CB-585: maxLoad: 0 caps a profile at zero, negative refused at load

bridged/src/test/java/dev/ltms/bridged/config/BridgedConfigTest.java

@@ -1257,6 +1257,44 @@ class BridgedConfigTest {
         assertEquals(0.0f, w.weight(), 0.0001f, "a negative weight behaves as excluded (0), not as an error and not as 1.0");
     }
 
+    @Test
+    void explicitMaxLoadZeroStaysZeroInsteadOfCoercingToUnlimited(@TempDir Path dir) throws Exception {
+        // CB-585: maxLoad: 0 used to be normalised to null (unlimited) by this same compact
+        // constructor, so an operator writing it to mean "never run anything here" got the exact
+        // opposite. On a subscription: true profile, maxLoad is the only throttle against the
+        // operator's own paid plan.
+        Path f = dir.resolve("maxload-zero.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  opus:
+                    baseUrl: http://gx10.gw:8000
+                    maxLoad: 0
+                """);
+
+        BridgedConfig cfg = BridgedConfig.load(f);
+        BridgedConfig.Profile w = cfg.profiles().get("opus");
+        assertEquals(0, w.maxLoad(), "an explicit maxLoad: 0 must stay 0, not coerce to unlimited (null)");
+    }
+
+    @Test
+    void negativeMaxLoadIsRefusedAtLoadNamingTheProfileAndKey(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("maxload-negative.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  opus:
+                    baseUrl: http://gx10.gw:8000
+                    maxLoad: -2
+                """);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class, () -> BridgedConfig.load(f));
+        assertTrue(e.getMessage().contains("opus"), "error names the profile: " + e.getMessage());
+        assertTrue(e.getMessage().contains("maxLoad"), "error names the key: " + e.getMessage());
+    }
+
     @Test
     void subscriptionFlagBindsAndDefaultsFalse(@TempDir Path dir) throws Exception {
         Path f = dir.resolve("subscription.yaml");

bridged/src/test/java/dev/ltms/bridged/member/CompositePeerLauncherTest.java

@@ -473,6 +473,27 @@ class CompositePeerLauncherTest {
         assertEquals("a", h.profile(), "a profile with no maxLoad is never capped, however many live workers");
     }
 
+    @Test
+    void explicitSpawnOnMaxLoadZeroProfileIsRefusedEvenWithZeroLiveWorkers() {
+        // CB-585: before the fix, maxLoad: 0 normalised to null (unlimited) in the compact
+        // constructor, so this exact case — naming a zero-cap profile explicitly, with nothing
+        // live on it yet — would have spawned instead of refusing. "at most zero members" must
+        // hold even when the profile is named directly, not only against automatic placement.
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, BridgedConfig.Profile> profiles = ordered(
+                "a", stubWorker("a", 1.0f, 0),
+                "b", stubWorker("b"));
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of());
+        CompositePeerLauncher composite = new CompositePeerLauncher(
+                List.of(adapter), "a", profiles, PlacementPolicies.fixed(), _ -> 0);
+
+        PlacementException e = assertThrows(PlacementException.class,
+                () -> composite.spawn(new SpawnRequest("a", null, null)));
+        assertTrue(e.getMessage().contains("'a'"), "message names the profile: " + e.getMessage());
+        assertTrue(e.getMessage().contains("0 cap"), "message names the zero cap: " + e.getMessage());
+        assertEquals(0, adapter.spawnCount("a"), "a maxLoad: 0 profile accepts no explicit spawn");
+    }
+
     @Test
     void emptyCandidateSetThrowsClearException() {
         FakeHerdr herdr = new FakeHerdr();

bridged/src/test/java/dev/ltms/bridged/placement/PlacementPolicyTest.java

@@ -340,4 +340,31 @@ class PlacementPolicyTest {
     void unknownPolicyNameThrows() {
         assertThrows(IllegalArgumentException.class, () -> PlacementPolicies.fromName("random"));
     }
+
+    // --- CB-585: maxLoad 0 caps a profile at zero live members, even with nothing live yet -----
+
+    @Test
+    void weightedSkipsMaxLoadZeroProfileEvenWithZeroLiveWorkers() {
+        PlacementPolicy policy = PlacementPolicies.weighted();
+        List<PlacementCandidate> candidates = List.of(
+                PlacementCandidate.profile("a", 1.0f, 0),
+                PlacementCandidate.profile("b", 1.0f, null));
+        Function<String, Integer> liveCount = _ -> 0;
+        for (int i = 0; i < 5; i++) {
+            assertEquals("b", policy.select(ctx(candidates, liveCount)).profile(),
+                    "a has maxLoad 0, so it is already at its cap with nobody live — every pick lands on b");
+        }
+    }
+
+    @Test
+    void weightedThrowsWhenAllMaxLoadZero() {
+        PlacementPolicy policy = PlacementPolicies.weighted();
+        List<PlacementCandidate> candidates = List.of(
+                PlacementCandidate.profile("a", 1.0f, 0),
+                PlacementCandidate.profile("b", 1.0f, 0));
+        Function<String, Integer> liveCount = _ -> 0;
+        PlacementException e = assertThrows(PlacementException.class,
+                () -> policy.select(ctx(candidates, liveCount)));
+        assertTrue(e.getMessage().contains("maxLoad"), e.getMessage());
+    }
 }