CB-571: make PeerHandle.charterReceipt() abstract, fix OpenCode adapter's silent null

SessionAwareHandle wrapped the base's WorkerHandle but never overrode
charterReceipt(), so it silently inherited the interface default (null)
while the real receipt sat on its delegate. sol/terra never got a
charterSource/charterSha256 roster row.

Deletes the default so every PeerHandle must answer explicitly; the
compiler now catches this class of gap instead of a roster field
quietly going missing.

bridged/bridged.example.yaml

@@ -138,12 +138,6 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      SSH is unaffected). The token value itself is never stored in this file.
 #   gitHostEnv       → host env var holding the forge host (default GITEA_HOST). Injected as
 #                      GITEA_HOST *only* alongside a resolved gitTokenEnv.
-#   exhaustedPattern → regex matched against a completion-fallback scrape (CB-578 stage A) to
-#                      classify a turn that ended with no bridge_reply as the backend having
-#                      refused on a subscription usage limit, rather than a real answer. Opt-in —
-#                      omit and this profile's completion fallback behaves exactly as before.
-#                      Every backend words its refusal differently, so this is config, never a
-#                      vendor string baked into bridged itself.
 #   env              → extra environment for this profile's workers, as a literal key/value map
 #                      (CB-511). Use it to give workers a toolchain.
 #
@@ -177,7 +171,6 @@ profiles:
     maxLoad: 2                        # max live workers on this profile (omit for unlimited)
     # gitTokenEnv: GITEA_TOKEN        # opt-in: let this profile's workers open their own PR (CB-302)
     # gitHostEnv: GITEA_HOST          # defaults to GITEA_HOST; injected only with gitTokenEnv
-    # exhaustedPattern: "usage limit has been reached"   # opt-in: classify a usage-limit refusal (CB-578)
     # configDir: /Users/me/.ccs/instances/gx10   # CLAUDE_CONFIG_DIR — inherit that profile's skills/MCP
     # cwd: /Users/me/src/myrepo       # pin the working dir; omit to inherit the primary's
     # parityOverlay: [".claude/settings.local.json", ".env", ".envrc"]   # never add .mcp.json — see above

bridged/src/main/java/dev/ltms/bridged/Bridged.java

@@ -13,7 +13,6 @@ import dev.ltms.bridged.herdr.PaneLocator;
 import dev.ltms.bridged.herdr.UnixSocketHerdrClient;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.inject.CompletionResolver;
-import dev.ltms.bridged.inject.ExhaustedPatternLookup;
 import dev.ltms.bridged.inject.Injector;
 import dev.ltms.bridged.inject.StatusPoller;
 import dev.ltms.bridged.inject.TurnListener;
@@ -61,7 +60,6 @@ import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Function;
 import java.util.function.Predicate;
 import java.util.function.Supplier;
-import java.util.regex.Pattern;
 import java.util.stream.Collectors;
 
 /**
@@ -255,24 +253,7 @@ public final class Bridged {
         // The blocking message endpoint (CB-104) is the producer; the poller is inert until then.
         // CB-106: a confirmed turn completion resolves a blocked send whose worker never replied.
         Rendezvous rendezvous = new Rendezvous();
-        // CB-578 stage A: classify a completion-fallback scrape that matches a profile's configured
-        // usage-limit refusal as BACKEND_EXHAUSTED rather than handing it back as a real answer.
-        // Compiled once at startup, keyed by profile name; a profile with no exhaustedPattern is
-        // simply absent here, so its workers keep today's completion-fallback behaviour unchanged.
-        Map<String, Pattern> exhaustedPatternsByProfile = new LinkedHashMap<>();
-        cfg.profiles().forEach((name, profile) -> {
-            if (profile.hasExhaustedPattern()) {
-                exhaustedPatternsByProfile.put(name, Pattern.compile(profile.exhaustedPattern()));
-            }
-        });
-        ExhaustedPatternLookup exhaustedPatterns = target -> sessions.roster().stream()
-                .filter(session -> target.equals(session.terminalId()))
-                .findFirst()
-                .map(session -> exhaustedPatternsByProfile.get(session.profile()))
-                .orElse(null);
-        log.info("backend-exhausted classification (CB-578 stage A): {}",
-                CompletionResolver.coverage(cfg.profiles().keySet(), exhaustedPatternsByProfile.keySet()));
-        CompletionResolver completion = new CompletionResolver(agents, rendezvous, exhaustedPatterns);
+        CompletionResolver completion = new CompletionResolver(agents, rendezvous);
         // CB-113: deliver only to an available worker (its MCP is connected), never its boot window.
         // CB-301: the manager's presence bridge records availability and drives SPAWNING → READY.
         MemberPresence presence = sessions.asPresence();

bridged/src/main/java/dev/ltms/bridged/config/BridgedConfig.java

@@ -181,12 +181,6 @@ public record BridgedConfig(
      *                       opposite intents). For the same reason, an {@code env:} entry naming
      *                       {@code ANTHROPIC_BASE_URL} or {@code ANTHROPIC_AUTH_TOKEN} is refused at
      *                       config load (CB-542): on the subscription path no guard would vet it.
-     * @param exhaustedPattern  regex matched against a completion-fallback scrape (CB-578 stage A) to
-     *                       classify a turn that ended with no {@code bridge_reply} as the backend
-     *                       having refused on a subscription usage limit, rather than a real answer.
-     *                       {@code null}/blank ⇒ the classification never fires for this profile and
-     *                       today's completion-fallback behaviour is unchanged. Every backend words
-     *                       its refusal differently, so this is config, never a vendor string in code.
      */
     @JsonIgnoreProperties(ignoreUnknown = true)
     public record Profile(String profile, String baseUrl, String model,
@@ -199,8 +193,7 @@ public record BridgedConfig(
                          Map<String, String> env,
                          Float weight,
                          Integer maxLoad,
-                         Boolean subscription,
-                         String exhaustedPattern) {
+                         Boolean subscription) {
 
         /** Peer kind spawned by {@link dev.ltms.bridged.member.ClaudeCodeLauncher} (the default). */
         public static final String KIND_CLAUDE_CODE = "claude-code";
@@ -243,9 +236,6 @@ public record BridgedConfig(
             weight = (weight == null || weight <= 0.0f) ? 1.0f : weight;
             maxLoad = (maxLoad == null || maxLoad <= 0) ? null : maxLoad;
             subscription = (subscription != null && subscription) ? Boolean.TRUE : Boolean.FALSE;
-            // exhaustedPattern stays null when unset/blank (opt-in) — no defaulting, no vendor
-            // wording: an unconfigured profile keeps today's completion-fallback behaviour exactly.
-            exhaustedPattern = (exhaustedPattern == null || exhaustedPattern.isBlank()) ? null : exhaustedPattern;
         }
 
         /**
@@ -258,7 +248,7 @@ public record BridgedConfig(
                       String placement, String workspace, String tabLabel, String mcpUrl,
                       String cwd, List<String> parityOverlay) {
             this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, null, null, null, null, null, null, null, null);
+                    mcpUrl, cwd, parityOverlay, null, null, null, null, null, null, null);
         }
 
         /**
@@ -270,7 +260,7 @@ public record BridgedConfig(
                       String placement, String workspace, String tabLabel, String mcpUrl,
                       String cwd, List<String> parityOverlay, String gitTokenEnv, String gitHostEnv) {
             this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, null, null, null, null, null, null);
+                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, null, null, null, null, null);
         }
 
         /**
@@ -283,14 +273,13 @@ public record BridgedConfig(
                       String cwd, List<String> parityOverlay, String gitTokenEnv, String gitHostEnv,
                       String kind) {
             this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, null, null, null, null, null);
+                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, null, null, null, null);
         }
 
         /** A copy with {@code profile} set — used to default a profile to its {@code workers} key. */
         public Profile withProfile(String p) {
             return new Profile(p, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad, subscription,
-                    exhaustedPattern);
+                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad, subscription);
         }
 
         /** True when this profile is served by the Claude Code adapter (the default kind). */
@@ -323,12 +312,7 @@ public record BridgedConfig(
                       String cwd, List<String> parityOverlay, String gitTokenEnv, String gitHostEnv,
                       String kind, Map<String, String> env, Float weight, Integer maxLoad) {
             this(profile, baseUrl, model, configDir, tokenEnv, argv, placement, workspace, tabLabel,
-                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad, null, null);
-        }
-
-        /** True when this profile's CB-578 stage A backend-exhausted classification is configured. */
-        public boolean hasExhaustedPattern() {
-            return exhaustedPattern != null;
+                    mcpUrl, cwd, parityOverlay, gitTokenEnv, gitHostEnv, kind, env, weight, maxLoad, null);
         }
 
         /** True when this profile's workers are granted a forge token to open their own PR (CB-302). */

bridged/src/main/java/dev/ltms/bridged/inject/CompletionResolver.java

@@ -6,13 +6,8 @@ import dev.ltms.bridged.msg.TurnToken;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
-import java.util.List;
-import java.util.Objects;
-import java.util.Set;
-import java.util.TreeSet;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
-import java.util.regex.Pattern;
 
 /**
  * The CB-106 completion fallback: bridges the {@link Injector}'s turn-completion signal to the
@@ -66,7 +61,6 @@ public final class CompletionResolver implements TurnListener {
 
     private final AgentControl agents;
     private final Rendezvous rendezvous;
-    private final ExhaustedPatternLookup exhaustedPatterns;
 
     /**
      * Per-target record of the turn currently in flight: the exact {@link Rendezvous} waiter its
@@ -84,16 +78,9 @@ public final class CompletionResolver implements TurnListener {
 
     private final ConcurrentHashMap<String, InFlight> inFlight = new ConcurrentHashMap<>();
 
-    /**
-     * @param exhaustedPatterns CB-578 stage A: per-target lookup for a profile's configured
-     *                          usage-limit refusal pattern. Required — there is deliberately no
-     *                          defaulting overload; a caller that does not want the classification
-     *                          must pass an explicit inert value ({@link ExhaustedPatternLookup#none()}).
-     */
-    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns) {
+    public CompletionResolver(AgentControl agents, Rendezvous rendezvous) {
         this.agents = agents;
         this.rendezvous = rendezvous;
-        this.exhaustedPatterns = Objects.requireNonNull(exhaustedPatterns, "exhaustedPatterns");
     }
 
     @Override
@@ -170,12 +157,11 @@ public final class CompletionResolver implements TurnListener {
             return;
         }
         String tail;
-        String assistantBlock = null;
         int originalLength = 0;
         boolean clipped = false;
         boolean scrapeFailed = false;
         try {
-            assistantBlock = lastAssistantBlock(agents.read(target, SCRAPE_SOURCE));
+            String assistantBlock = lastAssistantBlock(agents.read(target, SCRAPE_SOURCE));
             originalLength = assistantBlock.strip().length();
             clipped = originalLength > MAX_SCRAPE_CHARS;
             tail = clip(assistantBlock);
@@ -198,22 +184,6 @@ public final class CompletionResolver implements TurnListener {
                     target);
             return; // keep the in-flight record: a later genuine completion still needs it
         }
-        // CB-578 stage A: a turn that ended with no bridge_reply AND whose scrape matches the
-        // backend's configured usage-limit pattern is a refusal, not an answer. Classify it as
-        // BACKEND_EXHAUSTED rather than handing the caller a scrape that reads like a real reply.
-        if (!scrapeFailed) {
-            Pattern exhausted = exhaustedPatterns.patternFor(target);
-            String matchedLine = exhausted == null ? null : firstMatchingLine(assistantBlock, exhausted);
-            if (matchedLine != null) {
-                String reason = "backend exhausted (usage limit): " + matchedLine;
-                if (rendezvous.resolveExhausted(waiter, reason)) {
-                    inFlight.remove(target, turn);
-                    log.warn("completion for {} classified BACKEND_EXHAUSTED (no bridge_reply; scrape "
-                            + "matched the profile's exhausted pattern): {}", target, reason);
-                }
-                return;
-            }
-        }
         String completion = clipped ? tail + "\n" + CLIPPED_PANE_TAIL_MARKER : tail;
         if (rendezvous.resolveCompletion(waiter, completion)) {
             inFlight.remove(target, turn);
@@ -262,45 +232,6 @@ public final class CompletionResolver implements TurnListener {
         }
     }
 
-    /**
-     * The first line of {@code text} matching {@code pattern}, stripped — the CB-578 stage A
-     * evidence carried in a {@code BACKEND_EXHAUSTED} reason so the operator sees the real refusal
-     * text, never a generic label. {@code null} if no line matches.
-     */
-    static String firstMatchingLine(String text, Pattern pattern) {
-        if (text == null || text.isEmpty()) return null;
-        for (String line : text.split("\n", -1)) {
-            if (pattern.matcher(line).find()) {
-                return line.strip();
-            }
-        }
-        return null;
-    }
-
-    /**
-     * Coverage summary for the CB-578 stage A exhausted-pattern classification, logged at startup
-     * the way {@link dev.ltms.bridged.health.FleetHealthMonitor#coverage} is — so an operator can
-     * see whether the classification is on, and for which profiles, without reading every
-     * profile's config by hand.
-     *
-     * @param allProfiles        every configured profile name
-     * @param configuredProfiles the subset of {@code allProfiles} that carry an exhausted pattern
-     */
-    public static String coverage(Set<String> allProfiles, Set<String> configuredProfiles) {
-        if (configuredProfiles.isEmpty()) {
-            return "off (no profile has an exhaustedPattern configured; profiles: " + sorted(allProfiles) + ")";
-        }
-        Set<String> unconfigured = new TreeSet<>(allProfiles);
-        unconfigured.removeAll(configuredProfiles);
-        return unconfigured.isEmpty()
-                ? "full (all profiles configured: " + sorted(allProfiles) + ")"
-                : "partial (configured: " + sorted(configuredProfiles) + "; not configured: " + sorted(unconfigured) + ")";
-    }
-
-    private static List<String> sorted(Set<String> names) {
-        return names.stream().sorted().toList();
-    }
-
     private static String clip(String s) {
         if (s == null) return "";
         String trimmed = s.strip();

bridged/src/main/java/dev/ltms/bridged/inject/ExhaustedPatternLookup.java

@@ -1,27 +0,0 @@
-package dev.ltms.bridged.inject;
-
-import java.util.regex.Pattern;
-
-/**
- * Per-target lookup for a profile's configured usage-limit refusal pattern (CB-578 stage A): how
- * {@link CompletionResolver} tells a backend that refused on a subscription usage limit — the
- * worker's pane stays healthy, but the account is exhausted — apart from a genuine completion.
- *
- * <p>The pattern is always profile config, never a vendor string in Java source: every backend
- * words its refusal differently, so a hardcoded sentence would only ever match one of them.
- */
-@FunctionalInterface
-public interface ExhaustedPatternLookup {
-
-    /** The compiled pattern configured for {@code target}'s profile, or {@code null} if none. */
-    Pattern patternFor(String target);
-
-    /**
-     * Inert lookup — no profile has a pattern configured, so the classification never fires and
-     * the completion fallback behaves exactly as before CB-578 stage A. The explicit stand-in a
-     * caller (or a test not exercising this feature) passes instead of a defaulting overload.
-     */
-    static ExhaustedPatternLookup none() {
-        return target -> null;
-    }
-}

bridged/src/main/java/dev/ltms/bridged/mcp/BridgeMcp.java

@@ -458,11 +458,6 @@ public final class BridgeMcp {
                     "[worker finished without a structured bridge_reply — transcript tail follows]\n" + r.text());
             // The worker ran the turn then wedged (CB-109) — surface the error context.
             case WORKER_FAILED -> text("[worker failed — turn ended in an unrecoverable state]\n" + r.text());
-            // The backend refused on a subscription usage limit (CB-578 stage A) — the worker's
-            // pane stayed healthy, but its account is exhausted. Distinct from WORKER_FAILED so the
-            // primary gets the real cause, not a generic wedge.
-            case BACKEND_EXHAUSTED -> text("[backend exhausted — the worker's account refused on a "
-                    + "usage limit]\n" + r.text());
             // The worker paused mid-turn to ask (CB-205) — tell the primary how to answer in-turn.
             case QUESTION -> text("[question] the worker paused to ask before it can finish:\n" + r.text()
                     + "\n\nAnswer it by calling bridge_send again with turnId=\"" + r.turnId()

bridged/src/main/java/dev/ltms/bridged/member/HerdrPeerLauncher.java

@@ -7,6 +7,7 @@ import dev.ltms.bridged.herdr.HerdrException;
 import dev.ltms.bridged.herdr.Tab;
 import dev.ltms.bridged.herdr.Workspace;
 import dev.ltms.bridged.herdr.WorkspaceControl;
+import dev.ltms.bridged.peer.CharterReceipt;
 import dev.ltms.bridged.peer.MemberRole;
 import dev.ltms.bridged.peer.PeerHandle;
 import dev.ltms.bridged.peer.PeerLauncher;
@@ -269,8 +270,11 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
 
     // --- spawn ---------------------------------------------------------------------------------
 
-    /** A started peer plus the launch's agent-session id (the resume handle, or null). */
-    private record Spawned(Agent agent, String agentSessionId) {
+    /**
+     * A started peer plus the launch's agent-session id (the resume handle, or null) and the
+     * charter receipt (CB-571) the base composed for it.
+     */
+    private record Spawned(Agent agent, String agentSessionId, CharterReceipt receipt) {
     }
 
     /**
@@ -305,12 +309,41 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         String replyCharter = cfg.hasMcp() ? REPLY_CHARTER : null;
         String charter = roleCharter == null ? replyCharter
                 : replyCharter == null ? roleCharter : roleCharter + "\n\n" + replyCharter;
-        Launch launch = buildLaunch(cfg, new LaunchSpec(sessionName, resumeSessionId, role, charter));
-        String cwd = resolveCwd(requestedCwd, cfg, callerCwd);
-        Agent agent = cfg.tabPlacement()
-                ? spawnInTab(cfg, launch.env(), launch.argv(), cwd, role, liveFleet)
-                : spawnAsPane(cfg, launch.env(), launch.argv(), cwd);
-        return new Spawned(agent, launch.agentSessionId());
+        // CB-571: fingerprint the exact composed charter bytes once, here in the base, before the
+        // string leaves for an adapter — so Claude and OpenCode derive the same digest. A failed
+        // start has no bridge_spawn result and no roster row, so the failure log below is the only
+        // surface the byte count can appear on. The charter text itself is never logged.
+        CharterReceipt receipt = CharterReceipt.compose(role, cfg.profile(), roleCharter, charter);
+        try {
+            Launch launch = buildLaunch(cfg, new LaunchSpec(sessionName, resumeSessionId, role, charter));
+            String cwd = resolveCwd(requestedCwd, cfg, callerCwd);
+            Agent agent = cfg.tabPlacement()
+                    ? spawnInTab(cfg, launch.env(), launch.argv(), cwd, role, liveFleet)
+                    : spawnAsPane(cfg, launch.env(), launch.argv(), cwd, charter);
+            logCharterReceipt(receipt, true);
+            return new Spawned(agent, launch.agentSessionId(), receipt);
+        } catch (RuntimeException e) {
+            logCharterReceipt(receipt, false);
+            throw e;
+        }
+    }
+
+    /**
+     * The one place the charter's size and digest appear in the logs. {@code success} true after a
+     * start, false from the failure path of {@link #spawnInternal} where no handle or roster row
+     * exists to carry the receipt. Always metadata only — never the charter text.
+     */
+    private static void logCharterReceipt(CharterReceipt receipt, boolean success) {
+        String role = receipt.role() == null ? "" : receipt.role().wireName();
+        if (success) {
+            log.info("spawned role={} profile={} charterSource={} charterSha256={} charterBytes={}",
+                    role, receipt.profile(), receipt.charterSource(),
+                    receipt.charterSha256(), receipt.charterBytes());
+        } else {
+            log.warn("spawn failed; charter role={} profile={} charterSource={} charterSha256={} charterBytes={}",
+                    role, receipt.profile(), receipt.charterSource(),
+                    receipt.charterSha256(), receipt.charterBytes());
+        }
     }
 
     /**
@@ -349,7 +382,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         String id = UUID.randomUUID().toString();
         paneByAgentId.put(id, paneId);
         return new WorkerHandle(id, agent.terminalId(), requireProfile(req.profileName()).profile(),
-                req.sessionName(), spawned.agentSessionId());
+                req.sessionName(), spawned.agentSessionId(), spawned.receipt());
     }
 
     @Override
@@ -433,11 +466,19 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         }
     }
 
-    /** Legacy placement: split the currently-focused tab; the peer still starts in {@code cwd}. */
+    /**
+     * Legacy placement: split the currently-focused tab; the peer still starts in {@code cwd}.
+     *
+     * <p>CB-571: this is the one legacy log that printed the full argv, and the charter travels
+     * inside argv — so the charter text went to the daemon log on every pane-placement spawn. The
+     * {@code spawnInTab} path never logs argv, so only this site is fixed. {@code charter} is the
+     * composed charter, if any; its argv element is replaced by its digest so the log still shows
+     * which args were passed without exposing the charter prose.
+     */
     private Agent spawnAsPane(BridgedConfig.Profile cfg, Map<String, String> workerEnv,
-                              List<String> argv, String cwd) {
+                              List<String> argv, String cwd, String charter) {
         log.info("spawning {} (pane placement) profile={} cwd={} argv={}",
-                namePrefix, cfg.profile(), cwd, argv);
+                namePrefix, cfg.profile(), cwd, redactCharter(argv, charter));
         String paneId = spaces.splitPane(cwd, workerEnv);
         if (paneId == null) {
             throw new IllegalStateException("pane.split returned no pane — cannot start a peer");
@@ -447,6 +488,21 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
         return peer;
     }
 
+    /**
+     * A copy of {@code argv} with an element equal to {@code charter} replaced by its digest, so
+     * the pane log never prints the charter prose. The charter is handed to an adapter as one argv
+     * element, so exact-equality is the right match; every other argument passes through unchanged.
+     */
+    private static List<String> redactCharter(List<String> argv, String charter) {
+        if (charter == null || charter.isBlank() || argv == null || argv.isEmpty()) {
+            return argv;
+        }
+        String digest = CharterReceipt.digestOf(charter);
+        return argv.stream()
+                .map(a -> a.equals(charter) ? "<charter sha256=" + digest + ">" : a)
+                .toList();
+    }
+
     /** A started peer together with the sequence its unique name/label used. */
     private record Started(Agent agent, long seq) {
     }
@@ -651,11 +707,18 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
 
     /**
      * A concrete {@link PeerHandle} wrapping herdr agent coordinates, the profile that spawned it,
-     * and the session identity the launch resolved (CB-547a): the bridge's logical name and the
-     * peer's own session id, both null when the spawn carried no identity.
+     * the session identity the launch resolved (CB-547a): the bridge's logical name and the peer's
+     * own session id, both null when the spawn carried no identity — and the charter receipt
+     * (CB-571) the base computed for this launch.
      */
     private record WorkerHandle(String id, String terminalId, String profile,
-                                String sessionName, String agentSessionId) implements PeerHandle {
+                                String sessionName, String agentSessionId,
+                                CharterReceipt receipt) implements PeerHandle {
+
+        @Override
+        public CharterReceipt charterReceipt() {
+            return receipt;
+        }
     }
 
     // --- shared helpers ------------------------------------------------------------------------

bridged/src/main/java/dev/ltms/bridged/member/OpenCodeLauncher.java

@@ -7,6 +7,7 @@ import dev.ltms.bridged.herdr.Agent;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.peer.Capability;
+import dev.ltms.bridged.peer.CharterReceipt;
 import dev.ltms.bridged.peer.PeerHandle;
 import dev.ltms.bridged.peer.SpawnRequest;
 
@@ -406,6 +407,11 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
             // appeared).
             return discovery.sessionIdForDirectory(cwd);
         }
+
+        @Override
+        public CharterReceipt charterReceipt() {
+            return delegate.charterReceipt();
+        }
     }
 
     // --- Agent-returning convenience spawns (used by callers/tests that want the herdr Agent) ---

bridged/src/main/java/dev/ltms/bridged/msg/MessageService.java

@@ -69,14 +69,6 @@ public final class MessageService {
          * failure context (e.g. the error screen). Terminal, but not a successful completion.
          */
         WORKER_FAILED,
-        /**
-         * The turn finished without a {@code bridge_reply} and the scrape matched the backend's
-         * configured usage-limit refusal pattern (CB-578 stage A); {@code text} is the reason,
-         * carrying the matched line. The worker's pane is healthy — only its account is refusing —
-         * so this is never reported as a completed reply, and is kept distinct from
-         * {@link #WORKER_FAILED} (a wedged worker) and a session simply going {@code GONE}.
-         */
-        BACKEND_EXHAUSTED,
         /**
          * The worker paused mid-turn to ask the primary a question (CB-205); {@code text} is the
          * question and {@code turnId} correlates the answer. Not terminal — the primary answers with
@@ -288,7 +280,6 @@ public final class MessageService {
             case COMPLETED_UNREPLIED -> "completion_fallback";
             case TIMED_OUT_WORKING, TIMED_OUT_QUEUED, BUSY -> "timeout";
             case WORKER_FAILED -> "failed";
-            case BACKEND_EXHAUSTED -> "backend_exhausted";
             case STALE_TURN, QUESTION -> null; // not a completed delegation
         };
     }
@@ -600,11 +591,9 @@ public final class MessageService {
             String source = r.outcome() == Outcome.REPLIED ? "reply" : "transcript";
             return new TaskView(ticket, Phase.DONE, r.text(), source, null, null);
         }
-        // A wedged worker (CB-109) or a backend-exhausted classification (CB-578 stage A) carries
-        // the real cause as its reason; the timeout/busy outcomes carry none, so fall back to the
-        // outcome name.
-        boolean carriesReason = r.outcome() == Outcome.WORKER_FAILED || r.outcome() == Outcome.BACKEND_EXHAUSTED;
-        String detail = carriesReason && r.text() != null
+        // A wedged worker (CB-109) carries the error context as its reason; the timeout/busy
+        // outcomes carry none, so fall back to the outcome name.
+        String detail = r.outcome() == Outcome.WORKER_FAILED && r.text() != null
                 ? r.text()
                 : "no reply — " + r.outcome().name().toLowerCase();
         return new TaskView(ticket, Phase.FAILED, null, null, detail, null);
@@ -680,7 +669,6 @@ public final class MessageService {
             case REPLY -> Outcome.REPLIED;
             case COMPLETION -> Outcome.COMPLETED_UNREPLIED;
             case FAILED -> Outcome.WORKER_FAILED;
-            case BACKEND_EXHAUSTED -> Outcome.BACKEND_EXHAUSTED;
             case QUESTION -> Outcome.QUESTION;
         };
     }

bridged/src/main/java/dev/ltms/bridged/msg/Rendezvous.java

@@ -33,13 +33,6 @@ public final class Rendezvous {
         COMPLETION,
         /** The worker ran the turn then wedged (CB-109); {@code text} is the failure context. */
         FAILED,
-        /**
-         * The turn finished without a {@code bridge_reply}, and the scrape matched the backend's
-         * configured usage-limit refusal pattern (CB-578 stage A); {@code text} is the reason,
-         * carrying the matched line. The pane is healthy — only the account is refusing — so this
-         * is kept separate from a session simply going {@code GONE}.
-         */
-        BACKEND_EXHAUSTED,
         /**
          * The worker paused mid-turn to ask the primary a question (CB-205 reverse rendezvous);
          * {@code text} is the question and {@code turnId} correlates the primary's answer back to
@@ -231,19 +224,6 @@ public final class Rendezvous {
         return waiter != null && waiter.complete(new Resolution(Kind.FAILED, reason));
     }
 
-    /**
-     * Resolve a specific captured {@code waiter} as {@link Kind#BACKEND_EXHAUSTED} (CB-578 stage A):
-     * the turn finished with no {@code bridge_reply} and the scrape matched the backend's configured
-     * usage-limit pattern; {@code reason} carries the matched line. Like
-     * {@link #resolveCompletion(CompletableFuture, String)} it targets the exact captured send
-     * (CB-116). A no-op if that waiter was already resolved — first resolution wins.
-     *
-     * @return {@code true} if this call resolved the waiter, {@code false} if it was null or already resolved
-     */
-    public boolean resolveExhausted(CompletableFuture<Resolution> waiter, String reason) {
-        return waiter != null && waiter.complete(new Resolution(Kind.BACKEND_EXHAUSTED, reason));
-    }
-
     private boolean complete(String session, Resolution resolution) {
         CompletableFuture<Resolution> waiter = waiters.get(session);
         return waiter != null && waiter.complete(resolution);

bridged/src/main/java/dev/ltms/bridged/peer/CharterReceipt.java

@@ -0,0 +1,84 @@
+package dev.ltms.bridged.peer;
+
+import java.nio.charset.StandardCharsets;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
+import java.util.HexFormat;
+
+/**
+ * CB-571: a fingerprint of the exact charter bytes handed to a spawned member.
+ *
+ * <p>Lets an operator prove <em>which</em> charter a member actually got, without ever logging the
+ * charter text. The digest covers the exact composed UTF-8 string {@code HerdrPeerLauncher} passes
+ * to its adapter as {@code LaunchSpec.charter()}, so every adapter that receives the same string —
+ * Claude inlining it, OpenCode writing it to a file — produces the same digest for the same config.
+ * Two spawns of the same role from the same config agree; editing the charter changes the digest.
+ *
+ * <p>Deliberately places no charter prose. A charter is operator-authored text that may name
+ * internal projects or unreleased plans, and logs get tailed, shipped, and pasted into tickets.
+ * The {@code charterSource} key is what the operator wants to confirm, and it carries no content.
+ */
+public record CharterReceipt(
+        MemberRole role,
+        String profile,
+        String charterSource,
+        String charterSha256,
+        int charterBytes) {
+
+    /** Source reported when the role has no configured charter, so the field is never omitted. */
+    public static final String NO_SOURCE = "none";
+
+    /**
+     * The config key that supplied the role's charter text, e.g. {@code fleet.charters.architect}.
+     */
+    public static String sourceKey(MemberRole role) {
+        return "fleet.charters." + (role == null ? "?" : role.wireName());
+    }
+
+    /**
+     * Fingerprint the composed charter for {@code role} on {@code profile}. {@code configured} is
+     * the role's charter text as read from config ({@code null} when none is configured);
+     * {@code composed} is the exact string the launcher will pass to the adapter — the reply
+     * charter may be appended to {@code configured}, or stand alone when no role charter exists.
+     *
+     * <p>No composed charter at all is reported as an explicit absence — a {@code null} digest and
+     * a zero byte count — never a digest of the empty string, which would hide the fact that no
+     * text was supplied. {@code configured} being {@code null} while {@code composed} is the reply
+     * charter alone is a normal case, and the source says so.
+     */
+    public static CharterReceipt compose(MemberRole role, String profile,
+                                         String configured, String composed) {
+        String source = (configured == null || configured.isBlank())
+                ? NO_SOURCE : sourceKey(role);
+        if (composed == null) {
+            return new CharterReceipt(role, profile, source, null, 0);
+        }
+        byte[] bytes = composed.getBytes(StandardCharsets.UTF_8);
+        return new CharterReceipt(role, profile, source, digestOf(composed), bytes.length);
+    }
+
+    /** Whether the composed charter was absent (no text was given to the member). */
+    public boolean absent() {
+        return charterSha256 == null;
+    }
+
+    /**
+     * The stable SHA-256 hex digest of {@code text}, or {@code null} for null/blank text. Used both
+     * for the receipt's fingerprint and to redact a charter argument in a spawn log.
+     */
+    public static String digestOf(String text) {
+        if (text == null || text.isBlank()) {
+            return null;
+        }
+        return sha256Hex(text.getBytes(StandardCharsets.UTF_8));
+    }
+
+    private static String sha256Hex(byte[] bytes) {
+        try {
+            MessageDigest md = MessageDigest.getInstance("SHA-256");
+            return HexFormat.of().formatHex(md.digest(bytes));
+        } catch (NoSuchAlgorithmException e) {
+            throw new IllegalStateException("SHA-256 is unavailable", e);
+        }
+    }
+}

bridged/src/main/java/dev/ltms/bridged/peer/PeerHandle.java

@@ -67,4 +67,18 @@ public interface PeerHandle {
     default String agentSessionId() {
         return null;
     }
+
+    /**
+     * The charter receipt (CB-571) for this peer's launch — the fingerprint of the exact charter
+     * bytes it was started with. {@code null} when the launcher records none (a non-instrumented
+     * adapter, or a launcher before this field); the session registry stores it so the spawn result
+     * and the roster row can show an operator which charter a member actually got.
+     *
+     * <p>Deliberately not a {@code default}: a decorator that forgets to override this silently
+     * answers {@code null} for a question it has no basis to answer, and the gap surfaces only as
+     * a missing roster field, not a compile error. Every implementation must answer explicitly.
+     *
+     * @return the fingerprint, or {@code null} when the launcher carries none
+     */
+    CharterReceipt charterReceipt();
 }

bridged/src/main/java/dev/ltms/bridged/rest/BridgedApp.java

@@ -403,12 +403,9 @@ public final class BridgedApp {
                         case TIMED_OUT_QUEUED -> "queued";
                         case BUSY -> "busy";
                         case WORKER_FAILED -> "failed";
-                        case BACKEND_EXHAUSTED -> "backend_exhausted";
                         default -> "done"; // unreachable (terminal outcomes handled above)
                     },
-                    "detail", (reply.outcome() == MessageService.Outcome.WORKER_FAILED
-                                    || reply.outcome() == MessageService.Outcome.BACKEND_EXHAUSTED)
-                                    && reply.text() != null
+                    "detail", reply.outcome() == MessageService.Outcome.WORKER_FAILED && reply.text() != null
                             ? reply.text()
                             : "no reply within " + timeout + "ms; poll status or retry"));
         }

bridged/src/main/java/dev/ltms/bridged/session/MemberSession.java

@@ -1,5 +1,6 @@
 package dev.ltms.bridged.session;
 
+import dev.ltms.bridged.peer.CharterReceipt;
 import dev.ltms.bridged.peer.MemberRole;
 
 /**
@@ -23,6 +24,8 @@ import dev.ltms.bridged.peer.MemberRole;
  * @param lastActivityAtNanos {@link System#nanoTime()} of the most recent lifecycle event
  * @param turnCount          number of delegated turns that have been delivered to this session
  * @param state              current lifecycle state in the one-shot FSM
+ * @param charterReceipt     the fingerprint (CB-571) of the charter bytes this member was started
+ *                           with; {@code null} for a session whose launcher recorded none
  */
 public record MemberSession(
         String paneId,
@@ -36,7 +39,8 @@ public record MemberSession(
         int turnCount,
         State state,
         String worktree,
-        String branch) {
+        String branch,
+        CharterReceipt charterReceipt) {
 
     /** One-shot worker lifecycle states. */
     public enum State {
@@ -48,21 +52,34 @@ public record MemberSession(
         RELEASED
     }
 
+    /**
+     * Backward-compatible shape: a session with no charter receipt (a test or a launcher before
+     * CB-571). A separate constructor rather than a new parameter on the canonical one, so existing
+     * call sites that have nothing to record keep compiling unchanged.
+     */
+    public MemberSession(String paneId, String terminalId, String profile, MemberRole role,
+                         String cwd, String ownerTerminal, long spawnedAtNanos,
+                         long lastActivityAtNanos, int turnCount, State state,
+                         String worktree, String branch) {
+        this(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
+                lastActivityAtNanos, turnCount, state, worktree, branch, null);
+    }
+
     /** Return a copy of this session in {@code state}. */
     public MemberSession withState(State state) {
         return new MemberSession(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
-                lastActivityAtNanos, turnCount, state, worktree, branch);
+                lastActivityAtNanos, turnCount, state, worktree, branch, charterReceipt);
     }
 
     /** Return a copy with {@code lastActivityAtNanos} updated to {@code nowNanos}. */
     public MemberSession withActivity(long nowNanos) {
         return new MemberSession(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
-                nowNanos, turnCount, state, worktree, branch);
+                nowNanos, turnCount, state, worktree, branch, charterReceipt);
     }
 
     /** Return a copy with the turn count incremented and activity timestamped at {@code nowNanos}. */
     public MemberSession bumpTurn(long nowNanos) {
         return new MemberSession(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
-                nowNanos, turnCount + 1, state, worktree, branch);
+                nowNanos, turnCount + 1, state, worktree, branch, charterReceipt);
     }
 }

bridged/src/main/java/dev/ltms/bridged/session/SessionManager.java

@@ -163,7 +163,8 @@ public final class SessionManager implements TurnListener {
                     0,
                     MemberSession.State.SPAWNING,
                     null,
-                    null);
+                    null,
+                    handle.charterReceipt());
             registry.put(handle.id(), session);
             memberLifecycle.acquired(session.role(), session.profile(), session.terminalId());
             log.debug("acquired session id={} terminal={} profile={} owner={}",
@@ -355,7 +356,8 @@ public final class SessionManager implements TurnListener {
                 0,
                 MemberSession.State.SPAWNING,
                 path,
-                branch);
+                branch,
+                handle.charterReceipt());
         registry.put(handle.id(), session);
         memberLifecycle.acquired(session.role(), session.profile(), session.terminalId());
         log.debug("acquired worktree session id={} terminal={} profile={} branch={} path={}",
@@ -421,6 +423,16 @@ public final class SessionManager implements TurnListener {
         if (session.ownerTerminal() != null) {
             m.put("owner", session.ownerTerminal());
         }
+        // CB-571: which charter this member was started with — never the charter text itself. The
+        // digest lets a lead tell at a glance whether all members got the same charter; the source
+        // records whether a role charter was configured ("fleet.charters.<role>") or only the reply
+        // charter was composed ("none").
+        if (session.charterReceipt() != null) {
+            m.put("charterSource", session.charterReceipt().charterSource());
+            if (session.charterReceipt().charterSha256() != null) {
+                m.put("charterSha256", session.charterReceipt().charterSha256());
+            }
+        }
         m.put("liveStatus", live == null ? "unknown" : live.status().name().toLowerCase());
         return m;
     }

bridged/src/test/java/dev/ltms/bridged/config/BridgedConfigTest.java

@@ -1140,7 +1140,6 @@ class BridgedConfigTest {
                     gitHostEnv: GITEA_HOST
                     weight: 0.5
                     maxLoad: 2
-                    exhaustedPattern: "usage limit has been reached"
                 placement: weighted
                 lifecycle:
                   idleTtlSeconds: 300
@@ -1172,8 +1171,6 @@ class BridgedConfigTest {
         assertEquals("GITEA_HOST", w.gitHostEnv());
         assertEquals(0.5f, w.weight(), 0.0001f, "weight binds as a float");
         assertEquals(2, w.maxLoad(), "maxLoad binds as an integer");
-        assertTrue(w.hasExhaustedPattern(), "exhaustedPattern binds and enables the CB-578 stage A classification");
-        assertEquals("usage limit has been reached", w.exhaustedPattern());
 
         assertEquals("weighted", cfg.placement(), "placement binds at the top level");
         assertEquals(300, cfg.lifecycle().idleTtlSeconds());

bridged/src/test/java/dev/ltms/bridged/inject/CompletionResolverTest.java

@@ -12,9 +12,6 @@ import dev.ltms.bridged.msg.TurnToken;
 import org.junit.jupiter.api.Test;
 import org.slf4j.LoggerFactory;
 
-import java.util.Set;
-import java.util.regex.Pattern;
-
 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -26,7 +23,7 @@ class CompletionResolverTest {
     void skipsTheScrapeWhenNoSendIsWaiting() {
         FakeHerdr herdr = new FakeHerdr();
         Rendezvous rendezvous = new Rendezvous(); // no waiter opened
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
 
         resolver.resolve("term_a", null); // no in-flight turn captured for this target
 
@@ -38,7 +35,7 @@ class CompletionResolverTest {
     void failSkipsTheScrapeWhenNoSendIsWaiting() {
         FakeHerdr herdr = new FakeHerdr();
         Rendezvous rendezvous = new Rendezvous(); // no waiter opened
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
 
         resolver.fail("term_a", null); // no in-flight turn, and no registered waiter to fall back to
 
@@ -50,7 +47,7 @@ class CompletionResolverTest {
     void captureBaselineSkipsTheReadWhenNoSendIsWaiting() {
         FakeHerdr herdr = new FakeHerdr().readText("⏺ X\n❯ ");
         Rendezvous rendezvous = new Rendezvous(); // no waiter opened
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
 
         resolver.captureBaseline("term_a", TestTurnTokens.inert("term_a")); // no send to attribute a later completion to
 
@@ -139,7 +136,7 @@ class CompletionResolverTest {
         // send must NOT be resolved with the stale answer.
         FakeHerdr herdr = new FakeHerdr().readText("⏺ 391\n❯ ");
         Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
 
         var waiter = rendezvous.open("term_a");   // a send is blocked on this turn
         // The turn as captured at delivery: its waiter, and the previous turn's answer still on screen.
@@ -154,7 +151,7 @@ class CompletionResolverTest {
     void resolvesACompletionWhoseScrapeChangedSinceDelivery() {
         FakeHerdr herdr = new FakeHerdr().readText("⏺ No, 391 = 17 × 23.\n❯ "); // the worker's real answer
         Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
 
         var waiter = rendezvous.open("term_a");
         // Delivery baseline was the previous turn's "391"; the scrape now differs → resolve.
@@ -171,7 +168,7 @@ class CompletionResolverTest {
         String block = "⏺ " + "x".repeat(CompletionResolver.MAX_SCRAPE_CHARS + 1) + "\n❯ ";
         FakeHerdr herdr = new FakeHerdr().readText(block);
         Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
 
         var waiter = rendezvous.open("term_a");
         resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
@@ -185,7 +182,7 @@ class CompletionResolverTest {
     void leavesAnUnclippedCompletionPaneTailUnmarked() {
         FakeHerdr herdr = new FakeHerdr().readText("⏺ complete report\n❯ ");
         Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
 
         var waiter = rendezvous.open("term_a");
         resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
@@ -197,7 +194,7 @@ class CompletionResolverTest {
     void resolvesSynchronouslyBeforePostTurnContextClearing() {
         FakeHerdr herdr = new FakeHerdr().readText("⏺ previous answer\n❯ ");
         Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
         var waiter = rendezvous.open("term_a");
         resolver.captureBaseline("term_a", new TurnToken("term_a", waiter));
         herdr.readText("⏺ answer that /clear would erase\n❯ ");
@@ -219,7 +216,7 @@ class CompletionResolverTest {
         String longBlock = "⏺ " + "x".repeat(CompletionResolver.MAX_SCRAPE_CHARS + 500) + "\n❯ ";
         FakeHerdr herdr = new FakeHerdr().readText(longBlock);
         Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
 
         var waiter = rendezvous.open("term_a");        // a send is blocked on this turn
         resolver.captureBaseline("term_a", new TurnToken("term_a", waiter)); // baseline is the clipped >cap block
@@ -239,7 +236,7 @@ class CompletionResolverTest {
         // No delivery baseline (e.g. the pre-turn read failed) ⇒ never suppress; the completion resolves.
         FakeHerdr herdr = new FakeHerdr().readText("⏺ hello\n❯ ");
         Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
 
         var waiter = rendezvous.open("term_a");
         resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
@@ -257,7 +254,7 @@ class CompletionResolverTest {
         // byte-identical guard would wrongly match the empty tail and suppress.
         FakeHerdr herdr = new FakeHerdr().healthy(false); // agent.read throws HerdrException
         Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
 
         var waiter = rendezvous.open("term_a");
         var turn = new CompletionResolver.InFlight(waiter, ""); // empty pane baselined at delivery
@@ -277,7 +274,7 @@ class CompletionResolverTest {
         // fail must not overwrite that value, and must not even scrape the worker — nobody needs it.
         FakeHerdr herdr = new FakeHerdr().readText("an error screen");
         Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
 
         var waiter = rendezvous.open("term_a");
         var turn = new CompletionResolver.InFlight(waiter, null);
@@ -298,7 +295,7 @@ class CompletionResolverTest {
         // fail falls back to the waiter currently registered on the Rendezvous and fails it.
         FakeHerdr herdr = new FakeHerdr().readText("stuck on an error screen");
         Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
 
         var waiter = rendezvous.open("term_a"); // send registered, but no captureBaseline ever ran
         resolver.fail("term_a", null);          // no in-flight turn → fall back to the registered waiter
@@ -324,7 +321,7 @@ class CompletionResolverTest {
         try {
             FakeHerdr herdr = new FakeHerdr().readText("stuck on an error screen");
             Rendezvous rendezvous = new Rendezvous();
-            CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none());
+            CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
             var waiter = rendezvous.open("term_a");
 
             resolver.fail("term_a", null);
@@ -352,7 +349,7 @@ class CompletionResolverTest {
         // scrape to turn N+1; targeting turn N's captured waiter makes the late completion a no-op.
         FakeHerdr herdr = new FakeHerdr().readText("⏺ turn N answer\n❯ ");
         Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
 
         var waiterN = rendezvous.open("term_a"); // turn N's send
         // The turn as the injector captured it at delivery (waiter + pre-turn baseline).
@@ -373,88 +370,4 @@ class CompletionResolverTest {
                 "turn N stays resolved by its own reply");
         assertTrue(rendezvous.isWaiting("term_a"), "turn N+1 is still awaiting its own resolution");
     }
-
-    // --- CB-578 stage A: backend-exhausted classification ---------------------------------
-
-    @Test
-    void classifiesAMatchingScrapeAsBackendExhaustedInsteadOfACompletedReply() {
-        String block = "⏺ Working on it...\nThe usage limit has been reached. Try again later.\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(block);
-        Rendezvous rendezvous = new Rendezvous();
-        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns);
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertTrue(waiter.isDone(), "a matching scrape still resolves the blocked send");
-        assertEquals(Rendezvous.Kind.BACKEND_EXHAUSTED, waiter.getNow(null).kind(),
-                "not reported as a completed reply — the classification is distinct");
-    }
-
-    @Test
-    void theExhaustedReasonCarriesTheMatchedLine() {
-        String block = "⏺ Working on it...\nThe usage limit has been reached. Try again later.\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(block);
-        Rendezvous rendezvous = new Rendezvous();
-        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns);
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertEquals("backend exhausted (usage limit): The usage limit has been reached. Try again later.",
-                waiter.getNow(null).text(), "the reason names the real cause and carries the matched line");
-    }
-
-    @Test
-    void aNonMatchingScrapeResolvesAsAnOrdinaryCompletion() {
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ complete report\n❯ ");
-        Rendezvous rendezvous = new Rendezvous();
-        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns);
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertEquals(Rendezvous.Kind.COMPLETION, waiter.getNow(null).kind(),
-                "a scrape that does not match the pattern is an ordinary completion");
-        assertEquals("complete report", waiter.getNow(null).text());
-    }
-
-    @Test
-    void aProfileWithNoConfiguredPatternKeepsTodaysCompletionFallbackUnchanged() {
-        // Even a scrape that WOULD have matched some other profile's pattern must resolve as a
-        // plain completion when this target's own profile has none configured (CB-578 criterion 4).
-        String block = "⏺ The usage limit has been reached.\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(block);
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver =
-                new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none());
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertEquals(Rendezvous.Kind.COMPLETION, waiter.getNow(null).kind(),
-                "no pattern configured for this target's profile ⇒ unchanged completion-fallback behaviour");
-        assertEquals("The usage limit has been reached.", waiter.getNow(null).text());
-    }
-
-    @Test
-    void coverageIsOffWhenNoProfileHasAPatternConfigured() {
-        assertEquals("off (no profile has an exhaustedPattern configured; profiles: [terra])",
-                CompletionResolver.coverage(Set.of("terra"), Set.of()));
-    }
-
-    @Test
-    void coverageIsFullWhenEveryProfileHasAPatternConfigured() {
-        assertEquals("full (all profiles configured: [gx10, terra])",
-                CompletionResolver.coverage(Set.of("terra", "gx10"), Set.of("terra", "gx10")));
-    }
-
-    @Test
-    void coverageIsPartialAndNamesWhichProfilesAreConfigured() {
-        assertEquals("partial (configured: [terra]; not configured: [gx10])",
-                CompletionResolver.coverage(Set.of("terra", "gx10"), Set.of("terra")));
-    }
 }

bridged/src/test/java/dev/ltms/bridged/lead/LeadLauncherTest.java

@@ -28,7 +28,7 @@ class LeadLauncherTest {
                 List.of("ccs", "ltms"), "tab", "bridged-workers", null,
                 "http://127.0.0.1:8765/mcp", null, null,
                 null, null, null,
-                Map.of("CLAUDE_CODE_AUTO_COMPACT_WINDOW", "300000"), null, null, true, null);
+                Map.of("CLAUDE_CODE_AUTO_COMPACT_WINDOW", "300000"), null, null, true);
     }
 
     private static BridgedConfig configWith(BridgedConfig.Leader lead) {

bridged/src/test/java/dev/ltms/bridged/member/ClaudeCodeLauncherTest.java

@@ -733,7 +733,7 @@ class ClaudeCodeLauncherTest {
         return new BridgedConfig.Profile(
                 profile, baseUrl, "sonnet", null, "BRIDGED_WORKER_TOKEN",
                 List.of("ccs", profile), "tab", "bridged-workers", "w #{n}", null, null, null,
-                null, null, null, Map.of(), null, null, true, null);
+                null, null, null, Map.of(), null, null, true);
     }
 
     @Test
@@ -819,7 +819,7 @@ class ClaudeCodeLauncherTest {
                 null, null, null,
                 Map.of("ANTHROPIC_BASE_URL", "http://evil.example.com",
                         "ANTHROPIC_AUTH_TOKEN", "sk-ant-bad", "JAVA_HOME", "/opt/jdk"),
-                null, null, true, null);
+                null, null, true);
         new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
                 new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
                 _ -> "would-be-token").spawn();

bridged/src/test/java/dev/ltms/bridged/member/CompositePeerLauncherTest.java

@@ -10,6 +10,7 @@ import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.peer.Capability;
+import dev.ltms.bridged.peer.CharterReceipt;
 import dev.ltms.bridged.peer.MemberRole;
 import dev.ltms.bridged.peer.PeerHandle;
 import dev.ltms.bridged.peer.PeerLauncher;
@@ -93,6 +94,7 @@ class CompositePeerLauncherTest {
                 @Override public String id() { return "pane-" + p; }
                 @Override public String terminalId() { return "term-" + p; }
                 @Override public String profile() { return p; }
+                @Override public CharterReceipt charterReceipt() { return null; }
             };
         }
 

bridged/src/test/java/dev/ltms/bridged/member/HerdrPeerLauncherCharterTest.java

@@ -1,13 +1,19 @@
 package dev.ltms.bridged.member;
 
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.peer.Capability;
+import dev.ltms.bridged.peer.CharterReceipt;
 import dev.ltms.bridged.peer.MemberRole;
 import dev.ltms.bridged.peer.SpawnRequest;
 import org.junit.jupiter.api.Test;
+import org.slf4j.LoggerFactory;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -17,6 +23,8 @@ import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Supplier;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
 class HerdrPeerLauncherCharterTest {
 
@@ -38,10 +46,72 @@ class HerdrPeerLauncherCharterTest {
                 "a role charter does not depend on an MCP mount");
     }
 
+    @Test
+    void panePlacementSpawnLogNeverContainsTheCharterText() {
+        // A pane-placement spawn used to log the whole argv (CB-571), and the charter travels
+        // inside argv — so the charter text leaked to the daemon log. Prove the legacy pane path
+        // now redacts it to its digest.
+        String secret = "TOP SECRET charter marker 99x"; // distinctive, so a leak is unambiguous
+        AtomicReference<BridgedConfig.Fleet> fleet = new AtomicReference<>(fleet(Map.of("dev", secret)));
+        CharterArgLauncher launcher = new CharterArgLauncher(fleet::get);
+
+        Logger logger = (Logger) LoggerFactory.getLogger(HerdrPeerLauncher.class);
+        Level previous = logger.getLevel();
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        logger.setLevel(Level.INFO); // the test logback sets dev.ltms.bridged to WARN; a leak lives at INFO
+        try {
+            launcher.spawn(new SpawnRequest("mcp", null, null, null, null, MemberRole.DEV));
+
+            String all = String.join("\n", appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList());
+            assertFalse(all.contains(secret),
+                    "the pane-placement spawn log must not contain the charter text; got:\n" + all);
+            // The "mcp" profile composes role + reply charter; the digest must match that composed
+            // string (the exact bytes the adapter receives), proving the redaction hashes and
+            // removes the real, full charter — not some placeholder.
+            String composed = secret + "\n\n" + HerdrPeerLauncher.REPLY_CHARTER;
+            assertTrue(all.contains("<charter sha256=" + CharterReceipt.digestOf(composed) + ">"),
+                    "the charter argv argument should be replaced by its digest; got:\n" + all);
+        } finally {
+            logger.setLevel(previous);
+            logger.detachAppender(appender);
+        }
+    }
+
     private static BridgedConfig.Fleet fleet(Map<String, String> charters) {
         return new BridgedConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(), charters, null);
     }
 
+    private static BridgedConfig.Profile profile(String name, String mcpUrl) {
+        return new BridgedConfig.Profile(name, "http://gx00.gw:8000", null, null,
+                "BRIDGED_WORKER_TOKEN", List.of("test"), "pane", null, null, mcpUrl, null, null);
+    }
+
+    /**
+     * A launcher whose {@code buildLaunch} hands the composed charter to herdr as one argv element
+     * (what the claude-cod adapter does), so a pane-placement spawn log would print it unless the
+     * base redacts it.
+     */
+    private static final class CharterArgLauncher extends HerdrPeerLauncher {
+
+        CharterArgLauncher(Supplier<BridgedConfig.Fleet> fleet) {
+            super("test", new AgentControl(new FakeHerdr()), new WorkspaceControl(new FakeHerdr()),
+                    Map.of("mcp", profile("mcp", "http://bridge")),
+                    "mcp", _ -> null, 0, () -> 0L, () -> { }, fleet);
+        }
+
+        @Override
+        protected Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec) {
+            return new Launch(Map.of(), List.of("test", spec.charter() == null ? "none" : spec.charter()));
+        }
+
+        @Override
+        public Set<Capability> capabilities() {
+            return Set.of();
+        }
+    }
+
     private static final class CapturingLauncher extends HerdrPeerLauncher {
         private final List<LaunchSpec> specs = new ArrayList<>();
 
@@ -62,10 +132,5 @@ class HerdrPeerLauncherCharterTest {
         public Set<Capability> capabilities() {
             return Set.of();
         }
-
-        private static BridgedConfig.Profile profile(String name, String mcpUrl) {
-            return new BridgedConfig.Profile(name, "http://gx00.gw:8000", null, null,
-                    "BRIDGED_WORKER_TOKEN", List.of("test"), "pane", null, null, mcpUrl, null, null);
-        }
     }
 }

bridged/src/test/java/dev/ltms/bridged/member/OpenCodeLauncherTest.java

@@ -7,6 +7,7 @@ import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.peer.Capability;
+import dev.ltms.bridged.peer.CharterReceipt;
 import dev.ltms.bridged.peer.PeerHandle;
 import dev.ltms.bridged.peer.PeerUnreachableException;
 import dev.ltms.bridged.peer.SpawnRequest;
@@ -322,6 +323,26 @@ class OpenCodeLauncherTest {
         assertFalse(herdr.called("agent.get"), "no polling when the gate is disabled");
     }
 
+    @Test
+    void handleCarriesTheRealCharterReceiptNotTheInterfaceDefault(@TempDir Path root) {
+        // The base's WorkerHandle computes a real CharterReceipt (CB-571), but the opencode adapter
+        // wraps it in SessionAwareHandle for lazy session discovery. Before this fix that decorator
+        // did not override charterReceipt(), so it silently inherited PeerHandle's `null` default
+        // and the real receipt sitting on its delegate was lost.
+        FakeHerdr herdr = new FakeHerdr();
+        BridgedConfig.Fleet fleet = new BridgedConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(),
+                Map.of("dev", "role rule"), null);
+        PeerHandle handle = service(herdr, root,
+                opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null), () -> fleet)
+                .spawn(new SpawnRequest(null, null, null));
+
+        assertNotNull(handle.charterReceipt(),
+                "an opencode spawn's charterReceipt() must not silently be null");
+        String composed = "role rule\n\n" + HerdrPeerLauncher.REPLY_CHARTER;
+        assertEquals(CharterReceipt.digestOf(composed), handle.charterReceipt().charterSha256(),
+                "the receipt on the wrapped handle must match the exact composed charter bytes");
+    }
+
     // --- CB-508: pinned OpenAI-compatible endpoint (e.g. a local vLLM) ---------------------------
 
     /** A profile with a baseUrl but no model provider prefix cannot be resolved — fail loudly. */

bridged/src/test/java/dev/ltms/bridged/msg/MessageServiceTest.java

@@ -5,7 +5,6 @@ import dev.ltms.bridged.herdr.AgentStatus;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.HerdrException;
 import dev.ltms.bridged.inject.CompletionResolver;
-import dev.ltms.bridged.inject.ExhaustedPatternLookup;
 import dev.ltms.bridged.mcp.PrimaryRegistry;
 import dev.ltms.bridged.inject.Injector;
 import org.junit.jupiter.api.BeforeEach;
@@ -32,8 +31,7 @@ class MessageServiceTest {
     private final FakeHerdr herdr = new FakeHerdr().readText("BUILD GREEN: 391 files");
     private final AgentControl agents = new AgentControl(herdr);
     private final Rendezvous rendezvous = new Rendezvous();
-    private final CompletionResolver completion =
-            new CompletionResolver(agents, rendezvous, ExhaustedPatternLookup.none());
+    private final CompletionResolver completion = new CompletionResolver(agents, rendezvous);
     private final Injector injector = new Injector(agents, completion);
     private final InMemoryReplyInbox inbox = new InMemoryReplyInbox();
     private final MessageService messages = new MessageService(agents, injector, rendezvous, inbox);

bridged/src/test/java/dev/ltms/bridged/msg/RendezvousTest.java

@@ -114,17 +114,6 @@ class RendezvousTest {
                 "the first resolution wins; the stored value is unchanged");
     }
 
-    @Test
-    void resolveExhaustedTwiceIsANoOpTheSecondTime() {
-        CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.open(W);
-        assertTrue(rendezvous.resolveExhausted(waiter, "first reason"), "the first classification resolves");
-        assertFalse(rendezvous.resolveExhausted(waiter, "second reason"),
-                "a second exhausted resolution on an already-resolved waiter returns false");
-        assertEquals(Rendezvous.Kind.BACKEND_EXHAUSTED, waiter.getNow(null).kind());
-        assertEquals("first reason", waiter.getNow(null).text(),
-                "the first resolution wins; the stored value is unchanged");
-    }
-
     @Test
     void closeAskRemovesTheTurn() {
         Rendezvous.AskTicket t = rendezvous.openAsk(W);

bridged/src/test/java/dev/ltms/bridged/peer/CharterReceiptTest.java

@@ -0,0 +1,57 @@
+package dev.ltms.bridged.peer;
+
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+class CharterReceiptTest {
+
+    @Test
+    void recordsNoCharterConfiguredDistinctFromCharterDelivered() {
+        // No role charter configured — only the reply charter is composed. Source is "none", but
+        // text was still delivered, so absent() is false and the digest is present.
+        CharterReceipt viaReply = CharterReceipt.compose(MemberRole.DEV, "s", null, "reply charter");
+        // A role charter was configured AND delivered.
+        CharterReceipt delivered = CharterReceipt.compose(MemberRole.DEV, "s", "role charter",
+                "role charter\n\nreply charter");
+
+        // The two cases must not collapse: the no-role-charter case reports "none", the delivered
+        // case reports the config key, and their digests differ.
+        assertEquals(CharterReceipt.NO_SOURCE, viaReply.charterSource());
+        assertEquals("fleet.charters.dev", delivered.charterSource());
+        assertNotEquals(viaReply.charterSource(), delivered.charterSource());
+        assertNotEquals(viaReply.charterSha256(), delivered.charterSha256());
+
+        // Both actually delivered text — the distinction is the source and digest, not absence.
+        assertFalse(viaReply.absent());
+        assertFalse(delivered.absent());
+    }
+
+    @Test
+    void recordsExplicitAbsenceWhenNoCharterIsComposed() {
+        CharterReceipt none = CharterReceipt.compose(MemberRole.REVIEWER, "s", null, null);
+        assertTrue(none.absent());
+        assertNull(none.charterSha256());
+        assertEquals(0, none.charterBytes());
+        assertEquals(CharterReceipt.NO_SOURCE, none.charterSource(),
+                "no configured charter and nothing composed still reports a source, never a gap");
+    }
+
+    @Test
+    void digestIsStableForSameTextAndDiffersForDifferentText() {
+        assertEquals(CharterReceipt.digestOf("charter-aaa"), CharterReceipt.digestOf("charter-aaa"),
+                "the same text must always produce the same digest");
+        assertNotEquals(CharterReceipt.digestOf("charter-aaa"), CharterReceipt.digestOf("charter-bbb"),
+                "different text must produce a different digest");
+        assertNull(CharterReceipt.digestOf(""), "blank text carries no digest");
+
+        // The record's fingerprint matches the standalone digest for the same composed string.
+        CharterReceipt r = CharterReceipt.compose(MemberRole.DEV, "s", "role", "the composed text");
+        assertEquals(CharterReceipt.digestOf("the composed text"), r.charterSha256());
+        assertFalse(r.absent());
+    }
+}

bridged/src/test/java/dev/ltms/bridged/session/SessionManagerTest.java

@@ -11,6 +11,8 @@ import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.member.ClaudeCodeLauncher;
 import dev.ltms.bridged.msg.TestTurnTokens;
+import dev.ltms.bridged.peer.CharterReceipt;
+import dev.ltms.bridged.peer.MemberRole;
 import dev.ltms.bridged.peer.PeerUnreachableException;
 import org.junit.jupiter.api.Test;
 import org.slf4j.LoggerFactory;
@@ -91,6 +93,24 @@ class SessionManagerTest {
         assertEquals(2, sessions.roster().size(), "both sessions are registered");
     }
 
+    @Test
+    void rosterViewExposesTheCharterReceiptButNeverTheCharterText() {
+        // The roster (bridge_list and GET /members both render through rosterView) must let a lead
+        // see which charter a member got, without ever carrying the charter prose itself (CB-571).
+        MemberSession s = new MemberSession("p1", "term1", "prof", MemberRole.DEV, "/cwd", null,
+                0, 0, 0, MemberSession.State.READY, null, null,
+                CharterReceipt.compose(MemberRole.DEV, "prof", "role charter", "role charter\n\nreply"));
+
+        Map<String, Object> view = SessionManager.rosterView(s, null);
+
+        assertEquals("fleet.charters.dev", view.get("charterSource"),
+                "the config key that supplied the role charter is reported");
+        assertEquals(CharterReceipt.digestOf("role charter\n\nreply"), view.get("charterSha256"),
+                "the digest of the exact composed charter bytes is reported");
+        assertFalse(view.values().toString().contains("role charter"),
+                "the roster row must not embed the charter text itself");
+    }
+
     @Test
     void aNullTerminalFromThePrimaryIsANoOpEvenWithSessionsRegistered() {
         // The primary resolves to a Principal with no terminal, and BridgeMcp's context extractor