Merge CB-579: resolve a lead by its tab name, drop the terminal-id pin

Verified by the lead: merged onto main (9088d2b) in a scratch worktree, mvn -f bridged/pom.xml
clean install unpiped — MVN_EXIT=0, Tests run: 696, Failures: 0, BUILD SUCCESS. main alone measures
692, so this adds 4 net tests. Merges cleanly; Bridged.java auto-merged against CB-580.

Reviewed by the lead reading the full production diff and the three test files. The member's own
report was lost to the idle reaper before collection, so there was no author write-up.

Closes the live bug: LeadTabScanner.scan() no longer merges the config pin over the scan result, and
the cache no longer seeds from it, so a lead disappears once its tab is gone. The ghost this fixes
had begun throwing agent_not_found from ReplyPushLoop.decide on every tick, against a dead terminal
that still owned two live members.

Beyond the brief, and correct: `tab` is required for every leader, not only non-creatable ones,
because LeadLauncher also uses it to label a tab it creates. terminal: is rejected by a raw-YAML
check rather than by record shape — the only way to beat @JsonIgnoreProperties(ignoreUnknown = true).
The silent-default trap is avoided: the back-compat constructor still takes `tab` positionally.

Behaviour change worth knowing: the scanner's initial cache is now empty instead of the config pins,
so a herdr failure on the very first scan yields no leads until a scan succeeds. That is unavoidable
once the pins are gone, it fails loudly rather than silently, and it is covered by
aFailedFirstScanReturnsEmptyRatherThanThrowing.

Operator action required: bridged.yaml must replace fleet.leaders.<name>.terminal with tab. Already
done for this deployment.

bridged/src/test/java/dev/ltms/bridged/config/BridgedConfigTest.java

@@ -194,7 +194,7 @@ class BridgedConfigTest {
                 fleet:
                   leaders:
                     opus:
-                      terminal: term_opus
+                      tab: "lead: opus"
                 """);
 
         BridgedConfig.Leader lead = BridgedConfig.load(f).fleet().leaders().get("opus");
@@ -212,7 +212,7 @@ class BridgedConfigTest {
                 fleet:
                   leaders:
                     opus:
-                      terminal: term_opus
+                      tab: "drive: opus"
                       tabPrefix: "drive:"
                       scanIntervalSeconds: 30
                 """);
@@ -224,7 +224,9 @@ class BridgedConfigTest {
 
     /**
      * The pane no longer has to exist before the daemon does (CB-557): a lead naming a profile may
-     * be launched, while one that names only a terminal is recognised and never created.
+     * be launched, while one that names no profile is recognised and never created. Either way it
+     * still needs its own {@code tab:} (CB-579) — that part is unconditional, see
+     * {@link #aLeadWithNoTabRefusesToStart}.
      */
     @Test
     void aLeadIsCreatableOnlyWhenItNamesAProfile(@TempDir Path dir) throws Exception {
@@ -239,8 +241,9 @@ class BridgedConfigTest {
                   leaders:
                     launched:
                       profile: opus
+                      tab: "lead: launched"
                     pinned:
-                      terminal: term_opus
+                      tab: "lead: pinned"
                 """);
 
         var leaders = BridgedConfig.load(f).fleet().leaders();
@@ -249,8 +252,12 @@ class BridgedConfigTest {
                 "no profile to launch on ⇒ recognise-only, the pre-CB-557 behaviour");
     }
 
+    /**
+     * CB-579: {@code tab} is the only field a lead's identity depends on now, so it is required
+     * whether the entry is creatable or recognise-only — without it the entry can never be found.
+     */
     @Test
-    void aLeadThatCanBeNeitherFoundNorCreatedRefusesToStart(@TempDir Path dir) throws Exception {
+    void aLeadWithNoTabRefusesToStart(@TempDir Path dir) throws Exception {
         Path f = dir.resolve("useless-lead.yaml");
         Files.writeString(f, """
                 bind:
@@ -264,6 +271,80 @@ class BridgedConfigTest {
 
         IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateMembers);
         assertTrue(e.getMessage().contains("ghost"), "the message must name the useless entry");
+        assertTrue(e.getMessage().contains("tab:"), "the message must say what is missing");
+    }
+
+    /**
+     * CB-579 acceptance (2): a config still spelling {@code fleet.leaders.<name>.terminal} must fail
+     * loudly at load, not be silently dropped by {@code Leader}'s {@code @JsonIgnoreProperties}.
+     */
+    @Test
+    void aLeaderTerminalKeyFailsLoadAndNamesTabAsTheReplacement(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("stale-terminal.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  leaders:
+                    opus:
+                      terminal: term_opus
+                """);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, () -> BridgedConfig.load(f));
+        assertTrue(e.getMessage().contains("opus"), "the message must name the offending entry");
+        assertTrue(e.getMessage().contains("tab:"), "the message must name the replacement key");
+        assertTrue(e.getMessage().contains("terminal"), "the message must name the retired key");
+    }
+
+    /** The same refusal, and it must name every offending entry, not just the first. */
+    @Test
+    void everyLeaderStillUsingTerminalIsReportedAtOnce(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("stale-terminals.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  leaders:
+                    opus:
+                      terminal: term_opus
+                    sol:
+                      terminal: term_sol
+                """);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, () -> BridgedConfig.load(f));
+        assertTrue(e.getMessage().contains("opus"));
+        assertTrue(e.getMessage().contains("sol"));
+    }
+
+    /** A {@code terminal:} anywhere else in the document (not under a leader entry) is unaffected. */
+    @Test
+    void aTerminalKeyOutsideFleetLeadersIsNotRejected(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("primary-terminal-ok.yaml");
+        Files.writeString(f, "bind:\n  port: 8080\nprimary:\n  terminal: term_fixed\n");
+
+        assertDoesNotThrow(() -> BridgedConfig.load(f));
+    }
+
+    /** CB-579 acceptance (3): distinct `tab:` labels need no shared prefix — one scanner finds both. */
+    @Test
+    void twoLeadersWithDifferentTabsAreBothConfigured(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("two-tabs.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                    sol:
+                      tab: "captain: sol"
+                """);
+
+        var leaders = BridgedConfig.load(f).fleet().leaders();
+        assertEquals("lead: opus", leaders.get("opus").tab());
+        assertEquals("captain: sol", leaders.get("sol").tab());
     }
 
     // ── CB-551: the idle-lead heartbeat ─────────────────────────────────────────────────────────
@@ -328,7 +409,7 @@ class BridgedConfigTest {
                 fleet:
                   leaders:
                     opus:
-                      terminal: term_opus
+                      tab: "lead: opus"
                       tabPrefix: "lead:"
                 """);
         BridgedConfig cfg = BridgedConfig.load(f);
@@ -349,7 +430,7 @@ class BridgedConfigTest {
                   tabLabel: "lead: {role} {profile}"
                   leaders:
                     opus:
-                      terminal: term_opus
+                      tab: "lead: opus"
                 """);
         BridgedConfig cfg = BridgedConfig.load(f);
 
@@ -374,7 +455,7 @@ class BridgedConfigTest {
                 fleet:
                   leaders:
                     opus:
-                      terminal: term_opus
+                      tab: "lead: opus"
                 """);
 
         assertDoesNotThrow(() -> BridgedConfig.load(f).validateLeadTabPrefixes());
@@ -400,7 +481,7 @@ class BridgedConfigTest {
                 "a label that collides with a convention nobody reads is not a problem");
     }
 
-    // ── CB-530: the leaders registry ────────────────────────────────────────────────────────────
+    // ── CB-530/CB-579: the leaders registry ─────────────────────────────────────────────────────
 
     @Test
     void leadersBlockRegistersEveryPaneByName(@TempDir Path dir) throws Exception {
@@ -411,10 +492,10 @@ class BridgedConfigTest {
                 fleet:
                   leaders:
                     opus-5.0:
-                      terminal: term_opus
+                      tab: "lead: opus-5.0"
                       kind: claude
                     gpt-sol-5.6:
-                      terminal: term_sol
+                      tab: "lead: gpt-sol-5.6"
                       kind: opencode
                       model: openai/gpt-5.6-terra
                 """);
@@ -425,9 +506,9 @@ class BridgedConfigTest {
         assertEquals(Set.of("opus-5.0", "gpt-sol-5.6"), leaders.keySet());
         assertEquals("opencode", leaders.get("gpt-sol-5.6").kind());
         assertEquals("openai/gpt-5.6-terra", leaders.get("gpt-sol-5.6").model());
-        // The whole point: BOTH panes resolve as leads, so neither is demoted to worker.
-        assertEquals(Map.of("term_opus", "opus-5.0", "term_sol", "gpt-sol-5.6"),
-                cfg.leaderTerminals());
+        // Identity is the tab now (CB-579) — both entries carry their own, distinct label.
+        assertEquals("lead: opus-5.0", leaders.get("opus-5.0").tab());
+        assertEquals("lead: gpt-sol-5.6", leaders.get("gpt-sol-5.6").tab());
     }
 
     @Test
@@ -439,42 +520,6 @@ class BridgedConfigTest {
                 "configs that never migrate must behave exactly as they did before CB-530");
     }
 
-    @Test
-    void anExplicitLeadersEntryWinsOverThePinForTheSameTerminal(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("both.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                primary:
-                  terminal: term_shared
-                fleet:
-                  leaders:
-                    opus-5.0:
-                      terminal: term_shared
-                """);
-
-        assertEquals(Map.of("term_shared", "opus-5.0"), BridgedConfig.load(f).leaderTerminals(),
-                "the pin is the older spelling of the same fact; the named entry is what was meant");
-    }
-
-    @Test
-    void bothBlocksTogetherRegisterTheUnionOfTheirTerminals(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("union.yaml");
-        Files.writeString(f, """
-                bind:
-                  port: 8080
-                primary:
-                  terminal: term_pinned
-                fleet:
-                  leaders:
-                    gpt-sol-5.6:
-                      terminal: term_sol
-                """);
-
-        assertEquals(Map.of("term_pinned", "primary", "term_sol", "gpt-sol-5.6"),
-                BridgedConfig.load(f).leaderTerminals());
-    }
-
     @Test
     void neitherBlockLeavesNothingRegistered(@TempDir Path dir) throws Exception {
         Path f = dir.resolve("none.yaml");
@@ -483,22 +528,25 @@ class BridgedConfigTest {
         assertTrue(BridgedConfig.load(f).leaderTerminals().isEmpty());
     }
 
-    /** A lead entry with no terminal identifies nothing — it must not register a null key. */
+    /**
+     * CB-579: {@code fleet.leaders} no longer feeds {@code leaderTerminals()} at all — a lead's
+     * identity comes from the live tab scan, not a config-held terminal map. This method now exists
+     * only for the {@code primary.terminal} fallback.
+     */
     @Test
-    void aLeadWithoutATerminalIsNotRegistered(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("no-terminal.yaml");
+    void fleetLeadersNeverContributesToLeaderTerminals(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("leaders-only.yaml");
         Files.writeString(f, """
                 bind:
                   port: 8080
                 fleet:
                   leaders:
-                    sketch:
-                      kind: opencode
-                    real:
-                      terminal: term_real
+                    opus-5.0:
+                      tab: "lead: opus-5.0"
                 """);
 
-        assertEquals(Map.of("term_real", "real"), BridgedConfig.load(f).leaderTerminals());
+        assertTrue(BridgedConfig.load(f).leaderTerminals().isEmpty(),
+                "no primary.terminal pin ⇒ nothing registered, even with fleet.leaders configured");
     }
 
     // ── CB-548: the architects registry ────────────────────────────────────────────────────────

bridged/src/test/java/dev/ltms/bridged/herdr/LeadTabScannerTest.java

@@ -15,8 +15,9 @@ import java.util.concurrent.atomic.AtomicLong;
 import static org.junit.jupiter.api.Assertions.*;
 
 /**
- * CB-531. A lead is never spawned, so the daemon has to <em>find</em> it: these assert that an
- * operator-labelled tab is what makes a pane a lead, and — just as importantly — what does not.
+ * CB-531/CB-579. A lead is never spawned, so the daemon has to <em>find</em> it: these assert that
+ * an operator-labelled tab matching a configured {@code tab:} is what makes a pane a lead, and —
+ * just as importantly — what does not, and that a stale entry does not linger forever.
  */
 class LeadTabScannerTest {
 
@@ -120,23 +121,48 @@ class LeadTabScannerTest {
                 .pane("w9:p1", "w9:t1", "term_worker");
     }
 
-    private LeadTabScanner scanner(TopologyHerdr herdr, Map<String, String> configured,
+    /** The {@code tab:} → name map {@code twoLeads()}'s two lead tabs are configured under. */
+    private static Map<String, String> twoLeadsConfigured() {
+        return Map.of("lead: opus-5.0", "opus-5.0", "lead: gpt-sol-5.6", "gpt-sol-5.6");
+    }
+
+    private LeadTabScanner scanner(TopologyHerdr herdr, Map<String, String> tabToName,
                                    AtomicLong clock) {
-        return new LeadTabScanner(herdr, "lead:", Set.of("bridged-workers"), configured, TTL,
-                clock::get);
+        return new LeadTabScanner(herdr, tabToName, Set.of("bridged-workers"), TTL, clock::get);
     }
 
     @Test
-    void everyLabelledTabBecomesALeadNamedByItsLabel() {
-        Map<String, String> leads = scanner(twoLeads(), Map.of(), new AtomicLong()).get();
+    void everyConfiguredTabBecomesALeadNamedByItsEntry() {
+        Map<String, String> leads = scanner(twoLeads(), twoLeadsConfigured(), new AtomicLong()).get();
 
         assertEquals(Map.of("term_opus", "opus-5.0", "term_gpt", "gpt-sol-5.6"), leads,
-                "two leads discovered from labels alone — no terminal_id was ever configured");
+                "two leads discovered by their configured tab — no terminal_id was ever configured");
     }
 
     @Test
-    void anUnlabelledTabContributesNothing() {
-        assertFalse(scanner(twoLeads(), Map.of(), new AtomicLong()).get().containsKey("term_notes"));
+    void anUnconfiguredTabContributesNothing() {
+        assertFalse(scanner(twoLeads(), twoLeadsConfigured(), new AtomicLong())
+                .get().containsKey("term_notes"));
+    }
+
+    /**
+     * CB-579: matching is exact against the configured map now, not a shared prefix — two leads with
+     * completely different labels are both discovered by one scanner, no convention required.
+     */
+    @Test
+    void twoLeadsWithCompletelyDifferentLabelsAreBothDiscovered() {
+        TopologyHerdr herdr = new TopologyHerdr()
+                .workspace("w1", "main")
+                .tab("w1:t1", "w1", "orchestrator: opus")
+                .tab("w1:t2", "w1", "captain: sol")
+                .pane("w1:p1", "w1:t1", "term_opus")
+                .pane("w1:p2", "w1:t2", "term_sol");
+        Map<String, String> tabToName = Map.of("orchestrator: opus", "opus", "captain: sol", "sol");
+
+        Map<String, String> leads = scanner(herdr, tabToName, new AtomicLong()).get();
+
+        assertEquals(Map.of("term_opus", "opus", "term_sol", "sol"), leads,
+                "no shared prefix needed — each lead is matched by its own configured tab");
     }
 
     /**
@@ -148,25 +174,28 @@ class LeadTabScannerTest {
     void aTabInAWorkerSpaceIsNeverALeadEvenWhenItsLabelMatches() {
         TopologyHerdr herdr = twoLeads().tab("w9:t2", "w9", "lead: impostor")
                 .pane("w9:p2", "w9:t2", "term_impostor");
+        Map<String, String> tabToName = new LinkedHashMap<>(twoLeadsConfigured());
+        tabToName.put("lead: impostor", "impostor");
 
-        assertFalse(scanner(herdr, Map.of(), new AtomicLong()).get().containsKey("term_impostor"));
+        assertFalse(scanner(herdr, tabToName, new AtomicLong()).get().containsKey("term_impostor"));
     }
 
     @Test
-    void aBarePrefixNamesNobodyAndIsRejected() {
+    void aLabelWithNoConfiguredEntryIsIgnored() {
         TopologyHerdr herdr = new TopologyHerdr().workspace("w1", "main")
-                .tab("w1:t1", "w1", "lead:").pane("w1:p1", "w1:t1", "term_a");
+                .tab("w1:t1", "w1", "lead: nobody-configured").pane("w1:p1", "w1:t1", "term_a");
 
-        assertEquals(Map.of(), scanner(herdr, Map.of(), new AtomicLong()).get(),
-                "a lead with no name would resolve as PRIMARY with nothing to attribute it to");
+        assertEquals(Map.of(), scanner(herdr, twoLeadsConfigured(), new AtomicLong()).get(),
+                "a label that names no configured lead resolves nobody");
     }
 
     @Test
-    void thePrefixMatchesCaseInsensitivelyAndTheNameIsTrimmed() {
+    void matchingIsCaseInsensitiveAndToleratesSurroundingWhitespace() {
         TopologyHerdr herdr = new TopologyHerdr().workspace("w1", "main")
-                .tab("w1:t1", "w1", "  LEAD:   opus-5.0  ").pane("w1:p1", "w1:t1", "term_a");
+                .tab("w1:t1", "w1", "  LEAD: Opus-5.0  ").pane("w1:p1", "w1:t1", "term_a");
 
-        assertEquals(Map.of("term_a", "opus-5.0"), scanner(herdr, Map.of(), new AtomicLong()).get());
+        assertEquals(Map.of("term_a", "opus-5.0"),
+                scanner(herdr, Map.of("lead: Opus-5.0", "opus-5.0"), new AtomicLong()).get());
     }
 
     @Test
@@ -175,18 +204,51 @@ class LeadTabScannerTest {
         // nothing bridged placed can land here (see the worker-space test above).
         TopologyHerdr herdr = twoLeads().pane("w1:p1b", "w1:t1", "term_opus_split");
 
-        assertEquals("opus-5.0", scanner(herdr, Map.of(), new AtomicLong()).get().get("term_opus_split"));
+        assertEquals("opus-5.0",
+                scanner(herdr, twoLeadsConfigured(), new AtomicLong()).get().get("term_opus_split"));
     }
 
+    /**
+     * CB-579 acceptance (6): this is the bug the ticket closes. A stale pin used to be merged back
+     * over every scan and never expire; now a scan is the whole answer, so a lead whose tab is gone
+     * drops out on the very next scan.
+     */
     @Test
-    void anExplicitlyConfiguredLeadIsMergedInAndOutranksALabel() {
-        Map<String, String> configured = Map.of("term_opus", "pinned-name", "term_extra", "from-config");
+    void aTabNoLongerPresentDropsTheLeadOnTheNextScan() {
+        TopologyHerdr herdr = twoLeads();
+        AtomicLong clock = new AtomicLong();
+        LeadTabScanner s = scanner(herdr, twoLeadsConfigured(), clock);
+        assertTrue(s.get().containsKey("term_opus"));
 
-        Map<String, String> leads = scanner(twoLeads(), configured, new AtomicLong()).get();
+        // The session behind term_opus restarted — herdr no longer reports that tab or pane at all.
+        herdr.tabs.remove("w1:t1");
+        herdr.panes.remove("w1:p1");
+        clock.addAndGet(TTL);
 
-        assertEquals("pinned-name", leads.get("term_opus"), "an explicit pin is the operator's last word");
-        assertEquals("from-config", leads.get("term_extra"), "a configured lead needs no tab at all");
-        assertEquals("gpt-sol-5.6", leads.get("term_gpt"));
+        assertFalse(s.get().containsKey("term_opus"),
+                "a stale entry must expire once the tab it named is gone, not be merged back forever");
+    }
+
+    /**
+     * CB-579 acceptance (5): the whole point of matching by tab instead of {@code terminal_id} — a
+     * restart changes the terminal, not the tab, so the lead resolves under the same name with no
+     * config edit.
+     */
+    @Test
+    void aLeadRestartingInTheSameTabResolvesUnderTheSameName() {
+        TopologyHerdr herdr = twoLeads();
+        AtomicLong clock = new AtomicLong();
+        LeadTabScanner s = scanner(herdr, twoLeadsConfigured(), clock);
+        assertEquals("opus-5.0", s.get().get("term_opus"));
+
+        // The session restarts: herdr assigns the pane a new terminal_id, same tab (w1:t1).
+        herdr.panes.remove("w1:p1");
+        herdr.pane("w1:p1", "w1:t1", "term_opus_v2");
+        clock.addAndGet(TTL);
+
+        Map<String, String> leads = s.get();
+        assertEquals("opus-5.0", leads.get("term_opus_v2"), "the new terminal resolves immediately");
+        assertFalse(leads.containsKey("term_opus"), "the old terminal_id is simply gone, not carried");
     }
 
     // ── caching ─────────────────────────────────────────────────────────────────────────────────
@@ -195,7 +257,7 @@ class LeadTabScannerTest {
     void aSecondLookupWithinTheTtlDoesNotTouchHerdr() {
         TopologyHerdr herdr = twoLeads();
         AtomicLong clock = new AtomicLong();
-        LeadTabScanner s = scanner(herdr, Map.of(), clock);
+        LeadTabScanner s = scanner(herdr, twoLeadsConfigured(), clock);
 
         s.get();
         int afterFirst = herdr.calls;
@@ -210,21 +272,23 @@ class LeadTabScannerTest {
     void aTabLabelledAfterStartupIsPickedUpOnceTheTtlExpires() {
         TopologyHerdr herdr = twoLeads();
         AtomicLong clock = new AtomicLong();
-        LeadTabScanner s = scanner(herdr, Map.of(), clock);
+        Map<String, String> tabToName = new LinkedHashMap<>(twoLeadsConfigured());
+        tabToName.put("lead: late-arrival", "late-arrival");
+        LeadTabScanner s = scanner(herdr, tabToName, clock);
         assertFalse(s.get().containsKey("term_notes"));
 
         herdr.tab("w1:t3", "w1", "lead: late-arrival"); // the operator renames their tab
         clock.addAndGet(TTL);
 
         assertEquals("late-arrival", s.get().get("term_notes"),
-                "the whole point over `leaders:`: no config edit, no restart");
+                "the whole point over a config-held terminal_id: no config edit, no restart");
     }
 
     @Test
     void aFailedScanKeepsTheLeadsAlreadyKnownRatherThanDemotingThem() {
         TopologyHerdr herdr = twoLeads();
         AtomicLong clock = new AtomicLong();
-        LeadTabScanner s = scanner(herdr, Map.of(), clock);
+        LeadTabScanner s = scanner(herdr, twoLeadsConfigured(), clock);
         Map<String, String> before = s.get();
 
         herdr.failing = true;
@@ -235,14 +299,14 @@ class LeadTabScannerTest {
     }
 
     @Test
-    void aFailedFirstScanStillHonoursTheConfiguredLeads() {
+    void aFailedFirstScanReturnsEmptyRatherThanThrowing() {
         TopologyHerdr herdr = twoLeads();
         herdr.failing = true;
 
-        Map<String, String> leads = scanner(herdr, Map.of("term_x", "opus-5.0"), new AtomicLong()).get();
+        Map<String, String> leads = scanner(herdr, twoLeadsConfigured(), new AtomicLong()).get();
 
-        assertEquals(Map.of("term_x", "opus-5.0"), leads,
-                "config-named leads must not depend on herdr answering at all");
+        assertEquals(Map.of(), leads,
+                "with nothing scanned yet and no override to fall back on, the map is simply empty");
     }
 
     @Test
@@ -250,7 +314,7 @@ class LeadTabScannerTest {
         TopologyHerdr herdr = twoLeads();
         herdr.failing = true;
         AtomicLong clock = new AtomicLong();
-        LeadTabScanner s = scanner(herdr, Map.of(), clock);
+        LeadTabScanner s = scanner(herdr, twoLeadsConfigured(), clock);
 
         s.get();
         int afterFirst = herdr.calls;

bridged/src/test/java/dev/ltms/bridged/lead/LeadLauncherTest.java

@@ -41,8 +41,8 @@ class LeadLauncherTest {
                 null, null, fleet, null, "fixed", null).withDefaults();
     }
 
-    private static BridgedConfig.Leader lead(String profile, String terminal, int instances) {
-        return new BridgedConfig.Leader(profile, terminal, instances, "lead:", 10, null, null,
+    private static BridgedConfig.Leader lead(String profile, String tab, int instances) {
+        return new BridgedConfig.Leader(profile, tab, instances, "lead:", 10, null, null,
                 "leads", "/repo");
     }
 
@@ -70,16 +70,16 @@ class LeadLauncherTest {
     void startsTheDeclaredLeadWhenNoneIsRunning() {
         FakeHerdr herdr = new FakeHerdr();
 
-        assertEquals(1, launcher(herdr, configWith(lead("opus", null, 1))).ensureLeads());
+        assertEquals(1, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads());
         assertTrue(herdr.called("agent.start"), "a lead must actually be started");
         assertEquals("lead-opus", startedName(herdr));
     }
 
-    /** The tab is labelled so the scanner finds the lead on the next resolve. */
+    /** The tab is labelled with the configured `tab:` so the scanner finds the lead on the next resolve. */
     @Test
-    void labelsTheTabWithThePrefixTheScannerReadsBack() {
+    void labelsTheTabWithTheConfiguredTabValue() {
         FakeHerdr herdr = new FakeHerdr();
-        launcher(herdr, configWith(lead("opus", null, 1))).ensureLeads();
+        launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads();
 
         assertEquals("lead: opus",
                 ((Map<?, ?>) herdr.lastCall("tab.rename").params()).get("label"));
@@ -90,7 +90,7 @@ class LeadLauncherTest {
     void startsAsManyInstancesAsAreDeclared() {
         FakeHerdr herdr = new FakeHerdr();
 
-        assertEquals(2, launcher(herdr, configWith(lead("opus", null, 2))).ensureLeads());
+        assertEquals(2, launcher(herdr, configWith(lead("opus", "lead: opus", 2))).ensureLeads());
         assertEquals(2, herdr.calls.stream().filter(c -> c.method().equals("agent.start")).count());
     }
 
@@ -104,7 +104,7 @@ class LeadLauncherTest {
                 .withTab("wL", "wL:t1", "lead: opus")
                 .withAgent("lead-opus", "term_lead", "wL:p1", "wL:t1");
 
-        assertEquals(0, launcher(herdr, configWith(lead("opus", null, 1))).ensureLeads());
+        assertEquals(0, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads());
         assertFalse(herdr.called("agent.start"), "the live lead must not be duplicated");
     }
 
@@ -118,20 +118,23 @@ class LeadLauncherTest {
                 .withWorkspace("wL", "leads")
                 .withTab("wL", "wL:t1", "lead: opus"); // label only — nothing running in it
 
-        assertEquals(1, launcher(herdr, configWith(lead("opus", null, 1))).ensureLeads(),
+        assertEquals(1, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads(),
                 "a stale label is not a lead; the lead must be relaunched");
     }
 
     /**
-     * A lead the operator opened by hand and pinned with `terminal:` is live even though its tab
-     * carries no matching label. Counting labels alone would relaunch it on every boot.
+     * A lead the operator opened by hand is live once its tab carries the configured `tab:` label —
+     * CB-579 retired the `terminal:` pin, so a hand-opened lead is found the same way an
+     * auto-launched one is, by its tab, not by a terminal id nobody wrote down in advance.
      */
     @Test
-    void aPinnedTerminalWithARunningAgentCountsAsLive() {
+    void aHandOpenedLeadWithTheConfiguredTabLabelCountsAsLive() {
         FakeHerdr herdr = new FakeHerdr()
-                .withAgent("hand-opened", "term_pinned", "wX:p1", "wX:t1");
+                .withWorkspace("wX", "main")
+                .withTab("wX", "wX:t1", "lead: opus")
+                .withAgent("hand-opened", "term_hand", "wX:p1", "wX:t1");
 
-        assertEquals(0, launcher(herdr, configWith(lead("opus", "term_pinned", 1))).ensureLeads());
+        assertEquals(0, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads());
         assertFalse(herdr.called("agent.start"));
     }
 
@@ -143,7 +146,7 @@ class LeadLauncherTest {
                 .withTab("wM", "wM:t1", "lead: opus")              // a member tab that looks like a lead
                 .withAgent("claude-opus-x", "term_m", "wM:p1", "wM:t1");
 
-        assertEquals(1, launcher(herdr, configWith(lead("opus", null, 1))).ensureLeads(),
+        assertEquals(1, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads(),
                 "a member in a lead-labelled tab is not a lead, so the real lead is still missing");
     }
 
@@ -152,7 +155,7 @@ class LeadLauncherTest {
     void anUncountableHerdrStartsNothing() {
         FakeHerdr herdr = new FakeHerdr().healthy(false);
 
-        assertEquals(0, launcher(herdr, configWith(lead("opus", null, 1))).ensureLeads());
+        assertEquals(0, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads());
         assertFalse(herdr.called("agent.start"));
     }
 
@@ -166,7 +169,7 @@ class LeadLauncherTest {
     @Test
     void theLeadNeverReceivesTheWorkerReplyCharter() {
         FakeHerdr herdr = new FakeHerdr();
-        launcher(herdr, configWith(lead("opus", null, 1))).ensureLeads();
+        launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads();
 
         List<String> args = startedArgs(herdr);
         assertFalse(args.contains("--append-system-prompt"),
@@ -178,7 +181,7 @@ class LeadLauncherTest {
     @Test
     void theLeadMountsTheBridgeMcpAndPinsItsModel() {
         FakeHerdr herdr = new FakeHerdr();
-        launcher(herdr, configWith(lead("opus", null, 1))).ensureLeads();
+        launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads();
 
         List<String> args = startedArgs(herdr);
         assertTrue(args.contains("--mcp-config"));
@@ -192,7 +195,7 @@ class LeadLauncherTest {
     @Test
     void theLeadEnvCarriesNoAnthropicBinding() {
         FakeHerdr herdr = new FakeHerdr();
-        launcher(herdr, configWith(lead("opus", null, 1))).ensureLeads();
+        launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads();
 
         Map<String, String> env = tabEnv(herdr);
         assertNull(env.get("ANTHROPIC_BASE_URL"));
@@ -205,7 +208,7 @@ class LeadLauncherTest {
     @Test
     void theLeadTabIsCreatedOutsideEveryMemberWorkspace() {
         FakeHerdr herdr = new FakeHerdr();
-        launcher(herdr, configWith(lead("opus", null, 1))).ensureLeads();
+        launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads();
 
         String label = (String) ((Map<?, ?>) herdr.lastCall("workspace.create").params()).get("label");
         assertEquals("leads", label);
@@ -214,12 +217,12 @@ class LeadLauncherTest {
 
     // ── recognise-only and misconfiguration ───────────────────────────────────────────────────
 
-    /** A lead with a pin but no profile is recognise-only by design — not an error, not a launch. */
+    /** A lead with a tab but no profile is recognise-only by design — not an error, not a launch. */
     @Test
     void aLeadThatNamesNoProfileIsRecognisedButNeverLaunched() {
         FakeHerdr herdr = new FakeHerdr();
 
-        assertEquals(0, launcher(herdr, configWith(lead(null, "term_dead", 1))).ensureLeads());
+        assertEquals(0, launcher(herdr, configWith(lead(null, "lead: dead", 1))).ensureLeads());
         assertFalse(herdr.called("agent.start"));
     }
 
@@ -228,7 +231,7 @@ class LeadLauncherTest {
     void zeroInstancesLaunchesNothing() {
         FakeHerdr herdr = new FakeHerdr();
 
-        assertEquals(0, launcher(herdr, configWith(lead("opus", null, 0))).ensureLeads());
+        assertEquals(0, launcher(herdr, configWith(lead("opus", "lead: opus", 0))).ensureLeads());
         assertFalse(herdr.called("agent.start"));
     }
 
@@ -237,7 +240,7 @@ class LeadLauncherTest {
     void anUnknownProfileIsSkippedRatherThanThrown() {
         FakeHerdr herdr = new FakeHerdr();
 
-        assertEquals(0, launcher(herdr, configWith(lead("nope", null, 1))).ensureLeads());
+        assertEquals(0, launcher(herdr, configWith(lead("nope", "lead: opus", 1))).ensureLeads());
         assertFalse(herdr.called("agent.start"));
     }