CB-553: enforce maxLoad on explicit-profile spawns (no cap bypass)

Merge CB-548 send ownership and rendezvous hardening
CB-548: guard primary singleton to PRIMARY callers; open waiter before enqueue
2026-08-13 21:12:32 +02:00 · 2026-08-13 19:44:02 +02:00 · 2026-08-13 19:42:48 +02:00 · 2026-08-13 19:42:48 +02:00 · 2026-08-13 19:41:06 +02:00 · 2026-08-13 19:40:17 +02:00
58 changed files with 5490 additions and 218 deletions
@@ -0,0 +1,18 @@
+{
+  "name": "claude-bridge",
+  "description": "Tooling for orchestrating a fleet of delegated coding agents through the bridged MCP gateway.",
+  "owner": {
+    "name": "LTMS"
+  },
+  "plugins": [
+    {
+      "name": "claude-bridge",
+      "source": "./plugin",
+      "description": "Make a project bridge-ready: mount the bridged MCP gateway and apply standard Claude Code settings so a session can orchestrate delegated workers. Ships no credentials.",
+      "version": "0.1.0",
+      "author": {
+        "name": "LTMS"
+      }
+    }
+  ]
+}
@@ -0,0 +1,172 @@
+---
+name: port-to-opencode
+description: Make an OpenCode session a first-class participant in a Claude Code workspace — instructions, MCP servers, and secrets — without duplicating config. Use when onboarding opencode to a project that already has CLAUDE.md and .mcp.json, or when an opencode peer needs the same tools and rules as the Claude session.
+---
+
+# Porting a Claude Code workspace to OpenCode
+
+**The headline: there is almost nothing to port.** OpenCode reads `CLAUDE.md` natively. The only
+artifact you create is one `opencode.json` mapping MCP servers. Do not translate instructions, do
+not generate a second rules file, and do not install a sync tool — every one of those makes the
+workspace worse.
+
+Everything below was verified against `opencode 1.18.16` and the OpenCode docs.
+
+## 1. Know what you get for free
+
+OpenCode's instruction search order:
+
+```
+1. walking up from cwd:   AGENTS.md , then CLAUDE.md
+2. global:                ~/.config/opencode/AGENTS.md
+3. Claude Code global:    ~/.claude/CLAUDE.md          (unless disabled)
+```
+
+*"The first matching file wins in each category."*
+
+Consequences that decide the whole procedure:
+
+- **A project `CLAUDE.md` is already read.** No port needed.
+- **Your user-level `~/.claude/CLAUDE.md` is already read too.** Global preferences carry over.
+- **An `AGENTS.md` in the repo SHADOWS `CLAUDE.md`.** If one exists from a previous Codex port,
+  **delete it** — otherwise opencode reads the stale translated copy instead of the real rules.
+  This is the single most likely way to get this wrong.
+
+## 2. Create `opencode.json` for MCP servers only
+
+Project config lives at `opencode.json` in the repo root; the global one is
+`~/.config/opencode/opencode.json`. **Configs merge, they do not replace** — so machine-local
+servers belong in the global file and shared ones in the project file.
+
+Map each entry from `.mcp.json`:
+
+| `.mcp.json` | `opencode.json` |
+|---|---|
+| `"type": "http"` / `"sse"` | `"type": "remote"`, `"url"` |
+| `"type": "stdio"` | `"type": "local"`, `"command": ["bin", "arg"]` |
+| `"command"` + `"args"` | single `"command"` array |
+| `"env"` | `"environment"` |
+| `"headers"` | `"headers"` |
+
+```json
+{
+  "$schema": "https://opencode.ai/config.json",
+  "instructions": ["CLAUDE.md"],
+  "mcp": {
+    "bridged":  { "type": "remote", "url": "http://127.0.0.1:8765/mcp", "enabled": true },
+    "context7": { "type": "remote", "url": "https://example.dev/mcp", "enabled": true,
+                  "headers": { "Authorization": "Bearer {env:CONTEXT7_TOKEN}" } },
+    "gitea":    { "type": "local", "command": ["gitea-mcp", "-t", "stdio"], "enabled": true,
+                  "environment": { "GITEA_ACCESS_TOKEN": "{env:GITEA_ACCESS_TOKEN}" } }
+  }
+}
+```
+
+Set `instructions` explicitly even though `CLAUDE.md` is found anyway — the fallback only applies
+while no `AGENTS.md` exists, and being explicit survives someone adding one later.
+
+## 3. Reference secrets, never embed them
+
+OpenCode substitutes at load time, in both `headers` and `environment`:
+
+```
+{env:VARIABLE_NAME}      value from the environment
+{file:~/.secrets/token}  value read from a file
+```
+
+**No credential ever belongs in `opencode.json`.** With `{env:…}` there is no reason to write one,
+which is what makes this file safe to commit — and it must be committable, because a peer running
+in a git worktree receives tracked files only.
+
+**But `{env:…}` reads OpenCode's *process* environment — and OpenCode has no env store of its
+own.** A Claude Code `env` block in `~/.claude/settings.json` or `.claude/settings.local.json` does
+**not** reach it: those files are Claude Code's, and the variables exist only inside processes
+Claude Code spawned. Verify with a clean login shell, not the shell your agent hands you:
+
+```bash
+env -u MY_TOKEN zsh -lc 'echo "${MY_TOKEN:-NOT IN PROFILE}"'
+```
+
+So `{env:…}` only works if something puts the variable in the environment first. Pick the supply
+route by who launches opencode:
+
+| Launcher | Route |
+|---|---|
+| a human, from a terminal | `{file:…}` — see below |
+| a spawner (bridge, CI, IDE) | `{env:…}`, with the spawner injecting the variable |
+
+For the human case prefer **`{file:…}` with a workspace-relative path**, kept in a gitignored
+`.secrets/` directory beside `opencode.json`:
+
+```json
+"headers": { "Authorization": "Bearer {file:.secrets/api-token}" }
+```
+
+Verified: opencode resolves relative `{file:}` paths against the project root, so this needs no
+shell setup at all — no rc export leaking the secret to every process, no direnv dependency.
+
+**The catch, and state it out loud:** `.secrets/` is gitignored, so a peer running in a git worktree
+does **not** get it — worktrees receive tracked files only, the same rule that makes `opencode.json`
+itself worth committing. Spawned peers must therefore be fed through `{env:…}` by whatever launches
+them. Check the variable *names* match: a spawner often injects under a different name than your
+shell uses, and the config has no fallback.
+
+## 4. Do not port machine-local MCP servers
+
+IDE indexes, language servers, editor bridges — anything bound to *your* checkout — stay out of the
+project file. Put them in `~/.config/opencode/opencode.json` if you want them personally.
+
+A committed project config reaches every worktree. A worker that mounts servers whose paths point
+into the primary's checkout will edit the primary's files while building in its own — every build
+passes, every change lands in the wrong tree.
+
+Port the servers the work needs. Leave the rest.
+
+## 5. Verify against the running agent, not the file
+
+A file on disk proves nothing about what the agent loaded.
+
+```bash
+opencode run "In one line: state a rule from this project's instructions."
+```
+
+The answer must reflect the actual `CLAUDE.md`. If it answers generically, the instructions did not
+reach the model and everything after this is built on sand.
+
+Then confirm the tools are mounted:
+
+```bash
+opencode mcp list
+```
+
+**"connected" does not mean "working".** A stdio server with a missing credential still completes
+the MCP handshake and reports green; only a real tool call reveals it. Verified: `gitea` showed
+`✓ connected` with no token, then failed the first call with `token is required`. A remote server
+is more honest (`⚠ needs authentication`), but do not rely on that difference — **exercise one
+authenticated tool per server**:
+
+```bash
+opencode run "Call <server>'s <tool>. Report the result or the exact error. One line."
+```
+
+Check too that no server you deliberately withheld is present.
+
+## 6. Report
+
+State what you changed, which servers crossed and which you withheld and why, and quote the
+verification answer verbatim. If any server failed to connect, say so plainly — a partially mounted
+peer is worse than a missing one, because it looks configured.
+
+## Gotchas
+
+- **A leftover `AGENTS.md` silently wins over `CLAUDE.md`.** Check for one before anything else.
+- **`opencode.json` is merged, not overridden** — a global entry and a project entry with the same
+  server name both matter; keep names distinct unless you intend to layer them.
+- **`enabled: false`** turns a server off without deleting its config — prefer it over removal when
+  you may want the server back.
+- **OAuth-based servers** store tokens in `~/.local/share/opencode/mcp-auth.json` after
+  `opencode mcp auth <server>`; that is machine state, never config to commit.
+- **Skills and subagents do not port.** OpenCode uses its own agent markdown under
+  `.opencode/agents/`; `.claude/skills/**` is not read. If a delegation brief tells a peer to load a
+  skill by name, that instruction has no effect on an opencode peer — spell the procedure out in the
+  brief, or author the equivalent agent file.
@@ -0,0 +1,12 @@
+# Workspace-scoped secrets for tools that read no settings cascade of their own
+# (opencode resolves these via {file:.secrets/...} in opencode.json).
+.secrets/
+
+# Settings backups inherit the env block — and secrets with it.
+.claude/settings.local.json.bak*
+
+# Daemon runtime artefacts. bridged appends its log wherever it is launched from, so both the
+# repo root and bridged/ collect one; neither belongs in git.
+bridged.out
+bridged/bridged.out
+logs/
@@ -41,8 +41,9 @@ nothing. Fail toward the recoverable error.
 2. **The bridge is the only channel.** Text you print in your terminal reaches nobody — the other
   side cannot see your screen. An answer that isn't in a `bridge_*` call is silently discarded.
 3. **Identity comes from the connection, never an argument.** Workers never pass a target; you
-   cannot act as another session. Spawn/stop/send/drain are primary-only; reply/ask are
-   worker-only-and-only-as-itself. A call outside your role is refused, not queued.
+   cannot act as another session. Spawn/stop/send/drain are lead-only; reply/ask are
+   only-as-itself — any peer may answer for its own pane, and for no other. A call outside your
+   role is refused, not queued.
 4. **Delivery is status-gated: one message per turn.** Don't busy-poll a peer's terminal and don't
   re-send because a call looks slow — the bridge delivers when the peer is `idle`/`blocked`.
 5. **Never drive the terminal multiplexer directly** (no `herdr` CLI, no socket). The bridge owns
@@ -101,13 +102,42 @@ the merge — and merging on a reviewer's word is delegating it by proxy.
 | Confirm your own role | `bridge_whoami` |
 | See backends available | `bridge_profiles` |
 | Start a worker | `bridge_spawn{profile?, cwd?, worktree?, ticket?}` → `sessionId` + `paneId` |
-| See the fleet | `bridge_list` · one worker's state: `bridge_status{sessionId}` |
+| See the fleet | `bridge_list` → `leads` (your peers) + `workers` · one peer's state: `bridge_status{sessionId}` |
 | Delegate (blocking) | `bridge_send{sessionId, content}` |
 | Delegate (long task) | `bridge_send{sessionId, content, wait:false}` → ticket → `bridge_poll{ticket}` |
 | Answer a worker's `bridge_ask` | `bridge_send{turnId, content}` — **not** `sessionId` |
+| Message a **peer lead** | `bridge_send{sessionId: <their terminal>, content}` — `bridge_list` → `leads` reports it. Coordination only, **never** a task |
+| Answer a peer lead that messaged you | `bridge_reply{content}` — the one case a lead replies |
 | Collect a held reply | `bridge_poll{target}` · then `bridge_ack{target, msgId}` |
 | Tear down | `bridge_stop{paneId}` |

+### Lead ↔ lead — coordinate, never delegate
+
+`bridge_list` returns `leads` alongside `workers`; your own row carries `self: true`. Every other row
+is a peer — an orchestrator with its own context, its own workers, and its own judgment. An empty
+`workers` array means no workers are spawned; it says nothing about peers.
+
+**A lead never assigns a task to another lead.** Work goes to workers — only ever downward, never
+sideways. Sending a peer a brief with acceptance criteria is a category error: a brief is a worker's
+artefact, and a peer is not yours to task. If a unit needs doing and it falls in your area, spawn a
+worker and delegate it yourself; if it falls in the peer's area, say so and let the peer assign it.
+The traffic between leads is coordination and nothing else:
+
+1. **Divide the map, not the work.** Agree who owns which area, then each of you assigns inside your
+   own. Split by **context ownership** — whoever already holds the context owns that area — and say
+   who takes what, in one message, before either of you starts. Two leads silently working the same
+   unit is the failure mode here, and neither notices until the merge.
+2. **Share findings, hazards, and corrections.** What you have already discovered, what broke, what
+   the next person will trip on. This is the traffic that actually pays for the channel: it costs one
+   message and saves a peer a rediscovery.
+3. **Verify a peer exactly as you verify yourself.** Peer status buys nothing: check the claim
+   against the code, and re-run the build. A peer's correction gets the same treatment — right or
+   wrong on the evidence, not on who said it. Neither of you merges the other's work unreviewed.
+
+Being messaged by a peer does not make you its worker: answer with `bridge_reply`, and push back on
+the substance if it is wrong. A peer that simply complies has thrown away the reason there are two of
+you.
+
 ### Worker — the turn contract

 1. **Load the playbook skill the lead named** before doing anything else.
@@ -143,6 +173,8 @@ charter, not here.
  `mcp/ConnectionIdentity` (connection→role), and `worker/*Launcher` (`REPLY_CHARTER`).
 - **Skills available to delegate:** `implementer` (worktree → commit → push → own PR) and
  `reviewer` (scoped review → one structured finding). Name one in every delegation.
+- **Primary-side skills** (not delegation playbooks — a worker cannot use them):
+  `port-to-opencode` (make an OpenCode session a participant in this workspace).
 - **Never commit** `.mcp.json` (the primary's local copy, flagged `--skip-worktree`) or `wiki/`
  (a submodule with its own remote).
 - **Flows and the error model** — rendezvous, `bridge_ask`, detached delivery, turn-done fallback —
@@ -42,6 +42,48 @@ bind:
 #   pushReminders: 5      # max nudges before giving up (default 5)
 #   pushBackoffMs: 15000  # delay between nudges (default 15000)

+# CB-530: MORE THAN ONE LEAD. `primary:` above is singular by construction — every other pane
+# resolves as a worker — which is right for one lead driving a fleet and wrong the moment two leads
+# (say a Claude lead and an opencode lead) work as peers: the second is silently demoted and refused
+# every orchestration call. List each lead's pane here and all of them resolve as leads.
+#
+#   terminal → the ONLY field identity depends on; get it from that session's bridge_whoami
+#   kind/model → descriptive; they document what runs in the pane and are echoed by bridge_whoami
+#
+# A lead is never spawned — it pre-exists, which is exactly why it must be named rather than created.
+# `bridge_whoami` reports `{"role":"primary","leader":"<name>"}`; role stays "primary" because a lead
+# IS a primary for authorization, so nothing that keys on the role breaks.
+#
+# KEEP `primary:` when adding leads: it still addresses the CB-307 push loop, which needs a single
+# destination for its nudges. If both name the same terminal, the `leaders:` entry wins.
+# leaders:
+#   opus-5.0:
+#     terminal: term_0123456789abcd
+#     kind: claude
+#   gpt-sol-5.6:
+#     terminal: term_fedcba9876543
+#     kind: opencode
+#     model: openai/gpt-5.6-terra
+
+# CB-531: FIND LEADS BY TAB NAME instead of pasting terminal ids. `leaders:` above needs an id that
+# only exists once the session is running, so adding a lead is: open a tab, start the agent, ask it
+# bridge_whoami, edit this file, restart the daemon. This block replaces all of that with a naming
+# convention — label the tab `lead: <name>` when you open it and the pane is recognised on the next
+# rescan, with no config edit and no restart. Reopen the tab later and the id changes; the label
+# does not.
+#
+# bridged NEVER writes these labels. It renames worker tabs (see `tabLabel` below) but reads lead
+# tabs read-only, so what is in the tab bar is always what you typed. Two things keep the convention
+# from being a way to claim leadership: the configured worker spaces are excluded from the scan, so
+# nothing bridged places can land in a matching tab; and startup REFUSES a `tabPrefix` that any
+# worker `tabLabel` also matches, so the two namespaces cannot overlap by accident.
+#
+# Opt-in on purpose — this widens who resolves as a lead, so upgrading the daemon must never switch
+# it on for you. Absent block = leads come only from `leaders:`/`primary:`, exactly as before.
+# leadScan:
+#   tabPrefix: "lead:"      # `lead: opus-5.0` ⇒ a lead named opus-5.0 (case-insensitive; default "lead:")
+#   intervalSeconds: 10     # rescan cadence, and the worst case before a new tab is recognised
+
 # herdr Unix socket. Omit to use the client default
 # (${HERDR_SOCKET_PATH:-~/.config/herdr/herdr.sock}).
 herdrSocket: ~/.config/herdr/herdr.sock
@@ -116,15 +158,21 @@ workers:
    # configDir: /Users/me/.ccs/instances/gx10   # CLAUDE_CONFIG_DIR — inherit that profile's skills/MCP
    # cwd: /Users/me/src/myrepo       # pin the working dir; omit to inherit the primary's
    # parityOverlay: [".claude/settings.local.json", ".env", ".envrc"]   # never add .mcp.json — see above
-  ollama:
-    baseUrl: http://ollama.ltms.dev  # local/self-hosted; usually no token
+  gx11:                              # a second backend, so `placement: weighted` has a choice
+    baseUrl: http://gx01.gw:8000     # self-hosted; ccs handles the model + token
    placement: tab
    workspace: bridged-workers
    tabLabel: "worker: {profile} #{n}"
    mcpUrl: http://127.0.0.1:8765/mcp
-    argv: ["ccs", "ollama"]
+    argv: ["ccs", "gx11"]
    weight: 0.5
    maxLoad: 2
+    # Pin an auto-compact window BELOW the served model's context ceiling. The global
+    # ~/.claude/settings.json value is shared by every ccs instance and the primary, so the
+    # per-profile override belongs here. Equal to the ceiling means auto-compact never fires
+    # before the server rejects the prompt, which kills a worker mid-turn (CB-523).
+    env:
+      CLAUDE_CODE_AUTO_COMPACT_WINDOW: "280000"
  # CB-402: a second coding-agent kind, proving the PeerLauncher SPI is provider-neutral.
  # opencode is provider-agnostic and uses NONE of Claude's private seams: no ANTHROPIC_BASE_URL /
  # SubscriptionGuard (so it needs no `guard` host entry), no --mcp-config / --append-system-prompt.
@@ -179,7 +227,6 @@ guard:
  offSubscriptionHosts:
    - gx00.gw
    - gx01.gw
-    - ollama.ltms.dev

 # Spawn-readiness gate (CB-306). The launcher blocks until the worker's herdr status is
 # injectable (IDLE/BLOCKED/DONE) or the timeout elapses. 0 disables the gate.
@@ -5,6 +5,7 @@ import dev.ltms.bridged.guard.SubscriptionGuard;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.HerdrClient;
 import dev.ltms.bridged.herdr.HerdrException;
+import dev.ltms.bridged.herdr.LeadTabScanner;
 import dev.ltms.bridged.herdr.PaneLocator;
 import dev.ltms.bridged.herdr.UnixSocketHerdrClient;
 import dev.ltms.bridged.herdr.WorkspaceControl;
@@ -13,6 +14,7 @@ import dev.ltms.bridged.inject.Injector;
 import dev.ltms.bridged.inject.StatusPoller;
 import dev.ltms.bridged.inject.TurnListener;
 import dev.ltms.bridged.inject.WorkerPresence;
+import dev.ltms.bridged.auth.ArchitectRegistry;
 import dev.ltms.bridged.auth.CallerResolver;
 import dev.ltms.bridged.mcp.BridgeMcp;
 import dev.ltms.bridged.mcp.ConnectionIdentity;
@@ -46,9 +48,15 @@ import java.util.ArrayList;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
+import java.util.Set;
 import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Function;
+import java.util.function.Predicate;
+import java.util.function.Supplier;
+import java.util.stream.Collectors;

 /**
 * {@code bridged} entry point. Wires the real herdr socket client to the REST app and
@@ -79,6 +87,13 @@ public final class Bridged {
        // refuses remote connections to a loopback socket. This throws rather than warns so the
        // dangerous configuration cannot be reached by ignoring a log line.
        cfg.validateAuthExposure();
+        cfg.validateLeadScan();
+        // CB-542: a subscription:true profile whose env: reseats ANTHROPIC_BASE_URL/AUTH_TOKEN would
+        // reach an unguarded endpoint (the launcher skips SubscriptionGuard for it). Refuse at load.
+        cfg.validateSubscriptionProfiles();
+        // CB-548: every architect slot must name a configured workers: profile — the strong-model
+        // backend the future spawn lifecycle would read. A stale reference dies here, not later.
+        cfg.validateArchitects();

        Path socket = cfg.herdrSocket() != null && !cfg.herdrSocket().isBlank()
                ? Path.of(cfg.herdrSocket())
@@ -114,7 +129,7 @@ public final class Bridged {
                    opencodeProfiles, cfg.defaultProfile(), System::getenv,
                    cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs()));
        }
-        AtomicReference<Function<String, Integer>> liveCountRef = new AtomicReference<>(name -> 0);
+        AtomicReference<Function<String, Integer>> liveCountRef = new AtomicReference<>(_ -> 0);
        PeerLauncher workers = new CompositePeerLauncher(
                adapters,
                cfg.defaultProfile(),
@@ -144,7 +159,9 @@ public final class Bridged {
                && cfg.lifecycle().contextCap() > 0) {
            contextCap = cfg.lifecycle().contextCap();
        }
-        SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot()), contextCap);
+        boolean clearAfterTurn = cfg.lifecycle() != null && cfg.lifecycle().clearAfterTurn();
+        SessionManager sessions = new SessionManager(workers, new GitWorktrees(cfg.worktreeRoot()),
+                System::nanoTime, contextCap, clearAfterTurn);
        liveCountRef.set(profileName -> (int) sessions.roster().stream()
                .filter(s -> profileName.equals(s.profile()))
                .count());
@@ -160,6 +177,45 @@ public final class Bridged {
            reaper = null;
        }

+        // CB-530: every pane the config names as a lead, merged from `leaders:` and the legacy
+        // singular pin. PrimaryRegistry below still tracks ONE terminal — it addresses the push
+        // loop's nudges, which need a single destination — so it keeps the legacy pin.
+        Map<String, String> leadTerminals = cfg.leaderTerminals();
+        if (leadTerminals.size() > 1) {
+            log.info("leads: {} panes recognised {}", leadTerminals.size(), leadTerminals.values());
+        }
+        // CB-531: on top of the static registry, discover leads by the tab labels the operator
+        // writes. Opt-in, so a config with no `leadScan:` block resolves exactly as it did under
+        // CB-530 — the supplier is then a constant and never touches herdr.
+        final Supplier<Map<String, String>> leads;
+        if (cfg.leadScan() != null) {
+            var scan = cfg.leadScan();
+            Set<String> workerSpaces = cfg.workerProfiles().values().stream()
+                    .map(BridgedConfig.Worker::workspace)
+                    .filter(Objects::nonNull)
+                    .collect(Collectors.toSet());
+            leads = new LeadTabScanner(herdr, scan.tabPrefix(), workerSpaces, leadTerminals,
+                    TimeUnit.SECONDS.toNanos(scan.intervalSeconds()), System::nanoTime);
+            log.info("lead scan: tabs labelled '{}…' host a lead (rescan every {}s, worker spaces {} "
+                            + "excluded)",
+                    scan.tabPrefix(), scan.intervalSeconds(), workerSpaces);
+        } else {
+            leads = () -> leadTerminals;
+        }
+
+        // CB-548: config-declared architect slots. Config supplies only the stable name → profile
+        // map; the terminal → slot binding is owned by the registry and is empty at startup, so no
+        // pane resolves to an architect until the later spawn lifecycle binds one. The registry is
+        // what CallerResolver resolves against and what that lifecycle will read profiles from;
+        // nothing here spawns a slot.
+        ArchitectRegistry architects = new ArchitectRegistry(
+                cfg.architects() == null ? Map.of() : cfg.architects());
+        if (!architects.slots().isEmpty()) {
+            log.info("architect slots: {} configured {} — none bound yet (a slot is idle until the "
+                            + "spawn lifecycle binds a live terminal to it)",
+                    architects.slots().size(), architects.slots().keySet());
+        }
+
        // Status-gated injector (CB-103): the single writer into workers, fed by a poller.
        // The blocking message endpoint (CB-104) is the producer; the poller is inert until then.
        // CB-106: a confirmed turn completion resolves a blocked send whose worker never replied.
@@ -175,6 +231,17 @@ public final class Bridged {
                sessions.onTurnComplete(target);
            }

+            @Override
+            public boolean hasPostTurnAction(String target) {
+                return sessions.hasPostTurnAction(target);
+            }
+
+            @Override
+            public boolean onTurnCompleteWithPostAction(String target) {
+                completion.resolveBeforePostAction(target);
+                return sessions.onTurnCompleteWithPostAction(target);
+            }
+
            @Override
            public void onDelivered(String target) {
                completion.onDelivered(target);
@@ -187,7 +254,8 @@ public final class Bridged {
                sessions.onTurnFailed(target);
            }
        };
-        Injector injector = new Injector(agents, turnListener, presence::isPresent, presence::forget);
+        Injector injector = new Injector(agents, turnListener, deliverableTo(presence, leads),
+                presence::forget);
        StatusPoller poller = new StatusPoller(agents, injector, INJECT_POLL_MILLIS);
        poller.start();

@@ -207,7 +275,15 @@ public final class Bridged {
        // otherwise resolve as a worker and be refused every orchestration tool.
        String pinnedPrimaryTerminal = cfg.primary() != null ? cfg.primary().terminal() : null;
        PrimaryRegistry primaryRegistry = new PrimaryRegistry(pinnedPrimaryTerminal);
-
+        // CB-532: `primary.terminal` is superseded and no longer needed for either of its jobs —
+        // identity comes from `leaders:`/`leadScan:`, and reply nudges now follow the delegating
+        // lead. Say so once at startup rather than leaving a redundant pin to look load-bearing.
+        if (pinnedPrimaryTerminal != null && !pinnedPrimaryTerminal.isBlank()) {
+            log.warn("primary.terminal is DEPRECATED (CB-532) and can be deleted: identity now comes "
+                    + "from leaders:/leadScan:, and reply nudges follow the lead that delegated. "
+                    + "It still works, and is still the fallback nudge destination when a restart "
+                    + "has lost the delegation map. Its pushReminders/pushBackoffMs stay valid.");
+        }
        // CB-307: active push-to-primary loop — nudge the primary when replies land without an
        // open bridge_send. Uses its own lightweight scheduled executor, separate from the injector.
        int maxReminders = cfg.primary() != null ? cfg.primary().remindersOrDefault() : 5;
@@ -232,6 +308,7 @@ public final class Bridged {
        sessions.onRelease(terminal -> {
            messages.abandon(terminal, "the worker session was released before it replied");
            replyInbox.release(terminal);
+            primaryRegistry.forgetDelegation(terminal); // CB-532: don't leak the lead binding
        });

        // MCP server face (CB-105): bridge_send/bridge_reply/bridge_status, mounted at /mcp.
@@ -248,11 +325,13 @@ public final class Bridged {
                throw new IllegalStateException("auth.mode=token but env var " + cfg.auth().tokenEnv()
                        + " is unset or empty — export it before starting bridged");
            }
-            callers = new CallerResolver(identity, true, token, pinnedPrimaryTerminal);
+            callers = CallerResolver.withLeadsAndArchitects(identity, true, token, leads,
+                    architects::snapshot);
            log.info("auth: token mode (bearer required for non-worker callers, env {})",
                    cfg.auth().tokenEnv());
        } else {
-            callers = new CallerResolver(identity, false, null, pinnedPrimaryTerminal);
+            callers = CallerResolver.withLeadsAndArchitects(identity, false, null, leads,
+                    architects::snapshot);
            log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
        }

@@ -287,6 +366,28 @@ public final class Bridged {
                cfg.bind().host(), cfg.bind().port(), socket);
    }

+    /**
+     * The {@link Injector}'s readiness gate (CB-534): a target is deliverable if it is a worker whose
+     * agent has connected the bridge MCP, <em>or</em> a lead.
+     *
+     * <p>The gate exists for one reason — to hold a delivery out of a <em>spawned</em> worker's boot
+     * window, where herdr already reports {@code idle} but the TUI would drop an injected paste. That
+     * hazard is a property of spawning. A lead is never spawned: the operator started it and named it
+     * (or labelled its tab) only once it was up, so there is no boot window to guard.
+     *
+     * <p>A lead is also never enrolled in {@link WorkerPresence} — {@code BridgeMcp} marks presence
+     * only for a worker, deliberately, since that map doubles as the worker roster's availability
+     * signal and a lead counted there would show up as an available worker. So without the second
+     * disjunct a lead is permanently un-deliverable: every lead→lead send sat on the gate for
+     * {@code READINESS_GRACE_POLLS} (~60s) and then failed having never been typed into the pane.
+     *
+     * <p>The lead set is read through the supplier on each call rather than snapshotted, so a lead
+     * discovered by {@code leadScan} after startup becomes deliverable without a restart.
+     */
+    static Predicate<String> deliverableTo(WorkerPresence presence, Supplier<Map<String, String>> leads) {
+        return target -> presence.isPresent(target) || leads.get().containsKey(target);
+    }
+
    /**
     * Poll herdr's {@code ping} until it answers or {@link #HERDR_WAIT_SECONDS} elapses (CB-504).
     *
@@ -0,0 +1,142 @@
+package dev.ltms.bridged.auth;
+
+import dev.ltms.bridged.config.BridgedConfig;
+
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * The architect-slot registry (CB-548): every gateway-local architect name and the strong-model
+ * profile it points at, plus the <em>live</em> bindings from a live architect's herdr terminal to
+ * its slot.
+ *
+ * <p>Two halves, split by who owns each:
+ * <ul>
+ *   <li><b>slots</b> — configured once, keyed by the gateway-local unique name; each carries the
+ *       {@code profile} reference the spawn lifecycle reads when it stands the slot up. A read-only
+ *       snapshot taken at construction.</li>
+ *   <li><b>terminal bindings</b> — owned by this registry and initially <em>empty</em>. Config
+ *       declares no architect terminal, so at startup every slot is idle and nothing resolves to an
+ *       architect; a session only becomes one when the spawn lifecycle {@linkplain #bind(String,
+ *       String) binds} its terminal to a slot. {@link CallerResolver} reads this through
+ *       {@link #snapshot()} to turn a pane into an {@link Role#ARCHITECT}.</li>
+ * </ul>
+ *
+ * <p>Spawning/lifecycle is deliberately a separate unit: this class only owns the bindings and
+ * exposes the map the resolver resolves against plus the profile lookup lifecycle will call.
+ * Nothing here creates or manages an architect session.
+ */
+public final class ArchitectRegistry {
+
+    private final Map<String, BridgedConfig.Architect> slots;
+    /** Live {@code terminal_id → slot name}; guarded by {@code this}. */
+    private final Map<String, String> terminalToSlot = new HashMap<>();
+
+    public ArchitectRegistry(Map<String, BridgedConfig.Architect> slots) {
+        this.slots = slots == null ? Map.of() : Map.copyOf(slots);
+    }
+
+    /** The configured slots, keyed by gateway-local unique name. Unmodifiable snapshot. */
+    public Map<String, BridgedConfig.Architect> slots() {
+        return slots;
+    }
+
+    /**
+     * An immutable copy of the live {@code terminal_id → slot name} bindings.
+     *
+     * <p>Passed to {@link CallerResolver} as the source of architect identity, and what
+     * {@code bridge_whoami}/the roster will read to say which slot a pane hosts. Empty until the
+     * spawn lifecycle binds a slot.
+     */
+    public Map<String, String> snapshot() {
+        synchronized (terminalToSlot) {
+            return Map.copyOf(terminalToSlot);
+        }
+    }
+
+    /** The slot a live terminal is bound to, or {@code null} if it is not an architect slot. */
+    public String slotForTerminal(String terminal) {
+        if (terminal == null) {
+            return null;
+        }
+        synchronized (terminalToSlot) {
+            return terminalToSlot.get(terminal);
+        }
+    }
+
+    /**
+     * The strong-model profile a slot runs under — what the spawn lifecycle reads.
+     *
+     * @return the slot's configured {@code profile}, or {@code null} if the slot is unknown or
+     *         declares none
+     */
+    public String profileForSlot(String slotName) {
+        BridgedConfig.Architect a = slots.get(slotName);
+        return (a == null || a.profile() == null) ? null : a.profile();
+    }
+
+    /** True when {@code slotName} is a configured architect slot. */
+    public boolean isSlot(String slotName) {
+        return slots.containsKey(slotName);
+    }
+
+    /**
+     * Bind {@code terminal} to {@code slot} (CB-548).
+     *
+     * <p>The spawn lifecycle calls this when it stands a slot up. The bind is atomic and preserves
+     * the two cardinality invariants: a terminal may occupy at most one slot, and a slot may host at
+     * most one terminal. Binding the same terminal to the same slot again is a harmless no-op.
+     *
+     * @param slot     a configured slot name, or the bind is refused
+     * @param terminal the pane that will act as this architect
+     * @return {@code true} if the binding is now {@code terminal → slot}; {@code false} if it was
+     *         refused — an unknown slot, a terminal already bound to a different slot, or a slot
+     *         already hosting a different terminal
+     */
+    public boolean bind(String slot, String terminal) {
+        if (slot == null || terminal == null || terminal.isBlank()) {
+            return false;
+        }
+        synchronized (terminalToSlot) {
+            if (!isSlot(slot)) {
+                return false; // unknown slot — nothing to bind to
+            }
+            String existingSlot = terminalToSlot.get(terminal);
+            if (existingSlot != null) {
+                return slot.equals(existingSlot); // already this slot (idempotent) or a different one
+            }
+            if (terminalToSlot.containsValue(slot)) {
+                return false; // slot already hosts a terminal — no second one
+            }
+            terminalToSlot.put(terminal, slot);
+            return true;
+        }
+    }
+
+    /**
+     * Compare-safe unbind of {@code expectedTerminal} from {@code slot} (CB-548).
+     *
+     * <p>The spawn lifecycle calls this when it tears a slot down. Only the exact binding
+     * {@code expectedTerminal → slot} is removed; if that terminal was since rebound to a different
+     * slot (or the slot to a different terminal), the call is a no-op returning {@code false} — a
+     * stale unbind must never remove a replacement.
+     *
+     * @param slot             the slot the caller believes the terminal is bound to
+     * @param expectedTerminal the terminal it expects to be bound there
+     * @return {@code true} if {@code expectedTerminal → slot} was removed; {@code false} if nothing
+     *         was (no such binding, or the binding had already moved)
+     */
+    public boolean unbind(String slot, String expectedTerminal) {
+        if (slot == null || expectedTerminal == null) {
+            return false;
+        }
+        synchronized (terminalToSlot) {
+            String current = terminalToSlot.get(expectedTerminal);
+            if (current == null || !slot.equals(current)) {
+                return false; // absent, or a replacement/moved binding — leave it in place
+            }
+            terminalToSlot.remove(expectedTerminal);
+            return true;
+        }
+    }
+}
@@ -46,18 +46,28 @@ public final class Authz {
            return false; // authenticated as nothing ⇒ authorized for nothing
        }
        return switch (action) {
-            // Orchestration is the primary's alone. A worker driving spawn/stop/send would be a
-            // worker escalating into the orchestrator role.
-            case SPAWN, STOP, SEND, DRAIN -> caller.isPrimary();
+            // Fleet lifecycle is the primary's alone — spawn, stop, drain. An architect
+            // deliberately does NOT get these (CB-548), so it cannot tear down or stand up workers
+            // even though it coordinates them; and a worker driving any of these would be a worker
+            // escalating into the orchestrator role.
+            case SPAWN, STOP, DRAIN -> caller.isPrimary();

-            // The load-bearing rule: a worker acts only as itself. The primary is deliberately
-            // excluded — a reply/ask is a worker's own turn output, and letting the primary forge
-            // one would corrupt the rendezvous correlation it is itself waiting on.
+            // Delivering a turn is open to the primary and the architect: an architect delegates
+            // to workers (that is the role's point) but still has no lifecycle rights. A worker is
+            // excluded — sending would be it escalating.
+            case SEND -> caller.isPrimary() || caller.isArchitect();
+
+            // The load-bearing rule: a caller acts only as the pane it occupies. CB-532 widened who
+            // that can be — a lead answering another lead is replying for its OWN terminal, which
+            // this already permits — while the rule itself is unchanged, and is what stops anyone
+            // forging a reply for a rendezvous someone else is waiting on. An architect's own pane
+            // passes through the same check, so it can answer a funnel that delegated to it. An
+            // unnamed primary (token/loopback, no pane) owns nothing and is still excluded.
            case REPLY, ASK -> caller.ownsSession(targetSession);

-            // Observation is open to both authenticated roles: a worker legitimately polls its own
+            // Observation is open to every authenticated role: a worker legitimately polls its own
            // status, and the roster carries no secrets.
-            case READ, METRICS -> caller.isPrimary() || caller.isWorker();
+            case READ, METRICS -> caller.isPrimary() || caller.isWorker() || caller.isArchitect();
        };
    }

@@ -4,6 +4,8 @@ import dev.ltms.bridged.mcp.ConnectionIdentity;

 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
+import java.util.Map;
+import java.util.function.Supplier;

 /**
 * Resolves every caller to a {@link Principal}, for both entry paths into the core (CB-501).
@@ -15,10 +17,17 @@ import java.security.MessageDigest;
 *
 * <p><strong>Resolution order</strong> — connection identity first, token second, nothing third:
 * <ol>
- *   <li>A loopback peer PID that maps to the pinned {@code primary.terminal} pane (CB-307) ⇒
- *       {@link Role#PRIMARY}. The pane mapping is as unforgeable as a worker's, and the config
- *       explicitly names that pane as the primary's own — without this rule a primary running
- *       <em>inside</em> a herdr pane is misread as a worker and locked out of orchestration.</li>
+ *   <li>A loopback peer PID that maps to a pane named by {@code leaders:}, by the legacy
+ *       {@code primary.terminal} pin, or by an operator-labelled lead tab (CB-307, CB-530, CB-531)
+ *       ⇒ {@link Role#PRIMARY}, carrying that lead's
+ *       name. The pane mapping is as unforgeable as a worker's, and the config explicitly names
+ *       that pane as a lead's own — without this rule a lead running <em>inside</em> a herdr pane
+ *       is misread as a worker and locked out of orchestration. More than one pane may be named,
+ *       so two leads can work as peers rather than one being demoted.</li>
+ *   <li>A loopback peer PID that maps to a pane bound to a CB-548 architect slot ⇒
+ *       {@link Role#ARCHITECT}, carrying the slot name. Just unforgeable as a worker's, and
+ *       resolved from the <em>live</em> terminal→slot binding (never a request argument), before
+ *       the generic worker fallback.</li>
 *   <li>A loopback peer PID that maps to any other herdr pane ⇒ {@link Role#WORKER}. This is
 *       unforgeable (the OS reports the PID, herdr owns the PID→pane map) and is honoured
 *       regardless of auth mode, so enabling auth never breaks the fleet.</li>
@@ -33,29 +42,115 @@ public final class CallerResolver {
    private final ConnectionIdentity identity;
    private final boolean tokenMode;
    private final byte[] expectedToken; // null unless tokenMode
-    private final String pinnedPrimaryTerminal; // null unless primary.terminal is configured
+    /**
+     * terminal_id → lead name; empty when nothing is pinned. CB-530.
+     *
+     * <p>A supplier rather than a map because the registry is no longer fixed at startup: CB-531
+     * discovers leads by scanning herdr for operator-labelled tabs, so a lead that opens its tab
+     * after the daemon booted must still be recognised. Consulted per resolve; the scanner behind
+     * it is TTL-cached, so this is a map lookup in the common case.
+     */
+    private final Supplier<Map<String, String>> leadTerminals;
+    /**
+     * terminal_id → architect slot name; empty when nothing is configured. CB-548.
+     *
+     * <p>Like {@link #leadTerminals}, a supplier rather than a fixed map, so a binding injected
+     * after startup — when the later spawn lifecycle establishes a live architect session, or an
+     * operator pins one — takes effect without a restart. Consulted per resolve; today's wiring
+     * in {@code Bridged} reads a constant from config, which is the degenerate live case.
+     */
+    private final Supplier<Map<String, String>> architectTerminals;

    /** Loopback-trust resolver: no token required, historical behaviour. */
    public CallerResolver(ConnectionIdentity identity) {
-        this(identity, false, null, null);
+        this(identity, false, null, Map.of());
    }

-    /** As {@link #CallerResolver(ConnectionIdentity, boolean, String, String)} with no pin. */
+    /** As {@link #CallerResolver(ConnectionIdentity, boolean, String, Map)} with no leads pinned. */
    public CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token) {
-        this(identity, tokenMode, token, null);
+        this(identity, tokenMode, token, Map.of());
    }

    /**
-     * @param identity               connection-based worker identification
-     * @param tokenMode              when true, a non-worker caller must present a valid bearer token
-     * @param token                  the expected bearer token; required (non-blank) when
-     *                               {@code tokenMode}
-     * @param pinnedPrimaryTerminal  the primary's own herdr {@code terminal_id} from
-     *                               {@code primary.terminal} ({@code null}/blank = unpinned); a
-     *                               caller resolving to this pane is the primary, not a worker
+     * Single-pin form for the legacy {@code primary.terminal}-only configuration — one lead, named
+     * {@code primary}.
+     *
+     * <p>A static factory rather than a fourth constructor overload on purpose: {@code String} and
+     * {@code Map} overloads are ambiguous for a literal {@code null} argument, which is a compile
+     * error at the call site and exactly the shape "unpinned" is written in.
+     *
+     * @param pinnedPrimaryTerminal the primary's own herdr {@code terminal_id}
+     *                              ({@code null}/blank = unpinned)
+     */
+    public static CallerResolver pinnedTo(ConnectionIdentity identity, boolean tokenMode,
+                                          String token, String pinnedPrimaryTerminal) {
+        return new CallerResolver(identity, tokenMode, token,
+                pinnedPrimaryTerminal == null || pinnedPrimaryTerminal.isBlank()
+                        ? Map.of() : Map.of(pinnedPrimaryTerminal, "primary"));
+    }
+
+    /**
+     * @param identity       connection-based worker identification
+     * @param tokenMode      when true, a non-worker caller must present a valid bearer token
+     * @param token          the expected bearer token; required (non-blank) when {@code tokenMode}
+     * @param leadTerminals  herdr {@code terminal_id} → lead name for every configured lead
+     *                       (CB-530). A caller resolving to one of these panes is that lead — a
+     *                       {@link Role#PRIMARY} — rather than a worker. Empty = nothing pinned,
+     *                       so every pane resolves as a worker.
     */
    public CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
-                          String pinnedPrimaryTerminal) {
+                          Map<String, String> leadTerminals) {
+        this(identity, tokenMode, token, fixed(leadTerminals), null);
+    }
+
+    /**
+     * Map-form of both registries (CB-548): lead terminals and the initial architect terminal
+     * bindings, each snapshotted at construction (a handed-over map is not offered as live state).
+     */
+    public CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                          Map<String, String> leadTerminals,
+                          Map<String, String> architectTerminals) {
+        this(identity, tokenMode, token, fixed(leadTerminals), fixed(architectTerminals));
+    }
+
+    /**
+     * Live-registry form: {@code leadTerminals} is consulted on every resolve, so leads discovered
+     * after startup (CB-531's tab scan) take effect without a restart.
+     *
+     * <p>A static factory rather than a fourth constructor overload, for the same reason as
+     * {@link #pinnedTo}: {@code Map} and {@code Supplier} overloads are ambiguous for a literal
+     * {@code null}.
+     */
+    public static CallerResolver withLeads(ConnectionIdentity identity, boolean tokenMode,
+                                           String token,
+                                           Supplier<Map<String, String>> leadTerminals) {
+        return new CallerResolver(identity, tokenMode, token, leadTerminals, null);
+    }
+
+    /**
+     * Live-registry form for both {@code leadTerminals} and the CB-548 architect registry: both
+     * are consulted on every resolve, so a slot binding injected after startup takes effect
+     * without a restart.
+     *
+     * <p>A static factory rather than a constructor overload, for the same reason as
+     * {@link #pinnedTo}: too many {@code Map}/{@code Supplier} combinations to make {@code null}
+     * unambiguous.
+     */
+    public static CallerResolver withLeadsAndArchitects(ConnectionIdentity identity,
+                                                        boolean tokenMode, String token,
+                                                        Supplier<Map<String, String>> leadTerminals,
+                                                        Supplier<Map<String, String>> architectTerminals) {
+        return new CallerResolver(identity, tokenMode, token, leadTerminals, architectTerminals);
+    }
+
+    private static Supplier<Map<String, String>> fixed(Map<String, String> leadTerminals) {
+        Map<String, String> snapshot = leadTerminals == null ? Map.of() : Map.copyOf(leadTerminals);
+        return () -> snapshot;
+    }
+
+    private CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                           Supplier<Map<String, String>> leadTerminals,
+                           Supplier<Map<String, String>> architectTerminals) {
        if (tokenMode && (token == null || token.isBlank())) {
            throw new IllegalArgumentException(
                    "auth.mode=token requires a non-empty token; check that the env var named by "
@@ -64,9 +159,32 @@ public final class CallerResolver {
        this.identity = identity;
        this.tokenMode = tokenMode;
        this.expectedToken = tokenMode ? token.getBytes(StandardCharsets.UTF_8) : null;
-        this.pinnedPrimaryTerminal =
-                pinnedPrimaryTerminal == null || pinnedPrimaryTerminal.isBlank()
-                        ? null : pinnedPrimaryTerminal;
+        this.leadTerminals = leadTerminals == null ? Map::of : leadTerminals;
+        this.architectTerminals = architectTerminals == null ? Map::of : architectTerminals;
+    }
+
+    /**
+     * The currently-recognised leads, {@code terminal_id → name} (CB-535).
+     *
+     * <p>Deliberately read from the same supplier {@link #resolve} consults, rather than from a
+     * second copy handed to the roster: a lead that is <em>listed</em> but would not <em>resolve</em>
+     * (or the reverse) is an address a peer cannot actually reach, and the two answers drifting apart
+     * is precisely the confusion this exists to end. Live, so a lead discovered by the tab scan after
+     * startup appears without a restart.
+     */
+    public Map<String, String> leads() {
+        return leadTerminals.get();
+    }
+
+    /**
+     * The currently-recognised architect slots, {@code terminal_id → slot name} (CB-548).
+     *
+     * <p>Read from the same supplier {@link #resolve} consults, so a slot that is <em>listed</em>
+     * here but would not <em>resolve</em> (or the reverse) cannot drift apart. Live for the same
+     * reason as {@link #leads()}.
+     */
+    public Map<String, String> architects() {
+        return architectTerminals.get();
    }

    /**
@@ -79,10 +197,20 @@ public final class CallerResolver {
    public Principal resolve(String remoteAddr, int remotePort, String authorizationHeader) {
        ConnectionIdentity.Caller c = identity.resolve(remoteAddr, remotePort);
        if (c.terminal() != null) {
-            if (c.terminal().equals(pinnedPrimaryTerminal)) {
-                // The config names this pane as the primary's own. The pane mapping is exactly as
+            String lead = leadTerminals.get().get(c.terminal());
+            if (lead != null) {
+                // The config names this pane as a lead's own. The pane mapping is exactly as
                // unforgeable as a worker's, so it outranks the token path — no credential needed.
-                return Principal.primary(c.pid());
+                // Checked before the architect registry so a pane named in BOTH is still the lead
+                // (CB-548 preserves every existing leader behaviour).
+                return Principal.leader(lead, c.terminal(), c.pid());
+            }
+            String slot = architectTerminals.get().get(c.terminal());
+            if (slot != null) {
+                // The config/live binding names this pane as an architect slot's own. Same
+                // unforgeable pane mapping; the live binding, never a request argument, decides.
+                // Checked before the generic worker fallback, per the CB-548 precedence order.
+                return Principal.architect(slot, c.terminal(), c.pid());
            }
            return Principal.worker(c.terminal(), c.pid()); // unforgeable; never token-gated
        }
@@ -99,16 +227,6 @@ public final class CallerResolver {
        return isLoopback(remoteAddr) ? Principal.primary(c.pid()) : Principal.anonymous();
    }

-    /** The working directory of the calling process (CB-112 spawn cwd inheritance), or {@code null}. */
-    public String cwdForPid(long pid) {
-        return identity.cwdForPid(pid);
-    }
-
-    /** True when auth requires a bearer token of non-worker callers. */
-    public boolean tokenMode() {
-        return tokenMode;
-    }
-
    private boolean presentedTokenMatches(String authorizationHeader) {
        String presented = bearerValue(authorizationHeader);
        if (presented == null) {
@@ -5,30 +5,82 @@ package dev.ltms.bridged.auth;
 * identifies which worker it is (CB-501).
 *
 * @param role     what this caller is authorized to act as
- * @param terminal the worker's herdr terminal id; {@code null} for {@code PRIMARY}/{@code ANONYMOUS}
+ * @param terminal the herdr {@code terminal_id} of the pane this caller occupies — a worker's, or
+ *                 (since CB-532) a named lead's; {@code null} for an unnamed primary resolved off a
+ *                 token or loopback trust, and for {@code ANONYMOUS}
 * @param pid      the connecting process id, or {@code -1} when not resolvable (audit context)
+ * @param name     for a lead resolved from the CB-530 {@code leaders:} registry, which lead it is;
+ *                 for an architect resolved from the CB-548 {@code architects:} registry, which
+ *                 slot it occupies; {@code null} for every other caller, including an unnamed primary
 */
-public record Principal(Role role, String terminal, long pid) {
+public record Principal(Role role, String terminal, long pid, String name) {
+
+    /**
+     * Three-arg form for the callers that have no name to carry (workers, anonymous, and the
+     * token/loopback primary paths). Kept so adding CB-530's {@code name} did not churn every
+     * construction site — and so a reconstructed principal without a stashed name still works.
+     */
+    public Principal(Role role, String terminal, long pid) {
+        this(role, terminal, pid, null);
+    }

    /** A caller authenticated as nothing — the default when no check establishes anything else. */
    public static Principal anonymous() {
        return new Principal(Role.ANONYMOUS, null, -1);
    }

-    /** The orchestrating session. */
+    /** The orchestrating session, unnamed (token or loopback-trust path). */
    public static Principal primary(long pid) {
        return new Principal(Role.PRIMARY, null, pid);
    }

+    /**
+     * A named lead from the {@code leaders:} registry (CB-530).
+     *
+     * <p>Carries {@link Role#PRIMARY}: a lead <em>is</em> a primary as far as authorization goes,
+     * so every existing {@code isPrimary()} gate keeps working unchanged and the role table needed
+     * no new entry. The name is reporting only — it lets {@code bridge_whoami} say <em>which</em>
+     * lead is asking once more than one is configured.
+     *
+     * <p><strong>CB-532: a lead now carries the terminal it was matched by.</strong> Under CB-530 it
+     * deliberately did not, because {@code terminal} meant "which worker pane" everywhere and a
+     * non-null one would have enrolled the lead in the worker presence map. That reading was what
+     * made a lead unaddressable: {@link #ownsSession} could never be true for it, so
+     * {@code bridge_reply} was refused and one lead could send to another but never be answered.
+     * The terminal now means "which pane is this caller", the presence map keys on
+     * {@link #isWorker()} instead, and a lead is a peer that can both send and receive.
+     */
+    public static Principal leader(String name, String terminal, long pid) {
+        return new Principal(Role.PRIMARY, terminal, pid, name);
+    }
+
    /** A worker peer, identified by its herdr pane. */
    public static Principal worker(String terminal, long pid) {
        return new Principal(Role.WORKER, terminal, pid);
    }

+    /**
+     * An architect (CB-548), identified by the slot it occupies and the pane bound to it.
+     *
+     * <p>Carries {@link Role#ARCHITECT}. {@code slotName} is reporting only — it lets
+     * {@code bridge_whoami} say <em>which</em> architect slot is asking, and it is the key the
+     * (future) spawn lifecycle reads a profile back from. Identity is the {@code terminal}: like a
+     * worker's it comes from the connection and the live terminal→slot binding, so
+     * {@code ownsSession} works exactly as it does for a worker — an architect acts as its own
+     * pane and no other.
+     */
+    public static Principal architect(String slotName, String terminal, long pid) {
+        return new Principal(Role.ARCHITECT, terminal, pid, slotName);
+    }
+
    public boolean isPrimary() {
        return role == Role.PRIMARY;
    }

+    public boolean isArchitect() {
+        return role == Role.ARCHITECT;
+    }
+
    public boolean isWorker() {
        return role == Role.WORKER;
    }
@@ -39,18 +91,26 @@ public record Principal(Role role, String terminal, long pid) {

    /**
     * Whether this caller may act <em>as</em> {@code sessionId} — the "own session only" rule that
-     * keeps one worker from replying or asking on another's behalf. Only a worker can own a
-     * session, and only its own.
+     * keeps one peer from replying or asking on another's behalf.
+     *
+     * <p>The rule is about <em>identity</em>, not rank: a caller may act as the pane it demonstrably
+     * occupies, and as no other. CB-532 dropped the extra {@code isWorker()} conjunct that used to
+     * be here. It was not what enforced the rule — {@code terminal.equals(sessionId)} is, and that
+     * terminal comes from the connection, so it cannot be forged either way. All the conjunct did
+     * was make a lead permanently unable to answer anyone, since a lead's terminal was null and a
+     * lead is not a worker. A caller with no terminal at all (an off-host or token-authenticated
+     * primary) still owns nothing, which is the case the null check covers.
     */
    public boolean ownsSession(String sessionId) {
-        return isWorker() && terminal != null && terminal.equals(sessionId);
+        return terminal != null && terminal.equals(sessionId);
    }

    /** Short, non-sensitive description for audit lines and error details. */
    public String describe() {
        return switch (role) {
            case WORKER -> "worker:" + terminal;
-            case PRIMARY -> "primary";
+            case ARCHITECT -> "architect:" + name;
+            case PRIMARY -> name == null ? "primary" : "leader:" + name;
            case ANONYMOUS -> "anonymous";
        };
    }
@@ -24,6 +24,16 @@ public enum Role {
     */
    WORKER,

+    /**
+     * A config-declared architect slot (CB-548): a gateway-local named session on a strong-model
+     * profile that coordinates and delegates turns but does not own the fleet. Unforgeable like a
+     * worker's — derived from the connection's pane and the live terminal→slot binding, never from
+     * a request argument. May {@code SEND} a turn, {@code REPLY}/{@code ASK} only as its own pane,
+     * and {@code READ}/{@code METRICS}; may <em>not</em> {@code SPAWN}/{@code STOP}/{@code DRAIN}
+     * (those stay the primary's, to keep lifecycle in one pair of hands).
+     */
+    ARCHITECT,
+
    /** Authenticated as nothing. Authorized for nothing but {@code /healthz}. */
    ANONYMOUS
 }
@@ -1,14 +1,19 @@
 package dev.ltms.bridged.config;

 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonToken;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;

 import java.io.IOException;
 import java.io.UncheckedIOException;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.Collections;
+import java.util.HashSet;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
@@ -17,7 +22,8 @@ import java.util.Set;
 /**
 * {@code bridged} configuration, loaded from a YAML file (see
 * {@code bridged.example.yaml}). Unknown keys are ignored so config can grow ahead
- * of the code.
+ * of the code — but an unknown <em>top-level</em> key is logged as a WARN at load (CB-530), because
+ * silently dropping a whole block is indistinguishable from honouring it.
 *
 * @param bind          REST/MCP listen host:port
 * @param herdrSocket   path to herdr's Unix socket ({@code null} → client default)
@@ -37,6 +43,16 @@ import java.util.Set;
 * @param primary       optional pinned primary terminal config ({@code null} → derived from connection);
 *                      a non-blank {@code terminal} seeds {@code PrimaryRegistry} and prevents
 *                      connection-derived overrides, CB-307
+ * @param leaders       named panes that orchestrate rather than are orchestrated (CB-530), keyed by
+ *                      lead name; supersedes the singular {@code primary} pin, which stays honoured.
+ *                      See {@link #leaderTerminals()} for how the two merge
+ * @param architects    CB-548 architect slots, keyed by gateway-local unique slot name; each points
+ *                      at a strong-model profile the future spawn lifecycle reads back. An architect
+ *                      is <em>not</em> recognised like a lead: config declares the slots only, and a
+ *                      live session becomes an architect when the spawn lifecycle binds its terminal
+ *                      to a slot. Nothing here spawns a slot.
+ * @param leadScan      opt-in discovery of leads by tab label (CB-531); {@code null} ⇒ no scanning,
+ *                      and only {@code leaders:}/{@code primary:} name a lead
 * @param placement     how to choose a worker profile for an unqualified spawn:
 *                      {@code fixed} (default), {@code round-robin}, or {@code weighted}
 * @param auth          API authentication mode ({@code null} → {@code loopback-trust}, the
@@ -56,6 +72,9 @@ public record BridgedConfig(
        Integer spawnReadyPollMs,
        Broker broker,
        Primary primary,
+        Map<String, Leader> leaders,
+        Map<String, Architect> architects,
+        LeadScan leadScan,
        String placement,
        Auth auth) {

@@ -109,6 +128,17 @@ public record BridgedConfig(
     *                       each adapter drives only its own kind. Normalised to lower-case; blank ⇒ the
     *                       default. It selects the adapter, not the transport — placement, tabs, cwd, and
     *                       the readiness gate are kind-independent and stay in the shared base.
+     * @param subscription  {@code true} to run this profile's workers on the operator's Claude
+     *                       subscription, on purpose (CB-539). When set, the launcher neither requires
+     *                       nor injects {@code ANTHROPIC_BASE_URL} / {@code ANTHROPIC_AUTH_TOKEN}, and the
+     *                       {@code SubscriptionGuard} base_url requirement is skipped <em>for this
+     *                       profile only</em>. Absent/{@code false} (the default) keeps today's hard
+     *                       refusal: a claude-code profile with no base_url may not spawn, because
+     *                       spawning one would bill the subscription. Mutually exclusive with
+     *                       {@code baseUrl} — setting both is a configuration error (the two state
+     *                       opposite intents). For the same reason, an {@code env:} entry naming
+     *                       {@code ANTHROPIC_BASE_URL} or {@code ANTHROPIC_AUTH_TOKEN} is refused at
+     *                       config load (CB-542): on the subscription path no guard would vet it.
     */
    @JsonIgnoreProperties(ignoreUnknown = true)
    public record Worker(String profile, String baseUrl, String model,
@@ -120,7 +150,8 @@ public record BridgedConfig(
                         String kind,
                         Map<String, String> env,
                         Float weight,
-                         Integer maxLoad) {
+                         Integer maxLoad,
+                         Boolean subscription) {

        /** Peer kind spawned by {@link dev.ltms.bridged.worker.ClaudeCodeLauncher} (the default). */
        public static final String KIND_CLAUDE_CODE = "claude-code";
@@ -153,6 +184,7 @@ public record BridgedConfig(
            env = (env == null) ? Map.of() : Map.copyOf(env);
            weight = (weight == null || weight <= 0.0f) ? 1.0f : weight;
            maxLoad = (maxLoad == null || maxLoad <= 0) ? null : maxLoad;
+            subscription = (subscription != null && subscription) ? Boolean.TRUE : Boolean.FALSE;
        }

        /**
@@ -165,7 +197,7 @@ public record BridgedConfig(
                      String placement, String workspace, String tabLabel, String mcpUrl,
                      String cwd, List<String> parityOverlay) {
            this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, null, null, null, null, null, null);
+                    mcpUrl, cwd, parityOverlay, null, null, null, null, null, null, null);
        }

        /**
@@ -177,7 +209,7 @@ public record BridgedConfig(
                      String placement, String workspace, String tabLabel, String mcpUrl,
                      String cwd, List<String> parityOverlay, String gitTokenEnv, String gitHostEnv) {
            this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, null, null, null, null);
+                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, null, null, null, null, null);
        }

        /**
@@ -190,13 +222,13 @@ public record BridgedConfig(
                      String cwd, List<String> parityOverlay, String gitTokenEnv, String gitHostEnv,
                      String kind) {
            this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, null, null, null);
+                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, null, null, null, null);
        }

        /** A copy with {@code profile} set — used to default a profile to its {@code workers} key. */
        public Worker withProfile(String p) {
            return new Worker(p, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad);
+                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad, subscription);
        }

        /** True when this profile is served by the Claude Code adapter (the default kind). */
@@ -209,11 +241,48 @@ public record BridgedConfig(
            return KIND_OPENCODE.equals(kind);
        }

+        /**
+         * True when this profile runs on the operator's Claude subscription, on purpose (CB-539).
+         * Absent/{@code false} (the default) keeps the hard refusal: a claude-code profile with no
+         * base_url may not spawn, because doing so would bill the subscription.
+         */
+        public boolean isSubscription() {
+            return Boolean.TRUE.equals(subscription);
+        }
+
+        /**
+         * Backward-compatible constructor without the CB-539 subscription flag — the worker stays on
+         * the off-subscription boundary (the default). Keeps pre-CB-539 call sites (and any YAML
+         * that omits the flag) compiling and behaving identically.
+         */
+        public Worker(String profile, String baseUrl, String model,
+                      String configDir, String tokenEnv, List<String> argv,
+                      String placement, String workspace, String tabLabel, String mcpUrl,
+                      String cwd, List<String> parityOverlay, String gitTokenEnv, String gitHostEnv,
+                      String kind, Map<String, String> env, Float weight, Integer maxLoad) {
+            this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
+                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad, null);
+        }
+
        /** True when this profile's workers are granted a forge token to open their own PR (CB-302). */
        public boolean hasGitToken() {
            return gitTokenEnv != null && !gitTokenEnv.isBlank();
        }

+        /**
+         * True when this profile's {@code env:} block names a worker-side Anthropic binding variable.
+         * Those two keys are the adapter's, never the operator's: on a claude-code worker
+         * {@code ANTHROPIC_BASE_URL} is the endpoint the {@code SubscriptionGuard} vetted, and
+         * {@code ANTHROPIC_AUTH_TOKEN} is injected from {@code tokenEnv}. An {@code env:} entry for
+         * either is a bypass vector — it is what the subscription path would otherwise let survive
+         * unguarded — so it is rejected at config load (see
+         * {@link BridgedConfig#validateSubscriptionProfiles()}).
+         */
+        public boolean envCarriesAnthropicBinding() {
+            return env != null
+                    && (env.containsKey("ANTHROPIC_BASE_URL") || env.containsKey("ANTHROPIC_AUTH_TOKEN"));
+        }
+
        /** True when workers should land in their own tab in the worker space. */
        public boolean tabPlacement() {
            return "tab".equals(placement);
@@ -246,9 +315,12 @@ public record BridgedConfig(
     *                           ({@code null} → disabled)
     * @param drainTimeoutSeconds seconds to wait for {@code BUSY} sessions to finish before
     *                           forced teardown on shutdown (default 5 when unset)
+     * @param clearAfterTurn      whether a reusable worker discards its conversation context after
+     *                           every completed delegated turn (default false)
     */
    @JsonIgnoreProperties(ignoreUnknown = true)
-    public record Lifecycle(Integer idleTtlSeconds, Integer contextCap, Integer drainTimeoutSeconds) {
+    public record Lifecycle(Integer idleTtlSeconds, Integer contextCap, Integer drainTimeoutSeconds,
+                            boolean clearAfterTurn) {
    }

    /**
@@ -295,6 +367,107 @@ public record BridgedConfig(
        }
    }

+    /**
+     * One entry of the CB-530 {@code leaders:} registry — a pane that orchestrates rather than one
+     * that is orchestrated.
+     *
+     * <p>Why a registry and not a second {@code primary:}: {@code primary.terminal} is singular by
+     * construction, so a session in any other pane resolves as a worker. That is correct while one
+     * lead drives a fleet, and wrong the moment two leads (say an Opus lead and an opencode lead)
+     * work as peers — the second is silently demoted and refused every orchestration call.
+     *
+     * <p>{@code kind} and {@code model} are descriptive only at this stage: they document what runs
+     * in the pane and are reported back by {@code bridge_whoami}. Nothing spawns a lead — a lead
+     * pre-exists, which is precisely why it must be recognised by configuration rather than created.
+     *
+     * @param terminal the lead's herdr {@code terminal_id}; the only field identity depends on
+     * @param kind     which agent runs there ({@code claude}, {@code opencode}, …); descriptive
+     * @param model    the model or selector it runs, for operators reading the roster; descriptive
+     */
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    public record Leader(String terminal, String kind, String model) {
+    }
+
+    /**
+     * One entry of the CB-548 {@code architects:} registry — a gateway-local named slot that points
+     * at a strong-model profile.
+     *
+     * <p>A slot is <em>declared</em>, not recognised: config names the slot and the profile it runs,
+     * and nothing else. Unlike a lead (which config pins by herdr {@code terminal_id} and is
+     * recognised at startup), an architect slot is idle at boot — config supplies no terminal, so no
+     * session resolves to one until the spawn lifecycle binds a live terminal to the slot. The
+     * stable name + profile pair is the only config-time identity; live identity is defined purely
+     * by the runtime {@link dev.ltms.bridged.auth.ArchitectRegistry} binding.
+     *
+     * <p>Why a {@code profile} reference: an architect is meant to run a strong model, and the slot
+     * records which {@code workers:} profile that is — the value the future spawn lifecycle reads.
+     * It must name a configured profile, enforced by {@link #validateArchitects()} (a stale or
+     * typo'd reference fails at startup rather than silently spawning the wrong backend later).
+     *
+     * @param profile the name of the strong-model {@code workers:} profile this slot runs;
+     *                required and validated against {@link #workerProfiles()}
+     */
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    public record Architect(String profile) {
+    }
+
+    /**
+     * Discover leads by tab label instead of by pasted {@code terminal_id} (CB-531).
+     *
+     * <p>Why: a lead is not spawned, so its {@code terminal_id} exists only once a human has opened
+     * the tab and started the agent — which makes {@code leaders:} a three-step ritual (start it,
+     * ask it its id, edit config, restart) repeated per lead. Naming the tab is one step, done at
+     * the moment the operator is already there. The convention also survives what an id does not:
+     * close the tab and reopen it and the id changes, while the label is retyped as-is.
+     *
+     * <p>Deliberately opt-in ({@code null} ⇒ off). Turning it on widens who resolves as
+     * {@link dev.ltms.bridged.auth.Role#PRIMARY}, and a config that never asked for it must not
+     * acquire that by upgrading the daemon.
+     *
+     * <p>bridged never writes these labels — see {@link dev.ltms.bridged.herdr.LeadTabScanner} for
+     * why that one-way direction is what keeps the convention trustworthy.
+     *
+     * @param tabPrefix       label prefix marking a lead's tab, matched case-insensitively; the
+     *                        remainder is the lead's name ({@code "lead: opus-5.0"} → {@code
+     *                        opus-5.0}). Default {@code "lead:"}
+     * @param intervalSeconds how long a scan is cached before herdr is asked again; also the worst
+     *                        case before a newly-labelled tab is recognised. Default 10
+     */
+    @JsonIgnoreProperties(ignoreUnknown = true)
+    public record LeadScan(String tabPrefix, Integer intervalSeconds) {
+        public LeadScan {
+            tabPrefix = (tabPrefix == null || tabPrefix.isBlank()) ? "lead:" : tabPrefix.strip();
+            intervalSeconds = (intervalSeconds == null || intervalSeconds <= 0) ? 10 : intervalSeconds;
+        }
+    }
+
+    /**
+     * The terminal → lead-name map that {@link dev.ltms.bridged.auth.CallerResolver} resolves
+     * against, merging the {@code leaders:} registry with the legacy singular {@code primary:} pin.
+     *
+     * <p>Precedence: an explicit {@code leaders:} entry wins over the {@code primary:} pin for the
+     * same terminal. The pin is the older, less expressive spelling of the same fact, so when both
+     * name a pane the named entry is the one an operator meant. The pin is still honoured on its
+     * own — a config carrying only {@code primary:} behaves exactly as it did before CB-530.
+     *
+     * @return an unmodifiable map, empty when neither block is configured (nothing is pinned, and
+     *         every pane therefore resolves as a worker — the pre-CB-307 behaviour)
+     */
+    public Map<String, String> leaderTerminals() {
+        Map<String, String> byTerminal = new LinkedHashMap<>();
+        if (leaders != null) {
+            leaders.forEach((name, leader) -> {
+                if (leader != null && leader.terminal() != null && !leader.terminal().isBlank()) {
+                    byTerminal.put(leader.terminal(), name);
+                }
+            });
+        }
+        if (primary != null && primary.terminal() != null && !primary.terminal().isBlank()) {
+            byTerminal.putIfAbsent(primary.terminal(), "primary");
+        }
+        return Collections.unmodifiableMap(byTerminal);
+    }
+
    /**
     * API authentication (CB-501). Governs how a caller that is <em>not</em> an on-host worker
     * pane proves it is the primary.
@@ -387,30 +560,192 @@ public record BridgedConfig(
        return p.isEmpty() ? null : p.keySet().iterator().next();
    }

+    private static final Logger log = LoggerFactory.getLogger(BridgedConfig.class);
+
    private static final ObjectMapper YAML = new ObjectMapper(new YAMLFactory());

+    /**
+     * Top-level keys this version understands. Used only to warn about the rest — see
+     * {@link #warnUnknownTopLevelKeys}. Keep in step with the record components.
+     */
+    private static final Set<String> KNOWN_TOP_LEVEL_KEYS = Set.of(
+            "bind", "herdrSocket", "worker", "workers", "defaultWorker", "guard", "worktreeRoot",
+            "lifecycle", "spawnReadyTimeoutMs", "spawnReadyPollMs", "broker", "primary", "leaders",
+            "architects", "leadScan", "placement", "auth");
+
    /** Load and validate config from {@code path}. */
    public static BridgedConfig load(Path path) {
        try {
-            BridgedConfig cfg = YAML.readValue(Files.readString(path), BridgedConfig.class);
+            String yaml = Files.readString(path);
+            warnUnknownTopLevelKeys(yaml, path);
+            rejectDuplicateArchitectSlots(yaml);
+            BridgedConfig cfg = YAML.readValue(yaml, BridgedConfig.class);
            return cfg.withDefaults();
        } catch (IOException e) {
            throw new UncheckedIOException("cannot read bridged config at " + path, e);
        }
    }

+    /**
+     * Reject an {@code architects:} registry whose slot names repeat (CB-548).
+     *
+     * <p>The registry is a {@code Map} keyed by slot name, so by the time it is read duplicate keys
+     * have already collapsed last-wins — a duplicated slot name would silently drop one slot and the
+     * daemon would never know. Jackson's YAML parser does not fail on duplicate mapping keys by
+     * default, so duplicates are caught here, at parse time, before the map is built. Only the
+     * <em>top-level</em> {@code architects:} block is considered, and only its direct child keys (the
+     * slot names) — a nested field elsewhere, even one also named {@code architects:}, is ignored, so
+     * parsing of the rest of the config is unaffected.
+     *
+     * @throws IllegalStateException when two {@code architects:} entries share a slot name, naming it
+     */
+    static void rejectDuplicateArchitectSlots(String yaml) {
+        try (JsonParser p = YAML.createParser(yaml)) {
+            if (p.nextToken() != JsonToken.START_OBJECT) {
+                return; // not a mapping at top level — readValue reports the malformed file
+            }
+            // Scan the TOP-LEVEL mapping only. Every other field's value (however deep, including
+            // any nested field also literally named "architects") is consumed whole by skipValue, so
+            // the loop below can only ever see the top-level field names — a nested `architects:` can
+            // neither suppress the real block nor be misread as one.
+            JsonToken t;
+            while ((t = p.nextToken()) != null && t != JsonToken.END_OBJECT) {
+                if (t == JsonToken.FIELD_NAME) {
+                    String name = p.getCurrentName();
+                    JsonToken value = p.nextToken();
+                    if ("architects".equals(name)) {
+                        if (value == JsonToken.START_OBJECT) {
+                            rejectDuplicateChildSlotKeys(p);
+                        }
+                        return; // the single top-level architects block is handled; nothing more to check
+                    }
+                    skipValue(p, value);
+                }
+            }
+        } catch (IOException e) {
+            // Not a duplicate-name condition — let readValue report the malformed file itself.
+        }
+    }
+
+    /**
+     * Reject a duplicated <em>direct child</em> key of the (already-positioned) {@code architects:}
+     * mapping — i.e. a duplicated {@code slot name}.
+     *
+     * <p>Each slot's value is consumed whole by {@link #skipValue}, so a duplicated field <em>inside</em>
+     * a slot (e.g. two {@code profile:} keys, or a duplicate nested {@code architects:}) is never seen
+     * here and cannot masquerade as a duplicated slot name.
+     *
+     * @throws IllegalStateException when two {@code architects:} entries share a slot name, naming it
+     */
+    private static void rejectDuplicateChildSlotKeys(JsonParser p) throws IOException {
+        Set<String> seen = new HashSet<>();
+        JsonToken t;
+        while ((t = p.nextToken()) != null && t != JsonToken.END_OBJECT) {
+            if (t == JsonToken.FIELD_NAME) {
+                if (!seen.add(p.getCurrentName())) {
+                    throw new IllegalStateException("refusing to start: duplicate architect slot name '"
+                            + p.getCurrentName() + "' — slot names must be unique; a later entry would "
+                            + "silently overwrite the earlier one");
+                }
+                skipValue(p, p.nextToken()); // the slot's entire value
+            }
+        }
+    }
+
+    /**
+     * Consume the whole value that starts at {@code start}, including every nested structure, and
+     * leave the parser positioned just past it. Used so depth is handled structurally rather than by
+     * a heuristic — a nested field is never interpreted as a top-level {@code architects:}.
+     */
+    private static void skipValue(JsonParser p, JsonToken start) throws IOException {
+        switch (start) {
+            case START_OBJECT: {
+                JsonToken t;
+                while ((t = p.nextToken()) != null && t != JsonToken.END_OBJECT) {
+                    if (t == JsonToken.FIELD_NAME) {
+                        skipValue(p, p.nextToken());
+                    }
+                }
+                return;
+            }
+            case START_ARRAY: {
+                JsonToken t;
+                while ((t = p.nextToken()) != null && t != JsonToken.END_ARRAY) {
+                    skipValue(p, t);
+                }
+                return;
+            }
+            default:
+                // A scalar (VALUE_* / VALUE_NULL) is already fully consumed by the nextToken that
+                // returned it — nothing further to skip.
+        }
+    }
+
+    /**
+     * Log a WARN naming any top-level key this version does not understand (CB-530).
+     *
+     * <p>Why this exists: every record here is {@code @JsonIgnoreProperties(ignoreUnknown = true)},
+     * which is deliberate — config must be allowed to grow ahead of the code, and a rolled-back
+     * daemon must still start. The cost is that a whole block can be written, parsed, dropped, and
+     * never mentioned again. That is exactly how a hand-written {@code leaders:} registry came to
+     * look configured while being inert: the daemon started, nothing complained, and the only way
+     * to discover it was reading the config class.
+     *
+     * <p>A warning rather than a failure, on purpose. Failing closed would turn "the config names
+     * something this build has not learned yet" into a daemon that will not boot — which is the
+     * forward-compatibility this annotation was chosen to preserve. Loud, not fatal.
+     */
+    private static void warnUnknownTopLevelKeys(String yaml, Path path) {
+        List<String> unknown = unknownTopLevelKeys(yaml);
+        if (!unknown.isEmpty()) {
+            log.warn("{}: ignoring unknown top-level config key(s) {} — this build does not "
+                            + "understand them, so they have NO effect. Check for a typo, or a "
+                            + "feature not in this version.",
+                    path, unknown);
+        }
+    }
+
+    /**
+     * The top-level keys in {@code yaml} that this build does not understand, sorted. Package-private
+     * so the guardrail is asserted directly rather than through a log appender.
+     *
+     * @return empty when everything is known, or when {@code yaml} is not a mapping at all (a
+     *         malformed file is {@code readValue}'s error to report, not this method's)
+     */
+    static List<String> unknownTopLevelKeys(String yaml) {
+        Map<?, ?> raw;
+        try {
+            raw = YAML.readValue(yaml, Map.class);
+        } catch (IOException | IllegalArgumentException e) {
+            return List.of();
+        }
+        if (raw == null) {
+            return List.of();
+        }
+        return raw.keySet().stream()
+                .map(String::valueOf)
+                .filter(k -> !KNOWN_TOP_LEVEL_KEYS.contains(k))
+                .sorted()
+                .toList();
+    }
+
    /** Fill in nested defaults so callers never see nulls for structural fields. */
    public BridgedConfig withDefaults() {
        Bind b = bind != null ? bind : new Bind(null, 0);
        Guard g = guard != null ? guard : new Guard(List.of());
-        Lifecycle l = lifecycle != null ? lifecycle : new Lifecycle(null, null, null);
+        Lifecycle l = lifecycle != null ? lifecycle : new Lifecycle(null, null, null, false);
        Integer timeout = (spawnReadyTimeoutMs != null) ? spawnReadyTimeoutMs : 20000;
        Integer pollMs = (spawnReadyPollMs != null) ? spawnReadyPollMs : 300;
        Auth a = auth != null ? auth : new Auth(null, null);
        String placementOrDefault = (placement != null && !placement.isBlank()) ? placement : "fixed";
        // broker is left as-is: null (or an empty/blank uri) keeps the in-memory soft-state inbox.
        // primary is left as-is: null defaults to connection-derived identity.
-        return new BridgedConfig(b, herdrSocket, worker, workers, defaultWorker, g, worktreeRoot, l, timeout, pollMs, broker, primary, placementOrDefault, a);
+        // leadScan is left as-is: null is "off", and LeadScan's own compact constructor defaults the
+        // fields of a block that IS present. Defaulting it here would switch the feature on for
+        // every config that never mentioned it.
+        // architects is left as-is: null is "none configured", and Architect's fields have no
+        // defaults to fill. Defaulting it here would change nothing, so leave the call natural.
+        return new BridgedConfig(b, herdrSocket, worker, workers, defaultWorker, g, worktreeRoot, l, timeout, pollMs, broker, primary, leaders, architects, leadScan, placementOrDefault, a);
    }

    /**
@@ -437,6 +772,125 @@ public record BridgedConfig(
                        + "bind to 127.0.0.1 and put a reverse proxy in front.");
    }

+    /**
+     * Reject a lead-scan convention that a worker tab would also satisfy (CB-531).
+     *
+     * <p>The scan reads a tab label and concludes "a lead lives here". bridged also <em>writes</em>
+     * tab labels — every worker gets {@code tabLabel} rendered into its tab. Choose a
+     * {@code leadScan.tabPrefix} that a worker template matches and the daemon starts labelling its
+     * own workers as leads, promoting the entire fleet to {@link dev.ltms.bridged.auth.Role#PRIMARY}
+     * with no message and no diff. The worker-space exclusion in
+     * {@link dev.ltms.bridged.herdr.LeadTabScanner} already blocks the realistic path, but defence
+     * that depends on one workspace label holding is not defence enough for a privilege boundary.
+     *
+     * <p>Fatal rather than a warning, unlike {@link #warnUnknownTopLevelKeys}: an unknown key means
+     * a feature does nothing, while this means a feature does the opposite of what it says.
+     *
+     * @throws IllegalStateException when any worker profile's {@code tabLabel} starts with the
+     *                               configured lead prefix
+     */
+    public void validateLeadScan() {
+        if (leadScan == null) {
+            return;
+        }
+        String prefix = leadScan.tabPrefix();
+        List<String> clashing = workerProfiles().entrySet().stream()
+                .filter(e -> e.getValue().tabLabel() != null
+                        && e.getValue().tabLabel().strip()
+                        .regionMatches(true, 0, prefix, 0, prefix.length()))
+                .map(Map.Entry::getKey)
+                .sorted()
+                .toList();
+        if (clashing.isEmpty()) {
+            return;
+        }
+        throw new IllegalStateException(
+                "refusing to start: leadScan.tabPrefix=\"" + prefix + "\" also matches the tabLabel "
+                        + "of worker profile(s) " + clashing + ". Every worker spawned under them "
+                        + "would be read back as a lead and granted spawn/stop/send on the whole "
+                        + "fleet. Change one of the two so worker tabs and lead tabs cannot be "
+                        + "confused.");
+    }
+
+    /**
+     * Reject a subscription profile whose {@code env:} block tries to reseat the Anthropic binding
+     * (CB-542).
+     *
+     * <p>Why this must be fatal rather than sanitised: {@code subscription: true} deliberately
+     * stops the launcher from writing {@code ANTHROPIC_BASE_URL}/{@code ANTHROPIC_AUTH_TOKEN} and
+     * skips the {@code SubscriptionGuard} for that profile. But the profile's {@code env:} map is
+     * layered into the worker environment separately, so an {@code ANTHROPIC_BASE_URL} sitting
+     * there would survive into the worker having passed no guard at all — {@code subscription: true}
+     * plus an {@code env:} repoint is a contradiction just like {@code subscription: true} plus a
+     * {@code baseUrl}. The launcher also hard-strips these two keys from the worker env as a
+     * belt-and-braces measure; this method is the loud, load-time refusal so the operator is told
+     * about the mistake instead of having it silently cleaned up.
+     *
+     * @throws IllegalStateException when any subscription profile's {@code env:} names
+     *                               {@code ANTHROPIC_BASE_URL} or {@code ANTHROPIC_AUTH_TOKEN},
+     *                               naming the profile and the offending key(s)
+     */
+    public void validateSubscriptionProfiles() {
+        List<String> bad = new java.util.ArrayList<>();
+        workerProfiles().forEach((name, w) -> {
+            if (w.isSubscription() && w.envCarriesAnthropicBinding()) {
+                List<String> keys = w.env().keySet().stream()
+                        .filter(k -> k.equals("ANTHROPIC_BASE_URL") || k.equals("ANTHROPIC_AUTH_TOKEN"))
+                        .sorted()
+                        .toList();
+                bad.add("worker profile '" + name + "' carries " + keys + " in env: — "
+                        + "subscription: true forbids ANTHROPIC_BASE_URL / ANTHROPIC_AUTH_TOKEN there, "
+                        + "because on the subscription no guard vets them (they would repoint the "
+                        + "worker past the SubscriptionGuard). Remove them from env: (or drop "
+                        + "subscription: true).");
+            }
+        });
+        if (!bad.isEmpty()) {
+            throw new IllegalStateException("refusing to start: " + String.join(" ", bad));
+        }
+    }
+
+    /**
+     * Reject an architect slot whose profile reference does not resolve (CB-548).
+     *
+     * <p>An architect's {@code profile} is the strong-model {@code workers:} profile the future
+     * spawn lifecycle will read to stand the slot up. A reference that names no configured profile
+     * is a typo or a stale config — and unlike a worker spawn (which fails loudly at its call site
+     * when it cannot resolve), an architect slot fails only when something later tries to use it.
+     * This config class <em>does</em> have access to {@link #workerProfiles()}, so the reference
+     * is validated at startup and the mistake is named then, not discovered months later by a
+     * spawn that quietly has no backend to use.
+     *
+     * <p>Slot-name uniqueness needs no check here: the registry is a {@code Map} keyed by name, so
+     * duplicates are unrepresentable by construction once loaded — and {@link #load(Path)} already
+     * rejects a duplicated slot name at parse time, before the map collapses.
+     *
+     * @throws IllegalStateException when any architect slot is missing or names an unknown profile,
+     *                               naming the slot and the offending reference
+     */
+    public void validateArchitects() {
+        if (architects == null) {
+            return;
+        }
+        Map<String, Worker> profiles = workerProfiles();
+        List<String> bad = new java.util.ArrayList<>();
+        architects.forEach((name, arch) -> {
+            if (arch == null || arch.profile() == null || arch.profile().isBlank()) {
+                bad.add("architect slot '" + name + "' has no profile: — give it the name of a "
+                        + "workers: profile (the strong-model backend it runs).");
+                return;
+            }
+            if (!profiles.containsKey(arch.profile())) {
+                bad.add("architect slot '" + name + "' references profile '" + arch.profile()
+                        + "', which is not a configured workers: profile (have: " + profiles.keySet()
+                        + ").");
+            }
+        });
+        if (!bad.isEmpty()) {
+            throw new IllegalStateException("refusing to start: " + String.join(" ", bad));
+        }
+    }
+
    /** True for the loopback addresses and the unspecified-but-local forms we treat as same-host. */
    private static boolean isLoopbackBind(String host) {
        if (host == null || host.isBlank()) {
@@ -0,0 +1,164 @@
+package dev.ltms.bridged.herdr;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+
+import java.util.Collections;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Set;
+import java.util.function.LongSupplier;
+import java.util.function.Supplier;
+
+/**
+ * Discovers which panes host a lead by scanning herdr for tabs the operator labelled by convention
+ * (CB-531), and hands {@link dev.ltms.bridged.auth.CallerResolver} the resulting
+ * {@code terminal_id → lead name} map.
+ *
+ * <p><strong>Why scan at all.</strong> A lead is never spawned — a human opens a tab and starts an
+ * agent in it — so the daemon cannot learn a lead's {@code terminal_id} at creation time the way it
+ * does a worker's. CB-530 solved that by having the operator paste each id into {@code leaders:},
+ * which works but costs a config edit and a daemon restart per lead, and the id is only obtainable
+ * by first starting the session and asking it. Scanning closes that loop: label the tab, and the
+ * pane is recognised on the next resolve.
+ *
+ * <p><strong>Direction of trust.</strong> The label names the lead; it never <em>grants</em>
+ * anything a pane could take for itself. Three properties keep that honest:
+ * <ol>
+ *   <li>bridged never renames a lead tab. The operator's label is read-only input, so what is in
+ *       the tab bar is always what the human wrote — no round-trip where the daemon's own rename
+ *       becomes the evidence for its next decision.</li>
+ *   <li>Worker spaces are excluded wholesale ({@code excludedWorkspaceLabels}), so a worker cannot
+ *       become a lead by being placed — as a split, say — inside a matching tab.</li>
+ *   <li>A worker cannot rename a tab: {@code tab.rename} is reachable only through
+ *       {@link WorkspaceControl}, which no {@code bridge_*} tool exposes. The label is writable by
+ *       the human at the terminal and by nobody the bridge is defending against.</li>
+ * </ol>
+ * The remaining hazard is an <em>operator</em> one — a worker {@code tabLabel} template that
+ * happens to start with the same prefix would promote the whole fleet — and that is refused at
+ * startup by {@code BridgedConfig.validateLeadScan} rather than documented here.
+ *
+ * <p><strong>Caching.</strong> {@link #get()} is on the request path (every resolve), so the scan
+ * is TTL-cached and a stale-but-valid map is preferred to a herdr round-trip. A failed scan keeps
+ * the previous answer instead of emptying it — a herdr hiccup must not silently demote a live lead
+ * mid-session.
+ */
+public final class LeadTabScanner implements Supplier<Map<String, String>> {
+
+    private static final Logger log = LoggerFactory.getLogger(LeadTabScanner.class);
+
+    private final HerdrClient herdr;
+    private final String tabPrefix;
+    private final Set<String> excludedWorkspaceLabels;
+    private final Map<String, String> configuredLeads;
+    private final long ttlNanos;
+    private final LongSupplier clock;
+
+    private Map<String, String> cached;
+    private long scannedAtNanos;
+    private boolean everScanned;
+
+    /**
+     * @param herdr                   the herdr client to query ({@code workspace.list},
+     *                                {@code tab.list}, {@code pane.list} — all read-only)
+     * @param tabPrefix               a tab whose label starts with this (case-insensitively) hosts a
+     *                                lead; the rest of the label, trimmed, is the lead's name
+     * @param excludedWorkspaceLabels workspaces never scanned — the configured worker spaces
+     * @param configuredLeads         the static {@code leaders:}/{@code primary:} registry, merged
+     *                                over every scan result. Explicit config outranks the
+     *                                convention, and survives a scan that cannot run at all
+     * @param ttlNanos                how long a scan result is reused before the next one
+     * @param clock                   nanosecond time source ({@code System::nanoTime} in production)
+     */
+    public LeadTabScanner(HerdrClient herdr, String tabPrefix, Set<String> excludedWorkspaceLabels,
+                          Map<String, String> configuredLeads, long ttlNanos, LongSupplier clock) {
+        this.herdr = herdr;
+        this.tabPrefix = tabPrefix == null || tabPrefix.isBlank() ? "lead:" : tabPrefix.strip();
+        this.excludedWorkspaceLabels = excludedWorkspaceLabels == null
+                ? Set.of() : Set.copyOf(excludedWorkspaceLabels);
+        this.configuredLeads = configuredLeads == null ? Map.of() : Map.copyOf(configuredLeads);
+        this.ttlNanos = ttlNanos;
+        this.clock = clock;
+        this.cached = this.configuredLeads;
+    }
+
+    /**
+     * The current {@code terminal_id → lead name} map, rescanning when the cache has expired.
+     *
+     * <p>Synchronized so a burst of concurrent calls produces one scan rather than one each; a scan
+     * is a handful of RPCs over a Unix socket and is rate-limited to one per TTL.
+     */
+    @Override
+    public synchronized Map<String, String> get() {
+        long now = clock.getAsLong();
+        if (everScanned && now - scannedAtNanos < ttlNanos) {
+            return cached;
+        }
+        // Stamp before scanning, not after: a herdr that is down must cost one attempt per TTL, not
+        // one per request.
+        scannedAtNanos = now;
+        everScanned = true;
+        try {
+            Map<String, String> fresh = scan();
+            if (!fresh.equals(cached)) {
+                log.info("lead panes: {}", fresh);
+            }
+            cached = fresh;
+        } catch (HerdrException e) {
+            log.warn("lead-tab scan failed, keeping the {} lead(s) already known: {}",
+                    cached.size(), e.getMessage());
+        }
+        return cached;
+    }
+
+    /** One full pass: labelled tabs → their panes → those panes' terminals. */
+    private Map<String, String> scan() {
+        Map<String, String> nameByTab = new LinkedHashMap<>();
+        for (JsonNode w : herdr.call("workspace.list").path("workspaces")) {
+            Workspace ws = Workspace.from(w);
+            if (ws.workspaceId() == null || excludedWorkspaceLabels.contains(ws.label())) {
+                continue;
+            }
+            for (JsonNode t : herdr.call("tab.list", Map.of("workspace_id", ws.workspaceId())).path("tabs")) {
+                Tab tab = Tab.from(t);
+                String name = leadNameOf(tab.label());
+                if (name != null && tab.tabId() != null) {
+                    nameByTab.put(tab.tabId(), name);
+                }
+            }
+        }
+
+        Map<String, String> byTerminal = new LinkedHashMap<>();
+        if (!nameByTab.isEmpty()) {
+            // One pane.list for every tab: panes carry tab_id, so the join is local.
+            for (JsonNode p : herdr.call("pane.list", Map.of()).path("panes")) {
+                String name = nameByTab.get(p.path("tab_id").asText(null));
+                String terminal = p.path("terminal_id").asText(null);
+                if (name != null && terminal != null && !terminal.isBlank()) {
+                    byTerminal.put(terminal, name);
+                }
+            }
+        }
+        byTerminal.putAll(configuredLeads); // an explicit pin outranks a label
+        return Collections.unmodifiableMap(byTerminal);
+    }
+
+    /**
+     * The lead name a tab label declares, or {@code null} if it declares none.
+     *
+     * <p>{@code "lead: opus-5.0"} → {@code "opus-5.0"}. A bare {@code "lead:"} names nobody and is
+     * rejected: an unnamed lead would resolve as {@code PRIMARY} with nothing to attribute it to.
+     */
+    private String leadNameOf(String label) {
+        if (label == null) {
+            return null;
+        }
+        String l = label.strip();
+        if (!l.regionMatches(true, 0, tabPrefix, 0, tabPrefix.length())) {
+            return null;
+        }
+        String name = l.substring(tabPrefix.length()).strip();
+        return name.isEmpty() ? null : name;
+    }
+}
@@ -122,6 +122,15 @@ public final class CompletionResolver implements TurnListener {
        Thread.ofVirtual().name("completion-" + target).start(() -> resolve(target, turn));
    }

+    /**
+     * Resolve the completed turn before adapter housekeeping can erase its rendered output. This is
+     * intentionally synchronous and used only when a post-turn context reset is enabled; the normal
+     * path remains off-loaded so polling is not blocked by a scrape.
+     */
+    public void resolveBeforePostAction(String target) {
+        resolve(target, inFlight.get(target));
+    }
+
    @Override
    public void onTurnFailed(String target) {
        InFlight turn = inFlight.get(target);
@@ -132,6 +132,10 @@ public final class Injector {
        boolean turnObserved;      // saw a real `working` sample since that delivery (turn ran)
        int unknownSinceTurn;      // consecutive `unknown` samples while a delegation is outstanding (CB-109)
        int notReadySincePoll;     // consecutive injectable samples a queued message waited on the readiness gate (CB-114)
+        boolean postTurnPending;   // completion observed; adapter housekeeping has not started yet
+        boolean awaitingPostTurnPickup;
+        boolean postTurnObserved;
+        int injectableSincePostTurnPickup;

        synchronized void add(Pending p) {
            queue.add(p);
@@ -173,9 +177,15 @@ public final class Injector {
        boolean turnCompleted = false;
        boolean turnFailed = false;
        boolean resubmit = false;
+        boolean startPostTurn = false;
        List<Pending> notReady = null; // queued messages failed because the worker never became ready
        synchronized (t) {
            if (status == AgentStatus.WORKING) {
+                if (t.awaitingPostTurnPickup) {
+                    t.awaitingPostTurnPickup = false;
+                    t.injectableSincePostTurnPickup = 0;
+                    t.postTurnObserved = true;
+                }
                // Definitive pickup: the worker is busy on our last message, and (if a delivery is
                // outstanding) a real turn is now confirmed to be running.
                t.awaitingPickup = false;
@@ -185,6 +195,16 @@ public final class Injector {
                if (t.awaitingCompletion) t.turnObserved = true;
            } else if (status.injectable()) { // IDLE or BLOCKED
                t.unknownSinceTurn = 0;
+                if (t.awaitingPostTurnPickup) {
+                    if (++t.injectableSincePostTurnPickup >= PICKUP_GRACE_POLLS) {
+                        t.awaitingPostTurnPickup = false;
+                        t.injectableSincePostTurnPickup = 0;
+                    } else {
+                        resubmit = true;
+                    }
+                } else if (t.postTurnObserved) {
+                    t.postTurnObserved = false;
+                }
                if (t.awaitingPickup) {
                    if (++t.injectableSincePickup >= PICKUP_GRACE_POLLS) {
                        // Pickup edge was never sampled (turn faster than the poll, or status lag).
@@ -209,11 +229,16 @@ public final class Injector {
                        t.awaitingCompletion = false;
                        t.turnObserved = false;
                        turnCompleted = true;
+                        if (turnListener.hasPostTurnAction(target)) {
+                            t.postTurnPending = true;
+                            startPostTurn = true;
+                        }
                    }
                    // Deliver the next queued message only once the prior turn is fully settled, so a
                    // completion is never confused with the pickup of the following message — and only
                    // once the worker is available (CB-113), so we never paste into its boot window.
-                    if (!t.awaitingCompletion) {
+                    if (!t.awaitingCompletion && !t.postTurnPending
+                            && !t.awaitingPostTurnPickup && !t.postTurnObserved) {
                        Pending p = t.queue.peek();
                        if (p != null && ready.test(target)) {
                            t.notReadySincePoll = 0;
@@ -263,7 +288,8 @@ public final class Injector {

            // Reclaim the entry once the worker is fully quiescent (nothing queued, no pickup or
            // completion awaited), so the map cannot grow without bound across short-lived workers.
-            if (t.queue.isEmpty() && !t.awaitingPickup && !t.awaitingCompletion) {
+            if (t.queue.isEmpty() && !t.awaitingPickup && !t.awaitingCompletion
+                    && !t.postTurnPending && !t.awaitingPostTurnPickup && !t.postTurnObserved) {
                targets.remove(target, t);
            }
        }
@@ -290,7 +316,21 @@ public final class Injector {
            turnListener.onTurnFailed(target);
        }
        if (turnCompleted) {
-            turnListener.onTurnComplete(target);
+            if (startPostTurn) {
+                boolean started = turnListener.onTurnCompleteWithPostAction(target);
+                synchronized (t) {
+                    t.postTurnPending = false;
+                    if (started) {
+                        t.awaitingPostTurnPickup = true;
+                        t.injectableSincePostTurnPickup = 0;
+                    }
+                    if (t.queue.isEmpty() && !t.awaitingPostTurnPickup) {
+                        targets.remove(target, t);
+                    }
+                }
+            } else {
+                turnListener.onTurnComplete(target);
+            }
        }
        if (turnFailed) {
            turnListener.onTurnFailed(target);
@@ -317,7 +357,8 @@ public final class Injector {
                .filter(e -> {
                    synchronized (e.getValue()) {
                        Target t = e.getValue();
-                        return !t.queue.isEmpty() || t.awaitingPickup || t.awaitingCompletion;
+                        return !t.queue.isEmpty() || t.awaitingPickup || t.awaitingCompletion
+                                || t.postTurnPending || t.awaitingPostTurnPickup || t.postTurnObserved;
                    }
                })
                .map(java.util.Map.Entry::getKey)
@@ -343,6 +384,9 @@ public final class Injector {
            hadDeliveredTurn = t.awaitingCompletion;
            t.awaitingCompletion = false;
            t.awaitingPickup = false;
+            t.postTurnPending = false;
+            t.awaitingPostTurnPickup = false;
+            t.postTurnObserved = false;
        }
        forget.accept(target); // the worker is gone — clear its readiness/presence too (CB-114)
        for (Pending p : pending) {
@@ -13,6 +13,25 @@ public interface TurnListener {
    /** A worker's delegated turn finished (worker returned to idle after visibly working). */
    void onTurnComplete(String target);

+    /**
+     * Whether completion must pause ordinary delivery while adapter-specific housekeeping starts.
+     * This is queried before the injector considers the next queued message, closing the same-tick
+     * ordering gap. Implementations must not mutate state here.
+     */
+    default boolean hasPostTurnAction(String target) {
+        return false;
+    }
+
+    /**
+     * Complete the delegated turn and start its non-turn housekeeping operation.
+     *
+     * @return true when the injector must observe that operation settle before the next delivery
+     */
+    default boolean onTurnCompleteWithPostAction(String target) {
+        onTurnComplete(target);
+        return false;
+    }
+
    /**
     * A worker that visibly ran a delegated turn then wedged in a non-idle, non-working state
     * (CB-109) — e.g. an error screen herdr classifies as {@code unknown} — so no
@@ -65,6 +65,8 @@ public final class BridgeMcp {
    static final String CALLER_PID = "callerPid";
    /** Transport-context key under which the extractor stashes the resolved {@link Role} (CB-501). */
    static final String CALLER_ROLE = "callerRole";
+    /** Transport-context key for the lead's configured name, when the caller is one (CB-530). */
+    static final String CALLER_NAME = "callerName";

    private final HttpServletStreamableServerTransportProvider transport;
    private final McpSyncServer server;
@@ -106,11 +108,15 @@ public final class BridgeMcp {
                            ? callers.resolve(req.getRemoteAddr(), req.getRemotePort(),
                                    req.getHeader("Authorization"))
                            : legacyPrincipal(identity, req.getRemoteAddr(), req.getRemotePort());
-                    presence.markPresent(p.terminal()); // no-op for the primary (null terminal)
+                    // CB-532: guard on the ROLE, not on the terminal being null. A named lead now
+                    // carries its pane too, and enrolling a lead in the worker presence map would
+                    // have it counted as an available worker.
+                    if (p.isWorker()) presence.markPresent(p.terminal());
                    return McpTransportContext.create(Map.of(
                            CALLER_TERMINAL, orEmpty(p.terminal()),
                            CALLER_PID, Long.toString(p.pid()),
-                            CALLER_ROLE, p.role().name()));
+                            CALLER_ROLE, p.role().name(),
+                            CALLER_NAME, orEmpty(p.name())));
                })
                .build();
        this.server = McpServer.sync(transport)
@@ -121,18 +127,31 @@ public final class BridgeMcp {
                            str(req.arguments(), "sessionId"));
                    if (denied != null) return denied;
                    String caller = callerTerminal(exchange);
-                    if (caller != null) primaryRegistry.record(caller);
+                    // CB-548: only a PRIMARY caller may claim the legacy singleton "primary" fallback.
+                    // An architect delegates as its own pane but must never become the fallback that
+                    // no-delegation inbox nudges target as if it were the primary (the per-target
+                    // delegation map does not cure the singleton).
+                    recordPrimarySingleton(primaryRegistry, caller, principal(exchange));
                    Map<String, Object> a = req.arguments();
+                    String target = str(a, "sessionId");
+                    String content = str(a, "content");
                    String turnId = str(a, "turnId");
                    if (turnId != null && !turnId.isBlank()) {
                        // Answering a worker's bridge_ask (CB-205): resolve its blocked question and
-                        // block for the worker's reply as it resumes the same turn.
-                        return answer(messages, turnId, str(a, "content"), timeoutMs(a));
+                        // block for the worker's reply as it resumes the same turn. This is the same
+                        // delegation, so ownership is left untouched (CB-548) — never re-recorded.
+                        return answer(messages, turnId, content, timeoutMs(a));
                    }
+                    // CB-548: delegator ownership (which lead's reply nudge this worker routes to,
+                    // CB-532) is recorded only once the send is ACCEPTED — MessageService has won the
+                    // session lock and queued delivery — via the accepted-delivery callback, never at
+                    // request time. A concurrent sender that times out BUSY therefore cannot steal a
+                    // live turn's reply routing without ever owning the turn.
+                    Runnable onAccepted = () -> primaryRegistry.recordDelegation(target, caller);
                    // wait defaults to true (block for the reply); wait:false is fire-and-poll.
                    return Boolean.FALSE.equals(a.get("wait"))
-                            ? sendAsync(messages, str(a, "sessionId"), str(a, "content"))
-                            : send(messages, str(a, "sessionId"), str(a, "content"), timeoutMs(a));
+                            ? sendAsync(messages, target, content, onAccepted)
+                            : send(messages, target, content, timeoutMs(a), onAccepted);
                })
                // bridge_reply's identity is the CONNECTION, never an argument — so the authz check
                // is "is this caller a worker at all", and it can only ever reply as itself.
@@ -173,7 +192,9 @@ public final class BridgeMcp {
                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.SPAWN, null);
                    if (denied != null) return denied;
                    String caller = callerTerminal(exchange);
-                    if (caller != null) primaryRegistry.record(caller);
+                    // SPAWN is already auth-gated to PRIMARY (architects can never call it), but
+                    // enforce the same invariant here: only a PRIMARY may claim the legacy singleton.
+                    recordPrimarySingleton(primaryRegistry, caller, principal(exchange));
                    Map<String, Object> a = req.arguments();
                    // CB-112: worker inherits the primary's cwd unless the call pins one.
                    // CB-301: carry the caller's identity as the session owner (null for the primary).
@@ -185,7 +206,9 @@ public final class BridgeMcp {
                .toolCall(listTool(), (exchange, _) -> {
                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                    if (denied != null) return denied;
-                    return listWorkers(workers, sessions);
+                    return listFleet(workers, sessions,
+                            callers == null ? Map.of() : callers.leads(),
+                            callerTerminal(exchange));
                })
                .toolCall(stopTool(), (exchange, req) -> {
                    String paneId = str(req.arguments(), "paneId");
@@ -222,7 +245,7 @@ public final class BridgeMcp {
    /** The caller reconstructed from the transport context. */
    private static Principal principal(McpSyncServerExchange exchange) {
        return principalFrom(exchange.transportContext().get(CALLER_ROLE),
-                callerTerminal(exchange), callerPid(exchange));
+                callerTerminal(exchange), callerPid(exchange), callerName(exchange));
    }

    /**
@@ -237,11 +260,16 @@ public final class BridgeMcp {
     * @param pid      the calling pid, or {@code -1}
     */
    static Principal principalFrom(Object role, String terminal, long pid) {
+        return principalFrom(role, terminal, pid, null);
+    }
+
+    /** As {@link #principalFrom(Object, String, long)}, carrying a lead's name (CB-530). */
+    static Principal principalFrom(Object role, String terminal, long pid, String name) {
        if (role == null) {
            // No role stashed (legacy path): fall back to the historical interpretation.
            return terminal != null ? Principal.worker(terminal, pid) : Principal.primary(pid);
        }
-        return new Principal(Role.valueOf(role.toString()), terminal, pid);
+        return new Principal(Role.valueOf(role.toString()), terminal, pid, name);
    }

    /**
@@ -285,6 +313,24 @@ public final class BridgeMcp {
        return error(reason + ": " + caller.describe() + " may not " + action);
    }

+    /**
+     * Update the legacy singleton "primary" fallback used for no-delegation inbox nudges (CB-548).
+     *
+     * <p>Only {@link Role#PRIMARY} callers — the unnamed primary and named leads alike — may claim
+     * it. An architect delegates as its own pane but must never become the fallback: the per-target
+     * delegation map ({@code PrimaryRegistry#recordDelegation}) does not cure the singleton, so an
+     * architect left here would draw nudges that belong to a primary. The decision uses the resolved
+     * role, never name/kind sniffing. A null {@code caller} (legacy/no-auth path) records nothing.
+     *
+     * <p>Split out of the tool handlers so the guard is unit-testable without fabricating an SDK
+     * {@code McpSyncServerExchange} (same pattern as {@link #denyFor}/{@link #principalFrom}).
+     */
+    static void recordPrimarySingleton(PrimaryRegistry registry, String callerTerminal, Principal caller) {
+        if (caller != null && caller.isPrimary()) {
+            registry.record(callerTerminal);
+        }
+    }
+
    /** The worker identity resolved from this call's connection, or {@code null} if the primary. */
    private static String callerTerminal(McpSyncServerExchange exchange) {
        Object v = exchange.transportContext().get(CALLER_TERMINAL);
@@ -292,6 +338,13 @@ public final class BridgeMcp {
        return (s == null || s.isBlank()) ? null : s;
    }

+    /** The lead name resolved from this call's connection, or {@code null} (CB-530). */
+    private static String callerName(McpSyncServerExchange exchange) {
+        Object v = exchange.transportContext().get(CALLER_NAME);
+        String s = v == null ? null : v.toString();
+        return (s == null || s.isBlank()) ? null : s;
+    }
+
    /** The caller's PID resolved from this call's connection, or {@code -1} if unknown. */
    private static long callerPid(McpSyncServerExchange exchange) {
        Object v = exchange.transportContext().get(CALLER_PID);
@@ -320,12 +373,22 @@ public final class BridgeMcp {

    /** {@code bridge_send}: delegate {@code content} to a worker session and block for its reply. */
    static McpSchema.CallToolResult send(MessageService messages, String sessionId, String content, Long timeoutMs) {
+        return send(messages, sessionId, content, timeoutMs, null);
+    }
+
+    /**
+     * As {@link #send(MessageService, String, String, Long)}, wiring an accepted-delivery hook
+     * (CB-548): {@code onAccepted} records delegator ownership the instant the send is accepted, so
+     * a BUSY interloper never claims a turn it did not win. {@code null} disables recording.
+     */
+    static McpSchema.CallToolResult send(MessageService messages, String sessionId, String content,
+                                         Long timeoutMs, Runnable onAccepted) {
        if (isBlank(sessionId) || isBlank(content)) {
            return error("sessionId and content are required");
        }
        long timeout = clamp(timeoutMs == null ? DEFAULT_TIMEOUT_MS : timeoutMs);
        try {
-            return formatReply(messages.send(sessionId, content, timeout), timeout);
+            return formatReply(messages.send(sessionId, content, timeout, onAccepted), timeout);
        } catch (HerdrException e) {
            return error("herdr error contacting session " + sessionId + ": " + e.getMessage());
        }
@@ -394,10 +457,19 @@ public final class BridgeMcp {
     * immediately (fire-and-poll), so a long task isn't cut off by the caller's MCP call timeout.
     */
    static McpSchema.CallToolResult sendAsync(MessageService messages, String sessionId, String content) {
+        return sendAsync(messages, sessionId, content, null);
+    }
+
+    /**
+     * As {@link #sendAsync(MessageService, String, String)}, wiring the accepted-delivery hook
+     * (CB-548) so an async flooding send records delegator ownership exactly once it is accepted.
+     */
+    static McpSchema.CallToolResult sendAsync(MessageService messages, String sessionId, String content,
+                                              Runnable onAccepted) {
        if (isBlank(sessionId) || isBlank(content)) {
            return error("sessionId and content are required");
        }
-        String ticket = messages.sendAsync(sessionId, content);
+        String ticket = messages.sendAsync(sessionId, content, onAccepted);
        return text("accepted — task delegated. Poll bridge_poll with ticket=" + ticket);
    }

@@ -484,7 +556,29 @@ public final class BridgeMcp {
    static McpSchema.CallToolResult whoami(Principal caller, SessionManager sessions) {
        Map<String, Object> m = new LinkedHashMap<>();
        m.put("role", caller.role().name().toLowerCase());
+        if (caller.isArchitect()) {
+            // CB-548: the role reads "architect"; the name is the gateway-local slot the pane is
+            // bound to, and the pane itself so a peer knows where to reach it.
+            if (caller.name() != null) {
+                m.put("architect", caller.name());
+            }
+            if (caller.terminal() != null) {
+                m.put("sessionId", caller.terminal());
+            }
+            return text(json(m));
+        }
        if (!caller.isWorker()) {
+            // CB-530: which lead, once more than one pane is configured as one. `role` deliberately
+            // still reads "primary" — the fallback ladder in CLAUDE.md keys on it, and a lead IS a
+            // primary for authorization; the name is additive so no existing reader breaks.
+            if (caller.name() != null) {
+                m.put("leader", caller.name());
+            }
+            // CB-532: a lead's own pane, so it can tell a peer where to reach it — and so an
+            // operator can read off which tab hosts which lead without going to herdr.
+            if (caller.terminal() != null) {
+                m.put("sessionId", caller.terminal());
+            }
            return text(json(m));
        }
        m.put("sessionId", caller.terminal());
@@ -576,25 +670,65 @@ public final class BridgeMcp {
    }

    /**
-     * {@code bridge_list}: bridge-owned roster merged with live herdr status. CB-519 decoupled the
-     * registry key (a host-unique id) from the herdr pane coordinate, so the join is on the
-     * terminal id, which both the session and the live agent carry.
+     * {@code bridge_list}: the whole fleet — {@code leads} and {@code workers} — each merged with
+     * live herdr status. CB-519 decoupled the registry key (a host-unique id) from the herdr pane
+     * coordinate, so the join is on the terminal id, which both the session and the live agent carry.
+     *
+     * <p>CB-535 added the {@code leads} half. Until then this listed the worker roster alone, and a
+     * lead asking "who else is here?" got an empty array — which reads as <em>no peers</em> but
+     * actually means <em>no workers spawned</em>. There was no way at all for a lead to learn a
+     * peer's address; it had to be carried across by a human. Both halves are reported even when a
+     * half is empty, so an empty {@code workers} can no longer be mistaken for an empty fleet.
+     *
+     * <p>Leads are drawn from the resolver rather than from a second registry, so an address listed
+     * here is one that would actually resolve as a lead — see {@link CallerResolver#leads()}. The
+     * caller's own row is flagged {@code "self": true}: a peer needs to tell its own pane apart from
+     * a peer's, and the alternative is every lead calling {@code bridge_whoami} to subtract itself.
+     *
+     * @param leads    terminal_id → lead name, live from the resolver
+     * @param selfTerm the calling pane's terminal id, or blank for a caller with no pane
     */
-    static McpSchema.CallToolResult listWorkers(PeerLauncher workers, SessionManager sessions) {
+    static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions,
+                                              Map<String, String> leads, String selfTerm) {
        try {
            Map<String, Agent> live = workers.list().stream()
                    .map(Agent.class::cast)
                    .filter(a -> a.terminalId() != null)
                    .collect(Collectors.toMap(Agent::terminalId, Function.identity(), (_, b) -> b));
+            List<Map<String, Object>> leadRows = leads.entrySet().stream()
+                    .sorted(Map.Entry.comparingByValue())
+                    .map(e -> leadView(e.getKey(), e.getValue(), live.get(e.getKey()), selfTerm))
+                    .toList();
            List<Map<String, Object>> out = sessions.roster().stream()
                    .map(s -> SessionManager.rosterView(s, live.get(s.terminalId())))
                    .toList();
-            return text(json(Map.of("workers", out)));
+            return text(json(Map.of("leads", leadRows, "workers", out)));
        } catch (HerdrException e) {
-            return error("herdr error listing workers: " + e.getMessage());
+            return error("herdr error listing the fleet: " + e.getMessage());
        }
    }

+    /**
+     * One lead's row: its address, its name, and whether it can be reached right now.
+     *
+     * <p>{@code status} is herdr's live view, and {@code unknown} when herdr is not tracking that
+     * pane as an agent — the honest answer, and the one that matters: a lead whose pane herdr cannot
+     * see is a lead a {@code bridge_send} cannot be typed into. It is reported rather than hidden,
+     * because a peer that has gone unreachable is exactly what the sender needs to know.
+     */
+    private static Map<String, Object> leadView(String terminal, String name, Agent live,
+                                                String selfTerm) {
+        Map<String, Object> m = new LinkedHashMap<>();
+        m.put("sessionId", terminal);
+        m.put("name", name);
+        m.put("status", live == null || live.status() == null
+                ? "unknown" : live.status().name().toLowerCase());
+        if (terminal.equals(selfTerm)) {
+            m.put("self", true);
+        }
+        return m;
+    }
+
    /** {@code bridge_stop}: tear a worker down by its pane id. */
    static McpSchema.CallToolResult stop(SessionManager sessions, String paneId) {
        if (isBlank(paneId)) {
@@ -710,8 +844,13 @@ public final class BridgeMcp {

    private static McpSchema.Tool listTool() {
        return tool("bridge_list",
-                "List the worker sessions the bridge tracks — each with its sessionId, paneId, profile, "
-                        + "state, optional worktree/branch/owner, and live herdr status.",
+                "List the whole fleet the bridge tracks, in two parts. 'leads' are your PEERS — other "
+                        + "orchestrators, each with its sessionId (the address to bridge_send to), "
+                        + "name, live status, and 'self': true on your own row; this is how you "
+                        + "discover a peer lead without being told its address. 'workers' are the "
+                        + "sessions delegated to — each with sessionId, paneId, profile, state, "
+                        + "optional worktree/branch/owner, and live herdr status. An empty 'workers' "
+                        + "means no workers are spawned; it says nothing about peers.",
                objectSchema(Map.of(), List.of()));
    }

@@ -724,10 +863,12 @@ public final class BridgeMcp {
    }

    private static McpSchema.Tool replyTool() {
-        // No session/target arg — the worker's identity is resolved from the connection.
+        // No session/target arg — the caller's identity is resolved from the connection.
        return tool("bridge_reply",
-                "Return your structured answer for the task you were delegated, "
-                        + "resolving the caller's blocked bridge_send.",
+                "Return your structured answer for a message you were sent, resolving the sender's "
+                        + "blocked bridge_send. A worker MUST end every delegated turn with exactly "
+                        + "one of these. A lead uses it only to answer another lead that messaged "
+                        + "it — never to answer a worker, whose turn it is not.",
                objectSchema(Map.of(
                        "content", stringProp("Your reply/answer")),
                        List.of("content")));
@@ -745,11 +886,14 @@ public final class BridgeMcp {
        return tool("bridge_whoami",
                "Report who YOU are on the bridge — your role is resolved from your connection "
                        + "(unforgeable), never from anything you claim. Returns role 'primary' (you "
-                        + "orchestrate: spawn/send/stop, and you must never call bridge_reply) or "
-                        + "'worker' (you were delegated to: you must end every turn with exactly one "
-                        + "bridge_reply, and cannot spawn or send), plus your own sessionId, profile, "
-                        + "worktree and branch when you are a worker. Call this first when following "
-                        + "role-conditional instructions rather than guessing your role.",
+                        + "orchestrate: spawn/send/stop; reply ONLY to answer a peer lead that "
+                        + "messaged you, never to answer a worker), 'architect' (you delegate turns "
+                        + "and reply/ask as your own pane, but cannot spawn/stop/drain), or 'worker' "
+                        + "(you were delegated to: you must end every turn with exactly one "
+                        + "bridge_reply, and cannot spawn or send), plus 'leader'/'architect' naming "
+                        + "which one you are, your own sessionId, and profile/worktree/branch when "
+                        + "you are a worker. Call this first when following role-conditional "
+                        + "instructions rather than guessing.",
                objectSchema(Map.of(), List.of()));
    }

@@ -4,6 +4,7 @@ import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

 import java.util.Optional;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.atomic.AtomicReference;

 /**
@@ -25,6 +26,15 @@ public final class PrimaryRegistry {
    private final AtomicReference<String> terminal = new AtomicReference<>();
    private final boolean pinned;

+    /**
+     * CB-532: worker terminal → the lead that delegated to it. The single slot above answers "who is
+     * THE primary", a question with no correct answer once two leads orchestrate the same fleet:
+     * whichever called {@code bridge_send} first captured every nudge, including nudges for the
+     * other lead's delegations. This map answers the question that actually matters — "who is
+     * waiting on THIS worker" — and is what lets {@code primary.terminal} be retired.
+     */
+    private final ConcurrentHashMap<String, String> leadByTarget = new ConcurrentHashMap<>();
+
    /**
     * @param pinnedTerminal an optional pinned terminal from config ({@code null}/blank = unpinned)
     */
@@ -56,6 +66,45 @@ public final class PrimaryRegistry {
        }
    }

+    /**
+     * Record that {@code leadTerminal} owns the accepted delegation of worker {@code target} (CB-532).
+     *
+     * <p>Called from the {@code MessageService} accepted-delivery hook — only after a send has won
+     * the session's send lock and queued delivery — where both halves are known (CB-548). It is
+     * deliberately <em>not</em> called at {@code bridge_send} request time: a concurrent sender that
+     * times out {@code BUSY} must not steal a live delegation's reply routing without ever owning
+     * the turn. Last writer wins — if a second lead's later send is accepted, replies follow the
+     * lead that most recently delegated to it, which is the one waiting.
+     */
+    public void recordDelegation(String target, String leadTerminal) {
+        if (target == null || target.isBlank() || leadTerminal == null || leadTerminal.isBlank()) {
+            return;
+        }
+        leadByTarget.put(target, leadTerminal);
+    }
+
+    /** Forget a worker's delegating lead — call on release, so a torn-down session leaks nothing. */
+    public void forgetDelegation(String target) {
+        if (target != null) {
+            leadByTarget.remove(target);
+        }
+    }
+
+    /**
+     * Where a nudge about {@code target}'s reply should go: the lead that delegated to it, falling
+     * back to the single known primary.
+     *
+     * <p>The fallback matters after a daemon restart, which loses the map while the durable inbox
+     * keeps the reply. With one lead the fallback is unambiguous and correct. With several and no
+     * recorded delegation there is no right answer, so this returns empty rather than guessing —
+     * delivery degrades to pull, which is exactly what the durable inbox is for, instead of
+     * interrupting the wrong lead with someone else's result.
+     */
+    public Optional<String> nudgeTargetFor(String target) {
+        String lead = target == null ? null : leadByTarget.get(target);
+        return lead != null ? Optional.of(lead) : Optional.ofNullable(terminal.get());
+    }
+
    /** The known primary terminal, or empty if not yet learned (and not pinned). */
    public Optional<String> primaryTerminal() {
        return Optional.ofNullable(terminal.get());
@@ -310,6 +310,22 @@ public final class MessageService {
     * worker replies via {@link Rendezvous} or {@code timeoutMillis} elapses.
     */
    public Reply send(String target, String content, long timeoutMillis) {
+        return send(target, content, timeoutMillis, null);
+    }
+
+    /**
+     * As {@link #send(String, String, long)}, but with an accepted-delivery hook.
+     *
+     * <p>{@code onAccepted} is invoked exactly once, once this send has won {@code target}'s send
+     * lock and so become the <em>accepted target turn</em> — it runs <em>before</em> delivery is
+     * queued, so a throwing hook fails the send cleanly (the waiter it already opened is closed and
+     * nothing is left queued). It is <em>not</em> invoked when the send is {@link Outcome#BUSY}
+     * (lock never taken). A caller uses this to record that <em>it</em> now owns the delegation's
+     * reply routing (CB-548: {@code PrimaryRegistry} delegator ownership) — recording only on
+     * acceptance means a concurrent sender that times out {@code BUSY} can never steal ownership it
+     * never earned. {@code null} disables the hook.
+     */
+    public Reply send(String target, String content, long timeoutMillis, Runnable onAccepted) {
        long deadlineNanos = System.nanoTime() + timeoutMillis * 1_000_000L;
        ReentrantLock lock = sessionLocks.computeIfAbsent(target, _ -> new ReentrantLock());

@@ -317,22 +333,36 @@ public final class MessageService {
            return new Reply(Outcome.BUSY, null); // another send held the session the whole window
        }
        try {
-            CompletableFuture<Void> delivered = injector.enqueue(target, content);
+            // Open the waiter BEFORE queueing delivery (CB-548). A fast reply — the worker already
+            // injectable the instant we enqueue — otherwise arrives before the waiter is registered
+            // and orphans into the inbox while this send blocks to the timeout (the enqueue-before-
+            // open race). Opening first also means a throwing onAccepted (fired before enqueue) or an
+            // enqueue failure is safely closed by the finally below: nothing is left queued, and the
+            // failed send leaves no stale waiter behind.
            CompletableFuture<Rendezvous.Resolution> reply = rendezvous.open(target);
            try {
-                Rendezvous.Resolution r = reply.get(remainingMillis(deadlineNanos), TimeUnit.MILLISECONDS);
-                return recorded(new Reply(outcomeOf(r.kind()), r.text(), r.turnId()));
-            } catch (TimeoutException e) {
-                boolean wasDelivered = delivered.isDone() && !delivered.isCompletedExceptionally();
-                log.debug("send to {} timed out (delivered={})", target, wasDelivered);
-                return recorded(new Reply(
-                        wasDelivered ? Outcome.TIMED_OUT_WORKING : Outcome.TIMED_OUT_QUEUED, null));
-            } catch (ExecutionException e) {
-                Throwable cause = e.getCause();
-                throw cause instanceof RuntimeException re ? re : new IllegalStateException(cause);
-            } catch (InterruptedException e) {
-                Thread.currentThread().interrupt();
-                throw new IllegalStateException("interrupted awaiting reply from " + target, e);
+                // The send has won the lock; the accepted-delivery hook records delegator ownership
+                // here (CB-548). It runs BEFORE enqueue so a throwing hook — onAccepted is now a
+                // public callback — fails the send without queuing a message that would orphan.
+                if (onAccepted != null) {
+                    onAccepted.run();
+                }
+                CompletableFuture<Void> delivered = injector.enqueue(target, content);
+                try {
+                    Rendezvous.Resolution r = reply.get(remainingMillis(deadlineNanos), TimeUnit.MILLISECONDS);
+                    return recorded(new Reply(outcomeOf(r.kind()), r.text(), r.turnId()));
+                } catch (TimeoutException e) {
+                    boolean wasDelivered = delivered.isDone() && !delivered.isCompletedExceptionally();
+                    log.debug("send to {} timed out (delivered={})", target, wasDelivered);
+                    return recorded(new Reply(
+                            wasDelivered ? Outcome.TIMED_OUT_WORKING : Outcome.TIMED_OUT_QUEUED, null));
+                } catch (ExecutionException e) {
+                    Throwable cause = e.getCause();
+                    throw cause instanceof RuntimeException re ? re : new IllegalStateException(cause);
+                } catch (InterruptedException e) {
+                    Thread.currentThread().interrupt();
+                    throw new IllegalStateException("interrupted awaiting reply from " + target, e);
+                }
            } finally {
                rendezvous.close(target, reply);
            }
@@ -440,9 +470,21 @@ public final class MessageService {
     * @return the ticket to poll for the eventual result
     */
    public String sendAsync(String target, String content) {
+        return sendAsync(target, content, null);
+    }
+
+    /**
+     * As {@link #sendAsync(String, String)}, with the accepted-delivery hook of
+     * {@link #send(String, String, long, Runnable)} — the running {@code send} invokes {@code onAccepted}
+     * the moment it becomes the accepted target turn, so async flooding records delegator ownership
+     * exactly as the blocking path does (CB-548).
+     *
+     * @return the ticket to poll for the eventual result
+     */
+    public String sendAsync(String target, String content, Runnable onAccepted) {
        String ticket = "task-" + ticketSeq.incrementAndGet();
-        CompletableFuture<Reply> future =
-                CompletableFuture.supplyAsync(() -> send(target, content, ASYNC_TIMEOUT_MS), asyncExecutor);
+        CompletableFuture<Reply> future = CompletableFuture.supplyAsync(
+                () -> send(target, content, ASYNC_TIMEOUT_MS, onAccepted), asyncExecutor);
        tasks.put(ticket, new Task(target, future, System.nanoTime()));
        pruneTerminalTickets();
        log.debug("async send {} -> {}", ticket, target);
@@ -74,15 +74,30 @@ public final class Rendezvous {
    /**
     * Register a waiter for {@code session} — the await side of the public {@code resolve*} methods.
     * The caller must hold that session's send lock.
+     *
+     * <p>Atomic fail-if-present (CB-548): if a waiter is already registered for {@code session}, an
+     * {@link IllegalStateException} is thrown rather than replacing the first — so any future
+     * invariant violation fails loudly instead of silently swapping the waiter another send is
+     * blocked on. {@code MessageService} serializes sends per session (the send lock), so in correct
+     * code a double open is impossible; this is a tripwire for the day that no longer holds.
     */
    public CompletableFuture<Resolution> open(String session) {
        CompletableFuture<Resolution> waiter = new CompletableFuture<>();
-        waiters.put(session, waiter);
+        CompletableFuture<Resolution> existing = waiters.putIfAbsent(session, waiter);
+        if (existing != null) {
+            throw new IllegalStateException(
+                    "rendezvous double-open for session " + session + " — a waiter is already registered");
+        }
        return waiter;
    }

-    /** Remove {@code waiter} for {@code session} (only if it is still the registered one). */
-    void close(String session, CompletableFuture<Resolution> waiter) {
+    /**
+     * Remove {@code waiter} for {@code session}, only if it is still the registered one. The
+     * symmetric complement of {@link #open}: a terminal send deregisters its waiter so the next
+     * send on the session may {@link #open} a fresh one (CB-548 makes double-open an error, so a
+     * successful {@code open} after a finished turn requires this close to have happened first).
+     */
+    public void close(String session, CompletableFuture<Resolution> waiter) {
        waiters.remove(session, waiter);
    }

@@ -59,10 +59,10 @@ public final class ReplyPushLoop {
        this.metrics = metrics;
    }

-    /** Record a counter sample when a registry is wired; a no-op in unit tests. */
-    private void count(String name, String... labels) {
+    /** Count one nudge outcome when a registry is wired; a no-op in unit tests. */
+    private void countNudge(String outcome) {
        if (metrics != null) {
-            metrics.inc(name, labels);
+            metrics.inc(BridgedMetrics.PUSH_NUDGES, "outcome", outcome);
        }
    }

@@ -79,8 +79,13 @@ public final class ReplyPushLoop {
     * @return the action the caller should take
     */
    Action decide(String target, int reminderCount) {
-        if (!primaryRegistry.isKnown()) {
-            log.debug("push: primary unknown, stopping reminder for {}", target);
+        // CB-532: the destination is per-delegation — the lead that sent this worker its work, not
+        // "the primary". With two leads orchestrating one fleet the singular question has no right
+        // answer, and answering it anyway interrupted whichever lead happened to call bridge_send
+        // first with results it never asked for.
+        var nudgeTarget = primaryRegistry.nudgeTargetFor(target);
+        if (nudgeTarget.isEmpty()) {
+            log.debug("push: no lead is known to be waiting on {}, stopping reminder", target);
            return Action.STOP;
        }
        if (inbox.peek(target).isEmpty()) {
@@ -89,21 +94,21 @@ public final class ReplyPushLoop {
        }
        if (reminderCount >= maxReminders) {
            log.debug("push: reminder cap ({}) reached for {}, stopping", maxReminders, target);
-            count(BridgedMetrics.PUSH_NUDGES, "outcome", "exhausted");
+            countNudge("exhausted");
            return Action.STOP;
        }
-        var primaryTerminal = primaryRegistry.primaryTerminal().orElseThrow();
+        String leadTerminal = nudgeTarget.get();
        AgentStatus status;
        try {
-            status = agents.status(primaryTerminal);
+            status = agents.status(leadTerminal);
        } catch (RuntimeException e) {
-            log.debug("push: status check failed for primary {}, will retry", primaryTerminal, e);
+            log.debug("push: status check failed for lead {}, will retry", leadTerminal, e);
            return Action.WAIT_BUSY;
        }
        if (status.injectable()) {
            return Action.INJECT;
        }
-        log.debug("push: primary {} is {} (not injectable), waiting", primaryTerminal, status);
+        log.debug("push: lead {} is {} (not injectable), waiting", leadTerminal, status);
        return Action.WAIT_BUSY;
    }

@@ -143,16 +148,23 @@ public final class ReplyPushLoop {

    /** Send the nudge and log the event. */
    private void injectNudge(String target, int reminderCount) {
-        var primaryTerminal = primaryRegistry.primaryTerminal().orElseThrow();
+        // Re-read rather than threading it down from decide(): the delegating lead can change
+        // between the decision and the injection, and the nudge should follow the current one.
+        var lead = primaryRegistry.nudgeTargetFor(target);
+        if (lead.isEmpty()) {
+            log.debug("push: lead for {} disappeared before the nudge could be sent", target);
+            return;
+        }
+        String leadTerminal = lead.get();
        String nudge = NUDGE_FORMAT.formatted(target, target);
        try {
-            agents.send(primaryTerminal, nudge);
-            log.debug("push: nudge {}/{} sent to primary {} for target {}",
-                    reminderCount + 1, maxReminders, primaryTerminal, target);
-            count(BridgedMetrics.PUSH_NUDGES, "outcome", "delivered");
+            agents.send(leadTerminal, nudge);
+            log.debug("push: nudge {}/{} sent to lead {} for target {}",
+                    reminderCount + 1, maxReminders, leadTerminal, target);
+            countNudge("delivered");
        } catch (RuntimeException e) {
-            log.warn("push: failed to nudge primary {} for target {} (reminder {}/{}): {}",
-                    primaryTerminal, target, reminderCount + 1, maxReminders, e.toString());
+            log.warn("push: failed to nudge lead {} for target {} (reminder {}/{}): {}",
+                    leadTerminal, target, reminderCount + 1, maxReminders, e.toString());
        }
    }

@@ -26,10 +26,33 @@ public enum Capability {
     */
    WORKTREE,

+    /**
+     * The peer can discard its current conversation context without starting a delegated bridge
+     * turn. The command or API used to do that is adapter-specific.
+     */
+    CONTEXT_RESET,
+
    /**
     * The spawner can reconcile orphaned peers on boot — workers that outlived a prior daemon
     * process and whose pane ids died with it (CB-117). Claude Code over herdr supports this
     * via name-based matching against the herdr agent list.
     */
-    ORPHAN_REAP
+    ORPHAN_REAP,
+
+    /**
+     * The peer surfaces the bridge's logical name ({@link SpawnRequest#sessionName()}) in its own
+     * UI at spawn — e.g. Claude Code's {@code -n} display name, which shows in the prompt box, the
+     * {@code /resume} picker, and the terminal title. This is what lets an operator tell the
+     * bridge's worker apart from a user's own session in the same terminal after a restart.
+     */
+    SESSION_NAME,
+
+    /**
+     * The peer can be relaunched onto a prior conversation via that conversation's own session id
+     * ({@link SpawnRequest#resumeSessionId()}) — e.g. Claude Code's {@code -r}, which adopts the id
+     * as the agent's own identity rather than starting a new conversation. A launcher that declares
+     * this mints/resolves that id at spawn and exposes it on the returned
+     * {@link PeerHandle#agentSessionId()}, so a later resume addresses the same conversation.
+     */
+    SESSION_RESUME
 }
@@ -41,4 +41,30 @@ public interface PeerHandle {
    default String profile() {
        return null;
    }
+
+    /**
+     * The bridge's logical name for this session, as assigned at spawn
+     * ({@link SpawnRequest#sessionName()}). Stable across restarts and meaningful to an operator,
+     * unlike the transport identifiers above; a launch with no name leaves the peer's display
+     * identity to the launcher to derive.
+     *
+     * @return the bridge-assigned logical session name, or {@code null} if none was assigned
+     */
+    default String sessionName() {
+        return null;
+    }
+
+    /**
+     * The peer's OWN session id — the handle that resumes this conversation later (the id a
+     * later {@link Capability#SESSION_RESUME resume} spawn would pass back). Null when the adapter
+     * cannot determine it — the contract for an adapter that declines
+     * {@link Capability#SESSION_RESUME}; an adapter that declares that capability returns this
+     * non-null for a spawn that requested session identity, because it knows the id before the
+     * peer has written anything.
+     *
+     * @return the peer's own session id, or {@code null} when not determinable
+     */
+    default String agentSessionId() {
+        return null;
+    }
 }
@@ -82,4 +82,13 @@ public interface PeerLauncher {
     * when safe to do so.
     */
    void stop(String id);
+
+    /**
+     * Discard the context of the peer identified by {@code id}. Implementations must bypass normal
+     * bridge delivery/turn accounting. Unsupported peer kinds return {@code false} without sending
+     * a guessed command.
+     *
+     * @return {@code true} when a reset was sent and its status transition must settle before reuse
+     */
+    boolean clearContext(String id);
 }
@@ -8,6 +8,17 @@ package dev.ltms.bridged.peer;
 * <p>A null or blank {@code profileName} means "use the launcher's default profile."
 * A null or blank {@code requestedCwd} means "inherit from config or caller."
 * A null {@code callerCwd} means "the request came from the daemon itself (not a primary)."
+ *
+ * <p>{@code sessionName} and {@code resumeSessionId} carry the session's durable identity (CB-547a):
+ * the bridge's LOGICAL name for the session (stable across restarts, meaningful to an operator)
+ * and the peer's OWN prior session id to resume, respectively. Both are <em>opted in</em> — either
+ * may be null/blank, in which case the launcher derives a display name and mints a fresh session.
 */
-public record SpawnRequest(String profileName, String requestedCwd, String callerCwd) {
+public record SpawnRequest(String profileName, String requestedCwd, String callerCwd,
+                           String sessionName, String resumeSessionId) {
+
+    /** Back-compat: a spawn with no session identity (fresh session, launcher-derived name). */
+    public SpawnRequest(String profileName, String requestedCwd, String callerCwd) {
+        this(profileName, requestedCwd, callerCwd, null, null);
+    }
 }
@@ -27,12 +27,47 @@ public final class GitWorktrees implements Worktrees {

    private static final Logger log = LoggerFactory.getLogger(GitWorktrees.class);

-    /** Project-level MCP config. Present in the repo, so every worktree checks the primary's out. */
+    /** Project-level MCP config. Present in the repo, so every worktree would otherwise inherit the
+     *  primary's IDE server mounts (a CB-523 worker edited the primary checkout; see the isolation
+     *  javadoc). Neutralized unconditionally. */
    private static final String MCP_CONFIG = ".mcp.json";

-    /** What {@link #isolateToolSurface} writes: a valid, explicitly empty server map. */
+    /** What {@link #isolateToolSurface} writes for {@code .mcp.json}: a valid, explicitly empty server map. */
    private static final String NEUTRAL_MCP_CONFIG = "{\n  \"mcpServers\": {}\n}\n";

+    /** OpenCode's repo-level config. Tracked here, so it lands in every worktree; it carries
+     *  {@code {file:.secrets/...}} references to gitignored secrets that never reach a worktree, and
+     *  opencode refuses to start on a dangling reference — so it is neutralized and the worker gets
+     *  only the config its launcher writes via {@code OPENCODE_CONFIG}. */
+    private static final String OPENCODE_CONFIG = "opencode.json";
+
+    /** What {@link #isolateToolSurface} writes for {@code opencode.json}: a valid, empty JSON object. */
+    private static final String NEUTRAL_OPENCODE_CONFIG = "{}\n";
+
+    /** Autoenv's repo-level config. Not tracked today, but re-landing it must stay safe: autoenv
+     *  authorizes by path, so a fresh worktree path is always unauthorized and its interactive prompt
+     *  would block every spawn — neutralize it so it can never be committed. */
+    private static final String AUTOENV_CONFIG = ".autoenv";
+
+    /** What {@link #isolateToolSurface} writes for {@code .autoenv}: a valid, empty env file. */
+    private static final String NEUTRAL_AUTOENV_CONFIG = "";
+
+    /**
+     * A tracked project config that is hostile in a provisioned worktree, and what to replace it
+     * with. {@link #file} is the repo-relative path; {@link #stub} is a neutral but VALID payload for
+     * that file's format — a malformed stub would only trade one crash for another;
+     * {@link #createIfAbsent} keeps {@code .mcp.json}'s long-standing behaviour of writing its stub
+     * even when the repo carries no such file, whereas the others are only touched when present.
+     */
+    private record WorktreeHostileConfig(String file, String stub, boolean createIfAbsent) {}
+
+    /** The worktree-hostile configs neutralized in every provisioned worktree, in order. */
+    private static final List<WorktreeHostileConfig> WORKTREE_HOSTILE_CONFIGS = List.of(
+            new WorktreeHostileConfig(MCP_CONFIG, NEUTRAL_MCP_CONFIG, true),
+            new WorktreeHostileConfig(OPENCODE_CONFIG, NEUTRAL_OPENCODE_CONFIG, false),
+            new WorktreeHostileConfig(AUTOENV_CONFIG, NEUTRAL_AUTOENV_CONFIG, false)
+    );
+
    private final String configuredRoot;
    private final SecureRandom random = new SecureRandom();
    private final AtomicLong seq = new AtomicLong();
@@ -66,8 +101,9 @@ public final class GitWorktrees implements Worktrees {
    }

    /**
-     * Neutralize the worktree's project MCP config so a worker inherits only the tools its launcher
-     * mounts (the bridge, via {@code --mcp-config}) — never the primary's.
+     * Neutralize the worktree's worktree-hostile project configs so a worker inherits only the tools
+     * and environment its launcher mounts (the bridge via {@code --mcp-config}, the opencode config
+     * via {@code OPENCODE_CONFIG}) — never the primary's.
     *
     * <p>This is unconditional, and it is not the same job as the parity overlay. The repo's own
     * committed {@code .mcp.json} declares the primary's IDE servers, so a fresh checkout mounts them
@@ -75,25 +111,42 @@ public final class GitWorktrees implements Worktrees {
     * through tools bound to the <em>primary's</em> IntelliJ project, which silently hands it absolute
     * paths outside its own worktree. That is not hypothetical: a CB-523 worker made all 59 of its
     * edits in the primary checkout while compiling its worktree, so every build it ran was of code
-     * that did not contain its changes.
+     * that did not contain its changes. {@code opencode.json} is the same trap one tool over — tracked,
+     * so it lands in every worktree, referencing gitignored {@code .secrets/} files that never do, and
+     * opencode refuses to start on the dangling reference. {@code .autoenv} extends the principle to a
+     * config that is not tracked today: autoenv authorizes by path, so a fresh worktree path is always
+     * unauthorized and its interactive prompt would block every spawn, so re-landing one must be safe.
     *
-     * <p>Writing an empty server map (rather than deleting the file) keeps a project-level
-     * {@code .mcp.json} present and explicit, and the {@code --skip-worktree} bit keeps the
-     * neutralized copy from ever showing up as a local modification the worker might commit.
+     * <p>Where a config exists it is replaced by a valid neutral stub (an explicitly empty
+     * map/object, or an empty env file — never a deletion, which would still let a later
+     * {@code git checkout} restore the hostile copy). The {@code --skip-worktree} bit keeps the
+     * neutralized copy from ever showing up as a local modification the worker might commit. A config
+     * the repo does not carry is skipped silently — no stub is invented for a file the repo does not
+     * have, and one missing file must never fail provisioning.
     */
    private void isolateToolSurface(String worktreePath) {
        Path root = Path.of(worktreePath).toAbsolutePath().normalize();
-        Path mcp = root.resolve(MCP_CONFIG);
+        for (WorktreeHostileConfig cfg : WORKTREE_HOSTILE_CONFIGS) {
+            neutralize(root, worktreePath, cfg);
+        }
+    }
+
+    private void neutralize(Path root, String worktreePath, WorktreeHostileConfig cfg) {
+        Path target = root.resolve(cfg.file());
+        if (!Files.exists(target) && !cfg.createIfAbsent()) {
+            log.debug("{} absent in the worktree — skipping (repo does not carry it)", cfg.file());
+            return;
+        }
        try {
-            Files.writeString(mcp, NEUTRAL_MCP_CONFIG);
+            Files.writeString(target, cfg.stub());
        } catch (IOException e) {
-            throw new WorktreeException("cannot neutralize " + MCP_CONFIG + " in the worktree: "
+            throw new WorktreeException("cannot neutralize " + cfg.file() + " in the worktree: "
                    + e.getMessage(), e);
        }
-        if (isTracked(root, MCP_CONFIG)) {
-            exec("git", "-C", worktreePath, "update-index", "--skip-worktree", MCP_CONFIG);
+        if (isTracked(root, cfg.file())) {
+            exec("git", "-C", worktreePath, "update-index", "--skip-worktree", cfg.file());
        }
-        log.debug("neutralized {} — worker tool surface is launcher-mounted only", MCP_CONFIG);
+        log.debug("neutralized {} — worker tool surface is launcher-mounted only", cfg.file());
    }

    @Override
@@ -47,6 +47,7 @@ public final class SessionManager implements TurnListener {
    private final AtomicLong nonceSeq = new AtomicLong();
    private final LongSupplier nowNanos;
    private final int contextCap;
+    private final boolean clearAfterTurn;

    /** CB-520: notified with a terminalId on every acquire; no-op until wired. */
    private final List<Consumer<String>> acquireListeners = new java.util.concurrent.CopyOnWriteArrayList<>();
@@ -55,31 +56,37 @@ public final class SessionManager implements TurnListener {

    /** Backward-compatible constructor: shared-tree sessions, production git seam. */
    public SessionManager(PeerLauncher launcher) {
-        this(launcher, new GitWorktrees(), System::nanoTime, 0);
+        this(launcher, new GitWorktrees(), System::nanoTime, 0, false);
    }

    /** Backward-compatible constructor with an injectable worktree seam. */
    public SessionManager(PeerLauncher launcher, Worktrees worktrees) {
-        this(launcher, worktrees, System::nanoTime, 0);
+        this(launcher, worktrees, System::nanoTime, 0, false);
    }

    /** Test constructor with an injectable clock. */
    public SessionManager(PeerLauncher launcher, Worktrees worktrees, LongSupplier nowNanos) {
-        this(launcher, worktrees, nowNanos, 0);
+        this(launcher, worktrees, nowNanos, 0, false);
    }

    /** Production constructor with a configured context turn cap. */
    public SessionManager(PeerLauncher launcher, Worktrees worktrees, int contextCap) {
-        this(launcher, worktrees, System::nanoTime, contextCap);
+        this(launcher, worktrees, System::nanoTime, contextCap, false);
    }

    public SessionManager(PeerLauncher launcher, Worktrees worktrees, LongSupplier nowNanos,
-                          int contextCap) {
+                           int contextCap) {
+        this(launcher, worktrees, nowNanos, contextCap, false);
+    }
+
+    public SessionManager(PeerLauncher launcher, Worktrees worktrees, LongSupplier nowNanos,
+                          int contextCap, boolean clearAfterTurn) {
        this.launcher = launcher;
        this.worktrees = worktrees;
        this.presence = new PresenceBridge(this);
        this.nowNanos = nowNanos;
        this.contextCap = contextCap;
+        this.clearAfterTurn = clearAfterTurn;
    }

    /**
@@ -355,8 +362,25 @@ public final class SessionManager implements TurnListener {
    /** Lifecycle hook: the worker's delegated turn completed successfully. */
    @Override
    public void onTurnComplete(String target) {
+        completeTurn(target, false);
+    }
+
+    @Override
+    public boolean hasPostTurnAction(String target) {
+        if (!clearAfterTurn) return false;
        WorkerSession current = findByTerminal(target);
-        if (current == null || current.state() != WorkerSession.State.BUSY) return;
+        return current != null && current.state() == WorkerSession.State.BUSY
+                && (contextCap <= 0 || current.turnCount() < contextCap);
+    }
+
+    @Override
+    public boolean onTurnCompleteWithPostAction(String target) {
+        return completeTurn(target, true);
+    }
+
+    private boolean completeTurn(String target, boolean startContextReset) {
+        WorkerSession current = findByTerminal(target);
+        if (current == null || current.state() != WorkerSession.State.BUSY) return false;
        long now = nowNanos.getAsLong();
        WorkerSession updated = current.withState(WorkerSession.State.DONE).withActivity(now);
        if (replace(current, updated)) {
@@ -365,6 +389,15 @@ public final class SessionManager implements TurnListener {
        }
        if (contextCap > 0 && updated.turnCount() >= contextCap) {
            release(current.paneId());
+            return false;
+        }
+        if (!startContextReset || !clearAfterTurn) return false;
+        try {
+            return launcher.clearContext(current.paneId());
+        } catch (RuntimeException e) {
+            log.warn("context reset failed for terminal={} pane={}; continuing without reset: {}",
+                    target, current.paneId(), e.getMessage());
+            return false;
        }
    }

@@ -6,11 +6,14 @@ import dev.ltms.bridged.herdr.Agent;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.peer.Capability;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;

 import java.util.EnumSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.UUID;
 import java.util.function.Function;
 import java.util.function.LongSupplier;

@@ -36,6 +39,8 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
    /** Label prefix for this adapter's herdr agent names (drives naming + orphan reap). */
    private static final String NAME_PREFIX = "claude";

+    private static final Logger log = LoggerFactory.getLogger(ClaudeCodeLauncher.class);
+
    private final SubscriptionGuard guard;

    /**
@@ -109,24 +114,103 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
    /**
     * {@inheritDoc}
     *
-     * <p>The spawn sequence encodes the subscription boundary: assert the profile's base_url is on
-     * the allowlist <em>before</em> any herdr call, then build the worker env with
-     * {@code ANTHROPIC_*}, the parity-neutral git-forge grant, and the bridge MCP + reply charter
-     * mounted as inline launch flags.
+     * <p>A legacy spawn with no session identity is a fresh, launcher-derived session — delegate to
+     * the session-aware form with no name and no resume id.
     */
    @Override
    protected Launch buildLaunch(BridgedConfig.Worker cfg) {
+        return buildLaunch(cfg, null, null);
+    }
+
+    /**
+     * {@inheritDoc}
+     *
+     * <p>The spawn sequence encodes the subscription boundary: assert the profile's base_url is on
+     * the allowlist <em>before</em> any herdr call, then build the worker env with
+     * {@code ANTHROPIC_*}, the parity-neutral git-forge grant, and the bridge MCP + reply charter
+     * mounted as inline launch flags. When the request carries session identity (CB-547a) it is
+     * applied here — see {@link #applySessionIdentity}.
+     */
+    @Override
+    protected Launch buildLaunch(BridgedConfig.Worker cfg, String sessionName, String resumeSessionId) {
+        // CB-539: a profile may deliberately opt into the subscription (subscription: true) when no
+        // off-subscription endpoint exists for it — e.g. `sonnet` on `ccs`. That profile gets no
+        // ANTHROPIC_BASE_URL/AUTH_TOKEN (there is nothing to point them at) and the guard's base_url
+        // requirement is skipped FOR IT ONLY. Every other profile keeps the hard boundary below.
+        boolean onSubscription = cfg.isSubscription();
        String baseUrl = cfg.baseUrl();
-        guard.assertWorker(baseUrl); // hard stop before we spawn anything
+
+        if (onSubscription) {
+            // NO SILENT CONTRADICTION: subscription:true + a baseUrl state opposite intents; refuse
+            // loudly rather than pick a winner.
+            if (baseUrl != null && !baseUrl.isBlank()) {
+                throw new IllegalStateException("profile '" + cfg.profile()
+                        + "' sets both subscription: true and a baseUrl ('" + baseUrl + "') — the two "
+                        + "are contradictory: a subscription profile must not point at an endpoint. "
+                        + "Drop baseUrl, or drop subscription: true.");
+            }
+            // Visible without anyone going looking for it: this worker bills the subscription.
+            log.warn("spawning profile '{}' on the Claude subscription (subscription: true) — this "
+                    + "worker WILL bill the operator's subscription", cfg.profile());
+        } else {
+            guard.assertWorker(baseUrl); // hard stop before we spawn anything
+        }

        Map<String, String> workerEnv = baseEnv(cfg);
-        workerEnv.put("ANTHROPIC_BASE_URL", baseUrl);
+        if (onSubscription) {
+            // CB-542 belt-and-braces: on the subscription path no guard vets these two keys, and the
+            // profile's env: is layered in by baseEnv — so strip any that rode in there. Config load
+            // already rejects this (loudly, naming the profile); this makes the boundary hold even
+            // for a profile built in code that never passed through that validation.
+            workerEnv.remove("ANTHROPIC_BASE_URL");
+            workerEnv.remove("ANTHROPIC_AUTH_TOKEN");
+        } else {
+            workerEnv.put("ANTHROPIC_BASE_URL", baseUrl);
+            putIfPresent(workerEnv, "ANTHROPIC_AUTH_TOKEN", env.apply(cfg.tokenEnv()));
+        }
        putIfPresent(workerEnv, "ANTHROPIC_MODEL", cfg.model());
        putIfPresent(workerEnv, "CLAUDE_CONFIG_DIR", cfg.configDir());
-        putIfPresent(workerEnv, "ANTHROPIC_AUTH_TOKEN", env.apply(cfg.tokenEnv()));
        applyGitToken(workerEnv, cfg);

-        return new Launch(workerEnv, argvWithBridge(cfg));
+        // CB-547a: Claude Code can MINT its own session id, so bridged chooses it — a fresh spawn
+        // gets a UUID we pass as --session-id and return from agentSessionId(), so the resume
+        // handle is known BEFORE the agent has written anything; a resume spawn adopts its prior
+        // id via -r and passes no --session-id (the two conflict). Both are injected before the
+        // model flag so --model keeps outranking the operator's own argv.
+        // mutableArgv: argvWithBridge may hand back the profile's own (immutable) List.of when it
+        // has no MCP — session flags must be added into a list we own.
+        List<String> argv = mutableArgv(argvWithBridge(cfg));
+        String agentSessionId = applySessionIdentity(argv, sessionName, resumeSessionId);
+        return new Launch(workerEnv, argvWithModel(argv, cfg), agentSessionId);
+    }
+
+    /**
+     * Add the Claude-specific session-identity flags to {@code argv} and return the peer's OWN
+     * session id — the resume handle. A resume request passes the prior id via {@code -r} and
+     * returns that id; a fresh named session mints a new UUID, passes it via {@code --session-id},
+     * and returns the mint. The bridge's logical name rides along as {@code -n} when present. When
+     * <em>no</em> identity is requested (sessionName and resumeSessionId both blank) this adds
+     * nothing and returns {@code null}, keeping the legacy no-identity launch byte-identical.
+     */
+    private static String applySessionIdentity(List<String> argv, String sessionName, String resumeSessionId) {
+        boolean resuming = resumeSessionId != null && !resumeSessionId.isBlank();
+        boolean named = sessionName != null && !sessionName.isBlank();
+        if (!resuming && !named) {
+            return null; // no identity requested — keep the legacy launch byte-identical
+        }
+        if (named) {
+            argv.add("-n");
+            argv.add(sessionName);
+        }
+        if (resuming) {
+            argv.add("-r");
+            argv.add(resumeSessionId);
+            return resumeSessionId;
+        }
+        String minted = UUID.randomUUID().toString();
+        argv.add("--session-id");
+        argv.add(minted);
+        return minted;
    }

    /**
@@ -149,6 +233,32 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
        return argv;
    }

+    /**
+     * Pin the model on the command line as well as in {@code ANTHROPIC_MODEL} (CB-533).
+     *
+     * <p>The env var alone is not a reliable pin for this adapter, because the argv is usually a
+     * launcher rather than {@code claude} itself — {@code ["ccs", "<profile>"]} — and {@code ccs}
+     * exports its profile's own model family ({@code ANTHROPIC_MODEL}, {@code DEFAULT_OPUS/SONNET/
+     * HAIKU}, {@code CLAUDE_CODE_SUBAGENT_MODEL}) over whatever it inherited. A worker profile that
+     * set {@code model:} therefore got silently overruled by its own launcher. Claude Code's
+     * {@code --model} flag outranks the environment, and {@code ccs <profile> [claude-args...]}
+     * passes trailing arguments through, so the flag survives the wrapper.
+     *
+     * <p>Appended last so it also outranks anything in the operator's own {@code argv}. Profiles
+     * that deliberately leave {@code model:} unset (letting {@code ccs} own model selection, as
+     * {@code gx10} does) are untouched — this adds nothing when there is nothing to add. This is
+     * the {@code kind: claude} counterpart of the opencode adapter's {@code -m provider/model}.
+     */
+    private static List<String> argvWithModel(List<String> argv, BridgedConfig.Worker cfg) {
+        if (cfg.model() == null || cfg.model().isBlank()) {
+            return argv;
+        }
+        List<String> withModel = mutableArgv(argv);
+        withModel.add("--model");
+        withModel.add(cfg.model());
+        return withModel;
+    }
+
    // --- Agent-returning convenience spawns (used by callers/tests that want the herdr Agent) ---

    /** Spawn a worker for the default profile in the resolved default cwd. */
@@ -170,13 +280,26 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {

    @Override
    public Set<Capability> capabilities() {
-        Set<Capability> caps = EnumSet.of(Capability.MID_TURN_ASK, Capability.WORKTREE, Capability.ORPHAN_REAP);
+        Set<Capability> caps = EnumSet.of(Capability.MID_TURN_ASK, Capability.WORKTREE,
+                Capability.CONTEXT_RESET, Capability.ORPHAN_REAP,
+                Capability.SESSION_NAME, Capability.SESSION_RESUME);
        if (hasGitTokenProfile()) {
            caps.add(Capability.SELF_PR);
        }
        return Set.copyOf(caps);
    }

+    @Override
+    public boolean clearContext(String id) {
+        String target = agentTarget(id);
+        if (target == null) {
+            return false;
+        }
+        // This deliberately bypasses Injector: /clear is housekeeping, not a delegated turn.
+        agents().send(target, "/clear");
+        return true;
+    }
+
    /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
    private boolean hasGitTokenProfile() {
        return profileConfigs().stream().anyMatch(BridgedConfig.Worker::hasGitToken);
@@ -9,6 +9,7 @@ import dev.ltms.bridged.peer.PeerUnreachableException;
 import dev.ltms.bridged.peer.SpawnRequest;
 import dev.ltms.bridged.placement.PlacementCandidate;
 import dev.ltms.bridged.placement.PlacementContext;
+import dev.ltms.bridged.placement.PlacementException;
 import dev.ltms.bridged.placement.PlacementPolicies;
 import dev.ltms.bridged.placement.PlacementPolicy;
 import org.slf4j.Logger;
@@ -139,8 +140,12 @@ public final class CompositePeerLauncher implements PeerLauncher {
    public PeerHandle spawn(SpawnRequest req) {
        String requestedProfile = req.profileName();
        if (requestedProfile != null && !requestedProfile.isBlank()) {
-            // An explicit profile bypasses the policy entirely.
+            // An explicit profile bypasses the placement policy, but not the capacity cap: maxLoad
+            // is documented as an unconditional limit on this profile (BridgedConfig.Worker), and
+            // the charter makes explicit-profile spawns the normal path — so skipping the check
+            // here would leave the cap dead config in real operation.
            HerdrPeerLauncher d = route(requestedProfile);
+            enforceMaxLoad(requestedProfile);
            PeerHandle handle = d.spawn(req);
            spawnedBy.put(handle.id(), d);
            return handle;
@@ -168,7 +173,10 @@ public final class CompositePeerLauncher implements PeerLauncher {
                continue;
            }

-            SpawnRequest routedReq = new SpawnRequest(chosen.profile(), req.requestedCwd(), req.callerCwd());
+            // CB-547a: route the chosen profile but keep the caller's session identity — dropping it
+            // here would silently sever the resume handle on every policy-routed spawn.
+            SpawnRequest routedReq = new SpawnRequest(chosen.profile(), req.requestedCwd(), req.callerCwd(),
+                    req.sessionName(), req.resumeSessionId());
            try {
                PeerHandle handle = d.spawn(routedReq);
                spawnedBy.put(handle.id(), d);
@@ -187,6 +195,42 @@ public final class CompositePeerLauncher implements PeerLauncher {
                        + " candidate(s): " + String.join(", ", unreachable));
    }

+    /**
+     * Refuse an explicit-profile spawn when the profile is at its {@code maxLoad} cap.
+     *
+     * <p>maxLoad is a documented, unconditional capacity limit (see {@code BridgedConfig.Worker#maxLoad}),
+     * and the charter makes explicit-profile spawns the normal path — so enforcing it only in placement
+     * ({@link dev.ltms.bridged.placement.PlacementPolicyUtil}) would leave the cap dead config on every
+     * call that names a profile. Same rule as placement: {@code live >= cap} is at capacity.
+     *
+     * <p>Deliberately no fallback to another profile: the caller named {@code profile} for a cost/model
+     * reason, and silently re-routing a paid-tier (subscription) request elsewhere is worse than
+     * refusing it. A caller that wants placement should omit the profile and let the policy pick.
+     *
+     * <p>Known TOCTOU limitation — documented, not fixed. {@link #liveCount} is read outside any lock and
+     * {@code SessionManager} registers a session only after {@code launcher.spawn} returns, so two
+     * genuinely concurrent spawns can both pass this check. The race already exists on the placement
+     * path. Closing it needs slot reservation in the registry; serializing spawn here would block on
+     * the readiness gate and is a far worse trade.
+     *
+     * @param profile the profile the caller explicitly named
+     * @throws PlacementException when the profile is at capacity
+     */
+    private void enforceMaxLoad(String profile) {
+        // Absent config, or a config whose maxLoad normalized to null (non-positive ⇒ unlimited at
+        // load), means no cap — never cap what wasn't configured.
+        BridgedConfig.Worker cfg = profileConfigs.get(profile);
+        Integer cap = (cfg == null) ? null : cfg.maxLoad();
+        if (cap == null) {
+            return;
+        }
+        int live = liveCount.apply(profile);
+        if (live >= cap) {
+            throw new PlacementException("worker profile '" + profile + "' is at maxLoad: " + live
+                    + " live >= " + cap + " cap; refusing spawn — no fallback to another profile");
+        }
+    }
+
    /** Build the candidate list from the configured profiles, in definition order. */
    private List<PlacementCandidate> candidates() {
        List<PlacementCandidate> out = new ArrayList<>();
@@ -217,6 +261,16 @@ public final class CompositePeerLauncher implements PeerLauncher {
        d.stop(id);
    }

+    @Override
+    public boolean clearContext(String id) {
+        HerdrPeerLauncher delegate = spawnedBy.get(id);
+        if (delegate == null) {
+            log.debug("clearContext({}) ignored — no recorded owning adapter", id);
+            return false;
+        }
+        return delegate.clearContext(id);
+    }
+
    @Override
    public Set<String> profiles() {
        return byProfile.keySet();
@@ -24,6 +24,7 @@ import java.util.Set;
 import java.util.UUID;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ConcurrentMap;
+import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.Function;
 import java.util.function.LongSupplier;
@@ -90,6 +91,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
    // exact pane it must tear down. The pane id is launcher-private (never the routing key) — see
    // PeerHandle.id().
    private final ConcurrentMap<String, String> paneByAgentId = new ConcurrentHashMap<>();
+    private final AtomicBoolean resetUnsupportedLogged = new AtomicBoolean();

    /**
     * @param namePrefix          label prefix for this peer kind (drives naming and reap)
@@ -128,8 +130,52 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     */
    protected abstract Launch buildLaunch(BridgedConfig.Worker cfg);

-    /** A peer-specific launch: the herdr {@code env} map and {@code argv}. */
-    protected record Launch(Map<String, String> env, List<String> argv) {
+    /**
+     * Session-aware variant of {@link #buildLaunch(BridgedConfig.Worker)} (CB-547a). Default
+     * discards the session identity and delegates to the profile-only form, so an adapter that
+     * carries no durable peer session (opencode, say) inherits byte-identical behaviour and needs
+     * no change. An adapter that does (Claude Code) overrides this to mint/resume the id and to
+     * surface it on the returned {@link Launch#agentSessionId()}.
+     *
+     * @param cfg               the resolved profile to spawn
+     * @param sessionName       the bridge's logical session name, or null/blank for launcher-derived
+     * @param resumeSessionId   the peer's own prior session id to resume, or null/blank for fresh
+     */
+    protected Launch buildLaunch(BridgedConfig.Worker cfg, String sessionName, String resumeSessionId) {
+        return buildLaunch(cfg);
+    }
+
+    /** Direct transport access for peer-specific, non-turn control operations. */
+    protected final AgentControl agents() {
+        return agents;
+    }
+
+    /** Resolve the public peer id to the launcher's private herdr target. */
+    protected final String agentTarget(String id) {
+        return paneByAgentId.get(id);
+    }
+
+    @Override
+    public boolean clearContext(String id) {
+        if (resetUnsupportedLogged.compareAndSet(false, true)) {
+            log.warn("context reset is unsupported for peer kind {}; clearAfterTurn is a no-op",
+                    namePrefix);
+        }
+        return false;
+    }
+
+    /**
+     * A peer-specific launch: the herdr {@code env} map and {@code argv}, plus — for an adapter
+     * that carries durable session identity (CB-547a) — the peer's OWN session id
+     * ({@link PeerHandle#agentSessionId()}), known before the peer has written anything. Null for
+     * a launch that carries no identity.
+     */
+    protected record Launch(Map<String, String> env, List<String> argv, String agentSessionId) {
+
+        /** A launch without a discoverable agent session id (an adapter that carries none). */
+        Launch(Map<String, String> env, List<String> argv) {
+            this(env, argv, null);
+        }
    }

    // --- profile surface -----------------------------------------------------------------------
@@ -179,6 +225,10 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {

    // --- spawn ---------------------------------------------------------------------------------

+    /** A started peer plus the launch's agent-session id (the resume handle, or null). */
+    private record Spawned(Agent agent, String agentSessionId) {
+    }
+
    /**
     * Spawn a peer. {@code profileName} null/blank → the default profile. The working directory
     * (CB-112) is resolved by {@link #resolveCwd}: an explicit {@code requestedCwd}, else the
@@ -187,12 +237,24 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * The adapter's {@link #buildLaunch} runs before any herdr call.
     */
    protected Agent spawnInternal(String profileName, String requestedCwd, String callerCwd) {
+        return spawnInternal(profileName, requestedCwd, callerCwd, null, null).agent();
+    }
+
+    /**
+     * Spawn a peer with session identity (CB-547a). {@code sessionName} and {@code resumeSessionId}
+     * are threaded from the {@link SpawnRequest} into {@link #buildLaunch(BridgedConfig.Worker,
+     * String, String)}, and the launch's resolved agent-session id is returned alongside the agent
+     * so the caller can put it on the {@link PeerHandle}.
+     */
+    protected Spawned spawnInternal(String profileName, String requestedCwd, String callerCwd,
+                                    String sessionName, String resumeSessionId) {
        BridgedConfig.Worker cfg = requireProfile(profileName);
-        Launch launch = buildLaunch(cfg);
+        Launch launch = buildLaunch(cfg, sessionName, resumeSessionId);
        String cwd = resolveCwd(requestedCwd, cfg, callerCwd);
-        return cfg.tabPlacement()
+        Agent agent = cfg.tabPlacement()
                ? spawnInTab(cfg, launch.env(), launch.argv(), cwd)
                : spawnAsPane(cfg, launch.env(), launch.argv(), cwd);
+        return new Spawned(agent, launch.agentSessionId());
    }

    /**
@@ -209,7 +271,9 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     */
    @Override
    public PeerHandle spawn(SpawnRequest req) {
-        Agent agent = spawnInternal(req.profileName(), req.requestedCwd(), req.callerCwd());
+        Spawned spawned = spawnInternal(req.profileName(), req.requestedCwd(), req.callerCwd(),
+                req.sessionName(), req.resumeSessionId());
+        Agent agent = spawned.agent();
        String paneId = agent.paneId();
        if (spawnReadyTimeoutMs > 0) {
            waitUntilInjectableOrThrow(paneId);
@@ -217,7 +281,8 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        // CB-519: the handle id is a host-unique UUID; the herdr pane it maps to stays internal.
        String id = UUID.randomUUID().toString();
        paneByAgentId.put(id, paneId);
-        return new WorkerHandle(id, agent.terminalId(), requireProfile(req.profileName()).profile());
+        return new WorkerHandle(id, agent.terminalId(), requireProfile(req.profileName()).profile(),
+                req.sessionName(), spawned.agentSessionId());
    }

    @Override
@@ -514,8 +579,13 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
                        + spawnReadyTimeoutMs + "ms");
    }

-    /** A concrete {@link PeerHandle} wrapping herdr agent coordinates and the profile that spawned it. */
-    private record WorkerHandle(String id, String terminalId, String profile) implements PeerHandle {
+    /**
+     * A concrete {@link PeerHandle} wrapping herdr agent coordinates, the profile that spawned it,
+     * and the session identity the launch resolved (CB-547a): the bridge's logical name and the
+     * peer's own session id, both null when the spawn carried no identity.
+     */
+    private record WorkerHandle(String id, String terminalId, String profile,
+                                String sessionName, String agentSessionId) implements PeerHandle {
    }

    // --- shared helpers ------------------------------------------------------------------------
@@ -7,6 +7,8 @@ import dev.ltms.bridged.herdr.Agent;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.peer.Capability;
+import dev.ltms.bridged.peer.PeerHandle;
+import dev.ltms.bridged.peer.SpawnRequest;

 import java.io.IOException;
 import java.io.UncheckedIOException;
@@ -72,6 +74,24 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
    /** Root under which per-spawn opencode config dirs are created (injectable for tests). */
    private final Path configRoot;

+    /**
+     * The current spawn's resume-target session id, threaded from {@link #spawn(SpawnRequest)} to
+     * {@link #buildLaunch} across the base's {@code spawn -> spawnInternal -> buildLaunch} chain,
+     * which carries no request. A plain field would race under concurrent spawns (the base supports
+     * them), so it is thread-local: each spawn captures its own request's id on its own thread, and
+     * {@code buildLaunch}, synchronous and same-thread, reads exactly that one. Set only around the
+     * {@code super.spawn} call and cleared in {@code finally}, so a paused/leftover value can never
+     * bleed into the next spawn.
+     */
+    private final ThreadLocal<String> resumeSessionId = new ThreadLocal<>();
+
+    /**
+     * Session discovery against opencode's on-disk storage ({@link OpenCodeSessionDiscovery}) —
+     * the one seam that knows opencode's private session-file layout. Its root is injectable for
+     * tests so they never touch the operator's real {@code ~/.local/share/opencode}.
+     */
+    private final OpenCodeSessionDiscovery discovery;
+
    /**
     * Production constructor — disables the spawn-ready gate ({@code spawnReadyTimeoutMs == 0}) so it
     * matches the legacy non-blocking spawn semantics. Config dirs are created under the JVM temp dir.
@@ -81,7 +101,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                            Function<String, String> env) {
        this(agents, spaces, profiles, defaultProfile, env, 0,
                System::currentTimeMillis, () -> sleepUninterruptibly(300),
-                defaultConfigRoot());
+                defaultConfigRoot(), defaultDiscoveryRoot());
    }

    /**
@@ -94,7 +114,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
                            long spawnReadyTimeoutMs, long spawnReadyPollMs) {
        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
-                defaultConfigRoot());
+                defaultConfigRoot(), defaultDiscoveryRoot());
    }

    /**
@@ -112,21 +132,31 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * @param sleeper             sleep/wait hook (encodes the poll interval; never called when the
     *                            gate is disabled)
     * @param configRoot          existing directory under which per-spawn config dirs are created
+     * @param discoveryRoot       opencode's on-disk storage root to scan for session records
+     *                            (injectable for tests; opencode's layout is matched at
+     *                            {@link OpenCodeSessionDiscovery})
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
                            Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
                            Function<String, String> env,
                            long spawnReadyTimeoutMs,
-                            LongSupplier nowMillis, Runnable sleeper, Path configRoot) {
+                            LongSupplier nowMillis, Runnable sleeper,
+                            Path configRoot, Path discoveryRoot) {
        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
                spawnReadyTimeoutMs, nowMillis, sleeper);
        this.configRoot = configRoot;
+        this.discovery = new OpenCodeSessionDiscovery(discoveryRoot);
    }

    private static Path defaultConfigRoot() {
        return Path.of(System.getProperty("java.io.tmpdir"));
    }

+    /** The default opencode storage root: {@code ~/.local/share/opencode} (the XDG data dir). */
+    private static Path defaultDiscoveryRoot() {
+        return Path.of(System.getProperty("user.home"), ".local", "share", "opencode");
+    }
+
    /**
     * {@inheritDoc}
     *
@@ -144,7 +174,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
            workerEnv.put("OPENCODE_CONFIG", writeConfig(cfg).toString());
        }
        applyGitToken(workerEnv, cfg);
-        return new Launch(workerEnv, argvWithModel(cfg));
+        return new Launch(workerEnv, argvWithResume(argvWithModel(argvWithAuto(cfg), cfg)));
    }

    /**
@@ -161,9 +191,42 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
        return cfg.baseUrl() != null && !cfg.baseUrl().isBlank();
    }

-    /** The launch argv plus, when a model is configured, the opencode {@code -m provider/model} flag. */
-    private List<String> argvWithModel(BridgedConfig.Worker cfg) {
+    /**
+     * The launch argv plus the unconditional {@code --auto} flag, which auto-approves the
+     * permissions opencode does not explicitly deny. It is unconditional, not a preference: a
+     * spawned peer has no human at its pane — the bridge spawned it — so one that stops at an
+     * approval prompt is a wedged agent, indistinguishable from a legitimate mid-turn wait and
+     * unable to end its turn with {@code bridge_reply}. opencode's own help calls this
+     * "dangerous!", but the blast radius here is already bounded by design: a worker runs in its
+     * own git worktree on its own branch, is off-subscription, and cannot merge — the lead is the
+     * gate.
+     */
+    private List<String> argvWithAuto(BridgedConfig.Worker cfg) {
        List<String> argv = mutableArgv(cfg.argv());
+        argv.add("--auto");
+        return argv;
+    }
+
+    /**
+     * The launch argv plus, on a resumed spawn, opencode's {@code -s <id>} flag to continue a prior
+     * conversation by its session id. {@code -s, --session <id>} resumes an existing session; on a
+     * fresh spawn (no resume target) no flag is added, letting opencode start a brand-new session.
+     * The id comes from the current spawn request's {@code resumeSessionId}, threaded per-thread by
+     * {@link #spawn(SpawnRequest)}.
+     */
+    private List<String> argvWithResume(List<String> argv) {
+        String id = resumeSessionId.get();
+        if (id == null || id.isBlank()) {
+            return argv;
+        }
+        List<String> withResume = mutableArgv(argv);
+        withResume.add("-s");
+        withResume.add(id);
+        return withResume;
+    }
+
+    /** The launch argv plus, when a model is configured, the opencode {@code -m provider/model} flag. */
+    private List<String> argvWithModel(List<String> argv, BridgedConfig.Worker cfg) {
        if (cfg.model() != null && !cfg.model().isBlank()) {
            argv.add("-m");
            argv.add(cfg.model());
@@ -270,6 +333,82 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
        return afterScheme.contains("/") ? trimmed : trimmed + "/v1";
    }

+    /**
+     * {@inheritDoc}
+     *
+     * <p>adds this adapter's session-identity work around the base's spawn — as opencode cannot be
+     * told its session id at spawn (see {@link Capability#SESSION_RESUME} vs
+     * {@link Capability#SESSION_NAME}), identity is only ever adopted after the fact:
+     * <ul>
+     *   <li>the request's {@code resumeSessionId} is remembered for {@link #buildLaunch} to turn
+     *       into {@code -s <id>}; and</li>
+     *   <li>the returned handle is wrapped so its
+     *       {@link dev.ltms.bridged.peer.PeerHandle#agentSessionId()} performs lazy session
+     *       discovery against opencode's storage (see {@link OpenCodeSessionDiscovery}) — always
+     *       non-blocking, {@code null} until opencode has persisted the session record.</li>
+     * </ul>
+     */
+    @Override
+    public PeerHandle spawn(SpawnRequest req) {
+        resumeSessionId.set(req.resumeSessionId());
+        try {
+            PeerHandle inner = super.spawn(req);
+            return new SessionAwareHandle(inner, discovery, effectiveCwd(req));
+        } finally {
+            // Never let a paused/leftover resume id bleed into the next spawn on this thread.
+            resumeSessionId.remove();
+        }
+    }
+
+    /**
+     * A {@link PeerHandle} that delegates everything to the base's worker handle but resolves
+     * {@link #agentSessionId()} lazily through opencode session discovery. Delegate-only, so the
+     * base's id/terminalId/profile semantics (CB-519's host-unique routing key, herdr coordinates)
+     * are untouched — only the opencode-specific identity answer is added. {@code sessionName()}
+     * stays null: opencode has no display-name seam, so the logical name lives only in the bridge's
+     * roster (see the SESSION_NAME capability).
+     */
+    private static final class SessionAwareHandle implements PeerHandle {
+        private final PeerHandle delegate;
+        private final OpenCodeSessionDiscovery discovery;
+        private final String cwd;
+
+        SessionAwareHandle(PeerHandle delegate, OpenCodeSessionDiscovery discovery, String cwd) {
+            this.delegate = delegate;
+            this.discovery = discovery;
+            this.cwd = cwd;
+        }
+
+        @Override
+        public String id() {
+            return delegate.id();
+        }
+
+        @Override
+        public String terminalId() {
+            return delegate.terminalId();
+        }
+
+        @Override
+        public String profile() {
+            return delegate.profile();
+        }
+
+        @Override
+        public String sessionName() {
+            return delegate.sessionName();
+        }
+
+        @Override
+        public String agentSessionId() {
+            // Lazy + retried, never a spawn-time blocker: opencode writes the session record only
+            // when the session is first persisted, so null here is the correct interim answer and
+            // the caller re-calls later (each call re-scans, picking up a record that has since
+            // appeared).
+            return discovery.sessionIdForDirectory(cwd);
+        }
+    }
+
    // --- Agent-returning convenience spawns (used by callers/tests that want the herdr Agent) ---

    /** Spawn a worker for the default profile in the resolved default cwd. */
@@ -291,10 +430,15 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {

    @Override
    public Set<Capability> capabilities() {
-        Set<Capability> caps = EnumSet.of(Capability.MID_TURN_ASK, Capability.WORKTREE, Capability.ORPHAN_REAP);
+        Set<Capability> caps = EnumSet.of(Capability.MID_TURN_ASK, Capability.WORKTREE,
+                Capability.ORPHAN_REAP, Capability.SESSION_RESUME);
        if (hasGitTokenProfile()) {
            caps.add(Capability.SELF_PR);
        }
+        // Deliberately NOT SESSION_NAME: opencode has no display-name flag, so the bridge's logical
+        // name can't surface in the peer's own UI — declaring the capability would hide that
+        // asymmetry rather than make it honest. For opencode the name lives only in the bridge's
+        // roster (see PeerHandle.sessionName() returning null).
        return Set.copyOf(caps);
    }

@@ -0,0 +1,122 @@
+package dev.ltms.bridged.worker;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.stream.Stream;
+
+/**
+ * Resolves the opencode session id for a bridged worker from opencode's on-disk storage — the
+ * only place this adapter touches opencode's private layout, and deliberately the <em>only</em>
+ * class that does.
+ *
+ * <p><strong>Why this is isolated behind one seam.</strong> The layout is version-coupled and not a
+ * stable contract: opencode writes one JSON file per session under
+ * {@code <storageRoot>/session/<projectID>/<ses_*.json>}, and each record carries a
+ * {@code "version"} field (e.g. {@code "1.1.31"}), so the exact directory shape, file naming, and
+ * field names can move between opencode releases. opencode also ships a headless HTTP server that
+ * may supersede file scanning entirely. Everything this adapter knows about that private storage —
+ * its shape, naming, and field names — lives here, so a layout change, or a switch to the HTTP
+ * server, changes exactly one class and nothing in {@link OpenCodeLauncher}.
+ *
+ * <p>The determinism that makes this useful is structural, not a guess: every bridged worker runs
+ * in its own unique git worktree, so the record's {@code directory} (its project root) equals the
+ * worker's cwd identifies <em>its</em> session unambiguously. We match on {@code directory} rather
+ * than diffing {@code opencode session list} before/after — that races under concurrent spawns, and
+ * the CLI listing does not even show the directory.
+ *
+ * <p>All reads are best-effort and never throw: a missing or unreadable storage root, a record that
+ * fails to parse, or a directory with no record yet all yield {@code null}, and the caller (the
+ * session handle) treats that as "identity not resolved yet" and retries later.
+ */
+final class OpenCodeSessionDiscovery {
+
+    private final Path storageRoot;   // e.g. ~/.local/share/opencode (injectable for tests)
+    private final ObjectMapper json;
+
+    OpenCodeSessionDiscovery(Path storageRoot) {
+        this.storageRoot = storageRoot;
+        this.json = new ObjectMapper();
+    }
+
+    /**
+     * The opencode session id whose record references {@code directory} (the worker's cwd), or
+     * {@code null} when no record matches yet. When several records share the directory — e.g.
+     * repeated spawns into the same worktree — the <em>most recently modified</em> one wins: it is
+     * the session the pane most likely corresponds to.
+     *
+     * <p>Never throws: a missing {@code storageRoot}, an unreadable/malformed record, or a
+     * directory that has not been persisted yet all resolve to {@code null} rather than failing a
+     * spawn. A bridged worker's session record is written lazily (when the session is first
+     * persisted), so {@code null} here is the normal answer right after the pane is ready, and the
+     * caller retries later.
+     *
+     * @param directory the worker's cwd, as resolved for this spawn
+     * @return the matching session id, or {@code null} if none is known yet
+     */
+    String sessionIdForDirectory(String directory) {
+        if (directory == null || directory.isBlank()) {
+            return null;
+        }
+        Path sessionRoot = storageRoot.resolve("session");
+        if (!Files.isDirectory(sessionRoot)) {
+            return null;
+        }
+        String best = null;
+        long bestMtime = Long.MIN_VALUE;
+        try (Stream<Path> projectDirs = Files.list(sessionRoot)) {
+            for (Path projectDir : projectDirs.filter(Files::isDirectory).toList()) {
+                try (Stream<Path> records = Files.list(projectDir)) {
+                    for (Path record : records.toList()) {
+                        String id = matchId(record, directory);
+                        if (id == null) {
+                            continue;
+                        }
+                        long mtime = lastModifiedEpochMillis(record);
+                        if (mtime > bestMtime) {
+                            bestMtime = mtime;
+                            best = id;
+                        }
+                    }
+                } catch (IOException ignored) {
+                    // one project dir unreadable — skip it; another may still match
+                }
+            }
+        } catch (IOException ignored) {
+            // storage root vanished or became unreadable — "no session known yet"
+            return null;
+        }
+        return best;
+    }
+
+    /**
+     * The record's session id when it references {@code directory}, else {@code null}. A record
+     * that is not JSON, lacks {@code id}/{@code directory}, or points at a different directory is
+     * simply not our session; a malformed one is skipped, never fatal.
+     */
+    private String matchId(Path record, String directory) {
+        try {
+            JsonNode node = json.readTree(record.toFile());
+            JsonNode id = node == null ? null : node.get("id");
+            JsonNode dir = node == null ? null : node.get("directory");
+            if (id == null || dir == null || !directory.equals(dir.asText())) {
+                return null;
+            }
+            return id.asText();
+        } catch (IOException e) {
+            return null;
+        }
+    }
+
+    /** The record's last-modified epoch ms, or {@code Long.MIN_VALUE} if unreadable (never wins). */
+    private static long lastModifiedEpochMillis(Path record) {
+        try {
+            return Files.getLastModifiedTime(record).toMillis();
+        } catch (IOException e) {
+            return Long.MIN_VALUE;
+        }
+    }
+}
@@ -0,0 +1,86 @@
+package dev.ltms.bridged;
+
+import dev.ltms.bridged.inject.WorkerPresence;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.function.Predicate;
+import java.util.function.Supplier;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * CB-534: the injector's readiness gate must open for a lead as well as for a present worker.
+ *
+ * <p>The bug these cover was silent and slow: a lead was never marked present (only workers are), so
+ * every lead→lead delivery sat on the gate for the full readiness grace and failed ~60s later without
+ * a keystroke ever reaching the pane.
+ */
+class BridgedDeliverabilityTest {
+
+    private static Supplier<Map<String, String>> leads(Map<String, String> m) {
+        return () -> m;
+    }
+
+    @Test
+    @DisplayName("a worker that has connected its MCP is deliverable")
+    void presentWorkerIsDeliverable() {
+        WorkerPresence presence = new WorkerPresence();
+        presence.markPresent("term_worker");
+
+        assertTrue(Bridged.deliverableTo(presence, leads(Map.of())).test("term_worker"));
+    }
+
+    @Test
+    @DisplayName("a worker still in its boot window is held back")
+    void absentWorkerIsNotDeliverable() {
+        assertFalse(Bridged.deliverableTo(new WorkerPresence(), leads(Map.of())).test("term_booting"));
+    }
+
+    @Test
+    @DisplayName("a lead is deliverable without ever being marked present")
+    void leadIsDeliverableWithoutPresence() {
+        WorkerPresence presence = new WorkerPresence();
+        Predicate<String> deliverable =
+                Bridged.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")));
+
+        assertFalse(presence.isPresent("term_lead"), "a lead is never enrolled in worker presence");
+        assertTrue(deliverable.test("term_lead"), "…and must be deliverable anyway");
+    }
+
+    @Test
+    @DisplayName("an unknown terminal is deliverable to neither")
+    void strangerIsNotDeliverable() {
+        WorkerPresence presence = new WorkerPresence();
+        presence.markPresent("term_worker");
+
+        assertFalse(Bridged.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")))
+                .test("term_stranger"));
+    }
+
+    @Test
+    @DisplayName("a lead discovered after startup becomes deliverable with no restart")
+    void leadSetIsReadThroughOnEveryCall() {
+        Map<String, String> discovered = new HashMap<>();
+        Predicate<String> deliverable = Bridged.deliverableTo(new WorkerPresence(), leads(discovered));
+
+        assertFalse(deliverable.test("term_late"));
+        discovered.put("term_late", "gpt-sol-5.6"); // leadScan picks up a newly labelled tab
+        assertTrue(deliverable.test("term_late"), "the supplier must be re-read, not snapshotted");
+    }
+
+    @Test
+    @DisplayName("forgetting a torn-down worker does not strip a lead of its deliverability")
+    void forgetDoesNotDisarmALead() {
+        WorkerPresence presence = new WorkerPresence();
+        Predicate<String> deliverable =
+                Bridged.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")));
+
+        presence.forget("term_lead"); // the injector's cleanup path runs against every target
+
+        assertTrue(deliverable.test("term_lead"));
+    }
+}
@@ -0,0 +1,238 @@
+package dev.ltms.bridged.auth;
+
+import dev.ltms.bridged.config.BridgedConfig;
+import org.junit.jupiter.api.Test;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * CB-548 — the architect-slot registry: the config snapshot of slot → profile, and the live
+ * terminal → slot bindings it owns. The role a binding produces is asserted in
+ * {@link CallerResolverTest}; this pins the registry object itself — its invariants and their
+ * thread-safety.
+ */
+class ArchitectRegistryTest {
+
+    private static final Map<String, BridgedConfig.Architect> SLOTS = Map.of(
+            "lead-designer", new BridgedConfig.Architect("sonnet"),
+            "reviewer", new BridgedConfig.Architect("gx10"));
+
+    private final ArchitectRegistry registry = new ArchitectRegistry(SLOTS);
+
+    @Test
+    void exposesTheConfiguredSlots() {
+        assertEquals(SLOTS.keySet(), registry.slots().keySet());
+        assertTrue(registry.isSlot("reviewer"));
+        assertFalse(registry.isSlot("nope"));
+    }
+
+    @Test
+    void theSpawnLifecycleReadsTheProfileBackFromASlot() {
+        assertEquals("sonnet", registry.profileForSlot("lead-designer"));
+        assertEquals("gx10", registry.profileForSlot("reviewer"));
+        assertNull(registry.profileForSlot("unknown"), "an unknown slot has no profile");
+    }
+
+    @Test
+    void startsEmptySoNoTerminalResolvesToAnArchitect() {
+        assertTrue(registry.snapshot().isEmpty());
+        assertNull(registry.slotForTerminal("term_design"),
+                "config declares no architect terminal — nothing is recognised until a bind");
+        assertNull(registry.slotForTerminal(null), "no terminal ⇒ no slot");
+    }
+
+    // ── bind ──────────────────────────────────────────────────────────────────────────────────
+
+    @Test
+    void bindResolvesTheTerminalToTheSlot() {
+        assertTrue(registry.bind("lead-designer", "term_design"));
+        assertEquals("lead-designer", registry.slotForTerminal("term_design"));
+        assertEquals(Map.of("term_design", "lead-designer"), registry.snapshot());
+    }
+
+    @Test
+    void bindRefusesAnUnknownSlot() {
+        assertFalse(registry.bind("nope", "term_x"),
+                "a slot that is not configured must be refused — bind is not a way to invent one");
+        assertNull(registry.slotForTerminal("term_x"));
+    }
+
+    @Test
+    void bindRefusesATerminalInTwoSlots() {
+        assertTrue(registry.bind("lead-designer", "term_design"));
+        assertFalse(registry.bind("reviewer", "term_design"),
+                "a terminal may occupy at most one slot");
+        assertEquals("lead-designer", registry.slotForTerminal("term_design"),
+                "the first binding survives the refused second");
+    }
+
+    @Test
+    void bindRefusesASlotWithTwoTerminals() {
+        assertTrue(registry.bind("lead-designer", "term_design"));
+        assertFalse(registry.bind("lead-designer", "term_other"),
+                "a slot may host at most one terminal");
+        assertEquals("lead-designer", registry.slotForTerminal("term_design"),
+                "the first binding survives the refused second");
+        assertNull(registry.slotForTerminal("term_other"));
+    }
+
+    @Test
+    void rebindingTheSamePairIsAnIdempotentNoOp() {
+        assertTrue(registry.bind("lead-designer", "term_design"));
+        assertTrue(registry.bind("lead-designer", "term_design"),
+                "the same terminal → slot is harmless to repeat");
+        assertEquals(1, registry.snapshot().size());
+    }
+
+    // ── unbind ────────────────────────────────────────────────────────────────────────────────
+
+    @Test
+    void unbindRemovesTheExactBinding() {
+        assertTrue(registry.bind("lead-designer", "term_design"));
+        assertTrue(registry.unbind("lead-designer", "term_design"));
+        assertNull(registry.slotForTerminal("term_design"));
+        assertTrue(registry.snapshot().isEmpty());
+    }
+
+    @Test
+    void aStaleUnbindDoesNotRemoveAReplacement() {
+        // Bind, tear down, and stand the slot back up with a NEW terminal.
+        assertTrue(registry.bind("lead-designer", "term_design"));
+        registry.unbind("lead-designer", "term_design");
+        assertTrue(registry.bind("lead-designer", "term_new"));
+
+        // A late unbind naming the OLD terminal must not remove the replacement binding.
+        assertFalse(registry.unbind("lead-designer", "term_design"));
+        assertEquals("lead-designer", registry.slotForTerminal("term_new"),
+                "the replacement terminal stays bound");
+    }
+
+    @Test
+    void aStaleUnbindForATerminalThatMovedSlotsDoesNothing() {
+        // term_design starts in lead-designer, is torn down, and stands back up in a FREE slot.
+        assertTrue(registry.bind("lead-designer", "term_design"));
+        registry.unbind("lead-designer", "term_design");
+        assertTrue(registry.bind("reviewer", "term_design"));
+
+        // Unbinding against the slot it no longer occupies is refused; the new binding is intact.
+        assertFalse(registry.unbind("lead-designer", "term_design"),
+                "the old slot must not unbind a terminal that moved elsewhere");
+        assertEquals("reviewer", registry.slotForTerminal("term_design"));
+    }
+
+    @Test
+    void unbindOfNothingIsAFalseNoOp() {
+        assertFalse(registry.unbind("lead-designer", "term_design"),
+                "nothing was bound, so nothing is removed");
+    }
+
+    // ── snapshot ─────────────────────────────────────────────────────────────────────────────
+
+    @Test
+    void theSnapshotIsAnImmutableCopyNotAliveState() {
+        assertTrue(registry.bind("lead-designer", "term_design"));
+        Map<String, String> snap = registry.snapshot();
+
+        assertThrows(UnsupportedOperationException.class, () -> snap.put("x", "y"),
+                "a handed-out snapshot cannot be mutated in place");
+
+        // Later binds must not leak into an earlier snapshot.
+        assertTrue(registry.bind("reviewer", "term_review"));
+        assertFalse(snap.containsKey("term_review"),
+                "a snapshot is a point-in-time copy, not a live view");
+    }
+
+    // ── concurrency (CB-548 invariants hold under contention) ─────────────────────────────────
+
+    @Test
+    void concurrentBindsNeverGiveASlotTwoTerminals() throws Exception {
+        int n = 16;
+        ExecutorService pool = Executors.newFixedThreadPool(n);
+        try {
+            CountDownLatch go = new CountDownLatch(1);
+            List<Future<Boolean>> results = new ArrayList<>();
+            for (int i = 0; i < n; i++) {
+                final String term = "term_" + i; // every thread races for the SAME slot
+                results.add(pool.submit(() -> {
+                    go.await();
+                    return registry.bind("lead-designer", term);
+                }));
+            }
+            go.countDown();
+
+            int won = 0;
+            for (Future<Boolean> r : results) {
+                if (r.get()) {
+                    won++;
+                }
+            }
+            assertEquals(1, won, "exactly one terminal may win the sole slot, got " + won);
+            assertEquals(1, registry.snapshot().size(),
+                    "the slot hosts at most one terminal after the race");
+        } finally {
+            pool.shutdownNow();
+        }
+    }
+
+    @Test
+    void concurrentBindsNeverPutOneTerminalInTwoSlots() throws Exception {
+        int n = 16;
+        ExecutorService pool = Executors.newFixedThreadPool(n);
+        try {
+            CountDownLatch go = new CountDownLatch(1);
+            List<Future<String>> results = new ArrayList<>();
+            for (int i = 0; i < n; i++) {
+                final String slot = (i % 2 == 0) ? "lead-designer" : "reviewer"; // all race for ONE terminal
+                results.add(pool.submit(() -> {
+                    go.await();
+                    return registry.bind(slot, "shared_term")
+                            ? registry.slotForTerminal("shared_term") : null;
+                }));
+            }
+            go.countDown();
+
+            // Rebinding the same terminal to the same slot is a harmless idempotent true, so count
+            // winners is not the assertion — agreement is: every thread that reported success must
+            // have seen the terminal in the SAME slot, never in two at once.
+            String bound = null;
+            boolean conflict = false;
+            for (Future<String> r : results) {
+                String s = r.get();
+                if (s != null) {
+                    if (bound == null) {
+                        bound = s;
+                    } else if (!bound.equals(s)) {
+                        conflict = true;
+                    }
+                }
+            }
+            assertFalse(conflict, "a terminal was observed in two slots at once");
+            assertNotNull(bound, "at least one thread bound the terminal");
+            assertEquals(1, registry.snapshot().size(),
+                    "the terminal occupies exactly one slot in the final snapshot");
+            assertEquals(bound, registry.slotForTerminal("shared_term"));
+        } finally {
+            pool.shutdownNow();
+        }
+    }
+
+    /** A handed-over slot map is snapshotted at construction, not offered as live state. */
+    @Test
+    void theSlotSnapshotIsFixedByConstruction() {
+        Map<String, BridgedConfig.Architect> mutable = new HashMap<>(SLOTS);
+        ArchitectRegistry r = new ArchitectRegistry(mutable);
+
+        mutable.put("hijack", new BridgedConfig.Architect("gx10"));
+
+        assertFalse(r.isSlot("hijack"), "a handed-over map is not offered as live state");
+    }
+}
@@ -12,6 +12,8 @@ class AuthzTest {
    private static final Principal WORKER_A = Principal.worker("term_a", 200);
    private static final Principal WORKER_B = Principal.worker("term_b", 300);
    private static final Principal ANON = Principal.anonymous();
+    private static final Principal ARCH_DESIGN = Principal.architect("lead-designer", "term_design", 400);
+    private static final Principal ARCH_OTHER = Principal.architect("reviewer", "term_review", 500);

    @Test
    void anonymousIsAuthorizedForNothing() {
@@ -61,6 +63,48 @@ class AuthzTest {
                "an absent session id must not satisfy the own-session rule");
    }

+    // ── CB-548: the architect matrix ───────────────────────────────────────────────────────────
+
+    @Test
+    void anArchitectMaySendButNotSpawnStopOrDrain() {
+        assertTrue(Authz.permits(ARCH_DESIGN, SEND, "term_worker"),
+                "delegating a turn to a worker IS the architect's job");
+        assertTrue(Authz.permits(ARCH_DESIGN, SEND, null));
+
+        for (Authz.Action a : new Authz.Action[]{SPAWN, STOP, DRAIN}) {
+            assertFalse(Authz.permits(ARCH_DESIGN, a, null),
+                    "an architect must not " + a + " — fleet lifecycle is the primary's alone, so "
+                            + "a coordinator cannot also stand up or tear down the fleet");
+        }
+    }
+
+    @Test
+    void anArchitectMayReplyAndAskOnlyAsItsOwnPane() {
+        assertTrue(Authz.permits(ARCH_DESIGN, REPLY, "term_design"), "its own pane is its own");
+        assertTrue(Authz.permits(ARCH_DESIGN, ASK, "term_design"));
+
+        assertFalse(Authz.permits(ARCH_DESIGN, REPLY, "term_review"),
+                "architect 'lead-designer' must not reply on reviewer's pane");
+        assertFalse(Authz.permits(ARCH_OTHER, ASK, "term_design"),
+                "reviewer must not ask as lead-designer — no terminal is another's");
+        assertFalse(Authz.permits(ARCH_DESIGN, REPLY, null),
+                "an absent target must not pass the own-session rule");
+    }
+
+    @Test
+    void anArchitectMayReadAndScrapeMetrics() {
+        assertTrue(Authz.permits(ARCH_DESIGN, READ, null));
+        assertTrue(Authz.permits(ARCH_DESIGN, METRICS, null));
+    }
+
+    @Test
+    void anArchitectIsNotCountedAsPrimaryOrWorker() {
+        assertFalse(Authz.permits(ARCH_DESIGN, SPAWN, null), "not a primary — no lifecycle");
+        assertFalse(ARCH_DESIGN.isPrimary());
+        assertFalse(ARCH_DESIGN.isWorker(), "an architect is its own role, not a widened worker");
+        assertTrue(ARCH_DESIGN.isArchitect());
+    }
+
    @Test
    void observationIsOpenToBothAuthenticatedRoles() {
        assertTrue(Authz.permits(PRIMARY, READ, null));
@@ -5,6 +5,8 @@ import dev.ltms.bridged.herdr.PaneLocator;
 import dev.ltms.bridged.mcp.ConnectionIdentity;
 import org.junit.jupiter.api.Test;

+import java.util.Map;
+
 import static org.junit.jupiter.api.Assertions.*;

 /**
@@ -48,7 +50,7 @@ class CallerResolverTest {
    void aPinnedPrimaryTerminalResolvesToPrimaryNotWorker() {
        // The primary's own session lives in a herdr pane (term_a here). Without the pin the pane
        // match wins and the primary is locked out of spawn/send/stop as a misread worker.
-        Principal p = new CallerResolver(workerIdentity(), false, null, "term_a")
+        Principal p = CallerResolver.pinnedTo(workerIdentity(), false, null, "term_a")
                .resolve("127.0.0.1", 42, null);

        assertEquals(Role.PRIMARY, p.role());
@@ -56,7 +58,7 @@ class CallerResolverTest {

    @Test
    void aPinnedPrimaryTerminalNeedsNoTokenEvenInTokenMode() {
-        Principal p = new CallerResolver(workerIdentity(), true, "s3cret", "term_a")
+        Principal p = CallerResolver.pinnedTo(workerIdentity(), true, "s3cret", "term_a")
                .resolve("127.0.0.1", 42, null);

        assertEquals(Role.PRIMARY, p.role(),
@@ -65,7 +67,7 @@ class CallerResolverTest {

    @Test
    void otherPanesRemainWorkersWhenAPinIsSet() {
-        Principal p = new CallerResolver(workerIdentity(), false, null, "term_someone_else")
+        Principal p = CallerResolver.pinnedTo(workerIdentity(), false, null, "term_someone_else")
                .resolve("127.0.0.1", 42, null);

        assertEquals(Role.WORKER, p.role());
@@ -76,9 +78,9 @@ class CallerResolverTest {
    @Test
    void aBlankPinLeavesWorkerResolutionUntouched() {
        assertEquals(Role.WORKER,
-                new CallerResolver(workerIdentity(), false, null, "  ").resolve("127.0.0.1", 42, null).role());
+                CallerResolver.pinnedTo(workerIdentity(), false, null, "  ").resolve("127.0.0.1", 42, null).role());
        assertEquals(Role.WORKER,
-                new CallerResolver(workerIdentity(), false, null, null).resolve("127.0.0.1", 42, null).role());
+                CallerResolver.pinnedTo(workerIdentity(), false, null, null).resolve("127.0.0.1", 42, null).role());
    }

    @Test
@@ -133,6 +135,260 @@ class CallerResolverTest {
        assertEquals(Role.ANONYMOUS, p.role());
    }

+    // ── CB-530: the leaders registry ────────────────────────────────────────────────────────────
+    // The fake resolves exactly one pane (term_a) from a PID, so "two leads both resolve" is
+    // asserted at the config layer (BridgedConfigTest#leaderTerminals…). What matters here is that
+    // resolution is a REGISTRY LOOKUP rather than a single equality test against one pin.
+
+    @Test
+    void aRegisteredLeadPaneResolvesToPrimaryCarryingItsName() {
+        Principal p = new CallerResolver(workerIdentity(), false, null, Map.of("term_a", "opus-5.0"))
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.PRIMARY, p.role());
+        assertEquals("opus-5.0", p.name(), "whoami must be able to say WHICH lead is asking");
+        assertEquals("term_a", p.terminal(),
+                "CB-532: a lead carries the pane it was matched by. Without it ownsSession() can "
+                        + "never be true for a lead, so it can send to a peer but never answer one");
+    }
+
+    @Test
+    void aSecondLeadIsRecognisedRatherThanSilentlyDemoted() {
+        // The regression this feature exists for: with a singular pin, whichever lead was not the
+        // pin resolved as a worker and was refused every orchestration call.
+        Principal p = new CallerResolver(workerIdentity(), false, null,
+                Map.of("term_elsewhere", "gpt-sol-5.6", "term_a", "opus-5.0"))
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.PRIMARY, p.role());
+        assertEquals("opus-5.0", p.name());
+    }
+
+    @Test
+    void aPaneAbsentFromTheRegistryIsStillAWorker() {
+        Principal p = new CallerResolver(workerIdentity(), false, null,
+                Map.of("term_elsewhere", "gpt-sol-5.6"))
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.WORKER, p.role());
+        assertEquals("term_a", p.terminal());
+        assertNull(p.name());
+    }
+
+    @Test
+    void aRegisteredLeadNeedsNoTokenEvenInTokenMode() {
+        Principal p = new CallerResolver(workerIdentity(), true, "s3cret", Map.of("term_a", "opus"))
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.PRIMARY, p.role(),
+                "the pane mapping is as unforgeable as a worker's — it outranks the token path");
+        assertEquals("opus", p.name());
+    }
+
+    /** The pre-CB-530 spelling must keep working, exactly, including for configs that never migrate. */
+    @Test
+    void theLegacySinglePinBehavesAsALeadNamedPrimary() {
+        Principal p = CallerResolver.pinnedTo(workerIdentity(), false, null, "term_a")
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.PRIMARY, p.role());
+        assertEquals("primary", p.name());
+    }
+
+    @Test
+    void anEmptyRegistryLeavesEveryPaneAWorker() {
+        Map<String, String> noLeads = null;
+        assertEquals(Role.WORKER,
+                new CallerResolver(workerIdentity(), false, null, Map.of())
+                        .resolve("127.0.0.1", 42, null).role());
+        assertEquals(Role.WORKER,
+                new CallerResolver(workerIdentity(), false, null, noLeads)
+                        .resolve("127.0.0.1", 42, null).role());
+        // CB-531: and the same for the live-registry form, whose supplier may also be absent.
+        assertEquals(Role.WORKER,
+                CallerResolver.withLeads(workerIdentity(), false, null, null)
+                        .resolve("127.0.0.1", 42, null).role());
+    }
+
+    /** The audit line must distinguish leads once several exist, or a log says nothing useful. */
+    @Test
+    void describeNamesTheLeadButStillReadsPrimaryWhenUnnamed() {
+        assertEquals("leader:opus-5.0", Principal.leader("opus-5.0", "term_a", 1).describe());
+        assertEquals("primary", Principal.primary(1).describe());
+        assertEquals("worker:term_a", Principal.worker("term_a", 1).describe());
+    }
+
+    // ── CB-532: a lead is an addressable peer, not only a sender ────────────────────────────────
+
+    /**
+     * The regression this ticket exists for: two leads could both be recognised (CB-530/531) and
+     * still not converse, because REPLY is gated on ownsSession() and a lead owned nothing.
+     */
+    @Test
+    void aLeadOwnsItsOwnPaneSoItMayAnswerAPeer() {
+        Principal lead = new CallerResolver(workerIdentity(), false, null, Map.of("term_a", "opus-5.0"))
+                .resolve("127.0.0.1", 42, null);
+
+        assertTrue(lead.ownsSession("term_a"));
+        assertTrue(Authz.permits(lead, Authz.Action.REPLY, "term_a"),
+                "a lead answering a peer replies for its OWN terminal — the rendezvous the sender "
+                        + "opened is keyed on exactly that");
+        assertTrue(Authz.permits(lead, Authz.Action.ASK, "term_a"));
+    }
+
+    @Test
+    void aLeadStillCannotActAsAnyoneElse() {
+        Principal lead = new CallerResolver(workerIdentity(), false, null, Map.of("term_a", "opus-5.0"))
+                .resolve("127.0.0.1", 42, null);
+
+        assertFalse(lead.ownsSession("term_someone_else"));
+        assertFalse(Authz.permits(lead, Authz.Action.REPLY, "term_someone_else"),
+                "widening WHO may reply must not widen WHAT they may reply as");
+    }
+
+    /** A primary with no pane — token mode, or off-host — owns nothing and must stay a sender only. */
+    @Test
+    void anUnnamedPrimaryWithNoPaneOwnsNothing() {
+        Principal p = new CallerResolver(nonWorkerIdentity(), true, "s3cret")
+                .resolve("127.0.0.1", 99, "Bearer s3cret");
+
+        assertEquals(Role.PRIMARY, p.role());
+        assertNull(p.terminal());
+        assertFalse(p.ownsSession(null), "a null terminal must never match a null session id");
+        assertFalse(Authz.permits(p, Authz.Action.REPLY, null));
+    }
+
+    @Test
+    void aLeadKeepsEveryOrchestrationRightItAlreadyHad() {
+        Principal lead = new CallerResolver(workerIdentity(), false, null, Map.of("term_a", "opus-5.0"))
+                .resolve("127.0.0.1", 42, null);
+
+        assertTrue(Authz.permits(lead, Authz.Action.SPAWN, null));
+        assertTrue(Authz.permits(lead, Authz.Action.SEND, "term_worker"));
+        assertTrue(Authz.permits(lead, Authz.Action.STOP, null));
+        assertTrue(Authz.permits(lead, Authz.Action.DRAIN, null));
+    }
+
+    /**
+     * CB-531: the registry is read per resolve, not snapshotted at construction — a lead that
+     * labels its tab after the daemon booted is recognised without a restart.
+     */
+    @Test
+    void aLeadRegisteredAfterConstructionIsHonouredWithoutRebuildingTheResolver() {
+        Map<String, String> live = new java.util.HashMap<>();
+        CallerResolver r = CallerResolver.withLeads(workerIdentity(), false, null, () -> live);
+
+        assertEquals(Role.WORKER, r.resolve("127.0.0.1", 42, null).role());
+
+        live.put("term_a", "gpt-sol-5.6"); // the scanner sees a newly-labelled tab
+
+        Principal p = r.resolve("127.0.0.1", 42, null);
+        assertEquals(Role.PRIMARY, p.role());
+        assertEquals("gpt-sol-5.6", p.name());
+    }
+
+    /** The map form must stay a snapshot: a caller handing over a map is not offering live state. */
+    @Test
+    void theMapFormIsCopiedSoLaterMutationCannotGrantLeadership() {
+        Map<String, String> mutable = new java.util.HashMap<>();
+        CallerResolver r = new CallerResolver(workerIdentity(), false, null, mutable);
+
+        mutable.put("term_a", "sneaky");
+
+        assertEquals(Role.WORKER, r.resolve("127.0.0.1", 42, null).role());
+    }
+
+    // ── CB-548: architect slots ─────────────────────────────────────────────────────────────────
+
+    @Test
+    void aBoundArchitectPaneResolvesToArchitectBeforeTheWorkerFallback() {
+        Principal p = CallerResolver.withLeadsAndArchitects(workerIdentity(), false, null,
+                Map::of, () -> Map.of("term_a", "lead-designer"))
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.ARCHITECT, p.role(),
+                "a terminal bound to an architect slot is an architect, NOT the generic worker it "
+                        + "would otherwise resolve to");
+        assertEquals("lead-designer", p.name(), "whoami must say WHICH slot is asking");
+        assertEquals("term_a", p.terminal(), "the pane identity is carried so ownsSession works");
+    }
+
+    @Test
+    void anArchitectNeedsNoTokenEvenInTokenMode() {
+        Principal p = CallerResolver.withLeadsAndArchitects(workerIdentity(), true, "s3cret",
+                Map::of, () -> Map.of("term_a", "lead-designer"))
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.ARCHITECT, p.role(),
+                "the pane mapping is as unforgeable as a worker's — it outranks the token path");
+    }
+
+    @Test
+    void anUnboundPaneStillResolvesAsAWorker() {
+        Map<String, String> arch = Map.of("term_elsewhere", "reviewer");
+        Principal p = CallerResolver.withLeadsAndArchitects(workerIdentity(), false, null,
+                Map::of, () -> arch).resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.WORKER, p.role());
+        assertNull(p.name());
+    }
+
+    /** CB-548 precedence: lead > architect > worker, so a pane named in BOTH is still a lead. */
+    @Test
+    void aLeadWinsOverAnArchitectBindingForTheSamePane() {
+        Principal p = CallerResolver.withLeadsAndArchitects(workerIdentity(), false, null,
+                () -> Map.of("term_a", "opus-5.0"), () -> Map.of("term_a", "lead-designer"))
+                .resolve("127.0.0.1", 42, null);
+
+        assertEquals(Role.PRIMARY, p.role(),
+                "a pane the config calls a lead must keep resolving as a lead — no behaviour change "
+                        + "when an architect binding is added to an existing fleet");
+        assertEquals("opus-5.0", p.name());
+    }
+
+    /** The registry is live, like leads: a binding injected after construction is honoured. */
+    @Test
+    void anArchitectBoundAfterConstructionIsHonouredWithoutRebuildingTheResolver() {
+        Map<String, String> live = new java.util.HashMap<>();
+        CallerResolver r = CallerResolver.withLeadsAndArchitects(workerIdentity(), false, null,
+                Map::of, () -> live);
+
+        assertEquals(Role.WORKER, r.resolve("127.0.0.1", 42, null).role());
+
+        live.put("term_a", "lead-designer"); // the later lifecycle binds the slot
+
+        assertEquals(Role.ARCHITECT, r.resolve("127.0.0.1", 42, null).role());
+        assertEquals("lead-designer", r.architects().get("term_a"));
+    }
+
+    @Test
+    void theArchitectMapFormIsCopiedSoLaterMutationCannotGrantArchitect() {
+        Map<String, String> mutable = new java.util.LinkedHashMap<>();
+        CallerResolver r = new CallerResolver(workerIdentity(), false, null, Map.of(), mutable);
+
+        mutable.put("term_a", "sneaky");
+
+        assertEquals(Role.WORKER, r.resolve("127.0.0.1", 42, null).role());
+    }
+
+    @Test
+    void describeNamesTheArchitectSlot() {
+        assertEquals("architect:lead-designer",
+                Principal.architect("lead-designer", "term_a", 1).describe());
+    }
+
+    /** An architect acts only as its own pane — the same ownsSession rule as a worker or lead. */
+    @Test
+    void anArchitectOwnsItsOwnPaneAndNoOther() {
+        Principal arch = CallerResolver.withLeadsAndArchitects(workerIdentity(), false, null,
+                Map::of, () -> Map.of("term_a", "lead-designer")).resolve("127.0.0.1", 42, null);
+
+        assertTrue(arch.ownsSession("term_a"));
+        assertTrue(Authz.permits(arch, Authz.Action.REPLY, "term_a"));
+        assertFalse(arch.ownsSession("term_b"));
+        assertFalse(Authz.permits(arch, Authz.Action.REPLY, "term_b"));
+    }
+
    @Test
    void tokenModeRequiresANonEmptyConfiguredToken() {
        ConnectionIdentity id = nonWorkerIdentity();
@@ -1,10 +1,13 @@
 package dev.ltms.bridged.config;

+import dev.ltms.bridged.auth.ArchitectRegistry;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;

 import java.nio.file.Files;
 import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
 import java.util.Set;

 import static org.junit.jupiter.api.Assertions.*;
@@ -45,6 +48,7 @@ class BridgedConfigTest {
        assertEquals(9000, cfg.bind().port());
        assertNotNull(cfg.guard(), "guard must default to empty, never null");
        assertTrue(cfg.guard().offSubscriptionHosts().isEmpty());
+        assertFalse(cfg.lifecycle().clearAfterTurn(), "context clearing is opt-in");
    }

    @Test
@@ -96,6 +100,485 @@ class BridgedConfigTest {
        assertDoesNotThrow(() -> BridgedConfig.load(f));
    }

+    /**
+     * CB-530. Unknown keys stay ignored — config must be allowed to run ahead of the code — but they
+     * must be NAMED at load. A whole block that parses, is dropped, and is never mentioned again is
+     * indistinguishable from one that works: that is exactly how a hand-written `leaders:` registry
+     * came to look configured while being inert.
+     */
+    @Test
+    void unknownTopLevelKeysAreNamedSoADroppedBlockCannotLookLikeAWorkingOne() {
+        assertEquals(List.of("futureFeature", "leedars"),
+                BridgedConfig.unknownTopLevelKeys(
+                        "bind:\n  port: 8080\nleedars:\n  a: b\nfutureFeature: true\n"),
+                "a typo'd key is the common case and must be reported by name");
+    }
+
+    @Test
+    void everyKeyThisBuildUnderstandsIsAbsentFromTheUnknownList() {
+        assertTrue(BridgedConfig.unknownTopLevelKeys("""
+                bind:
+                  port: 8080
+                herdrSocket: /tmp/s
+                workers: {}
+                defaultWorker: a
+                guard: {}
+                worktreeRoot: /tmp
+                lifecycle: {}
+                spawnReadyTimeoutMs: 1
+                spawnReadyPollMs: 1
+                broker: {}
+                primary: {}
+                leaders: {}
+                architects: {}
+                leadScan: {}
+                placement: fixed
+                auth: {}
+                """).isEmpty(), "the known-key set must not drift from the record components");
+    }
+
+    @Test
+    void aMalformedOrEmptyDocumentIsNotReportedAsUnknownKeys() {
+        assertTrue(BridgedConfig.unknownTopLevelKeys("").isEmpty());
+        assertTrue(BridgedConfig.unknownTopLevelKeys("just a scalar").isEmpty());
+    }
+
+    // ── CB-531: lead discovery by tab label ─────────────────────────────────────────────────────
+
+    @Test
+    void leadScanIsOffUnlessTheBlockIsPresent(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("no-scan.yaml");
+        Files.writeString(f, "bind:\n  port: 8080\n");
+
+        assertNull(BridgedConfig.load(f).leadScan(),
+                "turning this on widens who resolves as PRIMARY — upgrading the daemon must not do that");
+    }
+
+    @Test
+    void leadScanDefaultsItsFieldsWhenTheBlockIsPresentButBare(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("bare-scan.yaml");
+        Files.writeString(f, "bind:\n  port: 8080\nleadScan: {}\n");
+
+        BridgedConfig.LeadScan scan = BridgedConfig.load(f).leadScan();
+        assertEquals("lead:", scan.tabPrefix());
+        assertEquals(10, scan.intervalSeconds());
+    }
+
+    @Test
+    void leadScanReadsAnExplicitPrefixAndInterval(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("scan.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                leadScan:
+                  tabPrefix: "drive:"
+                  intervalSeconds: 30
+                """);
+
+        BridgedConfig.LeadScan scan = BridgedConfig.load(f).leadScan();
+        assertEquals("drive:", scan.tabPrefix());
+        assertEquals(30, scan.intervalSeconds());
+    }
+
+    /**
+     * The hazard the guard exists for: bridged writes worker tab labels and reads lead tab labels.
+     * Overlap the two and every worker it spawns is read back as a lead.
+     */
+    @Test
+    void aLeadPrefixThatAWorkerTabLabelAlsoMatchesRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("collide.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                workers:
+                  gx10:
+                    tabLabel: "lead: {profile} #{n}"
+                leadScan:
+                  tabPrefix: "lead:"
+                """);
+        BridgedConfig cfg = BridgedConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateLeadScan);
+        assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
+    }
+
+    @Test
+    void theDefaultWorkerTabLabelDoesNotCollideWithTheDefaultLeadPrefix(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("ok.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                workers:
+                  gx10:
+                    baseUrl: http://gx00.gw:8000
+                leadScan: {}
+                """);
+
+        assertDoesNotThrow(() -> BridgedConfig.load(f).validateLeadScan());
+    }
+
+    @Test
+    void theCollisionGuardIsANoOpWhenScanningIsOff(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("off.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                workers:
+                  gx10:
+                    tabLabel: "lead: {profile}"
+                """);
+
+        assertDoesNotThrow(() -> BridgedConfig.load(f).validateLeadScan(),
+                "a label that collides with a convention nobody reads is not a problem");
+    }
+
+    // ── CB-530: the leaders registry ────────────────────────────────────────────────────────────
+
+    @Test
+    void leadersBlockRegistersEveryPaneByName(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("leaders.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                leaders:
+                  opus-5.0:
+                    terminal: term_opus
+                    kind: claude
+                  gpt-sol-5.6:
+                    terminal: term_sol
+                    kind: opencode
+                    model: openai/gpt-5.6-terra
+                """);
+
+        BridgedConfig cfg = BridgedConfig.load(f);
+
+        assertEquals(Set.of("opus-5.0", "gpt-sol-5.6"), cfg.leaders().keySet());
+        assertEquals("opencode", cfg.leaders().get("gpt-sol-5.6").kind());
+        assertEquals("openai/gpt-5.6-terra", cfg.leaders().get("gpt-sol-5.6").model());
+        // The whole point: BOTH panes resolve as leads, so neither is demoted to worker.
+        assertEquals(Map.of("term_opus", "opus-5.0", "term_sol", "gpt-sol-5.6"),
+                cfg.leaderTerminals());
+    }
+
+    @Test
+    void aLegacyPrimaryPinAloneStillRegistersAsALeadNamedPrimary(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("legacy-pin.yaml");
+        Files.writeString(f, "bind:\n  port: 8080\nprimary:\n  terminal: term_fixed\n");
+
+        assertEquals(Map.of("term_fixed", "primary"), BridgedConfig.load(f).leaderTerminals(),
+                "configs that never migrate must behave exactly as they did before CB-530");
+    }
+
+    @Test
+    void anExplicitLeadersEntryWinsOverThePinForTheSameTerminal(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("both.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                primary:
+                  terminal: term_shared
+                leaders:
+                  opus-5.0:
+                    terminal: term_shared
+                """);
+
+        assertEquals(Map.of("term_shared", "opus-5.0"), BridgedConfig.load(f).leaderTerminals(),
+                "the pin is the older spelling of the same fact; the named entry is what was meant");
+    }
+
+    @Test
+    void bothBlocksTogetherRegisterTheUnionOfTheirTerminals(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("union.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                primary:
+                  terminal: term_pinned
+                leaders:
+                  gpt-sol-5.6:
+                    terminal: term_sol
+                """);
+
+        assertEquals(Map.of("term_pinned", "primary", "term_sol", "gpt-sol-5.6"),
+                BridgedConfig.load(f).leaderTerminals());
+    }
+
+    @Test
+    void neitherBlockLeavesNothingRegistered(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("none.yaml");
+        Files.writeString(f, "bind:\n  port: 8080\n");
+
+        assertTrue(BridgedConfig.load(f).leaderTerminals().isEmpty());
+    }
+
+    /** A lead entry with no terminal identifies nothing — it must not register a null key. */
+    @Test
+    void aLeadWithoutATerminalIsNotRegistered(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("no-terminal.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                leaders:
+                  sketch:
+                    kind: opencode
+                  real:
+                    terminal: term_real
+                """);
+
+        assertEquals(Map.of("term_real", "real"), BridgedConfig.load(f).leaderTerminals());
+    }
+
+    // ── CB-548: the architects registry ────────────────────────────────────────────────────────
+
+    @Test
+    void architectsBlockDeclaresSlotsByNameAndProfileOnly(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("architects.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                workers:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                architects:
+                  lead-designer:
+                    profile: sonnet
+                  reviewer:
+                    profile: sonnet
+                """);
+
+        BridgedConfig cfg = BridgedConfig.load(f);
+        assertEquals(Set.of("lead-designer", "reviewer"), cfg.architects().keySet(),
+                "slot names are the keys — gateway-local unique by construction");
+        assertEquals("sonnet", cfg.architects().get("lead-designer").profile(),
+                "each slot carries its strong-model profile reference");
+        assertEquals("sonnet", cfg.architects().get("reviewer").profile());
+    }
+
+    @Test
+    void anArchitectCarriesNoConfigTerminalSoNothingIsRecognisedYet(@TempDir Path dir) throws Exception {
+        // The corrected CB-548 premise: config declares slots (name + profile) only. A `terminal:`
+        // key left over from the earlier premise is ignored — an architect is NOT recognised from
+        // config the way a lead is, so it binds nothing at startup and resolves no architect.
+        Path f = dir.resolve("arch-stale-terminal.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                workers:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                architects:
+                  lead-designer:
+                    terminal: term_design
+                    profile: sonnet
+                """);
+        BridgedConfig cfg = BridgedConfig.load(f);
+        assertEquals("sonnet", cfg.architects().get("lead-designer").profile(),
+                "the profile is still read even when a stray terminal is ignored");
+
+        // The registry built from this config owns no bindings: the slot is idle at startup.
+        ArchitectRegistry r = new ArchitectRegistry(cfg.architects());
+        assertTrue(r.snapshot().isEmpty());
+        assertNull(r.slotForTerminal("term_design"),
+                "a config terminal must not resolve an architect — slots start idle");
+    }
+
+    @Test
+    void noArchitectsBlockLeavesNothingConfigured(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("no-arch.yaml");
+        Files.writeString(f, "bind:\n  port: 8080\n");
+
+        assertNull(BridgedConfig.load(f).architects(),
+                "no architects: block ⇒ no architect identity, exactly as before CB-548");
+    }
+
+    @Test
+    void anArchitectSlotMayResolveToTheSoleProfileWithoutPrivileging(@TempDir Path dir) throws Exception {
+        // Even a single unqualified worker profile can back an architect slot — the reference is
+        // by name, not by position, so an explicit name is required.
+        Path f = dir.resolve("arch-single.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                worker:
+                  profile: ltms-local
+                  baseUrl: http://gx10.gw:8000
+                architects:
+                  lead-designer:
+                    profile: ltms-local
+                """);
+
+        BridgedConfig cfg = BridgedConfig.load(f);
+        assertDoesNotThrow(cfg::validateArchitects);
+        assertEquals("ltms-local", cfg.architects().get("lead-designer").profile());
+    }
+
+    @Test
+    void anArchitectProfileThatIsNotConfiguredRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("arch-bad-profile.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                workers:
+                  gx10:
+                    baseUrl: http://gx10.gw:8000
+                architects:
+                  lead-designer:
+                    profile: sonnet
+                """);
+        BridgedConfig cfg = BridgedConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateArchitects);
+        assertTrue(e.getMessage().contains("lead-designer"), "the refusal names the slot");
+        assertTrue(e.getMessage().contains("sonnet"), "the refusal names the offending profile");
+    }
+
+    @Test
+    void anArchitectSlotMissingAProfileRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("arch-no-profile.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                workers:
+                  gx10:
+                    baseUrl: http://gx10.gw:8000
+                architects:
+                  lead-designer:
+                    profile: ""
+                """);
+        BridgedConfig cfg = BridgedConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateArchitects);
+        assertTrue(e.getMessage().contains("lead-designer"), "the refusal names the slot");
+    }
+
+    @Test
+    void aValidArchitectRegistryPassesValidation(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("arch-ok.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                workers:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                  gx10:
+                    baseUrl: http://gx10.gw:8000
+                architects:
+                  lead-designer:
+                    profile: sonnet
+                  reviewer:
+                    profile: gx10
+                """);
+
+        assertDoesNotThrow(() -> BridgedConfig.load(f).validateArchitects());
+    }
+
+    @Test
+    void absentArchitectsBlockPassesValidation(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("no-arch.yaml");
+        Files.writeString(f, "bind:\n  port: 8080\n");
+
+        assertDoesNotThrow(() -> BridgedConfig.load(f).validateArchitects());
+    }
+
+    @Test
+    void duplicateArchitectSlotNamesAreRejectedAtParseTime(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("arch-dup.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                workers:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                architects:
+                  lead-designer:
+                    profile: sonnet
+                  lead-designer:
+                    profile: sonnet
+                """);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, () -> BridgedConfig.load(f));
+        assertTrue(e.getMessage().contains("lead-designer"),
+                "the refusal names the duplicated slot, was: " + e.getMessage());
+        assertTrue(e.getMessage().contains("duplicate architect"),
+                "the refusal says the slot name is duplicated");
+    }
+
+    @Test
+    void duplicateKeysOutsideArchitectsAreUnaffected(@TempDir Path dir) throws Exception {
+        // The duplicate check is scoped to the architects block — a duplicate elsewhere is not this
+        // guard's concern and must not change parsing of the rest of the config.
+        Path f = dir.resolve("dup-other.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                workers:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                """);
+        // Last-wins for a non-architect duplicate is untouched: only the architects block is walked.
+        assertEquals(Set.of("sonnet"), BridgedConfig.load(f).workerProfiles().keySet());
+    }
+
+    @Test
+    void aNestedArchitectsFieldDoesNotSuppressRealDuplicateDetection(@TempDir Path dir) throws Exception {
+        // A field ALSO named `architects` nested under another block carries its own duplicate and
+        // sits BEFORE the real top-level block. Only the top-level block is ever inspected: the
+        // refusal must name the real slot (lead-designer), not the nested one (nested-slot).
+        Path f = dir.resolve("nested-arch.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                  architects:
+                    nested-slot:
+                      k: v
+                    nested-slot:
+                      k: v
+                architects:
+                  lead-designer:
+                    profile: sonnet
+                  lead-designer:
+                    profile: sonnet
+                """);
+
+        IllegalStateException e =
+                assertThrows(IllegalStateException.class, () -> BridgedConfig.load(f));
+        assertTrue(e.getMessage().contains("lead-designer"),
+                "the real top-level duplicate must be reported, was: " + e.getMessage());
+        assertTrue(e.getMessage().contains("duplicate architect"),
+                "the refusal says the slot name is duplicated");
+    }
+
+    @Test
+    void nestedDuplicateFieldsInsideASlotAreNotDuplicateSlotNames(@TempDir Path dir) throws Exception {
+        // A duplicated field nested inside one slot's own value (here inside an ignored `extra:`
+        // sub-block) is not a duplicate SLOT name — it must not be rejected as one. Only the direct
+        // child keys of the architects mapping are slot names; whatever is deeper is the slot's
+        // business and must not masquerade as a duplicate slot.
+        Path f = dir.resolve("nested-dup-inside-slot.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                workers:
+                  sonnet:
+                    baseUrl: http://gx10.gw:8000
+                architects:
+                  lead-designer:
+                    profile: sonnet
+                    extra:
+                      a: 1
+                      a: 1
+                """);
+
+        BridgedConfig cfg = assertDoesNotThrow(() -> BridgedConfig.load(f));
+        assertDoesNotThrow(cfg::validateArchitects,
+                "a nested duplicate inside a slot is not a duplicate slot and must not refuse startup");
+        assertEquals(Set.of("lead-designer"), cfg.architects().keySet());
+        assertEquals("sonnet", cfg.architects().get("lead-designer").profile());
+    }
+
    @Test
    void absentBrokerBlockLeavesInboxSoftState(@TempDir Path dir) throws Exception {
        Path f = dir.resolve("no-broker.yaml");
@@ -345,6 +828,7 @@ class BridgedConfigTest {
                  idleTtlSeconds: 300
                  contextCap: 10
                  drainTimeoutSeconds: 5
+                  clearAfterTurn: true
                broker:
                  uri: amqp://guest:guest@127.0.0.1:5672
                primary:
@@ -371,6 +855,7 @@ class BridgedConfigTest {
        assertEquals(300, cfg.lifecycle().idleTtlSeconds());
        assertEquals(10, cfg.lifecycle().contextCap());
        assertEquals(5, cfg.lifecycle().drainTimeoutSeconds());
+        assertTrue(cfg.lifecycle().clearAfterTurn());
        assertEquals("amqp://guest:guest@127.0.0.1:5672", cfg.broker().uri());
        assertEquals("term_abc123", cfg.primary().terminal());
        assertEquals(5, cfg.primary().remindersOrDefault());
@@ -408,4 +893,100 @@ class BridgedConfigTest {
        assertEquals(1.0f, w.weight(), 0.0001f, "absent weight defaults to 1.0");
        assertNull(w.maxLoad(), "absent maxLoad defaults to unlimited (null)");
    }
+
+    @Test
+    void subscriptionFlagBindsAndDefaultsFalse(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("subscription.yaml");
+        Files.writeString(f, """
+                workers:
+                  sonnet:
+                    subscription: true
+                    argv: ["ccs", "sonnet"]
+                  opted:
+                    baseUrl: http://gx10.gw:8000
+                """);
+
+        BridgedConfig cfg = BridgedConfig.load(f);
+        assertTrue(cfg.workerProfiles().get("sonnet").isSubscription(),
+                "subscription: true binds as an explicit opt-in");
+        assertFalse(cfg.workerProfiles().get("opted").isSubscription(),
+                "a profile without the key stays off-subscription (the default)");
+    }
+
+    // ── CB-542: subscription:true must not smuggle an unguarded endpoint via env: ───────────────
+
+    @Test
+    void aSubscriptionProfileWithAnthropicBaseUrlInEnvIsRejected(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("baseUrl.yaml");
+        Files.writeString(f, """
+                workers:
+                  sonnet:
+                    subscription: true
+                    argv: ["ccs", "sonnet"]
+                    env:
+                      ANTHROPIC_BASE_URL: http://anything-not-on-the-allowlist
+                """);
+        BridgedConfig cfg = BridgedConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class,
+                cfg::validateSubscriptionProfiles);
+        assertTrue(e.getMessage().contains("sonnet"), "the refusal names the offending profile");
+        assertTrue(e.getMessage().contains("ANTHROPIC_BASE_URL"),
+                "the refusal names the offending key: " + e.getMessage());
+    }
+
+    @Test
+    void aSubscriptionProfileWithAnthropicAuthTokenInEnvIsRejected(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("authToken.yaml");
+        Files.writeString(f, """
+                workers:
+                  sonnet:
+                    subscription: true
+                    argv: ["ccs", "sonnet"]
+                    env:
+                      ANTHROPIC_AUTH_TOKEN: sk-ant-not-on-any-allowlist
+                """);
+        BridgedConfig cfg = BridgedConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class,
+                cfg::validateSubscriptionProfiles);
+        assertTrue(e.getMessage().contains("sonnet"), "the refusal names the offending profile");
+        assertTrue(e.getMessage().contains("ANTHROPIC_AUTH_TOKEN"),
+                "the refusal names the offending key: " + e.getMessage());
+    }
+
+    @Test
+    void aSubscriptionProfileWithACleanEnvPassesValidation(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("clean.yaml");
+        Files.writeString(f, """
+                workers:
+                  sonnet:
+                    subscription: true
+                    argv: ["ccs", "sonnet"]
+                    env:
+                      JAVA_HOME: /opt/jdk
+                """);
+        BridgedConfig cfg = BridgedConfig.load(f);
+
+        assertDoesNotThrow(cfg::validateSubscriptionProfiles,
+                "a subscription profile may carry env: — just not the Anthropic binding keys");
+    }
+
+    @Test
+    void aNonSubscriptionProfileMayCarryAnthropicEnvKeys(@TempDir Path dir) throws Exception {
+        // The override is only dangerous on the subscription path, where no guard could vet it. A
+        // plain profile's env: is still overwritten by the launcher's guard-checked value (CB-511).
+        Path f = dir.resolve("nonsub.yaml");
+        Files.writeString(f, """
+                workers:
+                  gx10:
+                    baseUrl: http://gx10.gw:8000
+                    env:
+                      ANTHROPIC_BASE_URL: http://something
+                """);
+        BridgedConfig cfg = BridgedConfig.load(f);
+
+        assertDoesNotThrow(cfg::validateSubscriptionProfiles,
+                "only subscription:true profiles are checked — off-subscription ones keep the baseUrl guard");
+    }
 }
@@ -0,0 +1,262 @@
+package dev.ltms.bridged.herdr;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.junit.jupiter.api.Test;
+
+import java.util.ArrayList;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicLong;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * CB-531. A lead is never spawned, so the daemon has to <em>find</em> it: these assert that an
+ * operator-labelled tab is what makes a pane a lead, and — just as importantly — what does not.
+ */
+class LeadTabScannerTest {
+
+    private static final ObjectMapper MAPPER = new ObjectMapper();
+    private static final long TTL = TimeUnit.SECONDS.toNanos(10);
+
+    /**
+     * A herdr whose workspace/tab/pane topology is declared per test. Counts calls so the caching
+     * contract can be asserted, and can be made to fail on demand.
+     */
+    private static final class TopologyHerdr implements HerdrClient {
+        /** workspace_id → label. */
+        final Map<String, String> workspaces = new LinkedHashMap<>();
+        /** tab_id → [workspace_id, label]. */
+        final Map<String, String[]> tabs = new LinkedHashMap<>();
+        /** pane_id → [tab_id, terminal_id]. */
+        final Map<String, String[]> panes = new LinkedHashMap<>();
+        int calls;
+        boolean failing;
+
+        TopologyHerdr workspace(String id, String label) {
+            workspaces.put(id, label);
+            return this;
+        }
+
+        TopologyHerdr tab(String tabId, String workspaceId, String label) {
+            tabs.put(tabId, new String[]{workspaceId, label});
+            return this;
+        }
+
+        TopologyHerdr pane(String paneId, String tabId, String terminalId) {
+            panes.put(paneId, new String[]{tabId, terminalId});
+            return this;
+        }
+
+        @Override
+        public JsonNode call(String method, Object params) {
+            calls++;
+            if (failing) {
+                throw new HerdrException("socket closed");
+            }
+            List<String> items = new ArrayList<>();
+            switch (method) {
+                case "workspace.list" -> {
+                    workspaces.forEach((id, label) -> items.add(
+                            "{\"workspace_id\":\"%s\",\"label\":\"%s\"}".formatted(id, label)));
+                    return read("{\"workspaces\":[%s]}".formatted(String.join(",", items)));
+                }
+                case "tab.list" -> {
+                    String ws = String.valueOf(((Map<?, ?>) params).get("workspace_id"));
+                    tabs.forEach((id, t) -> {
+                        if (ws.equals(t[0])) {
+                            items.add(("{\"tab_id\":\"%s\",\"workspace_id\":\"%s\",\"label\":%s,"
+                                    + "\"pane_count\":1}").formatted(id, t[0],
+                                    t[1] == null ? "null" : "\"" + t[1] + "\""));
+                        }
+                    });
+                    return read("{\"tabs\":[%s]}".formatted(String.join(",", items)));
+                }
+                case "pane.list" -> {
+                    panes.forEach((id, p) -> items.add(
+                            "{\"pane_id\":\"%s\",\"tab_id\":\"%s\",\"terminal_id\":\"%s\"}"
+                                    .formatted(id, p[0], p[1])));
+                    return read("{\"panes\":[%s]}".formatted(String.join(",", items)));
+                }
+                default -> throw new AssertionError("unexpected herdr call: " + method);
+            }
+        }
+
+        private static JsonNode read(String json) {
+            try {
+                return MAPPER.readTree(json);
+            } catch (Exception e) {
+                throw new AssertionError(e);
+            }
+        }
+
+        @Override
+        public void close() {
+        }
+    }
+
+    /**
+     * The usual shape: one user space with lead tabs, one worker space bridged owns.
+     *
+     * <p>Not closed: {@code close()} is a no-op on this fake, and every test needs the handle after
+     * the scanner is built (to mutate the topology or read {@code calls}).
+     */
+    @SuppressWarnings("resource")
+    private TopologyHerdr twoLeads() {
+        return new TopologyHerdr()
+                .workspace("w1", "main")
+                .workspace("w9", "bridged-workers")
+                .tab("w1:t1", "w1", "lead: opus-5.0")
+                .tab("w1:t2", "w1", "lead: gpt-sol-5.6")
+                .tab("w1:t3", "w1", "notes")
+                .tab("w9:t1", "w9", "worker: gx10 #1")
+                .pane("w1:p1", "w1:t1", "term_opus")
+                .pane("w1:p2", "w1:t2", "term_gpt")
+                .pane("w1:p3", "w1:t3", "term_notes")
+                .pane("w9:p1", "w9:t1", "term_worker");
+    }
+
+    private LeadTabScanner scanner(TopologyHerdr herdr, Map<String, String> configured,
+                                   AtomicLong clock) {
+        return new LeadTabScanner(herdr, "lead:", Set.of("bridged-workers"), configured, TTL,
+                clock::get);
+    }
+
+    @Test
+    void everyLabelledTabBecomesALeadNamedByItsLabel() {
+        Map<String, String> leads = scanner(twoLeads(), Map.of(), new AtomicLong()).get();
+
+        assertEquals(Map.of("term_opus", "opus-5.0", "term_gpt", "gpt-sol-5.6"), leads,
+                "two leads discovered from labels alone — no terminal_id was ever configured");
+    }
+
+    @Test
+    void anUnlabelledTabContributesNothing() {
+        assertFalse(scanner(twoLeads(), Map.of(), new AtomicLong()).get().containsKey("term_notes"));
+    }
+
+    /**
+     * The guard that matters: bridged labels its own worker tabs, so if a worker space were scanned
+     * a naming accident would promote the fleet. The exclusion is by workspace, not by hoping the
+     * worker template never collides.
+     */
+    @Test
+    void aTabInAWorkerSpaceIsNeverALeadEvenWhenItsLabelMatches() {
+        TopologyHerdr herdr = twoLeads().tab("w9:t2", "w9", "lead: impostor")
+                .pane("w9:p2", "w9:t2", "term_impostor");
+
+        assertFalse(scanner(herdr, Map.of(), new AtomicLong()).get().containsKey("term_impostor"));
+    }
+
+    @Test
+    void aBarePrefixNamesNobodyAndIsRejected() {
+        TopologyHerdr herdr = new TopologyHerdr().workspace("w1", "main")
+                .tab("w1:t1", "w1", "lead:").pane("w1:p1", "w1:t1", "term_a");
+
+        assertEquals(Map.of(), scanner(herdr, Map.of(), new AtomicLong()).get(),
+                "a lead with no name would resolve as PRIMARY with nothing to attribute it to");
+    }
+
+    @Test
+    void thePrefixMatchesCaseInsensitivelyAndTheNameIsTrimmed() {
+        TopologyHerdr herdr = new TopologyHerdr().workspace("w1", "main")
+                .tab("w1:t1", "w1", "  LEAD:   opus-5.0  ").pane("w1:p1", "w1:t1", "term_a");
+
+        assertEquals(Map.of("term_a", "opus-5.0"), scanner(herdr, Map.of(), new AtomicLong()).get());
+    }
+
+    @Test
+    void everyPaneInALeadTabResolvesAsThatLead() {
+        // A human may split their own lead tab. Both panes are theirs, so both are that lead —
+        // nothing bridged placed can land here (see the worker-space test above).
+        TopologyHerdr herdr = twoLeads().pane("w1:p1b", "w1:t1", "term_opus_split");
+
+        assertEquals("opus-5.0", scanner(herdr, Map.of(), new AtomicLong()).get().get("term_opus_split"));
+    }
+
+    @Test
+    void anExplicitlyConfiguredLeadIsMergedInAndOutranksALabel() {
+        Map<String, String> configured = Map.of("term_opus", "pinned-name", "term_extra", "from-config");
+
+        Map<String, String> leads = scanner(twoLeads(), configured, new AtomicLong()).get();
+
+        assertEquals("pinned-name", leads.get("term_opus"), "an explicit pin is the operator's last word");
+        assertEquals("from-config", leads.get("term_extra"), "a configured lead needs no tab at all");
+        assertEquals("gpt-sol-5.6", leads.get("term_gpt"));
+    }
+
+    // ── caching ─────────────────────────────────────────────────────────────────────────────────
+
+    @Test
+    void aSecondLookupWithinTheTtlDoesNotTouchHerdr() {
+        TopologyHerdr herdr = twoLeads();
+        AtomicLong clock = new AtomicLong();
+        LeadTabScanner s = scanner(herdr, Map.of(), clock);
+
+        s.get();
+        int afterFirst = herdr.calls;
+        clock.addAndGet(TTL - 1);
+        s.get();
+
+        assertEquals(afterFirst, herdr.calls,
+                "resolve() runs on every request — an un-cached scan would put herdr on that path");
+    }
+
+    @Test
+    void aTabLabelledAfterStartupIsPickedUpOnceTheTtlExpires() {
+        TopologyHerdr herdr = twoLeads();
+        AtomicLong clock = new AtomicLong();
+        LeadTabScanner s = scanner(herdr, Map.of(), clock);
+        assertFalse(s.get().containsKey("term_notes"));
+
+        herdr.tab("w1:t3", "w1", "lead: late-arrival"); // the operator renames their tab
+        clock.addAndGet(TTL);
+
+        assertEquals("late-arrival", s.get().get("term_notes"),
+                "the whole point over `leaders:`: no config edit, no restart");
+    }
+
+    @Test
+    void aFailedScanKeepsTheLeadsAlreadyKnownRatherThanDemotingThem() {
+        TopologyHerdr herdr = twoLeads();
+        AtomicLong clock = new AtomicLong();
+        LeadTabScanner s = scanner(herdr, Map.of(), clock);
+        Map<String, String> before = s.get();
+
+        herdr.failing = true;
+        clock.addAndGet(TTL);
+
+        assertEquals(before, s.get(),
+                "a herdr hiccup must not silently demote a live lead to a worker mid-session");
+    }
+
+    @Test
+    void aFailedFirstScanStillHonoursTheConfiguredLeads() {
+        TopologyHerdr herdr = twoLeads();
+        herdr.failing = true;
+
+        Map<String, String> leads = scanner(herdr, Map.of("term_x", "opus-5.0"), new AtomicLong()).get();
+
+        assertEquals(Map.of("term_x", "opus-5.0"), leads,
+                "config-named leads must not depend on herdr answering at all");
+    }
+
+    @Test
+    void aDownHerdrIsRetriedOncePerTtlNotOncePerRequest() {
+        TopologyHerdr herdr = twoLeads();
+        herdr.failing = true;
+        AtomicLong clock = new AtomicLong();
+        LeadTabScanner s = scanner(herdr, Map.of(), clock);
+
+        s.get();
+        int afterFirst = herdr.calls;
+        s.get();
+        s.get();
+
+        assertEquals(afterFirst, herdr.calls, "the failure path must be rate-limited too");
+    }
+}
@@ -156,6 +156,21 @@ class CompletionResolverTest {
        assertEquals("No, 391 = 17 × 23.", waiter.getNow(null).text());
    }

+    @Test
+    void resolvesSynchronouslyBeforePostTurnContextClearing() {
+        FakeHerdr herdr = new FakeHerdr().readText("⏺ previous answer\n❯ ");
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
+        var waiter = rendezvous.open("term_a");
+        resolver.captureBaseline("term_a");
+        herdr.readText("⏺ answer that /clear would erase\n❯ ");
+
+        resolver.resolveBeforePostAction("term_a");
+
+        assertTrue(waiter.isDone(), "the answer is captured before the adapter sends /clear");
+        assertEquals("answer that /clear would erase", waiter.getNow(null).text());
+    }
+
    @Test
    void suppressesAnUnchangedCompletionEvenWhenTheBlockExceedsTheScrapeCap() {
        // The fan-out issue-hunt finding: captureBaseline once stored the RAW (unclipped) assistant
@@ -271,10 +286,12 @@ class CompletionResolverTest {
        // The turn as the injector captured it at delivery (waiter + pre-turn baseline).
        var turnN = new CompletionResolver.InFlight(waiterN, "an earlier answer");

-        // Turn N is resolved by the worker's explicit reply.
+        // Turn N is resolved by the worker's explicit reply, and its send deregisters the waiter.
        assertTrue(rendezvous.resolve("term_a", "N replied"));
+        rendezvous.close("term_a", waiterN); // the sender's finally, before the next turn opens

-        // Turn N+1's send opens its own waiter on the same session (replacing the registered one).
+        // Turn N+1's send opens its own waiter on the same session (CB-548: open fails if the
+        // previous waiter is still registered, so a clean turn deregisters it first as above).
        var waiterN1 = rendezvous.open("term_a");

        resolver.resolve("term_a", turnN); // turn N's completion fallback finally fires
@@ -196,6 +196,47 @@ class InjectorTest {
        assertEquals(List.of(T), completed, "a confirmed working→idle fires exactly one completion");
    }

+    @Test
+    void postTurnResetSettlesBeforeNextDelegationWithoutBecomingATurn() {
+        AgentControl agents = new AgentControl(herdr);
+        class ResetListener implements TurnListener {
+            int completed;
+
+            @Override
+            public void onTurnComplete(String target) {
+                completed++;
+            }
+
+            @Override
+            public boolean hasPostTurnAction(String target) {
+                return true;
+            }
+
+            @Override
+            public boolean onTurnCompleteWithPostAction(String target) {
+                completed++;
+                agents.send(target, "/clear"); // direct housekeeping, never Injector.enqueue
+                return true;
+            }
+        }
+        ResetListener listener = new ResetListener();
+        Injector inj = new Injector(agents, listener);
+        inj.enqueue(T, "first");
+        inj.enqueue(T, "second");
+
+        inj.onStatus(T, AgentStatus.IDLE);    // first delegation
+        inj.onStatus(T, AgentStatus.WORKING);
+        inj.onStatus(T, AgentStatus.IDLE);    // first complete; reset dispatched
+        assertEquals(List.of("first", "/clear"), sent(),
+                "same-tick completion must not let the queued delegation overtake reset");
+
+        inj.onStatus(T, AgentStatus.WORKING); // reset picked up, but this is not a bridge turn
+        inj.onStatus(T, AgentStatus.IDLE);    // reset settled; second may now deliver
+        assertEquals(List.of("first", "/clear", "second"), sent());
+        assertEquals(1, listener.completed,
+                "reset settlement must not recursively emit another turn completion");
+    }
+
    @Test
    void doesNotSynthesizeCompletionFromAnUnconfirmedTurn() {
        List<String> completed = new ArrayList<>();
@@ -77,6 +77,7 @@ class BridgeMcpAuthzTest {
    private static final Principal PRIMARY = Principal.primary(100);
    private static final Principal WORKER_A = Principal.worker("term_a", 200);
    private static final Principal ANON = Principal.anonymous();
+    private static final Principal ARCH_DESIGN = Principal.architect("lead-designer", "term_design", 400);

    // --- the table, enforced on THIS path too ---------------------------------------------------

@@ -119,6 +120,33 @@ class BridgeMcpAuthzTest {
        assertNotNull(m.denyFor(PRIMARY, Authz.Action.ASK, "term_a"));
    }

+    // --- CB-548: the architect on this path ------------------------------------------------
+
+    @Test
+    void anArchitectMaySendAndReadButNotOrchestrateOverMcp() {
+        BridgeMcp m = mcp(true);
+        assertNull(m.denyFor(ARCH_DESIGN, Authz.Action.SEND, "term_a"),
+                "delegating a turn is the architect's job");
+        assertNull(m.denyFor(ARCH_DESIGN, Authz.Action.READ, null));
+
+        for (Authz.Action a : new Authz.Action[]{Authz.Action.SPAWN, Authz.Action.STOP,
+                Authz.Action.DRAIN}) {
+            McpSchema.CallToolResult denied = m.denyFor(ARCH_DESIGN, a, null);
+            assertNotNull(denied, a + " must be refused to an architect");
+            assertTrue(denied.isError(), "a refusal is returned as an MCP tool error");
+        }
+    }
+
+    @Test
+    void anArchitectMayReplyAndAskOnlyAsItsOwnPaneOverMcp() {
+        BridgeMcp m = mcp(true);
+        assertNull(m.denyFor(ARCH_DESIGN, Authz.Action.REPLY, "term_design"));
+        assertNull(m.denyFor(ARCH_DESIGN, Authz.Action.ASK, "term_design"));
+
+        assertNotNull(m.denyFor(ARCH_DESIGN, Authz.Action.REPLY, "term_a"),
+                "architect 'lead-designer' must not reply on worker term_a's session");
+    }
+
    @Test
    void anonymousIsRefusedEverythingAndCountedAsUnauthenticated() {
        BridgeMcp m = mcp(true);
@@ -156,6 +184,11 @@ class BridgeMcpAuthzTest {
        assertEquals("term_a", BridgeMcp.principalFrom("WORKER", "term_a", 7).terminal());
        assertEquals(Role.PRIMARY, BridgeMcp.principalFrom("PRIMARY", null, 7).role());
        assertEquals(Role.ANONYMOUS, BridgeMcp.principalFrom("ANONYMOUS", null, -1).role());
+        // CB-548: an architect round-trips through the same stash, carrying its slot name.
+        Principal arch = BridgeMcp.principalFrom("ARCHITECT", "term_design", 7, "lead-designer");
+        assertEquals(Role.ARCHITECT, arch.role());
+        assertEquals("lead-designer", arch.name());
+        assertEquals("term_design", arch.terminal());
    }

    @Test
@@ -288,7 +288,8 @@ class BridgeMcpTest {
        WorkerSession s = sessions.acquire("ltms-local", null, "/caller/proj", "term_primary",
                new WorktreeRequest("cb-304", null));

-        McpSchema.CallToolResult res = BridgeMcp.listWorkers(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions);
+        McpSchema.CallToolResult res = BridgeMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, Map.of(), "");

        assertNotEquals(Boolean.TRUE, res.isError());
        String out = textOf(res);
@@ -302,6 +303,58 @@ class BridgeMcpTest {
        assertTrue(out.contains("\"liveStatus\":\"unknown\""), out);
    }

+    @Test
+    void listReportsLeadsAndFlagsTheCallersOwnRow() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+
+        McpSchema.CallToolResult res = BridgeMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions,
+                Map.of("term_me", "opus-5.0", "term_peer", "gpt-sol-5.6"), "term_me");
+
+        assertNotEquals(Boolean.TRUE, res.isError());
+        String out = textOf(res);
+        assertTrue(out.contains("\"name\":\"opus-5.0\""), out);
+        assertTrue(out.contains("\"name\":\"gpt-sol-5.6\""), out);
+        assertTrue(out.contains("\"sessionId\":\"term_peer\""), out);
+        // The caller's own row is flagged, and only the caller's — a peer must be distinguishable
+        // from self without a second bridge_whoami call.
+        assertEquals(1, out.split("\"self\":true", -1).length - 1, out);
+        assertTrue(out.indexOf("term_me") < out.indexOf("\"self\":true"), out);
+    }
+
+    @Test
+    void listReportsBothHalvesEvenWhenEmpty() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+
+        McpSchema.CallToolResult res = BridgeMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, Map.of(), "");
+
+        // An absent "leads" key is what made an empty worker roster read as "no peers" (CB-535).
+        String out = textOf(res);
+        assertTrue(out.contains("\"leads\":[]"), out);
+        assertTrue(out.contains("\"workers\":[]"), out);
+    }
+
+    @Test
+    void listReportsALeadHerdrCannotSeeAsUnknown() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+
+        McpSchema.CallToolResult res = BridgeMcp.listFleet(
+                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions,
+                Map.of("term_ghost", "gone-away"), "term_me");
+
+        // Reported, not hidden: an unreachable peer is exactly what a would-be sender needs to see.
+        String out = textOf(res);
+        assertTrue(out.contains("\"name\":\"gone-away\""), out);
+        assertTrue(out.contains("\"status\":\"unknown\""), out);
+    }
+
    @Test
    void stopTearsDownAWorkerByPane() {
        FakeHerdr h = new FakeHerdr();
@@ -413,4 +466,55 @@ class BridgeMcpTest {
        assertTrue(out.contains("\"sessionId\":\"term_orphan\""), out);
        assertFalse(out.contains("profile"), out); // nothing invented for a session we don't track
    }
+
+    /**
+     * CB-548: an architect reports its role and which gateway-local slot its pane is bound to —
+     * the same shape as a lead, under the architect key, so it can tell a peer where to reach it.
+     */
+    @Test
+    void whoamiReportsAnArchitectWithItsSlotAndPane() {
+        FakeHerdr h = new FakeHerdr();
+        McpSchema.CallToolResult res = BridgeMcp.whoami(
+                Principal.architect("lead-designer", "term_design", 400),
+                sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
+
+        assertNotEquals(Boolean.TRUE, res.isError());
+        String out = textOf(res);
+        assertTrue(out.contains("\"role\":\"architect\""), out);
+        assertTrue(out.contains("\"architect\":\"lead-designer\""), out);
+        assertTrue(out.contains("\"sessionId\":\"term_design\""), out);
+    }
+
+    /**
+     * CB-548: an architect SEND delegates as its own pane (recording the per-target delegation) but
+     * must NEVER become the legacy singleton "primary" fallback — the per-target map does not cure
+     * the singleton, so an architect left there would draw no-delegation inbox nudges meant for a
+     * primary. Only PRIMARY callers (the unnamed primary and named leads alike) may claim it, and
+     * the decision keys on the resolved role, not name/kind sniffing.
+     */
+    @Test
+    void architectSendDoesNotClaimThePrimarySingletonButALeadSendStillCan() {
+        // Architect SEND: does not change the legacy primary fallback.
+        PrimaryRegistry reg = new PrimaryRegistry(null);
+        BridgeMcp.recordPrimarySingleton(reg, "term_design", Principal.architect("design", "term_design", 400));
+        assertTrue(reg.primaryTerminal().isEmpty(),
+                "an architect must never become the legacy primary fallback");
+
+        // Lead SEND (a named PRIMARY) still claims it — preserved from CB-530/CB-532.
+        PrimaryRegistry leadReg = new PrimaryRegistry(null);
+        BridgeMcp.recordPrimarySingleton(leadReg, "term_lead_opus", Principal.leader("opus", "term_lead_opus", 100));
+        assertEquals("term_lead_opus", leadReg.primaryTerminal().orElseThrow(),
+                "a named lead is a primary and may claim the fallback");
+
+        // Unnamed primary likewise.
+        PrimaryRegistry primaryReg = new PrimaryRegistry(null);
+        BridgeMcp.recordPrimarySingleton(primaryReg, "term_p", Principal.primary(50));
+        assertEquals("term_p", primaryReg.primaryTerminal().orElseThrow(),
+                "an unnamed primary may claim the fallback");
+
+        // A null caller (legacy/no-auth path) records nothing.
+        PrimaryRegistry legacy = new PrimaryRegistry(null);
+        BridgeMcp.recordPrimarySingleton(legacy, "term_x", null);
+        assertTrue(legacy.primaryTerminal().isEmpty(), "no caller means nothing is recorded");
+    }
 }
@@ -105,4 +105,68 @@ class PrimaryRegistryTest {
        reg.record("term_found");
        assertEquals("term_found", reg.primaryTerminal().get());
    }
+
+    // ── CB-532: nudges follow the delegating lead, not "the primary" ────────────────────────────
+
+    /**
+     * The bug that made `primary.terminal` unretirable: with one slot, whichever lead called
+     * bridge_send first captured every nudge — including nudges for the other lead's delegations.
+     */
+    @Test
+    void aNudgeGoesToTheLeadThatDelegatedToThatWorker() {
+        var reg = new PrimaryRegistry(null);
+        reg.recordDelegation("term_worker_a", "term_lead_opus");
+        reg.recordDelegation("term_worker_b", "term_lead_sol");
+
+        assertEquals("term_lead_opus", reg.nudgeTargetFor("term_worker_a").orElseThrow());
+        assertEquals("term_lead_sol", reg.nudgeTargetFor("term_worker_b").orElseThrow());
+    }
+
+    @Test
+    void theMostRecentDelegatorWinsWhenAWorkerChangesHands() {
+        var reg = new PrimaryRegistry(null);
+        reg.recordDelegation("term_worker", "term_lead_opus");
+        reg.recordDelegation("term_worker", "term_lead_sol");
+
+        assertEquals("term_lead_sol", reg.nudgeTargetFor("term_worker").orElseThrow(),
+                "the lead waiting on the reply is the one that sent the work most recently");
+    }
+
+    /** After a restart the map is empty while the durable inbox still holds the reply. */
+    @Test
+    void anUnknownDelegationFallsBackToThePinnedPrimary() {
+        var reg = new PrimaryRegistry("term_pinned");
+
+        assertEquals("term_pinned", reg.nudgeTargetFor("term_never_seen").orElseThrow());
+    }
+
+    @Test
+    void withNoPinAndNoDelegationNobodyIsNudged() {
+        var reg = new PrimaryRegistry(null);
+
+        assertTrue(reg.nudgeTargetFor("term_worker").isEmpty(),
+                "guessing would interrupt the wrong lead with someone else's result; the durable "
+                        + "inbox makes pull the correct degradation");
+    }
+
+    @Test
+    void releasingASessionForgetsItsLead() {
+        var reg = new PrimaryRegistry(null);
+        reg.recordDelegation("term_worker", "term_lead");
+
+        reg.forgetDelegation("term_worker");
+
+        assertTrue(reg.nudgeTargetFor("term_worker").isEmpty());
+    }
+
+    @Test
+    void aBlankOrNullDelegationIsIgnoredRatherThanStored() {
+        var reg = new PrimaryRegistry(null);
+        reg.recordDelegation("term_worker", "  ");
+        reg.recordDelegation(null, "term_lead");
+        reg.recordDelegation("  ", "term_lead");
+
+        assertTrue(reg.nudgeTargetFor("term_worker").isEmpty());
+        assertTrue(reg.nudgeTargetFor(null).isEmpty());
+    }
 }
@@ -5,6 +5,7 @@ import dev.ltms.bridged.herdr.AgentStatus;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.HerdrException;
 import dev.ltms.bridged.inject.CompletionResolver;
+import dev.ltms.bridged.mcp.PrimaryRegistry;
 import dev.ltms.bridged.inject.Injector;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -16,6 +17,7 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;

 /**
@@ -321,6 +323,141 @@ class MessageServiceTest {
        assertEquals("first done", firstReply.text());
    }

+    // --- CB-548: delegator ownership is recorded only on an ACCEPTED send ----------------------
+
+    private static final String LEAD_L = "term_lead_l";
+    private static final String LEAD_A = "term_lead_a";
+
+    /**
+     * The bug CB-548 fixes: L holds worker W, then architect A attempts W and times out BUSY. With
+     * delegator ownership recorded at {@code bridge_send} <em>request</em> time, A's rejected call
+     * would overwrite L — and W's late no-waiter reply would be pushed to A, who never owned the
+     * turn. The accepted-delivery hook must not fire for a BUSY send, so L stays the delegator.
+     */
+    @Test
+    void busySenderDoesNotBecomeTheDelegatingOwner() throws Exception {
+        PrimaryRegistry reg = new PrimaryRegistry(null);
+        // L accepts a delegation to W: the send wins the lock and queues delivery → L is recorded.
+        CompletableFuture<MessageService.Reply> first = CompletableFuture.supplyAsync(
+                () -> messages.send(T, "first", 5000, () -> reg.recordDelegation(T, LEAD_L)));
+        awaitWaiting();
+        assertEquals(LEAD_L, reg.nudgeTargetFor(T).orElseThrow(),
+                "an accepted send owns the delegation");
+
+        // A attempts W while L holds it → BUSY (lock never taken) → its hook never fires.
+        MessageService.Reply busy = messages.send(T, "second", 100, () -> reg.recordDelegation(T, LEAD_A));
+        assertEquals(MessageService.Outcome.BUSY, busy.outcome());
+        assertEquals(LEAD_L, reg.nudgeTargetFor(T).orElseThrow(),
+                "a BUSY send must not steal the delegator ownership it never earned");
+
+        // L completes so the test thread is not left pinned.
+        injector.onStatus(T, AgentStatus.IDLE);
+        injector.onStatus(T, AgentStatus.WORKING);
+        assertTrue(rendezvous.resolve(T, "first done"));
+        MessageService.Reply firstReply = first.get(5, TimeUnit.SECONDS);
+        assertEquals(MessageService.Outcome.REPLIED, firstReply.outcome());
+    }
+
+    /**
+     * Once L's accepted delegation is fully done, a later <em>accepted</em> send from A may
+     * legitimately become the new delegator — ownership follows the turn, not the first caller.
+     */
+    @Test
+    void anAcceptedSendAfterThePriorOwnerFinishesBecomesTheNewOwner() throws Exception {
+        PrimaryRegistry reg = new PrimaryRegistry(null);
+        CompletableFuture<MessageService.Reply> first = CompletableFuture.supplyAsync(
+                () -> messages.send(T, "first", 5000, () -> reg.recordDelegation(T, LEAD_L)));
+        awaitWaiting();
+        injector.onStatus(T, AgentStatus.IDLE);
+        injector.onStatus(T, AgentStatus.WORKING);
+        assertTrue(rendezvous.resolve(T, "first done"));
+        MessageService.Reply firstReply = first.get(5, TimeUnit.SECONDS);
+        assertEquals(MessageService.Outcome.REPLIED, firstReply.outcome());
+        assertEquals(LEAD_L, reg.nudgeTargetFor(T).orElseThrow(), "L owned the first turn");
+
+        // L finished; A's later accepted send takes the delegation over.
+        CompletableFuture<MessageService.Reply> second = CompletableFuture.supplyAsync(
+                () -> messages.send(T, "second", 5000, () -> reg.recordDelegation(T, LEAD_A)));
+        awaitWaiting();
+        assertEquals(LEAD_A, reg.nudgeTargetFor(T).orElseThrow(),
+                "an accepted send after the owner finished becomes the new delegator");
+
+        injector.onStatus(T, AgentStatus.IDLE);
+        injector.onStatus(T, AgentStatus.WORKING);
+        assertTrue(rendezvous.resolve(T, "second done"));
+        MessageService.Reply secondReply = second.get(5, TimeUnit.SECONDS);
+        assertEquals(MessageService.Outcome.REPLIED, secondReply.outcome());
+    }
+
+    /**
+     * CB-548 requirement: answering an existing {@code bridge_ask} is the SAME delegation, so it must
+     * not rewrite ownership. L accepted the send (owned), the worker paused to ask, and L answers via
+     * turnId — ownership stays L throughout; the answer path never touches the registry.
+     */
+    @Test
+    void answeringAnAskDoesNotRewriteDelegatorOwnership() throws Exception {
+        PrimaryRegistry reg = new PrimaryRegistry(null);
+        CompletableFuture<MessageService.Reply> send = CompletableFuture.supplyAsync(
+                () -> messages.send(T, "do X", 5000, () -> reg.recordDelegation(T, LEAD_L)));
+        awaitWaiting();
+        assertEquals(LEAD_L, reg.nudgeTargetFor(T).orElseThrow(), "L owns the delegation");
+
+        injector.onStatus(T, AgentStatus.IDLE);    // deliver
+        injector.onStatus(T, AgentStatus.WORKING); // worker picks it up, then pauses to ask
+
+        CompletableFuture<MessageService.AskResult> ask =
+                CompletableFuture.supplyAsync(() -> messages.ask(T, "which config?", 5000));
+        MessageService.Reply q = send.get(5, TimeUnit.SECONDS);
+        assertEquals(MessageService.Outcome.QUESTION, q.outcome());
+        assertNotNull(q.turnId());
+
+        // L answers the ask on the same turn; the answer path must not touch ownership.
+        CompletableFuture<MessageService.Reply> answer =
+                CompletableFuture.supplyAsync(() -> messages.answer(q.turnId(), "config.yaml", 5000));
+        assertEquals("config.yaml", ask.get(5, TimeUnit.SECONDS).answer());
+        awaitWaiting(); // the answering send reopened its forward waiter
+        assertEquals(LEAD_L, reg.nudgeTargetFor(T).orElseThrow(),
+                "answering an ask keeps L as the delegator — ownership is not rewritten");
+
+        assertTrue(rendezvous.resolve(T, "done"));
+        assertEquals(MessageService.Outcome.REPLIED, answer.get(5, TimeUnit.SECONDS).outcome());
+    }
+
+    /**
+     * CB-548: {@code onAccepted} is a public callback, so a throwing one must not orphan the turn.
+     * The waiter is opened first, then the hook runs BEFORE delivery is queued — so a throw fails
+     * the send loudly, closes its waiter, and never enqueues a message the worker would pick up and
+     * reply into the void.
+     */
+    @Test
+    void aThrowingAcceptedHookLeavesNoStaleWaiterOrQueuedOrphan() {
+        assertThrows(IllegalStateException.class,
+                () -> messages.send(T, "doomed", 500,
+                        () -> { throw new IllegalStateException("ownership hook failed"); }),
+                "a throwing ownership hook fails the send loudly");
+
+        assertFalse(rendezvous.isWaiting(T), "the failed send must not leave a stale rendezvous waiter");
+        // Give the injector a delivery window: with nothing enqueued, nothing may reach the worker.
+        injector.onStatus(T, AgentStatus.IDLE);
+        boolean doomedQueued = herdr.calls.stream()
+                .anyMatch(c -> c.method().equals("agent.prompt")
+                        && String.valueOf(c.params()).contains("doomed"));
+        assertFalse(doomedQueued, "a throwing ownership hook must not leave a queued, orphanable message");
+    }
+
+    /**
+     * The async (fire-and-poll) path runs the same {@code send} on a background thread, so the
+     * accepted-delivery hook must thread through it — ownership is recorded exactly as blocking sends.
+     */
+    @Test
+    void asyncSendRecordsOwnershipOnAcceptance() throws Exception {
+        PrimaryRegistry reg = new PrimaryRegistry(null);
+        messages.sendAsync(T, "async task", () -> reg.recordDelegation(T, LEAD_L));
+        awaitWaiting(); // the background send won the lock, queued, and opened its waiter
+        assertEquals(LEAD_L, reg.nudgeTargetFor(T).orElseThrow(),
+                "the async path records delegator ownership on acceptance, like the blocking path");
+    }
+
    // --- CB-307 reply inbox ----------------------------------------------------------------

    @Test
@@ -8,6 +8,8 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertNotEquals;
 import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertSame;
+import static org.junit.jupiter.api.Assertions.assertThrows;
 import static org.junit.jupiter.api.Assertions.assertTrue;

 /**
@@ -20,6 +22,26 @@ class RendezvousTest {

    private final Rendezvous rendezvous = new Rendezvous();

+    /**
+     * CB-548: an {@code open} is atomic fail-if-present so a double open can never replace the first
+     * waiter another send is blocked on. {@code MessageService} serializes sends per session, so in
+     * correct code this cannot happen — the rejection is a loud tripwire for an invariant violation,
+     * and the first waiter must survive it and stay resolvable.
+     */
+    @Test
+    void openRejectsADoubleOpenAndKeepsTheFirstWaiterRegisteredAndResolvable() {
+        CompletableFuture<Rendezvous.Resolution> first = rendezvous.open(W);
+
+        assertThrows(IllegalStateException.class, () -> rendezvous.open(W),
+                "a second open while one is registered is rejected loudly, not a silent replace");
+
+        assertSame(first, rendezvous.currentWaiter(W), "the first waiter remains the registered one");
+        assertTrue(rendezvous.resolve(W, "first wins"), "the first waiter is still resolvable");
+        Rendezvous.Resolution r = first.getNow(null);
+        assertEquals(Rendezvous.Kind.REPLY, r.kind());
+        assertEquals("first wins", r.text(), "the resolution lands on the first waiter, not the rejected one");
+    }
+
    @Test
    void openAskMintsAUniqueTurnScopedToItsSessionAndCoalescesDuplicates() {
        Rendezvous.AskTicket t1 = rendezvous.openAsk(W);
@@ -26,6 +26,18 @@ class GitWorktreesTest {
            }
            """;

+    /** An opencode config carrying a {@code {file:.secrets/...}} reference — CB-543's crash repro. */
+    private static final String OPENCODE_WITH_FILE_REF = """
+            {
+              "env": {
+                "CONTEXT7_TOKEN": "{file:.secrets/context7-token}"
+              }
+            }
+            """;
+
+    /** A non-empty autoenv file — the form that would prompt for authorization in a worktree. */
+    private static final String AUTOENV_WITH_DIRECTIVE = "export HELLO=world\n";
+
    private static Path initRepo(Path dir) throws Exception {
        Files.createDirectories(dir);
        git(dir, "init", "-q", "-b", "main");
@@ -47,9 +59,9 @@ class GitWorktreesTest {
        assertEquals(0, p.exitValue(), "git " + String.join(" ", args) + " failed:\n" + out);
    }

-    /** Pending changes to {@code .mcp.json} in {@code cwd}, empty when git considers it unmodified. */
-    private static String mcpStatus(Path cwd) throws Exception {
-        Process p = new ProcessBuilder("git", "status", "--porcelain", "--", ".mcp.json")
+    /** Pending changes to {@code file} in {@code cwd}, empty when git considers it unmodified. */
+    private static String status(Path cwd, String file) throws Exception {
+        Process p = new ProcessBuilder("git", "status", "--porcelain", "--", file)
                .directory(cwd.toFile()).redirectErrorStream(true).start();
        String out = new String(p.getInputStream().readAllBytes());
        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git status timed out");
@@ -82,7 +94,7 @@ class GitWorktreesTest {
        String wt = new GitWorktrees(tmp.resolve("wts").toString())
                .add(repo.toString(), "cb-525-b", "HEAD");

-        assertEquals("", mcpStatus(Path.of(wt)),
+        assertEquals("", status(Path.of(wt), ".mcp.json"),
                "the neutralized .mcp.json shows as modified — --skip-worktree did not take");
    }

@@ -116,4 +128,81 @@ class GitWorktreesTest {
        String body = Files.readString(Path.of(wt).resolve(".mcp.json"));
        assertTrue(body.replaceAll("\\s+", "").contains("\"mcpServers\":{}"), body);
    }
+
+    /**
+     * CB-543's repro: a tracked {@code opencode.json} carries a {@code {file:.secrets/...}} reference
+     * to a gitignored secret that never reaches a worktree, and opencode refuses to start on it. The
+     * worktree's copy must be neutralized and hidden like {@code .mcp.json}.
+     */
+    @Test
+    void aTrackedOpencodeConfigIsNeutralizedAndHidden(@TempDir Path tmp) throws Exception {
+        Path repo = tmp.resolve("repo");
+        Files.createDirectories(repo);
+        git(repo, "init", "-q", "-b", "main");
+        git(repo, "config", "user.email", "test@example.invalid");
+        git(repo, "config", "user.name", "Test");
+        Files.writeString(repo.resolve(".mcp.json"), WITH_SERVERS);
+        Files.writeString(repo.resolve("opencode.json"), OPENCODE_WITH_FILE_REF);
+        Files.writeString(repo.resolve("README.md"), "seed\n");
+        git(repo, "add", ".mcp.json", "opencode.json", "README.md");
+        git(repo, "commit", "-q", "-m", "seed");
+
+        String wt = new GitWorktrees(tmp.resolve("wts").toString())
+                .add(repo.toString(), "cb-543-a", "HEAD");
+
+        String body = Files.readString(Path.of(wt).resolve("opencode.json"));
+        assertFalse(body.contains(".secrets"),
+                "worktree kept a dangling {file:...} secret reference:\n" + body);
+        assertEquals("{}", body.replaceAll("\\s+", ""),
+                "expected an empty JSON object stub, got:\n" + body);
+        assertEquals("", status(Path.of(wt), "opencode.json"),
+                "the neutralized opencode.json shows as modified — --skip-worktree did not take");
+    }
+
+    /** A config the repo does not carry must be skipped — no stub invented, provisioning still succeeds. */
+    @Test
+    void anAbsentConfigIsSkippedWithoutError(@TempDir Path tmp) throws Exception {
+        Path repo = initRepo(tmp.resolve("repo"));   // only .mcp.json + README are committed
+
+        String wt = new GitWorktrees(tmp.resolve("wts").toString())
+                .add(repo.toString(), "cb-543-b", "HEAD");
+
+        assertFalse(Files.exists(Path.of(wt).resolve("opencode.json")),
+                "a stub was invented for a config the repo does not carry");
+        assertFalse(Files.exists(Path.of(wt).resolve(".autoenv")),
+                "a stub was invented for a config the repo does not carry");
+        // .mcp.json's long-standing create-always behaviour must be unchanged.
+        assertTrue(Files.exists(Path.of(wt).resolve(".mcp.json")), ".mcp.json stub was dropped");
+    }
+
+    /** All three protected configs are covered: each one present in a worktree is neutralized and hidden. */
+    @Test
+    void allThreeConfigsAreNeutralizedWhenPresent(@TempDir Path tmp) throws Exception {
+        Path repo = tmp.resolve("repo");
+        Files.createDirectories(repo);
+        git(repo, "init", "-q", "-b", "main");
+        git(repo, "config", "user.email", "test@example.invalid");
+        git(repo, "config", "user.name", "Test");
+        Files.writeString(repo.resolve(".mcp.json"), WITH_SERVERS);
+        Files.writeString(repo.resolve("opencode.json"), OPENCODE_WITH_FILE_REF);
+        Files.writeString(repo.resolve(".autoenv"), AUTOENV_WITH_DIRECTIVE);
+        Files.writeString(repo.resolve("README.md"), "seed\n");
+        git(repo, "add", ".mcp.json", "opencode.json", ".autoenv", "README.md");
+        git(repo, "commit", "-q", "-m", "seed");
+
+        String wt = new GitWorktrees(tmp.resolve("wts").toString())
+                .add(repo.toString(), "cb-543-c", "HEAD");
+
+        assertTrue(Files.readString(Path.of(wt).resolve(".mcp.json"))
+                        .replaceAll("\\s+", "").contains("\"mcpServers\":{}"),
+                ".mcp.json was not neutralized");
+        assertEquals("{}", Files.readString(Path.of(wt).resolve("opencode.json")).replaceAll("\\s+", ""),
+                "opencode.json was not neutralized");
+        assertEquals("", Files.readString(Path.of(wt).resolve(".autoenv")),
+                ".autoenv was not neutralized");
+
+        assertEquals("", status(Path.of(wt), ".mcp.json"), ".mcp.json still shows as modified");
+        assertEquals("", status(Path.of(wt), "opencode.json"), "opencode.json still shows as modified");
+        assertEquals("", status(Path.of(wt), ".autoenv"), ".autoenv still shows as modified");
+    }
 }
@@ -39,13 +39,18 @@ class SessionManagerTest {
    }

    private SessionManager sessionManager(FakeHerdr herdr, LongSupplier clock, int contextCap) {
+        return sessionManager(herdr, clock, contextCap, false);
+    }
+
+    private SessionManager sessionManager(FakeHerdr herdr, LongSupplier clock, int contextCap,
+                                          boolean clearAfterTurn) {
        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
                "worker: {profile} #{n}", null, null, null);
        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-        return new SessionManager(workers, new GitWorktrees(), clock, contextCap);
+        return new SessionManager(workers, new GitWorktrees(), clock, contextCap, clearAfterTurn);
    }

    @Test
@@ -336,6 +341,50 @@ class SessionManagerTest {
                "forced release tears the worker pane down exactly once");
    }

+    @Test
+    void clearAfterTurnResetsContextWithoutDoubleCountingTheTurn() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr, () -> 0L, 0, true);
+        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        sessions.asPresence().markPresent(session.terminalId());
+
+        sessions.onDelivered(session.terminalId());
+        assertTrue(sessions.onTurnCompleteWithPostAction(session.terminalId()));
+
+        WorkerSession updated = sessions.get(session.paneId()).orElseThrow();
+        assertEquals(1, updated.turnCount(), "the reset is housekeeping, not a second delegation");
+        assertEquals(List.of("/clear"), promptTexts(herdr));
+    }
+
+    @Test
+    void contextCapReleaseWinsOverClearAfterTurn() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr, () -> 0L, 1, true);
+        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        sessions.asPresence().markPresent(session.terminalId());
+        sessions.onDelivered(session.terminalId());
+
+        assertFalse(sessions.hasPostTurnAction(session.terminalId()),
+                "a session at its cap will be released, not reset for reuse");
+        assertFalse(sessions.onTurnCompleteWithPostAction(session.terminalId()));
+        assertTrue(sessions.get(session.paneId()).isEmpty());
+        assertTrue(promptTexts(herdr).isEmpty(), "never send /clear into a worker being torn down");
+    }
+
+    @Test
+    void clearAfterTurnFalsePreservesCompletionWithoutAControlPrompt() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr, () -> 0L, 0, false);
+        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        sessions.asPresence().markPresent(session.terminalId());
+        sessions.onDelivered(session.terminalId());
+
+        sessions.onTurnComplete(session.terminalId());
+
+        assertEquals(WorkerSession.State.DONE, sessions.get(session.paneId()).orElseThrow().state());
+        assertTrue(promptTexts(herdr).isEmpty());
+    }
+
    @Test
    void drainAllReleasesBusyAndReadySessionsAndWaitsForBusy() {
        long[] clock = {0};
@@ -367,6 +416,13 @@ class SessionManagerTest {
                .count();
    }

+    private static List<String> promptTexts(FakeHerdr herdr) {
+        return herdr.calls.stream()
+                .filter(c -> "agent.prompt".equals(c.method()))
+                .map(c -> String.valueOf(((Map<?, ?>) c.params()).get("text")))
+                .toList();
+    }
+
    // --- CB-306 spawn-readiness gate: no half-registered session on timeout ----------------

    @Test
@@ -1,6 +1,7 @@
 package dev.ltms.bridged.worker;

 import dev.ltms.bridged.config.BridgedConfig;
+import dev.ltms.bridged.guard.GuardException;
 import dev.ltms.bridged.guard.SubscriptionGuard;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.FakeHerdr;
@@ -78,14 +79,24 @@ class ClaudeCodeLauncherTest {

        Map<?, ?> start = (Map<?, ?>) herdr.lastCall("agent.start").params();
        assertEquals("claude", start.get("kind"), "herdr launches the canonical executable by kind");
-        assertEquals(List.of(), start.get("args"), "the configured executable is not repeated in args");
+        // CB-533: the shared fixture pins model "coder", so the model flag is the whole args list.
+        // What this test guards is that argv[0] is NOT repeated — herdr supplies it from `kind`.
+        assertEquals(List.of("--model", "coder"), start.get("args"),
+                "the configured executable is not repeated in args");
    }

    @Test
    void noBridgeFlagsWhenMcpUrlAbsent() {
        FakeHerdr herdr = new FakeHerdr();
        service(herdr, List.of("claude", "--verbose"), null).spawn();
-        assertEquals(List.of("--verbose"), spawnedArgs(herdr), "extra args untouched without mcpUrl");
+
+        List<String> args = spawnedArgs(herdr);
+        assertFalse(args.contains("--mcp-config"), "no bridge mount without mcpUrl");
+        assertFalse(args.contains("--append-system-prompt"), "no reply charter without mcpUrl");
+        // CB-533: the model flag is independent of the MCP mount — pinning the model is not part of
+        // "mount the bridge", so an unmounted worker still runs the model its profile names.
+        assertEquals(List.of("--verbose", "--model", "coder"), args,
+                "the operator's own args are preserved, in order, ahead of the model flag");
    }

    private ClaudeCodeLauncher multiProfile(FakeHerdr herdr) {
@@ -293,6 +304,20 @@ class ClaudeCodeLauncherTest {
        assertTrue(caps.contains(Capability.MID_TURN_ASK), "every Claude Code peer supports mid-turn ask");
        assertTrue(caps.contains(Capability.WORKTREE), "every CLI peer supports worktree cwd");
        assertTrue(caps.contains(Capability.ORPHAN_REAP), "every herdr launcher supports orphan reap");
+        assertTrue(caps.contains(Capability.CONTEXT_RESET), "Claude Code supports /clear");
+    }
+
+    @Test
+    void clearContextUsesTheClaudeCommandThroughTheOwningHandle() {
+        FakeHerdr herdr = new FakeHerdr();
+        ClaudeCodeLauncher svc = service(herdr, List.of("claude"), null);
+        PeerHandle handle = svc.spawn(new SpawnRequest(null, null, null));
+
+        assertTrue(svc.clearContext(handle.id()));
+
+        Map<?, ?> prompt = (Map<?, ?>) herdr.lastCall("agent.prompt").params();
+        assertEquals("/clear", prompt.get("text"));
+        assertEquals("w9:pRoot_1", prompt.get("target"));
    }

    @Test
@@ -329,6 +354,65 @@ class ClaudeCodeLauncherTest {
        assertEquals("/work/proj", cwd, "effectiveCwd via SpawnRequest must match the three-arg resolution");
    }

+    // --- CB-547a: durable session identity (mint / resume / no-identity legacy) -----------------
+
+    @Test
+    void freshSpawnMintsASessionIdAndPassesTheName() {
+        FakeHerdr herdr = new FakeHerdr();
+        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
+
+        PeerHandle handle = svc.spawn(new SpawnRequest("ltms-local", null, null, "my-session", null));
+
+        List<String> args = spawnedArgs(herdr);
+        int flag = args.indexOf("--session-id");
+        assertTrue(flag >= 0 && flag + 1 < args.size(), "--session-id present: " + args);
+        String minted = args.get(flag + 1);
+        assertDoesNotThrow(() -> UUID.fromString(minted), "--session-id is a valid UUID: " + minted);
+        assertEquals("my-session", args.get(args.indexOf("-n") + 1), "the logical name rides as -n");
+        assertEquals(minted, handle.agentSessionId(),
+                "the resume handle is the minted id, known before the agent has written anything");
+        assertEquals("my-session", handle.sessionName(), "the handle carries the logical name");
+    }
+
+    @Test
+    void resumeSpawnPassesDashRAndNeverASessionId() {
+        FakeHerdr herdr = new FakeHerdr();
+        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
+
+        PeerHandle handle = svc.spawn(new SpawnRequest("ltms-local", null, null, "my-session", "cb-resume-1"));
+
+        List<String> args = spawnedArgs(herdr);
+        assertFalse(args.contains("--session-id"), "--session-id must NOT be passed on a resume (conflicts with -r)");
+        assertEquals("cb-resume-1", args.get(args.indexOf("-r") + 1), "-r carries the prior session id");
+        assertEquals("cb-resume-1", handle.agentSessionId(), "a resume adopts the prior id as its own");
+        assertEquals("my-session", handle.sessionName(), "the logical name survives a resume");
+    }
+
+    @Test
+    void noIdentitySpawnKeepsTheLegacyArgvAndCarriesNoSessionHandle() {
+        FakeHerdr herdr = new FakeHerdr();
+        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
+
+        PeerHandle handle = svc.spawn(new SpawnRequest("ltms-local", null, null));
+
+        List<String> args = spawnedArgs(herdr);
+        assertFalse(args.contains("--session-id"), "no identity → no --session-id");
+        assertFalse(args.contains("-n"), "no identity → no -n");
+        assertFalse(args.contains("-r"), "no identity → no -r");
+        assertNull(handle.agentSessionId(), "no identity → no resume handle");
+        assertNull(handle.sessionName(), "no identity → no logical name");
+    }
+
+    @Test
+    void capabilitiesIncludeSessionNameAndSessionResume() {
+        FakeHerdr herdr = new FakeHerdr();
+        ClaudeCodeLauncher svc = service(herdr, List.of("ccs", "ltms-local"), null);
+
+        Set<Capability> caps = svc.capabilities();
+        assertTrue(caps.contains(Capability.SESSION_NAME), "Claude Code surfaces the bridge's logical name (-n)");
+        assertTrue(caps.contains(Capability.SESSION_RESUME), "Claude Code can relaunch onto a prior conversation (-r)");
+    }
+
    @Test
    void profilesViaPeerLauncherMatchesExistingApi() {
        FakeHerdr herdr = new FakeHerdr();
@@ -541,4 +625,161 @@ class ClaudeCodeLauncherTest {
        assertEquals("http://gx00.gw:8000", startEnv(herdr).get("ANTHROPIC_BASE_URL"),
                "the guard-checked baseUrl must win over any env: entry, or the boundary is bypassable");
    }
+
+    // ── CB-533: the model is pinned on the command line, not only in the environment ────────────
+
+    /** A launcher for a profile identical but for its {@code model:} — the only variable here. */
+    private ClaudeCodeLauncher serviceWithModel(FakeHerdr herdr, String model) {
+        BridgedConfig.Worker cfg = profileWithModel(model);
+        return new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
+                _ -> null);
+    }
+
+    private static BridgedConfig.Worker profileWithModel(String model) {
+        return new BridgedConfig.Worker("sonnet", "http://gx00.gw:8000", model, null,
+                "BRIDGED_WORKER_TOKEN", List.of("ccs", "sonnet"), "tab", "bridged-workers",
+                "w #{n}", "http://127.0.0.1:8765/mcp", null, null);
+    }
+
+    @Test
+    void aConfiguredModelIsPassedAsAModelFlagAsWellAsTheEnvVar() {
+        // ANTHROPIC_MODEL alone loses to `ccs`, which exports its own model family over whatever it
+        // inherited — so a profile that set model: was silently overruled by its own launcher.
+        FakeHerdr herdr = new FakeHerdr();
+        serviceWithModel(herdr, "claude-sonnet-5").spawn("sonnet", null, null);
+
+        assertEquals("claude-sonnet-5", startEnv(herdr).get("ANTHROPIC_MODEL"));
+        List<String> args = spawnedArgs(herdr);
+        int flag = args.indexOf("--model");
+        assertTrue(flag >= 0, "the flag is what survives a wrapper argv like [ccs, sonnet]");
+        assertEquals("claude-sonnet-5", args.get(flag + 1));
+    }
+
+    @Test
+    void theModelFlagComesLastSoItOutranksTheOperatorsOwnArgv() {
+        FakeHerdr herdr = new FakeHerdr();
+        serviceWithModel(herdr, "claude-sonnet-5").spawn("sonnet", null, null);
+
+        List<String> args = spawnedArgs(herdr);
+        assertEquals(args.size() - 2, args.indexOf("--model"));
+    }
+
+    @Test
+    void aProfileWithNoModelGetsNoModelFlag() {
+        // gx10 deliberately leaves model: unset so ccs owns selection; adding a flag would make
+        // this file a second source of truth for exactly the thing it declines to decide.
+        FakeHerdr herdr = new FakeHerdr();
+        serviceWithModel(herdr, null).spawn("sonnet", null, null);
+
+        assertFalse(spawnedArgs(herdr).contains("--model"));
+        assertNull(startEnv(herdr).get("ANTHROPIC_MODEL"));
+    }
+
+    // --- CB-539: subscription-profile opt-in ----------------------------------------------------
+
+    /** A claude-code profile on the subscription: no baseUrl (by design), no off-sub endpoint. */
+    private static BridgedConfig.Worker subscriptionCfg(String profile, String baseUrl) {
+        return new BridgedConfig.Worker(
+                profile, baseUrl, "sonnet", null, "BRIDGED_WORKER_TOKEN",
+                List.of("ccs", profile), "tab", "bridged-workers", "w #{n}", null, null, null,
+                null, null, null, Map.of(), null, null, true);
+    }
+
+    @Test
+    void defaultRefusalIsPreservedForClaudeProfileWithNoBaseUrl() {
+        // Requirement 1: absent subscription:true ⇒ byte-identical refusal to today. A claude-code
+        // profile with no baseUrl and no subscription must still be refused (it would bill the sub).
+        FakeHerdr herdr = new FakeHerdr();
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
+                "ltms-local", null, "coder", null, "BRIDGED_WORKER_TOKEN",
+                List.of("ccs", "ltms-local"), "tab", "bridged-workers", "w #{n}", null, null, null);
+        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
+
+        GuardException ex = assertThrows(GuardException.class, () -> svc.spawn("ltms-local", null, null));
+        assertTrue(ex.getMessage().contains("no ANTHROPIC_BASE_URL"),
+                "the refusal names the missing baseUrl: " + ex.getMessage());
+        assertEquals(0, herdr.calls.stream().filter(c -> c.method().equals("agent.start")).count(),
+                "nothing was spawned before the refusal");
+    }
+
+    @Test
+    void subscriptionProfileSpawnsWithoutInjectedAnthropicVars() {
+        // Requirement on subscription:true: no baseUrl is required (or injected), and neither
+        // ANTHROPIC_BASE_URL nor ANTHROPIC_AUTH_TOKEN is injected even though the token env would
+        // resolve one if asked.
+        FakeHerdr herdr = new FakeHerdr();
+        BridgedConfig.Worker cfg = subscriptionCfg("sonnet", null);
+        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
+                _ -> "would-be-token").spawn();
+
+        Map<String, String> env = startEnv(herdr);
+        assertNull(env.get("ANTHROPIC_BASE_URL"), "no baseUrl injected for a subscription profile");
+        assertNull(env.get("ANTHROPIC_AUTH_TOKEN"), "no auth token injected for a subscription profile");
+        assertEquals("sonnet", env.get("ANTHROPIC_MODEL"),
+                "the model alias is still injected; only the subscription-boundary vars are dropped");
+    }
+
+    @Test
+    void subscriptionPlusBaseUrlIsRefused() {
+        // Requirement 2: subscription:true + a baseUrl state opposite intents — refuse at spawn,
+        // naming the profile, rather than silently picking a winner.
+        FakeHerdr herdr = new FakeHerdr();
+        BridgedConfig.Worker cfg = subscriptionCfg("sonnet", "http://gx00.gw:8000");
+        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
+
+        IllegalStateException ex = assertThrows(IllegalStateException.class,
+                () -> svc.spawn("sonnet", null, null));
+        assertTrue(ex.getMessage().contains("sonnet"), "refusal names the profile: " + ex.getMessage());
+        assertTrue(ex.getMessage().contains("subscription"), "refusal explains the contradiction: " + ex.getMessage());
+        assertEquals(0, herdr.calls.stream().filter(c -> c.method().equals("agent.start")).count(),
+                "nothing was spawned before the contradiction was refused");
+    }
+
+    @Test
+    void nonSubscriptionProfilesAreStillAllowlistChecked() {
+        // Requirement 3: the guard keeps its teeth for every other profile — a base_url whose host is
+        // not on the allowlist is still refused, whether or not any subscription profile exists.
+        FakeHerdr herdr = new FakeHerdr();
+        BridgedConfig.Worker rogue = new BridgedConfig.Worker(
+                "rogue", "http://evil.example.com:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
+                List.of("ccs", "rogue"), "tab", "bridged-workers", "w #{n}", null, null, null);
+        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(rogue.profile(), rogue), rogue.profile(), _ -> null);
+
+        GuardException ex = assertThrows(GuardException.class, () -> svc.spawn("rogue", null, null));
+        assertTrue(ex.getMessage().contains("not on the"), "refusal cites the allowlist: " + ex.getMessage());
+        assertEquals(0, herdr.calls.stream().filter(c -> c.method().equals("agent.start")).count(),
+                "nothing was spawned before the allowlist refusal");
+    }
+
+    @Test
+    void aSubscriptionProfileHasAnEnvSuppliedAnthropicBindingStripped() {
+        // CB-542: even a subscription profile whose env: carries ANTHROPIC_BASE_URL (or AUTH_TOKEN)
+        // must not hand them to the worker — on the subscription path no guard would vet them. Config
+        // load refuses this loudly; this launcher-side strip is the belt-and-braces that makes the
+        // invariant hold for a profile built in code that never passed through that validation.
+        FakeHerdr herdr = new FakeHerdr();
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
+                "sonnet", null, "sonnet", null, "BRIDGED_WORKER_TOKEN",
+                List.of("ccs", "sonnet"), "tab", "bridged-workers", "w #{n}", null, null, null,
+                null, null, null,
+                Map.of("ANTHROPIC_BASE_URL", "http://evil.example.com",
+                        "ANTHROPIC_AUTH_TOKEN", "sk-ant-bad", "JAVA_HOME", "/opt/jdk"),
+                null, null, true);
+        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
+                _ -> "would-be-token").spawn();
+
+        Map<String, String> env = startEnv(herdr);
+        assertNull(env.get("ANTHROPIC_BASE_URL"),
+                "the unguarded endpoint must not survive into the worker");
+        assertNull(env.get("ANTHROPIC_AUTH_TOKEN"),
+                "the unguarded token must not survive into the worker");
+        assertEquals("/opt/jdk", env.get("JAVA_HOME"),
+                "only the Anthropic binding keys are stripped; the rest of env: still applies");
+    }
 }
@@ -1,5 +1,8 @@
 package dev.ltms.bridged.worker;

+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.guard.SubscriptionGuard;
 import dev.ltms.bridged.herdr.Agent;
@@ -14,6 +17,7 @@ import dev.ltms.bridged.peer.SpawnRequest;
 import dev.ltms.bridged.placement.PlacementException;
 import dev.ltms.bridged.placement.PlacementPolicies;
 import org.junit.jupiter.api.Test;
+import org.slf4j.LoggerFactory;

 import java.util.EnumSet;
 import java.util.HashMap;
@@ -232,6 +236,30 @@ class CompositePeerLauncherTest {
                "stop routes to the spawning adapter and closes exactly that worker's pane");
    }

+    @Test
+    void opencodeContextResetIsANoOpAndWarnsOnlyOnce() {
+        FakeHerdr herdr = new FakeHerdr();
+        CompositePeerLauncher composite = composite(herdr);
+        PeerHandle handle = composite.spawn(new SpawnRequest("gemini", null, null));
+        Logger logger = (Logger) LoggerFactory.getLogger(HerdrPeerLauncher.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            assertFalse(composite.clearContext(handle.id()));
+            assertFalse(composite.clearContext(handle.id()));
+        } finally {
+            logger.detachAppender(appender);
+        }
+
+        assertFalse(opencodeAdapter(herdr).capabilities().contains(Capability.CONTEXT_RESET));
+        assertTrue(herdr.calls.stream().noneMatch(c -> "agent.prompt".equals(c.method())),
+                "never type Claude's /clear into an opencode prompt");
+        assertEquals(1, appender.list.stream()
+                .filter(e -> e.getFormattedMessage().contains("context reset is unsupported"))
+                .count(), "unsupported reset is logged once per adapter, not once per turn");
+    }
+
    @Test
    void constructorRejectsAProfileClaimedByTwoAdapters() {
        FakeHerdr herdr = new FakeHerdr();
@@ -350,6 +378,54 @@ class CompositePeerLauncherTest {
        assertEquals(1, adapter.spawnCount("b"));
    }

+    @Test
+    void explicitSpawnAtMaxLoadThrowsPlacementExceptionNamingProfileLiveAndCap() {
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, BridgedConfig.Worker> profiles = ordered(
+                "a", stubWorker("a", 1.0f, 2),
+                "b", stubWorker("b"));
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of());
+        CompositePeerLauncher composite = new CompositePeerLauncher(
+                List.of(adapter), "a", profiles, PlacementPolicies.fixed(), name -> "a".equals(name) ? 2 : 0);
+
+        PlacementException e = assertThrows(PlacementException.class,
+                () -> composite.spawn(new SpawnRequest("a", null, null)));
+        assertTrue(e.getMessage().contains("'a'"), "message names the profile: " + e.getMessage());
+        assertTrue(e.getMessage().contains("2 live"), "message names the live count: " + e.getMessage());
+        assertTrue(e.getMessage().contains("2 cap"), "message names the cap: " + e.getMessage());
+        assertEquals(0, adapter.spawnCount("a"), "at cap, the spawn is refused before any delegation");
+    }
+
+    @Test
+    void explicitSpawnUnderMaxLoadStillSucceeds() {
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, BridgedConfig.Worker> profiles = ordered(
+                "a", stubWorker("a", 1.0f, 2),
+                "b", stubWorker("b"));
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of());
+        CompositePeerLauncher composite = new CompositePeerLauncher(
+                List.of(adapter), "a", profiles, PlacementPolicies.fixed(), name -> "a".equals(name) ? 1 : 0);
+
+        PeerHandle h = composite.spawn(new SpawnRequest("a", null, null));
+        assertEquals("a", h.profile(), "a profile under its cap accepts an explicit spawn");
+        assertEquals(1, adapter.spawnCount("a"), "the under-cap spawn is delegated");
+    }
+
+    @Test
+    void explicitSpawnWithNullMaxLoadIsNeverCapped() {
+        FakeHerdr herdr = new FakeHerdr();
+        Map<String, BridgedConfig.Worker> profiles = ordered(
+                "a", stubWorker("a", 1.0f, null),
+                "b", stubWorker("b"));
+        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of());
+        // A deliberately absurd live count: an unset maxLoad means unlimited, so it must never refuse.
+        CompositePeerLauncher composite = new CompositePeerLauncher(
+                List.of(adapter), "a", profiles, PlacementPolicies.fixed(), name -> 1000);
+
+        PeerHandle h = composite.spawn(new SpawnRequest("a", null, null));
+        assertEquals("a", h.profile(), "a profile with no maxLoad is never capped, however many live workers");
+    }
+
    @Test
    void emptyCandidateSetThrowsClearException() {
        FakeHerdr herdr = new FakeHerdr();
@@ -37,7 +37,7 @@ class OpenCodeLauncherTest {
    private OpenCodeLauncher service(FakeHerdr herdr, Path configRoot, BridgedConfig.Worker cfg) {
        return new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
                Map.of(cfg.profile(), cfg), cfg.profile(), k -> "GITEA_ACCESS_TOKEN".equals(k) ? "tok" : null,
-                0, System::currentTimeMillis, () -> { }, configRoot);
+                0, System::currentTimeMillis, () -> { }, configRoot, configRoot);
    }

    @SuppressWarnings("unchecked")
@@ -99,21 +99,24 @@ class OpenCodeLauncherTest {
    }

    @Test
-    void passesTheModelAsDashMFlag(@TempDir Path root) {
+    void passesTheModelAsDashMFlagAlongsideAutoApprove(@TempDir Path root) {
        FakeHerdr herdr = new FakeHerdr();
        service(herdr, root, opencodeCfg("google/gemini-2.5-pro", null, null)).spawn();

        List<String> args = startArgs(herdr);
+        assertTrue(args.contains("--auto"),
+                "--auto is present alongside -m so a spawned peer never blocks on approval");
        int m = args.indexOf("-m");
        assertTrue(m >= 0, "model is selected with -m");
        assertEquals("google/gemini-2.5-pro", args.get(m + 1), "the provider/model selector follows -m");
    }

    @Test
-    void noModelFlagWhenModelBlank(@TempDir Path root) {
+    void autoApproveIsUnconditionalWhenModelBlank(@TempDir Path root) {
        FakeHerdr herdr = new FakeHerdr();
        service(herdr, root, opencodeCfg(null, null, null)).spawn();
-        assertEquals(List.of(), startArgs(herdr), "no model → no extra args beyond the executable");
+        assertEquals(List.of("--auto"), startArgs(herdr),
+                "--auto is unconditional: a model-less worker still must never block on approval");
    }

    @Test
@@ -127,14 +130,65 @@ class OpenCodeLauncherTest {
    @Test
    void capabilitiesDeclareOrphanReapAndMcpAskAndConditionalSelfPr(@TempDir Path root) {
        FakeHerdr herdr = new FakeHerdr();
-        assertEquals(java.util.Set.of(Capability.MID_TURN_ASK, Capability.WORKTREE, Capability.ORPHAN_REAP),
+        assertEquals(java.util.Set.of(Capability.MID_TURN_ASK, Capability.WORKTREE, Capability.ORPHAN_REAP,
+                        Capability.SESSION_RESUME),
                service(herdr, root, opencodeCfg(null, null, null)).capabilities(),
-                "no git token → no SELF_PR");
+                "opencode can be resumed by its own session id, so SESSION_RESUME is always declared");
+        assertFalse(service(herdr, root, opencodeCfg(null, null, null))
+                        .capabilities().contains(Capability.SESSION_NAME),
+                "opencode has no display-name flag, so SESSION_NAME must NOT be declared");
        assertTrue(service(herdr, root, opencodeCfg(null, null, "GITEA_ACCESS_TOKEN"))
                        .capabilities().contains(Capability.SELF_PR),
                "a git-token profile adds SELF_PR");
    }

+    // --- CB-547: resume + post-hoc session discovery --------------------------------------------
+
+    @Test
+    void aResumeSpawnPassesTheSessionIdAsDashS(@TempDir Path root) {
+        FakeHerdr herdr = new FakeHerdr();
+        service(herdr, root, opencodeCfg("google/gemini-2.5-pro", null, null))
+                .spawn(new SpawnRequest(null, null, null, null, "ses_41b79fc90ffeI9E8uZv6VprUn2"));
+
+        List<String> args = startArgs(herdr);
+        int s = args.indexOf("-s");
+        assertTrue(s >= 0, "a resumed spawn carries opencode's -s flag");
+        assertEquals("ses_41b79fc90ffeI9E8uZv6VprUn2", args.get(s + 1),
+                "the resume target id follows -s");
+    }
+
+    @Test
+    void aFreshSpawnCarriesNoSessionFlag(@TempDir Path root) {
+        FakeHerdr herdr = new FakeHerdr();
+        service(herdr, root, opencodeCfg(null, null, null))
+                .spawn(new SpawnRequest(null, null, null, null, null));
+
+        assertFalse(startArgs(herdr).contains("-s"),
+                "no resume target → a fresh session with no -s flag");
+    }
+
+    @Test
+    void theHandleDiscoversTheSessionIdForTheWorkersCwdOnlyAfterItAppears(@TempDir Path root,
+                                                                          @TempDir Path discRoot)
+            throws Exception {
+        FakeHerdr herdr = new FakeHerdr();
+        OpenCodeLauncher launcher = new OpenCodeLauncher(new AgentControl(herdr),
+                new WorkspaceControl(herdr), Map.of("gemini", opencodeCfg(null, null, null)),
+                "gemini", _ -> null, 0, System::currentTimeMillis, () -> { }, root, discRoot);
+
+        PeerHandle handle = launcher.spawn(new SpawnRequest(null, "/work/dir", null));
+
+        // opencode writes the record only when the session is first persisted — the instant the
+        // pane is ready it does not exist, so agentSessionId() is null (never a spawn failure).
+        assertNull(handle.agentSessionId(), "no record yet → null, not a spawn-time block");
+        // Once the record appears (here: same cwd), lazy discovery resolves it — the handle's
+        // session id matches its own worktree, not another's.
+        OpenCodeSessionDiscoveryTest.writeRecord(discRoot, "p1", "ses_a.json",
+                "ses_resolved", "/work/dir", 1000L);
+        assertEquals("ses_resolved", handle.agentSessionId(),
+                "agentSessionId() re-scans and picks up a record that has since been written");
+    }
+
    @Test
    void foreignWorkerMatchesOpencodePrefixButNotClaude() {
        String nonce = "abc123";
@@ -166,7 +220,7 @@ class OpenCodeLauncherTest {
        long[] clock = {0};
        OpenCodeLauncher svc = new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
                Map.of("gemini", opencodeCfg(null, null, null)), "gemini", _ -> null,
-                1000, () -> clock[0], () -> clock[0] += 50, root);
+                1000, () -> clock[0], () -> clock[0] += 50, root, root);

        PeerUnreachableException ex = assertThrows(PeerUnreachableException.class,
                () -> svc.spawn(new SpawnRequest(null, null, null)));
@@ -0,0 +1,90 @@
+package dev.ltms.bridged.worker;
+
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.attribute.FileTime;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * {@link OpenCodeSessionDiscovery} matches an opencode session record by the worker's cwd (its
+ * {@code directory}) against opencode's on-disk storage. These tests populate a TEMP storage root
+ * themselves — never the operator's real {@code ~/.local/share/opencode}.
+ */
+class OpenCodeSessionDiscoveryTest {
+
+    /**
+     * Write a session record {@code {"id":..., "directory":...}} under
+     * {@code <root>/session/<projectID>/<fileName>} and stamp it with a known last-modified time,
+     * so "most recently modified wins" is deterministic. Static so the launcher test can reuse it.
+     */
+    static void writeRecord(Path root, String projectId, String fileName, String id,
+                            String directory, long lastModifiedEpochMillis) throws Exception {
+        Path dir = root.resolve("session").resolve(projectId);
+        Files.createDirectories(dir);
+        Path file = dir.resolve(fileName);
+        Files.writeString(file, "{\"id\":\"" + id + "\",\"directory\":\"" + directory
+                + "\",\"projectID\":\"" + projectId + "\",\"version\":\"1.1.31\"}");
+        Files.setLastModifiedTime(file, FileTime.fromMillis(lastModifiedEpochMillis));
+    }
+
+    @Test
+    void findsTheRecordWhoseDirectoryEqualsTheCwd(@TempDir Path root) throws Exception {
+        writeRecord(root, "p1", "ses_a.json", "ses_aaa", "/w/a", 1000L);
+        writeRecord(root, "p2", "ses_b.json", "ses_bbb", "/w/b", 2000L);
+
+        assertEquals("ses_bbb", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/b"),
+                "the record whose directory equals the cwd is the one found");
+        assertEquals("ses_aaa", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"));
+    }
+
+    @Test
+    void aNonMatchingDirectoryYieldsNullRatherThanAMismatch(@TempDir Path root) throws Exception {
+        writeRecord(root, "p1", "ses_a.json", "ses_aaa", "/w/a", 1000L);
+
+        assertNull(new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/other"),
+                "no record for this cwd yet → null, not a wrong session");
+    }
+
+    @Test
+    void prefersTheMostRecentlyModifiedRecordWhenSeveralMatch(@TempDir Path root) throws Exception {
+        writeRecord(root, "p1", "old.json", "ses_old", "/w/a", 1000L);
+        writeRecord(root, "p2", "new.json", "ses_new", "/w/a", 5000L);
+
+        assertEquals("ses_new", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"),
+                "the freshest record for the cwd wins");
+    }
+
+    @Test
+    void aMissingOrEmptyStorageRootYieldsNullWithoutThrowing(@TempDir Path root) throws Exception {
+        // Missing: no session dir at all under the root.
+        assertNull(new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"));
+
+        // Present but empty: a session dir with nothing in it produces no match, not a throw.
+        Path emptyRoot = root.resolve("empty");
+        Files.createDirectories(emptyRoot.resolve("session"));
+        assertNull(new OpenCodeSessionDiscovery(emptyRoot).sessionIdForDirectory("/w/a"));
+    }
+
+    @Test
+    void aBlankOrNullDirectoryYieldsNull(@TempDir Path root) {
+        OpenCodeSessionDiscovery discovery = new OpenCodeSessionDiscovery(root);
+        assertNull(discovery.sessionIdForDirectory(null));
+        assertNull(discovery.sessionIdForDirectory("   "));
+    }
+
+    @Test
+    void aMalformedRecordIsSkippedRatherThanFatal(@TempDir Path root) throws Exception {
+        // A record that fails to parse must not abort the scan of its siblings.
+        Path dir = root.resolve("session").resolve("p1");
+        Files.createDirectories(dir);
+        Files.writeString(dir.resolve("broken.json"), "{not valid json");
+        writeRecord(root, "p1", "good.json", "ses_good", "/w/a", 1000L);
+
+        assertEquals("ses_good", new OpenCodeSessionDiscovery(root).sessionIdForDirectory("/w/a"),
+                "an unreadable record is skipped; a later valid one still matches");
+    }
+}
@@ -1,6 +1,6 @@
 # CB-308 — Multi-Host Federation (Stage 5)

-**Status:** design note (proposal)
+**Status:** design note (proposal) — core design decisions resolved 2026-08-10 (§7)
 **Depends on:** CB-307 (broker-based reliable delivery) — CB-308 is the multi-host layer built *on*
 CB-307's broker fabric.
 **Relates to:** CB-401 (`PeerHandle` opaque id), CB-304 (`rosterView`), CB-306 (spawn-readiness),
@@ -143,6 +143,8 @@ extending the same broker from "worker→primary reliability" to "gateway↔gate
 5. **Trust** — the broker connection is now the security boundary. A gateway injects env/tokens at
   daemon privilege (the CB-401 Stage-C concern), so a **remote-triggered spawn/send** needs
   authn/authz: who may act on which host, and which control channels a gateway will honour.
+   *Authenticity* is resolved — signed messages, §7.1; *authorization* (who may do what) remains
+   open — §8.

 ## 5. The one thing the broker does NOT dissolve

@@ -191,15 +193,111 @@ useful), and build CB-308's items on top once the broker fabric exists. Choose C
 channel naming **multi-host-ready** now (per-agent routing keys, a `roster.*` topic namespace) so
 CB-308 doesn't have to repaint the topology.

-## 7. Open questions
+## 7. Resolved design decisions (2026-08-10)
+
+Settled in a design review of this note + wiki chapter 10. The broker-level operational rules
+(inbox caps, TLS + private broker, schema versioning, trace id, exclusive consumers, U8 broadcast)
+are recorded in wiki 10 §10; the CB-308-side decisions are below. Entries 1–6 are the first-pass
+decisions; 7–10 came out of the adversarial second-pass review (same day) and supersede 1–6 where
+they overlap (notably: the envelope is no longer optional, and dedup is split by path).
+
+1. **Sender authenticity — sign every message.** Each gateway holds its own signing key and signs
+   what it publishes (sender gid, `msgId`, timestamp). The receiving gateway verifies the
+   signature **and** checks against the roster that the claimed sender lives on the signing
+   gateway's host. This extends the single-host invariant — *identity comes from the connection,
+   never an argument* — across the broker: cross-host, identity comes from the key. Complements
+   (not replaces) per-gateway broker logins over TLS.
+2. **Profiles are owned by the worker's host.** `bridge_spawn(profile, host)` resolves the name in
+   the *target* gateway's `bridged.yaml`. Gateways advertise their profile names in presence
+   heartbeats, so a leader sees what each host offers before spawning; an unknown name is a clear
+   error from the target. Secrets (base URLs, tokens) never leave the host that uses them.
+3. **Repo provisioning — clone from the forge, pinned.** A cross-host spawn names the repo URL and
+   the exact commit. The target gateway clones from the forge into a local cache (first spawn
+   only), then cuts a per-worker worktree — the CB-301-ext flow with a clone step in front,
+   covered by the same repo-scoped forge token (CB-302). Git stays the only channel code moves
+   through.
+4. **Asks are live-only, with expiry.** `ASK`/`ANSWER` (U2) traverse the broker as short-lived
+   (TTL'd) messages carrying the `turn_id`, and are never held durably — the single-host rule
+   kept. An answer arriving after its turn ended is **not** injected; it is dropped and the leader
+   gets a `TOO_LATE` notice, so the one failure case is loud rather than weird. Only terminal
+   replies are durable. Walkthrough: wiki 10 §7.4.
+5. **Spawn dedup — a spawn id, remembered on the target.** The control queue redelivers like any
+   queue; a replayed `SpawnRequest` must not double-spawn. Requests carry a unique spawn id; the
+   target gateway keeps a short memory of handled ids and answers a redelivery with the existing
+   `PeerHandle`. CB-117's orphan reap stays as the backstop.
+6. **Broker down — local unaffected, remote fails fast.** The routing fork (§3.2) means same-host
+   traffic never touches the broker; that is now a written promise. A send to a remote agent while
+   the broker is unreachable **fails immediately** with a clear error — the gateway never buffers
+   on the broker's behalf (it stays soft-state, so a crash cannot lose messages it claimed to
+   deliver). Gateways auto-reconnect; remote hosts read as unknown in the roster meanwhile. Broker
+   HA is a later ops choice, not a design requirement.
+
+7. **Turn state — split by where the signals are.** The *worker's* gateway owns the turn record
+   (turnId minting, ask coalescing, STALE_TURN, the completion/failure fallbacks, CB-516 abandon):
+   every input to those decisions — pane status, injection, teardown — is local to it. The
+   *sender's* gateway owns only the waiter. The two are stitched by terminal-outcome envelope
+   kinds (`REPLY` / `FAILED` / `ABANDONED`) published to the sender's inbox: a worker dying on B
+   fails A's waiter fast because gateway B sees the death synchronously and says so.
+   **`ABANDONED` is belt-and-braces over the waiter's own timeout and roster expiry, never a
+   replacement** — the case where the waiter hangs longest is gateway B itself dying, which is
+   exactly when B can publish nothing.
+8. **Dual ack model + spawn idempotence by construction.** Forward path (a brief into a worker):
+   ack **before** the inject — at-most-once, duplicates structurally impossible; the loss window
+   is closed by an `INJECTED` confirmation published after the inject lands (no `INJECTED` within
+   a bound = loud fast failure at the sender, not a silent send-timeout). Reply/pull path keeps
+   ack-after-drain — a duplicate reply is benign, deduped by `msgId`. Spawn: the requester mints
+   **spawn id = the new worker's gid**; the target checks it against the **live pane registry**,
+   and the gid is **stored in the herdr pane itself** (label/env, readable back), so a restarted
+   gateway rebuilds gid↔pane from herdr and the check survives restarts with *no persisted
+   ledger* — this storage point is the load-bearing detail of the no-ledger position. An
+   **in-flight reservation set**, entered before the launcher call, absorbs a redelivery arriving
+   while the first spawn is still inside CB-306's readiness gate; a crash mid-spawn leaves a
+   half-built pane, which is exactly what CB-117 reaps.
+9. **Publish is enforced, not fire-and-forget.** Publisher confirms + the `mandatory` flag + a
+   return listener, on a **publish channel separate from the consume/ack channel** — synchronous
+   confirms on the single shared channel would hold its lock across a broker round trip and
+   serialize acks fleet-wide. Ordering caveat: a *return* (unroutable) arrives **before** the
+   confirm, so "confirmed" ≠ "routed"; the sender checks the returned-set at confirm time.
+   `mandatory` is false only for `BROADCAST`, where an empty group is legal silence.
+10. **Queue lifecycle is session lifecycle.** `bridge_stop`/reap deletes the worker's inbox queue
+    (its `broadcast.*` bindings die with it — no broadcasts to the dead); `x-expires` collects
+    queues orphaned by a crashed gateway (long for main/orchestrator inboxes, short for workers).
+    Queue names carry a version suffix (`.v2`): AMQP refuses to redeclare an existing durable
+    queue with new arguments (`PRECONDITION_FAILED` — a crash loop on an in-place upgrade from
+    v1.0.0), and the suffix keeps old sender-keyed and new recipient-keyed queues apart during
+    the keying migration (wiki 10 §3 footnote).
+
+## 8. Still open

 - **Directory ground-truth:** pure soft-state presence (heartbeats) vs. also treating broker queue
  existence as authoritative. Lean soft-state to preserve the persistence boundary; revisit if
  split-brain roster views cause mis-routing.
- **Global id scheme:** `<host>/<paneId>` (human-legible, leaks host) vs. opaque UUID (clean, needs
-  the directory to resolve host). Probably UUID in the protocol, host as directory metadata.
 - **Gateway discovery:** how gateways find the broker and each other (static config vs. discovery).
- **Trust model shape:** per-host shared secret vs. mTLS on the broker vs. a capability token per
-  control action — ties into CB-401 Stage-C.
- **Failure semantics:** a host/gateway dies mid-turn — how the federated roster reaps it (missed
-  heartbeat) and whether in-flight primary-bound messages survive (broker durability = yes).
+- **Control authorization — THE GATE ON U4.** Signing (§7.1) settles *who sent it*; authorization
+  is *who may do what*. **Cross-host spawn must not land before the minimal version exists**: a
+  per-host allowlist in `bridged.yaml` — beside the peer public keys — of gateway ids permitted to
+  publish control to this host, checked against the verified signature. A few lines of config and
+  check; without them, any principal holding broker credentials can start processes on every host
+  in the fleet.
+- **Key distribution & rotation:** static config (host → public key in each `bridged.yaml`) is
+  fine at the current 2–3 host scale; rotation is manual. A refinement, not a blocker.
+- **Gateway death mid-turn:** the roster reaps it by missed heartbeat, and in-flight primary-bound
+  messages survive by broker durability; still open is reconciling *worker* state when the dead
+  gateway's host comes back (orphaned panes vs. still-valid sessions).
+
+*(Resolved and moved up: the global id scheme — an opaque UUID minted by the spawn requester as
+the spawn id, host carried as roster metadata; §7.8.)*
+
+## 9. Implementation order (each step verifiable single-host)
+
+1. **As-built fixes, independent of CB-308** (v1.0.x tickets): `basicQos` prefetch on the AMQP
+   consumer (today the queue drains into gateway heap, so any cap would guard an empty queue);
+   publisher confirms + `mandatory` (§7.9); the `drainReplies` javadoc that claims "the ack is
+   local" — false for the AMQP adapter.
+2. Envelope + signing (wiki 10 §2.1) — testable against the single-host broker.
+3. Recipient-keyed queue migration (`.v2` names, drain-by-`from`, `ReplyPushLoop` rekeyed).
+4. Global id + queue lifecycle (§7.8, §7.10).
+5. Roster: host-level heartbeat + signed presence; then the routing fork (§3.2).
+6. U2 cross-host with the terminal-outcome kinds (§7.4, §7.7).
+7. U4 cross-host spawn — **gated on the control allowlist (§8)**.
+8. U8 broadcast **last** — it is the feature that punishes an unfinished queue lifecycle.
@@ -0,0 +1,34 @@
+{
+  "$schema": "https://opencode.ai/config.json",
+  "instructions": [
+    "CLAUDE.md"
+  ],
+  "mcp": {
+    "bridged": {
+      "type": "remote",
+      "url": "http://127.0.0.1:8765/mcp",
+      "enabled": true
+    },
+    "context7": {
+      "type": "remote",
+      "url": "https://ct7.ltms.dev/mcp",
+      "enabled": true,
+      "headers": {
+        "Authorization": "Bearer {file:.secrets/context7-token}"
+      }
+    },
+    "gitea": {
+      "type": "local",
+      "command": [
+        "gitea-mcp",
+        "-t",
+        "stdio"
+      ],
+      "enabled": true,
+      "environment": {
+        "GITEA_ACCESS_TOKEN": "{file:.secrets/gitea-token}",
+        "GITEA_HOST": "{file:.secrets/gitea-host}"
+      }
+    }
+  }
+}
@@ -0,0 +1,18 @@
+{
+  "name": "claude-bridge",
+  "description": "Make a project bridge-ready: mount the bridged MCP gateway and set up standard Claude Code settings so this session can orchestrate a fleet of delegated workers. Ships no credentials.",
+  "version": "0.1.0",
+  "author": {
+    "name": "LTMS"
+  },
+  "homepage": "https://git.ltms.dev/lms/claude-bridge",
+  "repository": "https://git.ltms.dev/lms/claude-bridge",
+  "license": "MIT",
+  "keywords": [
+    "mcp",
+    "orchestration",
+    "multi-agent",
+    "delegation",
+    "codex"
+  ]
+}
@@ -0,0 +1,8 @@
+{
+  "mcpServers": {
+    "bridged": {
+      "type": "http",
+      "url": "http://127.0.0.1:8765/mcp"
+    }
+  }
+}
@@ -0,0 +1,54 @@
+# claude-bridge (Claude Code plugin)
+
+Makes a project **bridge-ready**: mounts the `bridged` MCP gateway and applies standard Claude Code
+settings, so the session can orchestrate a fleet of delegated workers.
+
+**This plugin ships no credentials.** Every secret is referenced by environment-variable *name*;
+the values stay with the user. Nothing the plugin writes is unsafe to commit.
+
+## What it is not
+
+The plugin is the **client-side setup**, not the bridge. `bridged` is a separate daemon and `herdr`
+is a separate PTY multiplexer, each with its own lifecycle and install. The plugin mounts an
+already-running daemon and tells you what is missing when one isn't there — it deliberately does
+not try to install system services on your behalf.
+
+## Install
+
+```shell
+/plugin marketplace add ltms/claude-bridge
+/plugin install claude-bridge@claude-bridge
+```
+
+Then, in the project you want to onboard:
+
+```shell
+/claude-bridge:setup
+```
+
+## What you get
+
+| Component | Effect |
+|---|---|
+| `.mcp.json` | mounts `bridged` at `http://127.0.0.1:8765/mcp` for any session with the plugin enabled |
+| `skills/setup` | `/claude-bridge:setup` — preflight, project settings, credential guidance, and verification |
+
+Because the plugin carries its own `.mcp.json`, an installed plugin needs no project-level MCP
+file at all. The setup skill writes one only when you want the mount to work *without* the plugin —
+for teammates who haven't installed it, or for CI.
+
+## Verifying a setup
+
+The setup skill ends by requiring a **real spawn**, not a health check. `/healthz` only reports
+that the daemon can reach herdr; a protocol mismatch between the daemon's adapter and the herdr
+binary leaves health green while every spawn fails. Only a spawn that reaches `ready` proves the
+fleet.
+
+## Local development
+
+```shell
+claude --plugin-dir ./plugin
+claude plugin validate ./plugin
+```
+
+`/reload-plugins` picks up edits without restarting the session.
@@ -0,0 +1,227 @@
+---
+name: setup
+description: Make the current project bridge-ready — check the prerequisites, mount the bridged MCP gateway into the project's .mcp.json, apply standard Claude Code settings, and verify this session resolves as the primary. Writes no credentials. Load this when asked to set up, install, configure, or onboard a project onto claude-bridge, or when bridge_* tools are expected but absent.
+---
+
+# Bridge setup — make this project bridge-ready
+
+This skill configures **the project you are currently in** so that this Claude Code session can
+orchestrate a fleet of delegated workers through `bridged`.
+
+**It writes no credentials, ever.** Every secret is referenced by environment-variable *name*, and
+the user exports the value themselves. Nothing this skill creates is unsafe to commit. If you are
+ever about to write a token, key, or password into a file, you have misread this skill — stop.
+
+Work through the steps in order. Each one has a check; **report what actually happened**, including
+failures. A setup that half-worked and was reported as done is worse than one that failed loudly.
+
+## 0. Establish where you are
+
+```bash
+pwd
+git rev-parse --show-toplevel 2>/dev/null || echo "(not a git repo)"
+ls -a | head -30
+```
+
+Everything below is written into **this** project root. If the user meant a different directory,
+confirm before writing anything.
+
+## 1. Preflight — what must already exist
+
+The bridge is three moving parts, and the plugin is only one of them. Check all of it before
+changing any file, so you can tell the user the whole story at once instead of failing one step at
+a time.
+
+```bash
+command -v herdr  && herdr --version 2>&1 | head -1   || echo "MISSING: herdr"
+command -v ccs    && ccs version 2>&1 | head -1       || echo "MISSING: ccs (needed for worker profiles)"
+command -v codex  && codex --version 2>&1 | head -1   || echo "absent: codex (optional)"
+curl -s -m 5 http://127.0.0.1:8765/healthz || echo "MISSING: bridged daemon is not reachable"
+```
+
+A healthy daemon answers with its status **and the herdr protocol it negotiated**:
+
+```json
+{"status":"ok","herdr":{"version":"0.8.0","protocol":19}}
+```
+
+| Missing | What to tell the user |
+|---|---|
+| `herdr` | The PTY multiplexer that owns worker terminals. Install it first; nothing else works without it. |
+| `bridged` | The daemon. It is a separate service, not part of this plugin — the plugin only *mounts* it. Point the user at the project's own install instructions. |
+| `ccs` | Only needed to launch worker profiles. The bridge itself will still start. |
+| `codex` | Optional. Only needed if this fleet will run Codex peers. |
+
+**Do not attempt to install these yourself.** They are system services with their own lifecycles;
+guessing at an install is how you end up with two daemons on one socket. Report what is missing and
+let the user install it.
+
+## 2. Mount the bridge MCP — merge, never overwrite
+
+The project's `.mcp.json` may already declare servers. **Read it first and merge**; clobbering
+someone's existing MCP config is not a recoverable mistake.
+
+```bash
+cat .mcp.json 2>/dev/null || echo "(no .mcp.json yet)"
+```
+
+The entry to add, exactly:
+
+```json
+{
+  "mcpServers": {
+    "bridged": {
+      "type": "http",
+      "url": "http://127.0.0.1:8765/mcp"
+    }
+  }
+}
+```
+
+If `.mcp.json` already exists, add only the `bridged` key and leave every other server untouched.
+If a `bridged` entry is already there with a different URL, **ask** rather than assuming yours is
+right — a non-default port usually means a deliberate second daemon.
+
+> **If this plugin is installed, you can skip this step entirely.** The plugin ships its own
+> `.mcp.json`, so `bridged` is already mounted for any session with the plugin enabled. Write the
+> project-level file only when the user wants the mount to work *without* the plugin — for
+> teammates who have not installed it, or for CI.
+
+**Before writing it, settle whether `.mcp.json` is committed here:**
+
+```bash
+git ls-files --error-unmatch .mcp.json 2>/dev/null && echo "TRACKED" || echo "untracked"
+```
+
+A tracked `.mcp.json` is inherited by every checkout of this repo — including git worktrees the
+bridge provisions for workers. Servers bound to *your* machine (an IDE index, a local language
+server) will then be mounted by workers too, and every path they return points into **your**
+checkout rather than the worker's. That failure is silent and expensive: it has produced a worker
+that made all of its edits in the wrong tree while its builds passed, because it was building the
+tree it was not editing. Keep machine-local servers out of a tracked `.mcp.json`, or keep the file
+untracked.
+
+## 3. Standard project settings
+
+Create or merge `.claude/settings.json`. These are defaults, not requirements — keep anything the
+project already set.
+
+```json
+{
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
+  "permissions": {
+    "allow": [
+      "mcp__bridged__bridge_whoami",
+      "mcp__bridged__bridge_list",
+      "mcp__bridged__bridge_status",
+      "mcp__bridged__bridge_profiles",
+      "mcp__bridged__bridge_poll"
+    ]
+  }
+}
+```
+
+Only the **read-only** bridge verbs are pre-allowed. `bridge_spawn`, `bridge_send`, and
+`bridge_stop` start processes, deliver work, and tear down terminals — those stay behind a prompt
+on purpose. Do not "helpfully" add them.
+
+Never write `settings.local.json` on the user's behalf; that file is personal and usually
+gitignored.
+
+## 4. Credentials — by reference only
+
+The bridge takes every secret from the **environment**, and the daemon's config names the variable
+rather than holding the value. Your job is to tell the user which variables to export, not to
+collect or store them.
+
+| Variable | Needed for | Notes |
+|---|---|---|
+| `BRIDGED_WORKER_TOKEN` | authenticating a worker to the daemon | only when the daemon is configured with `tokenEnv` |
+| `GITEA_TOKEN` / equivalent | letting a worker open its own PR | **minimal `write:repository` scope** — see below |
+| `GITEA_HOST` | the forge base URL | no secret; safe anywhere |
+
+Two rules to state plainly to the user:
+
+- **The PR token must not be able to merge.** A worker opens a PR; the primary is the gate. A token
+  that can merge makes the gate decorative. Mint a narrow, repo-scoped token — never reuse a
+  personal admin token.
+- **Never set `ANTHROPIC_BASE_URL` or `ANTHROPIC_AUTH_TOKEN`** in this project, this shell, or any
+  settings file. The primary stays on subscription; only the daemon moves a *worker* off it, at
+  spawn. Mounting the bridge must never move a session across that boundary — if setup appears to
+  need this, something is wrong and you should stop and say so.
+
+Write none of these into any file. Show the user the `export` lines to run themselves.
+
+## 5. Verify — and do not trust a green health check
+
+Reconnect MCP if needed (`/mcp`), then confirm the tools are live and this session is the primary:
+
+```
+bridge_whoami
+```
+
+- `{"role":"primary"}` — correct, you are done with this step.
+- `{"role":"worker", …}` — **this is the trap.** If the primary runs inside a herdr pane, the
+  daemon resolves it to a terminal and classifies it as a worker, refusing `spawn`/`send`/`stop`:
+  every verb an orchestrator exists to call. It is **self-locking**, because the daemon can only
+  *learn* the primary's terminal from those same refused calls. The only way out is an
+  operator-set pin in the daemon's config:
+
+  ```yaml
+  primary:
+    terminal: term_xxxxxxxxxxxx     # the terminalId bridge_whoami just reported
+  ```
+
+  The daemon reads this **at boot**, so it needs a restart. Re-pin whenever the primary moves
+  panes — a stale pin fails exactly as silently as no pin.
+
+Then prove the fleet actually works, with a real spawn:
+
+```
+bridge_profiles                       → the configured backends
+bridge_spawn{profile: "<one of them>"} → must reach state "ready"
+bridge_stop{paneId: "<from spawn>"}
+```
+
+**`/healthz` reporting `ok` is not evidence that spawning works.** It reports that the daemon can
+reach herdr — nothing more. A version mismatch between the daemon's adapter and the herdr binary
+leaves health green while every single spawn fails. Only a real spawn proves the fleet. Do this
+even when everything above looked fine.
+
+## 6. Optional — Codex parity
+
+Only if the user wants Codex and Claude Code to share instructions, skills, and MCP config:
+
+```bash
+npm install -g ai-config-sync-manager
+ai-config-sync connect
+ai-config-sync status              # compare both hosts
+ai-config-sync sync --dry-run      # preview — always look before applying
+ai-config-sync sync --apply
+```
+
+It maps `~/.claude/CLAUDE.md` ↔ `~/.codex/AGENTS.md`, `~/.claude/skills/` ↔ `~/.codex/skills/`, and
+Claude's MCP servers ↔ `[mcp_servers.*]` in `~/.codex/config.toml`.
+
+**Raise the boundary before running it.** That sync is *user-level* and bidirectional, while the
+bridge deliberately isolates each worker's tool surface (§2). Syncing your MCP servers into
+`~/.codex/config.toml` gives every Codex session your machine-local servers — the same
+wrong-tree failure as §2, in a different runtime. Use the sync for the two CLIs *you* drive
+interactively; leave anything the bridge spawns isolated. Always `--dry-run` first.
+
+## 7. Report
+
+State plainly:
+
+```
+prereqs:   herdr <version> · bridged <protocol> · ccs <version> · codex <version|absent>
+written:   <files created or merged, or "none">
+role:      <bridge_whoami result — and the pin, if one was needed>
+spawn:     <real spawn result: profile, state reached, torn down>
+env:       <variables the USER still needs to export — names only, never values>
+skipped:   <anything not done, and why>
+```
+
+Never report a step as done that you did not verify. If the daemon was unreachable, say so and stop
+— the remaining steps cannot be checked, and guessing at them is how a broken setup gets called
+finished.
Author	SHA1	Message	Date
Dai Ha	37b4031ca4	CB-553: enforce maxLoad on explicit-profile spawns (no cap bypass) CI / build (pull_request) Successful in 56s Details CI / contract (pull_request) Successful in 1m16s Details	2026-08-13 21:12:32 +02:00
ltms	91c9f981c5	Merge CB-548 send ownership and rendezvous hardening CI / build (push) Successful in 1m16s Details CI / contract (push) Successful in 1m17s Details	2026-08-13 19:44:02 +02:00
Dai Ha	dd906526c0	CB-548: guard primary singleton to PRIMARY callers; open waiter before enqueue CI / contract (pull_request) Successful in 42s Details CI / build (pull_request) Successful in 53s Details Fix two handler-level bugs found in PR #21: - Only PRIMARY callers may update PrimaryRegistry.record (the legacy singleton 'primary' fallback for no-delegation inbox nudges). An architect SEND previously recorded its terminal as the fallback; the per-target delegation map does not cure the singleton. New BridgeMcp.recordPrimarySingleton uses the resolved role (caller.isPrimary()) — named leads (PRIMARY) still record, architects never do. - MessageService.send now opens the rendezvous waiter BEFORE queueing delivery, fixing both the enqueue-before-open fast-reply race (a fast reply no longer orphans into the inbox) and callback-failure ordering: a throwing onAccepted (public callback) fails the send cleanly with no stale waiter and no queued, orphanable message. Tests: architect SEND vs lead SEND primary-singleton regression; throwing onAccepted leaves no stale waiter or queued orphan.	2026-08-13 19:42:48 +02:00
Dai Ha	ec3001796a	CB-548: record delegator ownership only when a send is accepted Record PrimaryRegistry delegator ownership via a MessageService accepted-delivery hook (won the session lock + queued delivery), never at bridge_send request time, so a concurrent sender that times out BUSY cannot steal a live turn's reply routing. Make Rendezvous.open atomic fail-if-present so a double open trips loudly instead of replacing the waiter another send is blocked on. Answering a bridge_ask keeps the same ownership (no rewrite). Adds ownership/rendezvous regression tests.	2026-08-13 19:42:48 +02:00
ltms	86cf4c285a	CB-547b: opencode session identity — resume (-s) + post-hoc discovery (#18 ) CI / build (push) Successful in 48s Details CI / contract (push) Successful in 1m17s Details	2026-08-13 19:41:06 +02:00
Dai Ha	cd18887b69	CB-547b: opencode session identity — resume (-s) + post-hoc session discovery CI / contract (pull_request) Successful in 42s Details CI / build (pull_request) Successful in 1m16s Details	2026-08-13 19:40:17 +02:00
ltms	4637c68295	CB-543: neutralize worktree-hostile tracked configs (#22 ) CI / build (push) Successful in 55s Details CI / contract (push) Successful in 1m14s Details	2026-08-13 19:39:54 +02:00
Dai Ha	0114bd1fa7	CB-543: neutralize tracked opencode.json and .autoenv in provisioned worktrees CI / contract (pull_request) Successful in 45s Details CI / build (pull_request) Successful in 1m26s Details	2026-08-13 19:30:19 +02:00
ltms	6dee84ca71	Merge CB-548 architect config and authorization foundation CI / build (push) Successful in 57s Details CI / contract (push) Successful in 1m17s Details	2026-08-13 18:33:11 +02:00
Dai Ha	f004a0c654	CB-548: make duplicate-architect-slot detection top-level-only and depth-safe CI / contract (pull_request) Successful in 42s Details CI / build (pull_request) Successful in 1m13s Details	2026-08-13 18:31:29 +02:00
Dai Ha	6123576c68	CB-548: correct architect premise — profile-only slots, registry-owned bindings, dup-key rejection CI / build (pull_request) Successful in 54s Details CI / contract (pull_request) Successful in 1m6s Details	2026-08-13 18:05:53 +02:00
Dai Ha	21cfc09f8e	CB-548: config-declared architect slots + Role.ARCHITECT authz CI / build (pull_request) Successful in 55s Details CI / contract (pull_request) Successful in 1m6s Details	2026-08-13 17:28:14 +02:00
ltms	509530e235	CB-547a: peer-neutral session-identity contract + Claude Code adapter (#17 ) CI / build (push) Successful in 1m0s Details CI / contract (push) Successful in 1m2s Details	2026-08-13 16:56:32 +02:00
Dai Ha	d146a01422	CB-547a: peer-neutral session-identity contract + Claude Code adapter CI / contract (pull_request) Successful in 44s Details CI / build (pull_request) Successful in 1m31s Details	2026-08-13 16:43:47 +02:00
Dai Ha	91332723db	Bump wiki to 8c63db5 — the CB-539/CB-542 docs CI / build (push) Successful in 1m18s Details CI / contract (push) Successful in 1m52s Details Pairs with `244fbd9`. The docs half lived on the submodule's own remote, so the pointer bump is separate by necessity, not by preference. The substantive part is not the new 'Run a worker on the subscription' entry but the correction beside it: 'Give workers a toolchain' asserted flatly that an env: entry cannot repoint a worker past the SubscriptionGuard. CB-539 made that false, and the wiki went on claiming it until CB-542 closed the hole. The entry now states the rule and its one exception together.	2026-08-13 15:32:48 +02:00
ltms	244fbd98a5	Merge CB-539 + CB-542: subscription profiles, with the env: bypass closed CI / contract (push) Successful in 40s Details CI / build (push) Successful in 50s Details Verified by the lead in a clean worktree at `5afe8e1` rather than on the worker's report: Tests run: 474, Failures: 0, Errors: 0, Skipped: 0, BUILD SUCCESS (main was at 464). The invariant this lands: there is no configuration in which a worker reaches an Anthropic endpoint that no guard vetted. Closed at two layers — a fatal, profile- naming refusal at config load, and a launcher-side strip so it holds for profiles built in code that never passed validation. The wiki half is a separate branch on the submodule's own remote; the pointer bump follows as its own commit on main.	2026-08-13 15:31:51 +02:00
Dai Ha	5afe8e14d9	CB-542: close the subscription env: bypass, and fix the env: env-carries-anthropic docs CI / contract (pull_request) Successful in 44s Details CI / build (pull_request) Successful in 51s Details	2026-08-13 15:26:20 +02:00
Dai Ha	73f6b12dd8	CB-539: let a worker profile run on the subscription, explicitly Add a per-profile subscription: true opt-in that lets a claude-code worker run on the operator's Claude subscription when there is no off-subscription endpoint for it (e.g. sonnet on ccs). When set, the launcher injects neither ANTHROPIC_BASE_URL nor ANTHROPIC_AUTH_TOKEN and skips SubscriptionGuard's base_url requirement for that profile only, logging a WARN naming the profile. subscription: true alongside a baseUrl is refused as contradictory. The default (absent/false) keeps today's hard refusal unchanged; every other profile stays allowlist-checked and SubscriptionGuard is untouched.	2026-08-13 15:15:14 +02:00
Dai Ha	793f2e7157	Revert "Commit .autoenv" — it wedges every worker spawn CI / build (push) Successful in 53s Details CI / contract (push) Successful in 1m24s Details Regression I introduced one commit ago, caught by two consecutive spawn failures and reproduced end-to-end. Tracking `.autoenv` means git checks it out into every provisioned worktree. A worktree is a new path, and autoenv authorizes by path, so the file is always unauthorized there — autoenv prints "[autoenv] Authorize this file? (y/n/d)" and blocks on `read` (activate.sh:211-222). The pane's shell sits at that prompt, so `ccs <profile>` never runs, the peer never becomes injectable, and CB-306's readiness gate closes the pane after 20s. Symptom is a bare "spawn timed out"; nothing names autoenv, which is what made it worth writing down. Confirmed rather than inferred: the peer lead's cb-537 worker, spawned BEFORE `f8182e4`, has no `.autoenv` in its worktree and is still alive; a throwaway worktree at HEAD reproduces the prompt on entry. The file is still worth committing — the reasoning in `f8182e4` stands, and it is recoverable from there. What is missing is the other half: GitWorktrees already neutralizes `.mcp.json` in a provisioned worktree ("worker tool surface is launcher-mounted only"), and `.autoenv` needs exactly the same treatment for exactly the same reason — a worker's environment is launcher-supplied, never repo-supplied. Re-land it with that, tracked as CB-543. Rejected the quicker fix of exporting AUTOENV_ASSUME_YES: it auto-approves arbitrary repo-controlled shell code in every spawned worker, which is a worse trade than one unset variable.	2026-08-13 15:07:59 +02:00
Dai Ha	cf48983046	Merge CB-538: opencode peers launch with --auto CI / contract (push) Successful in 50s Details CI / build (push) Successful in 1m30s Details A spawned peer has no human at its pane, so an approval prompt is not a pause — it is a wedge. The agent stops, looks identical to a legitimate mid-turn wait, and can never reach its bridge_reply, so the delegation dies silently and the lead learns nothing until the timeout. Unconditional rather than a per-profile knob, which is the right call: there is no configuration under which a bridge-spawned opencode worker WANTS to block on an approval it has no way to answer. opencode's help calls --auto 'dangerous!', and that warning is written for a human at a terminal; the blast radius here is already bounded by the layer above — a worker runs in its own git worktree, on its own branch, off-subscription, and cannot merge. The lead is the gate. Reviewed by me rather than fanned out: 24 lines across one method and its two tests, below the threshold where a reviewer pass pays for itself. argvWithModel is re-signatured to take composed argv instead of building it, so the two flag-appenders compose rather than each owning construction.	2026-08-13 15:03:59 +02:00
Dai Ha	d038516750	Bump wiki to 0a21b49 — multi-lead arc, and opencode's secret supply CI / build (push) Successful in 53s Details CI / contract (push) Successful in 1m48s Details Moves the submodule pointer 4320c1c -> 0a21b49, matching the docs to the code in `bc13b8e` rather than leaving chapter 11 describing a fleet with one lead in it. 7b5381b 11, 7: CB-530..536 — leaders:, leadScan:, lead-to-lead messaging, lead deliverability, leads in bridge_list; 7's copy of the portable block re-synced byte-identically 0a21b49 12: where opencode's secrets actually come from, and why {env:...} is green under Claude Code and broken in a terminal Both are already pushed to the wiki's own remote, so this pointer resolves for anyone who clones — the ordering that matters, and the reason the wiki went first. This is the pointer only. `wiki/` is a submodule with its own remote and its content is never committed here; bumping the recorded SHA in its own commit is how this repo has always recorded a docs update (see "bump wiki to 4320c1c").	2026-08-13 10:44:38 +02:00
Dai Ha	f8182e4514	Commit .autoenv — the loader that keeps Claude Code on one secret store This file has always been designed to be committed and says so in its own header; it simply never was, so every clone of this workspace has been reconstructing it by hand or duplicating tokens instead. It holds no secret. It reads `.secrets/` (gitignored, 0600) and exports three variables, because Claude Code expands `${VAR}` in `.mcp.json` from the process environment and cannot read a file — so without it, CONTEXT7_TOKEN and the gitea pair must be duplicated as literals in `.claude/settings.local.json`. opencode needs none of this: it reads `.secrets/` directly via `{file:...}`. Verified before committing that no value appears in it, only the three names and the paths they are read from. Safe in a worktree by construction: a worktree receives tracked files only, so `.secrets/` is absent there and the whole block is skipped rather than failing. Workers are fed by the launcher's env instead — which is where the name mismatch documented in wiki chapter 12 (GITEA_TOKEN vs GITEA_ACCESS_TOKEN) has to be reconciled.	2026-08-13 10:44:21 +02:00
Dai Ha	bc13b8e92c	CB-530..536, CB-538 groundwork: leads as peers, and a fleet that can find itself Two leads now work as peers rather than one primary plus workers. The arc: CB-530/531 lead identity: `leaders:` names panes, `leadScan:` discovers them by tab label (LeadTabScanner, TTL-cached, worker spaces excluded). CB-532 leads can message each other AND be answered. Principal.leader now carries its terminal, so ownsSession() can be true for a lead; the "and you must be a worker" conjunct beside it protected nothing. Retires `primary:` — reply nudges follow the delegating lead, a binding recorded at bridge_send where both halves are known. CB-533 ClaudeCodeLauncher passes --model. argv is usually a wrapper (`ccs <profile>`) that re-exports its own model family, so ANTHROPIC_MODEL alone was silently overruled. CB-534 a lead is deliverable. The CB-113 readiness gate only opened for terminals in WorkerPresence, which only workers ever enter, so every lead->lead send waited out the ~60s grace and failed having never been typed. The gate guards a spawned peer's boot window; a lead is never spawned. CB-535 bridge_list returns `leads` alongside `workers`, with `self` on the caller's row. An empty worker roster no longer reads as "no peers". CB-536 CLAUDE.md: lead<->lead is coordinate-only, never sideways delegation. Propagated byte-identically to wiki/7-Use-Cases.md. MIXED PROVENANCE — recorded deliberately rather than hidden. This tree also carries in-progress CB-537 (context separation) authored by the peer lead gpt-sol-5.6 and its worker: Capability.CONTEXT_RESET, SessionManager.clearAfterTurn, and the Injector/TurnListener/CompletionResolver/launcher changes around it. That work was done in this shared working tree rather than a worktree, and is entangled with the above in BridgedConfig.java, Bridged.java and ClaudeCodeLauncher.java, so neither lead could stage its own half without sweeping in the other's. Committing the whole green state is the honest resolution; the peer branches from here. Note for whoever picks CB-537 up: the design in this commit is SUPERSEDED. Both leads agreed to replace the global `clearAfterTurn` boolean with per-delivery policy (inherit\|fresh\|thread) applied PRE-delivery, because a post-turn reset races by construction — Injector.onStatus clears awaitingCompletion and dequeues the next message in the same tick. `fresh` is also a correctness guarantee, so an adapter without a reset capability must refuse it rather than log a no-op. mvn clean install: Tests run: 464, Failures: 0, Errors: 0, Skipped: 0. BUILD SUCCESS.	2026-08-13 09:38:24 +02:00
Dai Ha	fbe79258bf	CB-538: opencode peers launch with --auto	2026-08-13 07:19:19 +02:00
Dai Ha	ef1e014b41	CB-527: ship the bridge as an installable Claude Code plugin CI / build (push) Successful in 1m0s Details CI / contract (push) Successful in 1m21s Details The orchestration contract had no distributable form. Every consuming project hand-copied a block of CLAUDE.md and hand-wrote an .mcp.json, and we keep a script whose only job is to notice those copies drifting apart. A plugin is versioned, installed once, and updates in place. Ships no credentials, deliberately: every secret is referenced by environment variable NAME and the value never enters a file, which is what makes the artifact safe to publish. The setup skill states the two rules that are easy to get wrong for the right-sounding reasons — the PR token must not be able to merge (a worker opens, the primary gates), and ANTHROPIC_BASE_URL must never be set by setup, because mounting the bridge must not move a session off subscription. The plugin root is plugin/, not the repo root. An installed plugin's .mcp.json is a committed file, while this repo's root .mcp.json is local-only and --skip-worktree; rooting the plugin at the repo would commit the primary's IDE servers and hand them to every worker — the exact failure CB-525 exists to prevent. Scope is client-side setup only. herdr and bridged stay separate services with their own lifecycles, and the skill refuses to install them rather than guess. It also refuses to accept /healthz as proof: health reports only that the daemon can reach herdr, and CB-521 showed it staying green while every spawn failed, so verification ends with a real spawn. Both manifests pass `claude plugin validate --strict`.	2026-08-10 19:55:17 +02:00
Dai Ha	e3c8393d1b	CB-527: retire the ollama profile from the worker choice The ollama backend is decommissioned, so the example config stops pointing readers at a dead host and the guard allowlist stops carrying an entry with no profile behind it — a stale entry there is dead permission, and that list is the only thing keeping a worker off the primary's subscription. The second illustrative profile survives as gx11: the example exists to show `placement: weighted` having something to choose between, and a one-profile example would quietly stop demonstrating that. It also moves the CB-523 auto-compact override onto the surviving profile. That guard had been attached to `ollama` alone, so retiring the profile would have removed the fleet's only protection against the failure it was written for — a worker whose prompt is rejected before auto-compact ever fires. The window belongs on every profile, not on whichever one happened to hit it.	2026-08-10 19:55:17 +02:00
kevin	379e03f9d0	CB-308: fold in the adversarial review; bump wiki to 4320c1c CI / build (push) Successful in 59s Details CI / contract (push) Successful in 1m16s Details Four new resolved decisions (§7.7-7.10): turn state split by where the signals are, with ABANDONED explicitly belt-and-braces over the waiter timeout; the dual ack model with spawn idempotence by construction (gid stored IN the herdr pane — the load-bearing detail of the no-ledger position — plus an in-flight reservation for redelivery during a slow spawn); enforced publish semantics (confirms + mandatory on a separate channel, return-before-confirm caveat); queue lifecycle = session lifecycle with .v2 names for the redeclare hazard. §8 reworked: global id scheme resolved and moved up; control authorization sharpened into the hard gate on U4 (per-host allowlist beside the peer keys); key distribution/rotation added. New §9: implementation order, each step verifiable single-host, U4 gated, U8 last. Wiki pointer bumped to 4320c1c (chapter 10 same-pass changes). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013ZGgxLQ2VpwZhEYoru8rkf	2026-08-10 22:32:00 +07:00
kevin	e13921aa8a	CB-308: resolve the cross-host design review; bump wiki to 36bb865 CI / build (push) Successful in 54s Details CI / contract (push) Successful in 1m5s Details Six decisions recorded in §7, replacing the matching open questions: signed messages (identity from the key, extending identity-from-connection across the broker), target-host-owned profiles advertised via presence, repo provisioning by pinned forge clone, live-only asks with TTL + TOO_LATE notice, spawn-id dedup on the target, and broker-outage semantics (local unaffected, remote fails fast, gateway stays soft-state). §8 keeps what is genuinely still open, with control authorization now separated from the resolved authenticity. The broker-level half (U8 broadcast, exclusive consumers, inbox caps, TLS, schema version, trace id) lands in wiki chapter 10 §10 — pointer bumped (also picks up 1710a77, chapter 11 Features). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013ZGgxLQ2VpwZhEYoru8rkf	2026-08-10 21:54:30 +07:00