Fleet thin client — Slice 2: proxy /amicode/* to the host (host owns all state) #1262

Acceptance Criteria

• On a fleet client, a registered /amicode/* path (GET /amicode/problems, profile / catalog / runs) returns the host's state, not the client's local ~/.amico — proving the exact-match table (server.ts:235) no longer shadows the proxy in fleet mode.
• A credential/solver MUTATION (POST /amicode/connections, solver-mode) issued from the client lands on the host and is accepted (the host's amicode_service binds loopback, so the mutation guard passes).
• Proxied /amicode/* non-GETs resolve through the write-failure contract (delivered / failed / ambiguous) with an /amicode/*-appropriate refetch (not the session-shaped one), never a raw proxy that hides a partial write.
• Multi-client concurrency: with ≥2 clients mutating the same host /amicode/* resource, the defined policy holds (one-writer or last-write-wins with a stated lost-update rule) — a two-client concurrent-POST test asserts no interleaved partial write.
• Standalone (non-fleet) behavior is unchanged: /amicode/* still served locally.

Testing Decisions

• Extend Fleet thin client — Slice 1: client relay skeleton (local UI + engine proxy + inject-auth, reload-tolerant) #1261's stub-host relay test: a registered /amicode/* GET proxies to the host; a mutation is accepted host-side (loopback); standalone still serves /amicode/* locally (no regression).
• New: a two-client concurrent-mutation test for the concurrency contract.

Key Decisions

• Fleet mode bypasses the entire local /amicode/* dispatch (exact-match table + catch-all), not just the :247 precedence — the exact-match table is why a bare :247 flip is insufficient.
• Host owns all /amicode/* state; the client proxies in fleet mode only.
• Mutation safety: the host's loopback bind satisfies the guard. (Note: today connections.ts's own setBindHostname is never wired — only bind_host.ts's is — so the connections guard currently passes via the unset/loopback default; wire it at listen or explicitly state the SSH mesh is the boundary.)
• Concurrency: choose and state the policy (one-writer vs last-write-wins) for shared host /amicode/* files.

Constraints & Invariants

• Loopback-only mutation guard (ADR 0002) holds — the host bind stays loopback.
• Standalone path untouched.

Prior Art

• The /amicode/* exact-match route table (server.ts:235) + the :247 catch-all + the fleet routing branch (:262).
• The fleet write-failure contract (fleet_writes.ts, session-shaped deriveRefetchPath).
• The bind-host loopback allowlist + connections.ts's unwired setBindHostname.

Source

• Part of PRD: Fleet thin client — local shell, remote data #792; Amendment A + F14.
• Blocked by Fleet thin client — Slice 1: client relay skeleton (local UI + engine proxy + inject-auth, reload-tolerant) #1261.