fleetd #722: reconcile presence that arrives before a session's registry entry

A member whose MCP contact lands between launcher.spawn() and registry.put()
had its presence marked, but the SPAWNING -> READY transition that markPresent
triggers found no registry entry yet and silently did nothing. The mark then
persisted while registration left the session in SPAWNING, with nothing to
retry the transition. That left the session undeliverable to reclaim/seat
accounting even though it was present and deliverable.

Add SessionManager.reconcilePresence, called right after registry.put in both
the plain-spawn and worktree-spawn paths, to retry the transition for a
terminal already marked present. One private helper serves both call sites.

Tests cover both orderings (contact-then-register and register-then-contact)
for both spawn paths, plus a terminal never marked present staying in
SPAWNING. The contact-then-register tests use a new PresenceRacingLauncher
test double that marks presence from inside spawn(), before acquire()'s own
registry.put runs.

CLAUDE.md

@@ -27,31 +27,26 @@ through its `fleet_*` tools. No session addresses a peer, a broker, or the netwo
 **Every role reads this file.** A member runs in a git worktree of this same repo, so it inherits
 this `CLAUDE.md` verbatim, and every rule below is role-conditional.
 
-**Call `fleet_whoami`.** It returns `primary`, `worker`, `architect`, `collaborator`, or `observer`,
-resolved by the daemon from your connection — unforgeable, and the same resolution its authorization
-gate uses. A worker also carries its `sessionId`, `profile`, `worktree` and `branch`; an architect
-carries the slot name it was bound to; a collaborator carries its registry name and its own
-`sessionId`, and **no `leader` key** — a collaborator is a named peer, not a primary. An **observer**
-carries only its own `sessionId`: a pane the daemon could not place as any of the above, authorized
-to `READ`/`METRICS` and to `REPLY`/`ASK` on its own pane and nothing more — never `SEND`, never a
-ticket. Don't infer what you can ask.
+**Call `fleet_whoami`.** It returns `primary`, `worker`, `architect`, or `collaborator`, resolved by
+the daemon from your connection — unforgeable, and the same resolution its authorization gate uses.
+A worker also carries its `sessionId`, `profile`, `worktree` and `branch`; an architect carries the
+slot name it was bound to; a collaborator carries its registry name and its own `sessionId`, and
+**no `leader` key** — a collaborator is a named peer, not a primary. Don't infer what you can ask.
 
 Only if that call is unavailable, fall back to these — each is one-way, so keep reading until one
 fires: the reply charter in your system prompt (*"You are a spawned member in the
 claude-bridge fleet"*) ⇒ **spawned member**; fleet tools prefixed `mcp__fleet__*` ⇒ **spawned
 member** (the launcher fixes that mount name; a primary's mount is named by whoever wrote its
 `.mcp.json`, so it varies — and a member spawned before CB-632 still says `mcp__bridge__*`); `ANTHROPIC_BASE_URL` set ⇒ **spawned member** (Claude-model members run
-on a clean env, so its *absence* proves nothing). None of these separate a worker from an architect,
-or a worker from an **observer** — an observer is just as unspawned as a collaborator and carries
-none of these signals either, so only `fleet_whoami` tells the two apart. **And none of them fires
-for a collaborator at all**: every signal in the ladder detects a *spawned* member, while a
-collaborator is a tab a person opened by hand, so it has no charter, no fixed mount name and a
-normal environment. A collaborator — or an observer — that cannot call `fleet_whoami` therefore falls
-to the line below and acts as a worker. That is the safe direction — it under-privileges, and the
-refusals are loud — but it means a collaborator or an observer has no way to learn what it is except
-by asking. **Still unsure ⇒ act as a worker**, the most restricted member role this ladder can name.
-The two mistakes are not symmetric: a primary acting as a worker is refused by the authorization gate
-— loud and self-correcting — while a member acting as the primary ends its turn with no `fleet_reply`,
+on a clean env, so its *absence* proves nothing). None of these separate a worker from an architect —
+only `fleet_whoami` does. **And none of them fires for a collaborator at all**: every signal in the
+ladder detects a *spawned* member, while a collaborator is a tab a person opened by hand, so it has
+no charter, no fixed mount name and a normal environment. A collaborator that cannot call
+`fleet_whoami` therefore falls to the line below and acts as a worker. That is the safe direction —
+it under-privileges, and the refusals are loud — but it means a collaborator has no way to learn
+what it is except by asking. **Still unsure ⇒ act as a worker**, the most restricted member role. The
+two mistakes are not symmetric: a primary acting as a worker is refused by the authorization gate —
+loud and self-correcting — while a member acting as the primary ends its turn with no `fleet_reply`,
 and the sender silently receives nothing. Fail toward the recoverable error.
 
 ### Invariants — every role, no exceptions

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -226,8 +226,9 @@ public final class Fleetd {
      * is the same way — a person's own tab, matched to a configured name, never spawned.
      *
      * <p>Neither a lead nor a collaborator is ever enrolled in {@link MemberPresence} — {@code
-     * FleetMcp} marks presence only for a worker, an architect, or the unconfigured-pane floor,
-     * never for a lead or a collaborator. So without the second and third disjuncts a lead or
+     * FleetMcp} marks presence for every spawned member (worker and architect), deliberately, since
+     * that map doubles as the member roster's availability signal and a lead or collaborator counted
+     * there would show up as an available member. So without the second and third disjuncts a lead or
      * collaborator is permanently un-deliverable: every send to one sat on the gate for
      * {@code READINESS_GRACE_POLLS} (~60s) and then failed having never been typed into the pane.
      *

fleetd/src/main/java/dev/ltms/fleet/auth/Authz.java

@@ -138,14 +138,13 @@ public final class Authz {
             // fleet_whoami — and carries no secrets: no ticket reply, no pending question, and no
             // other session's turn state. Those live under TASK_READ. METRICS is the separate
             // Prometheus scrape. Both are open to every authenticated role, including a
-            // collaborator and the unconfigured-pane floor.
+            // collaborator.
             case READ, METRICS -> caller.isPrimary() || caller.isWorker() || caller.isArchitect()
-                    || caller.isCollaborator() || caller.isObserver();
+                    || caller.isCollaborator();
 
             // Ticket polling and session status, open to every role READ is open to except a
-            // collaborator or an observer: ticket ids are a sequential counter with no owner
-            // check, so a holder could walk every ticket and read another session's delegation
-            // reply.
+            // collaborator: ticket ids are a sequential counter with no owner check, so a holder
+            // could walk every ticket and read another session's delegation reply.
             case TASK_READ -> caller.isPrimary() || caller.isWorker() || caller.isArchitect();
 
             // fleetd #421: reading held lead-to-lead mail is the primary's alone. An architect

fleetd/src/main/java/dev/ltms/fleet/auth/CallerResolver.java

@@ -40,7 +40,7 @@ import java.util.function.Supplier;
  *       the case the previous step does not catch: a binding with no live spawned-member session.</li>
  *   <li>A loopback peer PID that maps to an operator-labelled collaborator tab ⇒
  *       {@link Role#COLLABORATOR}, carrying that collaborator's name.</li>
- *   <li>A loopback peer PID that maps to any other herdr pane ⇒ {@link Role#OBSERVER}. This is
+ *   <li>A loopback peer PID that maps to any other herdr pane ⇒ {@link Role#WORKER}. This is
  *       unforgeable (the OS reports the PID, herdr owns the PID→pane map) and is honoured
  *       regardless of auth mode, so enabling auth never breaks the fleet.</li>
  *   <li>Otherwise, under {@code token} mode, a valid bearer token ⇒ {@link Role#PRIMARY}.</li>
@@ -323,7 +323,7 @@ public final class CallerResolver {
                 // of the above keeps that stronger role.
                 return Principal.collaborator(collaborator, c.terminal(), c.pid());
             }
-            return Principal.observer(c.terminal(), c.pid()); // unforgeable; never token-gated
+            return Principal.worker(c.terminal(), c.pid()); // unforgeable; never token-gated
         }
 
         if (tokenMode) {

fleetd/src/main/java/dev/ltms/fleet/auth/Principal.java

@@ -88,13 +88,6 @@ public record Principal(Role role, String terminal, long pid, String name) {
         return new Principal(Role.COLLABORATOR, terminal, pid, name);
     }
 
-    /**
-     * The unconfigured-pane floor: a loopback caller whose pane matched no other role.
-     */
-    public static Principal observer(String terminal, long pid) {
-        return new Principal(Role.OBSERVER, terminal, pid);
-    }
-
     public boolean isPrimary() {
         return role == Role.PRIMARY;
     }
@@ -111,15 +104,11 @@ public record Principal(Role role, String terminal, long pid, String name) {
         return role == Role.WORKER;
     }
 
-    public boolean isObserver() {
-        return role == Role.OBSERVER;
-    }
-
     /**
      * Whether this caller is a spawned member with its own pane.
      *
-     * <p>Both workers and architects are spawned members. A lead is not: it is a peer the
-     * operator started and named, never a pane this daemon spawned.
+     * <p>Both workers and architects are spawned members. A lead is excluded because recording it
+     * as present would count it as an available member in the roster.
      */
     public boolean isSpawnedMember() {
         return role == Role.WORKER || role == Role.ARCHITECT;
@@ -151,7 +140,6 @@ public record Principal(Role role, String terminal, long pid, String name) {
             case WORKER -> "worker:" + terminal;
             case ARCHITECT -> "architect:" + name;
             case COLLABORATOR -> "collaborator:" + name;
-            case OBSERVER -> "observer:" + terminal;
             case PRIMARY -> name == null ? "primary" : "leader:" + name;
             case ANONYMOUS -> "anonymous";
         };

fleetd/src/main/java/dev/ltms/fleet/auth/Role.java

@@ -45,17 +45,6 @@ public enum Role {
      */
     COLLABORATOR,
 
-    /**
-     * A loopback pane that resolved to none of the roles above: not a live spawned member, not a
-     * configured lead, not a bound architect slot, not a configured collaborator tab. Unforgeable
-     * like a worker's — derived from the connection's pane, never from a request argument, and
-     * honoured regardless of auth mode. May {@code READ} and {@code METRICS}, and {@code REPLY}/
-     * {@code ASK} only as its own pane; may not {@code SPAWN}/{@code STOP}/{@code DRAIN}/
-     * {@code HANDOVER}, {@code SEND}, poll a ticket ({@code TASK_READ}), or reach the coordination
-     * broker ({@code COORD_SEND}/{@code COORD_READ}).
-     */
-    OBSERVER,
-
     /** Authenticated as nothing. Authorized for nothing but {@code /healthz}. */
     ANONYMOUS
 }

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -334,7 +334,7 @@ public final class FleetMcp {
      * caller explicitly saying so — never by omitting a {@link CallerResolver} the way the old
      * {@code callers == null} idiom allowed. {@code callers} itself is required either way: even
      * under {@link #UNENFORCED}, the one real {@link CallerResolver} still resolves every caller's
-     * {@link Principal} (so {@code markTrackedCallerPresent}/{@code recordPrimarySingleton} see a
+     * {@link Principal} (so {@code markSpawnedMemberPresent}/{@code recordPrimarySingleton} see a
      * real identity), and {@link #denyFor} is the only thing that changes.
      */
     public enum AuthorizationMode { ENFORCED, UNENFORCED }
@@ -442,10 +442,10 @@ public final class FleetMcp {
                     // fall back to here — AuthorizationMode governs enforcement, not identity.
                     Principal p = callers.resolve(req.getRemoteAddr(), req.getRemotePort(),
                             req.getHeader("Authorization"));
-                    // Guards on the ROLE, not on the terminal being null — this marks presence for
-                    // a worker, an architect, or the unconfigured-pane floor, and excludes a lead
-                    // or a collaborator even though each carries its own pane too.
-                    markTrackedCallerPresent(p, presence);
+                    // CB-532: guard on the ROLE, not on the terminal being null. This excludes a
+                    // lead, which carries its pane too, while including every spawned member role.
+                    // Enrolling a lead would count it as an available member in the roster.
+                    markSpawnedMemberPresent(p, presence);
                     return McpTransportContext.create(Map.of(
                             CALLER_TERMINAL, orEmpty(p.terminal()),
                             CALLER_PID, Long.toString(p.pid()),
@@ -833,14 +833,9 @@ public final class FleetMcp {
         return identity;
     }
 
-    /**
-     * Mark a caller present for the injector readiness gate, when its deliverability depends on
-     * proving a live MCP contact: a worker, an architect, or the unconfigured-pane floor. A lead
-     * or a collaborator is excluded — each is already deliverable through its own named-registry
-     * entry.
-     */
-    static void markTrackedCallerPresent(Principal caller, MemberPresence presence) {
-        if (caller.isSpawnedMember() || caller.isObserver()) {
+    /** Mark a connected spawned member available for the injector readiness gate. */
+    static void markSpawnedMemberPresent(Principal caller, MemberPresence presence) {
+        if (caller.isSpawnedMember()) {
             presence.markPresent(caller.terminal());
         }
     }
@@ -1417,14 +1412,6 @@ public final class FleetMcp {
             }
             return text(json(m));
         }
-        if (caller.isObserver()) {
-            // No architect slot, collaborator name, or lead name to report — only the pane itself,
-            // so a peer that already knows this terminal can still address it.
-            if (caller.terminal() != null) {
-                m.put("sessionId", caller.terminal());
-            }
-            return text(json(m));
-        }
         if (!caller.isWorker()) {
             // CB-530: which lead, once more than one pane is configured as one. `role` deliberately
             // still reads "primary" — the fallback ladder in CLAUDE.md keys on it, and a lead IS a

fleetd/src/main/java/dev/ltms/fleet/session/SessionManager.java

@@ -255,6 +255,10 @@ public final class SessionManager implements TurnListener {
                         handle.id(), handle.terminalId(), resolvedProfile, actualRole, cwd, ownerTerminal, now, now, 0,
                         MemberSession.State.SPAWNING, null, null, handle.charterReceipt(), handle.agentSessionId());
                 registry.put(handle.id(), session);
+                // A presence contact that already arrived for this terminal found no registry
+                // entry to transition and gave up silently. Retry it now that one exists; remove
+                // this call and such a session stays in SPAWNING even though it is present.
+                reconcilePresence(handle.terminalId());
                 handles.put(handle.id(), handle);
                 log.debug("acquired session id={} terminal={} profile={} owner={}",
                         handle.id(), handle.terminalId(), session.profile(), session.ownerTerminal());
@@ -809,6 +813,10 @@ public final class SessionManager implements TurnListener {
                 handle.charterReceipt(),
                 handle.agentSessionId());
         registry.put(handle.id(), session);
+        // A presence contact that already arrived for this terminal found no registry entry to
+        // transition and gave up silently. Retry it now that one exists; remove this call and
+        // such a session stays in SPAWNING even though it is present.
+        reconcilePresence(handle.terminalId());
         handles.put(handle.id(), handle);
         log.debug("acquired worktree session id={} terminal={} profile={} branch={} path={}",
                 handle.id(), handle.terminalId(), session.profile(), session.branch(), session.worktree());
@@ -983,6 +991,20 @@ public final class SessionManager implements TurnListener {
         transitionByTerminal(terminalId, MemberSession.State.SPAWNING, MemberSession.State.READY);
     }
 
+    /**
+     * Completes a newly registered session's {@code SPAWNING -> READY} transition when {@code
+     * terminalId} was already marked present before this ran. A terminal never marked present is
+     * left in {@code SPAWNING}; it reaches {@code READY} normally through {@link #onReady} once
+     * its own contact arrives. Callers must run this only once the session's registry entry is
+     * already visible — {@link #onReady}'s transition matches against that entry, and reconciling
+     * before the entry exists finds nothing to transition.
+     */
+    private void reconcilePresence(String terminalId) {
+        if (terminalId != null && !terminalId.isBlank() && presence.isPresent(terminalId)) {
+            onReady(terminalId);
+        }
+    }
+
     /**
      * Lifecycle hook: a message was delivered into the worker — it is now busy on a turn.
      * The turn count is bumped and the activity timestamp is refreshed. A {@code DONE} session

fleetd/src/test/java/dev/ltms/fleet/auth/AuthzTest.java

@@ -15,7 +15,6 @@ class AuthzTest {
     private static final Principal ARCH_DESIGN = Principal.architect("lead-designer", "term_design", 400);
     private static final Principal ARCH_OTHER = Principal.architect("reviewer", "term_review", 500);
     private static final Principal COLLABORATOR = Principal.collaborator("ops", "term_collab", 600);
-    private static final Principal OBSERVER = Principal.observer("term_observer", 700);
 
     @Test
     void anonymousIsAuthorizedForNothing() {
@@ -267,49 +266,4 @@ class AuthzTest {
         assertTrue(WORKER_A.isSpawnedMember());
         assertTrue(ARCH_DESIGN.isSpawnedMember());
     }
-
-    // ── the observer matrix ─────────────────────────────────────────────────────────────────────
-
-    @Test
-    void anObserverMayReadAndScrapeMetrics() {
-        assertTrue(Authz.permits(OBSERVER, READ, null));
-        assertTrue(Authz.permits(OBSERVER, METRICS, null));
-    }
-
-    @Test
-    void anObserverMayReplyAndAskOnlyAsItsOwnPane() {
-        assertTrue(Authz.permits(OBSERVER, REPLY, "term_observer"), "its own pane is its own");
-        assertTrue(Authz.permits(OBSERVER, ASK, "term_observer"));
-
-        assertFalse(Authz.permits(OBSERVER, REPLY, "term_design"),
-                "an observer must not reply on another pane");
-        assertFalse(Authz.permits(OBSERVER, REPLY, null),
-                "an absent target must not pass the own-session rule");
-    }
-
-    /**
-     * Every action beyond READ/METRICS/REPLY/ASK, asserted denied for an observer — including
-     * {@code TASK_READ}, which is the entire point of this role: an unconfigured pane must not be
-     * able to poll a ticket or read another session's status.
-     */
-    @Test
-    void anObserverIsDeniedEverythingBeyondReadMetricsReplyAndAsk() {
-        for (Authz.Action a : Authz.Action.values()) {
-            if (a == READ || a == METRICS || a == REPLY || a == ASK) {
-                continue;
-            }
-            assertFalse(Authz.permits(OBSERVER, a, "term_observer", target -> true),
-                    "an observer must not " + a + " even when the classifier accepts every target");
-        }
-    }
-
-    @Test
-    void anObserverIsNotCountedAsAnyOtherRole() {
-        assertFalse(OBSERVER.isPrimary());
-        assertFalse(OBSERVER.isWorker());
-        assertFalse(OBSERVER.isArchitect());
-        assertFalse(OBSERVER.isCollaborator());
-        assertFalse(OBSERVER.isSpawnedMember());
-        assertTrue(OBSERVER.isObserver());
-    }
 }

fleetd/src/test/java/dev/ltms/fleet/auth/CallerResolverTest.java

@@ -57,23 +57,17 @@ class CallerResolverTest {
         return members;
     }
 
-    /**
-     * With no roster wired up at all (the simple constructor), a loopback pane that owns a herdr
-     * pane but is not recognised as a live spawned member lands on the {@link Role#OBSERVER} floor
-     * — unforgeable and never token-gated, exactly like a worker's own identity, because it comes
-     * from the same connection-derived pane mapping.
-     */
     @Test
-    void aLoopbackPaneWithNoLiveRosterResolvesToObserverRegardlessOfAuthMode() {
+    void aLoopbackWorkerPaneResolvesToWorkerRegardlessOfAuthMode() {
         Principal underTrust = new CallerResolver(workerIdentity()).resolve("127.0.0.1", 42, null);
         Principal underToken = new CallerResolver(workerIdentity(), true, "s3cret")
                 .resolve("127.0.0.1", 42, null);
 
-        assertEquals(Role.OBSERVER, underTrust.role());
+        assertEquals(Role.WORKER, underTrust.role());
         assertEquals("term_a", underTrust.terminal());
-        assertEquals(Role.OBSERVER, underToken.role(),
-                "the floor is unforgeable and must never be token-gated — otherwise enabling auth "
-                        + "would lock every unconfigured pane out of even READ");
+        assertEquals(Role.WORKER, underToken.role(),
+                "worker identity is unforgeable and must never be token-gated — otherwise enabling "
+                        + "auth would lock the whole fleet out of fleet_reply");
         assertEquals("term_a", underToken.terminal());
     }
 
@@ -97,20 +91,20 @@ class CallerResolverTest {
     }
 
     @Test
-    void otherPanesRemainAtTheFloorWhenAPinIsSet() {
+    void otherPanesRemainWorkersWhenAPinIsSet() {
         Principal p = CallerResolver.pinnedTo(workerIdentity(), false, null, "term_someone_else")
                 .resolve("127.0.0.1", 42, null);
 
-        assertEquals(Role.OBSERVER, p.role());
+        assertEquals(Role.WORKER, p.role());
         assertEquals("term_a", p.terminal());
     }
 
     /** The pin is optional config, so an absent or whitespace one must change nothing at all. */
     @Test
-    void aBlankPinLeavesFloorResolutionUntouched() {
-        assertEquals(Role.OBSERVER,
+    void aBlankPinLeavesWorkerResolutionUntouched() {
+        assertEquals(Role.WORKER,
                 CallerResolver.pinnedTo(workerIdentity(), false, null, "  ").resolve("127.0.0.1", 42, null).role());
-        assertEquals(Role.OBSERVER,
+        assertEquals(Role.WORKER,
                 CallerResolver.pinnedTo(workerIdentity(), false, null, null).resolve("127.0.0.1", 42, null).role());
     }
 
@@ -231,13 +225,13 @@ class CallerResolverTest {
      * mid-scan teardown into a refusal — the real match is still found and resolves as a worker.
      */
     @Test
-    void aHerdrErrorOnANonOwningPaneStillResolvesTheRealPane() {
+    void aHerdrErrorOnANonOwningPaneStillResolvesTheRealWorker() {
         FakeHerdr vanishedElsewhere = new FakeHerdr().processInfoFailsForPane("w2:p9", "pane_not_found");
         ConnectionIdentity id = new ConnectionIdentity(new PaneLocator(vanishedElsewhere), _ -> FakeHerdr.WORKER_PID);
 
         Principal p = new CallerResolver(id).resolve("127.0.0.1", 55555, null);
 
-        assertEquals(Role.OBSERVER, p.role());
+        assertEquals(Role.WORKER, p.role());
         assertEquals("term_a", p.terminal());
     }
 
@@ -281,12 +275,12 @@ class CallerResolverTest {
     }
 
     @Test
-    void aPaneAbsentFromTheRegistryFallsToTheObserverFloor() {
+    void aPaneAbsentFromTheRegistryIsStillAWorker() {
         Principal p = new CallerResolver(workerIdentity(), false, null,
                 Map.of("term_elsewhere", "gpt-sol-5.6"))
                 .resolve("127.0.0.1", 42, null);
 
-        assertEquals(Role.OBSERVER, p.role());
+        assertEquals(Role.WORKER, p.role());
         assertEquals("term_a", p.terminal());
         assertNull(p.name());
     }
@@ -312,16 +306,16 @@ class CallerResolverTest {
     }
 
     @Test
-    void anEmptyRegistryLeavesEveryPaneAtTheObserverFloor() {
+    void anEmptyRegistryLeavesEveryPaneAWorker() {
         Map<String, String> noLeads = null;
-        assertEquals(Role.OBSERVER,
+        assertEquals(Role.WORKER,
                 new CallerResolver(workerIdentity(), false, null, Map.of())
                         .resolve("127.0.0.1", 42, null).role());
-        assertEquals(Role.OBSERVER,
+        assertEquals(Role.WORKER,
                 new CallerResolver(workerIdentity(), false, null, noLeads)
                         .resolve("127.0.0.1", 42, null).role());
-        // And the same for the live-registry form, whose supplier may also be absent.
-        assertEquals(Role.OBSERVER,
+        // CB-531: and the same for the live-registry form, whose supplier may also be absent.
+        assertEquals(Role.WORKER,
                 CallerResolver.withLeads(workerIdentity(), false, null, null)
                         .resolve("127.0.0.1", 42, null).role());
     }
@@ -394,7 +388,7 @@ class CallerResolverTest {
         Map<String, String> live = new java.util.HashMap<>();
         CallerResolver r = CallerResolver.withLeads(workerIdentity(), false, null, () -> live);
 
-        assertEquals(Role.OBSERVER, r.resolve("127.0.0.1", 42, null).role());
+        assertEquals(Role.WORKER, r.resolve("127.0.0.1", 42, null).role());
 
         live.put("term_a", "gpt-sol-5.6"); // the scanner sees a newly-labelled tab
 
@@ -411,7 +405,7 @@ class CallerResolverTest {
 
         mutable.put("term_a", "sneaky");
 
-        assertEquals(Role.OBSERVER, r.resolve("127.0.0.1", 42, null).role());
+        assertEquals(Role.WORKER, r.resolve("127.0.0.1", 42, null).role());
     }
 
     // ── CB-548: architect slots ─────────────────────────────────────────────────────────────────
@@ -441,13 +435,13 @@ class CallerResolverTest {
     }
 
     @Test
-    void anUnboundPaneResolvesToTheObserverFloor() {
+    void anUnboundPaneStillResolvesAsAWorker() {
         MemberRegistry members = new MemberRegistry(new FleetConfig.Fleet(Map.of(),
                 Map.of("lead-designer", new FleetConfig.Slot("sonnet")), Map.of(), Map.of(), null));
         Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
                 Map::of, members).resolve("127.0.0.1", 42, null);
 
-        assertEquals(Role.OBSERVER, p.role());
+        assertEquals(Role.WORKER, p.role());
         assertNull(p.name());
     }
 
@@ -473,7 +467,7 @@ class CallerResolverTest {
         CallerResolver r = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
                 Map::of, members);
 
-        assertEquals(Role.OBSERVER, r.resolve("127.0.0.1", 42, null).role());
+        assertEquals(Role.WORKER, r.resolve("127.0.0.1", 42, null).role());
 
         assertTrue(members.bind("architect:lead-designer", "term_a")); // the later lifecycle binds the slot
 
@@ -500,13 +494,12 @@ class CallerResolverTest {
     }
 
     @Test
-    void aBoundNonArchitectSlotResolvesToTheObserverFloorNotArchitect() {
+    void aBoundNonArchitectSlotStillResolvesAsAWorker() {
         Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
                 Map::of, boundMembers("dev:builder", MemberRole.DEV))
                 .resolve("127.0.0.1", 42, null);
 
-        assertEquals(Role.OBSERVER, p.role(), "a dev binding must never grant architect rights, "
-                + "and this construction path wires no roster to recognise it as the live dev it is");
+        assertEquals(Role.WORKER, p.role(), "a dev binding must never grant architect rights");
     }
 
     @Test
@@ -517,17 +510,17 @@ class CallerResolverTest {
         assertThrows(IllegalArgumentException.class, () -> new CallerResolver(id, true, "  "));
     }
     @Test
-    void aPaneOnAnyLoopbackSourceAddressIsStillAtTheFloorNotThePrimary() {
-        // fleetd #305: the escalation this guards against. ConnectionIdentity used to accept only
-        // 127.0.0.1, so a pane connecting from 127.0.0.2 resolved to no terminal, and this
-        // resolver's own (wider) loopback check then made it the PRIMARY — granting spawn, stop,
-        // send and drain. Measured on the Linux fleet host: binding a source of 127.0.0.2 succeeds
-        // there, so the path is real and not theoretical.
+    void aWorkerOnAnyLoopbackSourceAddressIsStillAWorkerNotThePrimary() {
+        // fleetd #305: the escalation. ConnectionIdentity used to accept only 127.0.0.1, so a
+        // worker connecting from 127.0.0.2 resolved to no terminal, and this resolver's own
+        // (wider) loopback check then made it the PRIMARY — granting spawn, stop, send and drain.
+        // Measured on the Linux fleet host: binding a source of 127.0.0.2 succeeds there, so the
+        // path is real and not theoretical.
         CallerResolver r = new CallerResolver(workerIdentity(), false, null);
         for (String src : new String[]{"127.0.0.1", "127.0.0.2", "127.1.2.3", "::ffff:127.0.0.2"}) {
             Principal p = r.resolve(src, 55555, null);
-            assertEquals(Role.OBSERVER, p.role(), "the pane must stay off PRIMARY from source " + src);
-            assertEquals("term_a", p.terminal(), "pane terminal from source " + src);
+            assertEquals(Role.WORKER, p.role(), "a worker must stay a worker from source " + src);
+            assertEquals("term_a", p.terminal(), "worker terminal from source " + src);
         }
     }
 
@@ -833,14 +826,14 @@ class CallerResolverTest {
         assertEquals("term_a", p.terminal());
     }
 
-    /** Regression: an empty collaborator registry leaves every pane at the unconfigured-pane floor. */
+    /** Regression: an empty collaborator registry leaves every pane exactly as before. */
     @Test
-    void anEmptyCollaboratorRegistryLeavesEveryPaneAtTheObserverFloor() {
+    void anEmptyCollaboratorRegistryLeavesEveryPaneAsBefore() {
         Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null, Map::of,
                         new MemberRegistry(null), t -> null, Map::of)
                 .resolve("127.0.0.1", 42, null);
 
-        assertEquals(Role.OBSERVER, p.role());
+        assertEquals(Role.WORKER, p.role());
         assertNull(p.name());
     }
 
@@ -869,39 +862,6 @@ class CallerResolverTest {
         assertFalse(r.knownLeadOrCollaborator().test("term_other"));
     }
 
-    // ── fleetd #705: narrowing the unconfigured-pane floor to OBSERVER ──────────────────────────
-
-    /**
-     * The case this ticket exists for: a pane the resolver cannot place as a live spawned member,
-     * a lead, a bound architect slot, or a configured collaborator must land on the narrow
-     * {@link Role#OBSERVER} floor, never the {@link Role#WORKER} the old fallback granted.
-     *
-     * <p>The second assertion is the control the ticket requires: a terminal the roster DOES
-     * recognise as a live spawned member must still resolve its own role. Without it, this test
-     * would also pass if the fix accidentally turned every caller into an observer.
-     */
-    @Test
-    void anUnconfiguredPaneResolvesObserverButARegisteredMemberStillResolvesItsOwnRole() {
-        Principal unconfigured = new CallerResolver(workerIdentity()).resolve("127.0.0.1", 42, null);
-        assertEquals(Role.OBSERVER, unconfigured.role(),
-                "a pane matching none of the configured or live-roster roles must fall to the "
-                        + "floor, not WORKER");
-        assertEquals("term_a", unconfigured.terminal());
-
-        Principal registered = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                        Map::of, new MemberRegistry(null),
-                        t -> "term_a".equals(t) ? MemberRole.DEV : null, Map::of)
-                .resolve("127.0.0.1", 42, null);
-        assertEquals(Role.WORKER, registered.role(),
-                "control: a live spawned member must keep resolving its own role, never the "
-                        + "unconfigured-pane floor");
-    }
-
-    @Test
-    void describeNamesTheObserverByItsPane() {
-        assertEquals("observer:term_a", Principal.observer("term_a", 1).describe());
-    }
-
     @Test
     void knownLeadOrCollaboratorIsFalseForASpawnedMembersTerminal() {
         // The exact scenario a collaborator's SEND must never reach: a live spawned member's own

fleetd/src/test/java/dev/ltms/fleet/auth/MemberRegistryLiveTest.java

@@ -295,10 +295,9 @@ class MemberRegistryLiveTest {
         assertTrue(out.applied(), "the reload must actually take effect: " + out.summary());
 
         Principal after = resolver.resolve("127.0.0.1", 42, null);
-        assertEquals(Role.OBSERVER, after.role(),
-                "removing the slot from config must demote the bound session on its NEXT request — "
-                        + "this harness wires no live roster for term_a, so the demotion lands on "
-                        + "the unconfigured-pane floor");
+        assertEquals(Role.WORKER, after.role(),
+                "removing the slot from config must demote the bound session to worker on its "
+                        + "NEXT request — this is the ticket's whole point");
         assertEquals("term_a", after.terminal(), "same pane, same terminal — only the role changed");
     }
 

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpTest.java

@@ -1920,8 +1920,8 @@ class FleetMcpTest {
         Principal architect = Principal.architect("lead-designer", "term_design", 400);
         MemberPresence presence = new MemberPresence();
 
-        FleetMcp.markTrackedCallerPresent(worker, presence);
-        FleetMcp.markTrackedCallerPresent(architect, presence);
+        FleetMcp.markSpawnedMemberPresent(worker, presence);
+        FleetMcp.markSpawnedMemberPresent(architect, presence);
 
         assertTrue(presence.isPresent("term_worker"));
         assertTrue(presence.isPresent("term_design"));
@@ -1932,27 +1932,12 @@ class FleetMcpTest {
         Principal lead = Principal.leader("opus", "term_lead", 100);
         MemberPresence presence = new MemberPresence();
 
-        FleetMcp.markTrackedCallerPresent(lead, presence);
-        FleetMcp.markTrackedCallerPresent(Principal.anonymous(), presence);
+        FleetMcp.markSpawnedMemberPresent(lead, presence);
+        FleetMcp.markSpawnedMemberPresent(Principal.anonymous(), presence);
 
         assertFalse(presence.isPresent("term_lead"));
     }
 
-    /**
-     * The item whose absence would be silent: an observer's own MCP contact must still mark
-     * presence, or a pane resolving to the unconfigured-pane floor would sit on the injector
-     * readiness gate forever once something addresses it.
-     */
-    @Test
-    void anObserverContactMarksPresence() {
-        Principal observer = Principal.observer("term_observer", 800);
-        MemberPresence presence = new MemberPresence();
-
-        FleetMcp.markTrackedCallerPresent(observer, presence);
-
-        assertTrue(presence.isPresent("term_observer"));
-    }
-
     @Test
     void statusReportsLiveAgentStatus() {
         FakeHerdr blocked = new FakeHerdr().agentStatus("blocked");
@@ -2164,27 +2149,6 @@ class FleetMcpTest {
         assertTrue(leadOut.contains("\"leader\":\"opus\""), leadOut);
     }
 
-    /**
-     * An observer reports its own role and pane, never a {@code leader} key. Without an explicit
-     * branch it would reach the lead branch by elimination and look right only because the
-     * {@code leader} key is guarded on a non-null name — this pins the branch rather than the
-     * accident.
-     */
-    @Test
-    void whoamiReportsAnObserverNotALead() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw"));
-
-        McpSchema.CallToolResult res = FleetMcp.whoami(
-                Principal.observer("term_observer", 900), sessions);
-
-        assertNotEquals(Boolean.TRUE, res.isError());
-        String out = textOf(res);
-        assertTrue(out.contains("\"role\":\"observer\""), out);
-        assertTrue(out.contains("\"sessionId\":\"term_observer\""), out);
-        assertFalse(out.contains("leader"), out);
-    }
-
     /**
      * CB-548: an architect SEND delegates as its own pane (recording the per-target delegation) but
      * must NEVER become the legacy singleton "primary" fallback — the per-target map does not cure

fleetd/src/test/java/dev/ltms/fleet/rest/FleetAppAuthTest.java

@@ -8,7 +8,6 @@ import dev.ltms.fleet.auth.CallerResolver;
 import dev.ltms.fleet.auth.Authz;
 import dev.ltms.fleet.auth.MemberRegistry;
 import dev.ltms.fleet.auth.Principal;
-import dev.ltms.fleet.auth.Role;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.AgentControl;
@@ -21,7 +20,6 @@ import dev.ltms.fleet.metrics.FleetMetrics;
 import dev.ltms.fleet.metrics.Metrics;
 import dev.ltms.fleet.msg.MessageService;
 import dev.ltms.fleet.msg.Rendezvous;
-import dev.ltms.fleet.peer.MemberRole;
 import dev.ltms.fleet.session.FakeWorktrees;
 import dev.ltms.fleet.session.SessionManager;
 import dev.ltms.fleet.member.ClaudeCodeLauncher;
@@ -522,11 +520,6 @@ class FleetAppAuthTest {
      * As {@link #startOnSharedService(MessageService, FakeHerdr, long)}, but {@code leadTerminals}
      * resolves the given pid's terminal to a named lead (a caller with SEND permission) instead of
      * a plain worker, for a test that needs a terminal-bearing caller able to create a ticket.
-     *
-     * <p>Every connecting pane not already claimed by {@code leadTerminals} is wired into the live
-     * roster as a spawned worker, so a caller's resolved role matches what its own test expects:
-     * a {@link Role#WORKER}, never the unconfigured-pane {@link Role#OBSERVER} floor a roster-less
-     * resolver would otherwise fall to.
      */
     private Javalin startOnSharedService(MessageService messages, FakeHerdr herdr, long pid,
             Map<String, String> leadTerminals) {
@@ -541,8 +534,7 @@ class FleetAppAuthTest {
         SessionManager sessions = new SessionManager(workers, new FakeWorktrees());
         ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> pid);
         CallerResolver callers = CallerResolver.withLeadsAndMembers(identity, false, null,
-                () -> leadTerminals, new MemberRegistry(null),
-                t -> leadTerminals.containsKey(t) ? null : MemberRole.DEV, Map::of);
+                () -> leadTerminals, new MemberRegistry(null));
         Metrics appMetrics = FleetMetrics.create(sessions, new dev.ltms.fleet.msg.InMemoryReplyInbox());
 
         return new FleetApp(herdr, workers, sessions, messages, sessions.asPresence(), null,

fleetd/src/test/java/dev/ltms/fleet/session/PresenceRacingLauncher.java

@@ -0,0 +1,92 @@
+package dev.ltms.fleet.session;
+
+import dev.ltms.fleet.inject.MemberPresence;
+import dev.ltms.fleet.peer.Capability;
+import dev.ltms.fleet.peer.PeerHandle;
+import dev.ltms.fleet.peer.PeerLauncher;
+import dev.ltms.fleet.peer.SpawnRequest;
+import dev.ltms.fleet.placement.PlacementDecision;
+
+import java.util.List;
+import java.util.Set;
+
+/**
+ * {@link PeerLauncher} decorator that marks presence for a spawned terminal before returning its
+ * handle to the caller — the contact-then-register ordering fleetd #722 covers, where the
+ * terminal's MCP contact lands before {@link SessionManager#acquire} runs its own
+ * {@code registry.put}. The presence view is set after construction, via {@link #presence},
+ * because it is owned by the {@link SessionManager} this launcher is passed into.
+ */
+final class PresenceRacingLauncher implements PeerLauncher {
+
+    private final PeerLauncher delegate;
+    volatile MemberPresence presence;
+
+    PresenceRacingLauncher(PeerLauncher delegate) {
+        this.delegate = delegate;
+    }
+
+    @Override
+    public PeerHandle spawn(SpawnRequest req) {
+        PeerHandle handle = delegate.spawn(req);
+        presence.markPresent(handle.terminalId());
+        return handle;
+    }
+
+    @Override
+    public PeerHandle spawn(SpawnRequest req, PlacementDecision decision) {
+        PeerHandle handle = delegate.spawn(req, decision);
+        presence.markPresent(handle.terminalId());
+        return handle;
+    }
+
+    @Override
+    public Set<Capability> capabilities() {
+        return delegate.capabilities();
+    }
+
+    @Override
+    public Set<Capability> capabilitiesFor(String profileName) {
+        return delegate.capabilitiesFor(profileName);
+    }
+
+    @Override
+    public Set<String> profiles() {
+        return delegate.profiles();
+    }
+
+    @Override
+    public String defaultProfile() {
+        return delegate.defaultProfile();
+    }
+
+    @Override
+    public String effectiveCwd(SpawnRequest req) {
+        return delegate.effectiveCwd(req);
+    }
+
+    @Override
+    public List<String> parityOverlay(String profileName) {
+        return delegate.parityOverlay(profileName);
+    }
+
+    @Override
+    public List<?> list() {
+        return delegate.list();
+    }
+
+    @Override
+    public int reapOrphanWorkers() {
+        return delegate.reapOrphanWorkers();
+    }
+
+    @Override
+    public void stop(String id) {
+        delegate.stop(id);
+    }
+
+    @Override
+    public boolean clearContext(String id) {
+        return delegate.clearContext(id);
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/session/SessionManagerTest.java

@@ -422,6 +422,53 @@ class SessionManagerTest {
                 "turn completion moves BUSY → DONE");
     }
 
+    // --- fleetd #722: registration and presence must reach READY whichever lands first --------
+
+    @Test
+    void registerThenContactReachesReadyForPlainSpawn() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr);
+        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+
+        sessions.asPresence().markPresent(session.terminalId());
+
+        assertEquals(MemberSession.State.READY, sessions.get(session.paneId()).orElseThrow().state(),
+                "a presence contact that arrives after registration reaches READY");
+    }
+
+    @Test
+    void contactThenRegisterStillReachesReadyForPlainSpawn() {
+        // The racing launcher marks presence for the spawned terminal from inside spawn() —
+        // before SessionManager.acquire's own registry.put runs — modeling an MCP contact that
+        // lands in that window.
+        FakeHerdr herdr = new FakeHerdr();
+        FleetConfig.Profile cfg = new FleetConfig.Profile(
+                "ltms-local", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN",
+                List.of("ccs", "ltms-local"), "tab", "fleetd-workers",
+                "worker: {profile} #{n}", null, null, null);
+        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
+        PresenceRacingLauncher race = new PresenceRacingLauncher(workers);
+        SessionManager sessions = new SessionManager(race);
+        race.presence = sessions.asPresence();
+
+        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+
+        assertEquals(MemberSession.State.READY, sessions.get(session.paneId()).orElseThrow().state(),
+                "a presence contact that lands before registry.put must still reach READY");
+    }
+
+    @Test
+    void aTerminalNeverMarkedPresentStaysSpawningAfterRegistration() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr);
+
+        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+
+        assertEquals(MemberSession.State.SPAWNING, sessions.get(session.paneId()).orElseThrow().state(),
+                "registration alone must not advance a terminal that was never marked present");
+    }
+
     @Test
     void releaseTearsDownWorkerAndRemovesFromRosterAndIsIdempotent() {
         FakeHerdr herdr = new FakeHerdr();

fleetd/src/test/java/dev/ltms/fleet/session/WorktreeSessionManagerTest.java

@@ -159,6 +159,40 @@ class WorktreeSessionManagerTest {
         assertEquals(expectedPath, s.cwd(), "session cwd is the worktree path");
     }
 
+    // --- fleetd #722: registration and presence must reach READY whichever lands first --------
+
+    @Test
+    void registerThenContactReachesReadyForWorktreeSpawn() {
+        FakeHerdr herdr = new FakeHerdr();
+        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
+        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
+
+        MemberSession session = sessions.acquire("ltms-local", null, "/caller/proj", "term_primary",
+                new WorktreeRequest("cb-722", null));
+        sessions.asPresence().markPresent(session.terminalId());
+
+        assertEquals(MemberSession.State.READY, sessions.get(session.paneId()).orElseThrow().state(),
+                "a presence contact that arrives after worktree registration reaches READY");
+    }
+
+    @Test
+    void contactThenRegisterStillReachesReadyForWorktreeSpawn() {
+        // The racing launcher marks presence for the spawned terminal from inside spawn() —
+        // before SessionManager.acquireWithWorktree's own registry.put runs — modeling an MCP
+        // contact that lands in that window.
+        FakeHerdr herdr = new FakeHerdr();
+        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
+        PresenceRacingLauncher race = new PresenceRacingLauncher(workerService(herdr));
+        SessionManager sessions = new SessionManager(race, worktrees);
+        race.presence = sessions.asPresence();
+
+        MemberSession session = sessions.acquire("ltms-local", null, "/caller/proj", "term_primary",
+                new WorktreeRequest("cb-722", null));
+
+        assertEquals(MemberSession.State.READY, sessions.get(session.paneId()).orElseThrow().state(),
+                "a presence contact that lands before worktree registration must still reach READY");
+    }
+
     @Test
     void worktreeArchitectAcquireAlsoBindsItsSlot() {
         FakeHerdr herdr = new FakeHerdr();