CB-566: add fleet charter config

The bridge cannot classify what it never emits. Fleet-health monitoring —
detect a wedged member, decide, escalate — is blocked on that, so this is the
foundation rather than the feature.

A survey of Injector, CompletionResolver, StatusPoller, SessionManager,
SessionReaper and MessageService found six conditions that ended a member's
usefulness while saying nothing useful:

  * Injector.drop()             — worker gone, queue cleared: SILENT
  * CompletionResolver.fail()   — "via turn-stall fallback" at DEBUG, no reason
  * SessionManager.onFailed()   — "session marked failed" at DEBUG, no stage
  * SessionManager.reapIdle()   — indistinguishable from any other release
  * SessionManager.acquire()    — spawn failure rethrown with no log at all
  * MessageService.abandon()    — failed a caller's request at DEBUG

The first two are the exact phrases that misled the CB-560 diagnosis: both name
a symptom and neither names a cause. They are now WARN and carry the reason,
the stage, and the counts.

Conditions already loud were left alone, and so were two by-design timeouts in
MessageService — an async model exists precisely for those, and promoting them
would turn healthy operation into noise.

Behaviour is unchanged: every edit is a log statement.

Merge note: the recycle test deleted by CB-565 conflicted with a test added
here. Resolved by keeping the new onTurnFailed assertion and dropping the
recycle test, which tests a method that no longer exists.

bridged/bridged.example.yaml

@@ -231,8 +231,8 @@ placement: weighted
 #
 # Not every key can move under a running daemon, and the difference is about what already exists
 # when the reload happens — not about how important the key is:
-#   HOT       → takes effect on the next spawn: the whole `fleet:` block (every role pool and
-#               `tabLabel`), `placement:`, and an existing profile's weight / maxLoad. Those are
+#   HOT       → takes effect on the next spawn: the whole `fleet:` block (every role pool,
+#               `charters`, and `tabLabel`), `placement:`, and an existing profile's weight / maxLoad. Those are
 #               hot because the placement policy reads them through a supplier — being config is
 #               not by itself enough to make a key hot.
 #   DEFERRED  → accepted into the new config, but the wiring built at startup keeps the old value
@@ -274,6 +274,24 @@ placement: weighted
 # the candidates, in definition order. A dev and a reviewer staying anonymous is exactly compatible
 # with being listed here; the entry key just names the entry.
 fleet:
+  # Optional launch-charter text, keyed only by the singular role wire names: architect, dev,
+  # reviewer. Changes are HOT and reach the next spawn without a daemon restart. Do not put secrets
+  # here: a later launch step writes this text to a world-readable temp file, and ${ENV} interpolation
+  # is deliberately not supported.
+  charters:
+    architect: |-
+      You are an architect in this fleet. You refine work before anyone builds it:
+      scope, acceptance criteria, risks, and a unit split. You read the repo and
+      write analysis. You never commit production code and never open a PR.
+      A design task is worked by two architects. Design alone first, then exchange
+      and say plainly where you disagree. Do not concede just to agree.
+    dev: |-
+      You implement the one unit you were given, and nothing else. You test it,
+      commit it, and open your own pull request. You never merge.
+    reviewer: |-
+      You review the diff you were given. You report bugs, risks and missing tests.
+      You do not change code.
+
   # Optional. Template for a member tab's label; {role}, {profile}, {model} and {n} are substituted.
   # {n} counts per role+profile, so `dev: sonnet #2` really is the second sonnet dev. Because {role}
   # comes from a closed enum, a generated label can never begin with a lead's tabPrefix.

bridged/src/main/java/dev/ltms/bridged/Bridged.java

@@ -70,9 +70,6 @@ public final class Bridged {
 
     private static final Logger log = LoggerFactory.getLogger(Bridged.class);
 
-    /** How often the injector samples a busy worker's status while it has queued work. */
-    private static final long INJECT_POLL_MILLIS = 250;
-
     /** CB-504: how long to wait at startup for herdr's socket before serving degraded. */
     private static final long HERDR_WAIT_SECONDS = 30;
     private static final long HERDR_WAIT_POLL_MILLIS = 500;
@@ -99,6 +96,7 @@ public final class Bridged {
         // CB-542: a subscription:true profile whose env: reseats ANTHROPIC_BASE_URL/AUTH_TOKEN would
         // reach an unguarded endpoint (the launcher skips SubscriptionGuard for it). Refuse at load.
         cfg.validateSubscriptionProfiles();
+        cfg.validateCharters();
         // CB-548: every architect slot must name a configured workers: profile — the strong-model
         // backend the future spawn lifecycle would read. A stale reference dies here, not later.
         cfg.validateMembers();
@@ -243,6 +241,7 @@ public final class Bridged {
         // what CallerResolver resolves against and what that lifecycle will read profiles from;
         // nothing here spawns a slot.
         MemberRegistry members = new MemberRegistry(cfg.fleet());
+        sessions.setMemberLifecycle(members);
         if (!members.slots().isEmpty()) {
             log.info("member slots: {} configured {} — none bound yet (a slot is idle until the "
                             + "spawn lifecycle binds a live terminal to it)",
@@ -289,7 +288,7 @@ public final class Bridged {
         };
         Injector injector = new Injector(agents, turnListener, deliverableTo(presence, leads),
                 presence::forget);
-        StatusPoller poller = new StatusPoller(agents, injector, INJECT_POLL_MILLIS);
+        StatusPoller poller = new StatusPoller(agents, injector, Injector.POLL_INTERVAL_MILLIS);
         poller.start();
 
         // CB-307: reply inbox. A broker: block (with a uri) selects the AMQP-backed durable adapter;
@@ -375,13 +374,11 @@ public final class Bridged {
                 throw new IllegalStateException("auth.mode=token but env var " + cfg.auth().tokenEnv()
                         + " is unset or empty — export it before starting bridged");
             }
-            callers = CallerResolver.withLeadsAndMembers(identity, true, token, leads,
-                    members::snapshot);
+            callers = CallerResolver.withLeadsAndMembers(identity, true, token, leads, members);
             log.info("auth: token mode (bearer required for non-worker callers, env {})",
                     cfg.auth().tokenEnv());
         } else {
-            callers = CallerResolver.withLeadsAndMembers(identity, false, null, leads,
-                    members::snapshot);
+            callers = CallerResolver.withLeadsAndMembers(identity, false, null, leads, members);
             log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
         }
 
@@ -429,19 +426,20 @@ public final class Bridged {
     }
 
     /**
-     * The {@link Injector}'s readiness gate (CB-534): a target is deliverable if it is a worker whose
-     * agent has connected the bridge MCP, <em>or</em> a lead.
+     * The {@link Injector}'s readiness gate (CB-534): a target is deliverable if it is a spawned
+     * member whose agent has connected the bridge MCP, <em>or</em> a lead.
      *
-     * <p>The gate exists for one reason — to hold a delivery out of a <em>spawned</em> worker's boot
+     * <p>The gate exists for one reason — to hold a delivery out of a <em>spawned</em> member's boot
      * window, where herdr already reports {@code idle} but the TUI would drop an injected paste. That
      * hazard is a property of spawning. A lead is never spawned: the operator started it and named it
      * (or labelled its tab) only once it was up, so there is no boot window to guard.
      *
      * <p>A lead is also never enrolled in {@link MemberPresence} — {@code BridgeMcp} marks presence
-     * only for a worker, deliberately, since that map doubles as the worker roster's availability
-     * signal and a lead counted there would show up as an available worker. So without the second
-     * disjunct a lead is permanently un-deliverable: every lead→lead send sat on the gate for
-     * {@code READINESS_GRACE_POLLS} (~60s) and then failed having never been typed into the pane.
+     * for every spawned member (worker and architect), deliberately, since that map doubles as the
+     * member roster's availability signal and a lead counted there would show up as an available
+     * member. So without the second disjunct a lead is permanently un-deliverable: every
+     * lead→lead send sat on the gate for {@code READINESS_GRACE_POLLS} (~60s) and then failed
+     * having never been typed into the pane.
      *
      * <p>The lead set is read through the supplier on each call rather than snapshotted, so a lead
      * discovered by {@code leadScan} after startup becomes deliverable without a restart.

bridged/src/main/java/dev/ltms/bridged/auth/CallerResolver.java

@@ -1,10 +1,12 @@
 package dev.ltms.bridged.auth;
 
 import dev.ltms.bridged.mcp.ConnectionIdentity;
+import dev.ltms.bridged.peer.MemberRole;
 
 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
 import java.util.Map;
+import java.util.function.Function;
 import java.util.function.Supplier;
 
 /**
@@ -60,14 +62,16 @@ public final class CallerResolver {
      * in {@code Bridged} reads a constant from config, which is the degenerate live case.
      */
     private final Supplier<Map<String, String>> architectTerminals;
+    private final Function<String, MemberRole> memberSlotRoles;
+    private final Function<String, String> memberSlotNames;
 
-    /** Loopback-trust resolver: no token required, historical behaviour. */
-    public CallerResolver(ConnectionIdentity identity) {
+    /** Loopback-trust resolver: no token required, historical behaviour. Test-only. */
+    CallerResolver(ConnectionIdentity identity) {
         this(identity, false, null, Map.of());
     }
 
-    /** As {@link #CallerResolver(ConnectionIdentity, boolean, String, Map)} with no leads pinned. */
-    public CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token) {
+    /** As {@link #CallerResolver(ConnectionIdentity, boolean, String, Map)} with no leads pinned. Test-only. */
+    CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token) {
         this(identity, tokenMode, token, Map.of());
     }
 
@@ -82,8 +86,8 @@ public final class CallerResolver {
      * @param pinnedPrimaryTerminal the primary's own herdr {@code terminal_id}
      *                              ({@code null}/blank = unpinned)
      */
-    public static CallerResolver pinnedTo(ConnectionIdentity identity, boolean tokenMode,
-                                          String token, String pinnedPrimaryTerminal) {
+    static CallerResolver pinnedTo(ConnectionIdentity identity, boolean tokenMode,
+                                   String token, String pinnedPrimaryTerminal) {
         return new CallerResolver(identity, tokenMode, token,
                 pinnedPrimaryTerminal == null || pinnedPrimaryTerminal.isBlank()
                         ? Map.of() : Map.of(pinnedPrimaryTerminal, "primary"));
@@ -98,21 +102,11 @@ public final class CallerResolver {
      *                       {@link Role#PRIMARY} — rather than a worker. Empty = nothing pinned,
      *                       so every pane resolves as a worker.
      */
-    public CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
-                          Map<String, String> leadTerminals) {
+    CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                   Map<String, String> leadTerminals) {
         this(identity, tokenMode, token, fixed(leadTerminals), null);
     }
 
-    /**
-     * Map-form of both registries (CB-548): lead terminals and the initial architect terminal
-     * bindings, each snapshotted at construction (a handed-over map is not offered as live state).
-     */
-    public CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
-                          Map<String, String> leadTerminals,
-                          Map<String, String> architectTerminals) {
-        this(identity, tokenMode, token, fixed(leadTerminals), fixed(architectTerminals));
-    }
-
     /**
      * Live-registry form: {@code leadTerminals} is consulted on every resolve, so leads discovered
      * after startup (CB-531's tab scan) take effect without a restart.
@@ -121,26 +115,26 @@ public final class CallerResolver {
      * {@link #pinnedTo}: {@code Map} and {@code Supplier} overloads are ambiguous for a literal
      * {@code null}.
      */
-    public static CallerResolver withLeads(ConnectionIdentity identity, boolean tokenMode,
-                                           String token,
-                                           Supplier<Map<String, String>> leadTerminals) {
+    static CallerResolver withLeads(ConnectionIdentity identity, boolean tokenMode,
+                                    String token,
+                                    Supplier<Map<String, String>> leadTerminals) {
         return new CallerResolver(identity, tokenMode, token, leadTerminals, null);
     }
 
     /**
-     * Live-registry form for both {@code leadTerminals} and the CB-548 architect registry: both
-     * are consulted on every resolve, so a slot binding injected after startup takes effect
-     * without a restart.
+     * Live registry form that can confirm a bound slot is an architect slot.
      *
-     * <p>A static factory rather than a constructor overload, for the same reason as
-     * {@link #pinnedTo}: too many {@code Map}/{@code Supplier} combinations to make {@code null}
-     * unambiguous.
+     * <p>This is the only public construction path. It keeps terminal bindings and slot roles in
+     * the same {@link MemberRegistry}, so a configured architect can resolve as an architect.
      */
     public static CallerResolver withLeadsAndMembers(ConnectionIdentity identity,
-                                                        boolean tokenMode, String token,
-                                                        Supplier<Map<String, String>> leadTerminals,
-                                                        Supplier<Map<String, String>> architectTerminals) {
-        return new CallerResolver(identity, tokenMode, token, leadTerminals, architectTerminals);
+                                                       boolean tokenMode, String token,
+                                                       Supplier<Map<String, String>> leadTerminals,
+                                                       MemberRegistry members) {
+        return new CallerResolver(identity, tokenMode, token, leadTerminals,
+                members == null ? null : members::snapshot,
+                members == null ? null : members::roleForSlot,
+                members == null ? null : members::nameForSlot);
     }
 
     private static Supplier<Map<String, String>> fixed(Map<String, String> leadTerminals) {
@@ -151,6 +145,21 @@ public final class CallerResolver {
     private CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
                            Supplier<Map<String, String>> leadTerminals,
                            Supplier<Map<String, String>> architectTerminals) {
+        this(identity, tokenMode, token, leadTerminals, architectTerminals, null);
+    }
+
+    private CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                           Supplier<Map<String, String>> leadTerminals,
+                           Supplier<Map<String, String>> architectTerminals,
+                           Function<String, MemberRole> memberSlotRoles) {
+        this(identity, tokenMode, token, leadTerminals, architectTerminals, memberSlotRoles, null);
+    }
+
+    private CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                           Supplier<Map<String, String>> leadTerminals,
+                           Supplier<Map<String, String>> architectTerminals,
+                           Function<String, MemberRole> memberSlotRoles,
+                           Function<String, String> memberSlotNames) {
         if (tokenMode && (token == null || token.isBlank())) {
             throw new IllegalArgumentException(
                     "auth.mode=token requires a non-empty token; check that the env var named by "
@@ -161,6 +170,8 @@ public final class CallerResolver {
         this.expectedToken = tokenMode ? token.getBytes(StandardCharsets.UTF_8) : null;
         this.leadTerminals = leadTerminals == null ? Map::of : leadTerminals;
         this.architectTerminals = architectTerminals == null ? Map::of : architectTerminals;
+        this.memberSlotRoles = memberSlotRoles == null ? _ -> null : memberSlotRoles;
+        this.memberSlotNames = memberSlotNames == null ? Function.identity() : memberSlotNames;
     }
 
     /**
@@ -206,11 +217,12 @@ public final class CallerResolver {
                 return Principal.leader(lead, c.terminal(), c.pid());
             }
             String slot = architectTerminals.get().get(c.terminal());
-            if (slot != null) {
+            if (slot != null && memberSlotRoles.apply(slot) == MemberRole.ARCHITECT) {
                 // The config/live binding names this pane as an architect slot's own. Same
                 // unforgeable pane mapping; the live binding, never a request argument, decides.
-                // Checked before the generic worker fallback, per the CB-548 precedence order.
-                return Principal.architect(slot, c.terminal(), c.pid());
+                // Check the slot role too: this defence in depth prevents a bad lifecycle bind from
+                // escalating a dev or reviewer into an architect. Checked before the worker fallback.
+                return Principal.architect(memberSlotNames.apply(slot), c.terminal(), c.pid());
             }
             return Principal.worker(c.terminal(), c.pid()); // unforgeable; never token-gated
         }

bridged/src/main/java/dev/ltms/bridged/auth/MemberLifecycle.java

@@ -0,0 +1,21 @@
+package dev.ltms.bridged.auth;
+
+import dev.ltms.bridged.peer.MemberRole;
+
+/** Optional session lifecycle hook for live member-slot bindings. */
+public interface MemberLifecycle {
+
+    MemberLifecycle NONE = new MemberLifecycle() {
+        @Override
+        public void acquired(MemberRole role, String profile, String terminal) {
+        }
+
+        @Override
+        public void released(String terminal) {
+        }
+    };
+
+    void acquired(MemberRole role, String profile, String terminal);
+
+    void released(String terminal);
+}

bridged/src/main/java/dev/ltms/bridged/auth/MemberRegistry.java

@@ -2,11 +2,14 @@ package dev.ltms.bridged.auth;
 
 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.peer.MemberRole;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
 import java.util.Map;
+import java.util.Objects;
 
 /**
  * The architect-slot registry (CB-548): every gateway-local architect name and the strong-model
@@ -29,7 +32,9 @@ import java.util.Map;
  * exposes the map the resolver resolves against plus the profile lookup lifecycle will call.
  * Nothing here creates or manages an architect session.
  */
-public final class MemberRegistry {
+public final class MemberRegistry implements MemberLifecycle {
+
+    private static final Logger log = LoggerFactory.getLogger(MemberRegistry.class);
 
     /**
      * One flattened {@code fleet:} entry.
@@ -125,6 +130,12 @@ public final class MemberRegistry {
         return e == null ? null : e.role();
     }
 
+    /** The unqualified configured name for a slot, or {@code null} if it is unknown. */
+    public String nameForSlot(String slotName) {
+        Entry e = slots.get(slotName);
+        return e == null ? null : e.name();
+    }
+
     /** True when {@code slotName} is a configured architect slot. */
     public boolean isSlot(String slotName) {
         return slots.containsKey(slotName);
@@ -189,4 +200,33 @@ public final class MemberRegistry {
             return true;
         }
     }
+
+    /**
+     * Bind only architect sessions to a free slot with the resolved profile.
+     *
+     * <p>The role check is lifecycle policy. {@link CallerResolver} repeats it when resolving a
+     * binding, so a later lifecycle regression cannot turn a worker into an architect.
+     */
+    @Override
+    public void acquired(MemberRole role, String profile, String terminal) {
+        if (role != MemberRole.ARCHITECT || terminal == null || terminal.isBlank()) {
+            return;
+        }
+        // slotsFor preserves definition order, so duplicate-profile slots use the first free one.
+        for (Entry entry : slotsFor(MemberRole.ARCHITECT).values()) {
+            if (Objects.equals(profile, entry.profile()) && bind(entry.key(), terminal)) {
+                return;
+            }
+        }
+        log.info("member slot: no free architect slot for profile={}; session remains a worker", profile);
+    }
+
+    /** Unbind a released terminal using the compare-safe registry operation. */
+    @Override
+    public void released(String terminal) {
+        String slot = slotForTerminal(terminal);
+        if (slot != null) {
+            unbind(slot, terminal);
+        }
+    }
 }

bridged/src/main/java/dev/ltms/bridged/auth/Principal.java

@@ -48,7 +48,7 @@ public record Principal(Role role, String terminal, long pid, String name) {
      * made a lead unaddressable: {@link #ownsSession} could never be true for it, so
      * {@code bridge_reply} was refused and one lead could send to another but never be answered.
      * The terminal now means "which pane is this caller", the presence map keys on
-     * {@link #isWorker()} instead, and a lead is a peer that can both send and receive.
+     * {@link #isSpawnedMember()} instead, and a lead is a peer that can both send and receive.
      */
     public static Principal leader(String name, String terminal, long pid) {
         return new Principal(Role.PRIMARY, terminal, pid, name);
@@ -85,6 +85,16 @@ public record Principal(Role role, String terminal, long pid, String name) {
         return role == Role.WORKER;
     }
 
+    /**
+     * Whether this caller is a spawned member with its own pane.
+     *
+     * <p>Both workers and architects are spawned members. A lead is excluded because recording it
+     * as present would count it as an available member in the roster.
+     */
+    public boolean isSpawnedMember() {
+        return role == Role.WORKER || role == Role.ARCHITECT;
+    }
+
     public boolean isAnonymous() {
         return role == Role.ANONYMOUS;
     }

bridged/src/main/java/dev/ltms/bridged/config/BridgedConfig.java

@@ -210,8 +210,14 @@ public record BridgedConfig(
             // worker the primary's IDE servers, which are bound to the primary's checkout — so its
             // navigation returned paths outside its own worktree. GitWorktrees now neutralizes that
             // file instead; a worker's tools are whatever its launcher mounts.
+            // .claude/settings.local.json is the sibling that was left behind: it pre-approves tools
+            // (mcp__context7__*, mcp__jetbrains, mcp__intellij-index, Workflow(code-review)) a worker
+            // must never hold, and enables MCP servers by name. Its grants are currently INERT because
+            // GitWorktrees.isolateToolSurface strips every worktree's server map to empty — the named
+            // servers do not exist there to be enabled. This is defence in depth, not a live fix: the
+            // worker stays isolated only because this separate mechanism already removes the servers.
             parityOverlay = (parityOverlay == null || parityOverlay.isEmpty())
-                    ? List.of(".claude/settings.local.json", ".env", ".envrc")
+                    ? List.of(".env", ".envrc")
                     : List.copyOf(parityOverlay);
             // gitTokenEnv stays null when unset (opt-in). gitHostEnv defaults so operators enabling
             // checkpoints need only set gitTokenEnv; it is injected only alongside a resolved token.
@@ -526,6 +532,7 @@ public record BridgedConfig(
      * @param architects  profiles the {@code architect} role may run on
      * @param developers  profiles the {@code dev} role may run on
      * @param reviewers   profiles the {@code reviewer} role may run on
+     * @param charters    optional launch-charter text keyed by singular role wire name
      * @param tabLabel    template for a member tab's label; {@code {role}}, {@code {profile}},
      *                    {@code {model}} and {@code {n}} (a per role+profile counter) are
      *                    substituted. Default {@link #DEFAULT_TAB_LABEL}
@@ -535,6 +542,7 @@ public record BridgedConfig(
                         Map<String, Slot> architects,
                         Map<String, Slot> developers,
                         Map<String, Slot> reviewers,
+                        Map<String, String> charters,
                         String tabLabel) {
 
         /**
@@ -550,9 +558,16 @@ public record BridgedConfig(
             architects = unmodifiableOrEmpty(architects);
             developers = unmodifiableOrEmpty(developers);
             reviewers = unmodifiableOrEmpty(reviewers);
+            charters = unmodifiableOrEmpty(charters);
             tabLabel = (tabLabel == null || tabLabel.isBlank()) ? DEFAULT_TAB_LABEL : tabLabel;
         }
 
+        /** Convenience constructor for code that does not configure launch charters. */
+        public Fleet(Map<String, Leader> leaders, Map<String, Slot> architects,
+                     Map<String, Slot> developers, Map<String, Slot> reviewers, String tabLabel) {
+            this(leaders, architects, developers, reviewers, null, tabLabel);
+        }
+
         /**
          * Deliberately not {@code Map.copyOf}: its iteration order is salted per JVM run, which
          * would discard YAML definition order. The {@code fixed} placement policy answers with a
@@ -576,6 +591,11 @@ public record BridgedConfig(
             };
         }
 
+        /** The configured launch charter for {@code role}, or {@code null} when it is absent. */
+        public String charterFor(MemberRole role) {
+            return role == null ? null : charters.get(role.wireName());
+        }
+
         /**
          * The profile names {@code role} may run on, in definition order, without repeats.
          *
@@ -1046,7 +1066,7 @@ public record BridgedConfig(
         // fleet IS defaulted, unlike the leadScan: block it replaced, because an empty Fleet is not
         // the same as an enabled one: every pool is empty, so no lead is scanned for or created and
         // no role has a pool. Constructing it saves every reader a null check for no behaviour change.
-        Fleet f = (fleet != null) ? fleet : new Fleet(null, null, null, null, null);
+        Fleet f = (fleet != null) ? fleet : new Fleet(null, null, null, null, null, null);
         // leadHeartbeat is left as-is (CB-551): null is "off", and LeadHeartbeat's own compact
         // constructor defaults the fields of a block that IS present. Defaulting it here would
         // switch the feature on for every config that never mentioned it.
@@ -1184,6 +1204,35 @@ public record BridgedConfig(
         }
     }
 
+    /**
+     * Reject configured charter entries that would remove a role's contract or never be read.
+     *
+     * <p>The map deliberately retains every key from {@code fleet.charters:}. A typed record would
+     * silently discard an unknown child because {@link Fleet} ignores unknown JSON properties, which
+     * would make a typo look like an accepted configuration.
+     *
+     * @throws IllegalStateException when a charter key is not a role wire name or its value is blank
+     */
+    public void validateCharters() {
+        if (fleet == null || fleet.charters().isEmpty()) {
+            return;
+        }
+        List<String> valid = java.util.Arrays.stream(MemberRole.values())
+                .map(MemberRole::wireName)
+                .toList();
+        List<String> bad = new ArrayList<>();
+        fleet.charters().forEach((key, charter) -> {
+            if (!valid.contains(key)) {
+                bad.add("fleet.charters." + key + " is not a role wire name (valid: " + valid + ").");
+            } else if (charter == null || charter.isBlank()) {
+                bad.add("fleet.charters." + key + " is blank; a configured role needs charter text.");
+            }
+        });
+        if (!bad.isEmpty()) {
+            throw new IllegalStateException("refusing to start: " + String.join(" ", bad));
+        }
+    }
+
     /**
      * Reject a member slot whose {@code role} or {@code profile} does not resolve.
      *

bridged/src/main/java/dev/ltms/bridged/config/ConfigRef.java

@@ -27,8 +27,8 @@ import java.util.function.Supplier;
  *
  * <ul>
  *   <li><strong>Hot</strong> — re-read per use, so a reload takes effect on the next spawn:
- *       {@code fleet:} (every role pool and {@code tabLabel}), {@code placement:}, and an existing
- *       profile's {@code weight} / {@code maxLoad}. Those three are read through a supplier on
+ *       {@code fleet:} (every role pool, {@code charters}, and {@code tabLabel}),
+ *       {@code placement:}, and an existing profile's {@code weight} / {@code maxLoad}. Those three are read through a supplier on
  *       {@code CompositePeerLauncher}, which is what makes them hot — not the fact that they are
  *       config.</li>
  *   <li><strong>Deferred</strong> — accepted into the new snapshot, but the wiring built at startup
@@ -150,6 +150,7 @@ public final class ConfigRef implements Supplier<BridgedConfig> {
             fresh.validateAuthExposure();
             fresh.validateLeadTabPrefixes();
             fresh.validateSubscriptionProfiles();
+            fresh.validateCharters();
             fresh.validateMembers();
         } catch (RuntimeException e) {
             String msg = e.getMessage() == null ? e.toString() : e.getMessage();

bridged/src/main/java/dev/ltms/bridged/inject/CompletionResolver.java

@@ -55,6 +55,9 @@ public final class CompletionResolver implements TurnListener {
     /** Cap the scraped tail so a long transcript can't return an unbounded blob. */
     static final int MAX_SCRAPE_CHARS = 4000;
 
+    private static final String CLIPPED_PANE_TAIL_MARKER =
+            "[Pane tail clipped: member did not call bridge_reply.]";
+
     private final AgentControl agents;
     private final Rendezvous rendezvous;
 
@@ -147,9 +150,14 @@ public final class CompletionResolver implements TurnListener {
             return;
         }
         String tail;
+        int originalLength = 0;
+        boolean clipped = false;
         boolean scrapeFailed = false;
         try {
-            tail = clip(lastAssistantBlock(agents.read(target, SCRAPE_SOURCE)));
+            String assistantBlock = lastAssistantBlock(agents.read(target, SCRAPE_SOURCE));
+            originalLength = assistantBlock.strip().length();
+            clipped = originalLength > MAX_SCRAPE_CHARS;
+            tail = clip(assistantBlock);
         } catch (RuntimeException e) {
             // The worker finished but we couldn't read its screen — still resolve the send so the
             // caller unblocks; an empty tail beats hanging until the caller's timeout.
@@ -169,8 +177,14 @@ public final class CompletionResolver implements TurnListener {
                     target);
             return; // keep the in-flight record: a later genuine completion still needs it
         }
-        if (rendezvous.resolveCompletion(waiter, tail)) {
+        String completion = clipped ? tail + "\n" + CLIPPED_PANE_TAIL_MARKER : tail;
+        if (rendezvous.resolveCompletion(waiter, completion)) {
             inFlight.remove(target, turn);
+            if (clipped) {
+                log.warn("completion scrape for {} clipped from {} chars to the {} char cap; "
+                                + "member did not call bridge_reply, so the pane tail is partial",
+                        target, originalLength, MAX_SCRAPE_CHARS);
+            }
             log.debug("resolved send to {} via turn-completion fallback ({} chars scraped)",
                     target, tail.length());
         }
@@ -200,7 +214,7 @@ public final class CompletionResolver implements TurnListener {
         }
         if (rendezvous.resolveFailure(waiter, reason)) {
             inFlight.remove(target, turn);
-            log.debug("failed send to {} via turn-stall fallback", target);
+            log.warn("failing send to {} via turn-stall fallback: {}", target, reason);
         }
     }
 

bridged/src/main/java/dev/ltms/bridged/inject/Injector.java

@@ -78,6 +78,15 @@ public final class Injector {
      */
     private static final int READINESS_GRACE_POLLS = 240;
 
+    /**
+     * The single source for the injector poll cadence — how often the {@link StatusPoller} drives
+     * {@link #onStatus} at. {@code Bridged} passes this to every {@link StatusPoller} it constructs,
+     * and this class reads it to state the readiness grace in seconds on the CB-562 expiry log
+     * instead of hardcoding "60s". One constant, so a cadence change cannot silently desync a log
+     * that claims a grace duration.
+     */
+    public static final long POLL_INTERVAL_MILLIS = 250;
+
     private final AgentControl agents;
     private final TurnListener turnListener;
     private final Predicate<String> ready; // CB-113: a target is deliverable only when available
@@ -264,6 +273,11 @@ public final class Injector {
                             // fail every queued message and release the target (CB-114) instead of
                             // polling it indefinitely with the caller's future never completing.
                             notReady = new ArrayList<>(t.queue);
+                            log.warn("readiness grace for {} expired after {} polls ({}s): target never "
+                                    + "became deliverable, so failing {} queued message(s) that never "
+                                    + "reached its pane",
+                                    target, READINESS_GRACE_POLLS,
+                                    READINESS_GRACE_POLLS * POLL_INTERVAL_MILLIS / 1000, notReady.size());
                             t.queue.clear();
                             t.notReadySincePoll = 0;
                         }
@@ -388,6 +402,10 @@ public final class Injector {
             t.awaitingPostTurnPickup = false;
             t.postTurnObserved = false;
         }
+        log.warn("{} is gone, dropping its queue: {} message(s) failed{}; cause: {}", target,
+                pending.size(),
+                hadDeliveredTurn ? " (including one turn already in flight whose completion was never confirmed)" : "",
+                cause.getMessage());
         forget.accept(target); // the worker is gone — clear its readiness/presence too (CB-114)
         for (Pending p : pending) {
             p.delivered().completeExceptionally(cause);

bridged/src/main/java/dev/ltms/bridged/mcp/BridgeMcp.java

@@ -109,10 +109,10 @@ public final class BridgeMcp {
                             ? callers.resolve(req.getRemoteAddr(), req.getRemotePort(),
                                     req.getHeader("Authorization"))
                             : legacyPrincipal(identity, req.getRemoteAddr(), req.getRemotePort());
-                    // CB-532: guard on the ROLE, not on the terminal being null. A named lead now
-                    // carries its pane too, and enrolling a lead in the worker presence map would
-                    // have it counted as an available worker.
-                    if (p.isWorker()) presence.markPresent(p.terminal());
+                    // CB-532: guard on the ROLE, not on the terminal being null. This excludes a
+                    // lead, which carries its pane too, while including every spawned member role.
+                    // Enrolling a lead would count it as an available member in the roster.
+                    markSpawnedMemberPresent(p, presence);
                     return McpTransportContext.create(Map.of(
                             CALLER_TERMINAL, orEmpty(p.terminal()),
                             CALLER_PID, Long.toString(p.pid()),
@@ -365,6 +365,13 @@ public final class BridgeMcp {
         return transport;
     }
 
+    /** Mark a connected spawned member available for the injector readiness gate. */
+    static void markSpawnedMemberPresent(Principal caller, MemberPresence presence) {
+        if (caller.isSpawnedMember()) {
+            presence.markPresent(caller.terminal());
+        }
+    }
+
     /** Graceful shutdown of the MCP server. */
     public void close() {
         server.closeGracefully();

bridged/src/main/java/dev/ltms/bridged/msg/MessageService.java

@@ -277,7 +277,7 @@ public final class MessageService {
         }
         boolean failed = rendezvous.resolveFailure(waiter, reason);
         if (failed) {
-            log.debug("abandoned send to {}: {}", target, reason);
+            log.warn("abandoning the blocked send to {}: {}", target, reason);
         }
         return failed;
     }

bridged/src/main/java/dev/ltms/bridged/session/SessionManager.java

@@ -1,5 +1,6 @@
 package dev.ltms.bridged.session;
 
+import dev.ltms.bridged.auth.MemberLifecycle;
 import dev.ltms.bridged.herdr.Agent;
 import dev.ltms.bridged.inject.TurnListener;
 import dev.ltms.bridged.inject.MemberPresence;
@@ -28,8 +29,7 @@ import java.util.function.LongSupplier;
  * teardown on top.
  *
  * <p>The state machine is intentionally one-shot / no-reuse: every acquired worker is fresh,
- * and a finished or released worker is torn down, never pooled. {@link #recycle} is a convenience
- * for {@code release + acquire} with a new distinct pane id.
+ * and a finished or released worker is torn down, never pooled or reused.
  *
  * <p>The manager implements {@link TurnListener} so the injector's turn boundaries drive
  * {@code READY → BUSY → DONE} (or {@code FAILED}). It exposes a {@link MemberPresence} view via
@@ -49,6 +49,7 @@ public final class SessionManager implements TurnListener {
     private final LongSupplier nowNanos;
     private final int contextCap;
     private final boolean clearAfterTurn;
+    private volatile MemberLifecycle memberLifecycle = MemberLifecycle.NONE;
 
     /** CB-520: notified with a terminalId on every acquire; no-op until wired. */
     private final List<Consumer<String>> acquireListeners = new java.util.concurrent.CopyOnWriteArrayList<>();
@@ -139,7 +140,13 @@ public final class SessionManager implements TurnListener {
             // to pick the profile out of that role's pool and to label the tab; a role kept only on
             // the MemberSession is recorded after the spawn it was supposed to steer.
             SpawnRequest req = new SpawnRequest(profile, requestedCwd, callerCwd, null, null, memberRole);
-            PeerHandle handle = launcher.spawn(req);
+            PeerHandle handle;
+            try {
+                handle = launcher.spawn(req);
+            } catch (RuntimeException e) {
+                log.warn("spawn failed for profile={} role={}: {}", profile, memberRole, e.getMessage());
+                throw e;
+            }
             String resolvedProfile = resolveProfile(handle, profile);
             String cwd = launcher.effectiveCwd(new SpawnRequest(resolvedProfile, requestedCwd, callerCwd));
             long now = nowNanos.getAsLong();
@@ -157,6 +164,7 @@ public final class SessionManager implements TurnListener {
                     null,
                     null);
             registry.put(handle.id(), session);
+            memberLifecycle.acquired(session.role(), session.profile(), session.terminalId());
             log.debug("acquired session id={} terminal={} profile={} owner={}",
                     handle.id(), handle.terminalId(), session.profile(), session.ownerTerminal());
             notifyAcquired(session.terminalId());
@@ -177,7 +185,7 @@ public final class SessionManager implements TurnListener {
      * <p>CB-544: these are two concerns that used to be fused. Stopping the pane is correct on every
      * teardown — the worker process must end. Removing the worktree is a destructive act that is only
      * correct for a deliberately-finished teardown (an explicit stop of a completed session, the
-     * reaper releasing a genuinely idle one, a context-capped or recycled session). A shutdown drain
+     * reaper releasing a genuinely idle one, or a context-capped session). A shutdown drain
      * must stop panes but preserve worktrees: a worker's uncommitted work exists in exactly one
      * place — its worktree — so deleting it while the daemon simply goes down is silent data loss,
      * with no copy and no error. Do NOT fuse these back together; the cost of an orphaned worktree
@@ -187,6 +195,7 @@ public final class SessionManager implements TurnListener {
         MemberSession removed = registry.remove(paneId);
         boolean preserveWorktree = cause == ReleaseCause.SHUTDOWN;
         if (removed != null) {
+            memberLifecycle.released(removed.terminalId());
             log.debug("releasing session pane={} terminal={} state={} cause={}",
                     removed.paneId(), removed.terminalId(), removed.state(), cause);
             if (preserveWorktree && removed.worktree() != null) {
@@ -244,7 +253,7 @@ public final class SessionManager implements TurnListener {
     /**
      * Register a callback invoked with a session's {@code terminalId} whenever it is released
      * (CB-516). Every teardown path funnels through {@link #release}, so one hook covers the REST
-     * and MCP stop tools, the idle-TTL reaper, {@code recycle}, and shutdown drain alike.
+     * and MCP stop tools, the idle-TTL reaper, and shutdown drain alike.
      *
      * <p>Added rather than injected because {@code MessageService} — one intended listener — is
      * constructed after this manager (it needs the injector and rendezvous, which need the session
@@ -257,6 +266,11 @@ public final class SessionManager implements TurnListener {
         }
     }
 
+    /** Inject the optional member-slot lifecycle after construction without changing constructors. */
+    public void setMemberLifecycle(MemberLifecycle memberLifecycle) {
+        this.memberLifecycle = memberLifecycle == null ? MemberLifecycle.NONE : memberLifecycle;
+    }
+
     /** A listener failure must never prevent the acquisition it is reacting to. */
     private void notifyAcquired(String terminalId) {
         if (terminalId == null) {
@@ -304,6 +318,8 @@ public final class SessionManager implements TurnListener {
             worktrees.overlayParity(repoRoot, path, launcher.parityOverlay(preResolvedProfile));
             handle = launcher.spawn(new SpawnRequest(profile, path, callerCwd, null, null, memberRole));
         } catch (RuntimeException e) {
+            log.warn("spawn failed for profile={} role={} branch={} path={}: {}",
+                    preResolvedProfile, memberRole, branch, path, e.getMessage());
             if (path != null) {
                 try {
                     worktrees.remove(repoRoot, path);
@@ -330,6 +346,7 @@ public final class SessionManager implements TurnListener {
                 path,
                 branch);
         registry.put(handle.id(), session);
+        memberLifecycle.acquired(session.role(), session.profile(), session.terminalId());
         log.debug("acquired worktree session id={} terminal={} profile={} branch={} path={}",
                 handle.id(), handle.terminalId(), session.profile(), session.branch(), session.worktree());
         notifyAcquired(session.terminalId());
@@ -360,19 +377,6 @@ public final class SessionManager implements TurnListener {
         return launcher.defaultProfile();
     }
 
-    /**
-     * Release the old session and acquire a fresh one with the same profile and working directory.
-     * The new session is guaranteed to have a pane id distinct from the old one (no-reuse invariant).
-     */
-    public MemberSession recycle(String paneId) {
-        MemberSession old = registry.get(paneId);
-        if (old == null) {
-            throw new IllegalArgumentException("no session for paneId " + paneId);
-        }
-        release(paneId);
-        return acquire(old.profile(), old.cwd(), old.cwd(), old.ownerTerminal());
-    }
-
     /** The session for {@code paneId}, if it is still registered and not released. */
     public Optional<MemberSession> get(String paneId) {
         return Optional.ofNullable(registry.get(paneId));
@@ -488,8 +492,10 @@ public final class SessionManager implements TurnListener {
         MemberSession current = findByTerminal(target);
         if (current == null) return;
         if (current.state() == MemberSession.State.RELEASED) return;
+        MemberSession.State priorState = current.state();
         if (replace(current, current.withState(MemberSession.State.FAILED))) {
-            log.debug("session marked failed terminal={} pane={}", target, current.paneId());
+            log.warn("member terminal={} pane={} can no longer be delegated to: its turn never resolved "
+                    + "(was {} when it failed)", target, current.paneId(), priorState);
         }
     }
 
@@ -505,7 +511,11 @@ public final class SessionManager implements TurnListener {
             if (s.state() != MemberSession.State.READY && s.state() != MemberSession.State.DONE) {
                 continue;
             }
-            if (now - s.lastActivityAtNanos() > idleTtlNanos) {
+            long idleNanos = now - s.lastActivityAtNanos();
+            if (idleNanos > idleTtlNanos) {
+                log.debug("reaping idle session terminal={} pane={}: idle {}s exceeds the {}s ttl",
+                        s.terminalId(), s.paneId(), TimeUnit.NANOSECONDS.toSeconds(idleNanos),
+                        TimeUnit.NANOSECONDS.toSeconds(idleTtlNanos));
                 release(s.paneId());
                 reaped++;
             }

bridged/src/test/java/dev/ltms/bridged/auth/CallerResolverTest.java

@@ -3,6 +3,8 @@ package dev.ltms.bridged.auth;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.PaneLocator;
 import dev.ltms.bridged.mcp.ConnectionIdentity;
+import dev.ltms.bridged.config.BridgedConfig;
+import dev.ltms.bridged.peer.MemberRole;
 import org.junit.jupiter.api.Test;
 
 import java.util.Map;
@@ -32,6 +34,17 @@ class CallerResolverTest {
         return identity(999_999);
     }
 
+    private static MemberRegistry boundMembers(String slot, MemberRole role) {
+        Map<String, BridgedConfig.Slot> architects = role == MemberRole.ARCHITECT
+                ? Map.of("lead-designer", new BridgedConfig.Slot("sonnet")) : Map.of();
+        Map<String, BridgedConfig.Slot> devs = role == MemberRole.DEV
+                ? Map.of("builder", new BridgedConfig.Slot("sonnet")) : Map.of();
+        MemberRegistry members = new MemberRegistry(
+                new BridgedConfig.Fleet(Map.of(), architects, devs, Map.of(), null));
+        assertTrue(members.bind(slot, "term_a"));
+        return members;
+    }
+
     @Test
     void aLoopbackWorkerPaneResolvesToWorkerRegardlessOfAuthMode() {
         Principal underTrust = new CallerResolver(workerIdentity()).resolve("127.0.0.1", 42, null);
@@ -302,8 +315,9 @@ class CallerResolverTest {
 
     @Test
     void aBoundArchitectPaneResolvesToArchitectBeforeTheWorkerFallback() {
+        // This is the production construction path used by Bridged.
         Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                Map::of, () -> Map.of("term_a", "lead-designer"))
+                Map::of, boundMembers("architect:lead-designer", MemberRole.ARCHITECT))
                 .resolve("127.0.0.1", 42, null);
 
         assertEquals(Role.ARCHITECT, p.role(),
@@ -316,7 +330,7 @@ class CallerResolverTest {
     @Test
     void anArchitectNeedsNoTokenEvenInTokenMode() {
         Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), true, "s3cret",
-                Map::of, () -> Map.of("term_a", "lead-designer"))
+                Map::of, boundMembers("architect:lead-designer", MemberRole.ARCHITECT))
                 .resolve("127.0.0.1", 42, null);
 
         assertEquals(Role.ARCHITECT, p.role(),
@@ -325,9 +339,10 @@ class CallerResolverTest {
 
     @Test
     void anUnboundPaneStillResolvesAsAWorker() {
-        Map<String, String> arch = Map.of("term_elsewhere", "reviewer");
+        MemberRegistry members = new MemberRegistry(new BridgedConfig.Fleet(Map.of(),
+                Map.of("lead-designer", new BridgedConfig.Slot("sonnet")), Map.of(), Map.of(), null));
         Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                Map::of, () -> arch).resolve("127.0.0.1", 42, null);
+                Map::of, members).resolve("127.0.0.1", 42, null);
 
         assertEquals(Role.WORKER, p.role());
         assertNull(p.name());
@@ -337,7 +352,8 @@ class CallerResolverTest {
     @Test
     void aLeadWinsOverAnArchitectBindingForTheSamePane() {
         Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                () -> Map.of("term_a", "opus-5.0"), () -> Map.of("term_a", "lead-designer"))
+                () -> Map.of("term_a", "opus-5.0"),
+                boundMembers("architect:lead-designer", MemberRole.ARCHITECT))
                 .resolve("127.0.0.1", 42, null);
 
         assertEquals(Role.PRIMARY, p.role(),
@@ -349,26 +365,17 @@ class CallerResolverTest {
     /** The registry is live, like leads: a binding injected after construction is honoured. */
     @Test
     void anArchitectBoundAfterConstructionIsHonouredWithoutRebuildingTheResolver() {
-        Map<String, String> live = new java.util.HashMap<>();
+        MemberRegistry members = new MemberRegistry(new BridgedConfig.Fleet(Map.of(),
+                Map.of("lead-designer", new BridgedConfig.Slot("sonnet")), Map.of(), Map.of(), null));
         CallerResolver r = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                Map::of, () -> live);
+                Map::of, members);
 
         assertEquals(Role.WORKER, r.resolve("127.0.0.1", 42, null).role());
 
-        live.put("term_a", "lead-designer"); // the later lifecycle binds the slot
+        assertTrue(members.bind("architect:lead-designer", "term_a")); // the later lifecycle binds the slot
 
         assertEquals(Role.ARCHITECT, r.resolve("127.0.0.1", 42, null).role());
-        assertEquals("lead-designer", r.members().get("term_a"));
-    }
-
-    @Test
-    void theArchitectMapFormIsCopiedSoLaterMutationCannotGrantArchitect() {
-        Map<String, String> mutable = new java.util.LinkedHashMap<>();
-        CallerResolver r = new CallerResolver(workerIdentity(), false, null, Map.of(), mutable);
-
-        mutable.put("term_a", "sneaky");
-
-        assertEquals(Role.WORKER, r.resolve("127.0.0.1", 42, null).role());
+        assertEquals("architect:lead-designer", r.members().get("term_a"));
     }
 
     @Test
@@ -381,7 +388,8 @@ class CallerResolverTest {
     @Test
     void anArchitectOwnsItsOwnPaneAndNoOther() {
         Principal arch = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                Map::of, () -> Map.of("term_a", "lead-designer")).resolve("127.0.0.1", 42, null);
+                Map::of, boundMembers("architect:lead-designer", MemberRole.ARCHITECT))
+                .resolve("127.0.0.1", 42, null);
 
         assertTrue(arch.ownsSession("term_a"));
         assertTrue(Authz.permits(arch, Authz.Action.REPLY, "term_a"));
@@ -389,6 +397,15 @@ class CallerResolverTest {
         assertFalse(Authz.permits(arch, Authz.Action.REPLY, "term_b"));
     }
 
+    @Test
+    void aBoundNonArchitectSlotStillResolvesAsAWorker() {
+        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
+                Map::of, boundMembers("dev:builder", MemberRole.DEV))
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.WORKER, p.role(), "a dev binding must never grant architect rights");
+    }
+
     @Test
     void tokenModeRequiresANonEmptyConfiguredToken() {
         ConnectionIdentity id = nonWorkerIdentity();

bridged/src/test/java/dev/ltms/bridged/config/BridgedConfigTest.java

@@ -111,6 +111,28 @@ class BridgedConfigTest {
         assertDoesNotThrow(() -> BridgedConfig.load(f));
     }
 
+    @Test
+    void absentChartersRemainValidAndPresentChartersUseRoleWireNames(@TempDir Path dir) throws Exception {
+        Path absent = dir.resolve("absent.yaml");
+        Files.writeString(absent, "fleet: {}\n");
+        BridgedConfig withoutCharters = BridgedConfig.load(absent);
+        assertDoesNotThrow(withoutCharters::validateCharters);
+        assertNull(withoutCharters.fleet().charterFor(MemberRole.ARCHITECT));
+
+        Path blank = dir.resolve("blank.yaml");
+        Files.writeString(blank, "fleet:\n  charters:\n    architect: '   '\n");
+        IllegalStateException blankError = assertThrows(IllegalStateException.class,
+                () -> BridgedConfig.load(blank).validateCharters());
+        assertTrue(blankError.getMessage().contains("fleet.charters.architect is blank"));
+
+        Path unknown = dir.resolve("unknown.yaml");
+        Files.writeString(unknown, "fleet:\n  charters:\n    architetc: text\n");
+        IllegalStateException unknownError = assertThrows(IllegalStateException.class,
+                () -> BridgedConfig.load(unknown).validateCharters());
+        assertTrue(unknownError.getMessage().contains("architetc"));
+        assertTrue(unknownError.getMessage().contains("[architect, dev, reviewer]"));
+    }
+
     /**
      * CB-530. Unknown keys stay ignored — config must be allowed to run ahead of the code — but they
      * must be NAMED at load. A whole block that parses, is dropped, and is never mentioned again is
@@ -1167,6 +1189,41 @@ class BridgedConfigTest {
                 "a profile without the key stays off-subscription (the default)");
     }
 
+    @Test
+    void parityOverlayDefaultsToEnvFilesOnly(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("no-overlay.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    baseUrl: http://gx10.gw:8000
+                """);
+
+        BridgedConfig cfg = BridgedConfig.load(f);
+        assertEquals(List.of(".env", ".envrc"),
+                cfg.profiles().get("gx10").parityOverlay(),
+                "the default parity overlay is the env files; settings.local.json is no longer copied by default");
+    }
+
+    @Test
+    void parityOverlayExplicitListIsPreservedVerbatim(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("explicit-overlay.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    baseUrl: http://gx10.gw:8000
+                    parityOverlay: [".claude/settings.local.json", ".env"]
+                """);
+
+        BridgedConfig cfg = BridgedConfig.load(f);
+        assertEquals(List.of(".claude/settings.local.json", ".env"),
+                cfg.profiles().get("gx10").parityOverlay(),
+                "an operator's explicit list survives verbatim — the default only changes when unset");
+    }
+
     // ── CB-542: subscription:true must not smuggle an unguarded endpoint via env: ───────────────
 
     @Test

bridged/src/test/java/dev/ltms/bridged/config/ConfigRefTest.java

@@ -66,6 +66,64 @@ class ConfigRefTest {
         assertEquals("[{profile}] {role}", ref.get().fleet().tabLabel());
     }
 
+    @Test
+    void aCharterChangeIsHotAndReachesTheLiveConfig(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("bridged.yaml");
+        Files.writeString(f, yaml("""
+                fleet:
+                  charters:
+                    architect: old charter
+                """));
+        ConfigRef ref = refFor(f);
+        assertEquals("old charter", ref.get().fleet().charterFor(
+                dev.ltms.bridged.peer.MemberRole.ARCHITECT));
+
+        Files.writeString(f, yaml("""
+                fleet:
+                  charters:
+                    architect: new charter
+                """));
+        ConfigRef.Outcome out = ref.reload();
+
+        assertTrue(out.applied());
+        assertTrue(out.deferred().isEmpty());
+        assertEquals("new charter", ref.get().fleet().charterFor(
+                dev.ltms.bridged.peer.MemberRole.ARCHITECT));
+    }
+
+    @Test
+    void invalidChartersRefuseReloadAndKeepTheRunningConfig(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("bridged.yaml");
+        Files.writeString(f, yaml("""
+                fleet:
+                  charters:
+                    architect: valid charter
+                """));
+        ConfigRef ref = refFor(f);
+        BridgedConfig before = ref.get();
+
+        Files.writeString(f, yaml("""
+                fleet:
+                  charters:
+                    architect: " "
+                """));
+        ConfigRef.Outcome blank = ref.reload();
+        assertFalse(blank.applied());
+        assertTrue(blank.error().contains("fleet.charters.architect is blank"));
+        assertSame(before, ref.get());
+
+        Files.writeString(f, yaml("""
+                fleet:
+                  charters:
+                    architetc: valid charter
+                """));
+        ConfigRef.Outcome unknown = ref.reload();
+        assertFalse(unknown.applied());
+        assertTrue(unknown.error().contains("architetc"));
+        assertTrue(unknown.error().contains("architect"));
+        assertSame(before, ref.get());
+    }
+
     /**
      * The point of the whole class: a consumer holding the ref sees the new value without being
      * rebuilt. A component that captured {@code get()} into a field would still show the old one.

bridged/src/test/java/dev/ltms/bridged/inject/CompletionResolverTest.java

@@ -1,9 +1,14 @@
 package dev.ltms.bridged.inject;
 
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.LoggerContext;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.msg.Rendezvous;
 import org.junit.jupiter.api.Test;
+import org.slf4j.LoggerFactory;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
@@ -156,6 +161,33 @@ class CompletionResolverTest {
         assertEquals("No, 391 = 17 × 23.", waiter.getNow(null).text());
     }
 
+    @Test
+    void marksAClippedCompletionPaneTail() {
+        String block = "⏺ " + "x".repeat(CompletionResolver.MAX_SCRAPE_CHARS + 1) + "\n❯ ";
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertEquals("x".repeat(CompletionResolver.MAX_SCRAPE_CHARS)
+                        + "\n[Pane tail clipped: member did not call bridge_reply.]",
+                waiter.getNow(null).text());
+    }
+
+    @Test
+    void leavesAnUnclippedCompletionPaneTailUnmarked() {
+        FakeHerdr herdr = new FakeHerdr().readText("⏺ complete report\n❯ ");
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertEquals("complete report", waiter.getNow(null).text());
+    }
+
     @Test
     void resolvesSynchronouslyBeforePostTurnContextClearing() {
         FakeHerdr herdr = new FakeHerdr().readText("⏺ previous answer\n❯ ");
@@ -177,7 +209,8 @@ class CompletionResolverTest {
         // block while resolve compares against a clip()'d tail. For a block longer than MAX_SCRAPE_CHARS
         // the two capped representations differ even when the pane never changed, so the CB-115
         // byte-identical guard failed to fire and a stale completion could resolve the send. Both sides
-        // must clip identically; here an unchanged >cap block on rapid back-to-back turns stays suppressed.
+        // must clip identically. The returned-text marker is added only after this comparison, so an
+        // unchanged >cap block on rapid back-to-back turns still stays suppressed.
         String longBlock = "⏺ " + "x".repeat(CompletionResolver.MAX_SCRAPE_CHARS + 500) + "\n❯ ";
         FakeHerdr herdr = new FakeHerdr().readText(longBlock);
         Rendezvous rendezvous = new Rendezvous();
@@ -270,6 +303,40 @@ class CompletionResolverTest {
         assertEquals("stuck on an error screen", waiter.getNow(null).text());
     }
 
+    @Test
+    void failIsLoggedAtWarnWithTheReason() {
+        // CB-564: this used to be a bare DEBUG "failed send to X via turn-stall fallback" — a symptom
+        // with no cause, and below the level anyone watching for member health would see. A fail that
+        // resolves a caller's blocked send is at least WARN and must carry the reason.
+        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
+        ch.qos.logback.classic.Logger resolverLog =
+                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(CompletionResolver.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.setContext(ctx);
+        appender.start();
+        resolverLog.addAppender(appender);
+        resolverLog.setLevel(Level.WARN);
+        try {
+            FakeHerdr herdr = new FakeHerdr().readText("stuck on an error screen");
+            Rendezvous rendezvous = new Rendezvous();
+            CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
+            var waiter = rendezvous.open("term_a");
+
+            resolver.fail("term_a", null);
+
+            String warn = appender.list.stream()
+                    .filter(e -> e.getLevel().equals(Level.WARN))
+                    .map(ILoggingEvent::getFormattedMessage)
+                    .findFirst()
+                    .orElse("no turn-stall WARN logged");
+            assertTrue(warn.contains("term_a"), "the log names the target: " + warn);
+            assertTrue(warn.contains("stuck on an error screen"), "the log carries the reason: " + warn);
+            assertTrue(waiter.isDone());
+        } finally {
+            resolverLog.detachAppender(appender);
+        }
+    }
+
     // --- CB-116 waiter identity: a late completion never crosses into the next turn ---------
 
     @Test

bridged/src/test/java/dev/ltms/bridged/inject/InjectorTest.java

@@ -1,10 +1,15 @@
 package dev.ltms.bridged.inject;
 
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.LoggerContext;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.AgentStatus;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.HerdrException;
 import org.junit.jupiter.api.Test;
+import org.slf4j.LoggerFactory;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -369,6 +374,40 @@ class InjectorTest {
         assertTrue(inj.activeTargets().isEmpty(), "the target is reclaimed, not polled forever");
     }
 
+    @Test
+    void readinessGraceExpiryIsLogged() {
+        // CB-562: the grace-expiry path used to clear the queue silently, so a message that never
+        // reached the worker's pane surfaced elsewhere as an unrelated turn-stall failure. Assert the
+        // expiry now names the real cause. (ListAppender capture pattern mirrors AuditLogTest.)
+        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
+        ch.qos.logback.classic.Logger injectorLog =
+                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(Injector.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.setContext(ctx);
+        appender.start();
+        injectorLog.addAppender(appender);
+        injectorLog.setLevel(Level.WARN);
+        try {
+            Injector inj = new Injector(new AgentControl(herdr), TurnListener.NOOP, _ -> false, _ -> {
+            });
+            inj.enqueue(T, "task");
+
+            for (int i = 0; i < READINESS_SAMPLES; i++) inj.onStatus(T, AgentStatus.IDLE);
+
+            String warn = appender.list.stream()
+                    .filter(e -> e.getLevel().equals(Level.WARN))
+                    .map(ILoggingEvent::getFormattedMessage)
+                    .findFirst()
+                    .orElse("no grace-expiry WARN logged");
+            assertTrue(warn.contains(T), "the log names the target terminal: " + warn);
+            assertTrue(warn.contains("never reached"), "the log names the real cause: " + warn);
+            assertTrue(warn.contains("1 queued message"),
+                    "the log carries the failed message count: " + warn);
+        } finally {
+            injectorLog.detachAppender(appender);
+        }
+    }
+
     @Test
     void aWorkerThatBecomesReadyWithinTheGraceIsDeliveredNormally() {
         // The readiness grace must not fail a worker that is merely slow to boot: once it becomes
@@ -397,6 +436,38 @@ class InjectorTest {
         assertEquals(List.of(T), forgotten, "drop clears the gone worker's presence");
     }
 
+    @Test
+    void dropIsLogged() {
+        // CB-564: a vanished worker used to drop its queue with no log at all — the only trace was
+        // whatever failed downstream (e.g. a caller's send timing out with no clue why). Assert the
+        // drop itself now names the cause and the number of messages it failed.
+        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
+        ch.qos.logback.classic.Logger injectorLog =
+                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(Injector.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.setContext(ctx);
+        appender.start();
+        injectorLog.addAppender(appender);
+        injectorLog.setLevel(Level.WARN);
+        try {
+            Injector inj = new Injector(new AgentControl(herdr), TurnListener.NOOP, _ -> true, _ -> {
+            });
+            inj.enqueue(T, "orphan");
+            inj.drop(T, new HerdrException("worker gone", "pane_not_found", null));
+
+            String warn = appender.list.stream()
+                    .filter(e -> e.getLevel().equals(Level.WARN))
+                    .map(ILoggingEvent::getFormattedMessage)
+                    .findFirst()
+                    .orElse("no drop WARN logged");
+            assertTrue(warn.contains(T), "the log names the target terminal: " + warn);
+            assertTrue(warn.contains("1 message"), "the log carries the failed message count: " + warn);
+            assertTrue(warn.contains("worker gone"), "the log carries the real cause: " + warn);
+        } finally {
+            injectorLog.detachAppender(appender);
+        }
+    }
+
     @Test
     void pollerDeliversToAnIdleWorker() throws Exception {
         // End-to-end through the poller: idle worker → message delivered without manual onStatus.

bridged/src/test/java/dev/ltms/bridged/mcp/BridgeMcpAuthzTest.java

@@ -2,6 +2,7 @@ package dev.ltms.bridged.mcp;
 
 import dev.ltms.bridged.auth.Authz;
 import dev.ltms.bridged.auth.CallerResolver;
+import dev.ltms.bridged.auth.MemberRegistry;
 import dev.ltms.bridged.auth.Principal;
 import dev.ltms.bridged.auth.Role;
 import dev.ltms.bridged.config.BridgedConfig;
@@ -69,7 +70,8 @@ class BridgeMcpAuthzTest {
 
         mcp = new BridgeMcp(messages, workers, sessions, identity, sessions.asPresence(),
                 new PrimaryRegistry(null),
-                enforce ? new CallerResolver(identity) : null,
+                enforce ? CallerResolver.withLeadsAndMembers(identity, false, null,
+                Map::of, new MemberRegistry(null)) : null,
                 metrics);
         return mcp;
     }

bridged/src/test/java/dev/ltms/bridged/mcp/BridgeMcpTest.java

@@ -12,6 +12,7 @@ import dev.ltms.bridged.msg.Rendezvous;
 import dev.ltms.bridged.session.FakeWorktrees;
 import dev.ltms.bridged.session.SessionManager;
 import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.bridged.inject.MemberPresence;
 import dev.ltms.bridged.session.MemberSession;
 import dev.ltms.bridged.session.WorktreeRequest;
 import dev.ltms.bridged.member.ClaudeCodeLauncher;
@@ -404,6 +405,30 @@ class BridgeMcpTest {
         assertDoesNotThrow(() -> messages.ackReply("term_a", msgId));
     }
 
+    @Test
+    void spawnedMembersAreMarkedPresent() {
+        Principal worker = Principal.worker("term_worker", 200);
+        Principal architect = Principal.architect("lead-designer", "term_design", 400);
+        MemberPresence presence = new MemberPresence();
+
+        BridgeMcp.markSpawnedMemberPresent(worker, presence);
+        BridgeMcp.markSpawnedMemberPresent(architect, presence);
+
+        assertTrue(presence.isPresent("term_worker"));
+        assertTrue(presence.isPresent("term_design"));
+    }
+
+    @Test
+    void nonMembersAreNotMarkedPresent() {
+        Principal lead = Principal.leader("opus", "term_lead", 100);
+        MemberPresence presence = new MemberPresence();
+
+        BridgeMcp.markSpawnedMemberPresent(lead, presence);
+        BridgeMcp.markSpawnedMemberPresent(Principal.anonymous(), presence);
+
+        assertFalse(presence.isPresent("term_lead"));
+    }
+
     @Test
     void statusReportsLiveAgentStatus() {
         FakeHerdr blocked = new FakeHerdr().agentStatus("blocked");

bridged/src/test/java/dev/ltms/bridged/rest/BridgedAppAuthTest.java

@@ -1,6 +1,7 @@
 package dev.ltms.bridged.rest;
 
 import dev.ltms.bridged.auth.CallerResolver;
+import dev.ltms.bridged.auth.MemberRegistry;
 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.guard.SubscriptionGuard;
 import dev.ltms.bridged.herdr.AgentControl;
@@ -65,9 +66,8 @@ class BridgedAppAuthTest {
         MessageService messages = new MessageService(agents, injector, new Rendezvous());
 
         ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> pid);
-        CallerResolver callers = tokenMode
-                ? new CallerResolver(identity, true, token)
-                : new CallerResolver(identity);
+        CallerResolver callers = CallerResolver.withLeadsAndMembers(identity, tokenMode, token,
+                Map::of, new MemberRegistry(null));
         metrics = BridgedMetrics.create(sessions, new dev.ltms.bridged.msg.InMemoryReplyInbox());
 
         app = new BridgedApp(herdr, workers, sessions, messages, sessions.asPresence(), null,

bridged/src/test/java/dev/ltms/bridged/session/SessionManagerTest.java

@@ -1,5 +1,9 @@
 package dev.ltms.bridged.session;
 
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.LoggerContext;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.guard.SubscriptionGuard;
 import dev.ltms.bridged.herdr.AgentControl;
@@ -8,6 +12,7 @@ import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.member.ClaudeCodeLauncher;
 import dev.ltms.bridged.peer.PeerUnreachableException;
 import org.junit.jupiter.api.Test;
+import org.slf4j.LoggerFactory;
 
 import java.util.List;
 import java.util.Map;
@@ -158,32 +163,38 @@ class SessionManagerTest {
     }
 
     @Test
-    void recycleProducesNewPaneIdAndOldOneIsGone() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-        MemberSession oldSession = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-        String oldPane = oldSession.paneId();
-        String oldTerminal = oldSession.terminalId();
+    void onTurnFailedIsLoggedAtWarnWithThePriorState() {
+        // CB-564: this transition used to be a bare DEBUG "session marked failed" — a symptom with no
+        // cause. A member that can no longer be delegated to must be at least WARN, and should name
+        // what stage it failed at (here: BUSY, i.e. a turn was in flight and never resolved).
+        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
+        ch.qos.logback.classic.Logger sessionLog =
+                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(SessionManager.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.setContext(ctx);
+        appender.start();
+        sessionLog.addAppender(appender);
+        sessionLog.setLevel(Level.WARN);
+        try {
+            FakeHerdr herdr = new FakeHerdr();
+            SessionManager sessions = sessionManager(herdr);
+            MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+            String terminal = session.terminalId();
+            sessions.asPresence().markPresent(terminal);
+            sessions.onDelivered(terminal);
 
-        MemberSession fresh = sessions.recycle(oldPane);
+            sessions.onTurnFailed(terminal);
 
-        assertNotEquals(oldPane, fresh.paneId(), "recycle yields a new pane id");
-        assertNotEquals(oldTerminal, fresh.terminalId(), "recycle yields a new terminal id");
-        assertEquals(oldSession.profile(), fresh.profile(), "profile is preserved");
-        assertEquals(oldSession.cwd(), fresh.cwd(), "cwd is preserved");
-        assertEquals(oldSession.ownerTerminal(), fresh.ownerTerminal(), "owner is preserved");
-
-        assertTrue(sessions.get(oldPane).isEmpty(), "old pane is deregistered");
-        assertEquals(1, sessions.roster().size(), "only the fresh session remains");
-        assertEquals(fresh.paneId(), sessions.roster().getFirst().paneId());
-
-        // The old session was the first spawn → pane w9:pRoot_1 (CB-519: the registry key is the
-        // uuid id, so teardown is asserted on the real pane coordinate).
-        long paneCloseCount = herdr.calls.stream()
-                .filter(c -> "pane.close".equals(c.method()))
-                .filter(c -> "w9:pRoot_1".equals(((Map<?, ?>) c.params()).get("pane_id")))
-                .count();
-        assertEquals(1, paneCloseCount, "the old worker was torn down");
+            String warn = appender.list.stream()
+                    .filter(e -> e.getLevel().equals(Level.WARN))
+                    .map(ILoggingEvent::getFormattedMessage)
+                    .findFirst()
+                    .orElse("no turn-failed WARN logged");
+            assertTrue(warn.contains(terminal), "the log names the member: " + warn);
+            assertTrue(warn.contains("BUSY"), "the log names the stage it failed at: " + warn);
+        } finally {
+            sessionLog.detachAppender(appender);
+        }
     }
 
     @Test

bridged/src/test/java/dev/ltms/bridged/session/WorktreeSessionManagerTest.java

@@ -1,11 +1,13 @@
 package dev.ltms.bridged.session;
 
+import dev.ltms.bridged.auth.MemberRegistry;
 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.guard.SubscriptionGuard;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.member.ClaudeCodeLauncher;
+import dev.ltms.bridged.peer.MemberRole;
 import org.junit.jupiter.api.Test;
 
 import java.util.List;
@@ -22,6 +24,13 @@ import static org.junit.jupiter.api.Assertions.*;
  */
 class WorktreeSessionManagerTest {
 
+    private static MemberRegistry members() {
+        return new MemberRegistry(new BridgedConfig.Fleet(Map.of(),
+                Map.of("architect", new BridgedConfig.Slot("ltms-local")),
+                Map.of("dev", new BridgedConfig.Slot("ltms-local")),
+                Map.of("reviewer", new BridgedConfig.Slot("ltms-local")), null));
+    }
+
     private static ClaudeCodeLauncher workerService(FakeHerdr herdr) {
         BridgedConfig.Profile cfg = new BridgedConfig.Profile(
                 "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
@@ -56,6 +65,36 @@ class WorktreeSessionManagerTest {
         assertEquals("/caller/proj", startCwd(herdr), "spawn receives the caller's cwd");
     }
 
+    @Test
+    void onlyArchitectsBindAndReleaseMakesTheirSlotReusable() {
+        FakeHerdr herdr = new FakeHerdr();
+        MemberRegistry members = members();
+        SessionManager sessions = new SessionManager(workerService(herdr), new FakeWorktrees());
+        sessions.setMemberLifecycle(members);
+
+        MemberSession architect = sessions.acquire("ltms-local", MemberRole.ARCHITECT,
+                null, "/caller/proj", null, null);
+        MemberSession dev = sessions.acquire("ltms-local", MemberRole.DEV,
+                null, "/caller/proj", null, null);
+        MemberSession reviewer = sessions.acquire("ltms-local", MemberRole.REVIEWER,
+                null, "/caller/proj", null, null);
+
+        assertEquals("architect:architect", members.slotForTerminal(architect.terminalId()));
+        assertNull(members.slotForTerminal(dev.terminalId()), "a dev must never receive architect rights");
+        assertNull(members.slotForTerminal(reviewer.terminalId()),
+                "a reviewer must never receive architect rights");
+
+        sessions.release(architect.paneId());
+        MemberSession replacement = sessions.acquire("ltms-local", MemberRole.ARCHITECT,
+                null, "/caller/proj", null, null);
+        assertEquals("architect:architect", members.slotForTerminal(replacement.terminalId()));
+
+        MemberSession overflow = sessions.acquire("ltms-local", MemberRole.ARCHITECT,
+                null, "/caller/proj", null, null);
+        assertNull(members.slotForTerminal(overflow.terminalId()),
+                "a full slot pool must not stop the architect spawn");
+    }
+
     @Test
     void worktreeAcquireProvisionsAndRecordsPathAndBranch() {
         FakeHerdr herdr = new FakeHerdr();
@@ -79,6 +118,19 @@ class WorktreeSessionManagerTest {
         assertEquals(expectedPath, s.cwd(), "session cwd is the worktree path");
     }
 
+    @Test
+    void worktreeArchitectAcquireAlsoBindsItsSlot() {
+        FakeHerdr herdr = new FakeHerdr();
+        MemberRegistry members = members();
+        SessionManager sessions = new SessionManager(workerService(herdr), new FakeWorktrees());
+        sessions.setMemberLifecycle(members);
+
+        MemberSession architect = sessions.acquire("ltms-local", MemberRole.ARCHITECT,
+                null, "/caller/proj", null, new WorktreeRequest("cb-548", null));
+
+        assertEquals("architect:architect", members.slotForTerminal(architect.terminalId()));
+    }
+
     @Test
     void worktreeAcquireRunsParityOverlayWithProfileDefaults() {
         FakeHerdr herdr = new FakeHerdr();
@@ -94,12 +146,12 @@ class WorktreeSessionManagerTest {
         FakeWorktrees.OverlayCall overlay = worktrees.lastOverlay();
         assertNotNull(overlay);
         assertEquals("/repo", overlay.repoRoot());
-        assertEquals(List.of(".claude/settings.local.json", ".env", ".envrc"),
+        assertEquals(List.of(".env", ".envrc"),
                 overlay.requested(), "default parity overlay is used when unset");
         assertFalse(overlay.requested().contains(".mcp.json"),
                 "CB-525: replicating the primary's MCP config gives a worker the primary's IDE "
                         + "servers, which navigate its edits out of its own worktree");
-        assertEquals(List.of(".claude/settings.local.json", ".envrc"), overlay.copied(),
+        assertEquals(List.of(".envrc"), overlay.copied(),
                 "existing paths are copied; missing paths are skipped");
         assertEquals(List.of(".envrc"), overlay.skipWorktree(),
                 "tracked copied paths are --skip-worktree'd");

docs/CB-301-Session-Manager.md

@@ -35,7 +35,7 @@ build on.
 - **No checkpoint content.** Writing `STATE.md` + commit on teardown is CB-302; CB-301 only exposes
   the release hook it will attach to.
 
-"Recycle" under no-reuse is simply **release + fresh acquire** — a helper, not a pool operation.
+Under no-reuse, a released session is terminal. A new `acquire` always creates a fresh session.
 
 ## Design
 
@@ -46,11 +46,6 @@ ownership on top.
 **Package:** new `dev.ltms.bridged.session` — keeps the registry/lifecycle concern separate from
 the `worker` spawn mechanics. Holds `SessionManager` + `WorkerSession`.
 
-**`recycle` is IN SCOPE for CB-301** (decided): implement `recycle(paneId, …)` = `release` the old
-session then `acquire` a fresh one, asserting a new distinct paneId (the no-reuse invariant). It is
-a thin convenience over the two primitives, shipped now so the no-reuse teardown+respawn path is
-covered by a test from day one.
-
 ### `WorkerSession` (record or small mutable holder)
 
 | Field | Source | Notes |
@@ -88,7 +83,6 @@ SPAWNING|READY|BUSY|DONE --vanished/drop--> FAILED
 final class SessionManager {
     WorkerSession acquire(String profile, String requestedCwd, String callerCwd, String ownerTerminal);
     void          release(String paneId);          // deterministic teardown + deregister
-    WorkerSession recycle(String paneId, ...);      // release + acquire (no-reuse convenience)
     Optional<WorkerSession> get(String paneId);
     List<WorkerSession> roster();                   // bridge-owned view (CB-304 consumes this)
     // lifecycle hooks (package-private): onReady/onDelivered/onComplete/onFailed(target)
@@ -120,8 +114,7 @@ final class SessionManager {
 3. `release` tears the worker down via `WorkerService.stop` and removes it from `roster()`;
    a second `release` on the same paneId is a harmless no-op.
 4. `onTurnFailed` / drop moves the session to `FAILED` and it is absent from the live roster.
-5. `recycle` produces a new paneId and the old one is gone (no-reuse invariant).
-6. `roster()` reflects exactly the sessions acquired-minus-released, joined with live status.
+5. `roster()` reflects exactly the sessions acquired-minus-released, joined with live status.
 
 ## Seams left open (deliberately)