CB-563: mark clipped completion scrapes

When the injector's readiness grace expired it cleared the queue and logged
nothing. The failure then surfaced elsewhere as a turn-stall, which names the
wrong cause. Diagnosing CB-560 cost two live spawns and a wrong first
hypothesis for exactly this reason: the logs said "session marked failed" and
"failed send via turn-stall fallback", and neither says the message was never
typed into the pane at all.

The expiry now logs the target, the number of messages being failed, the grace
in polls and seconds, and the real cause in plain words.

The grace in seconds is derived, not written down twice: Bridged's own
INJECT_POLL_MILLIS is deleted and Injector.POLL_INTERVAL_MILLIS is the single
source, passed to every StatusPoller. A cadence change can no longer leave a
log line confidently stating the wrong duration.

Behaviour is unchanged. This is the first structured health event in the
daemon, and the foundation the fleet-health work will build on.

bridged/src/main/java/dev/ltms/bridged/Bridged.java

@@ -70,9 +70,6 @@ public final class Bridged {
 
     private static final Logger log = LoggerFactory.getLogger(Bridged.class);
 
-    /** How often the injector samples a busy worker's status while it has queued work. */
-    private static final long INJECT_POLL_MILLIS = 250;
-
     /** CB-504: how long to wait at startup for herdr's socket before serving degraded. */
     private static final long HERDR_WAIT_SECONDS = 30;
     private static final long HERDR_WAIT_POLL_MILLIS = 500;
@@ -290,7 +287,7 @@ public final class Bridged {
         };
         Injector injector = new Injector(agents, turnListener, deliverableTo(presence, leads),
                 presence::forget);
-        StatusPoller poller = new StatusPoller(agents, injector, INJECT_POLL_MILLIS);
+        StatusPoller poller = new StatusPoller(agents, injector, Injector.POLL_INTERVAL_MILLIS);
         poller.start();
 
         // CB-307: reply inbox. A broker: block (with a uri) selects the AMQP-backed durable adapter;

bridged/src/main/java/dev/ltms/bridged/auth/CallerResolver.java

@@ -65,13 +65,13 @@ public final class CallerResolver {
     private final Function<String, MemberRole> memberSlotRoles;
     private final Function<String, String> memberSlotNames;
 
-    /** Loopback-trust resolver: no token required, historical behaviour. */
-    public CallerResolver(ConnectionIdentity identity) {
+    /** Loopback-trust resolver: no token required, historical behaviour. Test-only. */
+    CallerResolver(ConnectionIdentity identity) {
         this(identity, false, null, Map.of());
     }
 
-    /** As {@link #CallerResolver(ConnectionIdentity, boolean, String, Map)} with no leads pinned. */
-    public CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token) {
+    /** As {@link #CallerResolver(ConnectionIdentity, boolean, String, Map)} with no leads pinned. Test-only. */
+    CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token) {
         this(identity, tokenMode, token, Map.of());
     }
 
@@ -86,8 +86,8 @@ public final class CallerResolver {
      * @param pinnedPrimaryTerminal the primary's own herdr {@code terminal_id}
      *                              ({@code null}/blank = unpinned)
      */
-    public static CallerResolver pinnedTo(ConnectionIdentity identity, boolean tokenMode,
-                                          String token, String pinnedPrimaryTerminal) {
+    static CallerResolver pinnedTo(ConnectionIdentity identity, boolean tokenMode,
+                                   String token, String pinnedPrimaryTerminal) {
         return new CallerResolver(identity, tokenMode, token,
                 pinnedPrimaryTerminal == null || pinnedPrimaryTerminal.isBlank()
                         ? Map.of() : Map.of(pinnedPrimaryTerminal, "primary"));
@@ -102,21 +102,11 @@ public final class CallerResolver {
      *                       {@link Role#PRIMARY} — rather than a worker. Empty = nothing pinned,
      *                       so every pane resolves as a worker.
      */
-    public CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
-                          Map<String, String> leadTerminals) {
+    CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                   Map<String, String> leadTerminals) {
         this(identity, tokenMode, token, fixed(leadTerminals), null);
     }
 
-    /**
-     * Map-form of both registries (CB-548): lead terminals and the initial architect terminal
-     * bindings, each snapshotted at construction (a handed-over map is not offered as live state).
-     */
-    public CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
-                          Map<String, String> leadTerminals,
-                          Map<String, String> architectTerminals) {
-        this(identity, tokenMode, token, fixed(leadTerminals), fixed(architectTerminals));
-    }
-
     /**
      * Live-registry form: {@code leadTerminals} is consulted on every resolve, so leads discovered
      * after startup (CB-531's tab scan) take effect without a restart.
@@ -125,29 +115,18 @@ public final class CallerResolver {
      * {@link #pinnedTo}: {@code Map} and {@code Supplier} overloads are ambiguous for a literal
      * {@code null}.
      */
-    public static CallerResolver withLeads(ConnectionIdentity identity, boolean tokenMode,
-                                           String token,
-                                           Supplier<Map<String, String>> leadTerminals) {
+    static CallerResolver withLeads(ConnectionIdentity identity, boolean tokenMode,
+                                    String token,
+                                    Supplier<Map<String, String>> leadTerminals) {
         return new CallerResolver(identity, tokenMode, token, leadTerminals, null);
     }
 
     /**
-     * Live-registry form for both {@code leadTerminals} and the CB-548 architect registry: both
-     * are consulted on every resolve, so a slot binding injected after startup takes effect
-     * without a restart.
+     * Live registry form that can confirm a bound slot is an architect slot.
      *
-     * <p>A static factory rather than a constructor overload, for the same reason as
-     * {@link #pinnedTo}: too many {@code Map}/{@code Supplier} combinations to make {@code null}
-     * unambiguous.
+     * <p>This is the only public construction path. It keeps terminal bindings and slot roles in
+     * the same {@link MemberRegistry}, so a configured architect can resolve as an architect.
      */
-    public static CallerResolver withLeadsAndMembers(ConnectionIdentity identity,
-                                                         boolean tokenMode, String token,
-                                                         Supplier<Map<String, String>> leadTerminals,
-                                                         Supplier<Map<String, String>> architectTerminals) {
-        return new CallerResolver(identity, tokenMode, token, leadTerminals, architectTerminals);
-    }
-
-    /** Live registry form that can confirm a bound slot is an architect slot. */
     public static CallerResolver withLeadsAndMembers(ConnectionIdentity identity,
                                                        boolean tokenMode, String token,
                                                        Supplier<Map<String, String>> leadTerminals,

bridged/src/main/java/dev/ltms/bridged/inject/CompletionResolver.java

@@ -55,6 +55,9 @@ public final class CompletionResolver implements TurnListener {
     /** Cap the scraped tail so a long transcript can't return an unbounded blob. */
     static final int MAX_SCRAPE_CHARS = 4000;
 
+    private static final String CLIPPED_PANE_TAIL_MARKER =
+            "[Pane tail clipped: member did not call bridge_reply.]";
+
     private final AgentControl agents;
     private final Rendezvous rendezvous;
 
@@ -147,9 +150,14 @@ public final class CompletionResolver implements TurnListener {
             return;
         }
         String tail;
+        int originalLength = 0;
+        boolean clipped = false;
         boolean scrapeFailed = false;
         try {
-            tail = clip(lastAssistantBlock(agents.read(target, SCRAPE_SOURCE)));
+            String assistantBlock = lastAssistantBlock(agents.read(target, SCRAPE_SOURCE));
+            originalLength = assistantBlock.strip().length();
+            clipped = originalLength > MAX_SCRAPE_CHARS;
+            tail = clip(assistantBlock);
         } catch (RuntimeException e) {
             // The worker finished but we couldn't read its screen — still resolve the send so the
             // caller unblocks; an empty tail beats hanging until the caller's timeout.
@@ -169,8 +177,14 @@ public final class CompletionResolver implements TurnListener {
                     target);
             return; // keep the in-flight record: a later genuine completion still needs it
         }
-        if (rendezvous.resolveCompletion(waiter, tail)) {
+        String completion = clipped ? tail + "\n" + CLIPPED_PANE_TAIL_MARKER : tail;
+        if (rendezvous.resolveCompletion(waiter, completion)) {
             inFlight.remove(target, turn);
+            if (clipped) {
+                log.warn("completion scrape for {} clipped from {} chars to the {} char cap; "
+                                + "member did not call bridge_reply, so the pane tail is partial",
+                        target, originalLength, MAX_SCRAPE_CHARS);
+            }
             log.debug("resolved send to {} via turn-completion fallback ({} chars scraped)",
                     target, tail.length());
         }

bridged/src/main/java/dev/ltms/bridged/inject/Injector.java

@@ -78,6 +78,15 @@ public final class Injector {
      */
     private static final int READINESS_GRACE_POLLS = 240;
 
+    /**
+     * The single source for the injector poll cadence — how often the {@link StatusPoller} drives
+     * {@link #onStatus} at. {@code Bridged} passes this to every {@link StatusPoller} it constructs,
+     * and this class reads it to state the readiness grace in seconds on the CB-562 expiry log
+     * instead of hardcoding "60s". One constant, so a cadence change cannot silently desync a log
+     * that claims a grace duration.
+     */
+    public static final long POLL_INTERVAL_MILLIS = 250;
+
     private final AgentControl agents;
     private final TurnListener turnListener;
     private final Predicate<String> ready; // CB-113: a target is deliverable only when available
@@ -264,6 +273,11 @@ public final class Injector {
                             // fail every queued message and release the target (CB-114) instead of
                             // polling it indefinitely with the caller's future never completing.
                             notReady = new ArrayList<>(t.queue);
+                            log.warn("readiness grace for {} expired after {} polls ({}s): target never "
+                                    + "became deliverable, so failing {} queued message(s) that never "
+                                    + "reached its pane",
+                                    target, READINESS_GRACE_POLLS,
+                                    READINESS_GRACE_POLLS * POLL_INTERVAL_MILLIS / 1000, notReady.size());
                             t.queue.clear();
                             t.notReadySincePoll = 0;
                         }

bridged/src/test/java/dev/ltms/bridged/auth/CallerResolverTest.java

@@ -315,6 +315,7 @@ class CallerResolverTest {
 
     @Test
     void aBoundArchitectPaneResolvesToArchitectBeforeTheWorkerFallback() {
+        // This is the production construction path used by Bridged.
         Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
                 Map::of, boundMembers("architect:lead-designer", MemberRole.ARCHITECT))
                 .resolve("127.0.0.1", 42, null);
@@ -338,9 +339,10 @@ class CallerResolverTest {
 
     @Test
     void anUnboundPaneStillResolvesAsAWorker() {
-        Map<String, String> arch = Map.of("term_elsewhere", "reviewer");
+        MemberRegistry members = new MemberRegistry(new BridgedConfig.Fleet(Map.of(),
+                Map.of("lead-designer", new BridgedConfig.Slot("sonnet")), Map.of(), Map.of(), null));
         Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                Map::of, () -> arch).resolve("127.0.0.1", 42, null);
+                Map::of, members).resolve("127.0.0.1", 42, null);
 
         assertEquals(Role.WORKER, p.role());
         assertNull(p.name());
@@ -376,16 +378,6 @@ class CallerResolverTest {
         assertEquals("architect:lead-designer", r.members().get("term_a"));
     }
 
-    @Test
-    void theArchitectMapFormIsCopiedSoLaterMutationCannotGrantArchitect() {
-        Map<String, String> mutable = new java.util.LinkedHashMap<>();
-        CallerResolver r = new CallerResolver(workerIdentity(), false, null, Map.of(), mutable);
-
-        mutable.put("term_a", "sneaky");
-
-        assertEquals(Role.WORKER, r.resolve("127.0.0.1", 42, null).role());
-    }
-
     @Test
     void describeNamesTheArchitectSlot() {
         assertEquals("architect:lead-designer",

bridged/src/test/java/dev/ltms/bridged/inject/CompletionResolverTest.java

@@ -156,6 +156,33 @@ class CompletionResolverTest {
         assertEquals("No, 391 = 17 × 23.", waiter.getNow(null).text());
     }
 
+    @Test
+    void marksAClippedCompletionPaneTail() {
+        String block = "⏺ " + "x".repeat(CompletionResolver.MAX_SCRAPE_CHARS + 1) + "\n❯ ";
+        FakeHerdr herdr = new FakeHerdr().readText(block);
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertEquals("x".repeat(CompletionResolver.MAX_SCRAPE_CHARS)
+                        + "\n[Pane tail clipped: member did not call bridge_reply.]",
+                waiter.getNow(null).text());
+    }
+
+    @Test
+    void leavesAnUnclippedCompletionPaneTailUnmarked() {
+        FakeHerdr herdr = new FakeHerdr().readText("⏺ complete report\n❯ ");
+        Rendezvous rendezvous = new Rendezvous();
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
+
+        var waiter = rendezvous.open("term_a");
+        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
+
+        assertEquals("complete report", waiter.getNow(null).text());
+    }
+
     @Test
     void resolvesSynchronouslyBeforePostTurnContextClearing() {
         FakeHerdr herdr = new FakeHerdr().readText("⏺ previous answer\n❯ ");
@@ -177,7 +204,8 @@ class CompletionResolverTest {
         // block while resolve compares against a clip()'d tail. For a block longer than MAX_SCRAPE_CHARS
         // the two capped representations differ even when the pane never changed, so the CB-115
         // byte-identical guard failed to fire and a stale completion could resolve the send. Both sides
-        // must clip identically; here an unchanged >cap block on rapid back-to-back turns stays suppressed.
+        // must clip identically. The returned-text marker is added only after this comparison, so an
+        // unchanged >cap block on rapid back-to-back turns still stays suppressed.
         String longBlock = "⏺ " + "x".repeat(CompletionResolver.MAX_SCRAPE_CHARS + 500) + "\n❯ ";
         FakeHerdr herdr = new FakeHerdr().readText(longBlock);
         Rendezvous rendezvous = new Rendezvous();

bridged/src/test/java/dev/ltms/bridged/inject/InjectorTest.java

@@ -1,10 +1,15 @@
 package dev.ltms.bridged.inject;
 
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.LoggerContext;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.AgentStatus;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.HerdrException;
 import org.junit.jupiter.api.Test;
+import org.slf4j.LoggerFactory;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -369,6 +374,40 @@ class InjectorTest {
         assertTrue(inj.activeTargets().isEmpty(), "the target is reclaimed, not polled forever");
     }
 
+    @Test
+    void readinessGraceExpiryIsLogged() {
+        // CB-562: the grace-expiry path used to clear the queue silently, so a message that never
+        // reached the worker's pane surfaced elsewhere as an unrelated turn-stall failure. Assert the
+        // expiry now names the real cause. (ListAppender capture pattern mirrors AuditLogTest.)
+        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
+        ch.qos.logback.classic.Logger injectorLog =
+                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(Injector.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.setContext(ctx);
+        appender.start();
+        injectorLog.addAppender(appender);
+        injectorLog.setLevel(Level.WARN);
+        try {
+            Injector inj = new Injector(new AgentControl(herdr), TurnListener.NOOP, _ -> false, _ -> {
+            });
+            inj.enqueue(T, "task");
+
+            for (int i = 0; i < READINESS_SAMPLES; i++) inj.onStatus(T, AgentStatus.IDLE);
+
+            String warn = appender.list.stream()
+                    .filter(e -> e.getLevel().equals(Level.WARN))
+                    .map(ILoggingEvent::getFormattedMessage)
+                    .findFirst()
+                    .orElse("no grace-expiry WARN logged");
+            assertTrue(warn.contains(T), "the log names the target terminal: " + warn);
+            assertTrue(warn.contains("never reached"), "the log names the real cause: " + warn);
+            assertTrue(warn.contains("1 queued message"),
+                    "the log carries the failed message count: " + warn);
+        } finally {
+            injectorLog.detachAppender(appender);
+        }
+    }
+
     @Test
     void aWorkerThatBecomesReadyWithinTheGraceIsDeliveredNormally() {
         // The readiness grace must not fail a worker that is merely slow to boot: once it becomes

bridged/src/test/java/dev/ltms/bridged/mcp/BridgeMcpAuthzTest.java

@@ -2,6 +2,7 @@ package dev.ltms.bridged.mcp;
 
 import dev.ltms.bridged.auth.Authz;
 import dev.ltms.bridged.auth.CallerResolver;
+import dev.ltms.bridged.auth.MemberRegistry;
 import dev.ltms.bridged.auth.Principal;
 import dev.ltms.bridged.auth.Role;
 import dev.ltms.bridged.config.BridgedConfig;
@@ -69,7 +70,8 @@ class BridgeMcpAuthzTest {
 
         mcp = new BridgeMcp(messages, workers, sessions, identity, sessions.asPresence(),
                 new PrimaryRegistry(null),
-                enforce ? new CallerResolver(identity) : null,
+                enforce ? CallerResolver.withLeadsAndMembers(identity, false, null,
+                Map::of, new MemberRegistry(null)) : null,
                 metrics);
         return mcp;
     }

bridged/src/test/java/dev/ltms/bridged/rest/BridgedAppAuthTest.java

@@ -1,6 +1,7 @@
 package dev.ltms.bridged.rest;
 
 import dev.ltms.bridged.auth.CallerResolver;
+import dev.ltms.bridged.auth.MemberRegistry;
 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.guard.SubscriptionGuard;
 import dev.ltms.bridged.herdr.AgentControl;
@@ -65,9 +66,8 @@ class BridgedAppAuthTest {
         MessageService messages = new MessageService(agents, injector, new Rendezvous());
 
         ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> pid);
-        CallerResolver callers = tokenMode
-                ? new CallerResolver(identity, true, token)
-                : new CallerResolver(identity);
+        CallerResolver callers = CallerResolver.withLeadsAndMembers(identity, tokenMode, token,
+                Map::of, new MemberRegistry(null));
         metrics = BridgedMetrics.create(sessions, new dev.ltms.bridged.msg.InMemoryReplyInbox());
 
         app = new BridgedApp(herdr, workers, sessions, messages, sessions.asPresence(), null,