 -> "default"
+        .../.config/herdr/sessions/<name>/herdr.sock -> <name>
+
+    Matched by shape, not by $HOME. Anything else is "" (not in a pane).
+    """
+    src = os.environ if environ is None else environ
+    sess = (src.get("HERDR_SESSION") or "").strip()
+    if sess:
+        return sess
+    sock = (src.get("HERDR_SOCKET_PATH") or "").strip()
+    parts = sock.split("/")
+    if len(parts) >= 4 and parts[-1] == "herdr.sock":
+        if parts[-3:-1] == [".config", "herdr"]:
+            return "default"
+        if len(parts) >= 5 and parts[-4:-2] == ["herdr", "sessions"] and parts[-5] == ".config":
+            return parts[-2]
+    return ""
+
+
 def scoped_env(session=None, environ=None):
     """The environment for a wait aimed at `session`.
 
     Unchanged unless this process runs inside a pane of another server: only
     then are the caller's own workspace/pane/tab ids meaningless for the call
-    and dropped. No pane (no HERDR_SESSION) and same-server keep every value.
+    and dropped. No pane and same-server keep every value.
     """
     src = os.environ if environ is None else environ
-    caller = (src.get("HERDR_SESSION") or "").strip()
+    caller = caller_server(src)
     target = (session or "").strip()
     # `default` is the same sentinel build_argv reads: no --session flag, so
     # herdr answers on the ambient server - the caller's own.