CB-553: enforce maxLoad on explicit-profile spawns (no cap bypass)

2026-08-13 21:12:32 +02:00
109 changed files with 1694 additions and 13967 deletions
@@ -92,32 +92,24 @@ route by who launches opencode:

 | Launcher | Route |
 |---|---|
-| a human, from a terminal | one central store, sourced by the login shell |
+| a human, from a terminal | `{file:…}` — see below |
 | a spawner (bridge, CI, IDE) | `{env:…}`, with the spawner injecting the variable |

-**For the human case, keep every credential in one file the login shell sources.** Here that file
-is `${SHARED_ENV}/tools/secrets.sh`, sourced from `${SHARED_ENV}/.ltms`, kept at mode 600 and never
-committed. `opencode.json` then names variables and holds no values:
+For the human case prefer **`{file:…}` with a workspace-relative path**, kept in a gitignored
+`.secrets/` directory beside `opencode.json`:

 ```json
-"headers": { "Authorization": "Bearer {env:CONTEXT7_TOKEN}" }
+"headers": { "Authorization": "Bearer {file:.secrets/api-token}" }
 ```

-Both routes end at the same syntax, and that is the point. The file does not change when a human
-launches opencode instead of the bridge.
+Verified: opencode resolves relative `{file:}` paths against the project root, so this needs no
+shell setup at all — no rc export leaking the secret to every process, no direnv dependency.

-**`{file:…}` also works, and this project moved away from it.** Opencode resolves a relative
-`{file:}` path against the project root, so a gitignored `.secrets/` beside `opencode.json` needs no
-shell setup at all. It did not fail; the problem is that it makes a second copy of the token. The
-same secret then lives in two places, and the copy you forget is the one that leaks or goes stale.
-One store with many references is easier to rotate and to audit.
-
-**One catch survives either choice, so state it out loud:** what a human's shell exports does not
-reach a spawned peer, and neither does a gitignored `.secrets/` — a git worktree receives tracked
-files only. Spawned peers must be fed through `{env:…}` by whatever launches them. Check the
-variable *names* match: a spawner often injects under a different name than your shell uses, and
-the config has no fallback. In this repo the bridge goes further: it neutralizes a worktree's
-`opencode.json`, so a member cannot inherit the primary's credentials by accident.
+**The catch, and state it out loud:** `.secrets/` is gitignored, so a peer running in a git worktree
+does **not** get it — worktrees receive tracked files only, the same rule that makes `opencode.json`
+itself worth committing. Spawned peers must therefore be fed through `{env:…}` by whatever launches
+them. Check the variable *names* match: a spawner often injects under a different name than your
+shell uses, and the config has no fallback.

 ## 4. Do not port machine-local MCP servers

@@ -1,19 +1,10 @@
-# No secret belongs in this repo any more: every credential lives in one shell-level store
-# (${SHARED_ENV}/tools/secrets.sh), and opencode.json reads it as {env:...}. This line stays as a
-# backstop, so a workspace-scoped copy that someone re-creates by habit still cannot be committed.
+# Workspace-scoped secrets for tools that read no settings cascade of their own
+# (opencode resolves these via {file:.secrets/...} in opencode.json).
 .secrets/

 # Settings backups inherit the env block — and secrets with it.
 .claude/settings.local.json.bak*

-# The default profile parityOverlay copies these primary→worktree, so they appear in EVERY worker
-# worktree. Two reasons they must be ignored. They hold environment values, which is reason enough.
-# And since CB-576 a release preserves any worktree that `git status --porcelain` calls dirty —
-# untracked files included, deliberately. An untracked overlay file would therefore make every
-# COMPLETED release preserve its worktree, and worktrees would pile up with no error to notice.
-.env
-.envrc
-
 # Daemon runtime artefacts. bridged appends its log wherever it is launched from, so both the
 # repo root and bridged/ collect one; neither belongs in git.
 bridged.out
@@ -11,45 +11,41 @@
 If no `bridge_*` MCP tools are mounted in this session, this section does not apply — skip it.

 `bridged` is the **sole communication gateway** between agents here. The orchestrating session (the
-**primary**) and every delegated peer (a **member**) mount the *same* MCP server and talk only
+**primary**) and every delegated peer (a **worker**) mount the *same* MCP server and talk only
 through its `bridge_*` tools. No session addresses a peer, a broker, or the network directly.

 ### Which role am I? — settle this before acting

-**Every role reads this file.** A member runs in a git worktree of this same repo, so it inherits
+**Both roles read this file.** A worker runs in a git worktree of this same repo, so it inherits
 this `CLAUDE.md` verbatim, and every rule below is role-conditional.

-**Call `bridge_whoami`.** It returns `primary`, `worker`, or `architect`, resolved by the daemon from
-your connection — unforgeable, and the same resolution its authorization gate uses. A worker also
-carries its `sessionId`, `profile`, `worktree` and `branch`; an architect carries the slot name it
-was bound to. Don't infer what you can ask.
+**Call `bridge_whoami`.** It returns `{"role":"primary"}` or `{"role":"worker","sessionId":…,
+"profile":…,"worktree":…,"branch":…}`, resolved by the daemon from your connection — unforgeable,
+and the same resolution its authorization gate uses. Don't infer what you can ask.

 Only if that call is unavailable, fall back to these — each is one-way, so keep reading until one
 fires: the reply charter in your system prompt (*"You are an off-subscription worker in the
-claude-bridge fleet"*) ⇒ **spawned member**; bridge tools prefixed `mcp__bridge__*` ⇒ **spawned
-member** (the launcher fixes that mount name; a primary's mount is named by whoever wrote its
-`.mcp.json`, so it varies); `ANTHROPIC_BASE_URL` set ⇒ **spawned member** (Claude-model members run
-on a clean env, so its *absence* proves nothing). None of these separate a worker from an architect —
-only `bridge_whoami` does. **Still unsure ⇒ act as a worker**, the most restricted member role. The
-two mistakes are not symmetric: a primary acting as a worker is refused by the authorization gate —
-loud and self-correcting — while a member acting as the primary ends its turn with no `bridge_reply`,
-and the sender silently receives nothing. Fail toward the recoverable error.
+claude-bridge fleet"*) ⇒ **worker**; bridge tools prefixed `mcp__bridge__*` ⇒ **worker** (the
+launcher fixes that mount name; a primary's mount is named by whoever wrote its `.mcp.json`, so it
+varies); `ANTHROPIC_BASE_URL` set ⇒ **worker** (Claude-model workers run on a clean env, so its
+*absence* proves nothing). **Still unsure ⇒ act as a worker.** The two mistakes are not symmetric: a
+primary acting as a worker is refused by the authorization gate — loud and self-correcting — while a
+worker acting as the primary ends its turn with no `bridge_reply`, and the sender silently receives
+nothing. Fail toward the recoverable error.

 ### Invariants — both roles, no exceptions

 1. **Never set, export, or forward `ANTHROPIC_BASE_URL`** (or `ANTHROPIC_AUTH_TOKEN`). The primary
-   stays on subscription; only the bridge puts a member off it, at spawn. Mounting the bridge must
+   stays on subscription; only the bridge puts a worker off it, at spawn. Mounting the bridge must
   never move a session across that boundary.
 2. **The bridge is the only channel.** Text you print in your terminal reaches nobody — the other
   side cannot see your screen. An answer that isn't in a `bridge_*` call is silently discarded.
 3. **Identity comes from the connection, never an argument.** Workers never pass a target; you
-   cannot act as another session. Spawn/stop/drain are lead-only; **send is lead or architect**;
-   reply/ask are only-as-itself — any peer may answer for its own pane, and for no other. A call
-   outside your role is refused, not queued.
+   cannot act as another session. Spawn/stop/send/drain are lead-only; reply/ask are
+   only-as-itself — any peer may answer for its own pane, and for no other. A call outside your
+   role is refused, not queued.
 4. **Delivery is status-gated: one message per turn.** Don't busy-poll a peer's terminal and don't
-   re-send because a call looks slow — the bridge delivers when the peer is `idle`, `blocked` or
-   `done`. A spawned member must **also** have mounted the bridge MCP: until it has, it is not
-   deliverable, and a send waits on that gate for ~60s and then fails without ever reaching its pane.
+   re-send because a call looks slow — the bridge delivers when the peer is `idle`/`blocked`.
 5. **Never drive the terminal multiplexer directly** (no `herdr` CLI, no socket). The bridge owns
   policy; the multiplexer owns PTYs. Going around the bridge bypasses every rule above.

@@ -81,9 +77,9 @@ below are the procedure — run them in order, every task, not only the big ones
 5. **Collect** — `bridge_poll{ticket}` → `bridge_ack{ticket, msgId}`. Answer a worker's `bridge_ask`
   with `bridge_send{turnId, content}` — **not** `sessionId`. A worker gone quiet is diagnosed with
   `bridge_status`, never by reading its terminal.
-6. **Verify yourself.** Re-run the build and the checks. A worker cannot run your IDE tooling, any
-   forge tools it appears to have hold a blocked credential and fail, and a piped command
-   (`… | tail`) hides failures behind a zero exit — never promote a worker's "clean" to a fact.
+6. **Verify yourself.** Re-run the build and the checks. A worker mounts only the bridge MCP and
+   cannot run your other tooling, and a piped command (`… | tail`) hides failures behind a zero
+   exit — never promote a worker's "clean" to a fact.
 7. **Review — fan out.** Spawn reviewers against the diff, one per dimension or per file, with
   `wait:false`. Never the implementer of the scope it reviews, and brief them from the diff — not
   from the implementer's rationale, which carries its own blind spot. Dispatch each PR's reviewers
@@ -105,26 +101,26 @@ the merge — and merging on a reviewer's word is delegating it by proxy.
 |---|---|
 | Confirm your own role | `bridge_whoami` |
 | See backends available | `bridge_profiles` |
-| Start a member | `bridge_spawn{role?, profile?, cwd?, worktree?, ticket?}` → `sessionId` + `paneId` |
-| See the fleet | `bridge_list` → `leads` (your peers) + `members` · one peer's state: `bridge_status{sessionId}` |
+| Start a worker | `bridge_spawn{profile?, cwd?, worktree?, ticket?}` → `sessionId` + `paneId` |
+| See the fleet | `bridge_list` → `leads` (your peers) + `workers` · one peer's state: `bridge_status{sessionId}` |
 | Delegate (blocking) | `bridge_send{sessionId, content}` |
 | Delegate (long task) | `bridge_send{sessionId, content, wait:false}` → ticket → `bridge_poll{ticket}` |
-| Answer a member's `bridge_ask` | `bridge_send{turnId, content}` — **not** `sessionId` |
+| Answer a worker's `bridge_ask` | `bridge_send{turnId, content}` — **not** `sessionId` |
 | Message a **peer lead** | `bridge_send{sessionId: <their terminal>, content}` — `bridge_list` → `leads` reports it. Coordination only, **never** a task |
 | Answer a peer lead that messaged you | `bridge_reply{content}` — the one case a lead replies |
 | Collect a held reply | `bridge_poll{target}` · then `bridge_ack{target, msgId}` |
-| Tear down a member | `bridge_stop{paneId}` |
+| Tear down | `bridge_stop{paneId}` |

 ### Lead ↔ lead — coordinate, never delegate

-`bridge_list` returns `leads` alongside `members`; your own row carries `self: true`. Every other row
-is a peer — an orchestrator with its own context, its own members, and its own judgment. An empty
-`members` array means no members are spawned; it says nothing about peers.
+`bridge_list` returns `leads` alongside `workers`; your own row carries `self: true`. Every other row
+is a peer — an orchestrator with its own context, its own workers, and its own judgment. An empty
+`workers` array means no workers are spawned; it says nothing about peers.

-**A lead never assigns a task to another lead.** Work goes to members — only ever downward, never
-sideways. Sending a peer a brief with acceptance criteria is a category error: a brief is a member's
+**A lead never assigns a task to another lead.** Work goes to workers — only ever downward, never
+sideways. Sending a peer a brief with acceptance criteria is a category error: a brief is a worker's
 artefact, and a peer is not yours to task. If a unit needs doing and it falls in your area, spawn a
-member and delegate it yourself; if it falls in the peer's area, say so and let the peer assign it.
+worker and delegate it yourself; if it falls in the peer's area, say so and let the peer assign it.
 The traffic between leads is coordination and nothing else:

 1. **Divide the map, not the work.** Agree who owns which area, then each of you assigns inside your
@@ -142,7 +138,7 @@ Being messaged by a peer does not make you its worker: answer with `bridge_reply
 the substance if it is wrong. A peer that simply complies has thrown away the reason there are two of
 you.

-### Member (worker or architect) — the turn contract
+### Worker — the turn contract

 1. **Load the playbook skill the lead named** before doing anything else.
 2. **Do the assigned scope only.** Note anything you spot outside it in one line; don't go hunt it.
@@ -151,17 +147,9 @@ you.
   Don't ask what you could decide yourself.
 4. **End the turn with exactly one `bridge_reply{content}`**, carrying your complete answer. This is
   the whole handoff. No `bridge_reply` ⇒ the sender gets nothing and the exchange stalls.
-   Do **not** lean on the completion fallback to carry your answer for you: when you end a turn
-   without replying, the bridge scrapes your pane, and it can return only the last 4000 characters.
-   A clipped scrape is marked as partial, but the missing text is gone — your report reaches the
-   lead with its end cut off.
-5. **Report honestly.** State only what you actually ran and its real output, including failures,
-   and never claim the result of a check you had no way to run. **Measure your own tools; do not
-   assume them.** What you mount depends on your backend: an opencode member gets the bridge and
-   nothing else, while a Claude Code member also inherits the operator's user-scope MCP servers,
-   which the bridge never chose for you. Two rules follow. The primary's IDE tooling is still not
-   yours, whatever you see. And **a mounted tool is not a working tool** — the forge server you may
-   find there holds a deliberately blocked credential and fails every call, by design.
+5. **Report honestly.** State only what you actually ran and its real output, including failures.
+   You mount **only** the bridge MCP — the primary's other servers (IDE, forge, docs) are not yours,
+   so never claim the result of a check you had no way to run.
 6. **Never merge.** Stage files explicitly — never `git add -A` — and leave alone anything the
   project marks as not-yours-to-commit.

@@ -169,9 +157,9 @@ you.

 | Layer | Scope | Reaches |
 |---|---|---|
-| the launcher's reply charter | the one rule that must survive with no repo: *end every turn with `bridge_reply`* | every spawned member, at launch, every peer kind — never a lead |
-| **this section** | protocol + orchestration policy | primary **and** every member that reads the repo — tracked in git, so worktrees inherit it |
-| role playbook skills | per-job procedure (commit/PR recipe, finding format) | a member told to load one |
+| the launcher's reply charter | the one rule that must survive with no repo: *end every turn with `bridge_reply`* | every worker, at launch, every peer kind |
+| **this section** | protocol + orchestration policy | primary **and** every Claude worker — tracked in git, so worktrees inherit it |
+| role playbook skills | per-job procedure (commit/PR recipe, finding format) | a worker told to load one |
 | the bridge's own docs | design detail, flows, error model | on demand |

 A rule belongs in **exactly one** layer — the outermost one that must obey it. Peers that don't read
@@ -193,64 +181,6 @@ charter, not here.
  are diagrammed in `docs/MCP-Contract.md` §6, kept out of this file because it loads into every
  session's context.

-### Redeploying the daemon — the lead may do this (primary only)
-
-**A merge is not a deployment.** The running `bridged` holds the jar it was started with, so a
-feature merged to `main` does nothing until the daemon is rebuilt and restarted. Saying "shipped"
-about code the live daemon has never loaded is a false report. The lead **may and should** redeploy
-rather than hand the job back to the operator.
-
-Workers must never do this. A worker has no business restarting the daemon it is talking through,
-and stopping it kills the worker's own channel mid-turn.
-
-**Use the script — do not hand-roll the steps.**
-
-```bash
-scripts/redeploy-bridged.sh --check   # report state, change nothing
-scripts/redeploy-bridged.sh           # build, confirm drain, restart, verify
-scripts/redeploy-bridged.sh --yes     # skip the drain prompt (fleet already checked)
-```
-
-It builds before it stops anything, so a failed build never leaves the fleet down; it waits for the
-old process to exit rather than assuming; it polls `/healthz`; and it anchors its log checks to a
-line marker taken before the restart, so old errors cannot be misread as new ones. Run `--check`
-first — it is read-only and reports whether the forge token resolves, which nothing else tells you.
-
-The script encodes the five things below, each of which has gone wrong here before. Read them anyway:
-if the script is unavailable or a step fails, this is what it was protecting you from.
-
-1. **Login shell, or workers silently lose their forge token.** The daemon inherits
-   `WORKER_GITEA_TOKEN` from the shell that starts it, and that comes from
-   `${SHARED_ENV}/tools/secrets.sh`. Start it from a non-login shell and the variable is empty, the
-   daemon starts fine, and the failure appears much later as workers that cannot open a PR. Nothing
-   logs this at startup — the script's `--check` is the only thing that reports it, and it checks
-   whether the name resolves without ever printing the value.
-2. **Drain live members first.** `bridge_list`, then `bridge_stop` each member, and collect anything
-   you still want with `bridge_poll` before you kill anything. A restart drops in-flight tickets and
-   rendezvous, and a member's report is not recoverable once its ticket is gone.
-3. **A restart is the only way deferred config keys take effect.** That is usually the reason to do
-   it. The startup log names which keys it accepted and which it deferred — read those lines rather
-   than assuming.
-4. **Re-check identity afterwards.** Call `bridge_whoami` and confirm it still answers `primary`. The
-   lead is found by its tab label (`fleet.leaders.*.tab`), and a lead whose tab no longer matches is
-   demoted to worker, which refuses every orchestration call.
-5. **Prove the new jar is the one running.** Confirm a *fresh* `bridged listening` line at the end of
-   `bridged/bridged.out`, dated after the restart. An old daemon that never died looks identical from
-   the outside.
-
-**Permission.** A `CLAUDE.md` rule grants intent, not tool permission — the command classifier
-refuses a bare `kill` on the daemon whatever this file says. The script is the seam that fixes that:
-it is one auditable command, so the operator allow-lists it once instead of approving a stop and a
-start every time. The rule lives in the operator's Claude Code settings:
-
-```json
-{ "permissions": { "allow": ["Bash(scripts/redeploy-bridged.sh:*)"] } }
-```
-
-Granted by the operator on 2026-08-15. If a call is still refused, do **not** route around it by
-running the stop and start as separate commands — that is exactly the approval the script replaced.
-Say what you were going to run and why, and let the operator decide.
-
 ### The prompt is part of the product — update it with the code (mandatory)

 This repo *is* the bridge, so the canonical block above is not documentation about someone else's
@@ -47,68 +47,52 @@ bind:
 # (say a Claude lead and an opencode lead) work as peers: the second is silently demoted and refused
 # every orchestration call. List each lead's pane here and all of them resolve as leads.
 #
-#   tab → the ONLY field identity depends on (CB-579); the exact label of the tab hosting the lead.
-#         Label the tab yourself, or let bridged label one it launches — see `fleet.leaders:` below.
+#   terminal → the ONLY field identity depends on; get it from that session's bridge_whoami
 #   kind/model → descriptive; they document what runs in the pane and are echoed by bridge_whoami
 #
-# A lead's tab must already carry its label (or be launched by bridged, which labels it) — there is
-# no terminal id to paste in and nothing to re-pin when the session restarts: the tab survives, so
-# the same label resolves the same lead again on the next scan.
+# A lead is never spawned — it pre-exists, which is exactly why it must be named rather than created.
 # `bridge_whoami` reports `{"role":"primary","leader":"<name>"}`; role stays "primary" because a lead
 # IS a primary for authorization, so nothing that keys on the role breaks.
 #
 # KEEP `primary:` when adding leads: it still addresses the CB-307 push loop, which needs a single
-# destination for its nudges, and is a separate mechanism from lead identity — see `fleet.leaders:`.
-#
-# Leads are configured under `fleet.leaders:` — see THE FLEET further down.
-#
-# Two things stop the tab-name convention from becoming a way to claim leadership: the configured
-# member spaces are excluded from the scan, so nothing bridged places can land in a matching tab;
-# and startup REFUSES a `tabPrefix` that the fleet tabLabel template, or any per-profile `tabLabel`
-# override, also matches — so the two namespaces cannot overlap by accident. The label is a NAME,
-# never a capability: what a pane may do is decided by the role the daemon resolves for it.
+# destination for its nudges. If both name the same terminal, the `leaders:` entry wins.
+# leaders:
+#   opus-5.0:
+#     terminal: term_0123456789abcd
+#     kind: claude
+#   gpt-sol-5.6:
+#     terminal: term_fedcba9876543
+#     kind: opencode
+#     model: openai/gpt-5.6-terra

-# CB-551: IDLE-LEAD HEARTBEAT — nudge the single lead back to work when it has been continuously
-# idle (no open bridge_send driving it) past the quiet period. The fleet is one lead + architects +
-# workers, so a lead that stalls is a single point of failure; the ReplyPushLoop only nudges when a
-# reply lands, and this timer catches the gap where nothing lands and the lead just sits idle.
+# CB-531: FIND LEADS BY TAB NAME instead of pasting terminal ids. `leaders:` above needs an id that
+# only exists once the session is running, so adding a lead is: open a tab, start the agent, ask it
+# bridge_whoami, edit this file, restart the daemon. This block replaces all of that with a naming
+# convention — label the tab `lead: <name>` when you open it and the pane is recognised on the next
+# rescan, with no config edit and no restart. Reopen the tab later and the id changes; the label
+# does not.
 #
-# Opt-in on purpose — it SPENDS the operator's subscription on its own initiative (each nudge starts
-# a lead turn nobody asked for), so upgrading the daemon must never switch it on for you. Absent
-# block = feature off, exactly as before.
+# bridged NEVER writes these labels. It renames worker tabs (see `tabLabel` below) but reads lead
+# tabs read-only, so what is in the tab bar is always what you typed. Two things keep the convention
+# from being a way to claim leadership: the configured worker spaces are excluded from the scan, so
+# nothing bridged places can land in a matching tab; and startup REFUSES a `tabPrefix` that any
+# worker `tabLabel` also matches, so the two namespaces cannot overlap by accident.
 #
-# Three knobs, each with a default that errs on the side of not burning context:
-#   idleAfterSeconds: 300   # how long the lead must stay idle before the FIRST nudge (default 300 —
-#                           # absorbs normal post-turn pauses; re-prompting every pause burns context)
-#   backoffMs: 60000        # re-check cadence / spacing between nudges past the quiet period (default 60000)
-#   quietNudgeCap: 3        # cap on consecutive nudges that find NOTHING pending, then it stops
-#                           # until real state appears (default 3 — never nag an empty fleet forever)
-# leadHeartbeat:
-#   idleAfterSeconds: 300
-#   backoffMs: 60000
-#   quietNudgeCap: 3
-
-# Fleet health detection is dormant unless enabled. It reads one whole-fleet agent list per tick.
-# It can run without a webhook; bridge_list then reports healthCoverage: detection-only.
-# health:
-#   enabled: true
-#   intervalSeconds: 30              # minimum 15
-#   workingSuspectAfterSeconds: 600  # minimum 300
-#   paneProbeIntervalSeconds: 60     # minimum 60
-#   notifications:
-#     mode: disabled                 # disabled (default) or webhook
+# Opt-in on purpose — this widens who resolves as a lead, so upgrading the daemon must never switch
+# it on for you. Absent block = leads come only from `leaders:`/`primary:`, exactly as before.
+# leadScan:
+#   tabPrefix: "lead:"      # `lead: opus-5.0` ⇒ a lead named opus-5.0 (case-insensitive; default "lead:")
+#   intervalSeconds: 10     # rescan cadence, and the worst case before a new tab is recognised

 # herdr Unix socket. Omit to use the client default
 # (${HERDR_SOCKET_PATH:-~/.config/herdr/herdr.sock}).
 herdrSocket: ~/.config/herdr/herdr.sock

-# How member sessions are spawned. Define one or more named profiles (backends) under
-# `profiles`; each key is the profile name (also the ccs profile). A profile says only WHICH
-# BACKEND — model, CLI adapter, credentials, cost. It says nothing about what a member spawned on
-# it is for; that is the member's role, and roles live under `fleet:` below. Which profile an
-# unqualified spawn lands on comes from that role's pool, not from a global default.
+# How worker sessions are spawned. Define one or more named profiles (backends) under
+# `workers`; each key is the profile name (also the ccs profile). `defaultWorker` picks
+# which one a no-argument spawn uses (bridge_spawn with no profile / POST /workers).
 #
-# Shared knobs (placement/workspace) can be repeated per profile; they usually match.
+# Shared knobs (placement/workspace/tabLabel) can be repeated per profile; they usually match.
 #   placement: tab   → each worker lands in its OWN tab in a dedicated worker space (default).
 #                      Use `pane` for the legacy behaviour (split the focused tab).
 #   mcpUrl           → bridged mounts the bridge MCP (--mcp-config, inline) + reply charter
@@ -138,23 +122,6 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      SSH is unaffected). The token value itself is never stored in this file.
 #   gitHostEnv       → host env var holding the forge host (default GITEA_HOST). Injected as
 #                      GITEA_HOST *only* alongside a resolved gitTokenEnv.
-#   exhaustedPattern → regex matched against a completion-fallback scrape (CB-578 stage A) to
-#                      classify a turn that ended with no bridge_reply as the backend having
-#                      refused on a subscription usage limit, rather than a real answer. Opt-in —
-#                      omit and this profile's completion fallback behaves exactly as before.
-#                      Every backend words its refusal differently, so this is config, never a
-#                      vendor string baked into bridged itself.
-#                      DEFERRED: compiled once into a startup pattern map — editing it needs a
-#                      daemon restart, same as this profile's model/baseUrl/argv.
-#   credentialId     → CB-578 stage B: the credential this profile quarantines WITH when a
-#                      BACKEND_EXHAUSTED classification fires. Two profiles that set the SAME
-#                      credentialId share one quarantine — the case this exists for is two models
-#                      on one account (e.g. sol and terra both billing one OpenAI credential): an
-#                      exhaustion on either one must lock out both, or the fleet just walks onto
-#                      the same dead account under the sibling's name. Opt-in — omit and this
-#                      profile quarantines alone, under its own name, exactly as if the field did
-#                      not exist. Cooldown length is the top-level quarantineCooldownSeconds below.
-#                      HOT: read live at every spawn/exhaustion check — no restart needed.
 #   env              → extra environment for this profile's workers, as a literal key/value map
 #                      (CB-511). Use it to give workers a toolchain.
 #
@@ -173,32 +140,21 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      entry cannot repoint a worker past the SubscriptionGuard — which is checked
 #                      against `baseUrl` alone.
 # Put `defaultMode: "auto"` in each ccs profile so the worker runs autonomously.
-profiles:
+workers:
  gx10:                              # ccs profile name (NOT a hostname)
    kind: claude-code                # which adapter spawns this profile (default; may omit)
    baseUrl: http://gx01.gw:8000     # the vLLM host this profile targets (gx00.gw / gx01.gw)
    model: coder
    placement: tab
    workspace: bridged-workers
-    # tabLabel: an optional per-profile override; the fleet template usually covers it
+    tabLabel: "worker: {profile} #{n}"  # {profile}/{model}/{n} substituted; {n} keeps sibling tabs distinct
    mcpUrl: http://127.0.0.1:8765/mcp
    tokenEnv: BRIDGED_WORKER_TOKEN
    argv: ["ccs", "gx10"]
-    # weight: relative selection weight for automatic placement (weighted, round-robin, and
-    # fixed's fallback walk). Absent defaults to 1.0. An explicit 0 or negative value means
-    # "never auto-select this profile" (CB-554) — it stays reachable via an explicit
-    # `bridge_spawn{profile:"gx10"}`, which bypasses placement entirely; only automatic
-    # selection skips it.
-    weight: 0.5
-    # maxLoad: max live workers on this profile. Omit for unlimited. An explicit 0 (CB-585) caps
-    # the profile at zero live members — it is excluded from automatic placement and an explicit
-    # `bridge_spawn{profile:"gx10"}` against it is refused too; a cap holds even when the profile
-    # is named directly. Negative is refused at config load — there is no sane meaning for it.
-    maxLoad: 2
+    weight: 0.5                       # relative selection weight for placement: weighted
+    maxLoad: 2                        # max live workers on this profile (omit for unlimited)
    # gitTokenEnv: GITEA_TOKEN        # opt-in: let this profile's workers open their own PR (CB-302)
    # gitHostEnv: GITEA_HOST          # defaults to GITEA_HOST; injected only with gitTokenEnv
-    # exhaustedPattern: "usage limit has been reached"   # opt-in: classify a usage-limit refusal (CB-578)
-    # credentialId: shared-openai   # opt-in: quarantine together with every other profile sharing this id (CB-578)
    # configDir: /Users/me/.ccs/instances/gx10   # CLAUDE_CONFIG_DIR — inherit that profile's skills/MCP
    # cwd: /Users/me/src/myrepo       # pin the working dir; omit to inherit the primary's
    # parityOverlay: [".claude/settings.local.json", ".env", ".envrc"]   # never add .mcp.json — see above
@@ -206,7 +162,7 @@ profiles:
    baseUrl: http://gx01.gw:8000     # self-hosted; ccs handles the model + token
    placement: tab
    workspace: bridged-workers
-    # tabLabel: an optional per-profile override; the fleet template usually covers it
+    tabLabel: "worker: {profile} #{n}"
    mcpUrl: http://127.0.0.1:8765/mcp
    argv: ["ccs", "gx11"]
    weight: 0.5
@@ -263,141 +219,7 @@ profiles:
 # How an unqualified spawn chooses a profile: fixed (default, reproduces pre-CB-518 behaviour),
 # round-robin, or weighted. Omitting this key is a strict no-op for existing configs.
 placement: weighted
-
-# How long a credential sits out after a BACKEND_EXHAUSTED classification (CB-578 stage B), in
-# seconds, before a spawn may land on it again. Applies to every profile's effective credential
-# (its own name, or its credentialId if set above) — there is no per-profile override. Default
-# 1800 (30 minutes) when omitted or non-positive.
-# DEFERRED: baked once into the BackendQuarantine built at startup — a running quarantine keeps
-# its original cooldown regardless; a new value only applies to a quarantine that starts after a
-# restart. Editing this needs a daemon restart to take effect.
-# quarantineCooldownSeconds: 1800
-
-# Re-read this file without restarting the daemon (CB-559). Off unless you add this block, so an
-# upgraded bridged keeps the old behaviour: the file is read once at boot and never again.
-#   enabled          → turn the watch on. bridged checks the file's modified time on a timer and
-#                      reloads when it moves.
-#   intervalSeconds  → how often to check (default 10). One `stat` per tick, so this is cheap.
-#
-# Not every key can move under a running daemon, and the difference is about what already exists
-# when the reload happens — not about how important the key is:
-#   HOT       → takes effect on the next spawn: the whole `fleet:` block (every role pool,
-#               `charters`, and `tabLabel`), `placement:`, and an existing profile's weight / maxLoad
-#               / credentialId. Those are hot because the placement policy (and, for credentialId,
-#               the CB-578 stage B quarantine check) reads them through a supplier — being config is
-#               not by itself enough to make a key hot.
-#   DEFERRED  → accepted into the new config, but the wiring built at startup keeps the old value
-#               until you restart: `lifecycle:`, `leadHeartbeat:`, `guard:`, `worktreeRoot:`,
-#               `spawnReadyTimeoutMs` / `spawnReadyPollMs`, `quarantineCooldownSeconds` (CB-578
-#               stage B — baked once into the quarantine tracker built at startup), ADDING or
-#               REMOVING a profile (a new backend needs its own launcher, and launchers are built
-#               once), AND an existing profile's launch settings — model, baseUrl, argv, env,
-#               configDir, mcpUrl, tabLabel, exhaustedPattern. The launcher takes a copy of
-#               `profiles:` at startup and resolves every spawn out of that copy, so those never
-#               reach a launch until you restart. The reload logs them by name rather than
-#               pretending they applied.
-#   COLD      → cannot change at all: `bind:`, `herdrSocket:`, `broker:` and `auth:`. The socket is
-#               bound, the broker connection is open, and the auth mode decides who may reach the
-#               port that is already listening.
-#
-# A changed COLD key refuses the WHOLE reload — not the hot half applied and the cold half warned
-# about. A half-applied reload would leave the daemon matching no file on disk, which is the worst
-# thing a reload can do to an operator debugging one. A file that fails to parse or fails a startup
-# validator is refused the same way, and the running config stays live.
-# configReload:
-#   enabled: true
-#   intervalSeconds: 10
-
-# THE FLEET (CB-557) — who the daemon may run, and under which role. This one block replaced four
-# older keys: `leaders:`, `members:`, `leadScan:` and `defaultProfile:`.
-#
-# A member is anything a lead spawns, and every member has two INDEPENDENT attributes:
-#   role    — which contract: architect, dev or reviewer. It picks the launch charter, the role
-#             file, the playbook skill and the authz row.
-#   profile — which backend: one of the `profiles:` keys above (model, CLI adapter, cost).
-# They vary on their own. A reviewer may run on the same profile as the dev whose diff it reads,
-# which is why the two cannot be one field.
-#
-# The ROLE IS THE CONTAINING KEY, not a `role:` field. That is not only tidier: a misspelled role
-# used to parse into a member with no contract at all, while a misspelled pool name here simply
-# declares nothing.
-#
-# Each pool lists the profiles that role MAY run on — these are pools, not identities. That is also
-# what replaced `defaultProfile:`: an unqualified spawn names a role, and that role's pool supplies
-# the candidates, in definition order. A dev and a reviewer staying anonymous is exactly compatible
-# with being listed here; the entry key just names the entry.
-fleet:
-  # Optional launch-charter text, keyed only by the singular role wire names: architect, dev,
-  # reviewer. Changes are HOT and reach the next spawn without a daemon restart. Do not put secrets
-  # here: a later launch step writes this text to a world-readable temp file, and ${ENV} interpolation
-  # is deliberately not supported.
-  charters:
-    architect: |-
-      You are an architect in this fleet. You refine work before anyone builds it:
-      scope, acceptance criteria, risks, and a unit split. You read the repo and
-      write analysis. You never commit production code and never open a PR.
-      A design task is worked by two architects. Design alone first, then exchange
-      and say plainly where you disagree. Do not concede just to agree.
-    dev: |-
-      You implement the one unit you were given, and nothing else. You test it,
-      commit it, and open your own pull request. You never merge.
-    reviewer: |-
-      You review the diff you were given. You report bugs, risks and missing tests.
-      You do not change code.
-
-  # Optional. Template for a member tab's label; {role}, {profile}, {model} and {n} are substituted.
-  # {n} counts per role+profile, so `dev: sonnet #2` really is the second sonnet dev. Because {role}
-  # comes from a closed enum, a generated label can never begin with a lead's tabPrefix.
-  # tabLabel: "{role}: {profile} #{n}"
-
-  # Panes that orchestrate rather than are orchestrated. A lead may now be CREATED as well as
-  # recognised: give it a `profile:` and the daemon launches the shortfall when fewer than
-  # `instances` are live. Omit `profile:` and it is recognise-only, as before.
-  #
-  # `tab:` (CB-579) is REQUIRED and is the only field identity depends on — the exact label of the
-  # tab hosting the lead, matched case-insensitively. Label the tab yourself and put that same
-  # string here, and the pane is recognised on the next rescan. Reopen the tab later, or the session
-  # inside it restarts — the terminal id changes; the tab, and its label, do not, so no config edit
-  # follows a restart.
-  #
-  # A lead the daemon launches is labelled BY the daemon with this same `tab:` value, so it is found
-  # by the same scan. A lead counts as live only when herdr also reports a running agent in that
-  # tab — a label left behind by a session that died does not block the relaunch, and a tab that is
-  # gone entirely drops out of the next scan rather than being remembered forever.
-  #
-  # An auto-launched lead is NOT a member: it gets no worker reply charter, is never registered with
-  # the session lifecycle (the idle reaper would kill your orchestrator), and stays on the
-  # subscription — ANTHROPIC_BASE_URL/AUTH_TOKEN are stripped from its env whatever the profile says.
-  # leaders:
-  #   opus-5.0:
-  #     profile: opus                # omit to never create this lead, only recognise it
-  #     instances: 1                 # desired live count; only the shortfall is launched. 0 = off
-  #     tab: "lead: opus-5.0"        # REQUIRED — the exact tab label this lead lives in
-  #     tabPrefix: "lead:"           # only used to guard against a worker tabLabel colliding with
-  #                                  # this convention at startup; plays no part in matching a lead
-  #     scanIntervalSeconds: 10      # rescan cadence, and the worst case before a new tab is seen
-  #     workspace: leads             # where a launched lead's tab is created (default "leads").
-  #                                  # MUST NOT be a member workspace — those are excluded from the
-  #                                  # scan, so a lead placed in one is never found again.
-  #     cwd: /path/to/repo           # the launched lead's working directory (default: bridged's own)
-  #     kind: claude                 # descriptive; reported by bridge_whoami
-  #   gpt-sol-5.6:
-  #     tab: "lead: gpt-sol-5.6"
-  #     kind: opencode
-  #     model: openai/gpt-5.6-terra
-
-  # architects:
-  #   architect-1:
-  #     profile: opus                # a strong model, on the operator's subscription
-  #   architect-2:
-  #     profile: sol                 # a different vendor on purpose — two architects that share a
-  #                                  # model share its blind spots
-  developers:
-    gx10:
-      profile: gx10
-  # reviewers:
-  #   gx10:
-  #     profile: gx10                # the same backend may serve two roles; that is the point
+defaultWorker: gx10

 # Subscription boundary. A worker's base_url host MUST be one of these; the primary
 # must carry none. Every profile above must have its host listed here.
@@ -1,31 +1,25 @@
 package dev.ltms.bridged;

 import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.config.ConfigRef;
-import dev.ltms.bridged.config.ConfigWatcher;
 import dev.ltms.bridged.guard.SubscriptionGuard;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.HerdrClient;
 import dev.ltms.bridged.herdr.HerdrException;
 import dev.ltms.bridged.herdr.LeadTabScanner;
-import dev.ltms.bridged.lead.LeadLauncher;
 import dev.ltms.bridged.herdr.PaneLocator;
 import dev.ltms.bridged.herdr.UnixSocketHerdrClient;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.inject.CompletionResolver;
-import dev.ltms.bridged.inject.ExhaustedPatternLookup;
-import dev.ltms.bridged.inject.ExhaustionSink;
 import dev.ltms.bridged.inject.Injector;
 import dev.ltms.bridged.inject.StatusPoller;
 import dev.ltms.bridged.inject.TurnListener;
-import dev.ltms.bridged.inject.MemberPresence;
-import dev.ltms.bridged.auth.MemberRegistry;
+import dev.ltms.bridged.inject.WorkerPresence;
+import dev.ltms.bridged.auth.ArchitectRegistry;
 import dev.ltms.bridged.auth.CallerResolver;
 import dev.ltms.bridged.mcp.BridgeMcp;
 import dev.ltms.bridged.mcp.ConnectionIdentity;
 import dev.ltms.bridged.metrics.BridgedMetrics;
 import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.health.FleetHealthMonitor;
 import dev.ltms.bridged.mcp.PrimaryRegistry;
 import dev.ltms.bridged.mcp.LsofPeerPidLookup;
 import dev.ltms.bridged.mcp.LsofProcessCwdLookup;
@@ -34,19 +28,17 @@ import dev.ltms.bridged.msg.InMemoryReplyInbox;
 import dev.ltms.bridged.msg.MessageService;
 import dev.ltms.bridged.msg.Rendezvous;
 import dev.ltms.bridged.msg.ReplyInbox;
-import dev.ltms.bridged.msg.LeadHeartbeatLoop;
 import dev.ltms.bridged.msg.ReplyPushLoop;
 import dev.ltms.bridged.rest.BridgedApp;
 import dev.ltms.bridged.session.GitWorktrees;
-import dev.ltms.bridged.session.MemberSession;
 import dev.ltms.bridged.session.SessionManager;
 import dev.ltms.bridged.peer.PeerLauncher;
 import dev.ltms.bridged.session.SessionReaper;
-import dev.ltms.bridged.member.ClaudeCodeLauncher;
-import dev.ltms.bridged.member.CompositePeerLauncher;
-import dev.ltms.bridged.member.HerdrPeerLauncher;
-import dev.ltms.bridged.member.OpenCodeLauncher;
-import dev.ltms.bridged.placement.BackendQuarantine;
+import dev.ltms.bridged.worker.ClaudeCodeLauncher;
+import dev.ltms.bridged.placement.PlacementPolicies;
+import dev.ltms.bridged.worker.CompositePeerLauncher;
+import dev.ltms.bridged.worker.HerdrPeerLauncher;
+import dev.ltms.bridged.worker.OpenCodeLauncher;
 import io.javalin.Javalin;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
@@ -64,7 +56,6 @@ import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Function;
 import java.util.function.Predicate;
 import java.util.function.Supplier;
-import java.util.regex.Pattern;
 import java.util.stream.Collectors;

 /**
@@ -76,6 +67,9 @@ public final class Bridged {

    private static final Logger log = LoggerFactory.getLogger(Bridged.class);

+    /** How often the injector samples a busy worker's status while it has queued work. */
+    private static final long INJECT_POLL_MILLIS = 250;
+
    /** CB-504: how long to wait at startup for herdr's socket before serving degraded. */
    private static final long HERDR_WAIT_SECONDS = 30;
    private static final long HERDR_WAIT_POLL_MILLIS = 500;
@@ -83,15 +77,6 @@ public final class Bridged {
    static void main(String[] args) {
        Path configPath = Path.of(args.length > 0 ? args[0] : "bridged.yaml");
        BridgedConfig cfg = BridgedConfig.load(configPath);
-        // CB-594: report which secret env vars the config actually needs, by name, before anything
-        // else can fail on a silently-empty one. A daemon started without a login shell (launchd)
-        // boots fine either way — this is the only thing that says so out loud.
-        reportRequiredSecrets(cfg);
-        // CB-559: `cfg` stays the startup snapshot — every validation and every piece of one-time
-        // wiring below reads it, and must, because those decisions cannot be unmade. `config` is the
-        // live reference the hot paths read per use. Which keys can actually move is ConfigRef's
-        // contract; adding a reader here does not make a key reloadable by itself.
-        ConfigRef config = new ConfigRef(configPath, cfg);

        // The primary/host env that launched bridged must not be tainted.
        SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
@@ -102,14 +87,13 @@ public final class Bridged {
        // refuses remote connections to a loopback socket. This throws rather than warns so the
        // dangerous configuration cannot be reached by ignoring a log line.
        cfg.validateAuthExposure();
-        cfg.validateLeadTabPrefixes();
+        cfg.validateLeadScan();
        // CB-542: a subscription:true profile whose env: reseats ANTHROPIC_BASE_URL/AUTH_TOKEN would
        // reach an unguarded endpoint (the launcher skips SubscriptionGuard for it). Refuse at load.
        cfg.validateSubscriptionProfiles();
-        cfg.validateCharters();
        // CB-548: every architect slot must name a configured workers: profile — the strong-model
        // backend the future spawn lifecycle would read. A stale reference dies here, not later.
-        cfg.validateMembers();
+        cfg.validateArchitects();

        Path socket = cfg.herdrSocket() != null && !cfg.herdrSocket().isBlank()
                ? Path.of(cfg.herdrSocket())
@@ -122,9 +106,9 @@ public final class Bridged {
        // CB-402: one adapter per configured peer kind, fronted by a composite router. A profile's
        // `kind:` selects its adapter — claude-code (the default) and opencode partition the profile
        // set — and the composite dispatches each SPI call to the adapter that owns the profile/pane.
-        Map<String, BridgedConfig.Profile> claudeProfiles = new LinkedHashMap<>();
-        Map<String, BridgedConfig.Profile> opencodeProfiles = new LinkedHashMap<>();
-        cfg.profiles().forEach((name, w) -> {
+        Map<String, BridgedConfig.Worker> claudeProfiles = new LinkedHashMap<>();
+        Map<String, BridgedConfig.Worker> opencodeProfiles = new LinkedHashMap<>();
+        cfg.workerProfiles().forEach((name, w) -> {
            if (w.isOpenCode()) {
                opencodeProfiles.put(name, w);
            } else {
@@ -137,36 +121,27 @@ public final class Bridged {
        // unless opencode is the only kind configured.
        if (!claudeProfiles.isEmpty() || opencodeProfiles.isEmpty()) {
            adapters.add(new ClaudeCodeLauncher(agents, spaces, guard,
-                    claudeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
-                    cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
-                    () -> config.get().fleet()));
+                    claudeProfiles, cfg.defaultProfile(), System::getenv,
+                    cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs()));
        }
        if (!opencodeProfiles.isEmpty()) {
            adapters.add(new OpenCodeLauncher(agents, spaces,
-                    opencodeProfiles, cfg.effectiveDefaultProfile(), System::getenv,
-                    cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs(),
-                    () -> config.get().fleet()));
+                    opencodeProfiles, cfg.defaultProfile(), System::getenv,
+                    cfg.spawnReadyTimeoutMs(), cfg.spawnReadyPollMs()));
        }
        AtomicReference<Function<String, Integer>> liveCountRef = new AtomicReference<>(_ -> 0);
-        // CB-578 stage B: one quarantine tracker for the whole daemon, shared between the launcher
-        // (checked at spawn) and the exhaustion sink wired in below (written on BACKEND_EXHAUSTED).
-        // The cooldown is deferred (see BridgedConfig#quarantineCooldownSeconds): it is read once
-        // here, at startup, and a config reload only changes it for a daemon restart.
-        BackendQuarantine quarantine = new BackendQuarantine(System::nanoTime,
-                TimeUnit.SECONDS.toNanos(cfg.quarantineCooldownSeconds()));
        PeerLauncher workers = new CompositePeerLauncher(
                adapters,
-                cfg.effectiveDefaultProfile(),
-                config,
-                profileName -> liveCountRef.get().apply(profileName),
-                quarantine);
+                cfg.defaultProfile(),
+                cfg.workerProfiles(),
+                PlacementPolicies.fromName(cfg.placement()),
+                profileName -> liveCountRef.get().apply(profileName));
        // CB-504: under supervision (launchd/systemd) bridged can start before herdr's socket
        // exists. The client itself is lazy — it connects per call — but the orphan reap below is
        // the first thing that actually talks to herdr, so without this wait a boot-order race
        // would crash the daemon into a restart loop. Wait, then degrade rather than die: serving
        // with /healthz reporting "degraded" is strictly more useful than exiting.
-        boolean herdrUp = awaitHerdr(herdr);
-        if (herdrUp) {
+        if (awaitHerdr(herdr)) {
            // CB-117: herdr keeps worker panes alive across a daemon restart, and their ids died
            // with the previous process — reap those leaked orphans now, before we start serving.
            workers.reapOrphanWorkers();
@@ -209,103 +184,46 @@ public final class Bridged {
        if (leadTerminals.size() > 1) {
            log.info("leads: {} panes recognised {}", leadTerminals.size(), leadTerminals.values());
        }
-        // CB-531: on top of the legacy primary.terminal pin, discover leads by the tab labels the
-        // operator writes. CB-557 moved the settings onto the lead they describe, so scanning is on
-        // whenever a `fleet.leaders:` entry exists — with no leads configured the supplier is a
-        // constant and never touches herdr, exactly as a missing `leadScan:` block used to behave.
-        // CB-579: each lead now names its own exact `tab:` label, so one scanner discovers every
-        // configured lead regardless of how differently their tabs are labelled — the old
-        // single-shared-tabPrefix limitation (and its warning) is gone.
+        // CB-531: on top of the static registry, discover leads by the tab labels the operator
+        // writes. Opt-in, so a config with no `leadScan:` block resolves exactly as it did under
+        // CB-530 — the supplier is then a constant and never touches herdr.
        final Supplier<Map<String, String>> leads;
-        var leaders = cfg.fleet().leaders();
-        if (!leaders.isEmpty()) {
-            Set<String> memberSpaces = cfg.profiles().values().stream()
-                    .map(BridgedConfig.Profile::workspace)
+        if (cfg.leadScan() != null) {
+            var scan = cfg.leadScan();
+            Set<String> workerSpaces = cfg.workerProfiles().values().stream()
+                    .map(BridgedConfig.Worker::workspace)
                    .filter(Objects::nonNull)
                    .collect(Collectors.toSet());
-            Map<String, String> tabToName = new LinkedHashMap<>();
-            leaders.forEach((name, leader) -> {
-                if (leader != null && leader.tab() != null && !leader.tab().isBlank()) {
-                    tabToName.put(leader.tab(), name);
-                }
-            });
-            // One shared rescan cadence: still taken from the first entry, as before — it is an
-            // operational cadence, not identity, so there is no correctness reason to give every
-            // lead its own scanner.
-            int scanIntervalSeconds = leaders.values().iterator().next().scanIntervalSeconds();
-            leads = new LeadTabScanner(herdr, tabToName, memberSpaces,
-                    TimeUnit.SECONDS.toNanos(scanIntervalSeconds), System::nanoTime);
-            log.info("lead scan: tabs {} host a lead (rescan every {}s, member spaces {} excluded)",
-                    tabToName.keySet(), scanIntervalSeconds, memberSpaces);
+            leads = new LeadTabScanner(herdr, scan.tabPrefix(), workerSpaces, leadTerminals,
+                    TimeUnit.SECONDS.toNanos(scan.intervalSeconds()), System::nanoTime);
+            log.info("lead scan: tabs labelled '{}…' host a lead (rescan every {}s, worker spaces {} "
+                            + "excluded)",
+                    scan.tabPrefix(), scan.intervalSeconds(), workerSpaces);
        } else {
            leads = () -> leadTerminals;
        }

-        // CB-558: start any declared lead that is not already running. After the scanner is built,
-        // because both read the same tab labels and the ordering makes that dependency visible; and
-        // only when herdr answered, because the launcher's whole safety property is that it can
-        // count live leads first — it must never guess and risk a second orchestrator.
-        if (herdrUp && !leaders.isEmpty()) {
-            int launched = new LeadLauncher(agents, spaces, cfg).ensureLeads();
-            if (launched > 0) {
-                log.info("lead auto-launch: {} lead(s) started", launched);
-            }
-        }
-
        // CB-548: config-declared architect slots. Config supplies only the stable name → profile
        // map; the terminal → slot binding is owned by the registry and is empty at startup, so no
        // pane resolves to an architect until the later spawn lifecycle binds one. The registry is
        // what CallerResolver resolves against and what that lifecycle will read profiles from;
        // nothing here spawns a slot.
-        MemberRegistry members = new MemberRegistry(cfg.fleet());
-        sessions.setMemberLifecycle(members);
-        if (!members.slots().isEmpty()) {
-            log.info("member slots: {} configured {} — none bound yet (a slot is idle until the "
+        ArchitectRegistry architects = new ArchitectRegistry(
+                cfg.architects() == null ? Map.of() : cfg.architects());
+        if (!architects.slots().isEmpty()) {
+            log.info("architect slots: {} configured {} — none bound yet (a slot is idle until the "
                            + "spawn lifecycle binds a live terminal to it)",
-                    members.slots().size(), members.slots().keySet());
+                    architects.slots().size(), architects.slots().keySet());
        }

        // Status-gated injector (CB-103): the single writer into workers, fed by a poller.
        // The blocking message endpoint (CB-104) is the producer; the poller is inert until then.
        // CB-106: a confirmed turn completion resolves a blocked send whose worker never replied.
        Rendezvous rendezvous = new Rendezvous();
-        // CB-578 stage A: classify a completion-fallback scrape that matches a profile's configured
-        // usage-limit refusal as BACKEND_EXHAUSTED rather than handing it back as a real answer.
-        // Compiled once at startup, keyed by profile name; a profile with no exhaustedPattern is
-        // simply absent here, so its workers keep today's completion-fallback behaviour unchanged.
-        Map<String, Pattern> exhaustedPatternsByProfile = new LinkedHashMap<>();
-        cfg.profiles().forEach((name, profile) -> {
-            if (profile.hasExhaustedPattern()) {
-                exhaustedPatternsByProfile.put(name, Pattern.compile(profile.exhaustedPattern()));
-            }
-        });
-        ExhaustedPatternLookup exhaustedPatterns = target -> sessions.roster().stream()
-                .filter(session -> target.equals(session.terminalId()))
-                .findFirst()
-                .map(session -> exhaustedPatternsByProfile.get(session.profile()))
-                .orElse(null);
-        log.info("backend-exhausted classification (CB-578 stage A): {}",
-                CompletionResolver.coverage(cfg.profiles().keySet(), exhaustedPatternsByProfile.keySet()));
-        // CB-578 stage B: on a classification that actually wins, quarantine the exhausted profile's
-        // CREDENTIAL — not the profile name — so a profile sharing that credential (e.g. two models
-        // on one OpenAI account) is refused too, not just the one that happened to report it. Reads
-        // the profile config live off `config`, so a credentialId edit is hot: no restart needed.
-        ExhaustionSink exhaustionSink = (target, reason) -> sessions.roster().stream()
-                .filter(session -> target.equals(session.terminalId()))
-                .findFirst()
-                .map(MemberSession::profile)
-                .map(profileName -> config.get().profiles().get(profileName))
-                .ifPresent(profile -> {
-                    String credentialId = profile.effectiveCredentialId();
-                    quarantine.quarantine(credentialId);
-                    log.warn("credential '{}' quarantined for {}s (profile '{}' classified "
-                                    + "BACKEND_EXHAUSTED): {}", credentialId,
-                            cfg.quarantineCooldownSeconds(), profile.profile(), reason);
-                });
-        CompletionResolver completion = new CompletionResolver(agents, rendezvous, exhaustedPatterns, exhaustionSink);
+        CompletionResolver completion = new CompletionResolver(agents, rendezvous);
        // CB-113: deliver only to an available worker (its MCP is connected), never its boot window.
        // CB-301: the manager's presence bridge records availability and drives SPAWNING → READY.
-        MemberPresence presence = sessions.asPresence();
+        WorkerPresence presence = sessions.asPresence();
        TurnListener turnListener = new TurnListener() {
            @Override
            public void onTurnComplete(String target) {
@@ -325,9 +243,9 @@ public final class Bridged {
            }

            @Override
-            public void onDelivered(String target, dev.ltms.bridged.msg.TurnToken token) {
-                completion.onDelivered(target, token);
-                sessions.onDelivered(target, token);
+            public void onDelivered(String target) {
+                completion.onDelivered(target);
+                sessions.onDelivered(target);
            }

            @Override
@@ -335,16 +253,10 @@ public final class Bridged {
                completion.onTurnFailed(target);
                sessions.onTurnFailed(target);
            }
-
-            @Override
-            public void onTurnFailed(String target, String reason) {
-                completion.onTurnFailed(target, reason);
-                sessions.onTurnFailed(target);
-            }
        };
        Injector injector = new Injector(agents, turnListener, deliverableTo(presence, leads),
                presence::forget);
-        StatusPoller poller = new StatusPoller(agents, injector, Injector.POLL_INTERVAL_MILLIS);
+        StatusPoller poller = new StatusPoller(agents, injector, INJECT_POLL_MILLIS);
        poller.start();

        // CB-307: reply inbox. A broker: block (with a uri) selects the AMQP-backed durable adapter;
@@ -384,65 +296,19 @@ public final class Bridged {
        Metrics metrics = BridgedMetrics.create(sessions, replyInbox);
        var pushLoop = new ReplyPushLoop(primaryRegistry, agents, replyInbox,
                pushScheduler, maxReminders, backoffMs, metrics);
-        // CB-551: idle-lead heartbeat. Opt-in; absent `leadHeartbeat:` this is never constructed, so
-        // an upgraded daemon cannot silently start spending subscription on nudging an idle lead.
-        // It has its own single-thread scheduler and holds its own scheduler shutdown via close().
-        final LeadHeartbeatLoop heartbeat;
-        var heartbeatScheduler = Executors.newSingleThreadScheduledExecutor(r ->
-                Thread.ofVirtual().name("bridge-heartbeat-").unstarted(r));
-        if (cfg.leadHeartbeat() != null) {
-            var hb = cfg.leadHeartbeat();
-            heartbeat = new LeadHeartbeatLoop(primaryRegistry, agents, replyInbox, sessions::roster,
-                    pushLoop, heartbeatScheduler, System::nanoTime,
-                    TimeUnit.SECONDS.toNanos(hb.idleAfterSeconds()), hb.backoffMs(), hb.quietNudgeCap(),
-                    metrics);
-            heartbeat.start();
-        } else {
-            heartbeat = null;
-            heartbeatScheduler.shutdownNow();
-        }
        MessageService messages = new MessageService(agents, injector, rendezvous, replyInbox,
                pushLoop, metrics);

-        // Health is a slow whole-fleet observer. Keep it separate from the 250ms delivery poller.
-        final FleetHealthMonitor healthMonitor;
-        var healthScheduler = Executors.newSingleThreadScheduledExecutor(r ->
-                Thread.ofVirtual().name("bridge-health-").unstarted(r));
-        if (cfg.health() != null && cfg.health().isEnabled()) {
-            // CB-580: a member found GONE/NEVER_READY must fail whatever ticket is waiting on it,
-            // through the same idempotent target-wide operation CB-516 already uses on release.
-            healthMonitor = new FleetHealthMonitor(agents, sessions::roster, messages, healthScheduler,
-                    System::nanoTime, cfg.health().intervalOrDefault(), messages::abandon);
-            String coverage = FleetHealthMonitor.coverage(true,
-                    cfg.health().notifications() != null && cfg.health().notifications().configured());
-            if ("detection-only".equals(coverage)) {
-                log.warn("fleet health: {} (no notification sink configured)", coverage);
-            } else {
-                log.info("fleet health: {}", coverage);
-            }
-            healthMonitor.start();
-        } else {
-            healthMonitor = null;
-            healthScheduler.shutdownNow();
-        }
-
        // CB-520: the reply inbox only consumes for agents this gateway owns. own on acquire,
        // release on teardown. Do this before CB-516 so the inbox is owned before any reply can land.
        sessions.onAcquire(replyInbox::own);
        // CB-516: releasing a worker must fail whatever send was waiting on it. Without this a
        // torn-down delegation kept reporting PENDING until the 30-minute async timeout, and never
        // reached /metrics — the delegation was unresolvable and nothing said so.
-        sessions.onRelease(detail -> {
-            // CB-578 stage C, acceptance criterion 10: a failed ticket's detail should tell a lead
-            // where to re-dispatch onto the same tree, not just that the worker vanished.
-            String reason = "the worker session was released before it replied";
-            if (detail.worktreePath() != null) {
-                reason += "; worktree=" + detail.worktreePath() + " branch=" + detail.branch()
-                        + " snapshot=" + (detail.snapshotRef() != null ? detail.snapshotRef() : "none");
-            }
-            messages.abandon(detail.terminalId(), reason);
-            replyInbox.release(detail.terminalId());
-            primaryRegistry.forgetDelegation(detail.terminalId()); // CB-532: don't leak the lead binding
+        sessions.onRelease(terminal -> {
+            messages.abandon(terminal, "the worker session was released before it replied");
+            replyInbox.release(terminal);
+            primaryRegistry.forgetDelegation(terminal); // CB-532: don't leak the lead binding
        });

        // MCP server face (CB-105): bridge_send/bridge_reply/bridge_status, mounted at /mcp.
@@ -459,39 +325,18 @@ public final class Bridged {
                throw new IllegalStateException("auth.mode=token but env var " + cfg.auth().tokenEnv()
                        + " is unset or empty — export it before starting bridged");
            }
-            callers = CallerResolver.withLeadsAndMembers(identity, true, token, leads, members);
+            callers = CallerResolver.withLeadsAndArchitects(identity, true, token, leads,
+                    architects::snapshot);
            log.info("auth: token mode (bearer required for non-worker callers, env {})",
                    cfg.auth().tokenEnv());
        } else {
-            callers = CallerResolver.withLeadsAndMembers(identity, false, null, leads, members);
+            callers = CallerResolver.withLeadsAndArchitects(identity, false, null, leads,
+                    architects::snapshot);
            log.info("auth: loopback-trust (any loopback non-worker caller is the primary)");
        }

        BridgeMcp mcp = new BridgeMcp(messages, workers, sessions, identity, presence,
-                primaryRegistry, callers, metrics, new BridgeMcp.CapacitySource(profile -> liveCountRef.get().apply(profile),
-                profile -> {
-                    var configured = config.get().profiles().get(profile);
-                    return configured == null ? null : configured.maxLoad();
-                }, () -> config.get().profiles().keySet(), System::nanoTime),
-                new BridgeMcp.HealthCoverageSource(() -> {
-                    var health = config.get().health();
-                    return FleetHealthMonitor.coverage(health != null && health.isEnabled(),
-                            health != null && health.notifications() != null && health.notifications().configured());
-                }),
-                new BridgeMcp.QuarantineSource(profile -> {
-                    var configured = config.get().profiles().get(profile);
-                    return configured == null ? null : configured.effectiveCredentialId();
-                }, quarantine));
-
-        // CB-559: opt-in config reload. With no `configReload:` block nothing is constructed, so an
-        // upgraded daemon behaves exactly as before — the file is read once at boot and never again.
-        final ConfigWatcher configWatcher;
-        if (cfg.configReload() != null && cfg.configReload().isEnabled()) {
-            configWatcher = new ConfigWatcher(config, cfg.configReload().intervalSeconds());
-            configWatcher.start();
-        } else {
-            configWatcher = null;
-        }
+                primaryRegistry, callers, metrics);

        // CB-303 part 3: single ordered shutdown hook. Drain sessions first while herdr is still
        // open (so releases reach the daemon), then stop poller/message/mcp/reaper, and close herdr
@@ -501,9 +346,6 @@ public final class Bridged {
            poller.stop();
            messages.close();
            pushLoop.close();
-            if (heartbeat != null) heartbeat.close(); // CB-551: stop the idle-lead heartbeat scheduler
-            if (healthMonitor != null) healthMonitor.stop();
-            if (configWatcher != null) configWatcher.stop(); // CB-559: stop polling the config file
            mcp.close();
            if (reaper != null) reaper.stop();
            // Release the broker connection last among message resources (no-op for the in-memory inbox).
@@ -525,85 +367,27 @@ public final class Bridged {
    }

    /**
-     * The {@link Injector}'s readiness gate (CB-534): a target is deliverable if it is a spawned
-     * member whose agent has connected the bridge MCP, <em>or</em> a lead.
+     * The {@link Injector}'s readiness gate (CB-534): a target is deliverable if it is a worker whose
+     * agent has connected the bridge MCP, <em>or</em> a lead.
     *
-     * <p>The gate exists for one reason — to hold a delivery out of a <em>spawned</em> member's boot
+     * <p>The gate exists for one reason — to hold a delivery out of a <em>spawned</em> worker's boot
     * window, where herdr already reports {@code idle} but the TUI would drop an injected paste. That
     * hazard is a property of spawning. A lead is never spawned: the operator started it and named it
     * (or labelled its tab) only once it was up, so there is no boot window to guard.
     *
-     * <p>A lead is also never enrolled in {@link MemberPresence} — {@code BridgeMcp} marks presence
-     * for every spawned member (worker and architect), deliberately, since that map doubles as the
-     * member roster's availability signal and a lead counted there would show up as an available
-     * member. So without the second disjunct a lead is permanently un-deliverable: every
-     * lead→lead send sat on the gate for {@code READINESS_GRACE_POLLS} (~60s) and then failed
-     * having never been typed into the pane.
+     * <p>A lead is also never enrolled in {@link WorkerPresence} — {@code BridgeMcp} marks presence
+     * only for a worker, deliberately, since that map doubles as the worker roster's availability
+     * signal and a lead counted there would show up as an available worker. So without the second
+     * disjunct a lead is permanently un-deliverable: every lead→lead send sat on the gate for
+     * {@code READINESS_GRACE_POLLS} (~60s) and then failed having never been typed into the pane.
     *
     * <p>The lead set is read through the supplier on each call rather than snapshotted, so a lead
     * discovered by {@code leadScan} after startup becomes deliverable without a restart.
     */
-    static Predicate<String> deliverableTo(MemberPresence presence, Supplier<Map<String, String>> leads) {
+    static Predicate<String> deliverableTo(WorkerPresence presence, Supplier<Map<String, String>> leads) {
        return target -> presence.isPresent(target) || leads.get().containsKey(target);
    }

-    /**
-     * CB-594: which env vars the loaded config actually needs, and why — every non-{@code
-     * subscription} profile's {@code tokenEnv} (a subscription profile never reads one, see
-     * {@link BridgedConfig.Profile#isSubscription()}), plus every profile's {@code gitTokenEnv}
-     * where set (opt-in). Derived from the config, not hard-coded, so a new profile is covered for
-     * free. A var required by more than one profile is one entry naming every profile that needs
-     * it. Deliberately excludes {@code auth.tokenEnv}: that one is already enforced loudly, by a
-     * startup throw, a few lines above this method's call site.
-     *
-     * <p>Package-private and pure (no I/O, no logging) so the derivation is unit-testable without
-     * capturing log output; {@link #reportRequiredSecrets(BridgedConfig)} is the logging caller.
-     */
-    static Map<String, List<String>> requiredSecretEnvVars(BridgedConfig cfg) {
-        Map<String, List<String>> requiredBy = new LinkedHashMap<>();
-        cfg.profiles().forEach((name, profile) -> {
-            if (!profile.isSubscription()) {
-                requiredBy.computeIfAbsent(profile.tokenEnv(), _ -> new ArrayList<>())
-                        .add("profile '" + name + "' tokenEnv");
-            }
-            if (profile.hasGitToken()) {
-                requiredBy.computeIfAbsent(profile.gitTokenEnv(), _ -> new ArrayList<>())
-                        .add("profile '" + name + "' gitTokenEnv");
-            }
-        });
-        return requiredBy;
-    }
-
-    /**
-     * CB-594: log, by name only, which required env vars (see {@link #requiredSecretEnvVars}) are
-     * set in the daemon's own process environment — the environment every profile's {@code
-     * tokenEnv}/{@code gitTokenEnv} is read from at spawn time (see
-     * {@code HerdrPeerLauncher.resolveEnv}). Never logs a value, a prefix, or a length.
-     *
-     * <p>A missing entry only warns — it must never refuse to start. A daemon that boots and says
-     * what is wrong is strictly more useful than one that will not boot at all.
-     */
-    private static void reportRequiredSecrets(BridgedConfig cfg) {
-        Map<String, List<String>> requiredBy = requiredSecretEnvVars(cfg);
-        if (requiredBy.isEmpty()) {
-            log.info("startup secrets: no profile references a token env var — nothing to check");
-            return;
-        }
-        Map<String, String> env = System.getenv();
-        requiredBy.forEach((varName, sources) -> {
-            String value = env.get(varName);
-            if (value != null && !value.isBlank()) {
-                log.info("startup secret {}: set ({})", varName, String.join(", ", sources));
-            } else {
-                log.warn("startup secret {}: MISSING ({}) — the daemon will start anyway, and this "
-                                + "failure stays invisible until a worker actually needs it. Fix "
-                                + "${SHARED_ENV}/tools/secrets.sh and restart bridged from a LOGIN "
-                                + "shell (see scripts/redeploy-bridged.sh).",
-                        varName, String.join(", ", sources));
-            }
-        });
-    }
-
    /**
     * Poll herdr's {@code ping} until it answers or {@link #HERDR_WAIT_SECONDS} elapses (CB-504).
     *
@@ -1,15 +1,9 @@
 package dev.ltms.bridged.auth;

 import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.peer.MemberRole;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;

-import java.util.Collections;
 import java.util.HashMap;
-import java.util.LinkedHashMap;
 import java.util.Map;
-import java.util.Objects;

 /**
 * The architect-slot registry (CB-548): every gateway-local architect name and the strong-model
@@ -32,64 +26,21 @@ import java.util.Objects;
 * exposes the map the resolver resolves against plus the profile lookup lifecycle will call.
 * Nothing here creates or manages an architect session.
 */
-public final class MemberRegistry implements MemberLifecycle {
+public final class ArchitectRegistry {

-    private static final Logger log = LoggerFactory.getLogger(MemberRegistry.class);
-
-    /**
-     * One flattened {@code fleet:} entry.
-     *
-     * <p>Flattened because a slot name is unique only <em>within</em> its pool — {@code sonnet} may
-     * legitimately be both a developer and a reviewer — while a terminal binds to exactly one thing.
-     * The qualified {@link #key()} is what that binding uses.
-     *
-     * @param name    the slot's key inside its pool
-     * @param role    the pool it came from
-     * @param profile the backend it runs on
-     */
-    public record Entry(String name, MemberRole role, String profile) {
-        /** {@code "architect:opus"} — unique across pools, unlike {@link #name()}. */
-        public String key() {
-            return role.wireName() + ":" + name;
-        }
-    }
-
-    private final Map<String, Entry> slots;
-    /** Live {@code terminal_id → qualified slot key}; guarded by {@code this}. */
+    private final Map<String, BridgedConfig.Architect> slots;
+    /** Live {@code terminal_id → slot name}; guarded by {@code this}. */
    private final Map<String, String> terminalToSlot = new HashMap<>();

-    /** Flatten every role pool in {@code fleet} into one registry. Leaders are not members. */
-    public MemberRegistry(BridgedConfig.Fleet fleet) {
-        Map<String, Entry> flat = new LinkedHashMap<>();
-        if (fleet != null) {
-            for (MemberRole role : MemberRole.values()) {
-                fleet.pool(role).forEach((name, slot) -> {
-                    if (slot != null) {
-                        Entry e = new Entry(name, role, slot.profile());
-                        flat.put(e.key(), e);
-                    }
-                });
-            }
-        }
-        this.slots = Collections.unmodifiableMap(flat);
+    public ArchitectRegistry(Map<String, BridgedConfig.Architect> slots) {
+        this.slots = slots == null ? Map.of() : Map.copyOf(slots);
    }

-    /** The configured slots, keyed by qualified {@link Entry#key()}. Unmodifiable snapshot. */
-    public Map<String, Entry> slots() {
+    /** The configured slots, keyed by gateway-local unique name. Unmodifiable snapshot. */
+    public Map<String, BridgedConfig.Architect> slots() {
        return slots;
    }

-    /** The slots belonging to {@code role}, in definition order. */
-    public Map<String, Entry> slotsFor(MemberRole role) {
-        Map<String, Entry> out = new LinkedHashMap<>();
-        slots.forEach((key, e) -> {
-            if (e.role() == role) {
-                out.put(key, e);
-            }
-        });
-        return Collections.unmodifiableMap(out);
-    }
-
    /**
     * An immutable copy of the live {@code terminal_id → slot name} bindings.
     *
@@ -120,20 +71,8 @@ public final class MemberRegistry implements MemberLifecycle {
     *         declares none
     */
    public String profileForSlot(String slotName) {
-        Entry e = slots.get(slotName);
-        return (e == null || e.profile() == null) ? null : e.profile();
-    }
-
-    /** The role a qualified slot key belongs to, or {@code null} when the key is unknown. */
-    public MemberRole roleForSlot(String slotName) {
-        Entry e = slots.get(slotName);
-        return e == null ? null : e.role();
-    }
-
-    /** The unqualified configured name for a slot, or {@code null} if it is unknown. */
-    public String nameForSlot(String slotName) {
-        Entry e = slots.get(slotName);
-        return e == null ? null : e.name();
+        BridgedConfig.Architect a = slots.get(slotName);
+        return (a == null || a.profile() == null) ? null : a.profile();
    }

    /** True when {@code slotName} is a configured architect slot. */
@@ -200,33 +139,4 @@ public final class MemberRegistry implements MemberLifecycle {
            return true;
        }
    }
-
-    /**
-     * Bind only architect sessions to a free slot with the resolved profile.
-     *
-     * <p>The role check is lifecycle policy. {@link CallerResolver} repeats it when resolving a
-     * binding, so a later lifecycle regression cannot turn a worker into an architect.
-     */
-    @Override
-    public void acquired(MemberRole role, String profile, String terminal) {
-        if (role != MemberRole.ARCHITECT || terminal == null || terminal.isBlank()) {
-            return;
-        }
-        // slotsFor preserves definition order, so duplicate-profile slots use the first free one.
-        for (Entry entry : slotsFor(MemberRole.ARCHITECT).values()) {
-            if (Objects.equals(profile, entry.profile()) && bind(entry.key(), terminal)) {
-                return;
-            }
-        }
-        log.info("member slot: no free architect slot for profile={}; session remains a worker", profile);
-    }
-
-    /** Unbind a released terminal using the compare-safe registry operation. */
-    @Override
-    public void released(String terminal) {
-        String slot = slotForTerminal(terminal);
-        if (slot != null) {
-            unbind(slot, terminal);
-        }
-    }
 }
@@ -1,12 +1,10 @@
 package dev.ltms.bridged.auth;

 import dev.ltms.bridged.mcp.ConnectionIdentity;
-import dev.ltms.bridged.peer.MemberRole;

 import java.nio.charset.StandardCharsets;
 import java.security.MessageDigest;
 import java.util.Map;
-import java.util.function.Function;
 import java.util.function.Supplier;

 /**
@@ -62,16 +60,14 @@ public final class CallerResolver {
     * in {@code Bridged} reads a constant from config, which is the degenerate live case.
     */
    private final Supplier<Map<String, String>> architectTerminals;
-    private final Function<String, MemberRole> memberSlotRoles;
-    private final Function<String, String> memberSlotNames;

-    /** Loopback-trust resolver: no token required, historical behaviour. Test-only. */
-    CallerResolver(ConnectionIdentity identity) {
+    /** Loopback-trust resolver: no token required, historical behaviour. */
+    public CallerResolver(ConnectionIdentity identity) {
        this(identity, false, null, Map.of());
    }

-    /** As {@link #CallerResolver(ConnectionIdentity, boolean, String, Map)} with no leads pinned. Test-only. */
-    CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token) {
+    /** As {@link #CallerResolver(ConnectionIdentity, boolean, String, Map)} with no leads pinned. */
+    public CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token) {
        this(identity, tokenMode, token, Map.of());
    }

@@ -86,8 +82,8 @@ public final class CallerResolver {
     * @param pinnedPrimaryTerminal the primary's own herdr {@code terminal_id}
     *                              ({@code null}/blank = unpinned)
     */
-    static CallerResolver pinnedTo(ConnectionIdentity identity, boolean tokenMode,
-                                   String token, String pinnedPrimaryTerminal) {
+    public static CallerResolver pinnedTo(ConnectionIdentity identity, boolean tokenMode,
+                                          String token, String pinnedPrimaryTerminal) {
        return new CallerResolver(identity, tokenMode, token,
                pinnedPrimaryTerminal == null || pinnedPrimaryTerminal.isBlank()
                        ? Map.of() : Map.of(pinnedPrimaryTerminal, "primary"));
@@ -102,11 +98,21 @@ public final class CallerResolver {
     *                       {@link Role#PRIMARY} — rather than a worker. Empty = nothing pinned,
     *                       so every pane resolves as a worker.
     */
-    CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
-                   Map<String, String> leadTerminals) {
+    public CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                          Map<String, String> leadTerminals) {
        this(identity, tokenMode, token, fixed(leadTerminals), null);
    }

+    /**
+     * Map-form of both registries (CB-548): lead terminals and the initial architect terminal
+     * bindings, each snapshotted at construction (a handed-over map is not offered as live state).
+     */
+    public CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
+                          Map<String, String> leadTerminals,
+                          Map<String, String> architectTerminals) {
+        this(identity, tokenMode, token, fixed(leadTerminals), fixed(architectTerminals));
+    }
+
    /**
     * Live-registry form: {@code leadTerminals} is consulted on every resolve, so leads discovered
     * after startup (CB-531's tab scan) take effect without a restart.
@@ -115,26 +121,26 @@ public final class CallerResolver {
     * {@link #pinnedTo}: {@code Map} and {@code Supplier} overloads are ambiguous for a literal
     * {@code null}.
     */
-    static CallerResolver withLeads(ConnectionIdentity identity, boolean tokenMode,
-                                    String token,
-                                    Supplier<Map<String, String>> leadTerminals) {
+    public static CallerResolver withLeads(ConnectionIdentity identity, boolean tokenMode,
+                                           String token,
+                                           Supplier<Map<String, String>> leadTerminals) {
        return new CallerResolver(identity, tokenMode, token, leadTerminals, null);
    }

    /**
-     * Live registry form that can confirm a bound slot is an architect slot.
+     * Live-registry form for both {@code leadTerminals} and the CB-548 architect registry: both
+     * are consulted on every resolve, so a slot binding injected after startup takes effect
+     * without a restart.
     *
-     * <p>This is the only public construction path. It keeps terminal bindings and slot roles in
-     * the same {@link MemberRegistry}, so a configured architect can resolve as an architect.
+     * <p>A static factory rather than a constructor overload, for the same reason as
+     * {@link #pinnedTo}: too many {@code Map}/{@code Supplier} combinations to make {@code null}
+     * unambiguous.
     */
-    public static CallerResolver withLeadsAndMembers(ConnectionIdentity identity,
-                                                       boolean tokenMode, String token,
-                                                       Supplier<Map<String, String>> leadTerminals,
-                                                       MemberRegistry members) {
-        return new CallerResolver(identity, tokenMode, token, leadTerminals,
-                members == null ? null : members::snapshot,
-                members == null ? null : members::roleForSlot,
-                members == null ? null : members::nameForSlot);
+    public static CallerResolver withLeadsAndArchitects(ConnectionIdentity identity,
+                                                        boolean tokenMode, String token,
+                                                        Supplier<Map<String, String>> leadTerminals,
+                                                        Supplier<Map<String, String>> architectTerminals) {
+        return new CallerResolver(identity, tokenMode, token, leadTerminals, architectTerminals);
    }

    private static Supplier<Map<String, String>> fixed(Map<String, String> leadTerminals) {
@@ -145,21 +151,6 @@ public final class CallerResolver {
    private CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
                           Supplier<Map<String, String>> leadTerminals,
                           Supplier<Map<String, String>> architectTerminals) {
-        this(identity, tokenMode, token, leadTerminals, architectTerminals, null);
-    }
-
-    private CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
-                           Supplier<Map<String, String>> leadTerminals,
-                           Supplier<Map<String, String>> architectTerminals,
-                           Function<String, MemberRole> memberSlotRoles) {
-        this(identity, tokenMode, token, leadTerminals, architectTerminals, memberSlotRoles, null);
-    }
-
-    private CallerResolver(ConnectionIdentity identity, boolean tokenMode, String token,
-                           Supplier<Map<String, String>> leadTerminals,
-                           Supplier<Map<String, String>> architectTerminals,
-                           Function<String, MemberRole> memberSlotRoles,
-                           Function<String, String> memberSlotNames) {
        if (tokenMode && (token == null || token.isBlank())) {
            throw new IllegalArgumentException(
                    "auth.mode=token requires a non-empty token; check that the env var named by "
@@ -170,8 +161,6 @@ public final class CallerResolver {
        this.expectedToken = tokenMode ? token.getBytes(StandardCharsets.UTF_8) : null;
        this.leadTerminals = leadTerminals == null ? Map::of : leadTerminals;
        this.architectTerminals = architectTerminals == null ? Map::of : architectTerminals;
-        this.memberSlotRoles = memberSlotRoles == null ? _ -> null : memberSlotRoles;
-        this.memberSlotNames = memberSlotNames == null ? Function.identity() : memberSlotNames;
    }

    /**
@@ -194,7 +183,7 @@ public final class CallerResolver {
     * here but would not <em>resolve</em> (or the reverse) cannot drift apart. Live for the same
     * reason as {@link #leads()}.
     */
-    public Map<String, String> members() {
+    public Map<String, String> architects() {
        return architectTerminals.get();
    }

@@ -217,12 +206,11 @@ public final class CallerResolver {
                return Principal.leader(lead, c.terminal(), c.pid());
            }
            String slot = architectTerminals.get().get(c.terminal());
-            if (slot != null && memberSlotRoles.apply(slot) == MemberRole.ARCHITECT) {
+            if (slot != null) {
                // The config/live binding names this pane as an architect slot's own. Same
                // unforgeable pane mapping; the live binding, never a request argument, decides.
-                // Check the slot role too: this defence in depth prevents a bad lifecycle bind from
-                // escalating a dev or reviewer into an architect. Checked before the worker fallback.
-                return Principal.architect(memberSlotNames.apply(slot), c.terminal(), c.pid());
+                // Checked before the generic worker fallback, per the CB-548 precedence order.
+                return Principal.architect(slot, c.terminal(), c.pid());
            }
            return Principal.worker(c.terminal(), c.pid()); // unforgeable; never token-gated
        }
@@ -1,21 +0,0 @@
-package dev.ltms.bridged.auth;
-
-import dev.ltms.bridged.peer.MemberRole;
-
-/** Optional session lifecycle hook for live member-slot bindings. */
-public interface MemberLifecycle {
-
-    MemberLifecycle NONE = new MemberLifecycle() {
-        @Override
-        public void acquired(MemberRole role, String profile, String terminal) {
-        }
-
-        @Override
-        public void released(String terminal) {
-        }
-    };
-
-    void acquired(MemberRole role, String profile, String terminal);
-
-    void released(String terminal);
-}
@@ -48,7 +48,7 @@ public record Principal(Role role, String terminal, long pid, String name) {
     * made a lead unaddressable: {@link #ownsSession} could never be true for it, so
     * {@code bridge_reply} was refused and one lead could send to another but never be answered.
     * The terminal now means "which pane is this caller", the presence map keys on
-     * {@link #isSpawnedMember()} instead, and a lead is a peer that can both send and receive.
+     * {@link #isWorker()} instead, and a lead is a peer that can both send and receive.
     */
    public static Principal leader(String name, String terminal, long pid) {
        return new Principal(Role.PRIMARY, terminal, pid, name);
@@ -85,16 +85,6 @@ public record Principal(Role role, String terminal, long pid, String name) {
        return role == Role.WORKER;
    }

-    /**
-     * Whether this caller is a spawned member with its own pane.
-     *
-     * <p>Both workers and architects are spawned members. A lead is excluded because recording it
-     * as present would count it as an available member in the roster.
-     */
-    public boolean isSpawnedMember() {
-        return role == Role.WORKER || role == Role.ARCHITECT;
-    }
-
    public boolean isAnonymous() {
        return role == Role.ANONYMOUS;
    }
@@ -1,291 +0,0 @@
-package dev.ltms.bridged.config;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.nio.file.Path;
-import java.util.ArrayList;
-import java.util.LinkedHashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
-import java.util.concurrent.atomic.AtomicReference;
-import java.util.function.Supplier;
-
-/**
- * The daemon's live configuration, re-readable without a restart (CB-559).
- *
- * <p>Consumers hold this, not a {@link BridgedConfig}, and read through {@link #get()} at the point
- * of use. A component that captures {@code ref.get()} into a field at construction has opted out of
- * reload — which is sometimes right (see <em>deferred</em> below), but it must then be a deliberate
- * choice rather than an accident of where the field was initialised.
- *
- * <h2>Not every key can change under a running daemon</h2>
- * Keys fall into three classes, and the difference is about what already exists when the reload
- * happens — not about how important the key is.
- *
- * <ul>
- *   <li><strong>Hot</strong> — re-read per use, so a reload takes effect on the next spawn:
- *       {@code fleet:} (every role pool, {@code charters}, and {@code tabLabel}),
- *       {@code placement:}, and an existing profile's {@code weight} / {@code maxLoad}. Those
- *       three are read through a supplier on {@code CompositePeerLauncher}, which is what makes
- *       them hot — not the fact that they are config. <strong>This does NOT include
- *       {@code fleet.leaders}</strong>: {@code Bridged.main} reads {@code cfg.fleet().leaders()}
- *       once at startup to build the {@code LeadTabScanner} and the {@code LeadLauncher}, and
- *       neither is reconstructed on reload — so a lead added, removed, or re-{@code tab}'d under
- *       {@code fleet.leaders} needs a restart, the same as any deferred key below.</li>
- *   <li><strong>Deferred</strong> — accepted into the new snapshot, but the wiring built at startup
- *       keeps the old value until a restart: {@code lifecycle:}, {@code leadHeartbeat:},
- *       {@code spawnReadyTimeoutMs} / {@code spawnReadyPollMs}, {@code quarantineCooldownSeconds}
- *       (CB-578 stage B — baked once into the {@code BackendQuarantine} built at startup),
- *       {@code guard:}, {@code worktreeRoot:}, adding or removing a profile (a new backend needs its own launcher,
- *       which is constructed once), <em>and an existing profile's launch settings</em> —
- *       {@code model}, {@code baseUrl}, {@code argv}, {@code env}, {@code mcpUrl},
- *       {@code exhaustedPattern} (CB-578 stage A — compiled once into {@code Bridged.main}'s
- *       pattern map at startup), and the rest. {@code credentialId} (CB-578 stage B) is NOT on
- *       this list — it is read live off the config supplier at every quarantine check and
- *       exhaustion event, exactly like {@code weight} / {@code maxLoad}, so it is hot instead.
- *       {@code HerdrPeerLauncher} takes {@code Map.copyOf(profiles)} at construction and resolves
- *       each spawn out of that copy, so those never reach a launch until the daemon restarts. A
- *       reload logs these rather than pretending they applied.</li>
- *   <li><strong>Cold</strong> — cannot change at all under a running daemon: {@code bind:},
- *       {@code herdrSocket:}, {@code broker:} and {@code auth:}. The socket is bound, the broker
- *       connection is open, and the auth mode decides who may reach the port that is already
- *       listening.</li>
- * </ul>
- *
- * <p><strong>A cold change refuses the whole reload.</strong> Not the hot half applied and the cold
- * half warned about: that would leave the running daemon in a state matching no file on disk, which
- * is the worst thing a reload can do to an operator debugging one. Refusing keeps the invariant that
- * the live config is always some version of the file, and the message names the keys that must
- * change through a restart.
- *
- * <p>A reload that fails to parse or fails validation is also refused, and the previous config keeps
- * running. A config file being edited is normally read once mid-save; degrading a working daemon
- * because it caught a half-written file would be a bad trade.
- */
-public final class ConfigRef implements Supplier<BridgedConfig> {
-
-    private static final Logger log = LoggerFactory.getLogger(ConfigRef.class);
-
-    /** Keys that cannot change under a running daemon — see the class doc. */
-    private static final Set<String> COLD_KEYS =
-            Set.of("bind", "herdrSocket", "broker", "auth");
-
-    private final Path path;
-    private final AtomicReference<BridgedConfig> current;
-
-    public ConfigRef(Path path, BridgedConfig initial) {
-        this.path = path;
-        this.current = new AtomicReference<>(Objects.requireNonNull(initial, "initial config"));
-    }
-
-    /** A fixed reference that never reloads — for tests and for wiring built from a config in code. */
-    public static ConfigRef fixed(BridgedConfig cfg) {
-        return new ConfigRef(null, cfg);
-    }
-
-    /** The live configuration. Read this per use; do not cache it in a field. */
-    @Override
-    public BridgedConfig get() {
-        return current.get();
-    }
-
-    /** The file this ref reloads from, or {@code null} for a {@link #fixed} ref. */
-    public Path path() {
-        return path;
-    }
-
-    /**
-     * What a reload attempt did.
-     *
-     * @param applied  true when the new config is now live
-     * @param coldKeys cold keys whose value changed, which is why an unapplied reload was refused
-     * @param deferred keys that changed and were accepted, but whose effect waits for a restart
-     * @param error    the parse or validation failure that refused the reload, else {@code null}
-     */
-    public record Outcome(boolean applied, List<String> coldKeys, List<String> deferred,
-                          String error) {
-
-        public Outcome {
-            coldKeys = List.copyOf(coldKeys);
-            deferred = List.copyOf(deferred);
-        }
-
-        static Outcome refusedCold(List<String> keys) {
-            return new Outcome(false, keys, List.of(), null);
-        }
-
-        static Outcome failed(String error) {
-            return new Outcome(false, List.of(), List.of(), error);
-        }
-
-        /** A one-line summary for the operator — the reason, not just the verdict. */
-        public String summary() {
-            if (error != null) {
-                return "config reload refused — " + error;
-            }
-            if (!applied) {
-                return "config reload refused — these keys cannot change under a running daemon: "
-                        + String.join(", ", coldKeys) + ". Restart bridged to apply them.";
-            }
-            if (!deferred.isEmpty()) {
-                return "config reloaded; these changes need a restart to take effect: "
-                        + String.join(", ", deferred);
-            }
-            return "config reloaded";
-        }
-    }
-
-    /**
-     * Re-read the file, validate it, and swap it in when nothing cold changed.
-     *
-     * <p>Never throws: a reload is a best-effort operation on a daemon that is already serving, and
-     * a bad edit must not take it down. Every failure path leaves the previous config live and is
-     * reported through the returned {@link Outcome}.
-     */
-    public Outcome reload() {
-        if (path == null) {
-            return Outcome.failed("this config was built in code and has no file to reload from");
-        }
-        BridgedConfig old = current.get();
-        BridgedConfig fresh;
-        try {
-            fresh = BridgedConfig.load(path);
-            // The same gate startup runs. A config that would have refused to boot must not be able
-            // to slip in through a reload — that is how a daemon ends up in a state it could never
-            // have started in, which is the hardest kind to debug.
-            fresh.validateAuthExposure();
-            fresh.validateLeadTabPrefixes();
-            fresh.validateSubscriptionProfiles();
-            fresh.validateCharters();
-            fresh.validateMembers();
-        } catch (RuntimeException e) {
-            String msg = e.getMessage() == null ? e.toString() : e.getMessage();
-            log.warn("config reload from {} refused, keeping the running config: {}", path, msg);
-            return Outcome.failed(msg);
-        }
-
-        List<String> cold = changedColdKeys(old, fresh);
-        if (!cold.isEmpty()) {
-            Outcome out = Outcome.refusedCold(cold);
-            log.warn(out.summary());
-            return out;
-        }
-
-        List<String> deferred = changedDeferredKeys(old, fresh);
-        current.set(fresh);
-        Outcome out = new Outcome(true, List.of(), deferred, null);
-        log.info(out.summary());
-        return out;
-    }
-
-    /** Cold keys whose value differs between the running config and the candidate. */
-    private static List<String> changedColdKeys(BridgedConfig old, BridgedConfig fresh) {
-        List<String> changed = new ArrayList<>();
-        if (!Objects.equals(old.bind(), fresh.bind())) {
-            changed.add("bind");
-        }
-        if (!Objects.equals(old.herdrSocket(), fresh.herdrSocket())) {
-            changed.add("herdrSocket");
-        }
-        if (!Objects.equals(old.broker(), fresh.broker())) {
-            changed.add("broker");
-        }
-        if (!Objects.equals(old.auth(), fresh.auth())) {
-            changed.add("auth");
-        }
-        // Kept in step with COLD_KEYS so the doc and the code cannot drift apart silently.
-        assert COLD_KEYS.containsAll(changed) : "a cold key was reported that COLD_KEYS omits";
-        return changed;
-    }
-
-    /** Changed keys that were accepted but whose effect waits for a restart. */
-    private static List<String> changedDeferredKeys(BridgedConfig old, BridgedConfig fresh) {
-        List<String> changed = new ArrayList<>();
-        if (!Objects.equals(old.lifecycle(), fresh.lifecycle())) {
-            changed.add("lifecycle");
-        }
-        if (!Objects.equals(old.leadHeartbeat(), fresh.leadHeartbeat())) {
-            changed.add("leadHeartbeat");
-        }
-        if (!Objects.equals(old.guard(), fresh.guard())) {
-            changed.add("guard");
-        }
-        if (!Objects.equals(old.worktreeRoot(), fresh.worktreeRoot())) {
-            changed.add("worktreeRoot");
-        }
-        if (!Objects.equals(old.spawnReadyTimeoutMs(), fresh.spawnReadyTimeoutMs())
-                || !Objects.equals(old.spawnReadyPollMs(), fresh.spawnReadyPollMs())) {
-            changed.add("spawnReady*");
-        }
-        // CB-578 stage B: baked once into the BackendQuarantine built at startup — a running
-        // quarantine keeps its original cooldown regardless, and a new cooldown only applies to a
-        // quarantine that starts after a restart.
-        if (!Objects.equals(old.quarantineCooldownSeconds(), fresh.quarantineCooldownSeconds())) {
-            changed.add("quarantineCooldownSeconds");
-        }
-        Map<String, BridgedConfig.Profile> before =
-                old.profiles() == null ? Map.of() : old.profiles();
-        Map<String, BridgedConfig.Profile> after =
-                fresh.profiles() == null ? Map.of() : fresh.profiles();
-        // Adding or removing a profile is deferred: a new backend needs its own launcher, and
-        // launchers are built once at startup.
-        if (!before.keySet().equals(after.keySet())) {
-            Set<String> diff = new LinkedHashSet<>(before.keySet());
-            diff.addAll(after.keySet());
-            diff.removeIf(p -> before.containsKey(p) && after.containsKey(p));
-            changed.add("profiles (added/removed: " + String.join(", ", diff) + ")");
-        }
-        // An EXISTING profile's launch settings are deferred too, and this is easy to get wrong:
-        // `HerdrPeerLauncher` takes `Map.copyOf(profiles)` at construction and `spawn` resolves the
-        // profile out of that snapshot, so a reloaded model/baseUrl/argv/env never reaches a launch.
-        // Only weight and maxLoad are genuinely hot, because placement reads them through the
-        // supplier on the composite rather than from the adapter's copy. Without this check a
-        // changed model would report "config reloaded" and silently do nothing — the worst outcome
-        // a reload can produce, because the operator has no reason to doubt it.
-        List<String> relaunch = new ArrayList<>();
-        before.forEach((name, was) -> {
-            BridgedConfig.Profile now = after.get(name);
-            if (now != null && !sameLaunchSettings(was, now)) {
-                relaunch.add(name);
-            }
-        });
-        if (!relaunch.isEmpty()) {
-            changed.add("profiles." + String.join("/", relaunch) + " launch settings "
-                    + "(model, baseUrl, argv, env, …) — the launcher holds a startup snapshot");
-        }
-        return changed;
-    }
-
-    /**
-     * Whether two versions of a profile would launch a peer identically. Compares every component
-     * the launcher reads at spawn; {@code weight}, {@code maxLoad} and {@code credentialId} are
-     * excluded because those are read live (by the placement policy and, for credentialId, by
-     * {@code CompositePeerLauncher}/the CB-578 stage B exhaustion sink) and really do take effect on
-     * the next spawn.
-     */
-    private static boolean sameLaunchSettings(BridgedConfig.Profile a, BridgedConfig.Profile b) {
-        return Objects.equals(a.baseUrl(), b.baseUrl())
-                && Objects.equals(a.model(), b.model())
-                && Objects.equals(a.configDir(), b.configDir())
-                && Objects.equals(a.tokenEnv(), b.tokenEnv())
-                && Objects.equals(a.argv(), b.argv())
-                && Objects.equals(a.placement(), b.placement())
-                && Objects.equals(a.workspace(), b.workspace())
-                && Objects.equals(a.tabLabel(), b.tabLabel())
-                && Objects.equals(a.mcpUrl(), b.mcpUrl())
-                && Objects.equals(a.cwd(), b.cwd())
-                && Objects.equals(a.parityOverlay(), b.parityOverlay())
-                && Objects.equals(a.gitTokenEnv(), b.gitTokenEnv())
-                && Objects.equals(a.gitHostEnv(), b.gitHostEnv())
-                && Objects.equals(a.kind(), b.kind())
-                && Objects.equals(a.env(), b.env())
-                && Objects.equals(a.subscription(), b.subscription())
-                // CB-578 stage B: exhaustedPattern is compiled once into Bridged.main's pattern map
-                // at startup (see ExhaustedPatternLookup wiring) — a reload never re-reads it, so a
-                // changed pattern must be reported as deferred, exactly like model/baseUrl/argv.
-                && Objects.equals(a.exhaustedPattern(), b.exhaustedPattern());
-    }
-}
@@ -1,96 +0,0 @@
-package dev.ltms.bridged.config;
-
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.concurrent.Executors;
-import java.util.concurrent.ScheduledExecutorService;
-import java.util.concurrent.TimeUnit;
-
-/**
- * Polls {@code bridged.yaml}'s modified time and asks {@link ConfigRef} to reload when it moves
- * (CB-559). Opt-in through {@code configReload.enabled}.
- *
- * <p><strong>Why polling and not a filesystem watch.</strong> {@code WatchService} on macOS has no
- * native backend — it falls back to polling internally anyway, at an interval this code does not
- * control — and editors save config files in ways that produce a different event mix per editor
- * (write-in-place, write-and-rename, write-temp-and-swap). A modified-time check treats all of them
- * the same and is a single {@code stat} per tick, which at a ten-second cadence costs nothing worth
- * measuring.
- *
- * <p><strong>A missing or unreadable file is not a reason to act.</strong> Many editors briefly
- * unlink the file during a save. Reloading on "it vanished" would mean reloading from a file that no
- * longer exists; reporting an error every tick would bury the log. So an unreadable file is skipped
- * silently and the next tick tries again — the running config stays live, which is the correct
- * outcome either way.
- */
-public final class ConfigWatcher {
-
-    private static final Logger log = LoggerFactory.getLogger(ConfigWatcher.class);
-
-    private final ConfigRef ref;
-    private final long intervalSeconds;
-    private final ScheduledExecutorService scheduler;
-
-    private volatile long lastSeenMillis;
-
-    public ConfigWatcher(ConfigRef ref, long intervalSeconds) {
-        this.ref = ref;
-        this.intervalSeconds = intervalSeconds;
-        this.lastSeenMillis = modifiedMillis(ref.path());
-        this.scheduler = Executors.newSingleThreadScheduledExecutor(r -> {
-            Thread t = new Thread(r, "config-watcher");
-            // A daemon thread: an operator's config watch must never be the reason the JVM refuses
-            // to exit after everything else has shut down.
-            t.setDaemon(true);
-            return t;
-        });
-    }
-
-    /** Begin watching. A ref with no file (a fixed one) is a no-op rather than an error. */
-    public void start() {
-        if (ref.path() == null) {
-            log.debug("config watch not started — this config has no file behind it");
-            return;
-        }
-        scheduler.scheduleWithFixedDelay(this::tick, intervalSeconds, intervalSeconds,
-                TimeUnit.SECONDS);
-        log.info("config watch: {} re-read when it changes (every {}s)", ref.path(), intervalSeconds);
-    }
-
-    /** One poll. Never throws — an exception here would silently cancel the schedule. */
-    void tick() {
-        try {
-            long now = modifiedMillis(ref.path());
-            if (now == 0 || now == lastSeenMillis) {
-                return;
-            }
-            // Stamp BEFORE reloading. A file whose reload is refused (a bad edit, or a cold key)
-            // must not be retried every tick — that would log the same refusal forever. The next
-            // save moves the timestamp again and earns a fresh attempt.
-            lastSeenMillis = now;
-            ref.reload();
-        } catch (RuntimeException e) {
-            log.warn("config watch tick failed, still watching: {}", e.getMessage());
-        }
-    }
-
-    private static long modifiedMillis(Path path) {
-        if (path == null) {
-            return 0;
-        }
-        try {
-            return Files.getLastModifiedTime(path).toMillis();
-        } catch (IOException e) {
-            return 0; // mid-save, or gone: say nothing and try again next tick
-        }
-    }
-
-    /** Stop polling. Called from the daemon's ordered shutdown hook, alongside the other loops. */
-    public void stop() {
-        scheduler.shutdownNow();
-    }
-}
@@ -1,40 +0,0 @@
-package dev.ltms.bridged.health;
-
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.session.MemberSession;
-
-/**
- * Pure classifier. Collection and repair are deliberately outside this package.
- * {@link HealthState#ERROR_ON_SCREEN} is not decided yet because it needs a bounded pane detection
- * read and an adapter-specific fatal signature; status facts alone must not guess it.
- */
-public final class FleetHealth {
-    private FleetHealth() { }
-
-    public static HealthDecision decide(HealthSnapshot s, HealthPrior prior, long nowNanos) {
-        if (s.controlLinkDown()) return result(HealthState.CONTROL_LINK_DOWN, false);
-        if (s.targetNotFound()) return result(HealthState.GONE, false);
-        if (s.sessionState() == MemberSession.State.SPAWNING && !s.present() && s.readinessGraceElapsed()) {
-            return result(HealthState.NEVER_READY, false);
-        }
-        if (s.orphanedDelegation()) return result(HealthState.DELEGATION_ORPHANED, false);
-        boolean disagreement = s.sessionState() == MemberSession.State.BUSY && s.acceptedDelivery()
-                && (s.liveStatus() == AgentStatus.IDLE || s.liveStatus() == AgentStatus.DONE);
-        if (disagreement && prior.busyButDone()) return result(HealthState.TURN_BOUNDARY_LOST, true);
-        if (s.stalled()) return result(HealthState.STALL_SUSPECTED, disagreement);
-        if (s.replyStranded()) return result(HealthState.REPLY_STRANDED, disagreement);
-        if (s.queuedDelivery() || s.inboxMessage()) return result(HealthState.WORK_PENDING, disagreement);
-        if (s.sessionState() == MemberSession.State.SPAWNING) return result(HealthState.STARTING, disagreement);
-        if (s.acceptedDelivery() && s.liveStatus() == AgentStatus.BLOCKED) {
-            return result(HealthState.BLOCKED_AMBIGUOUS, disagreement);
-        }
-        // An accepted delivery remains bridge work even when herdr is late, unknown, or has already
-        // reported DONE once. It cannot be IDLE until the delegation has resolved.
-        if (s.acceptedDelivery()) return result(HealthState.WORKING, disagreement);
-        return result(HealthState.IDLE, disagreement);
-    }
-
-    private static HealthDecision result(HealthState state, boolean disagreement) {
-        return new HealthDecision(state, new HealthPrior(disagreement));
-    }
-}
@@ -1,151 +0,0 @@
-package dev.ltms.bridged.health;
-
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.session.MemberSession;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.concurrent.ScheduledExecutorService;
-import java.util.concurrent.TimeUnit;
-import java.util.function.BiConsumer;
-import java.util.function.LongSupplier;
-import java.util.function.Supplier;
-
-/** Slow whole-fleet evidence collection. It is deliberately separate from the delivery poller. */
-public final class FleetHealthMonitor {
-    private static final Logger log = LoggerFactory.getLogger(FleetHealthMonitor.class);
-
-    /** Bounded attempts to run {@link #failTarget} for one transition. Never retried tick-to-tick (CB-580). */
-    static final int MAX_FAIL_TARGET_ATTEMPTS = 3;
-
-    private final AgentControl agents;
-    private final Supplier<List<MemberSession>> roster;
-    private final MessageService messages;
-    private final ScheduledExecutorService scheduler;
-    private final LongSupplier clock;
-    private final long intervalSeconds;
-    private final BiConsumer<String, String> failTarget;
-    private final Map<String, HealthPrior> priors = new HashMap<>();
-    private final Map<String, HealthState> states = new HashMap<>();
-
-    // These facts need the evidence publishers introduced by later M4 units. They are not negatives.
-    private static final boolean NOT_YET_OBSERVED = false;
-
-    /**
-     * @param failTarget CB-568's idempotent target-wide failure operation (e.g. {@code messages::abandon}),
-     *                   invoked once when a member transitions into a terminal health state. Required —
-     *                   there is deliberately no defaulting overload; a caller that does not want the
-     *                   fail-tickets-on-terminal-health behavior must pass an explicit inert value (see
-     *                   {@code TestTurnTokens.inert} / {@code BridgeMcp.CapacitySource.none()} for the pattern).
-     */
-    public FleetHealthMonitor(AgentControl agents, Supplier<List<MemberSession>> roster, MessageService messages,
-                              ScheduledExecutorService scheduler, LongSupplier clock, long intervalSeconds,
-                              BiConsumer<String, String> failTarget) {
-        this.agents = agents;
-        this.roster = roster;
-        this.messages = messages;
-        this.scheduler = scheduler;
-        this.clock = clock;
-        this.intervalSeconds = intervalSeconds;
-        this.failTarget = Objects.requireNonNull(failTarget, "failTarget");
-    }
-
-    /** Pure per-member decision seam. */
-    static HealthDecision decide(HealthSnapshot snapshot, HealthPrior prior, long nowNanos) {
-        return FleetHealth.decide(snapshot, prior, nowNanos);
-    }
-
-    public void start() { scheduler.schedule(this::tick, intervalSeconds, TimeUnit.SECONDS); }
-    public void stop() { scheduler.shutdownNow(); }
-
-    // Package-private so tests can run one tick without waiting.
-    void tick() {
-        try {
-            List<Agent> agentsNow = agents.list(); // Exactly one list call for this complete observation.
-            List<MemberSession> rosterNow = roster.get(); // One in-memory roster snapshot for this tick.
-            Map<String, Agent> live = new HashMap<>();
-            for (Agent agent : agentsNow) live.put(agent.terminalId(), agent);
-            HashSet<String> current = new HashSet<>();
-            for (MemberSession session : rosterNow) {
-                current.add(session.terminalId());
-                Agent agent = live.get(session.terminalId());
-                AgentStatus status = agent == null ? AgentStatus.UNKNOWN : agent.status();
-                boolean accepted = messages.hasAcceptedDelivery(session.terminalId());
-                HealthSnapshot snapshot = new HealthSnapshot(session.state(), status, accepted, NOT_YET_OBSERVED,
-                        messages.hasInboxMessage(session.terminalId()), agent != null, NOT_YET_OBSERVED,
-                        NOT_YET_OBSERVED, NOT_YET_OBSERVED, NOT_YET_OBSERVED, NOT_YET_OBSERVED, NOT_YET_OBSERVED);
-                HealthDecision decision = decide(snapshot, priors.getOrDefault(session.terminalId(), HealthPrior.NONE),
-                        clock.getAsLong());
-                priors.put(session.terminalId(), decision.prior());
-                reportTransition(session.terminalId(), decision.state());
-            }
-            priors.keySet().retainAll(current);
-            states.keySet().retainAll(current);
-        } catch (Throwable error) {
-            // A list failure is health evidence, and must never kill the monitor's only scheduler task.
-            log.warn("fleet health collection failed; will retry next tick", error);
-        } finally {
-            if (!scheduler.isShutdown()) {
-                scheduler.schedule(this::tick, intervalSeconds, TimeUnit.SECONDS);
-            }
-        }
-    }
-
-    void reportTransition(String target, HealthState next) {
-        HealthState previous = states.put(target, next);
-        if (previous == next) return;
-        if (fault(next)) {
-            log.warn("fleet health member={} state={} previous={}", target, next, previous);
-        } else if (previous != null && fault(previous)) {
-            log.info("fleet health member={} recovered state={} previous={}", target, next, previous);
-        }
-        // CB-580: a member entering GONE/NEVER_READY must not leave its waiting tickets pending
-        // forever. Fire exactly once per transition — never on a tick where the state is unchanged,
-        // which is what made the rejected commit call abandon() once per tick for as long as a
-        // member stayed terminal.
-        if (terminal(next)) {
-            failTerminalTarget(target, next);
-        }
-    }
-
-    private void failTerminalTarget(String target, HealthState state) {
-        String reason = "fleet health: member reached terminal state " + state.name();
-        RuntimeException last = null;
-        for (int attempt = 1; attempt <= MAX_FAIL_TARGET_ATTEMPTS; attempt++) {
-            try {
-                failTarget.accept(target, reason);
-                return;
-            } catch (RuntimeException error) {
-                last = error;
-                log.warn("fleet health: failTarget attempt {}/{} failed for member={} state={}",
-                        attempt, MAX_FAIL_TARGET_ATTEMPTS, target, state, error);
-            }
-        }
-        log.warn("fleet health: giving up on failTarget for member={} state={} after {} attempts",
-                target, state, MAX_FAIL_TARGET_ATTEMPTS, last);
-    }
-
-    private static boolean terminal(HealthState state) {
-        return state == HealthState.GONE || state == HealthState.NEVER_READY;
-    }
-
-    private static boolean fault(HealthState state) {
-        return switch (state) {
-            case NEVER_READY, GONE, TURN_BOUNDARY_LOST, ERROR_ON_SCREEN, STALL_SUSPECTED,
-                    MUTE, REPLY_STRANDED, DELEGATION_ORPHANED, CONTROL_LINK_DOWN -> true;
-            default -> false;
-        };
-    }
-
-    public static String coverage(boolean enabled, boolean notificationConfigured) {
-        return !enabled ? "off" : notificationConfigured ? "full" : "detection-only";
-    }
-}
@@ -1,4 +0,0 @@
-package dev.ltms.bridged.health;
-
-/** Classification plus the private fact that the next pure decision needs. */
-public record HealthDecision(HealthState state, HealthPrior prior) { }
@@ -1,6 +0,0 @@
-package dev.ltms.bridged.health;
-
-/** Private cross-tick observation. It is deliberately not a reported health value. */
-public record HealthPrior(boolean busyButDone) {
-    public static final HealthPrior NONE = new HealthPrior(false);
-}
@@ -1,11 +0,0 @@
-package dev.ltms.bridged.health;
-
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.session.MemberSession;
-
-/** Read-only facts from one fleet collection tick. */
-public record HealthSnapshot(MemberSession.State sessionState, AgentStatus liveStatus,
-                             boolean acceptedDelivery, boolean queuedDelivery, boolean inboxMessage,
-                             boolean present, boolean targetNotFound, boolean controlLinkDown,
-                             boolean readinessGraceElapsed, boolean orphanedDelegation,
-                             boolean replyStranded, boolean stalled) { }
@@ -1,8 +0,0 @@
-package dev.ltms.bridged.health;
-
-/** Health classifications reported for a member. */
-public enum HealthState {
-    STARTING, IDLE, WORKING, WORK_PENDING, BLOCKED_AMBIGUOUS,
-    NEVER_READY, GONE, TURN_BOUNDARY_LOST, ERROR_ON_SCREEN, STALL_SUSPECTED,
-    MUTE, REPLY_STRANDED, DELEGATION_ORPHANED, CONTROL_LINK_DOWN
-}
@@ -1,25 +0,0 @@
-package dev.ltms.bridged.health;
-
-import dev.ltms.bridged.msg.Rendezvous;
-
-import java.util.Map;
-import java.util.concurrent.ConcurrentHashMap;
-
-/**
- * Counts turns that ended via the completion fallback instead of {@code bridge_reply}.
- * MUTE is an observation by target and profile, not a classifier state and never suppresses faults.
- */
-public final class MuteCounter {
-    private final Map<String, Integer> byTarget = new ConcurrentHashMap<>();
-    private final Map<String, Integer> byProfile = new ConcurrentHashMap<>();
-
-    /** Record only fallback completion; a structured reply does not make a member mute. */
-    public void observe(String target, String profile, Rendezvous.Kind kind) {
-        if (kind != Rendezvous.Kind.COMPLETION) return;
-        byTarget.merge(target, 1, Integer::sum);
-        byProfile.merge(profile, 1, Integer::sum);
-    }
-
-    public int forTarget(String target) { return byTarget.getOrDefault(target, 0); }
-    public int forProfile(String profile) { return byProfile.getOrDefault(profile, 0); }
-}
@@ -1,26 +0,0 @@
-package dev.ltms.bridged.health;
-
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-
-/** Fixed pane-probe limits. Pane content is never retained here. */
-public final class PaneBudget {
-    public static final long COOLDOWN_NANOS = 60_000_000_000L;
-    public static final int MAX_PER_TICK = 2;
-    private final Map<String, Long> lastProbe = new HashMap<>();
-    private int cursor;
-
-    public List<String> choose(List<String> candidates, long nowNanos, long configuredCooldownNanos) {
-        long cooldown = Math.max(COOLDOWN_NANOS, configuredCooldownNanos);
-        List<String> out = new ArrayList<>();
-        for (int n = 0; n < candidates.size() && out.size() < MAX_PER_TICK; n++) {
-            String target = candidates.get((cursor + n) % candidates.size());
-            Long last = lastProbe.get(target);
-            if (last == null || nowNanos - last >= cooldown) { out.add(target); lastProbe.put(target, nowNanos); }
-        }
-        if (!candidates.isEmpty()) cursor = (cursor + 1) % candidates.size();
-        return List.copyOf(out);
-    }
-}
@@ -6,7 +6,6 @@ import org.slf4j.LoggerFactory;

 import java.util.Collections;
 import java.util.LinkedHashMap;
-import java.util.Locale;
 import java.util.Map;
 import java.util.Set;
 import java.util.function.LongSupplier;
@@ -24,41 +23,21 @@ import java.util.function.Supplier;
 * by first starting the session and asking it. Scanning closes that loop: label the tab, and the
 * pane is recognised on the next resolve.
 *
- * <p><strong>CB-579 — matched by name, not prefix.</strong> This used to strip one shared
- * {@code tabPrefix} off a label to derive the lead's name, and merged a config-supplied
- * {@code terminal_id} pin over every scan result so the pin could never expire. Both are gone: each
- * lead now configures its own exact {@code tab} label ({@code fleet.leaders.<name>.tab}), so this
- * class is handed a {@code tab → name} map up front and matches labels against it exactly
- * (case-insensitively). There is no merge step — a scan result is the whole answer. That is the
- * fix for the bug this replaces: a {@code terminal_id} pin surviving in config after the pane it
- * named was gone, so the daemon kept treating a dead session as a live lead forever.
- *
 * <p><strong>Direction of trust.</strong> The label names the lead; it never <em>grants</em>
 * anything a pane could take for itself. Three properties keep that honest:
 * <ol>
+ *   <li>bridged never renames a lead tab. The operator's label is read-only input, so what is in
+ *       the tab bar is always what the human wrote — no round-trip where the daemon's own rename
+ *       becomes the evidence for its next decision.</li>
 *   <li>Worker spaces are excluded wholesale ({@code excludedWorkspaceLabels}), so a worker cannot
 *       become a lead by being placed — as a split, say — inside a matching tab.</li>
 *   <li>A worker cannot rename a tab: {@code tab.rename} is reachable only through
 *       {@link WorkspaceControl}, which no {@code bridge_*} tool exposes. The label is writable by
 *       the human at the terminal and by nobody the bridge is defending against.</li>
- *   <li>The label is a <em>name</em>, not a capability. What a pane may do is decided by
- *       {@code Authz} against the role {@code CallerResolver} returns; a tab that calls itself a
- *       lead still cannot act as one unless the daemon's own registry agrees.</li>
 * </ol>
- *
- * <p><strong>CB-558 — bridged now writes lead labels too.</strong> This class used to be able to say
- * that bridged never renames a lead tab, so the label was always the human's own writing and there
- * was no round-trip from the daemon's rename back into its next decision.
- * {@code dev.ltms.bridged.lead.LeadLauncher} ends that: an auto-launched lead is labelled by the
- * daemon and found again by this scan. The trust direction above is unaffected — bridged writing a
- * name for a lead it just started is not a pane promoting itself — but <em>staleness</em> becomes
- * real: a label left behind by a session that has since died would read as a live lead forever.
- * This scanner does not solve that (its job is naming, and a stale name costs nothing here); the
- * launcher does, by requiring a running agent in the tab before it counts the lead as live. If you
- * ever make a decision that <em>removes</em> something based on this map, add the same check.
 * The remaining hazard is an <em>operator</em> one — a worker {@code tabLabel} template that
 * happens to start with the same prefix would promote the whole fleet — and that is refused at
- * startup by {@code BridgedConfig.validateLeadTabPrefixes} rather than documented here.
+ * startup by {@code BridgedConfig.validateLeadScan} rather than documented here.
 *
 * <p><strong>Caching.</strong> {@link #get()} is on the request path (every resolve), so the scan
 * is TTL-cached and a stale-but-valid map is preferred to a herdr round-trip. A failed scan keeps
@@ -70,46 +49,38 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
    private static final Logger log = LoggerFactory.getLogger(LeadTabScanner.class);

    private final HerdrClient herdr;
-    private final Map<String, String> tabToName;
+    private final String tabPrefix;
    private final Set<String> excludedWorkspaceLabels;
+    private final Map<String, String> configuredLeads;
    private final long ttlNanos;
    private final LongSupplier clock;

-    private Map<String, String> cached = Map.of();
+    private Map<String, String> cached;
    private long scannedAtNanos;
    private boolean everScanned;

    /**
     * @param herdr                   the herdr client to query ({@code workspace.list},
     *                                {@code tab.list}, {@code pane.list} — all read-only)
-     * @param tabToName               every configured lead's exact tab label → its name
-     *                                ({@code fleet.leaders.<name>.tab}), matched case-insensitively
+     * @param tabPrefix               a tab whose label starts with this (case-insensitively) hosts a
+     *                                lead; the rest of the label, trimmed, is the lead's name
     * @param excludedWorkspaceLabels workspaces never scanned — the configured worker spaces
+     * @param configuredLeads         the static {@code leaders:}/{@code primary:} registry, merged
+     *                                over every scan result. Explicit config outranks the
+     *                                convention, and survives a scan that cannot run at all
     * @param ttlNanos                how long a scan result is reused before the next one
     * @param clock                   nanosecond time source ({@code System::nanoTime} in production)
     */
-    public LeadTabScanner(HerdrClient herdr, Map<String, String> tabToName,
-                          Set<String> excludedWorkspaceLabels, long ttlNanos, LongSupplier clock) {
+    public LeadTabScanner(HerdrClient herdr, String tabPrefix, Set<String> excludedWorkspaceLabels,
+                          Map<String, String> configuredLeads, long ttlNanos, LongSupplier clock) {
        this.herdr = herdr;
-        this.tabToName = normalize(tabToName);
+        this.tabPrefix = tabPrefix == null || tabPrefix.isBlank() ? "lead:" : tabPrefix.strip();
        this.excludedWorkspaceLabels = excludedWorkspaceLabels == null
                ? Set.of() : Set.copyOf(excludedWorkspaceLabels);
+        this.configuredLeads = configuredLeads == null ? Map.of() : Map.copyOf(configuredLeads);
        this.ttlNanos = ttlNanos;
        this.clock = clock;
-    }
-
-    /** Keys stripped and lower-cased once, so every lookup is a plain map hit. */
-    private static Map<String, String> normalize(Map<String, String> tabToName) {
-        if (tabToName == null || tabToName.isEmpty()) {
-            return Map.of();
-        }
-        Map<String, String> out = new LinkedHashMap<>();
-        tabToName.forEach((tab, name) -> {
-            if (tab != null && !tab.isBlank() && name != null && !name.isBlank()) {
-                out.put(tab.strip().toLowerCase(Locale.ROOT), name);
-            }
-        });
-        return Collections.unmodifiableMap(out);
+        this.cached = this.configuredLeads;
    }

    /**
@@ -169,20 +140,25 @@ public final class LeadTabScanner implements Supplier<Map<String, String>> {
                }
            }
        }
+        byTerminal.putAll(configuredLeads); // an explicit pin outranks a label
        return Collections.unmodifiableMap(byTerminal);
    }

    /**
-     * The lead name a tab label declares, or {@code null} if it names none of the configured leads.
+     * The lead name a tab label declares, or {@code null} if it declares none.
     *
-     * <p>Exact match (case-insensitive, ends stripped) against {@link #tabToName} — no prefix
-     * stripping, so an operator's {@code "lead: something-else"} tab is never mistaken for a
-     * configured lead just because it shares a prefix.
+     * <p>{@code "lead: opus-5.0"} → {@code "opus-5.0"}. A bare {@code "lead:"} names nobody and is
+     * rejected: an unnamed lead would resolve as {@code PRIMARY} with nothing to attribute it to.
     */
    private String leadNameOf(String label) {
        if (label == null) {
            return null;
        }
-        return tabToName.get(label.strip().toLowerCase(Locale.ROOT));
+        String l = label.strip();
+        if (!l.regionMatches(true, 0, tabPrefix, 0, tabPrefix.length())) {
+            return null;
+        }
+        String name = l.substring(tabPrefix.length()).strip();
+        return name.isEmpty() ? null : name;
    }
 }
@@ -41,16 +41,6 @@ public final class WorkspaceControl {
        return out;
    }

-    /** Every tab in {@code workspaceId}, in herdr's order. */
-    public List<Tab> listTabs(String workspaceId) {
-        JsonNode result = herdr.call("tab.list", Map.of("workspace_id", workspaceId));
-        List<Tab> out = new ArrayList<>();
-        for (JsonNode t : result.path("tabs")) {
-            out.add(Tab.from(t));
-        }
-        return out;
-    }
-
    /** The first workspace with this exact label, if any. */
    public Optional<Workspace> findByLabel(String label) {
        return listWorkspaces().stream()
@@ -2,17 +2,11 @@ package dev.ltms.bridged.inject;

 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.msg.TurnToken;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

-import java.util.List;
-import java.util.Objects;
-import java.util.Set;
-import java.util.TreeSet;
 import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ConcurrentHashMap;
-import java.util.regex.Pattern;

 /**
 * The CB-106 completion fallback: bridges the {@link Injector}'s turn-completion signal to the
@@ -61,13 +55,8 @@ public final class CompletionResolver implements TurnListener {
    /** Cap the scraped tail so a long transcript can't return an unbounded blob. */
    static final int MAX_SCRAPE_CHARS = 4000;

-    private static final String CLIPPED_PANE_TAIL_MARKER =
-            "[Pane tail clipped: member did not call bridge_reply.]";
-
    private final AgentControl agents;
    private final Rendezvous rendezvous;
-    private final ExhaustedPatternLookup exhaustedPatterns;
-    private final ExhaustionSink exhaustionSink;

    /**
     * Per-target record of the turn currently in flight: the exact {@link Rendezvous} waiter its
@@ -85,36 +74,23 @@ public final class CompletionResolver implements TurnListener {

    private final ConcurrentHashMap<String, InFlight> inFlight = new ConcurrentHashMap<>();

-    /**
-     * @param exhaustedPatterns CB-578 stage A: per-target lookup for a profile's configured
-     *                          usage-limit refusal pattern. Required — there is deliberately no
-     *                          defaulting overload; a caller that does not want the classification
-     *                          must pass an explicit inert value ({@link ExhaustedPatternLookup#none()}).
-     * @param exhaustionSink    CB-578 stage B: notified when a {@code BACKEND_EXHAUSTED}
-     *                          classification actually resolves a waiter. Required for the same
-     *                          reason as {@code exhaustedPatterns} — pass {@link ExhaustionSink#none()}
-     *                          to opt out.
-     */
-    public CompletionResolver(AgentControl agents, Rendezvous rendezvous, ExhaustedPatternLookup exhaustedPatterns,
-                              ExhaustionSink exhaustionSink) {
+    public CompletionResolver(AgentControl agents, Rendezvous rendezvous) {
        this.agents = agents;
        this.rendezvous = rendezvous;
-        this.exhaustedPatterns = Objects.requireNonNull(exhaustedPatterns, "exhaustedPatterns");
-        this.exhaustionSink = Objects.requireNonNull(exhaustionSink, "exhaustionSink");
    }

    @Override
-    public void onDelivered(String target, TurnToken token) {
+    public void onDelivered(String target) {
        // Capture the exact waiter this turn belongs to (CB-116) and snapshot the pane's pre-turn
        // content — what it shows *before* the just-delivered turn produces output — as the staleness
        // reference (CB-115). Done synchronously (like the delivering send itself) so both are in
        // place before this turn's completion can fire.
-        captureBaseline(target, token);
+        captureBaseline(target);
    }

    /** Capture the in-flight turn: its waiter and pre-turn baseline (the testable core of {@link #onDelivered}). */
-    void captureBaseline(String target, TurnToken token) {
-        CompletableFuture<Rendezvous.Resolution> waiter = token.waiter();
+    void captureBaseline(String target) {
+        CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.currentWaiter(target);
        if (waiter == null) {
            inFlight.remove(target); // no send is waiting on this delivery — nothing to resolve later
            return;
@@ -158,13 +134,7 @@ public final class CompletionResolver implements TurnListener {
    @Override
    public void onTurnFailed(String target) {
        InFlight turn = inFlight.get(target);
-        Thread.ofVirtual().name("turn-failed-" + target).start(() -> fail(target, turn, null));
-    }
-
-    @Override
-    public void onTurnFailed(String target, String reason) {
-        InFlight turn = inFlight.get(target);
-        Thread.ofVirtual().name("turn-failed-" + target).start(() -> fail(target, turn, reason));
+        Thread.ofVirtual().name("turn-failed-" + target).start(() -> fail(target, turn));
    }

    /** Synchronous resolve (the unit-testable core of {@link #onTurnComplete}). */
@@ -177,15 +147,9 @@ public final class CompletionResolver implements TurnListener {
            return;
        }
        String tail;
-        String assistantBlock = null;
-        int originalLength = 0;
-        boolean clipped = false;
        boolean scrapeFailed = false;
        try {
-            assistantBlock = lastAssistantBlock(agents.read(target, SCRAPE_SOURCE));
-            originalLength = assistantBlock.strip().length();
-            clipped = originalLength > MAX_SCRAPE_CHARS;
-            tail = clip(assistantBlock);
+            tail = clip(lastAssistantBlock(agents.read(target, SCRAPE_SOURCE)));
        } catch (RuntimeException e) {
            // The worker finished but we couldn't read its screen — still resolve the send so the
            // caller unblocks; an empty tail beats hanging until the caller's timeout.
@@ -205,33 +169,8 @@ public final class CompletionResolver implements TurnListener {
                    target);
            return; // keep the in-flight record: a later genuine completion still needs it
        }
-        // CB-578 stage A: a turn that ended with no bridge_reply AND whose scrape matches the
-        // backend's configured usage-limit pattern is a refusal, not an answer. Classify it as
-        // BACKEND_EXHAUSTED rather than handing the caller a scrape that reads like a real reply.
-        if (!scrapeFailed) {
-            Pattern exhausted = exhaustedPatterns.patternFor(target);
-            String matchedLine = exhausted == null ? null : firstMatchingLine(assistantBlock, exhausted);
-            if (matchedLine != null) {
-                String reason = "backend exhausted (usage limit): " + matchedLine;
-                if (rendezvous.resolveExhausted(waiter, reason)) {
-                    inFlight.remove(target, turn);
-                    log.warn("completion for {} classified BACKEND_EXHAUSTED (no bridge_reply; scrape "
-                            + "matched the profile's exhausted pattern): {}", target, reason);
-                    // CB-578 stage B: only on the resolution that actually won the race — a late
-                    // duplicate must never quarantine a credential twice for one refusal.
-                    exhaustionSink.onExhausted(target, reason);
-                }
-                return;
-            }
-        }
-        String completion = clipped ? tail + "\n" + CLIPPED_PANE_TAIL_MARKER : tail;
-        if (rendezvous.resolveCompletion(waiter, completion)) {
+        if (rendezvous.resolveCompletion(waiter, tail)) {
            inFlight.remove(target, turn);
-            if (clipped) {
-                log.warn("completion scrape for {} clipped from {} chars to the {} char cap; "
-                                + "member did not call bridge_reply, so the pane tail is partial",
-                        target, originalLength, MAX_SCRAPE_CHARS);
-            }
            log.debug("resolved send to {} via turn-completion fallback ({} chars scraped)",
                    target, tail.length());
        }
@@ -239,11 +178,6 @@ public final class CompletionResolver implements TurnListener {

    /** Synchronous fail (the unit-testable core of {@link #onTurnFailed}). */
    void fail(String target, InFlight turn) {
-        fail(target, turn, null);
-    }
-
-    /** Synchronous fail with an optional reason supplied by a dropped worker queue. */
-    void fail(String target, InFlight turn, String explicitReason) {
        // A never-delivered readiness failure has no in-flight record but still has a blocked send;
        // fall back to the currently-registered waiter (unambiguous — that send never completed, so
        // no next turn exists to confuse it with).
@@ -253,64 +187,23 @@ public final class CompletionResolver implements TurnListener {
            inFlight.remove(target, turn); // nobody blocked on this worker — nothing to fail
            return;
        }
-        String reason = explicitReason;
-        if (reason == null || reason.isBlank()) {
-            try {
-                reason = clip(agents.read(target, SCRAPE_SOURCE));
-            } catch (RuntimeException e) {
-                reason = "";
-            }
-            if (reason.isBlank()) {
-                // No screen to scrape — either the worker is stuck (CB-109) or gone (CB-110).
-                reason = "worker did not reply; its turn ended in an unrecoverable state "
-                        + "(worker unreachable or stuck)";
-            }
+        String reason;
+        try {
+            reason = clip(agents.read(target, SCRAPE_SOURCE));
+        } catch (RuntimeException e) {
+            reason = "";
+        }
+        if (reason.isBlank()) {
+            // No screen to scrape — either the worker is stuck (CB-109) or gone (CB-110).
+            reason = "worker did not reply; its turn ended in an unrecoverable state "
+                    + "(worker unreachable or stuck)";
        }
        if (rendezvous.resolveFailure(waiter, reason)) {
            inFlight.remove(target, turn);
-            log.warn("failing send to {} via turn-stall fallback: {}", target, reason);
+            log.debug("failed send to {} via turn-stall fallback", target);
        }
    }

-    /**
-     * The first line of {@code text} matching {@code pattern}, stripped — the CB-578 stage A
-     * evidence carried in a {@code BACKEND_EXHAUSTED} reason so the operator sees the real refusal
-     * text, never a generic label. {@code null} if no line matches.
-     */
-    static String firstMatchingLine(String text, Pattern pattern) {
-        if (text == null || text.isEmpty()) return null;
-        for (String line : text.split("\n", -1)) {
-            if (pattern.matcher(line).find()) {
-                return line.strip();
-            }
-        }
-        return null;
-    }
-
-    /**
-     * Coverage summary for the CB-578 stage A exhausted-pattern classification, logged at startup
-     * the way {@link dev.ltms.bridged.health.FleetHealthMonitor#coverage} is — so an operator can
-     * see whether the classification is on, and for which profiles, without reading every
-     * profile's config by hand.
-     *
-     * @param allProfiles        every configured profile name
-     * @param configuredProfiles the subset of {@code allProfiles} that carry an exhausted pattern
-     */
-    public static String coverage(Set<String> allProfiles, Set<String> configuredProfiles) {
-        if (configuredProfiles.isEmpty()) {
-            return "off (no profile has an exhaustedPattern configured; profiles: " + sorted(allProfiles) + ")";
-        }
-        Set<String> unconfigured = new TreeSet<>(allProfiles);
-        unconfigured.removeAll(configuredProfiles);
-        return unconfigured.isEmpty()
-                ? "full (all profiles configured: " + sorted(allProfiles) + ")"
-                : "partial (configured: " + sorted(configuredProfiles) + "; not configured: " + sorted(unconfigured) + ")";
-    }
-
-    private static List<String> sorted(Set<String> names) {
-        return names.stream().sorted().toList();
-    }
-
    private static String clip(String s) {
        if (s == null) return "";
        String trimmed = s.strip();
@@ -1,27 +0,0 @@
-package dev.ltms.bridged.inject;
-
-import java.util.regex.Pattern;
-
-/**
- * Per-target lookup for a profile's configured usage-limit refusal pattern (CB-578 stage A): how
- * {@link CompletionResolver} tells a backend that refused on a subscription usage limit — the
- * worker's pane stays healthy, but the account is exhausted — apart from a genuine completion.
- *
- * <p>The pattern is always profile config, never a vendor string in Java source: every backend
- * words its refusal differently, so a hardcoded sentence would only ever match one of them.
- */
-@FunctionalInterface
-public interface ExhaustedPatternLookup {
-
-    /** The compiled pattern configured for {@code target}'s profile, or {@code null} if none. */
-    Pattern patternFor(String target);
-
-    /**
-     * Inert lookup — no profile has a pattern configured, so the classification never fires and
-     * the completion fallback behaves exactly as before CB-578 stage A. The explicit stand-in a
-     * caller (or a test not exercising this feature) passes instead of a defaulting overload.
-     */
-    static ExhaustedPatternLookup none() {
-        return target -> null;
-    }
-}
@@ -1,31 +0,0 @@
-package dev.ltms.bridged.inject;
-
-/**
- * Notified when {@link CompletionResolver} actually delivers a {@code BACKEND_EXHAUSTED}
- * classification to a waiting send (CB-578 stage B) — never on a race that lost (see
- * {@link CompletionResolver#resolve}, which only calls this after
- * {@code Rendezvous.resolveExhausted} returns {@code true}).
- *
- * <p>{@link CompletionResolver} knows only {@code target} (a herdr terminal id); it has no notion of
- * profiles or credentials, so mapping {@code target} to whatever should be quarantined is entirely
- * the sink's job — see {@code Bridged.main}'s wiring, which resolves target → session → profile →
- * {@code effectiveCredentialId()} and calls {@code BackendQuarantine.quarantine} on it.
- */
-@FunctionalInterface
-public interface ExhaustionSink {
-
-    /**
-     * @param target the herdr terminal id whose turn was classified {@code BACKEND_EXHAUSTED}
-     * @param reason the matched-line reason carried by the classification
-     */
-    void onExhausted(String target, String reason);
-
-    /**
-     * Inert sink — nothing happens on exhaustion. The explicit stand-in a caller (or a test not
-     * exercising this feature) passes instead of a defaulting overload, exactly like
-     * {@link ExhaustedPatternLookup#none()}.
-     */
-    static ExhaustionSink none() {
-        return (target, reason) -> { };
-    }
-}
@@ -2,7 +2,6 @@ package dev.ltms.bridged.inject;

 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.msg.TurnToken;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

@@ -79,15 +78,6 @@ public final class Injector {
     */
    private static final int READINESS_GRACE_POLLS = 240;

-    /**
-     * The single source for the injector poll cadence — how often the {@link StatusPoller} drives
-     * {@link #onStatus} at. {@code Bridged} passes this to every {@link StatusPoller} it constructs,
-     * and this class reads it to state the readiness grace in seconds on the CB-562 expiry log
-     * instead of hardcoding "60s". One constant, so a cadence change cannot silently desync a log
-     * that claims a grace duration.
-     */
-    public static final long POLL_INTERVAL_MILLIS = 250;
-
    private final AgentControl agents;
    private final TurnListener turnListener;
    private final Predicate<String> ready; // CB-113: a target is deliverable only when available
@@ -130,7 +120,7 @@ public final class Injector {
    }

    /** A pending message and the future that completes when it has been delivered. */
-    private record Pending(String text, TurnToken token, CompletableFuture<Void> delivered) {
+    private record Pending(String text, CompletableFuture<Void> delivered) {
    }

    /** Per-worker delivery state, guarded by its own monitor (single writer per worker). */
@@ -160,9 +150,9 @@ public final class Injector {
     * <p>Uses an atomic map update so a concurrent {@link #drop} cannot slip between "find the
     * target" and "queue the message" and orphan it in a target it just removed.
     */
-    public CompletableFuture<Void> enqueue(String target, String text, TurnToken token) {
+    public CompletableFuture<Void> enqueue(String target, String text) {
        CompletableFuture<Void> delivered = new CompletableFuture<>();
-        Pending p = new Pending(text, token, delivered);
+        Pending p = new Pending(text, delivered);
        targets.compute(target, (_, existing) -> {
            Target t = (existing != null) ? existing : new Target();
            t.add(p); // synchronized on the Target monitor — atomic with a concurrent drop
@@ -274,11 +264,6 @@ public final class Injector {
                            // fail every queued message and release the target (CB-114) instead of
                            // polling it indefinitely with the caller's future never completing.
                            notReady = new ArrayList<>(t.queue);
-                            log.warn("readiness grace for {} expired after {} polls ({}s): target never "
-                                    + "became deliverable, so failing {} queued message(s) that never "
-                                    + "reached its pane",
-                                    target, READINESS_GRACE_POLLS,
-                                    READINESS_GRACE_POLLS * POLL_INTERVAL_MILLIS / 1000, notReady.size());
                            t.queue.clear();
                            t.notReadySincePoll = 0;
                        }
@@ -357,7 +342,7 @@ public final class Injector {
            } else {
                // Baseline the pane's pre-turn content so a misattributed completion (no new output)
                // can't resolve this send with the previous turn's stale answer (CB-115).
-                turnListener.onDelivered(target, sent.token());
+                turnListener.onDelivered(target);
                sent.delivered().complete(null);
            }
        }
@@ -403,16 +388,12 @@ public final class Injector {
            t.awaitingPostTurnPickup = false;
            t.postTurnObserved = false;
        }
-        log.warn("{} is gone, dropping its queue: {} message(s) failed{}; cause: {}", target,
-                pending.size(),
-                hadDeliveredTurn ? " (including one turn already in flight whose completion was never confirmed)" : "",
-                cause.getMessage());
        forget.accept(target); // the worker is gone — clear its readiness/presence too (CB-114)
        for (Pending p : pending) {
            p.delivered().completeExceptionally(cause);
        }
-        // A queued send has no in-flight record, while a delivered turn does. CompletionResolver
-        // handles both forms and resolves its waiter at most once.
-        turnListener.onTurnFailed(target, cause.getMessage());
+        if (hadDeliveredTurn) {
+            turnListener.onTurnFailed(target);
+        }
    }
 }
@@ -1,7 +1,5 @@
 package dev.ltms.bridged.inject;

-import dev.ltms.bridged.msg.TurnToken;
-
 /**
 * Notified when a worker's delegated turn is observed to complete — a confirmed
 * {@code WORKING → IDLE} transition after a delivery. This is the CB-106 completion signal the
@@ -43,14 +41,6 @@ public interface TurnListener {
    default void onTurnFailed(String target) {
    }

-    /**
-     * As {@link #onTurnFailed(String)}, carrying the reason a worker became unreachable. The default
-     * keeps existing listeners working while allowing the completion resolver to report a useful cause.
-     */
-    default void onTurnFailed(String target, String reason) {
-        onTurnFailed(target);
-    }
-
    /**
     * A message was just delivered into {@code target}'s pane (CB-115). Fired so the completion
     * resolver can snapshot the pane's pre-turn content: a later {@link #onTurnComplete} whose
@@ -59,7 +49,7 @@ public interface TurnListener {
     * resolve the send with the previous turn's stale answer. A default no-op keeps the interface
     * functional for callers that don't scrape.
     */
-    default void onDelivered(String target, TurnToken token) {
+    default void onDelivered(String target) {
    }

    /** No-op default for callers that only need delivery, not completion signalling. */
@@ -15,7 +15,7 @@ import java.util.Set;
 * mounts the bridge MCP is never marked present — its sends stay queued until they time out, which is
 * correct (it could not have replied anyway).
 */
-public class MemberPresence {
+public class WorkerPresence {

    private final Set<String> present = ConcurrentHashMap.newKeySet();

@@ -1,292 +0,0 @@
-package dev.ltms.bridged.lead;
-
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.Agent;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.herdr.Tab;
-import dev.ltms.bridged.herdr.Workspace;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.ArrayList;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
-import java.util.stream.Collectors;
-
-/**
- * Starts the leads {@code fleet.leaders:} declares, when none is already running (CB-558).
- *
- * <p><strong>A lead is not a member, and this class exists to keep it that way.</strong> Every other
- * spawn path in the daemon goes through {@code HerdrPeerLauncher}, which does three things a lead
- * must never receive:
- * <ol>
- *   <li>it appends the <em>reply charter</em> — "you are an off-subscription worker … end every turn
- *       with {@code bridge_reply}". A lead is the orchestrator; telling it that it is a worker is
- *       exactly backwards.</li>
- *   <li>it registers the session with {@code SessionManager}, which subjects it to the idle reaper,
- *       the context cap and the shutdown drain. An idle lead is the normal state of a lead, so the
- *       reaper would kill the orchestrator for doing its job.</li>
- *   <li>it can move a peer off the subscription via {@code ANTHROPIC_BASE_URL}. A lead stays on the
- *       operator's subscription, always.</li>
- * </ol>
- * So this launcher talks to {@link AgentControl}/{@link WorkspaceControl} directly. The duplication
- * with the member launchers (argv and env assembly) is deliberate and is the cheaper half of the
- * trade: entangling the worker path with a not-a-worker case is how the three rules above get
- * broken later, quietly.
- *
- * <p><strong>Liveness, and the label round-trip.</strong> {@code LeadTabScanner} used to be able to
- * promise that bridged never writes a lead label. That is no longer true — an auto-launched lead is
- * labelled by this class, and the scanner reads that label back. The risk this opens is not
- * privilege escalation (the tab label never granted anything a pane could take for itself; see that
- * class's javadoc), but <em>staleness</em>: a label left behind by a crashed session would otherwise
- * read as a live lead forever, and the lead would never be relaunched. So a lead counts as live only
- * when herdr also reports a <em>running agent</em> in that tab — see {@link #liveLeads}. A labelled
- * tab with no agent in it is not a lead.
- */
-public final class LeadLauncher {
-
-    private static final Logger log = LoggerFactory.getLogger(LeadLauncher.class);
-
-    private final AgentControl agents;
-    private final WorkspaceControl spaces;
-    private final BridgedConfig cfg;
-
-    /**
-     * @param agents herdr agent control (start, list)
-     * @param spaces workspace / tab control (ensure, create, label, list)
-     * @param cfg    the loaded config — {@code fleet.leaders}, {@code profiles} and each lead's tab
-     */
-    public LeadLauncher(AgentControl agents, WorkspaceControl spaces, BridgedConfig cfg) {
-        this.agents = agents;
-        this.spaces = spaces;
-        this.cfg = cfg;
-    }
-
-    /**
-     * Bring every declared lead up to its {@code instances} count, and return how many were started.
-     *
-     * <p>Never throws: a daemon that cannot start a lead must still serve. herdr being unreachable,
-     * a profile that does not exist, a failed {@code agent.start} — each is logged and skipped, and
-     * the remaining leads are still attempted.
-     */
-    public int ensureLeads() {
-        Map<String, BridgedConfig.Leader> leaders = cfg.fleet().leaders();
-        if (leaders.isEmpty()) {
-            return 0;
-        }
-
-        Map<String, Integer> live;
-        try {
-            live = liveLeads(leaders);
-        } catch (HerdrException e) {
-            // Counting is the whole safety mechanism against double-spawning. If we cannot count, we
-            // must not guess — spawning a second orchestrator is worse than starting none.
-            log.warn("lead auto-launch skipped — cannot tell which leads are live: {}", e.getMessage());
-            return 0;
-        }
-
-        int started = 0;
-        for (Map.Entry<String, BridgedConfig.Leader> e : leaders.entrySet()) {
-            String name = e.getKey();
-            BridgedConfig.Leader lead = e.getValue();
-            int running = live.getOrDefault(name, 0);
-            int wanted = lead.instances();
-
-            if (running >= wanted) {
-                log.info("lead '{}': {} live, {} wanted — nothing to start", name, running, wanted);
-                continue;
-            }
-            if (!lead.isCreatable()) {
-                // A lead with a `tab:` but no `profile:` is recognise-only by design: the operator
-                // opens it by hand. Say so once rather than looking like a silent failure.
-                log.info("lead '{}' is not live, and names no profile — it can be recognised but not "
-                        + "launched. Add `profile:` under fleet.leaders.{} to have bridged start it.",
-                        name, name);
-                continue;
-            }
-
-            BridgedConfig.Profile profile = cfg.profiles().get(lead.profile());
-            if (profile == null) {
-                log.warn("lead '{}' names profile '{}', which is not configured — not launching",
-                        name, lead.profile());
-                continue;
-            }
-
-            for (int i = running; i < wanted; i++) {
-                if (launch(name, lead, profile)) {
-                    started++;
-                }
-            }
-        }
-        return started;
-    }
-
-    /**
-     * How many live leads exist per configured name: a running agent in a tab labelled with that
-     * lead's exact {@code tab} (CB-579). Member workspaces are excluded, exactly as the scanner
-     * excludes them: a member must not be counted as a lead because it happens to sit in a matching
-     * tab.
-     *
-     * <p>There used to be a second path here — a running agent on the terminal a
-     * {@code fleet.leaders.<name>.terminal} pin named, for a lead opened and pinned by hand. That
-     * pin is retired: {@code tab} is now the only field identity depends on, and {@link Agent}
-     * already carries {@link Agent#tabId()} directly, so a hand-opened lead is found the same way an
-     * auto-launched one is — by labelling its tab to match.
-     */
-    private Map<String, Integer> liveLeads(Map<String, BridgedConfig.Leader> leaders) {
-        Set<String> memberSpaces = cfg.profiles().values().stream()
-                .map(BridgedConfig.Profile::workspace)
-                .filter(w -> w != null && !w.isBlank())
-                .collect(Collectors.toSet());
-
-        // tabId → the lead name its label declares.
-        Map<String, String> nameByTab = new LinkedHashMap<>();
-        for (Workspace ws : spaces.listWorkspaces()) {
-            if (ws.workspaceId() == null || memberSpaces.contains(ws.label())) {
-                continue;
-            }
-            for (Tab tab : spaces.listTabs(ws.workspaceId())) {
-                String declared = leadNameOf(tab.label(), leaders);
-                if (declared != null && tab.tabId() != null) {
-                    nameByTab.put(tab.tabId(), declared);
-                }
-            }
-        }
-
-        Map<String, Integer> counts = new LinkedHashMap<>();
-        for (Agent a : agents.list()) {
-            String name = nameByTab.get(a.tabId());
-            if (name != null) {
-                counts.merge(name, 1, Integer::sum);
-            }
-        }
-        return counts;
-    }
-
-    /**
-     * The configured lead a tab label names, or {@code null} for a label that names none.
-     *
-     * <p>Matched exactly (case-insensitively) against each lead's configured {@code tab}, so an
-     * operator's {@code "lead: something-else"} tab is not mistaken for a configured lead.
-     */
-    private String leadNameOf(String label, Map<String, BridgedConfig.Leader> leaders) {
-        if (label == null) {
-            return null;
-        }
-        String l = label.strip();
-        for (Map.Entry<String, BridgedConfig.Leader> e : leaders.entrySet()) {
-            String tab = e.getValue().tabLabel();
-            if (tab != null && l.equalsIgnoreCase(tab.strip())) {
-                return e.getKey();
-            }
-        }
-        return null;
-    }
-
-    /** Start one lead. Returns false (having logged) rather than throwing on any failure. */
-    private boolean launch(String name, BridgedConfig.Leader lead, BridgedConfig.Profile profile) {
-        String label = lead.tabLabel();
-        String cwd = (lead.cwd() == null || lead.cwd().isBlank())
-                ? System.getProperty("user.dir") : lead.cwd();
-
-        Tab.Created tab = null;
-        try {
-            Workspace ws = spaces.ensureWorkspace(lead.workspace());
-            tab = spaces.createTab(ws.workspaceId(), cwd, leadEnv(profile));
-            if (tab.rootPaneId() == null) {
-                throw new IllegalStateException("tab " + tab.tab().tabId()
-                        + " came back with no seed pane — nowhere to start the lead");
-            }
-            // Same shape as the member launchers: herdr resolves the executable from `kind`, so
-            // argv[0] (the configured launcher, e.g. `ccs`) is dropped and only the rest is passed.
-            List<String> argv = leadArgv(profile);
-            Agent started = agents.start("lead-" + name, herdrKind(profile),
-                    argv.isEmpty() ? argv : argv.subList(1, argv.size()), tab.rootPaneId());
-
-            // Label AFTER the start succeeds. A label written before would survive a failed start
-            // and then read back as a live lead on the next boot, which is the exact staleness the
-            // agent-liveness check exists to prevent — no need to create the case ourselves.
-            spaces.renameTab(tab.tab().tabId(), label);
-
-            log.info("lead '{}' launched: profile={} tab={} pane={} terminal={} label='{}' cwd={}",
-                    name, profile.profile(), tab.tab().tabId(), started.paneId(),
-                    started.terminalId(), label, cwd);
-            return true;
-        } catch (RuntimeException e) {
-            log.warn("lead '{}' failed to launch on profile '{}': {}",
-                    name, profile.profile(), e.getMessage());
-            if (tab != null && tab.tab() != null && tab.tab().tabId() != null) {
-                try {
-                    spaces.closeTab(tab.tab().tabId());
-                } catch (RuntimeException cleanup) {
-                    log.warn("could not close the orphaned lead tab {}: {}",
-                            tab.tab().tabId(), cleanup.getMessage());
-                }
-            }
-            return false;
-        }
-    }
-
-    /**
-     * The herdr agent kind for this profile — the same value the matching member adapter passes, so
-     * herdr resolves the same executable for a lead as it does for a member on that backend.
-     */
-    private static String herdrKind(BridgedConfig.Profile profile) {
-        return profile.isOpenCode() ? "opencode" : "claude";
-    }
-
-    /**
-     * The lead's argv: the profile's own command, the model pin, and the bridge MCP mount.
-     *
-     * <p>No {@code --append-system-prompt}. That flag carries the worker reply charter, and a lead
-     * is not a worker — it reads its orchestration rules from the project's {@code CLAUDE.md} like
-     * any other primary. This is the single most important difference from the member launchers;
-     * do not "unify" it back.
-     */
-    private List<String> leadArgv(BridgedConfig.Profile profile) {
-        List<String> argv = new ArrayList<>(profile.argv());
-        if (profile.hasMcp()) {
-            argv.add("--mcp-config");
-            argv.add("{\"mcpServers\":{\"bridge\":{\"type\":\"http\",\"url\":\""
-                    + profile.mcpUrl() + "\"}}}");
-        }
-        // Appended last, for the same reason the member launcher does it (CB-533): the argv is
-        // usually a wrapper such as `ccs <profile>`, which exports its own model family over
-        // whatever it inherited, and --model outranks the environment.
-        if (profile.model() != null && !profile.model().isBlank()) {
-            argv.add("--model");
-            argv.add(profile.model());
-        }
-        return argv;
-    }
-
-    /**
-     * The lead's environment: the profile's {@code env:} block, and nothing that could move it off
-     * the subscription.
-     *
-     * <p>{@code ANTHROPIC_BASE_URL} and {@code ANTHROPIC_AUTH_TOKEN} are stripped unconditionally —
-     * not defaulted, not guarded, stripped. A lead runs on the operator's subscription by
-     * definition, so there is no configuration under which pointing it elsewhere is correct, and a
-     * profile that carries them (a member profile reused as a lead's backend) must not leak them in.
-     */
-    private Map<String, String> leadEnv(BridgedConfig.Profile profile) {
-        Map<String, String> out = new LinkedHashMap<>();
-        if (profile.env() != null) {
-            out.putAll(profile.env());
-        }
-        out.remove("ANTHROPIC_BASE_URL");
-        out.remove("ANTHROPIC_AUTH_TOKEN");
-        if (profile.configDir() != null && !profile.configDir().isBlank()) {
-            out.put("CLAUDE_CONFIG_DIR", profile.configDir());
-        }
-        // Deliberately no git token: a lead reviews and merges through the operator's own
-        // credentials, and never needs the scoped write:repository token a member is granted.
-        out.values().removeIf(Objects::isNull);
-        return out;
-    }
-}
@@ -1,30 +0,0 @@
-package dev.ltms.bridged.logging;
-
-import ch.qos.logback.classic.Level;
-import ch.qos.logback.classic.Logger;
-import ch.qos.logback.classic.turbo.TurboFilter;
-import ch.qos.logback.core.spi.FilterReply;
-import io.modelcontextprotocol.spec.McpSchema;
-import org.slf4j.Marker;
-
-/** Suppresses only the SDK warning for the normal MCP cancellation notification. */
-public final class McpCancelledNotificationFilter extends TurboFilter {
-
-    static final String LOGGER = "io.modelcontextprotocol.spec.McpStreamableServerSession";
-    static final String UNHANDLED_NOTIFICATION = "No handler registered for notification method: {}";
-
-    @Override
-    public FilterReply decide(Marker marker, Logger logger, Level level, String format, Object[] params,
-                              Throwable throwable) {
-        if (level == Level.WARN
-                && LOGGER.equals(logger.getName())
-                && UNHANDLED_NOTIFICATION.equals(format)
-                && params != null
-                && params.length == 1
-                && params[0] instanceof McpSchema.JSONRPCNotification notification
-                && "notifications/cancelled".equals(notification.method())) {
-            return FilterReply.DENY;
-        }
-        return FilterReply.NEUTRAL;
-    }
-}
@@ -9,16 +9,14 @@ import dev.ltms.bridged.guard.GuardException;
 import dev.ltms.bridged.herdr.Agent;
 import dev.ltms.bridged.metrics.BridgedMetrics;
 import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.inject.MemberPresence;
+import dev.ltms.bridged.inject.WorkerPresence;
 import dev.ltms.bridged.herdr.HerdrException;
 import dev.ltms.bridged.msg.MessageService;
 import dev.ltms.bridged.msg.Rendezvous;
 import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.placement.BackendQuarantine;
 import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.bridged.session.WorkerSession;
 import dev.ltms.bridged.session.WorktreeRequest;
-import dev.ltms.bridged.peer.MemberRole;
 import dev.ltms.bridged.peer.PeerLauncher;
 import io.modelcontextprotocol.common.McpTransportContext;
 import io.modelcontextprotocol.json.McpJsonMapper;
@@ -34,11 +32,7 @@ import jakarta.servlet.http.HttpServlet;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Objects;
-import java.util.Set;
 import java.util.function.Function;
-import java.util.function.LongSupplier;
-import java.util.function.Supplier;
 import java.util.stream.Collectors;

 /**
@@ -78,28 +72,15 @@ public final class BridgeMcp {
    private final McpSyncServer server;
    private final CallerResolver authz; // CB-501: null → authorization not enforced (legacy)
    private final Metrics metrics;      // CB-502: null → auth failures not counted
-    private final CapacitySource capacity;
-    private final HealthCoverageSource healthCoverage;
-    private final QuarantineSource quarantine;
-
-    /** Capacity facts used by {@code bridge_list}; production must supply the placement live count. */
-    public record CapacitySource(Function<String, Integer> liveCount, Function<String, Integer> maxLoad,
-                                 Supplier<Set<String>> configuredProfiles, LongSupplier clock) {
-        /** Inert test-only source. It omits capacity rather than inventing zero live counts. */
-        public static CapacitySource none() { return new CapacitySource(_ -> 0, _ -> null, Set::of, System::nanoTime); }
-        boolean available() { return !configuredProfiles.get().isEmpty(); }
-    }
-
-    /** Coverage is supplied by the health wiring, not inferred from a missing dependency. */
-    public record HealthCoverageSource(Supplier<String> value) { }

    /**
-     * CB-578 stage B quarantine facts used by {@code bridge_profiles}: a profile → credential id
-     * lookup, plus the shared {@link BackendQuarantine} to read remaining cooldowns off.
+     * Legacy constructor — no authorization. Retained so existing tests exercise tool behaviour
+     * without an auth fixture.
     */
-    public record QuarantineSource(Function<String, String> credentialIdFor, BackendQuarantine quarantine) {
-        /** Inert source — no profile is ever reported quarantined. Explicit stand-in, not a default. */
-        public static QuarantineSource none() { return new QuarantineSource(_ -> null, BackendQuarantine.none()); }
+    public BridgeMcp(MessageService messages, PeerLauncher workers,
+                     SessionManager sessions, ConnectionIdentity identity, WorkerPresence presence,
+                     PrimaryRegistry primaryRegistry) {
+        this(messages, workers, sessions, identity, presence, primaryRegistry, null, null);
    }

    /**
@@ -108,16 +89,10 @@ public final class BridgeMcp {
     *                Jetty's context handler and never passes through Javalin's {@code before}
     *                filter, so the REST guard does not cover it.
     * @param metrics registry for auth-failure counting; may be {@code null}
-     * @param quarantine CB-578 stage B facts for {@code bridge_profiles}; required — pass
-     *                   {@link QuarantineSource#none()} for a caller that does not want the feature
     */
-    public BridgeMcp(MessageService messages, PeerLauncher workers, SessionManager sessions,
-                     ConnectionIdentity identity, MemberPresence presence, PrimaryRegistry primaryRegistry,
-                      CallerResolver callers, Metrics metrics, CapacitySource capacity, HealthCoverageSource healthCoverage,
-                      QuarantineSource quarantine) {
-        this.capacity = capacity;
-        this.quarantine = Objects.requireNonNull(quarantine, "quarantine");
-        this.healthCoverage = healthCoverage;
+    public BridgeMcp(MessageService messages, PeerLauncher workers,
+                     SessionManager sessions, ConnectionIdentity identity, WorkerPresence presence,
+                     PrimaryRegistry primaryRegistry, CallerResolver callers, Metrics metrics) {
        McpJsonMapper json = new JacksonMcpJsonMapperSupplier().get();
        this.transport = HttpServletStreamableServerTransportProvider.builder()
                .jsonMapper(json)
@@ -133,10 +108,10 @@ public final class BridgeMcp {
                            ? callers.resolve(req.getRemoteAddr(), req.getRemotePort(),
                                    req.getHeader("Authorization"))
                            : legacyPrincipal(identity, req.getRemoteAddr(), req.getRemotePort());
-                    // CB-532: guard on the ROLE, not on the terminal being null. This excludes a
-                    // lead, which carries its pane too, while including every spawned member role.
-                    // Enrolling a lead would count it as an available member in the roster.
-                    markSpawnedMemberPresent(p, presence);
+                    // CB-532: guard on the ROLE, not on the terminal being null. A named lead now
+                    // carries its pane too, and enrolling a lead in the worker presence map would
+                    // have it counted as an available worker.
+                    if (p.isWorker()) presence.markPresent(p.terminal());
                    return McpTransportContext.create(Map.of(
                            CALLER_TERMINAL, orEmpty(p.terminal()),
                            CALLER_PID, Long.toString(p.pid()),
@@ -175,8 +150,8 @@ public final class BridgeMcp {
                    Runnable onAccepted = () -> primaryRegistry.recordDelegation(target, caller);
                    // wait defaults to true (block for the reply); wait:false is fire-and-poll.
                    return Boolean.FALSE.equals(a.get("wait"))
-                            ? sendAsync(messages, target, content, onAccepted, workers.profiles())
-                            : send(messages, target, content, timeoutMs(a), onAccepted, workers.profiles());
+                            ? sendAsync(messages, target, content, onAccepted)
+                            : send(messages, target, content, timeoutMs(a), onAccepted);
                })
                // bridge_reply's identity is the CONNECTION, never an argument — so the authz check
                // is "is this caller a worker at all", and it can only ever reply as itself.
@@ -225,14 +200,13 @@ public final class BridgeMcp {
                    // CB-301: carry the caller's identity as the session owner (null for the primary).
                    // CB-301-ext: optional isolated worktree for parallel implementers.
                    String callerCwd = identity.cwdForPid(callerPid(exchange));
-                    return spawn(sessions, str(a, "profile"), str(a, "role"), str(a, "cwd"), callerCwd,
-                            callerTerminal(exchange), worktreeRequest(a),
-                            str(a, "sessionName"), str(a, "resumeSessionId"));
+                    return spawn(sessions, str(a, "profile"), str(a, "cwd"), callerCwd,
+                            callerTerminal(exchange), worktreeRequest(a));
                })
                .toolCall(listTool(), (exchange, _) -> {
                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                    if (denied != null) return denied;
-                    return listFleet(workers, sessions, messages, capacity, healthCoverage, quarantine,
+                    return listFleet(workers, sessions,
                            callers == null ? Map.of() : callers.leads(),
                            callerTerminal(exchange));
                })
@@ -245,7 +219,7 @@ public final class BridgeMcp {
                .toolCall(profilesTool(), (exchange, _) -> {
                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
                    if (denied != null) return denied;
-                    return profiles(workers, quarantine);
+                    return profiles(workers);
                })
                .toolCall(whoamiTool(), (exchange, _) -> {
                    McpSchema.CallToolResult denied = deny(exchange, Authz.Action.READ, null);
@@ -390,13 +364,6 @@ public final class BridgeMcp {
        return transport;
    }

-    /** Mark a connected spawned member available for the injector readiness gate. */
-    static void markSpawnedMemberPresent(Principal caller, MemberPresence presence) {
-        if (caller.isSpawnedMember()) {
-            presence.markPresent(caller.terminal());
-        }
-    }
-
    /** Graceful shutdown of the MCP server. */
    public void close() {
        server.closeGracefully();
@@ -404,22 +371,21 @@ public final class BridgeMcp {

    // --- tool logic (thin adapters over the services; unit-testable) ---------------------------

+    /** {@code bridge_send}: delegate {@code content} to a worker session and block for its reply. */
+    static McpSchema.CallToolResult send(MessageService messages, String sessionId, String content, Long timeoutMs) {
+        return send(messages, sessionId, content, timeoutMs, null);
+    }
+
    /**
-     * {@code bridge_send}: delegate {@code content} to a worker session and block for its reply.
-     * The configured profiles are required so a profile name can never bypass target validation.
-     *
+     * As {@link #send(MessageService, String, String, Long)}, wiring an accepted-delivery hook
     * (CB-548): {@code onAccepted} records delegator ownership the instant the send is accepted, so
     * a BUSY interloper never claims a turn it did not win. {@code null} disables recording.
     */
    static McpSchema.CallToolResult send(MessageService messages, String sessionId, String content,
-                                         Long timeoutMs, Runnable onAccepted, Set<String> profiles) {
+                                         Long timeoutMs, Runnable onAccepted) {
        if (isBlank(sessionId) || isBlank(content)) {
            return error("sessionId and content are required");
        }
-        McpSchema.CallToolResult targetError = profileTargetError(sessionId, profiles);
-        if (targetError != null) {
-            return targetError;
-        }
        long timeout = clamp(timeoutMs == null ? DEFAULT_TIMEOUT_MS : timeoutMs);
        try {
            return formatReply(messages.send(sessionId, content, timeout, onAccepted), timeout);
@@ -475,11 +441,6 @@ public final class BridgeMcp {
                    "[worker finished without a structured bridge_reply — transcript tail follows]\n" + r.text());
            // The worker ran the turn then wedged (CB-109) — surface the error context.
            case WORKER_FAILED -> text("[worker failed — turn ended in an unrecoverable state]\n" + r.text());
-            // The backend refused on a subscription usage limit (CB-578 stage A) — the worker's
-            // pane stayed healthy, but its account is exhausted. Distinct from WORKER_FAILED so the
-            // primary gets the real cause, not a generic wedge.
-            case BACKEND_EXHAUSTED -> text("[backend exhausted — the worker's account refused on a "
-                    + "usage limit]\n" + r.text());
            // The worker paused mid-turn to ask (CB-205) — tell the primary how to answer in-turn.
            case QUESTION -> text("[question] the worker paused to ask before it can finish:\n" + r.text()
                    + "\n\nAnswer it by calling bridge_send again with turnId=\"" + r.turnId()
@@ -494,33 +455,24 @@ public final class BridgeMcp {
    /**
     * {@code bridge_send} with {@code wait:false}: delegate {@code content} and return a ticket
     * immediately (fire-and-poll), so a long task isn't cut off by the caller's MCP call timeout.
-     * The configured profiles are required so a profile name can never bypass target validation.
-     *
-     * This wires the accepted-delivery hook
+     */
+    static McpSchema.CallToolResult sendAsync(MessageService messages, String sessionId, String content) {
+        return sendAsync(messages, sessionId, content, null);
+    }
+
+    /**
+     * As {@link #sendAsync(MessageService, String, String)}, wiring the accepted-delivery hook
     * (CB-548) so an async flooding send records delegator ownership exactly once it is accepted.
     */
    static McpSchema.CallToolResult sendAsync(MessageService messages, String sessionId, String content,
-                                              Runnable onAccepted, Set<String> profiles) {
+                                              Runnable onAccepted) {
        if (isBlank(sessionId) || isBlank(content)) {
            return error("sessionId and content are required");
        }
-        McpSchema.CallToolResult targetError = profileTargetError(sessionId, profiles);
-        if (targetError != null) {
-            return targetError;
-        }
        String ticket = messages.sendAsync(sessionId, content, onAccepted);
        return text("accepted — task delegated. Poll bridge_poll with ticket=" + ticket);
    }

-    /** A configured profile is never a send target; other unknown values may be herdr-owned panes. */
-    private static McpSchema.CallToolResult profileTargetError(String sessionId, Set<String> profiles) {
-        if (profiles.contains(sessionId)) {
-            return error("unknown send target \"" + sessionId + "\": it is a configured profile name, not a "
-                    + "session id. Call bridge_list to find a member or lead sessionId.");
-        }
-        return null;
-    }
-
    /** {@code bridge_poll}: check an async delegation by ticket, or drain a worker's inbox by target. */
    static McpSchema.CallToolResult poll(MessageService messages, String ticket, String target) {
        if (!isBlank(target)) {
@@ -542,9 +494,6 @@ public final class BridgeMcp {
                    ? "[done — worker finished without a structured bridge_reply; transcript tail follows]\n" + v.reply()
                    : v.reply());
            case PENDING -> text("[pending — " + v.detail() + "]");
-            case ASKING -> text("[question — worker is waiting for your answer]\n" + v.reply()
-                    + "\n\nAnswer it by calling bridge_send again with turnId=\"" + v.turnId()
-                    + "\" and content set to your answer; the worker resumes the same turn.");
            case FAILED -> text("[failed — " + v.detail() + "]");
        };
    }
@@ -657,43 +606,27 @@ public final class BridgeMcp {

    /** {@code bridge_spawn} without cwd/caller context (default resolution). */
    static McpSchema.CallToolResult spawn(SessionManager sessions, String profile) {
-        return spawn(sessions, profile, null, null, null, null, null, null, null);
+        return spawn(sessions, profile, null, null, null, null);
    }

    /**
-     * {@code bridge_spawn}: launch a guard-checked member for {@code profile} (blank → the default
-     * profile) under {@code role} (blank → {@code dev}), and return its session id + pane id. The
-     * member's cwd is {@code requestedCwd} if given, else the profile's config, else
-     * {@code callerCwd} (the primary's directory), else the daemon's.
+     * {@code bridge_spawn}: launch a guard-checked worker for {@code profile} (blank → the default
+     * profile) and return its session id + pane id. The worker's cwd is {@code requestedCwd} if given,
+     * else the profile's config, else {@code callerCwd} (the primary's directory), else the daemon's.
     * CB-301: the session is registered with {@code ownerTerminal} as its owner.
     * CB-301-ext: {@code worktreeRequest} non-null provisions an isolated git worktree.
-     * CB-584: {@code sessionName}/{@code resumeSessionId} request agent session identity — a resumed
-     * conversation requires an explicit {@code profile} whose adapter declares
-     * {@link dev.ltms.bridged.peer.Capability#SESSION_RESUME}, or the spawn is refused rather than
-     * silently starting a cold session.
-     *
-     * <p>{@code role} and {@code profile} are independent: the role picks the contract, the profile
-     * picks the backend. A reviewer on the same profile as the dev it reviews is a normal spawn.
     */
-    static McpSchema.CallToolResult spawn(SessionManager sessions, String profile, String role,
+    static McpSchema.CallToolResult spawn(SessionManager sessions, String profile,
                                          String requestedCwd, String callerCwd,
-                                          String ownerTerminal, WorktreeRequest worktreeRequest,
-                                          String sessionName, String resumeSessionId) {
-        MemberRole memberRole;
+                                          String ownerTerminal, WorktreeRequest worktreeRequest) {
        try {
-            memberRole = isBlank(role) ? MemberRole.DEV : MemberRole.parse(role);
-        } catch (IllegalArgumentException e) {
-            return error(e.getMessage());
-        }
-        try {
-            MemberSession member = sessions.acquire(isBlank(profile) ? null : profile, memberRole,
-                    requestedCwd, callerCwd, ownerTerminal, worktreeRequest,
-                    isBlank(sessionName) ? null : sessionName, isBlank(resumeSessionId) ? null : resumeSessionId);
-            return text(json(memberView(member)));
+            WorkerSession worker = sessions.acquire(isBlank(profile) ? null : profile,
+                    requestedCwd, callerCwd, ownerTerminal, worktreeRequest);
+            return text(json(workerView(worker)));
        } catch (GuardException e) {
            return error("subscription boundary: " + e.getMessage());
        } catch (IllegalArgumentException e) {
-            return error(e.getMessage()); // unknown / no-default profile, or a refused resumeSessionId
+            return error(e.getMessage()); // unknown / no-default profile
        } catch (PeerUnreachableException e) {
            return error("spawn timed out — worker pane never reached injectable state: " + e.getMessage());
        } catch (HerdrException e) {
@@ -729,33 +662,11 @@ public final class BridgeMcp {
        return null;
    }

-    /**
-     * {@code bridge_profiles}: the configured worker profiles, the default, and — CB-578 stage B —
-     * which of them are currently quarantined (backend exhausted) and for how much longer. The
-     * {@code quarantined} key is present only when at least one profile is, so a fleet where nothing
-     * has ever been quarantined gets exactly the pre-stage-B shape.
-     */
-    static McpSchema.CallToolResult profiles(PeerLauncher workers, QuarantineSource quarantine) {
-        Map<String, Object> result = new LinkedHashMap<>();
-        result.put("profiles", workers.profiles());
-        result.put("default", workers.defaultProfile() == null ? "" : workers.defaultProfile());
-        Map<String, Object> quarantined = new LinkedHashMap<>();
-        for (String profile : workers.profiles()) {
-            String credentialId = quarantine.credentialIdFor().apply(profile);
-            if (credentialId == null) {
-                continue;
-            }
-            quarantine.quarantine().remainingSeconds(credentialId).ifPresent(remaining -> {
-                Map<String, Object> row = new LinkedHashMap<>();
-                row.put("credentialId", credentialId);
-                row.put("quarantinedForSeconds", remaining);
-                quarantined.put(profile, row);
-            });
-        }
-        if (!quarantined.isEmpty()) {
-            result.put("quarantined", quarantined);
-        }
-        return text(json(result));
+    /** {@code bridge_profiles}: the configured worker profiles and the default. */
+    static McpSchema.CallToolResult profiles(PeerLauncher workers) {
+        return text(json(Map.of(
+                "profiles", workers.profiles(),
+                "default", workers.defaultProfile() == null ? "" : workers.defaultProfile())));
    }

    /**
@@ -774,22 +685,11 @@ public final class BridgeMcp {
     * caller's own row is flagged {@code "self": true}: a peer needs to tell its own pane apart from
     * a peer's, and the alternative is every lead calling {@code bridge_whoami} to subtract itself.
     *
-     * <p>CB-583: the {@code capacity} rows reuse {@code quarantine} (the same {@link QuarantineSource}
-     * {@code bridge_profiles} reads) so the two surfaces cannot disagree about which profile is
-     * quarantined — see {@link #capacityView}.
-     *
     * @param leads    terminal_id → lead name, live from the resolver
     * @param selfTerm the calling pane's terminal id, or blank for a caller with no pane
     */
    static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions,
                                              Map<String, String> leads, String selfTerm) {
-        return listFleet(workers, sessions, null, CapacitySource.none(), new HealthCoverageSource(() -> "off"),
-                QuarantineSource.none(), leads, selfTerm);
-    }
-
-    static McpSchema.CallToolResult listFleet(PeerLauncher workers, SessionManager sessions, MessageService messages,
-                                               CapacitySource capacity, HealthCoverageSource healthCoverage,
-                                               QuarantineSource quarantine, Map<String, String> leads, String selfTerm) {
        try {
            Map<String, Agent> live = workers.list().stream()
                    .map(Agent.class::cast)
@@ -799,74 +699,15 @@ public final class BridgeMcp {
                    .sorted(Map.Entry.comparingByValue())
                    .map(e -> leadView(e.getKey(), e.getValue(), live.get(e.getKey()), selfTerm))
                    .toList();
-            List<MemberSession> roster = sessions.roster();
-            List<Map<String, Object>> out = roster.stream()
-                    .map(s -> memberCapacityView(s, live.get(s.terminalId()), messages, capacity.clock().getAsLong()))
+            List<Map<String, Object>> out = sessions.roster().stream()
+                    .map(s -> SessionManager.rosterView(s, live.get(s.terminalId())))
                    .toList();
-            Set<String> profiles = new java.util.TreeSet<>(capacity.configuredProfiles().get());
-            roster.stream().map(MemberSession::profile).forEach(profiles::add);
-            Map<String, Object> result = new LinkedHashMap<>();
-            result.put("leads", leadRows); result.put("members", out);
-            result.put("healthCoverage", healthCoverage.value().get());
-            if (capacity.available()) result.put("capacity", profiles.stream()
-                    .map(profile -> capacityView(profile, capacity.liveCount(), capacity.maxLoad(), roster, messages,
-                            capacity.clock().getAsLong(), quarantine)).toList());
-            return text(json(result));
+            return text(json(Map.of("leads", leadRows, "workers", out)));
        } catch (HerdrException e) {
            return error("herdr error listing the fleet: " + e.getMessage());
        }
    }

-    /**
-     * Capacity is advisory only. {@code reclaimable} says there is no bridge work, not that bridged
-     * may stop the member: the bridge has capacity facts but no work list, and choosing work needs
-     * authority it does not have. {@code idleForSeconds} is derived from monotonic nanoTime and has
-     * no wall-clock meaning across a daemon restart.
-     */
-    private static Map<String, Object> memberCapacityView(MemberSession session, Agent live,
-                                                           MessageService messages, long nowNanos) {
-        Map<String, Object> row = SessionManager.rosterView(session, live);
-        boolean open = messages != null && messages.hasAcceptedDelivery(session.terminalId());
-        boolean inbox = messages != null && messages.hasInboxMessage(session.terminalId());
-        boolean reclaimable = (session.state() == MemberSession.State.READY || session.state() == MemberSession.State.DONE)
-                && !open && !inbox;
-        row.put("reclaimable", reclaimable);
-        row.put("idleForSeconds", reclaimable ? Math.max(0, (nowNanos - session.lastActivityAtNanos()) / 1_000_000_000L) : null);
-        return row;
-    }
-
-    /**
-     * CB-583: {@code free} alone cannot tell a lead "busy, will free up" from "refusing, and
-     * nothing changes for N seconds" — those need different decisions. So a quarantined profile
-     * forces {@code free} to 0, whatever its {@code maxLoad}/{@code live} say, and the row carries
-     * the same {@code credentialId}/{@code quarantinedForSeconds} facts {@code bridge_profiles}
-     * reports, reusing {@link QuarantineSource} rather than a second lookup. Both new keys are
-     * added only when the profile is actually quarantined, so an ordinary fleet's rows are
-     * byte-identical to before this change.
-     */
-    private static Map<String, Object> capacityView(String profile, Function<String, Integer> liveCount,
-                                                     Function<String, Integer> maxLoad, List<MemberSession> roster,
-                                                     MessageService messages, long nowNanos, QuarantineSource quarantine) {
-        Integer cap = maxLoad.apply(profile);
-        int live = liveCount.apply(profile);
-        int reclaimable = (int) roster.stream().filter(s -> profile.equals(s.profile()))
-                .filter(s -> (s.state() == MemberSession.State.READY || s.state() == MemberSession.State.DONE))
-                .filter(s -> messages == null || (!messages.hasAcceptedDelivery(s.terminalId()) && !messages.hasInboxMessage(s.terminalId())))
-                .count();
-        Map<String, Object> row = new LinkedHashMap<>();
-        row.put("profile", profile); row.put("maxLoad", cap); row.put("live", live);
-        row.put("free", cap == null ? null : Math.max(0, cap - live)); row.put("reclaimable", reclaimable);
-        String credentialId = quarantine.credentialIdFor().apply(profile);
-        if (credentialId != null) {
-            quarantine.quarantine().remainingSeconds(credentialId).ifPresent(remaining -> {
-                row.put("free", 0);
-                row.put("credentialId", credentialId);
-                row.put("quarantinedForSeconds", remaining);
-            });
-        }
-        return row;
-    }
-
    /**
     * One lead's row: its address, its name, and whether it can be reached right now.
     *
@@ -902,14 +743,10 @@ public final class BridgeMcp {
    }

    /** CB-301 projection from the authoritative session registry. */
-    private static Map<String, Object> memberView(MemberSession s) {
+    private static Map<String, Object> workerView(WorkerSession s) {
        Map<String, Object> m = new LinkedHashMap<>();
        m.put("sessionId", s.terminalId());
        m.put("paneId", s.paneId());
-        // Echo the role back so the caller can see what it actually got, not what it meant to ask
-        // for — a spawn that silently fell back to dev is otherwise invisible.
-        m.put("role", s.role() == null ? "dev" : s.role().wireName());
-        m.put("profile", s.profile());
        m.put("status", s.state().name().toLowerCase());
        if (s.worktree() != null) {
            m.put("worktree", s.worktree());
@@ -986,38 +823,22 @@ public final class BridgeMcp {

    private static McpSchema.Tool spawnTool() {
        return tool("bridge_spawn",
-                "Spawn a new off-subscription member session. A member has two independent attributes: "
-                        + "role (what it is for) and profile (which backend it runs on). Pass role to pick "
-                        + "the contract — 'dev' implements a unit and opens its own PR, 'reviewer' reviews a "
-                        + "diff it did not write, 'architect' refines a ticket before anyone builds it; omit "
-                        + "it for 'dev'. Pass profile (from bridge_profiles) to pick the backend, or omit it "
-                        + "for the default. The two are independent: a reviewer may run on the same profile "
-                        + "as the dev it reviews. The member opens your current directory by default; pass "
-                        + "cwd to pin a different one. Pass worktree:true (with ticket) or "
-                        + "worktree:<ticket-slug> to provision an isolated git worktree. Pass resumeSessionId "
-                        + "to relaunch onto a prior conversation instead of starting cold — this requires an "
-                        + "explicit profile whose backend supports it (bridge_list shows agentSessionId for "
-                        + "resumable members), and is refused otherwise rather than silently starting fresh. "
-                        + "sessionName gives the member a display name in its own UI when the backend supports "
-                        + "one. Returns the member's sessionId (use with bridge_send) and paneId (use with "
-                        + "bridge_stop).",
+                "Spawn a new off-subscription worker session. Pass a profile (from bridge_profiles) to "
+                        + "pick the backend, or omit it for the default. The worker opens your current "
+                        + "directory by default; pass cwd to pin a different one. Pass worktree:true (with "
+                        + "ticket) or worktree:<ticket-slug> to provision an isolated git worktree. "
+                        + "Returns the worker's sessionId (use with bridge_send) and paneId (use with bridge_stop).",
                objectSchema(Map.of(
-                        "role", stringProp("What the member is for: architect, dev or reviewer (default dev)"),
-                        "profile", stringProp("Which backend to run it on (omit for the default profile)"),
-                        "cwd", stringProp("Working directory for the member (omit to inherit yours)"),
+                        "profile", stringProp("Worker profile to spawn (omit for the default profile)"),
+                        "cwd", stringProp("Working directory for the worker (omit to inherit yours)"),
                        "worktree", Map.of("type", "string", "description", "'true' or a ticket slug — requests an isolated git worktree"),
-                        "ticket", stringProp("Ticket slug when worktree:true"),
-                        "sessionName", stringProp("Logical display name for the member's own session, when its backend supports one"),
-                        "resumeSessionId", stringProp("A prior member's agentSessionId (from bridge_list) to resume — requires an explicit profile that supports it")),
+                        "ticket", stringProp("Ticket slug when worktree:true")),
                        List.of()));
    }

    private static McpSchema.Tool profilesTool() {
        return tool("bridge_profiles",
-                "List the configured worker profiles (backends) and which one bridge_spawn uses by "
-                        + "default. A 'quarantined' map is present when a backend-exhausted refusal put "
-                        + "a profile's credential on cooldown — bridge_spawn onto it is refused until "
-                        + "quarantinedForSeconds elapses; a profile sharing that credential is listed too.",
+                "List the configured worker profiles (backends) and which one bridge_spawn uses by default.",
                objectSchema(Map.of(), List.of()));
    }

@@ -1026,18 +847,10 @@ public final class BridgeMcp {
                "List the whole fleet the bridge tracks, in two parts. 'leads' are your PEERS — other "
                        + "orchestrators, each with its sessionId (the address to bridge_send to), "
                        + "name, live status, and 'self': true on your own row; this is how you "
-                        + "discover a peer lead without being told its address. 'members' are the "
-                        + "sessions delegated to — each with sessionId, paneId, role (architect/dev/"
-                        + "reviewer), profile (the backend it runs on), state, optional "
-                        + "worktree/branch/owner/agentSessionId (the id to pass as bridge_spawn's "
-                        + "resumeSessionId to relaunch onto that same conversation, when the backend "
-                        + "supports it), and live herdr status. An empty 'members' "
-                        + "means no members are spawned; it says nothing about peers. When capacity "
-                        + "facts are configured, a 'capacity' row per profile also reports free: 0 for "
-                        + "a quarantined profile's credential (see bridge_profiles), whatever its "
-                        + "maxLoad/live — with credentialId and quarantinedForSeconds naming the "
-                        + "quarantine, so 'free: 0, busy' can be told apart from 'free: 0, refusing "
-                        + "for N seconds'.",
+                        + "discover a peer lead without being told its address. 'workers' are the "
+                        + "sessions delegated to — each with sessionId, paneId, profile, state, "
+                        + "optional worktree/branch/owner, and live herdr status. An empty 'workers' "
+                        + "means no workers are spawned; it says nothing about peers.",
                objectSchema(Map.of(), List.of()));
    }

@@ -2,7 +2,7 @@ package dev.ltms.bridged.metrics;

 import dev.ltms.bridged.msg.ReplyInbox;
 import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.bridged.session.WorkerSession;

 import java.util.LinkedHashMap;
 import java.util.Map;
@@ -26,8 +26,6 @@ public final class BridgedMetrics {
    public static final String REPLIES = "bridged_replies_total";
    /** Counter: push-loop nudges to the primary, by outcome. */
    public static final String PUSH_NUDGES = "bridged_push_nudges_total";
-    /** Counter: idle-lead heartbeat nudges to the lead, by outcome (CB-551). */
-    public static final String HEARTBEAT_NUDGES = "bridged_lead_heartbeat_nudges_total";
    /** Counter: spawn attempts by peer kind and outcome. */
    public static final String SPAWNS = "bridged_spawns_total";
    /** Counter: herdr socket calls by method and outcome. */
@@ -57,9 +55,6 @@ public final class BridgedMetrics {
                "Worker replies by delivery path (rendezvous=resolved an open send, inbox=stranded and held).");
        m.describe(PUSH_NUDGES, "counter",
                "CB-307 push-loop nudges to the primary (delivered|exhausted).");
-        m.describe(HEARTBEAT_NUDGES, "counter",
-                "CB-551 idle-lead heartbeat nudges (delivered|failed|exhausted). Quiet-cap exhaustion "
-                        + "means the lead idled with nothing pending and was told to stand down.");
        m.describe(SPAWNS, "counter",
                "Worker spawn attempts by peer kind and outcome (ready|timeout|guard_rejected).");
        m.describe(HERDR_CALLS, "counter",
@@ -74,7 +69,7 @@ public final class BridgedMetrics {

        // One gauge per state so a scrape shows the whole census even when a state is empty —
        // an absent series and a zero series read very differently on a dashboard.
-        for (MemberSession.State state : MemberSession.State.values()) {
+        for (WorkerSession.State state : WorkerSession.State.values()) {
            String label = state.name().toLowerCase();
            m.gauge(SESSIONS, () -> countIn(sessions, state), "state", label);
        }
@@ -83,7 +78,7 @@ public final class BridgedMetrics {
        // port's non-destructive read — scraping metrics must never ack a reply out of the inbox.
        m.collector(INBOX_DEPTH, "target", () -> {
            Map<String, Number> depths = new LinkedHashMap<>();
-            for (MemberSession s : sessions.roster()) {
+            for (WorkerSession s : sessions.roster()) {
                String target = s.terminalId();
                if (target == null) {
                    continue;
@@ -95,7 +90,7 @@ public final class BridgedMetrics {
        return m;
    }

-    private static long countIn(SessionManager sessions, MemberSession.State state) {
+    private static long countIn(SessionManager sessions, WorkerSession.State state) {
        return sessions.roster().stream().filter(s -> s.state() == state).count();
    }
 }
@@ -1,351 +0,0 @@
-package dev.ltms.bridged.msg;
-
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.mcp.PrimaryRegistry;
-import dev.ltms.bridged.metrics.BridgedMetrics;
-import dev.ltms.bridged.metrics.Metrics;
-import dev.ltms.bridged.session.MemberSession;
-import org.slf4j.Logger;
-import org.slf4j.LoggerFactory;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.concurrent.ScheduledExecutorService;
-import java.util.concurrent.TimeUnit;
-import java.util.function.LongSupplier;
-import java.util.function.Supplier;
-
-/**
- * CB-551: an opt-in heartbeat that nudges the single idle lead back to work once it has been
- * continuously idle past a quiet period with no open {@code bridge_send} driving it.
- *
- * <p>Why this exists: the fleet is ONE lead + architects + workers, so an idle, stalled lead is a
- * single point of failure for the fleet's progress. {@link ReplyPushLoop} nudges the lead only when
- * a worker reply lands; this loop is the timer that catches the gap where nothing lands and the
- * lead simply sits idle with nobody to prompt it onward.
- *
- * <p>Mechanism mirrors {@link ReplyPushLoop}: a pure, unit-testable decision function
- * ({@link #decide(long, Long, int, AgentStatus, boolean, boolean, FleetState)}) plus a thin
- * scheduler around it. The loop is <em>entirely opt-in</em> ({@code leadHeartbeat:} in config); with
- * no such block it is never constructed, so upgrading the daemon cannot silently acquire a behaviour
- * that spends the operator's model subscription on its own initiative (constraint 1).
- *
- * <p>Four invariants keep it from becoming a runaway subscription burner:
- * <ol>
- *   <li><b>Status-gated</b> — a {@code WORKING} lead is making progress and is never touched; only an
- *       injectable (idle/done/blocked) lead is even considered (constraint 2).</li>
- *   <li><b>Debounced</b> — a nudge only fires once the lead has been <em>continuously</em> idle past
- *       {@code idleAfterSeconds}, so a lead that just finished a turn is not re-prompted into every
- *       natural pause (constraint 3).</li>
- *   <li><b>Bounded when quiet</b> — consecutive nudges that find no pending fleet state are capped at
- *       {@code quietNudgeCap}, then the loop stops nudging until real state returns (constraint 4).</li>
- *   <li><b>Never races {@link ReplyPushLoop}</b> — while that loop is actively nudging any target this
- *       loop stands down, so two competing injections never start two turns in the same pane
- *       (constraint 6).</li>
- * </ol>
- */
-public final class LeadHeartbeatLoop {
-
-    private static final Logger log = LoggerFactory.getLogger(LeadHeartbeatLoop.class);
-
-    /** Sentinel for {@link #idleSinceNanos}: the lead is not currently in an idle stretch. */
-    private static final long NOT_IDLE = Long.MIN_VALUE;
-
-    private final PrimaryRegistry primaryRegistry;
-    private final AgentControl agents;
-    private final ReplyInbox inbox;
-    private final Supplier<List<MemberSession>> roster;
-    private final ReplyPushLoop pushLoop;
-    private final ScheduledExecutorService scheduler;
-    private final LongSupplier clock;
-    private final long idleAfterNanos;
-    private final long backoffMs;
-    private final int quietNudgeCap;
-    private final Metrics metrics; // CB-512 pattern: nullable — no registry in unit tests
-
-    /** When the current idle stretch began (nanos), or {@link #NOT_IDLE}. Single scheduler thread only. */
-    private long idleSinceNanos = NOT_IDLE;
-    /** Consecutive nudges that found no pending fleet state. Single scheduler thread only. */
-    private int quietCount = 0;
-
-    /** Constructor with an injectable clock and no metric registry (unit tests, or wiring that opts out). */
-    public LeadHeartbeatLoop(PrimaryRegistry primaryRegistry, AgentControl agents, ReplyInbox inbox,
-                             Supplier<List<MemberSession>> roster, ReplyPushLoop pushLoop,
-                             ScheduledExecutorService scheduler, LongSupplier clock,
-                             long idleAfterNanos, long backoffMs, int quietNudgeCap) {
-        this(primaryRegistry, agents, inbox, roster, pushLoop, scheduler, clock,
-                idleAfterNanos, backoffMs, quietNudgeCap, null);
-    }
-
-    /** As above, with a metric registry (the CB-512 pattern) so nudge outcomes are counted. */
-    public LeadHeartbeatLoop(PrimaryRegistry primaryRegistry, AgentControl agents, ReplyInbox inbox,
-                             Supplier<List<MemberSession>> roster, ReplyPushLoop pushLoop,
-                             ScheduledExecutorService scheduler, LongSupplier clock,
-                             long idleAfterNanos, long backoffMs, int quietNudgeCap, Metrics metrics) {
-        this.primaryRegistry = primaryRegistry;
-        this.agents = agents;
-        this.inbox = inbox;
-        this.roster = roster;
-        this.pushLoop = pushLoop;
-        this.scheduler = scheduler;
-        this.clock = clock;
-        this.idleAfterNanos = idleAfterNanos;
-        this.backoffMs = backoffMs;
-        this.quietNudgeCap = quietNudgeCap;
-        this.metrics = metrics;
-    }
-
-    /** Count one nudge outcome when a registry is wired; a no-op in unit tests. */
-    private void countNudge(String outcome) {
-        if (metrics != null) {
-            metrics.inc(BridgedMetrics.HEARTBEAT_NUDGES, "outcome", outcome);
-        }
-    }
-
-    // --- decision logic (package-private for unit-testing) --------------------------------------
-
-    /** The action the loop should take on one tick. */
-    enum Action {
-        /** Send a heartbeat nudge to the lead now. */
-        INJECT,
-        /** Lead is idle but not yet past the quiet period — keep waiting, do nothing. */
-        WAIT_IDLE,
-        /** Lead is making progress (or its status cannot be read) — reset the idle window and re-arm. */
-        LEAD_BUSY,
-        /** Idle past the quiet period with nothing pending and the cap exhausted — stop until new state appears. */
-        QUIET_DONE,
-        /** {@link ReplyPushLoop} is actively nudging — stand aside rather than start a competing turn. */
-        STAND_DOWN
-    }
-
-    /** The outcome of one decision: the action plus the state to persist for the next tick. */
-    record Decision(Action action, Long idleSinceNanos, int quietCount) {}
-
-    /**
-     * Pure decision function: given the current loop state and fleet/lead facts, return what to do
-     * next and the exact state to carry forward. Pure means no I/O and no mutation — the caller
-     * ({@link #tick}) applies {@link Decision} to its fields. This is what makes the loop unit-testable
-     * with a fake clock and no sleeping.
-     *
-     * @param nowNanos        the current time (an injected clock in tests, {@link System#nanoTime()} live)
-     * @param idleSinceNanos  when the current idle stretch began, or {@code null} if the lead is not idle
-     * @param quietCount      consecutive nudges so far that found no pending fleet state
-     * @param status          the lead's herdr status
-     * @param pushLoopActive  whether {@link ReplyPushLoop} is currently nudging some target (constraint 6)
-     * @param leadKnown       whether a lead terminal is known to nudge at all
-     * @param fleet           a snapshot of the pending fleet state (constraint 5)
-     * @return the action to take and the state to persist
-     */
-    Decision decide(long nowNanos, Long idleSinceNanos, int quietCount, AgentStatus status,
-                    boolean pushLoopActive, boolean leadKnown, FleetState fleet) {
-        // Constraint 6: while ReplyPushLoop is actively nudging the lead, injecting a second,
-        // competing prompt into the same pane would start a second turn — racing loops multiply
-        // turns and context burn. Stand aside, and treat the active push as real state (re-arm the
-        // quiet counter), because the reply that drove it is exactly the kind of new state that
-        // should reset the cap.
-        if (pushLoopActive) {
-            return new Decision(Action.STAND_DOWN, idleSinceNanos, 0);
-        }
-        // Constraint 2: a WORKING lead is making progress and must NOT be touched; an unreadable
-        // status (read failure, or the agent is gone) is safest treated the same way — never inject
-        // into a state we cannot read. Either way, reset the idle window and the quiet counter: the
-        // lead was / may be active, so the next idle stretch must count its own quiet period fresh.
-        if (status == null || !status.injectable()) {
-            return new Decision(Action.LEAD_BUSY, null, 0);
-        }
-        if (idleSinceNanos == null) {
-            // The lead just became injectable — record the start of an idle stretch and wait out the
-            // debounce quiet period before ever nudging (constraint 3).
-            return new Decision(Action.WAIT_IDLE, nowNanos, quietCount);
-        }
-        if (nowNanos - idleSinceNanos < idleAfterNanos) {
-            // Still within the quiet period: the lead that just finished a turn sits momentarily idle
-            // and must not be re-prompted into every natural pause.
-            return new Decision(Action.WAIT_IDLE, idleSinceNanos, quietCount);
-        }
-        // Past the quiet period with an injectable lead: it is a genuine candidate for a nudge. Two
-        // gating facts decide whether and how:
-        if (!leadKnown) {
-            // No lead terminal is known yet (e.g. the registry has not learned one) — there is nobody
-            // to nudge. Keep waiting; the window stays open so discovery re-arms it without a fresh
-            // quiet period.
-            return new Decision(Action.WAIT_IDLE, idleSinceNanos, quietCount);
-        }
-        if (fleet.hasPending()) {
-            // Real fleet state is waiting — a worker reply or a DONE session. This is new state, so
-            // it resets the quiet counter (constraint 4) and the lead is nudged to go collect it.
-            return new Decision(Action.INJECT, idleSinceNanos, 0);
-        }
-        if (quietCount < quietNudgeCap) {
-            // Nothing is pending, but the cap is not exhausted: nudge anyway, telling the lead
-            // exactly that nothing is waiting so it can choose to stand down rather than hunt
-            // (constraint 5). Count it toward the consecutive-quiet cap.
-            return new Decision(Action.INJECT, idleSinceNanos, quietCount + 1);
-        }
-        // Nothing pending and the cap is exhausted: stop nudging until real state appears again
-        // (constraint 4). The loop still ticks on backoff so a genuinely new reply or session change
-        // re-arms it — QUIET_DONE stops injection, not observation.
-        return new Decision(Action.QUIET_DONE, idleSinceNanos, quietCount);
-    }
-
-    // --- loop ----------------------------------------------------------------------------------
-
-    /**
-     * Start the heartbeat. Schedules the first tick after one backoff so a freshly-booting daemon
-     * does not evaluate the lead's idle state before the fleet has settled.
-     */
-    public void start() {
-        log.info("idle-lead heartbeat: on — nudge lead after {}s idle (recheck {}ms, quiet cap {})",
-                TimeUnit.NANOSECONDS.toSeconds(idleAfterNanos), backoffMs, quietNudgeCap);
-        scheduler.schedule(this::tick, backoffMs, TimeUnit.MILLISECONDS);
-    }
-
-    /** One loop tick, every {@link #backoffMs} — the thin scheduler around {@link #decide}. */
-    private void tick() {
-        boolean leadKnown = primaryRegistry.primaryTerminal().isPresent();
-        FleetState fleet = snapshot(inbox, roster);
-        AgentStatus status = AgentStatus.UNKNOWN;
-        if (leadKnown) {
-            try {
-                status = agents.status(primaryRegistry.primaryTerminal().orElseThrow());
-            } catch (RuntimeException e) {
-                // A failed status read degrades to "unknown" — decide() treats that like a busy lead
-                // and never injects into a state it cannot read. Retry on the next backoff.
-                log.debug("idle-heartbeat: status check failed for lead, will retry: {}", e.toString());
-            }
-        }
-
-        Decision d = decide(clock.getAsLong(),
-                idleSinceNanos == NOT_IDLE ? null : idleSinceNanos,
-                quietCount, status, pushLoop.isActive(), leadKnown, fleet);
-        applyDecision(d);
-        switch (d.action()) {
-            case INJECT -> injectNudge(fleet);
-            case QUIET_DONE -> countNudge("exhausted");
-            case WAIT_IDLE, LEAD_BUSY, STAND_DOWN -> { /* nothing to inject, nothing to count */ }
-        }
-        scheduleNext();
-    }
-
-    /** Persist the state a decision returned, so the next tick starts from it. */
-    private void applyDecision(Decision d) {
-        idleSinceNanos = d.idleSinceNanos() == null ? NOT_IDLE : d.idleSinceNanos();
-        quietCount = d.quietCount();
-    }
-
-    /** Send the nudge to the known lead. */
-    private void injectNudge(FleetState fleet) {
-        var lead = primaryRegistry.primaryTerminal();
-        if (lead.isEmpty()) {
-            return; // the lead disappeared between the decision and the injection
-        }
-        String leadTerminal = lead.get();
-        try {
-            agents.send(leadTerminal, fleet.nudgeText());
-            log.debug("idle-heartbeat: nudge sent to lead {} (quiet nudges so far in this stretch: {})",
-                    leadTerminal, quietCount);
-            countNudge("delivered");
-        } catch (RuntimeException e) {
-            log.warn("idle-heartbeat: failed to nudge lead {}: {}", leadTerminal, e.toString());
-            countNudge("failed");
-        }
-    }
-
-    /** Schedule the next tick on the scheduler thread pool. */
-    private void scheduleNext() {
-        scheduler.schedule(this::tick, backoffMs, TimeUnit.MILLISECONDS);
-    }
-
-    // --- lifecycle -----------------------------------------------------------------------------
-
-    /** Shut down the scheduler; outstanding ticks are cancelled. */
-    public void stop() {
-        scheduler.shutdownNow();
-    }
-
-    /** @see #stop() */
-    public void close() {
-        stop();
-    }
-
-    /**
-     * A read-only snapshot of the fleet facts the heartbeat reports to an idle lead. Carries exact
-     * counts and names the targets that hold replies, so the nudge is actionable rather than a
-     * content-free "keep working" that would cost the lead a turn just to discover what there is to
-     * do (constraint 5).
-     *
-     * @param pendingReplies total undrained worker replies across owned targets
-     * @param doneSessions   session count in the DONE state — finished turns awaiting teardown
-     * @param liveWorkers    sessions still registered (acquired minus released)
-     * @param replyTargets   the terminals whose inboxes currently hold at least one reply
-     */
-    record FleetState(int pendingReplies, int doneSessions, int liveWorkers, List<String> replyTargets) {
-
-        /** True when the lead has something real to collect — a reply or a session awaiting teardown. */
-        boolean hasPending() {
-            return pendingReplies > 0 || doneSessions > 0;
-        }
-
-        /** The nudge body, phrased for the two cases the heartbeat distinguishes. */
-        String nudgeText() {
-            StringBuilder sb = new StringBuilder(
-                    "Heartbeat: you are idle and no bridge_send is waiting on you.");
-            if (hasPending()) {
-                sb.append(" The fleet has state to collect: ").append(pendingDetail());
-            } else {
-                sb.append(" Fleet is quiet — nothing pending to collect (")
-                        .append(pendingReplies).append(" worker replies, ")
-                        .append(doneSessions).append(" DONE sessions); ")
-                        .append(liveWorkers).append(" workers live. You may stand down until new state re-arms me.");
-            }
-            return sb.toString();
-        }
-
-        private String pendingDetail() {
-            StringBuilder sb = new StringBuilder();
-            sb.append(pendingReplies).append(" worker ")
-                    .append(pendingReplies == 1 ? "reply" : "replies")
-                    .append(" pending collection");
-            if (!replyTargets.isEmpty()) {
-                // Render each as the exact command so the lead can act without parsing: the nearest
-                // analogue to ReplyPushLoop's bridge_poll(target=...) nudge.
-                sb.append(" (")
-                        .append(String.join(", ",
-                                replyTargets.stream().map(t -> "bridge_poll(target=" + t + ")").toList()))
-                        .append(")");
-            }
-            sb.append(", ").append(doneSessions).append(" DONE session").append(doneSessions == 1 ? "" : "s")
-                    .append(" awaiting teardown")
-                    .append(", ").append(liveWorkers).append(" worker").append(liveWorkers == 1 ? "" : "s")
-                    .append(" live");
-            return sb.toString();
-        }
-    }
-
-    /**
-     * Build a {@link FleetState} snapshot over the live roster and the reply inbox — the same
-     * sources the metrics collector uses, so the heartbeat reports facts the operator can cross-check
-     * against {@code /metrics}. Package-private and pure (reads only) so it is unit-testable.
-     */
-    static FleetState snapshot(ReplyInbox inbox, Supplier<List<MemberSession>> roster) {
-        List<MemberSession> sessions = roster.get();
-        int replies = 0;
-        int done = 0;
-        List<String> replyTargets = new ArrayList<>();
-        for (MemberSession s : sessions) {
-            if (s.terminalId() == null) {
-                continue;
-            }
-            int depth = inbox.peek(s.terminalId()).size();
-            if (depth > 0) {
-                replies += depth;
-                replyTargets.add(s.terminalId());
-            }
-            if (s.state() == MemberSession.State.DONE) {
-                done++;
-            }
-        }
-        return new FleetState(replies, done, sessions.size(), List.copyOf(replyTargets));
-    }
-}
@@ -20,7 +20,6 @@ import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.concurrent.locks.ReentrantLock;
-import java.util.function.LongSupplier;

 /**
 * The blocking delegation feature (CB-104): deliver {@code content} into a worker and block until
@@ -53,12 +52,8 @@ public final class MessageService {
     */
    private static final long ASYNC_TIMEOUT_MS = 30 * 60 * 1_000L;

-    /**
-     * How long a finished (terminal) ticket is retained for polling before it is pruned. Package-
-     * private (not {@code private}) so a test can advance an injected clock past it deterministically
-     * instead of duplicating the magic number or sleeping for real.
-     */
-    static final long TICKET_TTL_NANOS = 10 * 60 * 1_000_000_000L;
+    /** How long a finished (terminal) ticket is retained for polling before it is pruned. */
+    private static final long TICKET_TTL_NANOS = 10 * 60 * 1_000_000_000L;

    /** Outcome of a blocking send. */
    public enum Outcome {
@@ -74,14 +69,6 @@ public final class MessageService {
         * failure context (e.g. the error screen). Terminal, but not a successful completion.
         */
        WORKER_FAILED,
-        /**
-         * The turn finished without a {@code bridge_reply} and the scrape matched the backend's
-         * configured usage-limit refusal pattern (CB-578 stage A); {@code text} is the reason,
-         * carrying the matched line. The worker's pane is healthy — only its account is refusing —
-         * so this is never reported as a completed reply, and is kept distinct from
-         * {@link #WORKER_FAILED} (a wedged worker) and a session simply going {@code GONE}.
-         */
-        BACKEND_EXHAUSTED,
        /**
         * The worker paused mid-turn to ask the primary a question (CB-205); {@code text} is the
         * question and {@code turnId} correlates the answer. Not terminal — the primary answers with
@@ -140,8 +127,6 @@ public final class MessageService {
    public enum Phase {
        /** Delegated and in flight — queued for the worker or being worked. */
        PENDING,
-        /** The worker is paused in {@code bridge_ask}; {@link TaskView#reply} and {@link TaskView#turnId} identify it. */
-        ASKING,
        /** The worker's turn finished; {@link TaskView#reply} holds the answer. */
        DONE,
        /** The delegation could not complete (timed out, worker gone, or busy). */
@@ -151,29 +136,16 @@ public final class MessageService {
    /**
     * A poll snapshot of an async delegation.
     *
-     * @param reply       the answer when {@link #phase} is {@link Phase#DONE}, or the question when
-     *                    {@link #phase} is {@link Phase#ASKING}; otherwise {@code null}
+     * @param reply       the answer when {@link #phase} is {@link Phase#DONE}, else {@code null}
     * @param replySource {@code "reply"} (structured {@code bridge_reply}) or {@code "transcript"}
     *                    (completion scrape) when {@link Phase#DONE}, else {@code null}
-     * @param detail      a human note (live worker status while pending, ask state, or failure reason)
-     * @param turnId      correlation id for an {@link Phase#ASKING} ticket, else {@code null}
+     * @param detail      a human note (live worker status while pending, or the failure reason)
     */
-    public record TaskView(String ticket, Phase phase, String reply, String replySource, String detail,
-                           String turnId) {
+    public record TaskView(String ticket, Phase phase, String reply, String replySource, String detail) {
    }

    /** An in-flight or finished async delegation, keyed by its ticket. */
-    private static final class Task {
-        private final String target;
-        private final CompletableFuture<Reply> future = new CompletableFuture<>();
-        private final long createdNanos;
-        private volatile Reply question;
-        private volatile String turnId;
-
-        private Task(String target, long createdNanos) {
-            this.target = target;
-            this.createdNanos = createdNanos;
-        }
+    private record Task(String target, CompletableFuture<Reply> future, long createdNanos) {
    }

    private final AgentControl agents;
@@ -182,16 +154,8 @@ public final class MessageService {
    private final ReplyInbox inbox;
    private final ReplyPushLoop pushLoop;
    private final Metrics metrics; // CB-502: nullable — no registry in unit tests
-    // CB-588: injectable so pruneTerminalTickets' 10-minute TICKET_TTL_NANOS can be exercised in a
-    // test without a real wait — same seam SessionManager already uses for its idle reaper (nowNanos).
-    private final LongSupplier nowNanos;
    private final ConcurrentHashMap<String, ReentrantLock> sessionLocks = new ConcurrentHashMap<>();
    private final ConcurrentHashMap<String, Task> tasks = new ConcurrentHashMap<>();
-    /** Async task that owns each exact forward rendezvous waiter. */
-    private final ConcurrentHashMap<CompletableFuture<Rendezvous.Resolution>, Task> asyncTasksByWaiter =
-            new ConcurrentHashMap<>();
-    /** Async tickets paused on a specific {@code bridge_ask} turn. */
-    private final ConcurrentHashMap<String, Task> asyncTasksByTurn = new ConcurrentHashMap<>();
    private final AtomicLong ticketSeq = new AtomicLong();
    private final ExecutorService asyncExecutor = Executors.newThreadPerTaskExecutor(
            Thread.ofVirtual().name("bridge-async-", 0).factory());
@@ -200,9 +164,7 @@ public final class MessageService {
     * Create with an explicit {@link ReplyInbox} and optional {@link ReplyPushLoop}.
     *
     * @param pushLoop nullable — when non-null, the push loop is notified on the no-waiter reply
-     *                 branch ({@link #reply}) so it can nudge the primary to drain the inbox, and
-     *                 (CB-588) whenever an async ticket started by {@link #sendAsync} reaches a
-     *                 terminal phase, and whenever {@link #poll} hands a terminal ticket to its caller
+     *                 branch ({@link #reply}) so it can nudge the primary to drain the inbox
     */
    public MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous,
                          ReplyInbox inbox, ReplyPushLoop pushLoop) {
@@ -217,19 +179,12 @@ public final class MessageService {
     */
    public MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous,
                          ReplyInbox inbox, ReplyPushLoop pushLoop, Metrics metrics) {
-        this(agents, injector, rendezvous, inbox, pushLoop, metrics, System::nanoTime);
-    }
-
-    /** Test constructor with an injectable clock (CB-588: exercise the ticket-prune TTL without a real wait). */
-    MessageService(AgentControl agents, Injector injector, Rendezvous rendezvous, ReplyInbox inbox,
-                   ReplyPushLoop pushLoop, Metrics metrics, LongSupplier nowNanos) {
        this.agents = agents;
        this.injector = injector;
        this.rendezvous = rendezvous;
        this.inbox = inbox;
        this.pushLoop = pushLoop;
        this.metrics = metrics;
-        this.nowNanos = nowNanos;
    }

    /** Create with an explicit {@link ReplyInbox} and no push loop. */
@@ -247,16 +202,6 @@ public final class MessageService {
        return agents.status(target);
    }

-    /** Read-only delegation fact for fleet views. */
-    public boolean hasAcceptedDelivery(String target) {
-        return rendezvous.isWaiting(target);
-    }
-
-    /** Read-only inbox fact for fleet views. */
-    public boolean hasInboxMessage(String target) {
-        return !inbox.peek(target).isEmpty();
-    }
-
    /**
     * Route a worker's explicit {@code bridge_reply}: resolve an open send, or queue it in the
     * inbox if no send is currently open. Unlike the bare {@link Rendezvous#resolve}, a no-waiter
@@ -306,7 +251,6 @@ public final class MessageService {
            case COMPLETED_UNREPLIED -> "completion_fallback";
            case TIMED_OUT_WORKING, TIMED_OUT_QUEUED, BUSY -> "timeout";
            case WORKER_FAILED -> "failed";
-            case BACKEND_EXHAUSTED -> "backend_exhausted";
            case STALE_TURN, QUESTION -> null; // not a completed delegation
        };
    }
@@ -328,18 +272,14 @@ public final class MessageService {
     */
    public boolean abandon(String target, String reason) {
        CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.currentWaiter(target);
-        boolean failed = waiter != null && !waiter.isDone() && rendezvous.resolveFailure(waiter, reason);
-        boolean asyncFailed = false;
-        for (Task task : tasks.values()) {
-            if (target.equals(task.target) && task.question == null
-                    && task.future.complete(new Reply(Outcome.WORKER_FAILED, reason))) {
-                asyncFailed = true;
-            }
+        if (waiter == null || waiter.isDone()) {
+            return false; // nobody is blocked on this worker — nothing to abandon
        }
+        boolean failed = rendezvous.resolveFailure(waiter, reason);
        if (failed) {
-            log.warn("abandoning the blocked send to {}: {}", target, reason);
+            log.debug("abandoned send to {}: {}", target, reason);
        }
-        return failed || asyncFailed;
+        return failed;
    }

    /**
@@ -351,30 +291,9 @@ public final class MessageService {
    }

    /**
-     * Drain (peek + ack) all pending inbox replies for {@code target}.
-     *
-     * <p><strong>The ack happens here, before the caller has the messages</strong> — before the MCP
-     * or REST response carrying them has been written, and long before the client has processed
-     * them. That ordering is what the two adapters disagree about, so do not read this method as
-     * "at-least-once" without qualifying which inbox is behind it (CB-529):
-     *
-     * <ul>
-     *   <li>{@code InMemoryReplyInbox} — the ack only drops an entry from a local map. The messages
-     *       are already in the returned list, so nothing can be lost after this point.
-     *   <li>{@code AmqpReplyInbox} — the ack is a broker-side {@code basicAck}. Once it lands the
-     *       broker has forgotten the message. If the daemon dies while writing the response, the
-     *       reply is gone from the broker <em>and</em> the client never received it. Re-polling
-     *       cannot recover it, because there is nothing left to re-deliver.
-     * </ul>
-     *
-     * <p>So the loss window is the response write, and it is a genuine loss rather than a
-     * redelivery. This is accepted, not overlooked: the alternative — ack on the next poll — turns
-     * every normal drain into a double delivery, which costs more than the window it closes. A
-     * caller that needs certainty re-polls; that is idempotent for every case except this one.
-     *
-     * <p>Any change here must be checked against <em>both</em> adapters. The previous version of
-     * this javadoc claimed "the ack is local", which was true when only the in-memory inbox existed
-     * and silently became false when the AMQP adapter landed.
+     * Drain (peek + ack) all pending inbox replies for {@code target}. At-least-once: returns the
+     * messages and acknowledges them; an in-flight failure between returning and the caller
+     * processing them re-surfaces them on a subsequent drain (the ack is local).
     *
     * @return the drained messages, newest last (FIFO); empty list if none
     */
@@ -407,11 +326,6 @@ public final class MessageService {
     * never earned. {@code null} disables the hook.
     */
    public Reply send(String target, String content, long timeoutMillis, Runnable onAccepted) {
-        return send(target, content, timeoutMillis, onAccepted, null);
-    }
-
-    /** Run a send, optionally stopping an async task that teardown already failed before acceptance. */
-    private Reply send(String target, String content, long timeoutMillis, Runnable onAccepted, Task task) {
        long deadlineNanos = System.nanoTime() + timeoutMillis * 1_000_000L;
        ReentrantLock lock = sessionLocks.computeIfAbsent(target, _ -> new ReentrantLock());

@@ -419,12 +333,6 @@ public final class MessageService {
            return new Reply(Outcome.BUSY, null); // another send held the session the whole window
        }
        try {
-            if (task != null && task.future.isDone()) {
-                return task.future.getNow(null);
-            }
-            if (hasAsyncQuestion(target)) {
-                return new Reply(Outcome.BUSY, null); // the worker's current turn is paused for its lead
-            }
            // Open the waiter BEFORE queueing delivery (CB-548). A fast reply — the worker already
            // injectable the instant we enqueue — otherwise arrives before the waiter is registered
            // and orphans into the inbox while this send blocks to the timeout (the enqueue-before-
@@ -433,17 +341,13 @@ public final class MessageService {
            // failed send leaves no stale waiter behind.
            CompletableFuture<Rendezvous.Resolution> reply = rendezvous.open(target);
            try {
-                if (task != null) {
-                    asyncTasksByWaiter.put(reply, task);
-                }
-                TurnToken token = new TurnToken(target, reply);
                // The send has won the lock; the accepted-delivery hook records delegator ownership
                // here (CB-548). It runs BEFORE enqueue so a throwing hook — onAccepted is now a
                // public callback — fails the send without queuing a message that would orphan.
                if (onAccepted != null) {
                    onAccepted.run();
                }
-                CompletableFuture<Void> delivered = injector.enqueue(target, content, token);
+                CompletableFuture<Void> delivered = injector.enqueue(target, content);
                try {
                    Rendezvous.Resolution r = reply.get(remainingMillis(deadlineNanos), TimeUnit.MILLISECONDS);
                    return recorded(new Reply(outcomeOf(r.kind()), r.text(), r.turnId()));
@@ -460,7 +364,6 @@ public final class MessageService {
                    throw new IllegalStateException("interrupted awaiting reply from " + target, e);
                }
            } finally {
-                asyncTasksByWaiter.remove(reply);
                rendezvous.close(target, reply);
            }
        } finally {
@@ -486,12 +389,7 @@ public final class MessageService {
        if (ticket.fresh()) {
            // Register the reverse waiter first, then surface the question — so the answer, which can
            // arrive the instant the primary reacts, always finds an open waiter to resolve.
-            CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.currentWaiter(workerSession);
-            Task task = markAsyncQuestion(waiter, question, ticket.turnId());
            if (!rendezvous.resolveQuestion(workerSession, question, ticket.turnId())) {
-                if (task != null) {
-                    clearAsyncQuestion(ticket.turnId(), true);
-                }
                rendezvous.closeAsk(ticket.turnId());
                return new AskResult(AskOutcome.NO_WAITER, null); // no primary is blocked on this worker
            }
@@ -501,7 +399,6 @@ public final class MessageService {
            return new AskResult(AskOutcome.ANSWERED, answer);
        } catch (TimeoutException e) {
            log.debug("bridge_ask from {} went unanswered in {}ms", workerSession, timeoutMillis);
-            clearAsyncQuestion(ticket.turnId(), true);
            return new AskResult(AskOutcome.TIMED_OUT, null);
        } catch (ExecutionException e) {
            Throwable cause = e.getCause();
@@ -544,12 +441,9 @@ public final class MessageService {
                rendezvous.close(workerSession, reply);
                return new Reply(Outcome.STALE_TURN, null); // lapsed between the lookup and the unblock
            }
-            clearAsyncQuestion(turnId, false);
            try {
                Rendezvous.Resolution r = reply.get(remainingMillis(deadlineNanos), TimeUnit.MILLISECONDS);
-                Reply result = new Reply(outcomeOf(r.kind()), r.text(), r.turnId());
-                finishAsyncTask(turnId, result);
-                return result;
+                return new Reply(outcomeOf(r.kind()), r.text(), r.turnId());
            } catch (TimeoutException e) {
                // The worker resumed but hasn't replied yet — no completion fallback arms an answered
                // turn (it never re-entered the injector), so a silent worker rides out the window.
@@ -589,37 +483,9 @@ public final class MessageService {
     */
    public String sendAsync(String target, String content, Runnable onAccepted) {
        String ticket = "task-" + ticketSeq.incrementAndGet();
-        Task task = new Task(target, nowNanos.getAsLong());
-        tasks.put(ticket, task);
-        if (pushLoop != null) {
-            // CB-588: task.future only ever completes on a terminal phase (DONE or a failure) — a
-            // worker paused in bridge_ask leaves it running, per finishAsyncTask's own contract — so
-            // this fires exactly once, from whichever path completes it: finishAsyncTask(task, result)
-            // below on any non-QUESTION outcome of send() — a worker's bridge_reply, the CB-106
-            // completion fallback, a CB-109 wedge, TIMED_OUT, BUSY, or BACKEND_EXHAUSTED — the same
-            // finishAsyncTask reached via answer()'s finishAsyncTask(turnId, result) once a QUESTION
-            // is resolved, completeExceptionally(t) just below when send() itself throws, or a CB-516
-            // abandon() on teardown. Without this, MessageService.reply's rendezvous fast path (the
-            // one an async ticket always takes) never told the push loop anything happened — see the
-            // class javadoc on sendAsync/CB-107.
-            task.future.whenComplete((reply, ex) -> {
-                boolean failed = ex != null || reply == null || !reply.completed();
-                pushLoop.onTicketTerminal(ticket, target, failed);
-            });
-        }
-        asyncExecutor.submit(() -> {
-            try {
-                Reply result = send(target, content, ASYNC_TIMEOUT_MS, onAccepted, task);
-                if (result.outcome() == Outcome.QUESTION) {
-                    // Keep the accepted owner until answer() finishes it. markAsyncQuestion may run
-                    // just after resolveQuestion wakes this thread.
-                } else {
-                    finishAsyncTask(task, result);
-                }
-            } catch (Throwable t) {
-                task.future.completeExceptionally(t);
-            }
-        });
+        CompletableFuture<Reply> future = CompletableFuture.supplyAsync(
+                () -> send(target, content, ASYNC_TIMEOUT_MS, onAccepted), asyncExecutor);
+        tasks.put(ticket, new Task(target, future, System.nanoTime()));
        pruneTerminalTickets();
        log.debug("async send {} -> {}", ticket, target);
        return ticket;
@@ -635,39 +501,27 @@ public final class MessageService {
        if (task == null) {
            return null;
        }
-        CompletableFuture<Reply> f = task.future;
+        CompletableFuture<Reply> f = task.future();
        if (!f.isDone()) {
-            Reply question = task.question;
-            if (question != null) {
-                return new TaskView(ticket, Phase.ASKING, question.text(), null,
-                        "worker is waiting for your answer", question.turnId());
-            }
-            return new TaskView(ticket, Phase.PENDING, null, null, "worker " + liveStatus(task.target), null);
-        }
-        // CB-588: the ticket is terminal and being handed to the caller right here — tell the push
-        // loop it is collected so a later tick's nudge never names a ticket the lead already has.
-        if (pushLoop != null) {
-            pushLoop.ticketCollected(ticket);
+            return new TaskView(ticket, Phase.PENDING, null, null, "worker " + liveStatus(task.target()));
        }
        Reply r;
        try {
            r = f.getNow(null);
        } catch (CompletionException | java.util.concurrent.CancellationException e) {
            Throwable cause = (e instanceof CompletionException ce && ce.getCause() != null) ? ce.getCause() : e;
-            return new TaskView(ticket, Phase.FAILED, null, null, cause.getMessage(), null);
+            return new TaskView(ticket, Phase.FAILED, null, null, cause.getMessage());
        }
        if (r.completed()) {
            String source = r.outcome() == Outcome.REPLIED ? "reply" : "transcript";
-            return new TaskView(ticket, Phase.DONE, r.text(), source, null, null);
+            return new TaskView(ticket, Phase.DONE, r.text(), source, null);
        }
-        // A wedged worker (CB-109) or a backend-exhausted classification (CB-578 stage A) carries
-        // the real cause as its reason; the timeout/busy outcomes carry none, so fall back to the
-        // outcome name.
-        boolean carriesReason = r.outcome() == Outcome.WORKER_FAILED || r.outcome() == Outcome.BACKEND_EXHAUSTED;
-        String detail = carriesReason && r.text() != null
+        // A wedged worker (CB-109) carries the error context as its reason; the timeout/busy
+        // outcomes carry none, so fall back to the outcome name.
+        String detail = r.outcome() == Outcome.WORKER_FAILED && r.text() != null
                ? r.text()
                : "no reply — " + r.outcome().name().toLowerCase();
-        return new TaskView(ticket, Phase.FAILED, null, null, detail, null);
+        return new TaskView(ticket, Phase.FAILED, null, null, detail);
    }

    /** Best-effort live worker status for a pending poll; never throws (a lookup error is just noise). */
@@ -679,71 +533,10 @@ public final class MessageService {
        }
    }

-    /**
-     * Drop finished tickets older than the TTL so {@link #tasks} cannot grow without bound.
-     *
-     * <p>{@code tasks} is the sole authority on whether a ticket still exists — {@link #poll} returns
-     * {@code null} the instant a ticket is gone from here, before it ever reaches the terminal branch
-     * that calls {@link ReplyPushLoop#ticketCollected}. Without telling the push loop about a prune
-     * too, its own {@code pendingTickets} entry would outlive the ticket it names: an unpolled ticket
-     * (or one the reminder cap already gave up on) is pruned here but never collected there, so it
-     * lingers in {@code pendingTickets} forever and rides along on every later nudge to the same lead
-     * — naming a ticket {@code bridge_poll} can no longer find (CB-588 follow-up).
-     */
+    /** Drop finished tickets older than the TTL so the registry cannot grow without bound. */
    private void pruneTerminalTickets() {
-        long cutoff = nowNanos.getAsLong() - TICKET_TTL_NANOS;
-        tasks.entrySet().removeIf(e -> {
-            Task t = e.getValue();
-            boolean expired = t.future.isDone() && t.createdNanos < cutoff;
-            if (expired && pushLoop != null) {
-                pushLoop.ticketCollected(e.getKey());
-            }
-            return expired;
-        });
-    }
-
-    /** Record the active question for an async ticket; blocking sends have no entry and stay unchanged. */
-    private Task markAsyncQuestion(CompletableFuture<Rendezvous.Resolution> waiter, String text, String turnId) {
-        Task task = waiter == null ? null : asyncTasksByWaiter.get(waiter);
-        if (task != null) {
-            task.question = new Reply(Outcome.QUESTION, text, turnId);
-            task.turnId = turnId;
-            asyncTasksByTurn.put(turnId, task);
-        }
-        return task;
-    }
-
-    /** Clear an answered or lapsed question, but only when it matches the ticket's current turn. */
-    private void clearAsyncQuestion(String turnId, boolean forgetTurn) {
-        Task task = asyncTasksByTurn.get(turnId);
-        if (task != null && turnId.equals(task.turnId)) {
-            task.question = null;
-            if (forgetTurn) {
-                asyncTasksByTurn.remove(turnId, task);
-                task.turnId = null;
-            }
-        }
-    }
-
-    /** Complete and detach an async ticket after its worker's actual terminal reply. */
-    private void finishAsyncTask(Task task, Reply result) {
-        task.future.complete(result);
-        if (task.turnId != null) {
-            asyncTasksByTurn.remove(task.turnId, task);
-        }
-    }
-
-    /** Complete the async ticket correlated to a specific answered turn. */
-    private void finishAsyncTask(String turnId, Reply result) {
-        Task task = asyncTasksByTurn.get(turnId);
-        if (task != null) {
-            finishAsyncTask(task, result);
-        }
-    }
-
-    /** A new send must not open a waiter while an async ticket owns this worker's paused turn. */
-    private boolean hasAsyncQuestion(String target) {
-        return asyncTasksByTurn.values().stream().anyMatch(task -> target.equals(task.target));
+        long cutoff = System.nanoTime() - TICKET_TTL_NANOS;
+        tasks.values().removeIf(t -> t.future().isDone() && t.createdNanos() < cutoff);
    }

    /** Release the async executor. */
@@ -757,7 +550,6 @@ public final class MessageService {
            case REPLY -> Outcome.REPLIED;
            case COMPLETION -> Outcome.COMPLETED_UNREPLIED;
            case FAILED -> Outcome.WORKER_FAILED;
-            case BACKEND_EXHAUSTED -> Outcome.BACKEND_EXHAUSTED;
            case QUESTION -> Outcome.QUESTION;
        };
    }
@@ -33,13 +33,6 @@ public final class Rendezvous {
        COMPLETION,
        /** The worker ran the turn then wedged (CB-109); {@code text} is the failure context. */
        FAILED,
-        /**
-         * The turn finished without a {@code bridge_reply}, and the scrape matched the backend's
-         * configured usage-limit refusal pattern (CB-578 stage A); {@code text} is the reason,
-         * carrying the matched line. The pane is healthy — only the account is refusing — so this
-         * is kept separate from a session simply going {@code GONE}.
-         */
-        BACKEND_EXHAUSTED,
        /**
         * The worker paused mid-turn to ask the primary a question (CB-205 reverse rendezvous);
         * {@code text} is the question and {@code turnId} correlates the primary's answer back to
@@ -231,19 +224,6 @@ public final class Rendezvous {
        return waiter != null && waiter.complete(new Resolution(Kind.FAILED, reason));
    }

-    /**
-     * Resolve a specific captured {@code waiter} as {@link Kind#BACKEND_EXHAUSTED} (CB-578 stage A):
-     * the turn finished with no {@code bridge_reply} and the scrape matched the backend's configured
-     * usage-limit pattern; {@code reason} carries the matched line. Like
-     * {@link #resolveCompletion(CompletableFuture, String)} it targets the exact captured send
-     * (CB-116). A no-op if that waiter was already resolved — first resolution wins.
-     *
-     * @return {@code true} if this call resolved the waiter, {@code false} if it was null or already resolved
-     */
-    public boolean resolveExhausted(CompletableFuture<Resolution> waiter, String reason) {
-        return waiter != null && waiter.complete(new Resolution(Kind.BACKEND_EXHAUSTED, reason));
-    }
-
    private boolean complete(String session, Resolution resolution) {
        CompletableFuture<Resolution> waiter = waiters.get(session);
        return waiter != null && waiter.complete(resolution);
@@ -8,12 +8,9 @@ import dev.ltms.bridged.metrics.Metrics;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;

-import java.util.List;
-import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
-import java.util.stream.Collectors;

 /**
 * Mechanism (b) of CB-307: a dedicated, status-gated push loop that nudges the primary's own
@@ -26,27 +23,11 @@ import java.util.stream.Collectors;
 *
 * <p>Bounded: at most {@link #maxReminders} nudges per target, with a configurable backoff
 * between them. The reply is never lost — the durable inbox is the backstop.
- *
- * <p><strong>CB-588 ticket nudges.</strong> {@link #onTicketTerminal(String, String, boolean)} is a
- * second, independent entry point for an async delegation ticket ({@code bridge_send(wait:false)})
- * reaching a terminal phase. That path takes the rendezvous fast path in {@link MessageService#reply}
- * and never reaches {@link #onReplyQueued}, so without this the lead's own charter — prefer
- * {@code wait:false} for anything non-trivial — was exactly the mode this loop failed to cover. It
- * reuses the same status gating, bounded/backoff reminders, and metrics, keyed by the nudge-receiving
- * lead terminal rather than the worker target so several tickets finishing together coalesce into one
- * nudge. The two entry points do not interact: {@link #onReplyQueued} / {@link #decide} / their nudge
- * text and bound are unchanged.
 */
 public final class ReplyPushLoop {

    private static final Logger log = LoggerFactory.getLogger(ReplyPushLoop.class);
    static final String NUDGE_FORMAT = "Worker %s returned a reply — run bridge_poll(target=%s) to collect it";
-    /** CB-588: singular form, one uncollected ticket. */
-    static final String TICKET_NUDGE_FORMAT =
-            "Ticket %s finished%s — run bridge_poll(ticket=%s) to collect it";
-    /** CB-588: coalesced form, several uncollected tickets for the same lead. */
-    static final String TICKETS_NUDGE_FORMAT =
-            "%d tickets finished%s — run bridge_poll(ticket=...) for each to collect them: %s";

    private final PrimaryRegistry primaryRegistry;
    private final AgentControl agents;
@@ -58,10 +39,6 @@ public final class ReplyPushLoop {

    /** Track targets that have an active schedule. */
    private final ConcurrentHashMap<String, Boolean> activeTargets = new ConcurrentHashMap<>();
-    /** CB-588: tickets that have gone terminal but not yet been polled, keyed by ticket. */
-    private final ConcurrentHashMap<String, PendingTicket> pendingTickets = new ConcurrentHashMap<>();
-    /** CB-588: leads with an active ticket-reminder schedule. */
-    private final ConcurrentHashMap<String, Boolean> activeLeads = new ConcurrentHashMap<>();

    public ReplyPushLoop(PrimaryRegistry primaryRegistry, AgentControl agents, ReplyInbox inbox,
                         ScheduledExecutorService scheduler,
@@ -196,211 +173,12 @@ public final class ReplyPushLoop {
        scheduler.schedule(() -> tick(target, nextReminderCount), backoffMs, TimeUnit.MILLISECONDS);
    }

-    // --- CB-588: async ticket terminal nudges ---------------------------------------------------
-
-    /** A ticket awaiting collection: which lead to nudge, and whether it ended in failure. */
-    private record PendingTicket(String ticket, String lead, boolean failed) {
-    }
-
-    /**
-     * Called when an async delegation ticket ({@code bridge_send(wait:false)}, CB-107) reaches a
-     * terminal phase — DONE or a failure. Unlike {@link #onReplyQueued}, which nudges about the
-     * durable-inbox no-waiter path, this covers the path {@code MessageService.reply} takes when a
-     * fire-and-poll send's own rendezvous waiter resolves the reply directly: that path returns
-     * before {@link #onReplyQueued} is ever called, so without this entry point a ticket finishing
-     * that way never nudged anyone (CB-588 / gitea #72).
-     *
-     * <p>Idempotent per lead: several tickets going terminal for the same lead while its schedule is
-     * already active coalesce onto that schedule's next tick rather than firing a nudge each.
-     *
-     * @param ticket the ticket to nudge about
-     * @param target the worker session the ticket was sent to — resolves which lead delegated it
-     * @param failed whether the ticket ended in a failure phase rather than {@code DONE}
-     */
-    public void onTicketTerminal(String ticket, String target, boolean failed) {
-        var lead = primaryRegistry.nudgeTargetFor(target);
-        if (lead.isEmpty()) {
-            log.debug("push: no lead is known to be waiting on ticket {} (target {}), skipping nudge",
-                    ticket, target);
-            return;
-        }
-        pendingTickets.put(ticket, new PendingTicket(ticket, lead.get(), failed));
-        if (activeLeads.putIfAbsent(lead.get(), Boolean.TRUE) != null) {
-            log.debug("push: ticket reminder loop already active for lead {}, {} coalesced in",
-                    lead.get(), ticket);
-            return;
-        }
-        log.debug("push: starting ticket reminder loop for lead {}", lead.get());
-        scheduleTicketTick(lead.get(), 0);
-    }
-
-    /**
-     * Called when a ticket's terminal state has been collected via {@code bridge_poll}. Removes it
-     * from the pending set so a scheduled tick — and any nudge it sends — never names a ticket the
-     * lead already has (CB-588 acceptance #5). A ticket that was never pending (unknown ticket, or
-     * one nudged with no push loop configured) is a no-op.
-     */
-    public void ticketCollected(String ticket) {
-        pendingTickets.remove(ticket);
-    }
-
-    /** Tickets still pending for {@code lead}, snapshotted fresh for one tick. */
-    private List<PendingTicket> pendingFor(String lead) {
-        return pendingTickets.values().stream().filter(t -> lead.equals(t.lead())).toList();
-    }
-
-    /**
-     * Pure decision function for ticket nudges, mirroring {@link #decide(String, int)} but keyed by
-     * the nudge-receiving lead terminal rather than the worker session — several tickets from
-     * different workers delegated by the same lead coalesce onto it.
-     */
-    Action decideTickets(String lead, int reminderCount) {
-        if (pendingFor(lead).isEmpty()) {
-            log.debug("push: nothing pending for lead {}, stopping ticket reminder", lead);
-            return Action.STOP;
-        }
-        if (reminderCount >= maxReminders) {
-            log.debug("push: ticket reminder cap ({}) reached for lead {}, stopping", maxReminders, lead);
-            countNudge("exhausted");
-            return Action.STOP;
-        }
-        AgentStatus status;
-        try {
-            status = agents.status(lead);
-        } catch (RuntimeException e) {
-            log.debug("push: status check failed for lead {}, will retry", lead, e);
-            return Action.WAIT_BUSY;
-        }
-        if (status.injectable()) {
-            return Action.INJECT;
-        }
-        log.debug("push: lead {} is {} (not injectable), waiting", lead, status);
-        return Action.WAIT_BUSY;
-    }
-
-    /** Execute one ticket-loop tick — called on the scheduler thread. */
-    private void ticketTick(String lead, int reminderCount) {
-        Set<String> pendingBefore = pendingIdsFor(lead);
-        var action = decideTickets(lead, reminderCount);
-        switch (action) {
-            case INJECT -> {
-                injectTicketNudge(lead, reminderCount);
-                scheduleTicketTick(lead, reminderCount + 1);
-            }
-            case WAIT_BUSY -> scheduleTicketTick(lead, reminderCount);
-            case STOP -> stopOrRestartTicketLoop(lead, pendingBefore);
-        }
-    }
-
-    /** Ticket IDs pending for {@code lead} right now, as a plain snapshot for race comparison. */
-    private Set<String> pendingIdsFor(String lead) {
-        return pendingFor(lead).stream().map(PendingTicket::ticket).collect(Collectors.toUnmodifiableSet());
-    }
-
-    /**
-     * Release {@code lead}'s active-schedule slot, then restart it only if a ticket landed that
-     * {@code pendingBefore} — the snapshot taken just before this tick's decision — did not already
-     * account for. {@code onTicketTerminal} reads {@code activeLeads} to decide whether to coalesce
-     * onto an existing schedule or start one, so a ticket that lands between {@code decideTickets}
-     * returning {@link Action#STOP} and this removal running sees the (soon-to-be-stale) slot as
-     * occupied, coalesces onto a schedule that is about to die, and gets no nudge scheduled at all —
-     * a lost nudge, the exact failure CB-588 exists to remove (found in review, gitea PR #73).
-     *
-     * <p>Restarting on ANY non-empty {@code pendingFor(lead)} would be wrong: when STOP is reached
-     * because the reminder cap was hit rather than the backlog draining, the same never-collected
-     * ticket is expected to still be sitting there — that is the cap doing its job — and restarting
-     * would nudge about it forever, defeating the bound (the original CB-307 bounded-reminder
-     * guarantee, carried into CB-588 by acceptance criterion #7 — this exact regression showed up as
-     * two existing tests failing once a naive "any pending ticket restarts" version of this fix went
-     * in: {@code successfulTicketNudgeIncrementsDelivered} and {@code ticketNudgesSendUpToCapThenStop}).
-     * Diffing the current pending set against {@code pendingBefore} tells the two cases apart: a
-     * ticket present before this tick's decision is stale backlog, not a race; only a ticket absent
-     * from {@code pendingBefore} can only have arrived during the decision-to-release window, which is
-     * exactly the race this method closes.
-     *
-     * <p>Package-private so a test can drive the interleaving directly rather than trying to force a
-     * genuine thread race: pass the exact {@code pendingBefore} snapshot a race requires (or does
-     * not) and call this to prove the recheck responds correctly either way.
-     *
-     * <p>Terminates rather than spinning: this method restarts the schedule at most once per call, and
-     * a fresh {@link #onTicketTerminal} racing the recheck below still terminates in one of two ways —
-     * either it observes the slot already vacated (by the {@code activeLeads.remove} above, which
-     * happens-before this recheck in program order) and claims it itself, or it lands first and this
-     * recheck then observes its ticket in {@code pendingTickets} and reclaims the slot instead. Exactly
-     * one side always wins; neither can miss the other, so this never loops on its own account.
-     */
-    void stopOrRestartTicketLoop(String lead, Set<String> pendingBefore) {
-        activeLeads.remove(lead);
-        boolean ticketRacedIn = pendingFor(lead).stream().anyMatch(t -> !pendingBefore.contains(t.ticket()));
-        if (ticketRacedIn && activeLeads.putIfAbsent(lead, Boolean.TRUE) == null) {
-            log.debug("push: a ticket for lead {} raced the reminder loop's stop — restarting", lead);
-            scheduleTicketTick(lead, 0);
-            return;
-        }
-        log.debug("push: ticket reminder loop ended for lead {}", lead);
-    }
-
-    /** Send the coalesced ticket nudge and log the event. */
-    private void injectTicketNudge(String lead, int reminderCount) {
-        // Re-read rather than threading it down from decideTickets(): a ticket can be collected (or
-        // another can arrive) between the decision and the injection.
-        List<PendingTicket> pending = pendingFor(lead);
-        if (pending.isEmpty()) {
-            log.debug("push: pending tickets for lead {} drained before the nudge could be sent", lead);
-            return;
-        }
-        String nudge = formatTicketsNudge(pending);
-        try {
-            agents.send(lead, nudge);
-            log.debug("push: ticket nudge {}/{} sent to lead {} for {} ticket(s)",
-                    reminderCount + 1, maxReminders, lead, pending.size());
-            countNudge("delivered");
-        } catch (RuntimeException e) {
-            log.warn("push: failed to nudge lead {} for {} ticket(s) (reminder {}/{}): {}",
-                    lead, pending.size(), reminderCount + 1, maxReminders, e.toString());
-        }
-    }
-
-    /** Schedule the next ticket-loop tick on the scheduler thread pool. */
-    private void scheduleTicketTick(String lead, int nextReminderCount) {
-        scheduler.schedule(() -> ticketTick(lead, nextReminderCount), backoffMs, TimeUnit.MILLISECONDS);
-    }
-
-    /** Render one or several pending tickets as a single nudge line. */
-    private static String formatTicketsNudge(List<PendingTicket> pending) {
-        if (pending.size() == 1) {
-            PendingTicket t = pending.get(0);
-            return TICKET_NUDGE_FORMAT.formatted(t.ticket(), t.failed() ? " (FAILED)" : "", t.ticket());
-        }
-        long failedCount = pending.stream().filter(PendingTicket::failed).count();
-        String ids = pending.stream()
-                .map(t -> t.failed() ? t.ticket() + " (FAILED)" : t.ticket())
-                .collect(Collectors.joining(", "));
-        String failedNote = failedCount > 0 ? " (%d failed)".formatted(failedCount) : "";
-        return TICKETS_NUDGE_FORMAT.formatted(pending.size(), failedNote, ids);
-    }
-
    // --- lifecycle -----------------------------------------------------------------------------

-    /**
-     * Whether any reminder loop is currently active for some target (CB-551). The idle-lead heartbeat
-     * uses this to stand aside: while the push loop is actively nudging the lead, a concurrent
-     * heartbeat injection would start a second competing turn in the same pane — racing loops multiply
-     * turns and context burn. "Active" means a schedule exists in {@link #activeTargets} or
-     * {@link #activeLeads} (CB-588 ticket nudges are a second source of pane injections the heartbeat
-     * must equally stand aside for); the sets are bounded by what has been triggered, not by any
-     * persistent state.
-     */
-    public boolean isActive() {
-        return !activeTargets.isEmpty() || !activeLeads.isEmpty();
-    }
-
    /** Shut down the scheduler. Outstanding reminders are cancelled. */
    public void stop() {
        scheduler.shutdownNow();
        activeTargets.clear();
-        activeLeads.clear();
-        pendingTickets.clear();
    }

    /** @see #stop() */
@@ -1,20 +0,0 @@
-package dev.ltms.bridged.msg;
-
-import java.util.concurrent.CompletableFuture;
-
-/**
- * Identity for one accepted send. The session turn is deliberately absent: CompletionResolver's
- * delivery callback runs before SessionManager.onDelivered, so binding it needs a later ordering design.
- */
-public final class TurnToken {
-    private final String target;
-    private final CompletableFuture<Rendezvous.Resolution> waiter;
-
-    public TurnToken(String target, CompletableFuture<Rendezvous.Resolution> waiter) {
-        this.target = target;
-        this.waiter = waiter;
-    }
-
-    public String target() { return target; }
-    public CompletableFuture<Rendezvous.Resolution> waiter() { return waiter; }
-}
@@ -1,84 +0,0 @@
-package dev.ltms.bridged.peer;
-
-import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
-import java.security.NoSuchAlgorithmException;
-import java.util.HexFormat;
-
-/**
- * CB-571: a fingerprint of the exact charter bytes handed to a spawned member.
- *
- * <p>Lets an operator prove <em>which</em> charter a member actually got, without ever logging the
- * charter text. The digest covers the exact composed UTF-8 string {@code HerdrPeerLauncher} passes
- * to its adapter as {@code LaunchSpec.charter()}, so every adapter that receives the same string —
- * Claude inlining it, OpenCode writing it to a file — produces the same digest for the same config.
- * Two spawns of the same role from the same config agree; editing the charter changes the digest.
- *
- * <p>Deliberately places no charter prose. A charter is operator-authored text that may name
- * internal projects or unreleased plans, and logs get tailed, shipped, and pasted into tickets.
- * The {@code charterSource} key is what the operator wants to confirm, and it carries no content.
- */
-public record CharterReceipt(
-        MemberRole role,
-        String profile,
-        String charterSource,
-        String charterSha256,
-        int charterBytes) {
-
-    /** Source reported when the role has no configured charter, so the field is never omitted. */
-    public static final String NO_SOURCE = "none";
-
-    /**
-     * The config key that supplied the role's charter text, e.g. {@code fleet.charters.architect}.
-     */
-    public static String sourceKey(MemberRole role) {
-        return "fleet.charters." + (role == null ? "?" : role.wireName());
-    }
-
-    /**
-     * Fingerprint the composed charter for {@code role} on {@code profile}. {@code configured} is
-     * the role's charter text as read from config ({@code null} when none is configured);
-     * {@code composed} is the exact string the launcher will pass to the adapter — the reply
-     * charter may be appended to {@code configured}, or stand alone when no role charter exists.
-     *
-     * <p>No composed charter at all is reported as an explicit absence — a {@code null} digest and
-     * a zero byte count — never a digest of the empty string, which would hide the fact that no
-     * text was supplied. {@code configured} being {@code null} while {@code composed} is the reply
-     * charter alone is a normal case, and the source says so.
-     */
-    public static CharterReceipt compose(MemberRole role, String profile,
-                                         String configured, String composed) {
-        String source = (configured == null || configured.isBlank())
-                ? NO_SOURCE : sourceKey(role);
-        if (composed == null) {
-            return new CharterReceipt(role, profile, source, null, 0);
-        }
-        byte[] bytes = composed.getBytes(StandardCharsets.UTF_8);
-        return new CharterReceipt(role, profile, source, digestOf(composed), bytes.length);
-    }
-
-    /** Whether the composed charter was absent (no text was given to the member). */
-    public boolean absent() {
-        return charterSha256 == null;
-    }
-
-    /**
-     * The stable SHA-256 hex digest of {@code text}, or {@code null} for null/blank text. Used both
-     * for the receipt's fingerprint and to redact a charter argument in a spawn log.
-     */
-    public static String digestOf(String text) {
-        if (text == null || text.isBlank()) {
-            return null;
-        }
-        return sha256Hex(text.getBytes(StandardCharsets.UTF_8));
-    }
-
-    private static String sha256Hex(byte[] bytes) {
-        try {
-            MessageDigest md = MessageDigest.getInstance("SHA-256");
-            return HexFormat.of().formatHex(md.digest(bytes));
-        } catch (NoSuchAlgorithmException e) {
-            throw new IllegalStateException("SHA-256 is unavailable", e);
-        }
-    }
-}
@@ -1,122 +0,0 @@
-package dev.ltms.bridged.peer;
-
-import java.util.Locale;
-
-/**
- * What a member is <em>for</em> — the contract it runs under.
- *
- * <p>A member is anything a lead spawns. Every member carries two independent attributes:
- *
- * <ul>
- *   <li><b>role</b> (this enum) — <em>which contract</em>: the launch charter it is given, the role
- *       file it reads, the playbook skill it loads, and its authorization row.</li>
- *   <li><b>profile</b> (a {@code profiles:} key) — <em>which backend</em>: model, CLI adapter,
- *       credentials, cost.</li>
- * </ul>
- *
- * <p>These are separate axes on purpose. A {@code REVIEWER} may run on the same profile as the
- * {@code DEV} whose diff it reviews — same backend, different contract. That case is what proves
- * role and profile cannot be collapsed into one field.
- *
- * <p>A lead is deliberately <em>not</em> a role here. A lead is not spawned: it is a pre-existing,
- * human-facing session that config recognises. Only spawned peers have a member role.
- */
-public enum MemberRole {
-
-    /**
-     * Refines a ticket before anyone implements it: scope, acceptance criteria, risks, unit split.
-     *
-     * <p>Reads the repo and writes analysis. Never commits code and never opens a pull request —
-     * an architect that starts implementing has stopped doing the job that makes it useful.
-     *
-     * <p>Architects are the one member kind declared in config, because a lead addresses the same
-     * slots across many tickets and needs a stable name for them.
-     */
-    ARCHITECT,
-
-    /**
-     * Implements one unit of work: provisions a worktree, writes the code, commits, pushes, and
-     * opens its own pull request.
-     *
-     * <p>Never merges. The lead is the gate, and a member that merged its own work would remove the
-     * only independent check in the flow.
-     */
-    DEV,
-
-    /**
-     * Reviews a diff it did not write and reports one structured finding.
-     *
-     * <p>Never commits, never merges, and is never the member that wrote the scope under review.
-     * Briefed from the diff rather than from the implementer's rationale, because that rationale
-     * carries the same blind spot that produced the bug.
-     */
-    REVIEWER;
-
-    /** The lowercase spelling used in config and on the wire ({@code architect}, {@code dev}, …). */
-    public String wireName() {
-        return name().toLowerCase(Locale.ROOT);
-    }
-
-    /**
-     * The {@code fleet:} block that holds this role's pool — {@code architects},
-     * {@code developers}, {@code reviewers}.
-     *
-     * <p>Plural, and not always the wire name: the pool of things a {@code dev} may run on reads
-     * naturally as {@code developers:}. The wire name stays the singular {@code dev}, because that
-     * is what a tab label and a roster row say.
-     */
-    public String configKey() {
-        return switch (this) {
-            case ARCHITECT -> "architects";
-            case DEV -> "developers";
-            case REVIEWER -> "reviewers";
-        };
-    }
-
-    /**
-     * The role owning the {@code fleet:} pool named {@code key}, or {@code null} when the key is not
-     * a role pool ({@code leaders}, {@code tabLabel}, …). Null rather than a throw: callers use this
-     * to sort a fleet block's children, where a non-pool key is normal rather than an error.
-     */
-    public static MemberRole fromConfigKey(String key) {
-        if (key == null) {
-            return null;
-        }
-        String k = key.trim().toLowerCase(Locale.ROOT);
-        for (MemberRole r : values()) {
-            if (r.configKey().equals(k)) {
-                return r;
-            }
-        }
-        return null;
-    }
-
-    /**
-     * Parse a config/wire spelling, case-insensitively.
-     *
-     * @param s the spelling to parse
-     * @return the matching role
-     * @throws IllegalArgumentException when {@code s} is null, blank, or not a known role — the
-     *                                  message lists the valid spellings, because a typo'd role in
-     *                                  config should fail at startup with the fix in the error
-     */
-    public static MemberRole parse(String s) {
-        if (s != null && !s.isBlank()) {
-            String t = s.trim().toLowerCase(Locale.ROOT);
-            for (MemberRole r : values()) {
-                if (r.wireName().equals(t)) {
-                    return r;
-                }
-            }
-        }
-        StringBuilder valid = new StringBuilder();
-        for (MemberRole r : values()) {
-            if (!valid.isEmpty()) {
-                valid.append(", ");
-            }
-            valid.append(r.wireName());
-        }
-        throw new IllegalArgumentException(
-                "unknown member role '" + s + "'; valid roles are: " + valid);
-    }
-}
@@ -62,27 +62,9 @@ public interface PeerHandle {
     * non-null for a spawn that requested session identity, because it knows the id before the
     * peer has written anything.
     *
-     * <p>Deliberately not a {@code default} (CB-584, the same fix CB-571 made for
-     * {@link #charterReceipt()} one method below): a decorator that forgets to override this
-     * silently answers {@code null} for a question it has no basis to answer, and the gap surfaces
-     * only as a resume that quietly starts a cold session, not a compile error. Every
-     * implementation must answer explicitly.
-     *
     * @return the peer's own session id, or {@code null} when not determinable
     */
-    String agentSessionId();
-
-    /**
-     * The charter receipt (CB-571) for this peer's launch — the fingerprint of the exact charter
-     * bytes it was started with. {@code null} when the launcher records none (a non-instrumented
-     * adapter, or a launcher before this field); the session registry stores it so the spawn result
-     * and the roster row can show an operator which charter a member actually got.
-     *
-     * <p>Deliberately not a {@code default}: a decorator that forgets to override this silently
-     * answers {@code null} for a question it has no basis to answer, and the gap surfaces only as
-     * a missing roster field, not a compile error. Every implementation must answer explicitly.
-     *
-     * @return the fingerprint, or {@code null} when the launcher carries none
-     */
-    CharterReceipt charterReceipt();
+    default String agentSessionId() {
+        return null;
+    }
 }
@@ -25,19 +25,6 @@ public interface PeerLauncher {
     */
    Set<Capability> capabilities();

-    /**
-     * The capabilities of the adapter that {@code profileName} resolves to (null/blank → the
-     * default profile, the same resolution {@link #spawn} uses). Distinct from {@link
-     * #capabilities()}, which unions every configured adapter: a caller that must know whether
-     * <em>this</em> profile's backend supports a capability — e.g. {@link Capability#SESSION_RESUME}
-     * before honoring {@link SpawnRequest#resumeSessionId()} — needs the per-profile answer, not
-     * the fleet-wide union, or a mixed fleet could OK a resume that lands on a non-supporting
-     * adapter (CB-584).
-     *
-     * @throws IllegalArgumentException if the profile is unknown and no default is configured
-     */
-    Set<Capability> capabilitiesFor(String profileName);
-
    /**
     * {@code profileName}/requestedCwd null/blank → default resolution. Returns after the peer
     * process is live (env + argv + placement complete). Never returns {@code null}.
@@ -1,32 +1,24 @@
 package dev.ltms.bridged.peer;

 /**
- * What a caller asks for when spawning a peer.
+ * Parameters for a {@link PeerLauncher#spawn(SpawnRequest)} call — the peer-neutral
+ * aggregation of what the core knows at delegation time: which profile to use, the caller's
+ * requested working directory, and the caller's own cwd (to inherit when no other cwd is set).
 *
- * @param profileName     the {@code profiles:} entry to spawn on; {@code null}/blank ⇒ the caller
- *                        did not choose, and the role's pool supplies the candidates
- * @param requestedCwd    working directory asked for by the caller ({@code null} ⇒ unset)
- * @param callerCwd       the caller's own working directory, used when nothing else pins one
- * @param sessionName     agent session name (CB-547a); {@code null} ⇒ the launcher mints one
- * @param resumeSessionId prior agent session to resume; {@code null} ⇒ a fresh session
- * @param role            the contract this member runs under (CB-557). Picks the tab label and,
- *                        with the profile, the counter its tab number comes from. {@code null} is
- *                        read as {@link MemberRole#DEV} — an unqualified spawn is a unit of work
+ * <p>A null or blank {@code profileName} means "use the launcher's default profile."
+ * A null or blank {@code requestedCwd} means "inherit from config or caller."
+ * A null {@code callerCwd} means "the request came from the daemon itself (not a primary)."
+ *
+ * <p>{@code sessionName} and {@code resumeSessionId} carry the session's durable identity (CB-547a):
+ * the bridge's LOGICAL name for the session (stable across restarts, meaningful to an operator)
+ * and the peer's OWN prior session id to resume, respectively. Both are <em>opted in</em> — either
+ * may be null/blank, in which case the launcher derives a display name and mints a fresh session.
 */
 public record SpawnRequest(String profileName, String requestedCwd, String callerCwd,
-                           String sessionName, String resumeSessionId, MemberRole role) {
-
-    public SpawnRequest {
-        role = (role == null) ? MemberRole.DEV : role;
-    }
+                           String sessionName, String resumeSessionId) {

+    /** Back-compat: a spawn with no session identity (fresh session, launcher-derived name). */
    public SpawnRequest(String profileName, String requestedCwd, String callerCwd) {
-        this(profileName, requestedCwd, callerCwd, null, null, null);
-    }
-
-    /** Pre-CB-557 shape: session identity without an explicit role (defaults to {@code dev}). */
-    public SpawnRequest(String profileName, String requestedCwd, String callerCwd,
-                        String sessionName, String resumeSessionId) {
-        this(profileName, requestedCwd, callerCwd, sessionName, resumeSessionId, null);
+        this(profileName, requestedCwd, callerCwd, null, null);
    }
 }
@@ -1,115 +0,0 @@
-package dev.ltms.bridged.placement;
-
-import java.util.LinkedHashMap;
-import java.util.Map;
-import java.util.Objects;
-import java.util.OptionalLong;
-import java.util.concurrent.ConcurrentHashMap;
-import java.util.function.LongSupplier;
-
-/**
- * Where a credential (not a profile — see {@code BridgedConfig.Profile#effectiveCredentialId()})
- * sits out a cooldown after a {@code BACKEND_EXHAUSTED} classification (CB-578 stage B), so a fresh
- * spawn does not walk straight back onto the account that just refused on a usage limit.
- *
- * <p>Keyed by credential id, never by profile name: two profiles sharing one credential (e.g. two
- * models on the same OpenAI account) share one quarantine — {@link #quarantine} one credential id
- * and every profile whose {@code effectiveCredentialId()} equals it is quarantined too, without this
- * class knowing anything about profiles at all. That mapping is the caller's job (see
- * {@code CompositePeerLauncher} and {@code dev.ltms.bridged.inject.ExhaustionSink}).
- *
- * <p>The clock is injected ({@link LongSupplier}, conventionally {@code System::nanoTime} like
- * {@code FleetHealthMonitor}), never read inline, so a quarantine's expiry is testable without a
- * real sleep.
- */
-public final class BackendQuarantine {
-
-    private final ConcurrentHashMap<String, Long> quarantinedUntilNanos = new ConcurrentHashMap<>();
-    private final LongSupplier nowNanos;
-    private final long cooldownNanos;
-    /** True only for {@link #none()}. See {@link #quarantine} for why this exists. */
-    private final boolean inert;
-
-    /**
-     * @param nowNanos      monotonic clock, injected for testability
-     * @param cooldownNanos how long a fresh {@link #quarantine} call blocks the credential for;
-     *                      must be positive
-     */
-    public BackendQuarantine(LongSupplier nowNanos, long cooldownNanos) {
-        this(nowNanos, cooldownNanos, false);
-    }
-
-    private BackendQuarantine(LongSupplier nowNanos, long cooldownNanos, boolean inert) {
-        this.nowNanos = Objects.requireNonNull(nowNanos, "nowNanos");
-        if (cooldownNanos <= 0) {
-            throw new IllegalArgumentException("cooldownNanos must be positive: " + cooldownNanos);
-        }
-        this.cooldownNanos = cooldownNanos;
-        this.inert = inert;
-    }
-
-    /**
-     * Inert quarantine — {@link #quarantine} does nothing on this instance, so nothing is ever
-     * quarantined. The explicit stand-in a caller (or a test not exercising this feature) passes
-     * instead of a defaulting overload, exactly like {@code ExhaustedPatternLookup.none()}.
-     */
-    public static BackendQuarantine none() {
-        return new BackendQuarantine(() -> 0L, 1, true);
-    }
-
-    /**
-     * Quarantine {@code credentialId} for the configured cooldown, starting now. A repeat call while
-     * already quarantined restarts the cooldown at full length — a fresh refusal is fresh evidence the
-     * account is still exhausted, not a reason to let an earlier, shorter wait stand.
-     *
-     * <p>On {@link #none()} this is a no-op. It has to be: that instance holds a clock frozen at 0,
-     * so recording a deadline would produce a quarantine that never expires — a credential locked out
-     * for the life of the daemon. Two production {@code CompositePeerLauncher} constructors default to
-     * {@code none()}, so the failure would be silent and permanent. An inert stand-in must omit the
-     * fact, never invent one.
-     */
-    public void quarantine(String credentialId) {
-        Objects.requireNonNull(credentialId, "credentialId");
-        if (inert) {
-            return;
-        }
-        quarantinedUntilNanos.put(credentialId, nowNanos.getAsLong() + cooldownNanos);
-    }
-
-    /** Whether {@code credentialId} is quarantined right now. */
-    public boolean isQuarantined(String credentialId) {
-        return remainingNanos(credentialId) > 0;
-    }
-
-    /** Seconds left on {@code credentialId}'s quarantine, or empty when it is not quarantined. */
-    public OptionalLong remainingSeconds(String credentialId) {
-        long remaining = remainingNanos(credentialId);
-        return remaining > 0 ? OptionalLong.of(toSecondsRoundedUp(remaining)) : OptionalLong.empty();
-    }
-
-    /**
-     * Every currently-quarantined credential id and its remaining seconds (CB-578 stage B fleet
-     * reporting) — expired entries are never included. Not pruned from the backing map here: it stays
-     * small (bounded by the number of distinct credentials ever exhausted) and a lazily-stale entry is
-     * harmless, since every read already checks the deadline.
-     */
-    public Map<String, Long> activeRemainingSeconds() {
-        Map<String, Long> out = new LinkedHashMap<>();
-        quarantinedUntilNanos.forEach((credentialId, deadline) -> {
-            long remaining = deadline - nowNanos.getAsLong();
-            if (remaining > 0) {
-                out.put(credentialId, toSecondsRoundedUp(remaining));
-            }
-        });
-        return out;
-    }
-
-    private long remainingNanos(String credentialId) {
-        Long deadline = quarantinedUntilNanos.get(credentialId);
-        return deadline == null ? 0L : deadline - nowNanos.getAsLong();
-    }
-
-    private static long toSecondsRoundedUp(long nanos) {
-        return (nanos + 999_999_999L) / 1_000_000_000L;
-    }
-}
@@ -4,63 +4,19 @@ package dev.ltms.bridged.placement;
 * Backward-compatible placement: an unqualified spawn always resolves to the configured default
 * profile, exactly as {@code CompositePeerLauncher} did before CB-518. This ignores caps and
 * reachability so that a pre-existing config behaves identically after upgrade.
- *
- * <p>Two exceptions walk past the default instead of returning it unconditionally:
- * <ul>
- *   <li>Quarantine (CB-578 stage B): a quarantined default is a credential that just refused on
- *       a usage limit, not a transient capacity or reachability concern.
- *   <li>Weight 0 (CB-554): {@code fixed} is still automatic selection, so a profile the operator
- *       marked "never auto-select me" ({@code weight <= 0}) must be skipped here exactly as
- *       {@code weighted}/{@code round-robin} skip it — an explicit {@code bridge_spawn} naming
- *       the profile is unaffected, only this automatic fallback walk.
- * </ul>
- * A fleet where nothing is ever quarantined or weight-0 never exercises either path, so today's
- * behaviour is unchanged.
 */
 final class FixedPlacementPolicy implements PlacementPolicy {

    @Override
    public PlacementCandidate select(PlacementContext ctx) {
        String d = ctx.defaultProfile();
-        if (d != null && !d.isBlank() && !ctx.quarantined().contains(d) && !weightExcluded(ctx, d)) {
+        if (d != null && !d.isBlank()) {
            return new PlacementCandidate(d, null, 1.0f, null);
        }
-        for (PlacementCandidate c : ctx.candidates()) {
-            if (!ctx.quarantined().contains(c.profile()) && !c.excluded()) {
-                return new PlacementCandidate(c.profile(), null, c.weight(), c.maxLoad());
-            }
-        }
-        if (d != null && !d.isBlank()) {
-            boolean dQuarantined = ctx.quarantined().contains(d);
-            boolean dWeightExcluded = weightExcluded(ctx, d);
-            if (dQuarantined && dWeightExcluded) {
-                throw new PlacementException("worker profile '" + d + "' is quarantined (backend "
-                        + "exhausted) and has weight 0 (excluded from automatic selection), and no "
-                        + "available candidate remains");
-            }
-            if (dWeightExcluded) {
-                throw new PlacementException("worker profile '" + d + "' has weight 0 (excluded "
-                        + "from automatic selection) and no available candidate remains");
-            }
-            if (dQuarantined) {
-                throw new PlacementException("worker profile '" + d + "' is quarantined (backend "
-                        + "exhausted) and no un-quarantined candidate is available");
-            }
-        }
        if (!ctx.candidates().isEmpty()) {
-            throw new PlacementException(
-                    "all worker profiles are excluded from automatic selection (quarantined or weight-0)");
+            PlacementCandidate first = ctx.candidates().getFirst();
+            return new PlacementCandidate(first.profile(), null, first.weight(), first.maxLoad());
        }
        throw new PlacementException("no worker profiles configured");
    }
-
-    /** Whether {@code profile} carries {@code weight <= 0} (CB-554) among {@code ctx}'s candidates. */
-    private static boolean weightExcluded(PlacementContext ctx, String profile) {
-        for (PlacementCandidate c : ctx.candidates()) {
-            if (c.profile().equals(profile)) {
-                return c.excluded();
-            }
-        }
-        return false;
-    }
 }
@@ -17,18 +17,4 @@ public record PlacementCandidate(String profile, String host, float weight, Inte
    public static PlacementCandidate profile(String profile) {
        return new PlacementCandidate(profile, null, 1.0f, null);
    }
-
-    /**
-     * True when this candidate carries an explicit {@code weight <= 0} (CB-554) and must be
-     * skipped by every automatic policy — the same way a quarantined or unreachable candidate is
-     * skipped. {@code BridgedConfig.Profile}'s compact constructor already normalises "absent" to
-     * {@code 1.0} and "negative" to {@code 0.0}, so this is a plain threshold check here; it does
-     * not need to distinguish "explicit 0" from "absent" itself.
-     *
-     * <p>Exclusion is about <em>automatic</em> selection only — an explicit
-     * {@code bridge_spawn{profile:"..."}} bypasses placement entirely and is unaffected.
-     */
-    public boolean excluded() {
-        return weight <= 0.0f;
-    }
 }
@@ -11,13 +11,9 @@ import java.util.function.Function;
 * @param candidates     every configured candidate; the policy filters out those at cap or unreachable
 * @param liveCount      current live worker count per profile (from the session registry)
 * @param unreachable    profiles already known to have failed in this spawn attempt
- * @param quarantined    profiles whose credential is currently quarantined (CB-578 stage B) — a
- *                       {@code BACKEND_EXHAUSTED} classification put it, or a profile it shares a
- *                       credential with, on cooldown. Filtered the same way as {@code unreachable}.
 */
 public record PlacementContext(String defaultProfile,
                               List<PlacementCandidate> candidates,
                               Function<String, Integer> liveCount,
-                               Set<String> unreachable,
-                               Set<String> quarantined) {
+                               Set<String> unreachable) {
 }
@@ -12,16 +12,13 @@ final class PlacementPolicyUtil {
    }

    /**
-     * Candidates that are not weight-excluded (CB-554: explicit {@code weight <= 0}, checked
-     * first because it is a static config choice rather than transient state), not
-     * known-unreachable, not quarantined (CB-578 stage B), and have not reached their maxLoad.
+     * Candidates that are not known-unreachable and have not reached their maxLoad.
     * A {@code null} maxLoad means unlimited.
     */
    static List<PlacementCandidate> available(PlacementContext ctx) {
        List<PlacementCandidate> out = new ArrayList<>();
        for (PlacementCandidate c : ctx.candidates()) {
-            if (c.excluded() || ctx.unreachable().contains(c.profile())
-                    || ctx.quarantined().contains(c.profile())) {
+            if (ctx.unreachable().contains(c.profile())) {
                continue;
            }
            Integer cap = c.maxLoad();
@@ -37,23 +34,15 @@ final class PlacementPolicyUtil {
    }

    /**
-     * Build a clear exception describing why every candidate was dropped: all weight-0, all
-     * quarantined, all at capacity, all unreachable, or a mix. Each candidate is counted into
-     * exactly one bucket (weight-excluded takes priority) so a candidate excluded for more than
-     * one reason is never double-counted.
+     * Build a clear exception describing why every candidate was dropped: all at capacity,
+     * all unreachable, or a mix.
     */
    static PlacementException emptyException(PlacementContext ctx) {
-        int weightExcluded = 0;
        int atCap = 0;
        int unreachable = 0;
-        int quarantined = 0;
        for (PlacementCandidate c : ctx.candidates()) {
            Integer cap = c.maxLoad();
-            if (c.excluded()) {
-                weightExcluded++;
-            } else if (ctx.quarantined().contains(c.profile())) {
-                quarantined++;
-            } else if (ctx.unreachable().contains(c.profile())) {
+            if (ctx.unreachable().contains(c.profile())) {
                unreachable++;
            } else if (cap != null && ctx.liveCount().apply(c.profile()) >= cap) {
                atCap++;
@@ -64,13 +53,6 @@ final class PlacementPolicyUtil {
        if (total == 0) {
            return new PlacementException("no worker profiles configured");
        }
-        if (weightExcluded == total) {
-            return new PlacementException(
-                    "all worker profiles have weight 0 (excluded from automatic selection)");
-        }
-        if (quarantined == total) {
-            return new PlacementException("all worker profiles are quarantined (backend exhausted)");
-        }
        if (atCap == total) {
            return new PlacementException("all worker profiles are at maxLoad");
        }
@@ -78,8 +60,6 @@ final class PlacementPolicyUtil {
            return new PlacementException("all worker profiles are unreachable");
        }
        return new PlacementException("no worker profile available: " + atCap + " at maxLoad, "
-                + unreachable + " unreachable, " + quarantined + " quarantined, "
-                + weightExcluded + " weight-0, "
-                + (total - atCap - unreachable - quarantined - weightExcluded) + " remaining");
+                + unreachable + " unreachable, " + (total - atCap - unreachable) + " remaining");
    }
 }
@@ -11,12 +11,11 @@ import dev.ltms.bridged.metrics.Metrics;
 import dev.ltms.bridged.herdr.Agent;
 import dev.ltms.bridged.herdr.HerdrClient;
 import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.inject.MemberPresence;
+import dev.ltms.bridged.inject.WorkerPresence;
 import dev.ltms.bridged.peer.PeerUnreachableException;
 import dev.ltms.bridged.msg.MessageService;
 import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.bridged.session.WorkerSession;
 import dev.ltms.bridged.session.WorktreeRequest;
 import dev.ltms.bridged.peer.PeerLauncher;
 import io.javalin.Javalin;
@@ -56,7 +55,7 @@ public final class BridgedApp {
    private final PeerLauncher workers;
    private final SessionManager sessions; // CB-301: authoritative session registry
    private final MessageService messages;
-    private final MemberPresence presence; // CB-113: which workers are MCP-connected (available)
+    private final WorkerPresence presence; // CB-113: which workers are MCP-connected (available)
    private final HttpServlet mcpServlet; // MCP Streamable-HTTP endpoint, mounted at /mcp (nullable)
    private final CallerResolver auth;    // CB-501: null → authz not enforced (legacy behaviour)
    private final Metrics metrics;        // CB-502: null → /metrics not exposed
@@ -68,7 +67,7 @@ public final class BridgedApp {
     * behaviour without each needing an auth fixture.
     */
    public BridgedApp(HerdrClient herdr, PeerLauncher workers, SessionManager sessions,
-                      MessageService messages, MemberPresence presence,
+                      MessageService messages, WorkerPresence presence,
                      HttpServlet mcpServlet) {
        this(herdr, workers, sessions, messages, presence, mcpServlet, null, null);
    }
@@ -80,7 +79,7 @@ public final class BridgedApp {
     *                the endpoint
     */
    public BridgedApp(HerdrClient herdr, PeerLauncher workers, SessionManager sessions,
-                      MessageService messages, MemberPresence presence,
+                      MessageService messages, WorkerPresence presence,
                      HttpServlet mcpServlet, CallerResolver auth, Metrics metrics) {
        this.herdr = herdr;
        this.workers = workers;
@@ -116,10 +115,10 @@ public final class BridgedApp {
        }
        app.get("/sessions", this::sessions);
        app.get("/agents", this::agents);
-        app.get("/members", this::listMembers);                  // CB-304: registry roster + live herdr status
-        app.get("/profiles", this::profiles);                    // configured backend profiles
-        app.post("/members", this::spawnMember);                 // optional ?role=&profile= or {"role":…,"profile":…}
-        app.delete("/members/{paneId}", this::stopMember);
+        app.get("/workers", this::listWorkers);                 // CB-304: registry roster + live herdr status
+        app.get("/profiles", this::profiles);                    // configured worker profiles
+        app.post("/workers", this::spawnWorker);                 // optional ?profile= or {"profile":…}
+        app.delete("/workers/{paneId}", this::stopWorker);
        app.post("/sessions/{id}/message", this::sendMessage);   // bridge_send (primary; blocking, wait:false, or answer via turnId)
        app.post("/sessions/{id}/reply", this::replyMessage);    // bridge_reply (worker)
        app.get("/sessions/{id}/replies", this::drainReplies);   // drain reply inbox (CB-307)
@@ -222,7 +221,7 @@ public final class BridgedApp {
    }

    /** CB-304: bridge-owned roster merged with live herdr status by paneId. */
-    private void listMembers(Context ctx) {
+    private void listWorkers(Context ctx) {
        if (!allow(ctx, Authz.Action.READ, null)) {
            return;
        }
@@ -252,11 +251,10 @@ public final class BridgedApp {
     * body) picks which configured profile; omitted → the default. 403 if the base_url would breach
     * the subscription boundary, 400 for an unknown profile.
     */
-    private void spawnMember(Context ctx) {
+    private void spawnWorker(Context ctx) {
        if (!allow(ctx, Authz.Action.SPAWN, null)) {
            return;
        }
-        String role = ctx.queryParam("role");
        String profile = ctx.queryParam("profile");
        String cwd = ctx.queryParam("cwd");
        String worktree = ctx.queryParam("worktree");
@@ -267,7 +265,6 @@ public final class BridgedApp {
                String body = ctx.body();
                if (!body.isBlank()) {
                    JsonNode b = mapper.readTree(body);
-                    if (role == null || role.isBlank()) role = b.path("role").asText(null);
                    if (profile == null || profile.isBlank()) profile = b.path("profile").asText(null);
                    if (cwd == null || cwd.isBlank()) cwd = b.path("cwd").asText(null);
                    if (worktree == null || worktree.isBlank()) worktree = b.path("worktree").asText(null);
@@ -278,18 +275,10 @@ public final class BridgedApp {
            }
        }
        WorktreeRequest wt = worktreeRequest(worktree, ticket);
-        MemberRole memberRole;
-        try {
-            memberRole = (role == null || role.isBlank()) ? MemberRole.DEV : MemberRole.parse(role);
-        } catch (IllegalArgumentException e) {
-            ctx.status(400).json(Map.of("error", "unknown_role", "detail", e.getMessage()));
-            return;
-        }
        try {
            // No MCP caller over REST, so callerCwd and ownerTerminal are null.
-            MemberSession member = sessions.acquire(blankToNull(profile), memberRole,
-                    blankToNull(cwd), null, null, wt);
-            ctx.status(201).json(view(member));
+            WorkerSession worker = sessions.acquire(blankToNull(profile), blankToNull(cwd), null, null, wt);
+            ctx.status(201).json(view(worker));
        } catch (GuardException e) {
            ctx.status(403).json(Map.of("error", "subscription_boundary", "detail", e.getMessage()));
        } catch (IllegalArgumentException e) {
@@ -317,7 +306,7 @@ public final class BridgedApp {
    }

    /** Tear a worker down by pane id. */
-    private void stopMember(Context ctx) {
+    private void stopWorker(Context ctx) {
        String paneId = ctx.pathParam("paneId");
        if (!allow(ctx, Authz.Action.STOP, paneId)) {
            return;
@@ -403,12 +392,9 @@ public final class BridgedApp {
                        case TIMED_OUT_QUEUED -> "queued";
                        case BUSY -> "busy";
                        case WORKER_FAILED -> "failed";
-                        case BACKEND_EXHAUSTED -> "backend_exhausted";
                        default -> "done"; // unreachable (terminal outcomes handled above)
                    },
-                    "detail", (reply.outcome() == MessageService.Outcome.WORKER_FAILED
-                                    || reply.outcome() == MessageService.Outcome.BACKEND_EXHAUSTED)
-                                    && reply.text() != null
+                    "detail", reply.outcome() == MessageService.Outcome.WORKER_FAILED && reply.text() != null
                            ? reply.text()
                            : "no reply within " + timeout + "ms; poll status or retry"));
        }
@@ -558,7 +544,7 @@ public final class BridgedApp {
    }

    /** CB-301 projection of an authoritative bridge-owned session. */
-    private static Map<String, Object> view(MemberSession s) {
+    private static Map<String, Object> view(WorkerSession s) {
        Map<String, Object> m = new LinkedHashMap<>();
        m.put("terminalId", s.terminalId());
        m.put("paneId", s.paneId());
@@ -13,8 +13,6 @@ import java.nio.file.Path;
 import java.nio.file.StandardCopyOption;
 import java.security.SecureRandom;
 import java.util.List;
-import java.util.Map;
-import java.util.Optional;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.stream.Collectors;
@@ -37,17 +35,10 @@ public final class GitWorktrees implements Worktrees {
    /** What {@link #isolateToolSurface} writes for {@code .mcp.json}: a valid, explicitly empty server map. */
    private static final String NEUTRAL_MCP_CONFIG = "{\n  \"mcpServers\": {}\n}\n";

-    /** OpenCode's repo-level config. Tracked here, so it lands in every worktree, and it mounts the
-     *  primary's gitea and context7 servers with the primary's credentials. Neutralized so the worker
-     *  gets only the config its launcher writes via {@code OPENCODE_CONFIG}.
-     *
-     *  <p>The reason has changed shape and is now stronger. It used to be a crash: the file carried
-     *  {@code {file:.secrets/...}} references to gitignored files that never reached a worktree, and
-     *  opencode refuses to start on a dangling reference (CB-543). Those credentials now live in one
-     *  shell-level store and the file reads them as {@code {env:...}}, so in a worktree the reference
-     *  resolves instead of failing. That is worse, not better: a member would silently inherit the
-     *  primary's admin-scoped {@code GITEA_ACCESS_TOKEN}. A loud crash became a quiet privilege leak,
-     *  so this entry protects a boundary now rather than papering over a startup error. */
+    /** OpenCode's repo-level config. Tracked here, so it lands in every worktree; it carries
+     *  {@code {file:.secrets/...}} references to gitignored secrets that never reach a worktree, and
+     *  opencode refuses to start on a dangling reference — so it is neutralized and the worker gets
+     *  only the config its launcher writes via {@code OPENCODE_CONFIG}. */
    private static final String OPENCODE_CONFIG = "opencode.json";

    /** What {@link #isolateToolSurface} writes for {@code opencode.json}: a valid, empty JSON object. */
@@ -121,8 +112,8 @@ public final class GitWorktrees implements Worktrees {
     * paths outside its own worktree. That is not hypothetical: a CB-523 worker made all 59 of its
     * edits in the primary checkout while compiling its worktree, so every build it ran was of code
     * that did not contain its changes. {@code opencode.json} is the same trap one tool over — tracked,
-     * so it lands in every worktree, and it mounts gitea and context7 with the primary's own
-     * credentials, which a member must never hold. {@code .autoenv} extends the principle to a
+     * so it lands in every worktree, referencing gitignored {@code .secrets/} files that never do, and
+     * opencode refuses to start on the dangling reference. {@code .autoenv} extends the principle to a
     * config that is not tracked today: autoenv authorizes by path, so a fresh worktree path is always
     * unauthorized and its interactive prompt would block every spawn, so re-landing one must be safe.
     *
@@ -169,22 +160,6 @@ public final class GitWorktrees implements Worktrees {
        exec("git", "-C", repoRoot, "worktree", "remove", "--force", worktreePath);
    }

-    @Override
-    public boolean hasUncommitted(String worktreePath) {
-        // A worktree that is already gone holds no work to lose, and it must not break teardown:
-        // git -C <missing-dir> status exits non-zero and would throw where release() is mid-way
-        // through stopping a pane. Mirror remove()'s already-gone tolerance by treating it as clean.
-        Path p = Path.of(worktreePath);
-        if (!Files.exists(p)) {
-            log.debug("worktree {} already gone — nothing can be uncommitted", worktreePath);
-            return false;
-        }
-        // No --untracked-files=no: the exact shape of the work lost in CB-576 was a new file
-        // that was never added, so an untracked-only worktree is still dirty.
-        String out = exec("git", "-C", worktreePath, "status", "--porcelain");
-        return !out.isBlank();
-    }
-
    @Override
    public void overlayParity(String repoRoot, String worktreePath, List<String> overlay) {
        if (overlay == null || overlay.isEmpty()) {
@@ -219,86 +194,6 @@ public final class GitWorktrees implements Worktrees {
        return Path.of(out.trim()).toAbsolutePath().normalize().toString();
    }

-    /**
-     * CB-578 stage C, fixed by CB-587. Stages into a <em>temporary</em> index (never the worktree's
-     * real one, which the worker may still be writing to) — but that temp index is first <em>seeded</em>
-     * from the worktree's real one, rather than starting empty:
-     *
-     * <pre>
-     * cp $(git -C worktree rev-parse --git-path index) &lt;temp&gt;
-     * GIT_INDEX_FILE=&lt;temp&gt; git -C worktree add -A
-     * tree=$(GIT_INDEX_FILE=&lt;temp&gt; git -C worktree write-tree)
-     * commit=$(git -C worktree commit-tree $tree -p HEAD -m message)
-     * git -C worktree update-ref refs/wip/branch $commit
-     * </pre>
-     *
-     * A fresh empty index carries none of the real index's {@code --skip-worktree} /
-     * {@code --assume-unchanged} bits, so {@code add -A} into it stages a skip-worktree file's local
-     * on-disk content even though {@code git status --porcelain} correctly hides that file (CB-587).
-     * Seeding from the real index preserves those bits, so {@code add -A} then skips exactly what
-     * {@code git status} skips. {@code add -A} (never {@code -f}) also still respects
-     * {@code .gitignore} exactly as it would in the real index — a gitignored file staying ignored is
-     * what keeps secrets and local config out of the snapshot's tree. The temporary index file is
-     * removed afterwards regardless of outcome; the worker's real index is never opened for writing.
-     */
-    @Override
-    public Optional<String> snapshot(String worktreePath, String branch, String message) {
-        if (!Files.exists(Path.of(worktreePath))) {
-            log.debug("worktree {} already gone — nothing to snapshot", worktreePath);
-            return Optional.empty();
-        }
-        Path tempIndex;
-        try {
-            tempIndex = Files.createTempFile("bridged-wip-index-", ".tmp");
-        } catch (IOException e) {
-            throw new WorktreeException("cannot create a temporary index for snapshot: " + e.getMessage(), e);
-        }
-        Map<String, String> indexEnv = Map.of("GIT_INDEX_FILE", tempIndex.toAbsolutePath().toString());
-        try {
-            Path realIndex = resolveRealIndex(worktreePath);
-            try {
-                Files.copy(realIndex, tempIndex, StandardCopyOption.REPLACE_EXISTING);
-            } catch (IOException e) {
-                throw new WorktreeException("cannot copy the worktree's real index (" + realIndex
-                        + ") into the temporary snapshot index: " + e.getMessage(), e);
-            }
-            exec(indexEnv, "git", "-C", worktreePath, "add", "-A");
-            String tree = exec(indexEnv, "git", "-C", worktreePath, "write-tree").trim();
-            String commit = exec("git", "-C", worktreePath, "commit-tree", tree, "-p", "HEAD", "-m", message).trim();
-            exec("git", "-C", worktreePath, "update-ref", "refs/wip/" + branch, commit);
-            log.info("snapshotted worktree {} to refs/wip/{} commit={}", worktreePath, branch, commit);
-            return Optional.of(commit);
-        } finally {
-            try {
-                Files.deleteIfExists(tempIndex);
-            } catch (IOException e) {
-                log.debug("could not delete temporary snapshot index {}: {}", tempIndex, e.getMessage());
-            }
-        }
-    }
-
-    /**
-     * Resolve the path of {@code worktreePath}'s real index. Never assume {@code <worktree>/.git/index}:
-     * in a linked worktree {@code .git} is a <em>file</em> pointing at the main repo's
-     * {@code worktrees/<name>/} directory, and that is where the real per-worktree index lives.
-     * {@code git rev-parse --git-path index} resolves this correctly for both a linked worktree and
-     * the main checkout. Throws {@link WorktreeException} — same as every other failure in this
-     * class — if the command fails or the resolved path does not exist, rather than silently
-     * snapshotting from an empty index.
-     */
-    private Path resolveRealIndex(String worktreePath) {
-        String out = exec("git", "-C", worktreePath, "rev-parse", "--git-path", "index").trim();
-        Path index = Path.of(out);
-        if (!index.isAbsolute()) {
-            index = Path.of(worktreePath).resolve(index).normalize();
-        }
-        if (!Files.exists(index)) {
-            throw new WorktreeException("worktree's real index not found at resolved path " + index
-                    + " (git rev-parse --git-path index reported '" + out + "')");
-        }
-        return index;
-    }
-
    /** Resolve the directory that will hold per-session worktree checkouts. */
    private Path resolveRoot(String repoRoot) {
        if (configuredRoot != null && !configuredRoot.isBlank()) {
@@ -321,20 +216,11 @@ public final class GitWorktrees implements Worktrees {
     * stdout and stderr (merged by redirectErrorStream).
     */
    private String exec(String... command) {
-        return exec(Map.of(), command);
-    }
-
-    /** Same as {@link #exec(String...)}, with extra environment variables set on the child process. */
-    private String exec(Map<String, String> extraEnv, String... command) {
        String out;
        int code;
        Process p;
        try {
-            ProcessBuilder pb = new ProcessBuilder(command).redirectErrorStream(true);
-            if (extraEnv != null && !extraEnv.isEmpty()) {
-                pb.environment().putAll(extraEnv);
-            }
-            p = pb.start();
+            p = new ProcessBuilder(command).redirectErrorStream(true).start();
        } catch (IOException e) {
            throw new WorktreeException("failed to start " + command[0] + ": " + e.getMessage(), e);
        }
@@ -1,92 +0,0 @@
-package dev.ltms.bridged.session;
-
-import dev.ltms.bridged.peer.CharterReceipt;
-import dev.ltms.bridged.peer.MemberRole;
-
-/**
- * A bridge-owned worker session — the authoritative in-daemon record of a worker this
- * process spawned. Immutable; state transitions are performed by replacing the record in
- * {@link SessionManager}'s registry.
- *
- * @param paneId         the host-unique opaque id (CB-519) — the registry key and the argument to
- *                       teardown. Despite the historical name this is the {@link
- *                       dev.ltms.bridged.peer.PeerHandle#id()}, a UUID, and is distinct from the
- *                       launcher-private herdr pane coordinate.
- * @param terminalId     herdr terminal handle — the {@code target} for send/read/status
- * @param profile        the profile name that spawned this session — WHICH BACKEND
- * @param role           the contract this member runs under — WHAT IT IS FOR. Independent of
- *                       {@code profile}: a reviewer may run on the same profile as the dev
- *                       whose diff it reads. {@code null} only for a session recorded before
- *                       the role was known
- * @param cwd            the resolved working directory the worker started in
- * @param ownerTerminal  the caller that requested this worker ({@code null} = daemon/anon)
- * @param spawnedAtNanos     {@link System#nanoTime()} when the session was registered
- * @param lastActivityAtNanos {@link System#nanoTime()} of the most recent lifecycle event
- * @param turnCount          number of delegated turns that have been delivered to this session
- * @param state              current lifecycle state in the one-shot FSM
- * @param charterReceipt     the fingerprint (CB-571) of the charter bytes this member was started
- *                           with; {@code null} for a session whose launcher recorded none
- * @param agentSessionId     the peer's OWN session id (CB-584) — the handle a later
- *                           {@code resumeSessionId} spawn would pass back to resume this exact
- *                           conversation; {@code null} when the launcher could not determine one
- *                           (an adapter that declines {@code Capability.SESSION_RESUME}, or one
- *                           that resolves it lazily and has not yet)
- */
-public record MemberSession(
-        String paneId,
-        String terminalId,
-        String profile,
-        MemberRole role,
-        String cwd,
-        String ownerTerminal,
-        long spawnedAtNanos,
-        long lastActivityAtNanos,
-        int turnCount,
-        State state,
-        String worktree,
-        String branch,
-        CharterReceipt charterReceipt,
-        String agentSessionId) {
-
-    /** One-shot worker lifecycle states. */
-    public enum State {
-        SPAWNING,
-        READY,
-        BUSY,
-        DONE,
-        FAILED,
-        RELEASED
-    }
-
-    /**
-     * Backward-compatible shape: a session with no charter receipt and no agent session id (a test
-     * or a launcher before CB-571 / CB-584). A separate constructor rather than a new parameter on
-     * the canonical one, so existing call sites that have nothing to record keep compiling
-     * unchanged.
-     */
-    public MemberSession(String paneId, String terminalId, String profile, MemberRole role,
-                         String cwd, String ownerTerminal, long spawnedAtNanos,
-                         long lastActivityAtNanos, int turnCount, State state,
-                         String worktree, String branch) {
-        this(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
-                lastActivityAtNanos, turnCount, state, worktree, branch, null, null);
-    }
-
-    /** Return a copy of this session in {@code state}. */
-    public MemberSession withState(State state) {
-        return new MemberSession(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
-                lastActivityAtNanos, turnCount, state, worktree, branch, charterReceipt, agentSessionId);
-    }
-
-    /** Return a copy with {@code lastActivityAtNanos} updated to {@code nowNanos}. */
-    public MemberSession withActivity(long nowNanos) {
-        return new MemberSession(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
-                nowNanos, turnCount, state, worktree, branch, charterReceipt, agentSessionId);
-    }
-
-    /** Return a copy with the turn count incremented and activity timestamped at {@code nowNanos}. */
-    public MemberSession bumpTurn(long nowNanos) {
-        return new MemberSession(paneId, terminalId, profile, role, cwd, ownerTerminal, spawnedAtNanos,
-                nowNanos, turnCount + 1, state, worktree, branch, charterReceipt, agentSessionId);
-    }
-}
@@ -1,12 +1,8 @@
 package dev.ltms.bridged.session;

-import dev.ltms.bridged.auth.MemberLifecycle;
 import dev.ltms.bridged.herdr.Agent;
 import dev.ltms.bridged.inject.TurnListener;
-import dev.ltms.bridged.inject.MemberPresence;
-import dev.ltms.bridged.msg.TurnToken;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.bridged.inject.WorkerPresence;
 import dev.ltms.bridged.peer.PeerHandle;
 import dev.ltms.bridged.peer.PeerLauncher;
 import dev.ltms.bridged.peer.SpawnRequest;
@@ -18,7 +14,6 @@ import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Optional;
-import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicLong;
@@ -32,10 +27,11 @@ import java.util.function.LongSupplier;
 * teardown on top.
 *
 * <p>The state machine is intentionally one-shot / no-reuse: every acquired worker is fresh,
- * and a finished or released worker is torn down, never pooled or reused.
+ * and a finished or released worker is torn down, never pooled. {@link #recycle} is a convenience
+ * for {@code release + acquire} with a new distinct pane id.
 *
 * <p>The manager implements {@link TurnListener} so the injector's turn boundaries drive
- * {@code READY → BUSY → DONE} (or {@code FAILED}). It exposes a {@link MemberPresence} view via
+ * {@code READY → BUSY → DONE} (or {@code FAILED}). It exposes a {@link WorkerPresence} view via
 * {@link #asPresence()}: any MCP contact from a worker marks it present and simultaneously
 * transitions the session {@code SPAWNING → READY}.
 */
@@ -45,19 +41,18 @@ public final class SessionManager implements TurnListener {

    private final PeerLauncher launcher;
    private final Worktrees worktrees;
-    private final ConcurrentHashMap<String /*paneId*/, MemberSession> registry = new ConcurrentHashMap<>();
-    private final MemberPresence presence;
+    private final ConcurrentHashMap<String /*paneId*/, WorkerSession> registry = new ConcurrentHashMap<>();
+    private final WorkerPresence presence;
    private final SecureRandom nonceRandom = new SecureRandom();
    private final AtomicLong nonceSeq = new AtomicLong();
    private final LongSupplier nowNanos;
    private final int contextCap;
    private final boolean clearAfterTurn;
-    private volatile MemberLifecycle memberLifecycle = MemberLifecycle.NONE;

    /** CB-520: notified with a terminalId on every acquire; no-op until wired. */
    private final List<Consumer<String>> acquireListeners = new java.util.concurrent.CopyOnWriteArrayList<>();
-    /** CB-516: notified with a {@link ReleaseDetail} on every release; no-op until wired. */
-    private final List<Consumer<ReleaseDetail>> releaseListeners = new java.util.concurrent.CopyOnWriteArrayList<>();
+    /** CB-516: notified with a terminalId on every release; no-op until wired. */
+    private final List<Consumer<String>> releaseListeners = new java.util.concurrent.CopyOnWriteArrayList<>();

    /** Backward-compatible constructor: shared-tree sessions, production git seam. */
    public SessionManager(PeerLauncher launcher) {
@@ -95,290 +90,76 @@ public final class SessionManager implements TurnListener {
    }

    /**
-     * The single {@link MemberPresence} view of this manager: it records availability and forwards
+     * The single {@link WorkerPresence} view of this manager: it records availability and forwards
     * the signal to the {@code SPAWNING → READY} transition. Pass this to the {@code Injector} and
-     * {@code BridgeMcp} where they previously accepted a plain {@link MemberPresence}. The same
+     * {@code BridgeMcp} where they previously accepted a plain {@link WorkerPresence}. The same
     * instance is returned every call — presence is shared state, so a fresh bridge per call would
     * fragment the {@code present} set and lose signals across callers.
     */
-    public MemberPresence asPresence() {
+    public WorkerPresence asPresence() {
        return presence;
    }

    /**
-     * Spawn a worker and register it as {@link MemberSession.State#SPAWNING}. The caller's
+     * Spawn a worker and register it as {@link WorkerSession.State#SPAWNING}. The caller's
     * identity is recorded as {@code ownerTerminal} ({@code null} for daemon/anon callers).
     */
-    public MemberSession acquire(String profile, String requestedCwd, String callerCwd,
+    public WorkerSession acquire(String profile, String requestedCwd, String callerCwd,
                                 String ownerTerminal) {
        return acquire(profile, requestedCwd, callerCwd, ownerTerminal, null);
    }

    /**
-     * Spawn a member, optionally inside a fresh git worktree, defaulting the role to
-     * {@link MemberRole#DEV}.
-     *
-     * <p>{@code DEV} is the right default because it is exactly what the old "worker" meant: an
-     * unqualified spawn is a unit of implementation work. An architect or a reviewer is always
-     * asked for on purpose, so neither is ever what a caller silently gets.
+     * Spawn a worker, optionally inside a fresh git worktree. When {@code wt} is non-null the
+     * worktree is provisioned, parity-overlaid, and its path becomes the worker's cwd. On any
+     * failure before registration the worktree is removed so no dangling checkout is left.
     */
-    public MemberSession acquire(String profile, String requestedCwd, String callerCwd,
+    public WorkerSession acquire(String profile, String requestedCwd, String callerCwd,
                                 String ownerTerminal, WorktreeRequest wt) {
-        return acquire(profile, MemberRole.DEV, requestedCwd, callerCwd, ownerTerminal, wt);
-    }
-
-    /**
-     * Spawn a member, optionally inside a fresh git worktree, with no session identity requested.
-     * Equivalent to {@link #acquire(String, MemberRole, String, String, String, WorktreeRequest,
-     * String, String)} with both trailing args {@code null}.
-     *
-     * @param profile which backend to run on — a {@code profiles:} key
-     * @param role    which contract the member runs under; never {@code null}
-     */
-    public MemberSession acquire(String profile, MemberRole role, String requestedCwd, String callerCwd,
-                                 String ownerTerminal, WorktreeRequest wt) {
-        return acquire(profile, role, requestedCwd, callerCwd, ownerTerminal, wt, null, null);
-    }
-
-    /**
-     * Spawn a member, optionally inside a fresh git worktree, optionally onto a chosen or resumed
-     * agent session (CB-547a / CB-584). When {@code wt} is non-null the worktree is provisioned,
-     * parity-overlaid, and its path becomes the member's cwd. On any failure before registration the
-     * worktree is removed so no dangling checkout is left.
-     *
-     * <p>A non-blank {@code resumeSessionId} requires an explicit {@code profile}: a resumed
-     * conversation is tied to the specific backend that started it, so an unqualified spawn (whose
-     * backend a placement policy picks at spawn time) has no safe candidate to check the capability
-     * against. It also requires that profile's adapter to declare {@link Capability#SESSION_RESUME};
-     * refusing rather than silently delivering a cold session on a non-supporting adapter is the
-     * whole point of checking before spawn, not after (CB-584).
-     *
-     * @param profile         which backend to run on — a {@code profiles:} key
-     * @param role            which contract the member runs under; never {@code null}
-     * @param sessionName     the bridge's logical name for the session, or {@code null}
-     * @param resumeSessionId the prior agent session to resume, or {@code null} for a fresh one
-     * @throws IllegalArgumentException if {@code resumeSessionId} is set with no explicit profile,
-     *                                   or the resolved profile's adapter lacks
-     *                                   {@link Capability#SESSION_RESUME}
-     */
-    public MemberSession acquire(String profile, MemberRole role, String requestedCwd, String callerCwd,
-                                 String ownerTerminal, WorktreeRequest wt,
-                                 String sessionName, String resumeSessionId) {
-        MemberRole memberRole = (role == null) ? MemberRole.DEV : role;
-        requireResumeCapability(profile, resumeSessionId);
        if (wt == null) {
-            // CB-557: the role must ride on the SpawnRequest, not stay a local. The launcher needs it
-            // to pick the profile out of that role's pool and to label the tab; a role kept only on
-            // the MemberSession is recorded after the spawn it was supposed to steer.
-            SpawnRequest req = new SpawnRequest(profile, requestedCwd, callerCwd, sessionName, resumeSessionId, memberRole);
-            PeerHandle handle;
-            try {
-                handle = launcher.spawn(req);
-            } catch (RuntimeException e) {
-                log.warn("spawn failed for profile={} role={}: {}", profile, memberRole, e.getMessage());
-                throw e;
-            }
+            SpawnRequest req = new SpawnRequest(profile, requestedCwd, callerCwd);
+            PeerHandle handle = launcher.spawn(req);
            String resolvedProfile = resolveProfile(handle, profile);
            String cwd = launcher.effectiveCwd(new SpawnRequest(resolvedProfile, requestedCwd, callerCwd));
            long now = nowNanos.getAsLong();
-            MemberSession session = new MemberSession(
+            WorkerSession session = new WorkerSession(
                    handle.id(),
                    handle.terminalId(),
                    resolvedProfile,
-                    memberRole,
                    cwd,
                    ownerTerminal,
                    now,
                    now,
                    0,
-                    MemberSession.State.SPAWNING,
+                    WorkerSession.State.SPAWNING,
                    null,
-                    null,
-                    handle.charterReceipt(),
-                    handle.agentSessionId());
+                    null);
            registry.put(handle.id(), session);
-            memberLifecycle.acquired(session.role(), session.profile(), session.terminalId());
            log.debug("acquired session id={} terminal={} profile={} owner={}",
                    handle.id(), handle.terminalId(), session.profile(), session.ownerTerminal());
            notifyAcquired(session.terminalId());
            return session;
        }
-        return acquireWithWorktree(profile, memberRole, requestedCwd, callerCwd, ownerTerminal, wt,
-                sessionName, resumeSessionId);
-    }
-
-    /**
-     * Refuse a {@code resumeSessionId} that either names no explicit profile or names one whose
-     * adapter does not declare {@link Capability#SESSION_RESUME}. A no-op when
-     * {@code resumeSessionId} is blank — the ordinary, no-identity spawn path.
-     */
-    private void requireResumeCapability(String profile, String resumeSessionId) {
-        if (resumeSessionId == null || resumeSessionId.isBlank()) {
-            return;
-        }
-        if (profile == null || profile.isBlank()) {
-            throw new IllegalArgumentException("resumeSessionId requires an explicit profile — "
-                    + "a resumed conversation is tied to the backend that started it, so it cannot "
-                    + "be left to placement to pick");
-        }
-        Set<Capability> caps = launcher.capabilitiesFor(profile);
-        if (!caps.contains(Capability.SESSION_RESUME)) {
-            throw new IllegalArgumentException("worker profile '" + profile + "' does not declare "
-                    + "Capability.SESSION_RESUME — refusing resumeSessionId rather than silently "
-                    + "starting a cold session");
-        }
+        return acquireWithWorktree(profile, requestedCwd, callerCwd, ownerTerminal, wt);
    }

    /** Tear a worker down by pane id and remove it from the registry. Idempotent. */
    public void release(String paneId) {
-        release(paneId, ReleaseCause.COMPLETED);
-    }
-
-    /**
-     * Core teardown: always stops the worker pane and deregisters the session; whether the worker's
-     * git worktree is also removed depends on {@code cause}.
-     *
-     * <p>CB-544: these are two concerns that used to be fused. Stopping the pane is correct on every
-     * teardown — the worker process must end. Removing the worktree is a destructive act that is only
-     * correct for a deliberately-finished teardown (an explicit stop of a completed session, the
-     * reaper releasing a genuinely idle one, or a context-capped session). A shutdown drain
-     * must stop panes but preserve worktrees: a worker's uncommitted work exists in exactly one
-     * place — its worktree — so deleting it while the daemon simply goes down is silent data loss,
-     * with no copy and no error. Do NOT fuse these back together; the cost of an orphaned worktree
-     * is a logged path an operator can reclaim, the cost of a deleted one is unrecoverable work.
-     */
-    private void release(String paneId, ReleaseCause cause) {
-        MemberSession removed = registry.remove(paneId);
-        boolean preserveWorktree = cause == ReleaseCause.SHUTDOWN;
-        String snapshotRef = null;
+        WorkerSession removed = registry.remove(paneId);
        if (removed != null) {
-            try {
-                memberLifecycle.released(removed.terminalId());
-                log.debug("releasing session pane={} terminal={} state={} cause={}",
-                        removed.paneId(), removed.terminalId(), removed.state(), cause);
-                boolean dirty = removed.worktree() != null && worktrees.hasUncommitted(removed.worktree());
-                if (preserveWorktree && removed.worktree() != null) {
-                    logPreservedForShutdown(removed);
-                } else if (dirty) {
-                    // CB-576: a release that would otherwise remove the worktree finds it holding
-                    // uncommitted work the bridge cannot see. A worker that ends a turn without
-                    // committing (normally because it stopped to ask a question or refused the turn)
-                    // has its only copy of that work in the worktree. Remove would --force-delete it,
-                    // so preserve the directory and tell an operator where to find it.
-                    preserveWorktree = true;
-                    log.warn("release {} preserves dirty worktree {} for pane={} terminal={}: "
-                            + "the worktree holds uncommitted changes that --force remove would destroy",
-                            cause, removed.worktree(), removed.paneId(), removed.terminalId());
-                }
-                if (dirty) {
-                    // CB-578 stage C: preserving on disk is not saving — the directory is one
-                    // `worktree remove --force`, or an operator tidying up, away from gone. Commit
-                    // its full state to a ref before the preserve-or-remove decision above can be
-                    // undone by anything else, regardless of why this release fired.
-                    snapshotRef = trySnapshot(removed, cause);
-                }
-            } catch (RuntimeException e) {
-                // CB-581: hasUncommitted shells out to `git status` and can throw on a non-zero
-                // exit. We can no longer tell whether the worktree holds uncommitted work, so fail
-                // toward the safe answer and preserve it — deleting on a guess can destroy work
-                // that has no other copy (CB-576), while keeping it on a false alarm only costs
-                // disk. The exception must not propagate: the pane still has to stop below.
-                preserveWorktree = true;
-                log.warn("release {} could not tell whether worktree {} for pane={} terminal={} has "
-                        + "uncommitted changes; preserving it rather than risk destroying unsaved work: {}",
-                        cause, removed.worktree(), removed.paneId(), removed.terminalId(), e.toString());
-            } finally {
-                // CB-516/CB-581: a send still waiting on this worker can never be answered now, no
-                // matter what happened above. Tell the listener BEFORE the pane is torn down, so a
-                // blocked caller fails fast with a real reason instead of sitting on a rendezvous
-                // nothing will ever resolve. CB-578 stage C: carry the worktree/branch/snapshot ref
-                // too, so a failed ticket's detail can point a lead at the same tree to re-dispatch.
-                notifyReleased(new ReleaseDetail(removed.terminalId(), removed.worktree(),
-                        removed.branch(), snapshotRef));
-            }
+            log.debug("releasing session pane={} terminal={} state={}",
+                    removed.paneId(), removed.terminalId(), removed.state());
+            // CB-516: a send still waiting on this worker can never be answered now. Tell the
+            // listener BEFORE the pane is torn down, so a blocked caller fails fast with a real
+            // reason instead of sitting on a rendezvous nothing will ever resolve.
+            notifyReleased(removed.terminalId());
        }
-        // CB-581: the pane must always stop, even if the dirty check above threw. A session removed
-        // from the registry with no pane stop is an orphaned pane — a live terminal burning a fleet
-        // slot that no longer appears in the roster and can never be reclaimed.
        launcher.stop(paneId);
-        if (removed != null && !preserveWorktree && removed.worktree() != null) {
+        if (removed != null && removed.worktree() != null) {
            worktrees.remove(worktrees.repoRoot(removed.cwd()), removed.worktree());
        }
    }

-    /**
-     * Best-effort snapshot of a dirty worktree into {@code refs/wip/<branch>} (CB-578 stage C). A
-     * failure here must never escalate: the caller has already decided to preserve the worktree
-     * regardless of whether this succeeds, so the only cost of a failed snapshot is a WARN and a
-     * missing ref — never a lost pane stop or a lost release notification.
-     */
-    private String trySnapshot(MemberSession session, ReleaseCause cause) {
-        if (session.worktree() == null || session.branch() == null) {
-            return null;
-        }
-        try {
-            Optional<String> ref = worktrees.snapshot(session.worktree(), session.branch(),
-                    snapshotMessage(session, cause));
-            ref.ifPresent(sha -> log.info(
-                    "snapshotted dirty worktree {} to refs/wip/{} commit={} for pane={} terminal={}",
-                    session.worktree(), session.branch(), sha, session.paneId(), session.terminalId()));
-            return ref.orElse(null);
-        } catch (RuntimeException e) {
-            log.warn("snapshot of dirty worktree {} failed for pane={} terminal={} branch={}: the "
-                    + "worktree is still preserved on disk, just not committed to refs/wip/{}: {}",
-                    session.worktree(), session.paneId(), session.terminalId(), session.branch(),
-                    session.branch(), e.toString());
-            return null;
-        }
-    }
-
-    /** Commit message for a CB-578 stage C snapshot — names the member so an operator can tell runs apart. */
-    private String snapshotMessage(MemberSession session, ReleaseCause cause) {
-        return "CB-578 stage C: snapshot of a released worker\n\n"
-                + "terminal: " + session.terminalId() + "\n"
-                + "profile:  " + session.profile() + "\n"
-                + "branch:   " + session.branch() + "\n"
-                + "cause:    " + cause;
-    }
-
-    /**
-     * Facts about a released session that a listener needs beyond the bare terminal id — enough
-     * for a caller to point a lead at where to re-dispatch onto the same tree after a failed
-     * release (CB-578 stage C, acceptance criterion 10). {@code worktreePath} and {@code branch}
-     * are {@code null} for a shared-tree session; {@code snapshotRef} is {@code null} unless this
-     * release snapshotted a dirty worktree into {@code refs/wip/<branch>}.
-     */
-    public record ReleaseDetail(String terminalId, String worktreePath, String branch, String snapshotRef) {
-    }
-
-    /**
-     * Why a session is being released — governs whether its worktree is preserved or removed.
-     * Worktree removal is reserved for the one case that is genuinely finished; everything else
-     * must keep the worker's only copy of its work.
-     */
-    public enum ReleaseCause {
-        /** Deliberate teardown of a finished session. Stops the pane and removes the worktree. */
-        COMPLETED,
-        /** Daemon shutdown drain. Stops the pane but PRESERVES the worktree. */
-        SHUTDOWN
-    }
-
-    /**
-     * CB-544 shutdown drain log for a worktree we deliberately kept. A session still {@code BUSY}
-     * when the drain timeout expired was abandoned mid-turn — that work may be uncommitted and is
-     * the only copy — so the message is loud and points at the path an operator needs to reclaim.
-     */
-    private void logPreservedForShutdown(MemberSession session) {
-        if (session.state() == MemberSession.State.BUSY) {
-            log.warn("shutdown drain abandoned BUSY session pane={} terminal={} mid-turn; "
-                    + "worktree preserved at {}", session.paneId(), session.terminalId(),
-                    session.worktree());
-        } else {
-            log.info("shutdown drain preserved worktree at {} for pane={}",
-                    session.worktree(), session.paneId());
-        }
-    }
-
    /**
     * Register a callback invoked with a session's {@code terminalId} whenever it is acquired
     * (CB-520). This is the hook that lets the reply inbox {@code own} a target's queue.
@@ -392,24 +173,19 @@ public final class SessionManager implements TurnListener {
    /**
     * Register a callback invoked with a session's {@code terminalId} whenever it is released
     * (CB-516). Every teardown path funnels through {@link #release}, so one hook covers the REST
-     * and MCP stop tools, the idle-TTL reaper, and shutdown drain alike.
+     * and MCP stop tools, the idle-TTL reaper, {@code recycle}, and shutdown drain alike.
     *
     * <p>Added rather than injected because {@code MessageService} — one intended listener — is
     * constructed after this manager (it needs the injector and rendezvous, which need the session
     * presence view this manager exposes). Wiring it at construction would require breaking that
     * cycle for one callback.
     */
-    public void onRelease(Consumer<ReleaseDetail> listener) {
+    public void onRelease(Consumer<String> listener) {
        if (listener != null) {
            releaseListeners.add(listener);
        }
    }

-    /** Inject the optional member-slot lifecycle after construction without changing constructors. */
-    public void setMemberLifecycle(MemberLifecycle memberLifecycle) {
-        this.memberLifecycle = memberLifecycle == null ? MemberLifecycle.NONE : memberLifecycle;
-    }
-
    /** A listener failure must never prevent the acquisition it is reacting to. */
    private void notifyAcquired(String terminalId) {
        if (terminalId == null) {
@@ -425,22 +201,21 @@ public final class SessionManager implements TurnListener {
    }

    /** A listener failure must never prevent the teardown it is reacting to. */
-    private void notifyReleased(ReleaseDetail detail) {
-        if (detail.terminalId() == null) {
+    private void notifyReleased(String terminalId) {
+        if (terminalId == null) {
            return;
        }
-        for (Consumer<ReleaseDetail> listener : releaseListeners) {
+        for (Consumer<String> listener : releaseListeners) {
            try {
-                listener.accept(detail);
+                listener.accept(terminalId);
            } catch (RuntimeException e) {
-                log.warn("release listener failed for terminal {}: {}", detail.terminalId(), e.toString());
+                log.warn("release listener failed for terminal {}: {}", terminalId, e.toString());
            }
        }
    }

-    private MemberSession acquireWithWorktree(String profile, MemberRole memberRole, String requestedCwd, String callerCwd,
-                                              String ownerTerminal, WorktreeRequest wt,
-                                              String sessionName, String resumeSessionId) {
+    private WorkerSession acquireWithWorktree(String profile, String requestedCwd, String callerCwd,
+                                              String ownerTerminal, WorktreeRequest wt) {
        String preResolvedProfile = (profile == null || profile.isBlank())
                ? launcher.defaultProfile() : profile;
        // CB-507: resolve through the launcher's CB-112 chain (requested → profile cwd → caller →
@@ -456,10 +231,8 @@ public final class SessionManager implements TurnListener {
        try {
            path = worktrees.add(repoRoot, branch, wt.baseRef());
            worktrees.overlayParity(repoRoot, path, launcher.parityOverlay(preResolvedProfile));
-            handle = launcher.spawn(new SpawnRequest(profile, path, callerCwd, sessionName, resumeSessionId, memberRole));
+            handle = launcher.spawn(new SpawnRequest(profile, path, callerCwd));
        } catch (RuntimeException e) {
-            log.warn("spawn failed for profile={} role={} branch={} path={}: {}",
-                    preResolvedProfile, memberRole, branch, path, e.getMessage());
            if (path != null) {
                try {
                    worktrees.remove(repoRoot, path);
@@ -472,23 +245,19 @@ public final class SessionManager implements TurnListener {
        String resolvedProfile = resolveProfile(handle, profile);
        String cwd = launcher.effectiveCwd(new SpawnRequest(resolvedProfile, path, callerCwd));
        long now = nowNanos.getAsLong();
-        MemberSession session = new MemberSession(
+        WorkerSession session = new WorkerSession(
                handle.id(),
                handle.terminalId(),
                resolvedProfile,
-                memberRole,
                cwd,
                ownerTerminal,
                now,
                now,
                0,
-                MemberSession.State.SPAWNING,
+                WorkerSession.State.SPAWNING,
                path,
-                branch,
-                handle.charterReceipt(),
-                handle.agentSessionId());
+                branch);
        registry.put(handle.id(), session);
-        memberLifecycle.acquired(session.role(), session.profile(), session.terminalId());
        log.debug("acquired worktree session id={} terminal={} profile={} branch={} path={}",
                handle.id(), handle.terminalId(), session.profile(), session.branch(), session.worktree());
        notifyAcquired(session.terminalId());
@@ -519,13 +288,26 @@ public final class SessionManager implements TurnListener {
        return launcher.defaultProfile();
    }

+    /**
+     * Release the old session and acquire a fresh one with the same profile and working directory.
+     * The new session is guaranteed to have a pane id distinct from the old one (no-reuse invariant).
+     */
+    public WorkerSession recycle(String paneId) {
+        WorkerSession old = registry.get(paneId);
+        if (old == null) {
+            throw new IllegalArgumentException("no session for paneId " + paneId);
+        }
+        release(paneId);
+        return acquire(old.profile(), old.cwd(), old.cwd(), old.ownerTerminal());
+    }
+
    /** The session for {@code paneId}, if it is still registered and not released. */
-    public Optional<MemberSession> get(String paneId) {
+    public Optional<WorkerSession> get(String paneId) {
        return Optional.ofNullable(registry.get(paneId));
    }

    /** Bridge-owned roster: all registered sessions (acquired minus released). */
-    public List<MemberSession> roster() {
+    public List<WorkerSession> roster() {
        return List.copyOf(registry.values());
    }

@@ -533,15 +315,11 @@ public final class SessionManager implements TurnListener {
     * CB-304 merged roster+live view. The registry is authoritative for worktree, branch,
     * profile, owner, and state; the optional live agent supplies the herdr-reported status.
     */
-    public static Map<String, Object> rosterView(MemberSession session, Agent live) {
+    public static Map<String, Object> rosterView(WorkerSession session, Agent live) {
        Map<String, Object> m = new LinkedHashMap<>();
        m.put("sessionId", session.terminalId());
        m.put("paneId", session.paneId());
-        // Both axes, always: profile says which backend this member runs on, role says what it is
-        // for. A lead reading the roster needs both — two rows may share a profile and still be
-        // allowed to do entirely different things.
        m.put("profile", session.profile());
-        m.put("role", session.role() == null ? "dev" : session.role().wireName());
        m.put("state", session.state().name().toLowerCase());
        if (session.worktree() != null) {
            m.put("worktree", session.worktree());
@@ -552,29 +330,13 @@ public final class SessionManager implements TurnListener {
        if (session.ownerTerminal() != null) {
            m.put("owner", session.ownerTerminal());
        }
-        // CB-584: which conversation this member holds — the id a later resumeSessionId spawn would
-        // pass back. Absent for an adapter that declines Capability.SESSION_RESUME, or one that
-        // resolves it lazily and has not yet.
-        if (session.agentSessionId() != null) {
-            m.put("agentSessionId", session.agentSessionId());
-        }
-        // CB-571: which charter this member was started with — never the charter text itself. The
-        // digest lets a lead tell at a glance whether all members got the same charter; the source
-        // records whether a role charter was configured ("fleet.charters.<role>") or only the reply
-        // charter was composed ("none").
-        if (session.charterReceipt() != null) {
-            m.put("charterSource", session.charterReceipt().charterSource());
-            if (session.charterReceipt().charterSha256() != null) {
-                m.put("charterSha256", session.charterReceipt().charterSha256());
-            }
-        }
        m.put("liveStatus", live == null ? "unknown" : live.status().name().toLowerCase());
        return m;
    }

    /** Lifecycle hook: worker became available on the bridge MCP. */
    void onReady(String terminalId) {
-        transitionByTerminal(terminalId, MemberSession.State.SPAWNING, MemberSession.State.READY);
+        transitionByTerminal(terminalId, WorkerSession.State.SPAWNING, WorkerSession.State.READY);
    }

    /**
@@ -583,14 +345,14 @@ public final class SessionManager implements TurnListener {
     * can be re-delivered for multi-turn reuse until it is released.
     */
    @Override
-    public void onDelivered(String target, TurnToken token) {
-        MemberSession current = findByTerminal(target);
+    public void onDelivered(String target) {
+        WorkerSession current = findByTerminal(target);
        if (current == null) return;
-        if (current.state() != MemberSession.State.READY && current.state() != MemberSession.State.DONE) {
+        if (current.state() != WorkerSession.State.READY && current.state() != WorkerSession.State.DONE) {
            return;
        }
        long now = nowNanos.getAsLong();
-        MemberSession updated = current.withState(MemberSession.State.BUSY).bumpTurn(now);
+        WorkerSession updated = current.withState(WorkerSession.State.BUSY).bumpTurn(now);
        if (replace(current, updated)) {
            log.debug("session transitioned terminal={} pane={} {} -> BUSY turn={}",
                    target, current.paneId(), current.state(), updated.turnCount());
@@ -606,8 +368,8 @@ public final class SessionManager implements TurnListener {
    @Override
    public boolean hasPostTurnAction(String target) {
        if (!clearAfterTurn) return false;
-        MemberSession current = findByTerminal(target);
-        return current != null && current.state() == MemberSession.State.BUSY
+        WorkerSession current = findByTerminal(target);
+        return current != null && current.state() == WorkerSession.State.BUSY
                && (contextCap <= 0 || current.turnCount() < contextCap);
    }

@@ -617,10 +379,10 @@ public final class SessionManager implements TurnListener {
    }

    private boolean completeTurn(String target, boolean startContextReset) {
-        MemberSession current = findByTerminal(target);
-        if (current == null || current.state() != MemberSession.State.BUSY) return false;
+        WorkerSession current = findByTerminal(target);
+        if (current == null || current.state() != WorkerSession.State.BUSY) return false;
        long now = nowNanos.getAsLong();
-        MemberSession updated = current.withState(MemberSession.State.DONE).withActivity(now);
+        WorkerSession updated = current.withState(WorkerSession.State.DONE).withActivity(now);
        if (replace(current, updated)) {
            log.debug("session transitioned terminal={} pane={} BUSY -> DONE turn={}",
                    target, current.paneId(), updated.turnCount());
@@ -647,13 +409,11 @@ public final class SessionManager implements TurnListener {

    /** Lifecycle hook: the worker vanished or was dropped mid-life. */
    void onFailed(String target) {
-        MemberSession current = findByTerminal(target);
+        WorkerSession current = findByTerminal(target);
        if (current == null) return;
-        if (current.state() == MemberSession.State.RELEASED) return;
-        MemberSession.State priorState = current.state();
-        if (replace(current, current.withState(MemberSession.State.FAILED))) {
-            log.warn("member terminal={} pane={} can no longer be delegated to: its turn never resolved "
-                    + "(was {} when it failed)", target, current.paneId(), priorState);
+        if (current.state() == WorkerSession.State.RELEASED) return;
+        if (replace(current, current.withState(WorkerSession.State.FAILED))) {
+            log.debug("session marked failed terminal={} pane={}", target, current.paneId());
        }
    }

@@ -665,49 +425,32 @@ public final class SessionManager implements TurnListener {
    int reapIdle(long idleTtlNanos) {
        long now = nowNanos.getAsLong();
        int reaped = 0;
-        for (MemberSession s : roster()) {
-            if (s.state() != MemberSession.State.READY && s.state() != MemberSession.State.DONE) {
+        for (WorkerSession s : roster()) {
+            if (s.state() != WorkerSession.State.READY && s.state() != WorkerSession.State.DONE) {
                continue;
            }
-            long idleNanos = now - s.lastActivityAtNanos();
-            if (idleNanos > idleTtlNanos) {
-                log.debug("reaping idle session terminal={} pane={}: idle {}s exceeds the {}s ttl",
-                        s.terminalId(), s.paneId(), TimeUnit.NANOSECONDS.toSeconds(idleNanos),
-                        TimeUnit.NANOSECONDS.toSeconds(idleTtlNanos));
-                // CB-581: one session that fails to release must not abort the whole reaping pass —
-                // match drainAll's per-session try/catch so the rest of the roster still gets reaped.
-                try {
-                    release(s.paneId());
-                    reaped++;
-                } catch (RuntimeException e) {
-                    log.warn("reap failed for pane={} terminal={} worktree={}; continuing with "
-                            + "remaining sessions", s.paneId(), s.terminalId(), s.worktree(), e);
-                }
+            if (now - s.lastActivityAtNanos() > idleTtlNanos) {
+                release(s.paneId());
+                reaped++;
            }
        }
        return reaped;
    }

    /**
-     * Gracefully drain all registered sessions on daemon shutdown. For each session that is
-     * {@code BUSY}, poll up to {@code timeoutNanos} for it to leave {@code BUSY}, then release it
-     * regardless. Non-busy sessions are released immediately. A failure releasing one session is
-     * logged and does not abort the rest.
-     *
-     * <p>CB-544: this is a {@link ReleaseCause#SHUTDOWN} release — the worker's pane is stopped
-     * (the process must end) but its worktree is preserved and its path logged. Shutdown is never
-     * a reason to delete a worker's only copy of its uncommitted work. A session still {@code BUSY}
-     * when the timeout expired is abandoned mid-turn and logged loudly so an operator can find its
-     * kept worktree.
+     * Gracefully drain all registered sessions. For each session that is {@code BUSY}, poll up to
+     * {@code timeoutNanos} for it to leave {@code BUSY}, then release it regardless. Non-busy
+     * sessions are released immediately. A failure releasing one session is logged and does not
+     * abort the rest.
     */
    void drainAll(long timeoutNanos) {
        long deadline = System.nanoTime() + timeoutNanos;
-        for (MemberSession s : roster()) {
+        for (WorkerSession s : roster()) {
            try {
-                if (s.state() == MemberSession.State.BUSY) {
+                if (s.state() == WorkerSession.State.BUSY) {
                    while (System.nanoTime() < deadline) {
-                        MemberSession current = registry.get(s.paneId());
-                        if (current == null || current.state() != MemberSession.State.BUSY) {
+                        WorkerSession current = registry.get(s.paneId());
+                        if (current == null || current.state() != WorkerSession.State.BUSY) {
                            break;
                        }
                        try {
@@ -719,7 +462,7 @@ public final class SessionManager implements TurnListener {
                        }
                    }
                }
-                release(s.paneId(), ReleaseCause.SHUTDOWN);
+                release(s.paneId());
            } catch (RuntimeException e) {
                log.warn("drain failed for pane={}; continuing with remaining sessions", s.paneId(), e);
            }
@@ -746,22 +489,22 @@ public final class SessionManager implements TurnListener {
     * <p>A null {@code terminalId} is a normal input, not a caller bug: every lifecycle hook here is
     * fed from the MCP transport, where the <em>primary</em> resolves to a {@link
     * dev.ltms.bridged.auth.Principal} with no terminal. {@code BridgeMcp} documents that contact as
-     * a no-op, and {@link dev.ltms.bridged.inject.MemberPresence#markPresent} honours it — but
+     * a no-op, and {@link dev.ltms.bridged.inject.WorkerPresence#markPresent} honours it — but
     * {@code PresenceBridge} then forwards the same null here. Matching on a null id can never
     * succeed anyway (a registered session always has a terminal), so answer "no match" rather than
     * throwing: an NPE on this path takes down an unrelated tool call for the primary.
     */
-    private MemberSession findByTerminal(String terminalId) {
+    private WorkerSession findByTerminal(String terminalId) {
        if (terminalId == null) return null;
-        for (MemberSession s : registry.values()) {
+        for (WorkerSession s : registry.values()) {
            if (terminalId.equals(s.terminalId())) return s;
        }
        return null;
    }

-    private void transitionByTerminal(String terminalId, MemberSession.State from,
-                                      MemberSession.State to) {
-        MemberSession current = findByTerminal(terminalId);
+    private void transitionByTerminal(String terminalId, WorkerSession.State from,
+                                      WorkerSession.State to) {
+        WorkerSession current = findByTerminal(terminalId);
        if (current == null || current.state() != from) return;
        long now = nowNanos.getAsLong();
        if (replace(current, current.withState(to).withActivity(now))) {
@@ -770,12 +513,12 @@ public final class SessionManager implements TurnListener {
        }
    }

-    private boolean replace(MemberSession expected, MemberSession updated) {
+    private boolean replace(WorkerSession expected, WorkerSession updated) {
        return registry.replace(expected.paneId(), expected, updated);
    }

-    /** MemberPresence bridge that also drives the manager's READY transition. */
-    private static final class PresenceBridge extends MemberPresence {
+    /** WorkerPresence bridge that also drives the manager's READY transition. */
+    private static final class PresenceBridge extends WorkerPresence {
        private final SessionManager sessions;

        PresenceBridge(SessionManager sessions) {
@@ -0,0 +1,61 @@
+package dev.ltms.bridged.session;
+
+/**
+ * A bridge-owned worker session — the authoritative in-daemon record of a worker this
+ * process spawned. Immutable; state transitions are performed by replacing the record in
+ * {@link SessionManager}'s registry.
+ *
+ * @param paneId         the host-unique opaque id (CB-519) — the registry key and the argument to
+ *                       teardown. Despite the historical name this is the {@link
+ *                       dev.ltms.bridged.peer.PeerHandle#id()}, a UUID, and is distinct from the
+ *                       launcher-private herdr pane coordinate.
+ * @param terminalId     herdr terminal handle — the {@code target} for send/read/status
+ * @param profile        the worker profile name that spawned this session
+ * @param cwd            the resolved working directory the worker started in
+ * @param ownerTerminal  the caller that requested this worker ({@code null} = daemon/anon)
+ * @param spawnedAtNanos     {@link System#nanoTime()} when the session was registered
+ * @param lastActivityAtNanos {@link System#nanoTime()} of the most recent lifecycle event
+ * @param turnCount          number of delegated turns that have been delivered to this session
+ * @param state              current lifecycle state in the one-shot FSM
+ */
+public record WorkerSession(
+        String paneId,
+        String terminalId,
+        String profile,
+        String cwd,
+        String ownerTerminal,
+        long spawnedAtNanos,
+        long lastActivityAtNanos,
+        int turnCount,
+        State state,
+        String worktree,
+        String branch) {
+
+    /** One-shot worker lifecycle states. */
+    public enum State {
+        SPAWNING,
+        READY,
+        BUSY,
+        DONE,
+        FAILED,
+        RELEASED
+    }
+
+    /** Return a copy of this session in {@code state}. */
+    public WorkerSession withState(State state) {
+        return new WorkerSession(paneId, terminalId, profile, cwd, ownerTerminal, spawnedAtNanos,
+                lastActivityAtNanos, turnCount, state, worktree, branch);
+    }
+
+    /** Return a copy with {@code lastActivityAtNanos} updated to {@code nowNanos}. */
+    public WorkerSession withActivity(long nowNanos) {
+        return new WorkerSession(paneId, terminalId, profile, cwd, ownerTerminal, spawnedAtNanos,
+                nowNanos, turnCount, state, worktree, branch);
+    }
+
+    /** Return a copy with the turn count incremented and activity timestamped at {@code nowNanos}. */
+    public WorkerSession bumpTurn(long nowNanos) {
+        return new WorkerSession(paneId, terminalId, profile, cwd, ownerTerminal, spawnedAtNanos,
+                nowNanos, turnCount + 1, state, worktree, branch);
+    }
+}
@@ -1,7 +1,6 @@
 package dev.ltms.bridged.session;

 import java.util.List;
-import java.util.Optional;

 /** Seam between {@link SessionManager} and git worktree operations. Tests use a recording fake. */
 public interface Worktrees {
@@ -11,47 +10,9 @@ public interface Worktrees {
    /** git -C <repoRoot> worktree remove --force <path>. Idempotent (already-gone tolerated). */
    void remove(String repoRoot, String worktreePath);

-    /**
-     * True when the worktree holds uncommitted changes the bridge cannot see: tracked
-     * modifications, staged files, or untracked files. {@code git status --porcelain} is the
-     * test; an empty result means clean. Callers use this to decide whether removing the
-     * worktree would silently destroy a worker's only copy of its work.
-     *
-     * <p>An already-gone worktree is reported as clean (no throw), matching {@link #remove}'s
-     * idempotent contract: a path that does not exist holds no work to lose, and must not break
-     * a teardown that is mid-way through stopping the pane.
-     */
-    boolean hasUncommitted(String worktreePath);
-
    /** Copy each existing overlay path repoRoot→worktree; mark tracked ones --skip-worktree. */
    void overlayParity(String repoRoot, String worktreePath, List<String> overlay);

    /** git -C <cwd> rev-parse --show-toplevel — the repo root that owns cwd. */
    String repoRoot(String cwd);
-
-    /**
-     * Commit the worktree's full on-disk state — tracked and untracked, respecting
-     * {@code .gitignore} — to {@code refs/wip/<branch>}, so a release that would otherwise leave
-     * the work as loose, unprotected files has a durable git object to fall back on (CB-578 stage
-     * C). Built on a <em>temporary</em> index: the worker's own index, working tree, and HEAD are
-     * never touched, since the worker may still be mid-write. The commit is parented on the
-     * worktree's current HEAD.
-     *
-     * <p>Never writes under {@code refs/heads/} — the ref must not appear in {@code git branch},
-     * must not be pushed by default, and must not be swept by a later {@code git branch -d}.
-     *
-     * <p>Callers are expected to have already confirmed {@link #hasUncommitted} before reaching
-     * for this; it always stages and commits whatever {@code git add -A} finds, so calling it on
-     * a clean worktree still produces a (harmless, tree-identical-to-HEAD) commit rather than
-     * detecting cleanliness itself.
-     *
-     * @param worktreePath absolute path of the worktree to snapshot
-     * @param branch       the worktree's own branch — keys {@code refs/wip/<branch>}
-     * @param message      the commit message; should name the member, its branch, and the release
-     *                     cause so an operator can tell which run produced it
-     * @return the created commit's sha, or {@link Optional#empty()} if {@code worktreePath} does
-     *         not exist (mirrors {@link #remove} and {@link #hasUncommitted}'s already-gone
-     *         tolerance — a worktree that is gone holds nothing to snapshot)
-     */
-    Optional<String> snapshot(String worktreePath, String branch, String message);
 }
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.member;
+package dev.ltms.bridged.worker;

 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.guard.SubscriptionGuard;
@@ -16,7 +16,6 @@ import java.util.Set;
 import java.util.UUID;
 import java.util.function.Function;
 import java.util.function.LongSupplier;
-import java.util.function.Supplier;

 /**
 * The {@link HerdrPeerLauncher} adapter for <strong>Claude Code</strong> — the safe path from a
@@ -44,12 +43,29 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {

    private final SubscriptionGuard guard;

+    /**
+     * Standing instruction appended to the worker's system prompt so it returns its result via
+     * {@code bridge_reply}. Injected as a launch flag, so nothing is written to the worker's
+     * profile — it is guidance, and a worker that never replies is caught by the send's timeout.
+     */
+    static final String REPLY_CHARTER =
+            "You are an off-subscription worker in the claude-bridge fleet. Every message you "
+            + "receive arrives through the bridge, and the ONLY channel back to the sender is the "
+            + "bridge_reply MCP tool. Text you write in your terminal is NOT sent anywhere — the "
+            + "sender cannot see your screen, so an in-terminal answer is silently discarded. "
+            + "Therefore you MUST end EVERY turn by calling bridge_reply with `content` set to your "
+            + "complete response. This holds for every message without exception — tasks, questions, "
+            + "clarifications, acknowledgements, and ordinary back-and-forth conversation. Call "
+            + "bridge_reply exactly once, as the final action of your turn, with your full answer in "
+            + "`content`; never wait for confirmation first. If you end a turn without calling "
+            + "bridge_reply, the sender receives nothing and the exchange stalls.";
+
    /**
     * Production constructor — disables the spawn-ready gate ({@code spawnReadyTimeoutMs == 0}) so
     * existing deployments and tests keep the legacy non-blocking spawn semantics.
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
                              Function<String, String> env) {
        this(agents, spaces, guard, profiles, defaultProfile, env, 0,
                System::currentTimeMillis, () -> sleepUninterruptibly(300));
@@ -60,27 +76,12 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * until the pane reports an injectable state or {@code spawnReadyTimeoutMs} elapses.
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
                              Function<String, String> env,
                              long spawnReadyTimeoutMs, long spawnReadyPollMs) {
-        this(agents, spaces, guard, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, spawnReadyPollMs, null);
-    }
-
-    /**
-     * Production constructor carrying the fleet-wide tab-label template (CB-557). The template comes
-     * from {@code fleet.tabLabel}, which a profile cannot know because it names the member's
-     * <em>role</em>; a profile may still override it with its own {@code tabLabel}.
-     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
-                              Function<String, String> env,
-                              long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                              Supplier<BridgedConfig.Fleet> fleet) {
        this(agents, spaces, guard, profiles, defaultProfile, env,
                spawnReadyTimeoutMs,
-                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
-                fleet);
+                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs));
    }

    /**
@@ -101,28 +102,24 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     *                             (poll ms) is accepted for API symmetry but otherwise unused here
     */
    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                              Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
                              Function<String, String> env,
                              long spawnReadyTimeoutMs,
                              LongSupplier nowMillis, Runnable sleeper) {
-        this(agents, spaces, guard, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, nowMillis, sleeper, null);
+        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
+                spawnReadyTimeoutMs, nowMillis, sleeper);
+        this.guard = guard;
    }

    /**
-     * Full testability constructor, plus the fleet-wide tab-label template (CB-557).
+     * {@inheritDoc}
     *
-     * @param fleet live fleet config, read once for each spawn
+     * <p>A legacy spawn with no session identity is a fresh, launcher-derived session — delegate to
+     * the session-aware form with no name and no resume id.
     */
-    public ClaudeCodeLauncher(AgentControl agents, WorkspaceControl spaces, SubscriptionGuard guard,
-                              Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
-                              Function<String, String> env,
-                              long spawnReadyTimeoutMs,
-                              LongSupplier nowMillis, Runnable sleeper,
-                              Supplier<BridgedConfig.Fleet> fleet) {
-        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, nowMillis, sleeper, fleet);
-        this.guard = guard;
+    @Override
+    protected Launch buildLaunch(BridgedConfig.Worker cfg) {
+        return buildLaunch(cfg, null, null);
    }

    /**
@@ -135,7 +132,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * applied here — see {@link #applySessionIdentity}.
     */
    @Override
-    protected Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec) {
+    protected Launch buildLaunch(BridgedConfig.Worker cfg, String sessionName, String resumeSessionId) {
        // CB-539: a profile may deliberately opt into the subscription (subscription: true) when no
        // off-subscription endpoint exists for it — e.g. `sonnet` on `ccs`. That profile gets no
        // ANTHROPIC_BASE_URL/AUTH_TOKEN (there is nothing to point them at) and the guard's base_url
@@ -181,9 +178,9 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
        // id via -r and passes no --session-id (the two conflict). Both are injected before the
        // model flag so --model keeps outranking the operator's own argv.
        // mutableArgv: argvWithBridge may hand back the profile's own (immutable) List.of when it
-        // has neither MCP nor a charter — session flags must be added into a list we own.
-        List<String> argv = mutableArgv(argvWithBridge(cfg, spec.charter()));
-        String agentSessionId = applySessionIdentity(argv, spec.sessionName(), spec.resumeSessionId());
+        // has no MCP — session flags must be added into a list we own.
+        List<String> argv = mutableArgv(argvWithBridge(cfg));
+        String agentSessionId = applySessionIdentity(argv, sessionName, resumeSessionId);
        return new Launch(workerEnv, argvWithModel(argv, cfg), agentSessionId);
    }

@@ -217,26 +214,22 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
    }

    /**
-     * The launch argv, plus an inline {@code --mcp-config} when {@code worker.mcpUrl} is set and
-     * {@code --append-system-prompt} when the base composed a charter. Neither touches the profile's
-     * config; both are pure command-line flags. This inline-flag mount is Claude Code specific —
-     * other adapters mount MCP and instructions their own way.
+     * The launch argv, plus — when {@code worker.mcpUrl} is set — inline {@code --mcp-config} for
+     * the bridge server and {@code --append-system-prompt} for the {@link #REPLY_CHARTER}. Neither
+     * touches the profile's config; both are pure command-line flags. This inline-flag mount is
+     * Claude Code specific — other adapters mount MCP and instructions their own way.
     */
-    private List<String> argvWithBridge(BridgedConfig.Profile cfg, String charter) {
-        if (!cfg.hasMcp() && charter == null) {
+    private List<String> argvWithBridge(BridgedConfig.Worker cfg) {
+        if (!cfg.hasMcp()) {
            return cfg.argv();
        }
+        String mcpJson = "{\"mcpServers\":{\"bridge\":{\"type\":\"http\",\"url\":\""
+                + cfg.mcpUrl() + "\"}}}";
        List<String> argv = mutableArgv(cfg.argv());
-        if (cfg.hasMcp()) {
-            String mcpJson = "{\"mcpServers\":{\"bridge\":{\"type\":\"http\",\"url\":\""
-                    + cfg.mcpUrl() + "\"}}}";
-            argv.add("--mcp-config");
-            argv.add(mcpJson);
-        }
-        if (charter != null) {
-            argv.add("--append-system-prompt");
-            argv.add(charter);
-        }
+        argv.add("--mcp-config");
+        argv.add(mcpJson);
+        argv.add("--append-system-prompt");
+        argv.add(REPLY_CHARTER);
        return argv;
    }

@@ -256,7 +249,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
     * {@code gx10} does) are untouched — this adds nothing when there is nothing to add. This is
     * the {@code kind: claude} counterpart of the opencode adapter's {@code -m provider/model}.
     */
-    private static List<String> argvWithModel(List<String> argv, BridgedConfig.Profile cfg) {
+    private static List<String> argvWithModel(List<String> argv, BridgedConfig.Worker cfg) {
        if (cfg.model() == null || cfg.model().isBlank()) {
            return argv;
        }
@@ -309,7 +302,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {

    /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
    private boolean hasGitTokenProfile() {
-        return profileConfigs().stream().anyMatch(BridgedConfig.Profile::hasGitToken);
+        return profileConfigs().stream().anyMatch(BridgedConfig.Worker::hasGitToken);
    }

    // --- CB-117 reap predicate (Claude prefix), kept for direct unit testing -------------------
@@ -1,14 +1,12 @@
-package dev.ltms.bridged.member;
+package dev.ltms.bridged.worker;

 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.herdr.Agent;
 import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.MemberRole;
 import dev.ltms.bridged.peer.PeerHandle;
 import dev.ltms.bridged.peer.PeerLauncher;
 import dev.ltms.bridged.peer.PeerUnreachableException;
 import dev.ltms.bridged.peer.SpawnRequest;
-import dev.ltms.bridged.placement.BackendQuarantine;
 import dev.ltms.bridged.placement.PlacementCandidate;
 import dev.ltms.bridged.placement.PlacementContext;
 import dev.ltms.bridged.placement.PlacementException;
@@ -24,12 +22,9 @@ import java.util.HashSet;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Objects;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.function.Function;
-import java.util.function.Supplier;
-import java.util.stream.Collectors;

 /**
 * The {@link PeerLauncher} the core actually holds when more than one adapter is configured — a thin
@@ -69,28 +64,10 @@ public final class CompositePeerLauncher implements PeerLauncher {
    /** paneId → the delegate that spawned it, so {@link #stop} tears down through the right adapter. */
    private final Map<String, HerdrPeerLauncher> spawnedBy = new ConcurrentHashMap<>();

+    private final Map<String, BridgedConfig.Worker> profileConfigs;
+    private final PlacementPolicy placementPolicy;
    private final Function<String, Integer> liveCount;

-    /**
-     * CB-559: the placement inputs are read <em>per spawn</em>, not captured at construction, so a
-     * config reload changes where the next member lands without a restart. These are the hot keys —
-     * role pools, an existing profile's weight/maxLoad, and the placement policy. What cannot change
-     * this way is the set of adapters ({@link #byProfile}), because a new backend needs a launcher
-     * and launchers are built once; {@code ConfigRef} classifies that as deferred and says so.
-     */
-    private final Supplier<Map<String, BridgedConfig.Profile>> profileConfigs;
-    private final Supplier<PlacementPolicy> placementPolicy;
-
-    /** CB-578 stage B: credential cooldown, checked before an explicit spawn and filtered into placement. */
-    private final BackendQuarantine quarantine;
-
-    /**
-     * CB-557: the role pools an unqualified spawn draws its candidates from. A supplier that yields
-     * {@code null}, and an empty pool for a role, both fall back to every configured profile — the
-     * pre-CB-557 behaviour.
-     */
-    private final Supplier<BridgedConfig.Fleet> fleet;
-
    /**
     * Backward-compatible constructor: fixed placement, no live-counting. Use this for tests and
     * simple wiring; it preserves the pre-CB-518 behaviour exactly.
@@ -101,14 +78,11 @@ public final class CompositePeerLauncher implements PeerLauncher {
     * @throws IllegalArgumentException if {@code delegates} is empty or two adapters claim one profile
     */
    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates, String defaultProfile) {
-        this(delegates, defaultProfile, Map.of(), PlacementPolicies.fixed(), _ -> 0);
+        this(delegates, defaultProfile, Map.of(), PlacementPolicies.fixed(), name -> 0);
    }

    /**
-     * Production constructor with a placement policy and live-worker counter. Quarantine (CB-578
-     * stage B) is off for this constructor — {@link BackendQuarantine#none()} — since it predates
-     * the feature and existing callers of this exact overload never exercised it; use the 7-arg
-     * overload below to wire a real {@link BackendQuarantine}.
+     * Production constructor with a placement policy and live-worker counter.
     *
     * @param delegates      one adapter per configured peer kind; must be non-empty and declare
     *                       disjoint profile-name sets
@@ -119,89 +93,18 @@ public final class CompositePeerLauncher implements PeerLauncher {
     */
    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
                                 String defaultProfile,
-                                 Map<String, BridgedConfig.Profile> profileConfigs,
+                                 Map<String, BridgedConfig.Worker> profileConfigs,
                                 PlacementPolicy placementPolicy,
                                 Function<String, Integer> liveCount) {
-        this(delegates, defaultProfile, profileConfigs, placementPolicy, liveCount, null, BackendQuarantine.none());
-    }
-
-    /**
-     * Production constructor with role pools (CB-557). An unqualified spawn draws its candidates from
-     * {@code fleet.<role>} instead of from every configured profile, so a reviewer is placed on a
-     * reviewer backend and never on, say, the architect-only one. Quarantine is off for this
-     * constructor too, for the same reason as the 5-arg overload above.
-     *
-     * @param fleet the configured role pools; {@code null} ⇒ every profile is a candidate for every
-     *              role, which is the pre-CB-557 behaviour
-     */
-    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
-                                 String defaultProfile,
-                                 Map<String, BridgedConfig.Profile> profileConfigs,
-                                 PlacementPolicy placementPolicy,
-                                 Function<String, Integer> liveCount,
-                                 BridgedConfig.Fleet fleet) {
-        this(delegates, defaultProfile, profileConfigs, placementPolicy, liveCount, fleet, BackendQuarantine.none());
-    }
-
-    /**
-     * Production constructor with role pools and quarantine (CB-578 stage B). The full-featured
-     * non-reloading form; {@link #CompositePeerLauncher(List, String, Supplier, Function, BackendQuarantine)}
-     * is what {@code Bridged.main} actually wires up.
-     *
-     * @param quarantine required — pass {@link BackendQuarantine#none()} for a caller that does not
-     *                   want the feature, never a defaulting overload (CB-578 stage B's own rule).
-     */
-    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
-                                 String defaultProfile,
-                                 Map<String, BridgedConfig.Profile> profileConfigs,
-                                 PlacementPolicy placementPolicy,
-                                 Function<String, Integer> liveCount,
-                                 BridgedConfig.Fleet fleet,
-                                 BackendQuarantine quarantine) {
-        // LinkedHashMap, not Map.copyOf: candidates() promises definition order and the weighted
-        // policy breaks exact-weight ties on it, so a salted iteration order would make placement
-        // differ from one JVM run to the next.
-        this(delegates, defaultProfile,
-                constant(Collections.unmodifiableMap(new LinkedHashMap<>(profileConfigs))),
-                constant(placementPolicy), liveCount, constant(fleet), quarantine);
-    }
-
-    /**
-     * Production constructor that re-reads its placement inputs per spawn (CB-559), so a config
-     * reload retargets the next member without a restart.
-     *
-     * @param config     the live configuration — read at every spawn, never captured
-     * @param quarantine required — CB-578 stage B; pass {@link BackendQuarantine#none()} to opt out
-     */
-    public CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
-                                 String defaultProfile,
-                                 Supplier<BridgedConfig> config,
-                                 Function<String, Integer> liveCount,
-                                 BackendQuarantine quarantine) {
-        this(delegates, defaultProfile,
-                () -> config.get().profiles(),
-                () -> PlacementPolicies.fromName(config.get().placement()),
-                liveCount,
-                () -> config.get().fleet(),
-                quarantine);
-    }
-
-    /** The all-suppliers form every other constructor funnels into. */
-    private CompositePeerLauncher(List<HerdrPeerLauncher> delegates,
-                                  String defaultProfile,
-                                  Supplier<Map<String, BridgedConfig.Profile>> profileConfigs,
-                                  Supplier<PlacementPolicy> placementPolicy,
-                                  Function<String, Integer> liveCount,
-                                  Supplier<BridgedConfig.Fleet> fleet,
-                                  BackendQuarantine quarantine) {
-        this.fleet = fleet;
-        this.quarantine = Objects.requireNonNull(quarantine, "quarantine");
        if (delegates.isEmpty()) {
            throw new IllegalArgumentException("at least one peer adapter must be configured");
        }
        this.delegates = List.copyOf(delegates);
        this.defaultProfile = defaultProfile;
-        this.profileConfigs = profileConfigs;
+        // LinkedHashMap, not Map.copyOf: candidates() promises definition order and the weighted
+        // policy breaks exact-weight ties on it, so a salted iteration order would make placement
+        // differ from one JVM run to the next.
+        this.profileConfigs = Collections.unmodifiableMap(new LinkedHashMap<>(profileConfigs));
        this.placementPolicy = placementPolicy;
        this.liveCount = liveCount;
        Map<String, HerdrPeerLauncher> index = new LinkedHashMap<>();
@@ -218,22 +121,6 @@ public final class CompositePeerLauncher implements PeerLauncher {
        this.byProfile = Collections.unmodifiableMap(index);
    }

-    /** A supplier of a value fixed at construction — how the non-reloading constructors funnel in. */
-    private static <T> Supplier<T> constant(T value) {
-        return () -> value;
-    }
-
-    /**
-     * The currently-configured profiles, never null.
-     *
-     * <p>Read fresh on every call so a reload is visible; a caller that needs two consistent reads
-     * takes one local, as {@link #poolFor} does.
-     */
-    private Map<String, BridgedConfig.Profile> profiles0() {
-        Map<String, BridgedConfig.Profile> m = profileConfigs.get();
-        return m == null ? Map.of() : m;
-    }
-
    /** The adapter owning {@code profileName} (null/blank → the default). Throws on an unknown profile. */
    private HerdrPeerLauncher route(String profileName) {
        String resolved = (profileName == null || profileName.isBlank()) ? defaultProfile : profileName;
@@ -254,35 +141,30 @@ public final class CompositePeerLauncher implements PeerLauncher {
        String requestedProfile = req.profileName();
        if (requestedProfile != null && !requestedProfile.isBlank()) {
            // An explicit profile bypasses the placement policy, but not the capacity cap: maxLoad
-            // is documented as an unconditional limit on this profile (BridgedConfig.Profile), and
+            // is documented as an unconditional limit on this profile (BridgedConfig.Worker), and
            // the charter makes explicit-profile spawns the normal path — so skipping the check
            // here would leave the cap dead config in real operation.
            HerdrPeerLauncher d = route(requestedProfile);
-            enforceNotQuarantined(requestedProfile);
            enforceMaxLoad(requestedProfile);
            PeerHandle handle = d.spawn(req);
            spawnedBy.put(handle.id(), d);
            return handle;
        }

-        // CB-557: an unqualified spawn is placed inside the pool of the role it asked for, not across
-        // the whole profile list. An EXPLICIT profile (above) is left alone on purpose — it is the
-        // operator overriding, and refusing it would break `bridge_spawn{profile:"opus"}`, which
-        // carries no role and so would be judged against the dev pool it was never meant for.
-        List<PlacementCandidate> candidates = candidates(req.role());
-        String roleDefault = defaultProfileFor(req.role());
+        List<PlacementCandidate> candidates = candidates();
        Set<String> unreachable = new HashSet<>();
-        // CB-578 stage B: computed once up front — a quarantine's expiry cannot pass within one spawn
-        // call, so re-deriving it per retry would only cost work, never change the answer.
-        Set<String> quarantined = quarantinedProfiles(candidates);
-        PlacementContext ctx = new PlacementContext(roleDefault, candidates, liveCount, unreachable, quarantined);
+        PlacementContext ctx = new PlacementContext(defaultProfile, candidates, liveCount, unreachable);

        int maxAttempts = candidates.isEmpty() ? 1 : candidates.size();
        for (int attempt = 0; attempt < maxAttempts; attempt++) {
-            // Deliberately uncaught: when no candidate is left (all at cap, or all unreachable) the
-            // policy already throws a clear message. Catching it to rethrow a generic
-            // PeerUnreachableException would replace a precise diagnosis with a vague one.
-            PlacementCandidate chosen = placementPolicy.get().select(ctx);
+            PlacementCandidate chosen;
+            try {
+                chosen = placementPolicy.select(ctx);
+            } catch (RuntimeException e) {
+                // No candidate left (all at cap or all unreachable). The policy already threw a clear
+                // message; do not wrap it in a generic PeerUnreachableException.
+                throw e;
+            }

            HerdrPeerLauncher d = byProfile.get(chosen.profile());
            if (d == null) {
@@ -292,10 +174,9 @@ public final class CompositePeerLauncher implements PeerLauncher {
            }

            // CB-547a: route the chosen profile but keep the caller's session identity — dropping it
-            // here would silently sever the resume handle on every policy-routed spawn. CB-557: the
-            // role rides along for the same reason, or a routed spawn would be labelled as a dev.
+            // here would silently sever the resume handle on every policy-routed spawn.
            SpawnRequest routedReq = new SpawnRequest(chosen.profile(), req.requestedCwd(), req.callerCwd(),
-                    req.sessionName(), req.resumeSessionId(), req.role());
+                    req.sessionName(), req.resumeSessionId());
            try {
                PeerHandle handle = d.spawn(routedReq);
                spawnedBy.put(handle.id(), d);
@@ -305,7 +186,7 @@ public final class CompositePeerLauncher implements PeerLauncher {
                        chosen.profile(), e.getMessage());
                unreachable.add(chosen.profile());
                // Update the context for the next selection so the policy excludes this profile.
-                ctx = new PlacementContext(roleDefault, candidates, liveCount, unreachable, quarantined);
+                ctx = new PlacementContext(defaultProfile, candidates, liveCount, unreachable);
            }
        }

@@ -317,10 +198,10 @@ public final class CompositePeerLauncher implements PeerLauncher {
    /**
     * Refuse an explicit-profile spawn when the profile is at its {@code maxLoad} cap.
     *
-     * <p>maxLoad is a documented, unconditional capacity limit (see {@code BridgedConfig.Profile#maxLoad}),
+     * <p>maxLoad is a documented, unconditional capacity limit (see {@code BridgedConfig.Worker#maxLoad}),
     * and the charter makes explicit-profile spawns the normal path — so enforcing it only in placement
-     * ({@code PlacementPolicyUtil}, package-private, hence not linked) would leave the cap dead config
-     * on every call that names a profile. Same rule as placement: {@code live >= cap} is at capacity.
+     * ({@link dev.ltms.bridged.placement.PlacementPolicyUtil}) would leave the cap dead config on every
+     * call that names a profile. Same rule as placement: {@code live >= cap} is at capacity.
     *
     * <p>Deliberately no fallback to another profile: the caller named {@code profile} for a cost/model
     * reason, and silently re-routing a paid-tier (subscription) request elsewhere is worse than
@@ -335,49 +216,10 @@ public final class CompositePeerLauncher implements PeerLauncher {
     * @param profile the profile the caller explicitly named
     * @throws PlacementException when the profile is at capacity
     */
-    /**
-     * Refuse an explicit-profile spawn whose credential is quarantined (CB-578 stage B): a prior
-     * {@code BACKEND_EXHAUSTED} classification on this profile, or on another profile sharing its
-     * {@code credentialId}, is still on cooldown.
-     *
-     * <p>Checked before {@link #enforceMaxLoad}, and for the same reason that check exists: an
-     * explicit profile bypasses the placement policy's filtering entirely, so without this the cap
-     * (there, quarantine here) would be dead config on the very path the charter calls normal.
-     * Deliberately no fallback to another profile, matching {@link #enforceMaxLoad}'s own reasoning —
-     * the caller named this profile for a cost/model reason.
-     *
-     * @throws PlacementException naming the profile, its credential, and the remaining cooldown
-     */
-    private void enforceNotQuarantined(String profile) {
-        String credentialId = credentialIdFor(profile);
-        quarantine.remainingSeconds(credentialId).ifPresent(remaining -> {
-            throw new PlacementException("worker profile '" + profile + "' is quarantined "
-                    + "(credential '" + credentialId + "' exhausted; ~" + remaining
-                    + "s remaining) — refusing spawn");
-        });
-    }
-
-    /** {@code profile}'s credential group (CB-578 stage B), or the profile's own name if unconfigured. */
-    private String credentialIdFor(String profile) {
-        BridgedConfig.Profile cfg = profiles0().get(profile);
-        return cfg == null ? profile : cfg.effectiveCredentialId();
-    }
-
-    /** The subset of {@code candidates} whose credential is currently quarantined (CB-578 stage B). */
-    private Set<String> quarantinedProfiles(List<PlacementCandidate> candidates) {
-        return candidates.stream()
-                .map(PlacementCandidate::profile)
-                .filter(p -> quarantine.isQuarantined(credentialIdFor(p)))
-                .collect(Collectors.toSet());
-    }
-
    private void enforceMaxLoad(String profile) {
-        // Absent config, or a config whose maxLoad normalized to null (ABSENT ⇒ unlimited at load),
-        // means no cap — never cap what wasn't configured. Note "non-positive ⇒ unlimited" was true
-        // until CB-585: an explicit `maxLoad: 0` now survives as 0 and is a real cap of zero, so the
-        // check below refuses every spawn on that profile, and a negative value is refused at config
-        // load rather than normalized away.
-        BridgedConfig.Profile cfg = profiles0().get(profile);
+        // Absent config, or a config whose maxLoad normalized to null (non-positive ⇒ unlimited at
+        // load), means no cap — never cap what wasn't configured.
+        BridgedConfig.Worker cfg = profileConfigs.get(profile);
        Integer cap = (cfg == null) ? null : cfg.maxLoad();
        if (cap == null) {
            return;
@@ -389,36 +231,12 @@ public final class CompositePeerLauncher implements PeerLauncher {
        }
    }

-    /**
-     * The profile names {@code role} may be placed on, in definition order.
-     *
-     * <p>An empty or absent pool means "unconstrained", not "nothing allowed": a config that declares
-     * no pool for a role must keep spawning, so it falls back to every configured profile. Names in a
-     * pool that no adapter declares are dropped here rather than thrown — config load already rejects
-     * a pool entry with no profile, so a survivor is a profile this particular composite does not own.
-     */
-    private List<String> poolFor(MemberRole role) {
-        Map<String, BridgedConfig.Profile> configured = profiles0();
-        BridgedConfig.Fleet f = fleet.get();
-        List<String> pool = (f == null) ? List.of() : f.profilesFor(role);
-        List<String> known = pool.stream().filter(configured::containsKey).toList();
-        return known.isEmpty() ? List.copyOf(configured.keySet()) : known;
-    }
-
-    /** The profile an unqualified spawn for {@code role} falls back to under {@code fixed} placement. */
-    private String defaultProfileFor(MemberRole role) {
-        List<String> pool = poolFor(role);
-        return pool.isEmpty() ? defaultProfile : pool.getFirst();
-    }
-
-    /** Build the candidate list from {@code role}'s pool, in definition order. */
-    private List<PlacementCandidate> candidates(MemberRole role) {
+    /** Build the candidate list from the configured profiles, in definition order. */
+    private List<PlacementCandidate> candidates() {
        List<PlacementCandidate> out = new ArrayList<>();
-        for (String name : poolFor(role)) {
-            BridgedConfig.Profile w = profiles0().get(name);
-            if (w != null) {
-                out.add(new PlacementCandidate(name, null, w.weight(), w.maxLoad()));
-            }
+        for (Map.Entry<String, BridgedConfig.Worker> e : profileConfigs.entrySet()) {
+            BridgedConfig.Worker w = e.getValue();
+            out.add(new PlacementCandidate(e.getKey(), null, w.weight(), w.maxLoad()));
        }
        return out;
    }
@@ -463,18 +281,6 @@ public final class CompositePeerLauncher implements PeerLauncher {
        return defaultProfile;
    }

-    /**
-     * {@inheritDoc}
-     *
-     * <p>Routes to the specific delegate {@code profileName} resolves to, not the fleet-wide
-     * union {@link #capabilities()} returns — the whole reason this method exists (CB-584): in a
-     * mixed fleet, one adapter's capability must never be read as every profile's.
-     */
-    @Override
-    public Set<Capability> capabilitiesFor(String profileName) {
-        return route(profileName).capabilities();
-    }
-
    /** Every herdr agent, deduplicated by pane id (all delegates share one herdr and list globally). */
    @Override
    public List<Agent> list() {
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.member;
+package dev.ltms.bridged.worker;

 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.herdr.Agent;
@@ -7,9 +7,6 @@ import dev.ltms.bridged.herdr.HerdrException;
 import dev.ltms.bridged.herdr.Tab;
 import dev.ltms.bridged.herdr.Workspace;
 import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.CharterReceipt;
-import dev.ltms.bridged.peer.MemberRole;
 import dev.ltms.bridged.peer.PeerHandle;
 import dev.ltms.bridged.peer.PeerLauncher;
 import dev.ltms.bridged.peer.PeerUnreachableException;
@@ -31,7 +28,6 @@ import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicLong;
 import java.util.function.Function;
 import java.util.function.LongSupplier;
-import java.util.function.Supplier;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;

@@ -46,7 +42,7 @@ import java.util.regex.Pattern;
 *   <li>{@code namePrefix} (constructor arg) — the label prefix ({@code claude}, {@code opencode})
 *       that drives both unique naming and the orphan-reap pattern, so each adapter reaps only its
 *       own kind of pane and never another's.</li>
- *   <li>{@link #buildLaunch(BridgedConfig.Profile, LaunchSpec)} — the peer-specific env map + argv, including any
+ *   <li>{@link #buildLaunch(BridgedConfig.Worker)} — the peer-specific env map + argv, including any
 *       subscription/guard check, MCP mount, and instruction injection. The base never sees how the
 *       peer is configured; it only places and starts the returned {@link Launch}.</li>
 * </ul>
@@ -73,48 +69,13 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
    private final String namePrefix;                       // label prefix: naming + reap scheme
    private final AgentControl agents;
    private final WorkspaceControl spaces;
-    private final Map<String, BridgedConfig.Profile> profiles; // profile name → spawn settings
+    private final Map<String, BridgedConfig.Worker> profiles; // profile name → spawn settings
    private final String defaultProfile;                      // profile a no-arg spawn uses (nullable)

    /** Host env lookup (injectable for tests); adapters read it in {@link #buildLaunch}. */
    protected final Function<String, String> env;

-    private final AtomicLong nameSeq = new AtomicLong(); // per-peer counter (herdr agent names only)
-
-    /**
-     * Live fleet config, read once per spawn. A null supplier or value leaves tab labels at their
-     * default and supplies no role charter. A profile's own {@code tabLabel} still overrides it.
-     *
-     * <p>CB-559: a supplier rather than a snapshot, so a config reload affects the next launch
-     * without a restart. Existing tabs keep the label they were given.
-     */
-    private final Supplier<BridgedConfig.Fleet> fleet;
-
-    /** The final instruction always requires a bridge reply when the bridge MCP is mounted. */
-    protected static final String REPLY_CHARTER =
-            "You are a spawned member in the claude-bridge fleet. Every message you receive arrives "
-            + "through the bridge, and the ONLY channel back to the sender is the bridge_reply MCP tool. "
-            + "Text you write in your terminal is NOT sent anywhere — the sender cannot see your screen, "
-            + "so an in-terminal answer is silently discarded. Therefore you MUST end EVERY turn by calling "
-            + "bridge_reply with `content` set to your complete response. This holds for every message without "
-            + "exception — tasks, questions, clarifications, acknowledgements, and ordinary back-and-forth "
-            + "conversation. Call bridge_reply exactly once, as the final action of your turn, with your full "
-            + "answer in `content`; never wait for confirmation first. If you end a turn without calling "
-            + "bridge_reply, the sender receives nothing and the exchange stalls.";
-
-    /**
-     * Tab numbers, counted per {@code role/profile} pair (CB-557).
-     *
-     * <p>Deliberately not {@link #nameSeq}. That counter is shared by every profile this launcher
-     * serves, because its job is to make herdr <em>agent names</em> unique. Reusing it for the tab
-     * label made the numbers global, so sibling tabs read {@code #4}, {@code #9}, {@code #17} — gaps
-     * that look like a member died. Counting per role+profile makes {@code dev: sonnet #2} mean the
-     * second sonnet dev, which is what a reader assumes it means.
-     *
-     * <p>Resets when the daemon restarts, and that is fine: the label is a human-facing hint, not an
-     * identity. Identity is {@link PeerHandle#id()}.
-     */
-    private final ConcurrentMap<String, AtomicLong> labelSeq = new ConcurrentHashMap<>();
+    private final AtomicLong nameSeq = new AtomicLong(); // per-peer counter (also the tab #)

    private final long spawnReadyTimeoutMs; // 0 = disable gate (legacy non-blocking spawn)
    private final LongSupplier nowMillis; // monotonic clock (injectable for tests)
@@ -145,28 +106,10 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     *                            interval is baked into this hook, so the base needs no poll field
     */
    protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
-                                Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                                Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
                                Function<String, String> env,
                                long spawnReadyTimeoutMs,
                                LongSupplier nowMillis, Runnable sleeper) {
-        this(namePrefix, agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
-                nowMillis, sleeper, null);
-    }
-
-    /**
-     * As above, plus the live {@code fleet} config (CB-557).
-     *
-     * @param fleet live fleet config, read once per spawn; {@code null} ⇒ default tab label and no
-     *              role charter. A separate constructor rather than a new parameter on the one
-     *              above, so every existing call site keeps the default without an edit.
-     */
-    protected HerdrPeerLauncher(String namePrefix, AgentControl agents, WorkspaceControl spaces,
-                                Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
-                                Function<String, String> env,
-                                long spawnReadyTimeoutMs,
-                                LongSupplier nowMillis, Runnable sleeper,
-                                Supplier<BridgedConfig.Fleet> fleet) {
-        this.fleet = fleet;
        this.namePrefix = namePrefix;
        this.agents = agents;
        this.spaces = spaces;
@@ -185,7 +128,22 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * Any subscription/guard check, MCP mount, and instruction injection happen here. The env map
     * and argv are adapter-private; the base only places and starts what is returned.
     */
-    protected abstract Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec);
+    protected abstract Launch buildLaunch(BridgedConfig.Worker cfg);
+
+    /**
+     * Session-aware variant of {@link #buildLaunch(BridgedConfig.Worker)} (CB-547a). Default
+     * discards the session identity and delegates to the profile-only form, so an adapter that
+     * carries no durable peer session (opencode, say) inherits byte-identical behaviour and needs
+     * no change. An adapter that does (Claude Code) overrides this to mint/resume the id and to
+     * surface it on the returned {@link Launch#agentSessionId()}.
+     *
+     * @param cfg               the resolved profile to spawn
+     * @param sessionName       the bridge's logical session name, or null/blank for launcher-derived
+     * @param resumeSessionId   the peer's own prior session id to resume, or null/blank for fresh
+     */
+    protected Launch buildLaunch(BridgedConfig.Worker cfg, String sessionName, String resumeSessionId) {
+        return buildLaunch(cfg);
+    }

    /** Direct transport access for peer-specific, non-turn control operations. */
    protected final AgentControl agents() {
@@ -220,10 +178,6 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        }
    }

-    /** All per-spawn values adapters may need, including the base-composed effective charter. */
-    protected record LaunchSpec(String sessionName, String resumeSessionId, MemberRole role, String charter) {
-    }
-
    // --- profile surface -----------------------------------------------------------------------

    /** The configured peer profile names (what {@code spawn(profile)} accepts). */
@@ -239,7 +193,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        if (name == null || name.isBlank()) {
            return List.of();
        }
-        BridgedConfig.Profile cfg = profiles.get(name);
+        BridgedConfig.Worker cfg = profiles.get(name);
        return cfg == null ? List.of() : cfg.parityOverlay();
    }

@@ -249,32 +203,19 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        return defaultProfile;
    }

-    /**
-     * {@inheritDoc}
-     *
-     * <p>One {@link HerdrPeerLauncher} instance always serves exactly one adapter kind, so every
-     * profile it owns shares that adapter's {@link #capabilities()} — {@code profileName} only
-     * needs validating (throwing on an unknown profile, same as {@link #spawn}), not routing.
-     */
-    @Override
-    public Set<Capability> capabilitiesFor(String profileName) {
-        requireProfile(profileName);
-        return capabilities();
-    }
-
    /** The configured profiles, for adapter capability decisions (e.g. any git-token grant). */
-    protected Collection<BridgedConfig.Profile> profileConfigs() {
+    protected Collection<BridgedConfig.Worker> profileConfigs() {
        return profiles.values();
    }

    /** Resolve {@code profileName} (null/blank → default) to its config, or throw with the options. */
-    protected BridgedConfig.Profile requireProfile(String profileName) {
+    protected BridgedConfig.Worker requireProfile(String profileName) {
        String name = (profileName == null || profileName.isBlank()) ? defaultProfile : profileName;
        if (name == null || name.isBlank()) {
            throw new IllegalArgumentException("no default worker profile is configured — "
                    + "pass a profile; configured: " + profiles.keySet());
        }
-        BridgedConfig.Profile cfg = profiles.get(name);
+        BridgedConfig.Worker cfg = profiles.get(name);
        if (cfg == null) {
            throw new IllegalArgumentException("unknown worker profile '" + name
                    + "' — configured: " + profiles.keySet());
@@ -284,11 +225,8 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {

    // --- spawn ---------------------------------------------------------------------------------

-    /**
-     * A started peer plus the launch's agent-session id (the resume handle, or null) and the
-     * charter receipt (CB-571) the base composed for it.
-     */
-    private record Spawned(Agent agent, String agentSessionId, CharterReceipt receipt) {
+    /** A started peer plus the launch's agent-session id (the resume handle, or null). */
+    private record Spawned(Agent agent, String agentSessionId) {
    }

    /**
@@ -302,73 +240,21 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        return spawnInternal(profileName, requestedCwd, callerCwd, null, null).agent();
    }

-    /** Pre-CB-557 shape: no explicit role, so the tab is labelled as a {@code dev}. */
+    /**
+     * Spawn a peer with session identity (CB-547a). {@code sessionName} and {@code resumeSessionId}
+     * are threaded from the {@link SpawnRequest} into {@link #buildLaunch(BridgedConfig.Worker,
+     * String, String)}, and the launch's resolved agent-session id is returned alongside the agent
+     * so the caller can put it on the {@link PeerHandle}.
+     */
    protected Spawned spawnInternal(String profileName, String requestedCwd, String callerCwd,
                                    String sessionName, String resumeSessionId) {
-        return spawnInternal(profileName, requestedCwd, callerCwd, sessionName, resumeSessionId,
-                MemberRole.DEV);
-    }
-
-    /**
-     * Spawn a peer with session identity (CB-547a). The session values, role, and charter are
-     * threaded from the {@link SpawnRequest} into {@link #buildLaunch(BridgedConfig.Profile,
-     * LaunchSpec)}, and the launch's resolved agent-session id is returned alongside the agent so
-     * the caller can put it on the {@link PeerHandle}.
-     */
-    protected Spawned spawnInternal(String profileName, String requestedCwd, String callerCwd,
-                                    String sessionName, String resumeSessionId, MemberRole role) {
-        BridgedConfig.Profile cfg = requireProfile(profileName);
-        BridgedConfig.Fleet liveFleet = fleet == null ? null : fleet.get();
-        String roleCharter = liveFleet == null ? null : liveFleet.charterFor(role);
-        String replyCharter = cfg.hasMcp() ? REPLY_CHARTER : null;
-        String charter = roleCharter == null ? replyCharter
-                : replyCharter == null ? roleCharter : roleCharter + "\n\n" + replyCharter;
-        // CB-571: fingerprint the exact composed charter bytes once, here in the base, before the
-        // string leaves for an adapter — so Claude and OpenCode derive the same digest. A failed
-        // start has no bridge_spawn result and no roster row, so the failure log below is the only
-        // surface the byte count can appear on. The charter text itself is never logged.
-        CharterReceipt receipt = CharterReceipt.compose(role, cfg.profile(), roleCharter, charter);
-        try {
-            Launch launch = buildLaunch(cfg, new LaunchSpec(sessionName, resumeSessionId, role, charter));
-            String cwd = resolveCwd(requestedCwd, cfg, callerCwd);
-            Agent agent = cfg.tabPlacement()
-                    ? spawnInTab(cfg, launch.env(), launch.argv(), cwd, role, liveFleet)
-                    : spawnAsPane(cfg, launch.env(), launch.argv(), cwd, charter);
-            logCharterReceipt(receipt, true);
-            return new Spawned(agent, launch.agentSessionId(), receipt);
-        } catch (RuntimeException e) {
-            logCharterReceipt(receipt, false);
-            throw e;
-        }
-    }
-
-    /**
-     * The one place the charter's size and digest appear in the logs. {@code success} true after a
-     * start, false from the failure path of {@link #spawnInternal} where no handle or roster row
-     * exists to carry the receipt. Always metadata only — never the charter text.
-     */
-    private static void logCharterReceipt(CharterReceipt receipt, boolean success) {
-        String role = receipt.role() == null ? "" : receipt.role().wireName();
-        if (success) {
-            log.info("spawned role={} profile={} charterSource={} charterSha256={} charterBytes={}",
-                    role, receipt.profile(), receipt.charterSource(),
-                    receipt.charterSha256(), receipt.charterBytes());
-        } else {
-            log.warn("spawn failed; charter role={} profile={} charterSource={} charterSha256={} charterBytes={}",
-                    role, receipt.profile(), receipt.charterSource(),
-                    receipt.charterSha256(), receipt.charterBytes());
-        }
-    }
-
-    /**
-     * The next tab number for {@code role} on {@code profile}, starting at 1.
-     *
-     * <p>Starts at 1 rather than 0 because the number is read by a person: {@code "dev: sonnet #1"}
-     * is the first one, and {@code #0} invites the question of where {@code #1} went.
-     */
-    private long nextLabelSeq(MemberRole role, String profile) {
-        String key = (role == null ? "" : role.wireName()) + "/" + profile;
-        return labelSeq.computeIfAbsent(key, _ -> new AtomicLong()).incrementAndGet();
+        BridgedConfig.Worker cfg = requireProfile(profileName);
+        Launch launch = buildLaunch(cfg, sessionName, resumeSessionId);
+        String cwd = resolveCwd(requestedCwd, cfg, callerCwd);
+        Agent agent = cfg.tabPlacement()
+                ? spawnInTab(cfg, launch.env(), launch.argv(), cwd)
+                : spawnAsPane(cfg, launch.env(), launch.argv(), cwd);
+        return new Spawned(agent, launch.agentSessionId());
    }

    /**
@@ -386,7 +272,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
    @Override
    public PeerHandle spawn(SpawnRequest req) {
        Spawned spawned = spawnInternal(req.profileName(), req.requestedCwd(), req.callerCwd(),
-                req.sessionName(), req.resumeSessionId(), req.role());
+                req.sessionName(), req.resumeSessionId());
        Agent agent = spawned.agent();
        String paneId = agent.paneId();
        if (spawnReadyTimeoutMs > 0) {
@@ -396,7 +282,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        String id = UUID.randomUUID().toString();
        paneByAgentId.put(id, paneId);
        return new WorkerHandle(id, agent.terminalId(), requireProfile(req.profileName()).profile(),
-                req.sessionName(), spawned.agentSessionId(), spawned.receipt());
+                req.sessionName(), spawned.agentSessionId());
    }

    @Override
@@ -418,7 +304,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * guaranteed last resort so a pathological environment with an unset {@code user.dir} still
     * honours the "never assume {@code $HOME}" contract rather than letting herdr default the pane.
     */
-    private static String resolveCwd(String requestedCwd, BridgedConfig.Profile cfg, String callerCwd) {
+    private static String resolveCwd(String requestedCwd, BridgedConfig.Worker cfg, String callerCwd) {
        return firstNonBlank(requestedCwd, cfg.cwd(), callerCwd, System.getProperty("user.dir"), ".");
    }

@@ -430,8 +316,8 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
    }

    /** Dedicated worker space → own tab (carrying cwd+env) → start the peer into the seed pane. */
-    private Agent spawnInTab(BridgedConfig.Profile cfg, Map<String, String> workerEnv,
-                             List<String> argv, String cwd, MemberRole role, BridgedConfig.Fleet liveFleet) {
+    private Agent spawnInTab(BridgedConfig.Worker cfg, Map<String, String> workerEnv,
+                             List<String> argv, String cwd) {
        Workspace space = spaces.ensureWorkspace(cfg.workspace());
        Tab.Created tab = spaces.createTab(space.workspaceId(), cwd, workerEnv);
        log.info("spawning {} profile={} space={} tab={} cwd={}",
@@ -462,10 +348,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        // Labelling is cosmetic: it must not fail the spawn or orphan the running peer — on error
        // we log and still return it so the caller gets its paneId and can tear it down.
        tidy("label tab " + tab.tab().tabId(),
-                () -> spaces.renameTab(tab.tab().tabId(),
-                        cfg.renderTabLabel(
-                                liveFleet == null ? null : liveFleet.tabLabel(),
-                                role, nextLabelSeq(role, cfg.profile()))));
+                () -> spaces.renameTab(tab.tab().tabId(), cfg.renderTabLabel(started.seq())));
        log.info("{} started pane={} tab={} terminal={}",
                namePrefix, started.agent().paneId(), started.agent().tabId(), started.agent().terminalId());
        return started.agent();
@@ -480,19 +363,11 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        }
    }

-    /**
-     * Legacy placement: split the currently-focused tab; the peer still starts in {@code cwd}.
-     *
-     * <p>CB-571: this is the one legacy log that printed the full argv, and the charter travels
-     * inside argv — so the charter text went to the daemon log on every pane-placement spawn. The
-     * {@code spawnInTab} path never logs argv, so only this site is fixed. {@code charter} is the
-     * composed charter, if any; its argv element is replaced by its digest so the log still shows
-     * which args were passed without exposing the charter prose.
-     */
-    private Agent spawnAsPane(BridgedConfig.Profile cfg, Map<String, String> workerEnv,
-                              List<String> argv, String cwd, String charter) {
+    /** Legacy placement: split the currently-focused tab; the peer still starts in {@code cwd}. */
+    private Agent spawnAsPane(BridgedConfig.Worker cfg, Map<String, String> workerEnv,
+                              List<String> argv, String cwd) {
        log.info("spawning {} (pane placement) profile={} cwd={} argv={}",
-                namePrefix, cfg.profile(), cwd, redactCharter(argv, charter));
+                namePrefix, cfg.profile(), cwd, argv);
        String paneId = spaces.splitPane(cwd, workerEnv);
        if (paneId == null) {
            throw new IllegalStateException("pane.split returned no pane — cannot start a peer");
@@ -502,21 +377,6 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        return peer;
    }

-    /**
-     * A copy of {@code argv} with an element equal to {@code charter} replaced by its digest, so
-     * the pane log never prints the charter prose. The charter is handed to an adapter as one argv
-     * element, so exact-equality is the right match; every other argument passes through unchanged.
-     */
-    private static List<String> redactCharter(List<String> argv, String charter) {
-        if (charter == null || charter.isBlank() || argv == null || argv.isEmpty()) {
-            return argv;
-        }
-        String digest = CharterReceipt.digestOf(charter);
-        return argv.stream()
-                .map(a -> a.equals(charter) ? "<charter sha256=" + digest + ">" : a)
-                .toList();
-    }
-
    /** A started peer together with the sequence its unique name/label used. */
    private record Started(Agent agent, long seq) {
    }
@@ -531,7 +391,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * backstop for the astronomically unlikely nonce+seq clash; the name is a label only — herdr
     * detects kind and status from terminal output, not from it.
     */
-    private Started startUniquelyNamed(BridgedConfig.Profile cfg, List<String> argv, String paneId) {
+    private Started startUniquelyNamed(BridgedConfig.Worker cfg, List<String> argv, String paneId) {
        // Protocol 19 resolves the executable from the agent kind (== namePrefix here), so
        // argv[0] — the configured executable — is dropped and only the extra args are passed.
        List<String> args = argv.isEmpty() ? argv : argv.subList(1, argv.size());
@@ -689,7 +549,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {

    /** Whether any configured profile places peers in their own tab (so tabs may need cleanup). */
    private boolean usesTabPlacement() {
-        return profiles.values().stream().anyMatch(BridgedConfig.Profile::tabPlacement);
+        return profiles.values().stream().anyMatch(BridgedConfig.Worker::tabPlacement);
    }

    /** True when a herdr error means the target is already gone (safe to treat as done). */
@@ -721,18 +581,11 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {

    /**
     * A concrete {@link PeerHandle} wrapping herdr agent coordinates, the profile that spawned it,
-     * the session identity the launch resolved (CB-547a): the bridge's logical name and the peer's
-     * own session id, both null when the spawn carried no identity — and the charter receipt
-     * (CB-571) the base computed for this launch.
+     * and the session identity the launch resolved (CB-547a): the bridge's logical name and the
+     * peer's own session id, both null when the spawn carried no identity.
     */
    private record WorkerHandle(String id, String terminalId, String profile,
-                                String sessionName, String agentSessionId,
-                                CharterReceipt receipt) implements PeerHandle {
-
-        @Override
-        public CharterReceipt charterReceipt() {
-            return receipt;
-        }
+                                String sessionName, String agentSessionId) implements PeerHandle {
    }

    // --- shared helpers ------------------------------------------------------------------------
@@ -755,7 +608,7 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * {@code GITEA_HOST}. Push over SSH is unaffected; the only incremental grant is PR-create.
     * Peer-neutral, so every herdr adapter reuses it unchanged.
     */
-    protected void applyGitToken(Map<String, String> workerEnv, BridgedConfig.Profile cfg) {
+    protected void applyGitToken(Map<String, String> workerEnv, BridgedConfig.Worker cfg) {
        if (!cfg.hasGitToken()) {
            return;
        }
@@ -766,61 +619,10 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        }
    }

-    /**
-     * CB-592: overlay value that shadows the admin {@code GITEA_ACCESS_TOKEN} a herdr pane
-     * otherwise inherits from herdr's own login-shell process environment (gitea issue #77).
-     * herdr spawns a pane from its <em>own</em> process environment and layers our map on top —
-     * {@link dev.ltms.bridged.herdr.WorkspaceControl#createTab} and {@code #splitPane} send only
-     * the keys we put in that map, so any key we never mention passes straight through from
-     * herdr's own shell, admin token included.
-     *
-     * <p>Deliberately a non-blank sentinel, not {@code ""}. Whether an empty-string overlay value
-     * overrides an inherited variable or is skipped as blank could not be settled by reading this
-     * codebase — herdr's server-side merge is an external process, not something in this repo.
-     * A non-blank replacement sidesteps that ambiguity entirely: {@link #baseEnv}'s own {@code
-     * PATH} seeding already depends on the overlay reliably replacing an inherited value (see its
-     * javadoc), and that is only demonstrated for a non-blank value, so this reuses the same,
-     * proven-reliable shape rather than the unverified one.
-     *
-     * <p><b>MEASURED ON A LIVE PANE, 2026-08-15: this sentinel alone does NOT hold.</b> The overlay
-     * itself works — {@code GITEA_TOKEN} is injected here, is exported by no shell file, and does
-     * reach the pane. The sentinel loses one step later. A herdr pane runs a <em>login</em> shell,
-     * {@code ~/.zprofile} sources {@code ${SHARED_ENV}/tools/secrets.sh}, and that file does a plain
-     * unconditional {@code export GITEA_ACCESS_TOKEN=...}. A login shell overwrites a value already
-     * in the environment, so the real admin token is put back over this sentinel before the member
-     * process ever starts. That defeat applies to <em>every</em> name {@code secrets.sh} exports,
-     * and no launcher-side overlay can win against it.
-     *
-     * <p>So this constant is not the control on its own — {@link #MEMBER_MARKER} is the other half.
-     * Keeping the sentinel is still worth it: it is correct for any peer kind whose pane does not
-     * start a login shell, and it makes the intent explicit at the one place every adapter passes.
-     */
-    private static final String BLOCKED_GITEA_ACCESS_TOKEN =
-            "blocked-by-bridged-cb592-see-gitea-issue-77";
-
-    /**
-     * CB-592: marks a pane as a bridged member so a shell startup file can decline to export
-     * operator-only credentials into it (gitea issue #77).
-     *
-     * <p>This name is deliberately one that {@code secrets.sh} never exports, which is exactly why
-     * it survives the login shell that wipes {@link #BLOCKED_GITEA_ACCESS_TOKEN}. The mechanism is
-     * measured, not assumed: {@code GITEA_TOKEN} is injected the same way, is absent from a login
-     * shell of its own, and was observed set inside a live member pane.
-     *
-     * <p>It is a no-op until the operator guards the export, which is a one-line change in a file
-     * this repo does not own and must not edit unasked:
-     *
-     * <pre>{@code
-     * [ -n "${BRIDGED_MEMBER:-}" ] || export GITEA_ACCESS_TOKEN=...
-     * }</pre>
-     *
-     * <p>Setting the marker now costs nothing and means that edit is the whole remaining fix.
-     */
-    static final String MEMBER_MARKER = "BRIDGED_MEMBER";
-
+    /** A fresh mutable env map — the conventional starting point for {@link #buildLaunch}. */
    /**
     * Seed a worker's environment (CB-511): the daemon's own {@code PATH}, then the profile's
-     * {@code env:} entries, then the CB-592 admin-token shadow.
+     * {@code env:} entries.
     *
     * <p>Why this exists: bridged passes herdr an explicit env map, and herdr merges it into
     * <em>its own</em> process environment. So before this, a worker inherited whatever PATH the
@@ -834,14 +636,8 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
     * overriding {@code ANTHROPIC_BASE_URL} and slipping past {@link
     * dev.ltms.bridged.guard.SubscriptionGuard}, which is checked against the profile's
     * {@code baseUrl} and nothing else.
-     *
-     * <p>The CB-592 shadow and marker are put in <em>last</em>, after the profile's own
-     * {@code env:}, so no profile — present or future — can restore the admin token, or hide that
-     * the pane is a member, by naming either in config. This is the one place both are applied:
-     * every {@code buildLaunch} in every adapter calls this first, so a new profile, and a peer
-     * kind not yet written, gets them for free.
     */
-    protected Map<String, String> baseEnv(BridgedConfig.Profile cfg) {
+    protected Map<String, String> baseEnv(BridgedConfig.Worker cfg) {
        Map<String, String> workerEnv = new LinkedHashMap<>();
        String path = env.apply("PATH");
        if (path != null && !path.isBlank()) {
@@ -850,8 +646,6 @@ public abstract class HerdrPeerLauncher implements PeerLauncher {
        if (cfg != null && cfg.env() != null) {
            workerEnv.putAll(cfg.env());
        }
-        workerEnv.put("GITEA_ACCESS_TOKEN", BLOCKED_GITEA_ACCESS_TOKEN);
-        workerEnv.put(MEMBER_MARKER, "1");
        return workerEnv;
    }

@@ -1,4 +1,4 @@
-package dev.ltms.bridged.member;
+package dev.ltms.bridged.worker;

 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.ObjectNode;
@@ -7,7 +7,6 @@ import dev.ltms.bridged.herdr.Agent;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.CharterReceipt;
 import dev.ltms.bridged.peer.PeerHandle;
 import dev.ltms.bridged.peer.SpawnRequest;

@@ -21,7 +20,6 @@ import java.util.Map;
 import java.util.Set;
 import java.util.function.Function;
 import java.util.function.LongSupplier;
-import java.util.function.Supplier;

 /**
 * The {@link HerdrPeerLauncher} adapter for <strong>opencode</strong> — an open-source,
@@ -39,7 +37,7 @@ import java.util.function.Supplier;
 *   <li><strong>File-based MCP mount + instructions.</strong> opencode has no inline
 *       {@code --mcp-config}/{@code --append-system-prompt}. Instead the bridge writes an ephemeral
 *       {@code opencode.json} that declares the bridge as a {@code remote} MCP server and lists a
- *       member-charter file under {@code instructions}, then points the worker at it with
+ *       reply-charter file under {@code instructions}, then points the worker at it with
 *       {@code OPENCODE_CONFIG}. This is the one place the launcher touches disk — Claude never did.</li>
 *   <li><strong>Model as a flag.</strong> the {@code provider/model} selector is passed as
 *       {@code -m}, not an env var.</li>
@@ -55,9 +53,38 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
    /** Writer for the generated {@code opencode.json}. */
    private static final ObjectMapper JSON = new ObjectMapper();

+    /**
+     * Standing instruction written to the charter file and mounted via the config's
+     * {@code instructions} so the worker returns its result through {@code bridge_reply}. Kept on
+     * disk (not a launch flag) because opencode's {@code instructions} takes file paths, not inline
+     * text — the file is regenerated per spawn and never touches the worker's own profile.
+     */
+    static final String REPLY_CHARTER =
+            "You are an off-subscription worker in the claude-bridge fleet, running under opencode. "
+            + "Every message you receive arrives through the bridge, and the ONLY channel back to the "
+            + "sender is the bridge_reply MCP tool. Text you write in your terminal is NOT sent "
+            + "anywhere — the sender cannot see your screen, so an in-terminal answer is silently "
+            + "discarded. Therefore you MUST end EVERY turn by calling bridge_reply with `content` set "
+            + "to your complete response. This holds for every message without exception — tasks, "
+            + "questions, clarifications, acknowledgements, and ordinary back-and-forth conversation. "
+            + "Call bridge_reply exactly once, as the final action of your turn, with your full answer "
+            + "in `content`; never wait for confirmation first. If you end a turn without calling "
+            + "bridge_reply, the sender receives nothing and the exchange stalls.";
+
    /** Root under which per-spawn opencode config dirs are created (injectable for tests). */
    private final Path configRoot;

+    /**
+     * The current spawn's resume-target session id, threaded from {@link #spawn(SpawnRequest)} to
+     * {@link #buildLaunch} across the base's {@code spawn -> spawnInternal -> buildLaunch} chain,
+     * which carries no request. A plain field would race under concurrent spawns (the base supports
+     * them), so it is thread-local: each spawn captures its own request's id on its own thread, and
+     * {@code buildLaunch}, synchronous and same-thread, reads exactly that one. Set only around the
+     * {@code super.spawn} call and cleared in {@code finally}, so a paused/leftover value can never
+     * bleed into the next spawn.
+     */
+    private final ThreadLocal<String> resumeSessionId = new ThreadLocal<>();
+
    /**
     * Session discovery against opencode's on-disk storage ({@link OpenCodeSessionDiscovery}) —
     * the one seam that knows opencode's private session-file layout. Its root is injectable for
@@ -70,7 +97,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * matches the legacy non-blocking spawn semantics. Config dirs are created under the JVM temp dir.
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
                            Function<String, String> env) {
        this(agents, spaces, profiles, defaultProfile, env, 0,
                System::currentTimeMillis, () -> sleepUninterruptibly(300),
@@ -82,26 +109,12 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * the pane reports an injectable state or {@code spawnReadyTimeoutMs} elapses.
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
                            Function<String, String> env,
                            long spawnReadyTimeoutMs, long spawnReadyPollMs) {
-        this(agents, spaces, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, spawnReadyPollMs, null);
-    }
-
-    /**
-     * Production constructor carrying the fleet-wide tab-label template (CB-557). The template comes
-     * from {@code fleet.tabLabel}, which a profile cannot know because it names the member's
-     * <em>role</em>; a profile may still override it with its own {@code tabLabel}.
-     */
-    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
-                            Function<String, String> env,
-                            long spawnReadyTimeoutMs, long spawnReadyPollMs,
-                            Supplier<BridgedConfig.Fleet> fleet) {
        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
                System::currentTimeMillis, () -> sleepUninterruptibly(spawnReadyPollMs),
-                defaultConfigRoot(), defaultDiscoveryRoot(), fleet);
+                defaultConfigRoot(), defaultDiscoveryRoot());
    }

    /**
@@ -124,29 +137,13 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     *                            {@link OpenCodeSessionDiscovery})
     */
    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                            Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
                            Function<String, String> env,
                            long spawnReadyTimeoutMs,
                            LongSupplier nowMillis, Runnable sleeper,
                            Path configRoot, Path discoveryRoot) {
-        this(agents, spaces, profiles, defaultProfile, env, spawnReadyTimeoutMs,
-                nowMillis, sleeper, configRoot, discoveryRoot, null);
-    }
-
-    /**
-     * Full testability constructor, plus the fleet-wide tab-label template (CB-557).
-     *
-     * @param fleet live fleet config, read once for each spawn
-     */
-    public OpenCodeLauncher(AgentControl agents, WorkspaceControl spaces,
-                            Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
-                            Function<String, String> env,
-                            long spawnReadyTimeoutMs,
-                            LongSupplier nowMillis, Runnable sleeper,
-                            Path configRoot, Path discoveryRoot,
-                            Supplier<BridgedConfig.Fleet> fleet) {
        super(NAME_PREFIX, agents, spaces, profiles, defaultProfile, env,
-                spawnReadyTimeoutMs, nowMillis, sleeper, fleet);
+                spawnReadyTimeoutMs, nowMillis, sleeper);
        this.configRoot = configRoot;
        this.discovery = new OpenCodeSessionDiscovery(discoveryRoot);
    }
@@ -164,21 +161,20 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * {@inheritDoc}
     *
     * <p>Builds the opencode launch: no {@code ANTHROPIC_*} and no guard (opencode reads its own
-     * provider credentials); when the profile mounts the bridge MCP or has a member charter,
-     * generate an ephemeral {@code opencode.json} (remote MCP server + member-charter instructions)
-     * and point the worker at it via {@code OPENCODE_CONFIG}; carry the parity-neutral git-forge
-     * grant; and select the model with {@code -m}.
+     * provider credentials); when the profile mounts the bridge MCP, generate an ephemeral
+     * {@code opencode.json} (remote MCP server + reply-charter instructions) and point the worker at
+     * it via {@code OPENCODE_CONFIG}; carry the parity-neutral git-forge grant; and select the model
+     * with {@code -m}.
     */
    @Override
-    protected Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec) {
+    protected Launch buildLaunch(BridgedConfig.Worker cfg) {
        Map<String, String> workerEnv = baseEnv(cfg);
-        // A config file is needed for the bridge MCP mount, a member charter, or a pinned endpoint (CB-508).
-        if (cfg.hasMcp() || spec.charter() != null || hasCustomProvider(cfg)) {
-            workerEnv.put("OPENCODE_CONFIG", writeConfig(cfg, spec.charter()).toString());
+        // A config file is needed for the bridge MCP mount, for a pinned endpoint (CB-508), or both.
+        if (cfg.hasMcp() || hasCustomProvider(cfg)) {
+            workerEnv.put("OPENCODE_CONFIG", writeConfig(cfg).toString());
        }
        applyGitToken(workerEnv, cfg);
-        return new Launch(workerEnv,
-                argvWithResume(argvWithModel(argvWithAuto(cfg), cfg), spec.resumeSessionId()));
+        return new Launch(workerEnv, argvWithResume(argvWithModel(argvWithAuto(cfg), cfg)));
    }

    /**
@@ -191,7 +187,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * primary's Anthropic subscription, and an opencode process has no Anthropic credential path
     * at all. Pointing it at a local vLLM cannot leak the subscription.
     */
-    private static boolean hasCustomProvider(BridgedConfig.Profile cfg) {
+    private static boolean hasCustomProvider(BridgedConfig.Worker cfg) {
        return cfg.baseUrl() != null && !cfg.baseUrl().isBlank();
    }

@@ -205,7 +201,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * own git worktree on its own branch, is off-subscription, and cannot merge — the lead is the
     * gate.
     */
-    private List<String> argvWithAuto(BridgedConfig.Profile cfg) {
+    private List<String> argvWithAuto(BridgedConfig.Worker cfg) {
        List<String> argv = mutableArgv(cfg.argv());
        argv.add("--auto");
        return argv;
@@ -215,9 +211,11 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * The launch argv plus, on a resumed spawn, opencode's {@code -s <id>} flag to continue a prior
     * conversation by its session id. {@code -s, --session <id>} resumes an existing session; on a
     * fresh spawn (no resume target) no flag is added, letting opencode start a brand-new session.
-     * The id comes from the base launch spec.
+     * The id comes from the current spawn request's {@code resumeSessionId}, threaded per-thread by
+     * {@link #spawn(SpawnRequest)}.
     */
-    private List<String> argvWithResume(List<String> argv, String id) {
+    private List<String> argvWithResume(List<String> argv) {
+        String id = resumeSessionId.get();
        if (id == null || id.isBlank()) {
            return argv;
        }
@@ -228,7 +226,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
    }

    /** The launch argv plus, when a model is configured, the opencode {@code -m provider/model} flag. */
-    private List<String> argvWithModel(List<String> argv, BridgedConfig.Profile cfg) {
+    private List<String> argvWithModel(List<String> argv, BridgedConfig.Worker cfg) {
        if (cfg.model() != null && !cfg.model().isBlank()) {
            argv.add("-m");
            argv.add(cfg.model());
@@ -237,47 +235,29 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
    }

    /**
-     * Write an ephemeral {@code opencode.json} (and the member-charter file it references) into a
+     * Write an ephemeral {@code opencode.json} (and the reply-charter file it references) into a
     * fresh per-spawn directory under {@link #configRoot}, and return the config file's path for
     * {@code OPENCODE_CONFIG}. The dir is unique per spawn so concurrent workers never race on it;
     * it is best-effort cleaned on JVM exit (worker config is disposable — regenerated every spawn).
     */
-    private Path writeConfig(BridgedConfig.Profile cfg, String charterText) {
+    private Path writeConfig(BridgedConfig.Worker cfg) {
        try {
            Path dir = Files.createTempDirectory(configRoot, "bridged-opencode-");
            dir.toFile().deleteOnExit();

            ObjectNode root = JSON.createObjectNode();
            root.put("$schema", "https://opencode.ai/config.json");
-            // CB-523, opencode side: a worker that runs out of context dies mid-turn, and its reply
-            // — the entire point of the turn — is lost with it. Auto-compaction is therefore not an
-            // operator preference for a bridged worker, it is a condition of the turn contract.
-            //
-            // Stated deliberately even though it is redundant today: OPENCODE_CONFIG is MERGED over
-            // ~/.config/opencode/config.json rather than replacing it, so a worker already inherits
-            // an `auto: true` set at home. We do not want that inheritance to be what the guarantee
-            // rests on — the home file is outside this repo, differs per machine, and is not ours.
-            //
-            // Know the cost before removing it: this key WINS over the home config (verified — an
-            // OPENCODE_CONFIG value overrides the home value, it does not defer to it), so an
-            // operator who sets `compaction.auto: false` at home cannot turn it off for bridged
-            // workers. That is the intended trade for peers we spawn and whose turns we must land;
-            // if per-profile control is ever wanted, add a profile knob rather than dropping this.
-            root.putObject("compaction").put("auto", true);
-
-            if (charterText != null) {
-                Path charter = dir.resolve("member-charter.md");
-                Files.writeString(charter, charterText);
-                charter.toFile().deleteOnExit();
-
-                root.putArray("instructions").add(charter.toAbsolutePath().toString());
-            }

            if (cfg.hasMcp()) {
+                Path charter = dir.resolve("reply-charter.md");
+                Files.writeString(charter, REPLY_CHARTER);
+                charter.toFile().deleteOnExit();
+
                ObjectNode bridge = root.putObject("mcp").putObject("bridge");
                bridge.put("type", "remote");
                bridge.put("url", cfg.mcpUrl());
                bridge.put("enabled", true);
+                root.putArray("instructions").add(charter.toAbsolutePath().toString());
            }
            if (hasCustomProvider(cfg)) {
                addCustomProvider(root, cfg);
@@ -302,7 +282,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * <p>The provider id comes from the {@code provider/model} selector in {@code model:}, so one
     * field drives both the declaration and the {@code -m} flag and they cannot drift apart.
     */
-    private void addCustomProvider(ObjectNode root, BridgedConfig.Profile cfg) {
+    private void addCustomProvider(ObjectNode root, BridgedConfig.Worker cfg) {
        String[] parts = splitModelSelector(cfg);
        String providerId = parts[0];
        String modelId = parts[1];
@@ -325,7 +305,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
     * needs both, so a bare model name is rejected loudly rather than silently falling back to the
     * default gateway — a worker quietly talking to the wrong endpoint is the failure this avoids.
     */
-    private static String[] splitModelSelector(BridgedConfig.Profile cfg) {
+    private static String[] splitModelSelector(BridgedConfig.Worker cfg) {
        String model = cfg.model();
        int slash = model == null ? -1 : model.indexOf('/');
        if (model == null || model.isBlank() || slash <= 0 || slash == model.length() - 1) {
@@ -353,11 +333,31 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
        return afterScheme.contains("/") ? trimmed : trimmed + "/v1";
    }

-    /** Add lazy on-disk session discovery to the base handle. */
+    /**
+     * {@inheritDoc}
+     *
+     * <p>adds this adapter's session-identity work around the base's spawn — as opencode cannot be
+     * told its session id at spawn (see {@link Capability#SESSION_RESUME} vs
+     * {@link Capability#SESSION_NAME}), identity is only ever adopted after the fact:
+     * <ul>
+     *   <li>the request's {@code resumeSessionId} is remembered for {@link #buildLaunch} to turn
+     *       into {@code -s <id>}; and</li>
+     *   <li>the returned handle is wrapped so its
+     *       {@link dev.ltms.bridged.peer.PeerHandle#agentSessionId()} performs lazy session
+     *       discovery against opencode's storage (see {@link OpenCodeSessionDiscovery}) — always
+     *       non-blocking, {@code null} until opencode has persisted the session record.</li>
+     * </ul>
+     */
    @Override
    public PeerHandle spawn(SpawnRequest req) {
-        PeerHandle inner = super.spawn(req);
-        return new SessionAwareHandle(inner, discovery, effectiveCwd(req));
+        resumeSessionId.set(req.resumeSessionId());
+        try {
+            PeerHandle inner = super.spawn(req);
+            return new SessionAwareHandle(inner, discovery, effectiveCwd(req));
+        } finally {
+            // Never let a paused/leftover resume id bleed into the next spawn on this thread.
+            resumeSessionId.remove();
+        }
    }

    /**
@@ -407,11 +407,6 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {
            // appeared).
            return discovery.sessionIdForDirectory(cwd);
        }
-
-        @Override
-        public CharterReceipt charterReceipt() {
-            return delegate.charterReceipt();
-        }
    }

    // --- Agent-returning convenience spawns (used by callers/tests that want the herdr Agent) ---
@@ -449,7 +444,7 @@ public final class OpenCodeLauncher extends HerdrPeerLauncher {

    /** Whether any configured profile opts into a git-forge token (required for {@link Capability#SELF_PR}). */
    private boolean hasGitTokenProfile() {
-        return profileConfigs().stream().anyMatch(BridgedConfig.Profile::hasGitToken);
+        return profileConfigs().stream().anyMatch(BridgedConfig.Worker::hasGitToken);
    }

    // --- CB-117 reap predicate (opencode prefix), kept for direct unit testing -----------------
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.member;
+package dev.ltms.bridged.worker;

 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -1,13 +1,4 @@
 <configuration>
-    <!--
-      CB-575: MCP SDK 2.0.0 has no public notification registration API. It registers only
-      notifications/initialized and notifications/roots/list_changed, so other client notifications
-      still warn when unhandled. Clients may legitimately send notifications/cancelled; suppress only
-      that SDK WARN because it would devalue the action-needed WARN level used by M4 fleet health.
-      If a later SDK handles cancellation, this filter simply stops matching and can be removed.
-    -->
-    <turboFilter class="dev.ltms.bridged.logging.McpCancelledNotificationFilter"/>
-
    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
        <encoder>
            <pattern>%d{HH:mm:ss.SSS} %-5level [%thread] %logger{28} - %msg%n</pattern>
@@ -1,6 +1,6 @@
 package dev.ltms.bridged;

-import dev.ltms.bridged.inject.MemberPresence;
+import dev.ltms.bridged.inject.WorkerPresence;
 import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;

@@ -28,7 +28,7 @@ class BridgedDeliverabilityTest {
    @Test
    @DisplayName("a worker that has connected its MCP is deliverable")
    void presentWorkerIsDeliverable() {
-        MemberPresence presence = new MemberPresence();
+        WorkerPresence presence = new WorkerPresence();
        presence.markPresent("term_worker");

        assertTrue(Bridged.deliverableTo(presence, leads(Map.of())).test("term_worker"));
@@ -37,13 +37,13 @@ class BridgedDeliverabilityTest {
    @Test
    @DisplayName("a worker still in its boot window is held back")
    void absentWorkerIsNotDeliverable() {
-        assertFalse(Bridged.deliverableTo(new MemberPresence(), leads(Map.of())).test("term_booting"));
+        assertFalse(Bridged.deliverableTo(new WorkerPresence(), leads(Map.of())).test("term_booting"));
    }

    @Test
    @DisplayName("a lead is deliverable without ever being marked present")
    void leadIsDeliverableWithoutPresence() {
-        MemberPresence presence = new MemberPresence();
+        WorkerPresence presence = new WorkerPresence();
        Predicate<String> deliverable =
                Bridged.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")));

@@ -54,7 +54,7 @@ class BridgedDeliverabilityTest {
    @Test
    @DisplayName("an unknown terminal is deliverable to neither")
    void strangerIsNotDeliverable() {
-        MemberPresence presence = new MemberPresence();
+        WorkerPresence presence = new WorkerPresence();
        presence.markPresent("term_worker");

        assertFalse(Bridged.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")))
@@ -65,7 +65,7 @@ class BridgedDeliverabilityTest {
    @DisplayName("a lead discovered after startup becomes deliverable with no restart")
    void leadSetIsReadThroughOnEveryCall() {
        Map<String, String> discovered = new HashMap<>();
-        Predicate<String> deliverable = Bridged.deliverableTo(new MemberPresence(), leads(discovered));
+        Predicate<String> deliverable = Bridged.deliverableTo(new WorkerPresence(), leads(discovered));

        assertFalse(deliverable.test("term_late"));
        discovered.put("term_late", "gpt-sol-5.6"); // leadScan picks up a newly labelled tab
@@ -75,7 +75,7 @@ class BridgedDeliverabilityTest {
    @Test
    @DisplayName("forgetting a torn-down worker does not strip a lead of its deliverability")
    void forgetDoesNotDisarmALead() {
-        MemberPresence presence = new MemberPresence();
+        WorkerPresence presence = new WorkerPresence();
        Predicate<String> deliverable =
                Bridged.deliverableTo(presence, leads(Map.of("term_lead", "opus-5.0")));

@@ -1,114 +0,0 @@
-package dev.ltms.bridged;
-
-import dev.ltms.bridged.config.BridgedConfig;
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.List;
-import java.util.Map;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-/**
- * CB-594: {@link Bridged#requiredSecretEnvVars(BridgedConfig)} is what decides what the startup
- * secret report checks — it must derive that set from the config, not a hand-written list, or a
- * new profile's token silently stops being reported.
- */
-class RequiredSecretEnvVarsTest {
-
-    private static BridgedConfig load(Path dir, String yaml) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        Files.writeString(f, yaml);
-        return BridgedConfig.load(f);
-    }
-
-    @Test
-    void collectsATokenEnvPerNonSubscriptionProfile(@TempDir Path dir) throws Exception {
-        BridgedConfig cfg = load(dir, """
-                profiles:
-                  local:
-                    baseUrl: http://gx00.gw:8000
-                    tokenEnv: AI_GATEWAY_TOKEN
-                """);
-
-        Map<String, List<String>> required = Bridged.requiredSecretEnvVars(cfg);
-
-        assertTrue(required.containsKey("AI_GATEWAY_TOKEN"));
-        assertEquals(List.of("profile 'local' tokenEnv"), required.get("AI_GATEWAY_TOKEN"));
-    }
-
-    @Test
-    void aSubscriptionProfileNeedsNoTokenEnv(@TempDir Path dir) throws Exception {
-        BridgedConfig cfg = load(dir, """
-                profiles:
-                  opus:
-                    subscription: true
-                    model: claude-opus-5
-                """);
-
-        assertTrue(Bridged.requiredSecretEnvVars(cfg).isEmpty(),
-                "subscription: true never reads ANTHROPIC_AUTH_TOKEN — see Profile#isSubscription");
-    }
-
-    @Test
-    void gitTokenEnvIsOptInAndCollectedWhenSet(@TempDir Path dir) throws Exception {
-        BridgedConfig cfg = load(dir, """
-                profiles:
-                  local:
-                    baseUrl: http://gx00.gw:8000
-                    tokenEnv: AI_GATEWAY_TOKEN
-                    gitTokenEnv: WORKER_GITEA_TOKEN
-                """);
-
-        Map<String, List<String>> required = Bridged.requiredSecretEnvVars(cfg);
-
-        assertTrue(required.containsKey("WORKER_GITEA_TOKEN"));
-        assertEquals(List.of("profile 'local' gitTokenEnv"), required.get("WORKER_GITEA_TOKEN"));
-    }
-
-    @Test
-    void noGitTokenEnvMeansNothingIsRequiredForIt(@TempDir Path dir) throws Exception {
-        BridgedConfig cfg = load(dir, """
-                profiles:
-                  local:
-                    baseUrl: http://gx00.gw:8000
-                    tokenEnv: AI_GATEWAY_TOKEN
-                """);
-
-        assertFalse(Bridged.requiredSecretEnvVars(cfg).containsKey("WORKER_GITEA_TOKEN"));
-    }
-
-    @Test
-    void aVarSharedByTwoProfilesIsReportedOnceNamingBoth(@TempDir Path dir) throws Exception {
-        BridgedConfig cfg = load(dir, """
-                profiles:
-                  local:
-                    baseUrl: http://gx00.gw:8000
-                    tokenEnv: AI_GATEWAY_TOKEN
-                    gitTokenEnv: WORKER_GITEA_TOKEN
-                  gx:
-                    kind: opencode
-                    baseUrl: https://llm.ltms.dev/v1
-                    tokenEnv: AI_GATEWAY_TOKEN
-                    gitTokenEnv: WORKER_GITEA_TOKEN
-                """);
-
-        Map<String, List<String>> required = Bridged.requiredSecretEnvVars(cfg);
-
-        assertEquals(List.of("profile 'local' tokenEnv", "profile 'gx' tokenEnv"),
-                required.get("AI_GATEWAY_TOKEN"));
-        assertEquals(List.of("profile 'local' gitTokenEnv", "profile 'gx' gitTokenEnv"),
-                required.get("WORKER_GITEA_TOKEN"));
-    }
-
-    @Test
-    void noProfilesMeansNothingIsRequired(@TempDir Path dir) throws Exception {
-        BridgedConfig cfg = load(dir, "bind:\n  host: 127.0.0.1\n  port: 8765\n");
-
-        assertTrue(Bridged.requiredSecretEnvVars(cfg).isEmpty());
-    }
-}
@@ -1,14 +1,12 @@
 package dev.ltms.bridged.auth;

 import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.peer.MemberRole;
 import org.junit.jupiter.api.Test;

 import java.util.ArrayList;
-import java.util.LinkedHashMap;
+import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Set;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
@@ -22,54 +20,25 @@ import static org.junit.jupiter.api.Assertions.*;
 * {@link CallerResolverTest}; this pins the registry object itself — its invariants and their
 * thread-safety.
 */
-class MemberRegistryTest {
+class ArchitectRegistryTest {

-    /**
-     * Slot keys are qualified by role (CB-557): a bare name is unique only within its pool, so
-     * {@code sonnet} can be both a developer and a reviewer, while a terminal binds to exactly one.
-     */
-    private static final String DESIGNER = "architect:lead-designer";
-    private static final String REVIEWER = "architect:code-reviewer";
+    private static final Map<String, BridgedConfig.Architect> SLOTS = Map.of(
+            "lead-designer", new BridgedConfig.Architect("sonnet"),
+            "reviewer", new BridgedConfig.Architect("gx10"));

-    private static BridgedConfig.Fleet fleetWith(Map<String, BridgedConfig.Slot> architects) {
-        return new BridgedConfig.Fleet(Map.of(), architects, Map.of(), Map.of(), null);
-    }
-
-    private static Map<String, BridgedConfig.Slot> architects() {
-        Map<String, BridgedConfig.Slot> pool = new LinkedHashMap<>();
-        pool.put("lead-designer", new BridgedConfig.Slot("sonnet"));
-        pool.put("code-reviewer", new BridgedConfig.Slot("gx10"));
-        return pool;
-    }
-
-    private final MemberRegistry registry = new MemberRegistry(fleetWith(architects()));
+    private final ArchitectRegistry registry = new ArchitectRegistry(SLOTS);

    @Test
-    void exposesTheConfiguredSlotsQualifiedByRole() {
-        assertEquals(Set.of(DESIGNER, REVIEWER), registry.slots().keySet());
-        assertTrue(registry.isSlot(REVIEWER));
+    void exposesTheConfiguredSlots() {
+        assertEquals(SLOTS.keySet(), registry.slots().keySet());
+        assertTrue(registry.isSlot("reviewer"));
        assertFalse(registry.isSlot("nope"));
-        assertFalse(registry.isSlot("lead-designer"),
-                "the bare name is not the key — it is unique only inside its pool");
-    }
-
-    /** The case the pool shape exists for: one profile serving two roles is not a duplicate. */
-    @Test
-    void oneProfileMayServeTwoRolesUnderTheSameSlotName() {
-        Map<String, BridgedConfig.Slot> devs = Map.of("sonnet", new BridgedConfig.Slot("sonnet"));
-        Map<String, BridgedConfig.Slot> revs = Map.of("sonnet", new BridgedConfig.Slot("sonnet"));
-        MemberRegistry r = new MemberRegistry(
-                new BridgedConfig.Fleet(Map.of(), Map.of(), devs, revs, null));
-
-        assertEquals(Set.of("dev:sonnet", "reviewer:sonnet"), r.slots().keySet());
-        assertEquals(MemberRole.DEV, r.roleForSlot("dev:sonnet"));
-        assertEquals(MemberRole.REVIEWER, r.roleForSlot("reviewer:sonnet"));
    }

    @Test
    void theSpawnLifecycleReadsTheProfileBackFromASlot() {
-        assertEquals("sonnet", registry.profileForSlot(DESIGNER));
-        assertEquals("gx10", registry.profileForSlot(REVIEWER));
+        assertEquals("sonnet", registry.profileForSlot("lead-designer"));
+        assertEquals("gx10", registry.profileForSlot("reviewer"));
        assertNull(registry.profileForSlot("unknown"), "an unknown slot has no profile");
    }

@@ -85,9 +54,9 @@ class MemberRegistryTest {

    @Test
    void bindResolvesTheTerminalToTheSlot() {
-        assertTrue(registry.bind(DESIGNER, "term_design"));
-        assertEquals(DESIGNER, registry.slotForTerminal("term_design"));
-        assertEquals(Map.of("term_design", DESIGNER), registry.snapshot());
+        assertTrue(registry.bind("lead-designer", "term_design"));
+        assertEquals("lead-designer", registry.slotForTerminal("term_design"));
+        assertEquals(Map.of("term_design", "lead-designer"), registry.snapshot());
    }

    @Test
@@ -99,27 +68,27 @@ class MemberRegistryTest {

    @Test
    void bindRefusesATerminalInTwoSlots() {
-        assertTrue(registry.bind(DESIGNER, "term_design"));
-        assertFalse(registry.bind(REVIEWER, "term_design"),
+        assertTrue(registry.bind("lead-designer", "term_design"));
+        assertFalse(registry.bind("reviewer", "term_design"),
                "a terminal may occupy at most one slot");
-        assertEquals(DESIGNER, registry.slotForTerminal("term_design"),
+        assertEquals("lead-designer", registry.slotForTerminal("term_design"),
                "the first binding survives the refused second");
    }

    @Test
    void bindRefusesASlotWithTwoTerminals() {
-        assertTrue(registry.bind(DESIGNER, "term_design"));
-        assertFalse(registry.bind(DESIGNER, "term_other"),
+        assertTrue(registry.bind("lead-designer", "term_design"));
+        assertFalse(registry.bind("lead-designer", "term_other"),
                "a slot may host at most one terminal");
-        assertEquals(DESIGNER, registry.slotForTerminal("term_design"),
+        assertEquals("lead-designer", registry.slotForTerminal("term_design"),
                "the first binding survives the refused second");
        assertNull(registry.slotForTerminal("term_other"));
    }

    @Test
    void rebindingTheSamePairIsAnIdempotentNoOp() {
-        assertTrue(registry.bind(DESIGNER, "term_design"));
-        assertTrue(registry.bind(DESIGNER, "term_design"),
+        assertTrue(registry.bind("lead-designer", "term_design"));
+        assertTrue(registry.bind("lead-designer", "term_design"),
                "the same terminal → slot is harmless to repeat");
        assertEquals(1, registry.snapshot().size());
    }
@@ -128,8 +97,8 @@ class MemberRegistryTest {

    @Test
    void unbindRemovesTheExactBinding() {
-        assertTrue(registry.bind(DESIGNER, "term_design"));
-        assertTrue(registry.unbind(DESIGNER, "term_design"));
+        assertTrue(registry.bind("lead-designer", "term_design"));
+        assertTrue(registry.unbind("lead-designer", "term_design"));
        assertNull(registry.slotForTerminal("term_design"));
        assertTrue(registry.snapshot().isEmpty());
    }
@@ -137,32 +106,32 @@ class MemberRegistryTest {
    @Test
    void aStaleUnbindDoesNotRemoveAReplacement() {
        // Bind, tear down, and stand the slot back up with a NEW terminal.
-        assertTrue(registry.bind(DESIGNER, "term_design"));
-        registry.unbind(DESIGNER, "term_design");
-        assertTrue(registry.bind(DESIGNER, "term_new"));
+        assertTrue(registry.bind("lead-designer", "term_design"));
+        registry.unbind("lead-designer", "term_design");
+        assertTrue(registry.bind("lead-designer", "term_new"));

        // A late unbind naming the OLD terminal must not remove the replacement binding.
-        assertFalse(registry.unbind(DESIGNER, "term_design"));
-        assertEquals(DESIGNER, registry.slotForTerminal("term_new"),
+        assertFalse(registry.unbind("lead-designer", "term_design"));
+        assertEquals("lead-designer", registry.slotForTerminal("term_new"),
                "the replacement terminal stays bound");
    }

    @Test
    void aStaleUnbindForATerminalThatMovedSlotsDoesNothing() {
        // term_design starts in lead-designer, is torn down, and stands back up in a FREE slot.
-        assertTrue(registry.bind(DESIGNER, "term_design"));
-        registry.unbind(DESIGNER, "term_design");
-        assertTrue(registry.bind(REVIEWER, "term_design"));
+        assertTrue(registry.bind("lead-designer", "term_design"));
+        registry.unbind("lead-designer", "term_design");
+        assertTrue(registry.bind("reviewer", "term_design"));

        // Unbinding against the slot it no longer occupies is refused; the new binding is intact.
-        assertFalse(registry.unbind(DESIGNER, "term_design"),
+        assertFalse(registry.unbind("lead-designer", "term_design"),
                "the old slot must not unbind a terminal that moved elsewhere");
-        assertEquals(REVIEWER, registry.slotForTerminal("term_design"));
+        assertEquals("reviewer", registry.slotForTerminal("term_design"));
    }

    @Test
    void unbindOfNothingIsAFalseNoOp() {
-        assertFalse(registry.unbind(DESIGNER, "term_design"),
+        assertFalse(registry.unbind("lead-designer", "term_design"),
                "nothing was bound, so nothing is removed");
    }

@@ -170,14 +139,14 @@ class MemberRegistryTest {

    @Test
    void theSnapshotIsAnImmutableCopyNotAliveState() {
-        assertTrue(registry.bind(DESIGNER, "term_design"));
+        assertTrue(registry.bind("lead-designer", "term_design"));
        Map<String, String> snap = registry.snapshot();

        assertThrows(UnsupportedOperationException.class, () -> snap.put("x", "y"),
                "a handed-out snapshot cannot be mutated in place");

        // Later binds must not leak into an earlier snapshot.
-        assertTrue(registry.bind(REVIEWER, "term_review"));
+        assertTrue(registry.bind("reviewer", "term_review"));
        assertFalse(snap.containsKey("term_review"),
                "a snapshot is a point-in-time copy, not a live view");
    }
@@ -195,7 +164,7 @@ class MemberRegistryTest {
                final String term = "term_" + i; // every thread races for the SAME slot
                results.add(pool.submit(() -> {
                    go.await();
-                    return registry.bind(DESIGNER, term);
+                    return registry.bind("lead-designer", term);
                }));
            }
            go.countDown();
@@ -222,7 +191,7 @@ class MemberRegistryTest {
            CountDownLatch go = new CountDownLatch(1);
            List<Future<String>> results = new ArrayList<>();
            for (int i = 0; i < n; i++) {
-                final String slot = (i % 2 == 0) ? DESIGNER : REVIEWER; // all race for ONE terminal
+                final String slot = (i % 2 == 0) ? "lead-designer" : "reviewer"; // all race for ONE terminal
                results.add(pool.submit(() -> {
                    go.await();
                    return registry.bind(slot, "shared_term")
@@ -259,11 +228,11 @@ class MemberRegistryTest {
    /** A handed-over slot map is snapshotted at construction, not offered as live state. */
    @Test
    void theSlotSnapshotIsFixedByConstruction() {
-        Map<String, BridgedConfig.Slot> mutable = architects();
-        MemberRegistry r = new MemberRegistry(fleetWith(mutable));
+        Map<String, BridgedConfig.Architect> mutable = new HashMap<>(SLOTS);
+        ArchitectRegistry r = new ArchitectRegistry(mutable);

-        mutable.put("hijack", new BridgedConfig.Slot("gx10"));
+        mutable.put("hijack", new BridgedConfig.Architect("gx10"));

-        assertFalse(r.isSlot("architect:hijack"), "a handed-over map is not offered as live state");
+        assertFalse(r.isSlot("hijack"), "a handed-over map is not offered as live state");
    }
 }
@@ -3,8 +3,6 @@ package dev.ltms.bridged.auth;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.PaneLocator;
 import dev.ltms.bridged.mcp.ConnectionIdentity;
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.peer.MemberRole;
 import org.junit.jupiter.api.Test;

 import java.util.Map;
@@ -34,17 +32,6 @@ class CallerResolverTest {
        return identity(999_999);
    }

-    private static MemberRegistry boundMembers(String slot, MemberRole role) {
-        Map<String, BridgedConfig.Slot> architects = role == MemberRole.ARCHITECT
-                ? Map.of("lead-designer", new BridgedConfig.Slot("sonnet")) : Map.of();
-        Map<String, BridgedConfig.Slot> devs = role == MemberRole.DEV
-                ? Map.of("builder", new BridgedConfig.Slot("sonnet")) : Map.of();
-        MemberRegistry members = new MemberRegistry(
-                new BridgedConfig.Fleet(Map.of(), architects, devs, Map.of(), null));
-        assertTrue(members.bind(slot, "term_a"));
-        return members;
-    }
-
    @Test
    void aLoopbackWorkerPaneResolvesToWorkerRegardlessOfAuthMode() {
        Principal underTrust = new CallerResolver(workerIdentity()).resolve("127.0.0.1", 42, null);
@@ -315,9 +302,8 @@ class CallerResolverTest {

    @Test
    void aBoundArchitectPaneResolvesToArchitectBeforeTheWorkerFallback() {
-        // This is the production construction path used by Bridged.
-        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                Map::of, boundMembers("architect:lead-designer", MemberRole.ARCHITECT))
+        Principal p = CallerResolver.withLeadsAndArchitects(workerIdentity(), false, null,
+                Map::of, () -> Map.of("term_a", "lead-designer"))
                .resolve("127.0.0.1", 42, null);

        assertEquals(Role.ARCHITECT, p.role(),
@@ -329,8 +315,8 @@ class CallerResolverTest {

    @Test
    void anArchitectNeedsNoTokenEvenInTokenMode() {
-        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), true, "s3cret",
-                Map::of, boundMembers("architect:lead-designer", MemberRole.ARCHITECT))
+        Principal p = CallerResolver.withLeadsAndArchitects(workerIdentity(), true, "s3cret",
+                Map::of, () -> Map.of("term_a", "lead-designer"))
                .resolve("127.0.0.1", 42, null);

        assertEquals(Role.ARCHITECT, p.role(),
@@ -339,10 +325,9 @@ class CallerResolverTest {

    @Test
    void anUnboundPaneStillResolvesAsAWorker() {
-        MemberRegistry members = new MemberRegistry(new BridgedConfig.Fleet(Map.of(),
-                Map.of("lead-designer", new BridgedConfig.Slot("sonnet")), Map.of(), Map.of(), null));
-        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                Map::of, members).resolve("127.0.0.1", 42, null);
+        Map<String, String> arch = Map.of("term_elsewhere", "reviewer");
+        Principal p = CallerResolver.withLeadsAndArchitects(workerIdentity(), false, null,
+                Map::of, () -> arch).resolve("127.0.0.1", 42, null);

        assertEquals(Role.WORKER, p.role());
        assertNull(p.name());
@@ -351,9 +336,8 @@ class CallerResolverTest {
    /** CB-548 precedence: lead > architect > worker, so a pane named in BOTH is still a lead. */
    @Test
    void aLeadWinsOverAnArchitectBindingForTheSamePane() {
-        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                () -> Map.of("term_a", "opus-5.0"),
-                boundMembers("architect:lead-designer", MemberRole.ARCHITECT))
+        Principal p = CallerResolver.withLeadsAndArchitects(workerIdentity(), false, null,
+                () -> Map.of("term_a", "opus-5.0"), () -> Map.of("term_a", "lead-designer"))
                .resolve("127.0.0.1", 42, null);

        assertEquals(Role.PRIMARY, p.role(),
@@ -365,17 +349,26 @@ class CallerResolverTest {
    /** The registry is live, like leads: a binding injected after construction is honoured. */
    @Test
    void anArchitectBoundAfterConstructionIsHonouredWithoutRebuildingTheResolver() {
-        MemberRegistry members = new MemberRegistry(new BridgedConfig.Fleet(Map.of(),
-                Map.of("lead-designer", new BridgedConfig.Slot("sonnet")), Map.of(), Map.of(), null));
-        CallerResolver r = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                Map::of, members);
+        Map<String, String> live = new java.util.HashMap<>();
+        CallerResolver r = CallerResolver.withLeadsAndArchitects(workerIdentity(), false, null,
+                Map::of, () -> live);

        assertEquals(Role.WORKER, r.resolve("127.0.0.1", 42, null).role());

-        assertTrue(members.bind("architect:lead-designer", "term_a")); // the later lifecycle binds the slot
+        live.put("term_a", "lead-designer"); // the later lifecycle binds the slot

        assertEquals(Role.ARCHITECT, r.resolve("127.0.0.1", 42, null).role());
-        assertEquals("architect:lead-designer", r.members().get("term_a"));
+        assertEquals("lead-designer", r.architects().get("term_a"));
+    }
+
+    @Test
+    void theArchitectMapFormIsCopiedSoLaterMutationCannotGrantArchitect() {
+        Map<String, String> mutable = new java.util.LinkedHashMap<>();
+        CallerResolver r = new CallerResolver(workerIdentity(), false, null, Map.of(), mutable);
+
+        mutable.put("term_a", "sneaky");
+
+        assertEquals(Role.WORKER, r.resolve("127.0.0.1", 42, null).role());
    }

    @Test
@@ -387,9 +380,8 @@ class CallerResolverTest {
    /** An architect acts only as its own pane — the same ownsSession rule as a worker or lead. */
    @Test
    void anArchitectOwnsItsOwnPaneAndNoOther() {
-        Principal arch = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                Map::of, boundMembers("architect:lead-designer", MemberRole.ARCHITECT))
-                .resolve("127.0.0.1", 42, null);
+        Principal arch = CallerResolver.withLeadsAndArchitects(workerIdentity(), false, null,
+                Map::of, () -> Map.of("term_a", "lead-designer")).resolve("127.0.0.1", 42, null);

        assertTrue(arch.ownsSession("term_a"));
        assertTrue(Authz.permits(arch, Authz.Action.REPLY, "term_a"));
@@ -397,15 +389,6 @@ class CallerResolverTest {
        assertFalse(Authz.permits(arch, Authz.Action.REPLY, "term_b"));
    }

-    @Test
-    void aBoundNonArchitectSlotStillResolvesAsAWorker() {
-        Principal p = CallerResolver.withLeadsAndMembers(workerIdentity(), false, null,
-                Map::of, boundMembers("dev:builder", MemberRole.DEV))
-                .resolve("127.0.0.1", 42, null);
-
-        assertEquals(Role.WORKER, p.role(), "a dev binding must never grant architect rights");
-    }
-
    @Test
    void tokenModeRequiresANonEmptyConfiguredToken() {
        ConnectionIdentity id = nonWorkerIdentity();
@@ -1,401 +0,0 @@
-package dev.ltms.bridged.config;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import java.nio.file.Files;
-import java.nio.file.Path;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * CB-559: re-reading {@code bridged.yaml} under a running daemon.
- *
- * <p>The tests that matter here are the refusals. A reload that applies a good file is the easy
- * half; the half that protects an operator is the one that keeps the running config when the new
- * file is bad, and the one that refuses a change the running daemon cannot honour.
- */
-class ConfigRefTest {
-
-    /** A minimal file that loads and passes every startup validator. */
-    private static String yaml(String extra) {
-        return """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                herdrSocket: ~/.config/herdr/herdr.sock
-                profiles:
-                  sonnet:
-                    baseUrl: http://gx00.gw:8000
-                    model: sonnet
-                guard:
-                  offSubscriptionHosts:
-                    - gx00.gw
-                """ + extra;
-    }
-
-    private static ConfigRef refFor(Path f) {
-        return new ConfigRef(f, BridgedConfig.load(f));
-    }
-
-    @Test
-    void aHotChangeIsAppliedAndReadThroughGet(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        Files.writeString(f, yaml("""
-                fleet:
-                  tabLabel: "{role}: {profile} #{n}"
-                  developers:
-                    a:
-                      profile: sonnet
-                """));
-        ConfigRef ref = refFor(f);
-        assertEquals("{role}: {profile} #{n}", ref.get().fleet().tabLabel());
-
-        Files.writeString(f, yaml("""
-                fleet:
-                  tabLabel: "[{profile}] {role}"
-                  developers:
-                    a:
-                      profile: sonnet
-                """));
-        ConfigRef.Outcome out = ref.reload();
-
-        assertTrue(out.applied());
-        assertTrue(out.deferred().isEmpty());
-        assertEquals("config reloaded", out.summary());
-        assertEquals("[{profile}] {role}", ref.get().fleet().tabLabel());
-    }
-
-    @Test
-    void aCharterChangeIsHotAndReachesTheLiveConfig(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        Files.writeString(f, yaml("""
-                fleet:
-                  charters:
-                    architect: old charter
-                """));
-        ConfigRef ref = refFor(f);
-        assertEquals("old charter", ref.get().fleet().charterFor(
-                dev.ltms.bridged.peer.MemberRole.ARCHITECT));
-
-        Files.writeString(f, yaml("""
-                fleet:
-                  charters:
-                    architect: new charter
-                """));
-        ConfigRef.Outcome out = ref.reload();
-
-        assertTrue(out.applied());
-        assertTrue(out.deferred().isEmpty());
-        assertEquals("new charter", ref.get().fleet().charterFor(
-                dev.ltms.bridged.peer.MemberRole.ARCHITECT));
-    }
-
-    @Test
-    void invalidChartersRefuseReloadAndKeepTheRunningConfig(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        Files.writeString(f, yaml("""
-                fleet:
-                  charters:
-                    architect: valid charter
-                """));
-        ConfigRef ref = refFor(f);
-        BridgedConfig before = ref.get();
-
-        Files.writeString(f, yaml("""
-                fleet:
-                  charters:
-                    architect: " "
-                """));
-        ConfigRef.Outcome blank = ref.reload();
-        assertFalse(blank.applied());
-        assertTrue(blank.error().contains("fleet.charters.architect is blank"));
-        assertSame(before, ref.get());
-
-        Files.writeString(f, yaml("""
-                fleet:
-                  charters:
-                    architetc: valid charter
-                """));
-        ConfigRef.Outcome unknown = ref.reload();
-        assertFalse(unknown.applied());
-        assertTrue(unknown.error().contains("architetc"));
-        assertTrue(unknown.error().contains("architect"));
-        assertSame(before, ref.get());
-    }
-
-    /**
-     * The point of the whole class: a consumer holding the ref sees the new value without being
-     * rebuilt. A component that captured {@code get()} into a field would still show the old one.
-     */
-    @Test
-    void aConsumerHoldingTheRefSeesTheNewValue(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        Files.writeString(f, yaml("placement: weighted\n"));
-        ConfigRef ref = refFor(f);
-        java.util.function.Supplier<String> reader = () -> ref.get().placement();
-        assertEquals("weighted", reader.get());
-
-        Files.writeString(f, yaml("placement: fixed\n"));
-        assertTrue(ref.reload().applied());
-
-        assertEquals("fixed", reader.get());
-    }
-
-    @Test
-    void aChangedColdKeyRefusesTheWholeReload(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        Files.writeString(f, yaml("placement: weighted\n"));
-        ConfigRef ref = refFor(f);
-
-        // Two changes in one file: a cold one (the port) and a hot one (placement).
-        Files.writeString(f, yaml("placement: fixed\n").replace("port: 8765", "port: 9999"));
-        ConfigRef.Outcome out = ref.reload();
-
-        assertFalse(out.applied());
-        assertEquals(java.util.List.of("bind"), out.coldKeys());
-        assertTrue(out.summary().contains("Restart bridged"), out.summary());
-        // The hot half must NOT have leaked in. A half-applied reload leaves the daemon matching no
-        // file on disk, which is worse for an operator than no reload at all.
-        assertEquals("weighted", ref.get().placement());
-        assertEquals(8765, ref.get().bind().port());
-    }
-
-    @Test
-    void aFileThatNoLongerParsesKeepsTheRunningConfig(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        Files.writeString(f, yaml("placement: weighted\n"));
-        ConfigRef ref = refFor(f);
-        BridgedConfig before = ref.get();
-
-        Files.writeString(f, "profiles:\n  sonnet:\n   baseUrl: \"unclosed\n");
-        ConfigRef.Outcome out = ref.reload();
-
-        assertFalse(out.applied());
-        assertNotNull(out.error());
-        assertTrue(out.summary().startsWith("config reload refused"), out.summary());
-        assertSame(before, ref.get());
-    }
-
-    /** A file that would have refused to boot must not be able to slip in through a reload. */
-    @Test
-    void aFileThatFailsAValidatorKeepsTheRunningConfig(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        Files.writeString(f, yaml("placement: weighted\n"));
-        ConfigRef ref = refFor(f);
-        BridgedConfig before = ref.get();
-
-        // A member slot naming a profile that does not exist — validateMembers refuses this at
-        // startup, so it must refuse it here too.
-        Files.writeString(f, yaml("""
-                fleet:
-                  developers:
-                    a:
-                      profile: no-such-profile
-                """));
-        ConfigRef.Outcome out = ref.reload();
-
-        assertFalse(out.applied());
-        assertNotNull(out.error());
-        assertSame(before, ref.get());
-    }
-
-    @Test
-    void aDeletedFileIsRefusedRatherThanCrashing(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        Files.writeString(f, yaml(""));
-        ConfigRef ref = refFor(f);
-        BridgedConfig before = ref.get();
-
-        Files.delete(f);
-        ConfigRef.Outcome out = ref.reload();
-
-        assertFalse(out.applied());
-        assertNotNull(out.error());
-        assertSame(before, ref.get());
-    }
-
-    /** A deferred change applies to the snapshot but the operator is told it needs a restart. */
-    @Test
-    void aDeferredChangeIsAppliedAndReported(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        Files.writeString(f, yaml("""
-                lifecycle:
-                  drainTimeoutSeconds: 30
-                """));
-        ConfigRef ref = refFor(f);
-
-        Files.writeString(f, yaml("""
-                lifecycle:
-                  drainTimeoutSeconds: 60
-                """));
-        ConfigRef.Outcome out = ref.reload();
-
-        assertTrue(out.applied());
-        assertEquals(java.util.List.of("lifecycle"), out.deferred());
-        assertTrue(out.summary().contains("needs a restart") || out.summary().contains("need a restart"),
-                out.summary());
-        assertEquals(60, ref.get().lifecycle().drainTimeoutSeconds());
-    }
-
-    /**
-     * Adding a profile is deferred, not hot: a new backend needs its own launcher, and launchers are
-     * built once at startup. The snapshot carries it so a restart picks it up.
-     */
-    @Test
-    void addingAProfileIsReportedAsDeferred(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        Files.writeString(f, yaml(""));
-        ConfigRef ref = refFor(f);
-
-        Files.writeString(f, """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                herdrSocket: ~/.config/herdr/herdr.sock
-                profiles:
-                  sonnet:
-                    baseUrl: http://gx00.gw:8000
-                    model: sonnet
-                  haiku:
-                    baseUrl: http://gx00.gw:8000
-                    model: haiku
-                guard:
-                  offSubscriptionHosts:
-                    - gx00.gw
-                """);
-        ConfigRef.Outcome out = ref.reload();
-
-        assertTrue(out.applied());
-        assertEquals(1, out.deferred().size());
-        assertTrue(out.deferred().getFirst().contains("haiku"), out.deferred().toString());
-    }
-
-    /**
-     * Changing an existing profile's weight or maxLoad IS hot: placement reads those live through
-     * the supplier on the composite, so the next spawn already sees them.
-     */
-    @Test
-    void changingAProfilesWeightOrMaxLoadIsHot(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        Files.writeString(f, yaml(""));
-        ConfigRef ref = refFor(f);
-
-        Files.writeString(f, """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                herdrSocket: ~/.config/herdr/herdr.sock
-                profiles:
-                  sonnet:
-                    baseUrl: http://gx00.gw:8000
-                    model: sonnet
-                    maxLoad: 7
-                    weight: 3.0
-                guard:
-                  offSubscriptionHosts:
-                    - gx00.gw
-                """);
-        ConfigRef.Outcome out = ref.reload();
-
-        assertTrue(out.applied());
-        assertTrue(out.deferred().isEmpty(), out.deferred().toString());
-        assertEquals(7, ref.get().profiles().get("sonnet").maxLoad());
-    }
-
-    /**
-     * Changing an existing profile's MODEL is deferred, not hot — and saying so is the whole point.
-     * HerdrPeerLauncher takes Map.copyOf(profiles) at construction and resolves every spawn out of
-     * that copy, so a reloaded model never reaches a launch. Reporting it as applied would be the
-     * worst outcome a reload can produce: the operator has no reason to doubt a clean "reloaded".
-     */
-    @Test
-    void changingAProfilesLaunchSettingsIsReportedAsDeferred(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        Files.writeString(f, yaml(""));
-        ConfigRef ref = refFor(f);
-
-        Files.writeString(f, """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                herdrSocket: ~/.config/herdr/herdr.sock
-                profiles:
-                  sonnet:
-                    baseUrl: http://gx00.gw:8000
-                    model: deepseek-v4-flash
-                guard:
-                  offSubscriptionHosts:
-                    - gx00.gw
-                """);
-        ConfigRef.Outcome out = ref.reload();
-
-        assertTrue(out.applied());
-        assertEquals(1, out.deferred().size(), out.deferred().toString());
-        assertTrue(out.deferred().getFirst().contains("sonnet"), out.deferred().toString());
-        assertTrue(out.deferred().getFirst().contains("launch settings"), out.deferred().toString());
-        // The snapshot still carries the new value — a restart is what makes it take effect.
-        assertEquals("deepseek-v4-flash", ref.get().profiles().get("sonnet").model());
-    }
-
-    /**
-     * CB-578 stage B: exhaustedPattern is compiled once into Bridged.main's pattern map at startup
-     * (see ExhaustedPatternLookup), so a reload never re-reads it — a changed pattern must be
-     * reported deferred exactly like model/baseUrl, not silently claimed as applied.
-     */
-    @Test
-    void changingAProfilesExhaustedPatternIsReportedAsDeferred(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        Files.writeString(f, """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                herdrSocket: ~/.config/herdr/herdr.sock
-                profiles:
-                  sonnet:
-                    baseUrl: http://gx00.gw:8000
-                    model: sonnet
-                    exhaustedPattern: "usage limit has been reached"
-                guard:
-                  offSubscriptionHosts:
-                    - gx00.gw
-                """);
-        ConfigRef ref = refFor(f);
-
-        Files.writeString(f, """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                herdrSocket: ~/.config/herdr/herdr.sock
-                profiles:
-                  sonnet:
-                    baseUrl: http://gx00.gw:8000
-                    model: sonnet
-                    exhaustedPattern: "rate limit exceeded"
-                guard:
-                  offSubscriptionHosts:
-                    - gx00.gw
-                """);
-        ConfigRef.Outcome out = ref.reload();
-
-        assertTrue(out.applied());
-        assertEquals(1, out.deferred().size(), out.deferred().toString());
-        assertTrue(out.deferred().getFirst().contains("sonnet"), out.deferred().toString());
-        assertTrue(out.deferred().getFirst().contains("launch settings"), out.deferred().toString());
-        // The snapshot still carries the new value — a restart is what makes it take effect.
-        assertEquals("rate limit exceeded", ref.get().profiles().get("sonnet").exhaustedPattern());
-    }
-
-    @Test
-    void aFixedRefHasNoFileAndRefusesToReload() {
-        BridgedConfig cfg = new BridgedConfig(null, null, null, null, null, null,
-                null, null, null, null, null, null, null, null, null).withDefaults();
-        ConfigRef ref = ConfigRef.fixed(cfg);
-
-        assertNull(ref.path());
-        assertSame(cfg, ref.get());
-        ConfigRef.Outcome out = ref.reload();
-        assertFalse(out.applied());
-        assertNotNull(out.error());
-    }
-}
@@ -1,162 +0,0 @@
-package dev.ltms.bridged.config;
-
-import org.junit.jupiter.api.Test;
-import org.junit.jupiter.api.io.TempDir;
-
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.nio.file.attribute.FileTime;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * CB-559: the mtime poller behind {@code configReload:}. The tests drive {@link
- * ConfigWatcher#tick()} directly rather than the scheduler, so nothing here sleeps.
- */
-class ConfigWatcherTest {
-
-    private static String yaml(String placement) {
-        return """
-                bind:
-                  host: 127.0.0.1
-                  port: 8765
-                herdrSocket: ~/.config/herdr/herdr.sock
-                profiles:
-                  sonnet:
-                    baseUrl: http://gx00.gw:8000
-                    model: sonnet
-                guard:
-                  offSubscriptionHosts:
-                    - gx00.gw
-                """ + "placement: " + placement + "\n";
-    }
-
-    /** Write and stamp an mtime, so a test never depends on the filesystem's clock resolution. */
-    private static void write(Path f, String content, long millis) throws Exception {
-        Files.writeString(f, content);
-        Files.setLastModifiedTime(f, FileTime.fromMillis(millis));
-    }
-
-    @Test
-    void aChangedMtimeTriggersAReload(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        write(f, yaml("weighted"), 1_000L);
-        ConfigRef ref = new ConfigRef(f, BridgedConfig.load(f));
-
-        ConfigWatcher watcher = new ConfigWatcher(ref, 10);
-        try {
-            write(f, yaml("fixed"), 2_000L);
-            watcher.tick();
-
-            assertEquals("fixed", ref.get().placement());
-        } finally {
-            watcher.stop();
-        }
-    }
-
-    @Test
-    void anUnchangedFileIsNotReloaded(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        write(f, yaml("weighted"), 1_000L);
-        ConfigRef ref = new ConfigRef(f, BridgedConfig.load(f));
-        BridgedConfig before = ref.get();
-
-        ConfigWatcher watcher = new ConfigWatcher(ref, 10);
-        try {
-            watcher.tick();
-            watcher.tick();
-
-            // Same instance, so no reload happened — a reload always swaps in a fresh object.
-            assertSame(before, ref.get());
-        } finally {
-            watcher.stop();
-        }
-    }
-
-    /**
-     * A refused reload must not be retried every tick. Without the stamp-before-reload order the
-     * same refusal would be logged forever, which buries the log an operator needs.
-     */
-    @Test
-    void aRefusedReloadIsNotRetriedUntilTheFileChangesAgain(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        write(f, yaml("weighted"), 1_000L);
-        ConfigRef ref = new ConfigRef(f, BridgedConfig.load(f));
-        BridgedConfig before = ref.get();
-
-        ConfigWatcher watcher = new ConfigWatcher(ref, 10);
-        try {
-            // A cold change: refused, and the running config stays.
-            write(f, yaml("fixed").replace("port: 8765", "port: 9999"), 2_000L);
-            watcher.tick();
-            assertSame(before, ref.get());
-
-            // The next tick sees the same mtime, so it does nothing at all.
-            watcher.tick();
-            assertSame(before, ref.get());
-
-            // A fresh save earns a fresh attempt — and this one is hot, so it applies.
-            write(f, yaml("fixed"), 3_000L);
-            watcher.tick();
-            assertEquals("fixed", ref.get().placement());
-        } finally {
-            watcher.stop();
-        }
-    }
-
-    /**
-     * Editors briefly unlink the file mid-save. A missing file is skipped, not an error and not a
-     * reload — the running config stays live, which is right either way.
-     */
-    @Test
-    void aMissingFileIsSkippedAndTheNextTickTriesAgain(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        write(f, yaml("weighted"), 1_000L);
-        ConfigRef ref = new ConfigRef(f, BridgedConfig.load(f));
-        BridgedConfig before = ref.get();
-
-        ConfigWatcher watcher = new ConfigWatcher(ref, 10);
-        try {
-            Files.delete(f);
-            assertDoesNotThrow(watcher::tick);
-            assertSame(before, ref.get());
-
-            write(f, yaml("fixed"), 2_000L);
-            watcher.tick();
-            assertEquals("fixed", ref.get().placement());
-        } finally {
-            watcher.stop();
-        }
-    }
-
-    /** A ref with no file behind it must not start a scheduler that could never do anything. */
-    @Test
-    void aFixedRefStartsNoWatch() {
-        BridgedConfig cfg = new BridgedConfig(null, null, null, null, null, null,
-                null, null, null, null, null, null, null, null, null).withDefaults();
-        ConfigWatcher watcher = new ConfigWatcher(ConfigRef.fixed(cfg), 10);
-        try {
-            assertDoesNotThrow(watcher::start);
-            assertDoesNotThrow(watcher::tick);
-        } finally {
-            watcher.stop();
-        }
-    }
-
-    @Test
-    void configReloadIsOffUnlessTheBlockSaysOtherwise(@TempDir Path dir) throws Exception {
-        Path f = dir.resolve("bridged.yaml");
-        write(f, yaml("weighted"), 1_000L);
-        assertNull(BridgedConfig.load(f).configReload());
-
-        write(f, yaml("weighted") + "configReload:\n  enabled: true\n", 2_000L);
-        BridgedConfig.ConfigReload on = BridgedConfig.load(f).configReload();
-        assertTrue(on.isEnabled());
-        assertEquals(10, on.intervalSeconds(), "an absent interval defaults to 10s");
-
-        write(f, yaml("weighted") + "configReload:\n  intervalSeconds: 30\n", 3_000L);
-        BridgedConfig.ConfigReload off = BridgedConfig.load(f).configReload();
-        assertFalse(off.isEnabled(), "a block that only sets the interval does not enable the watch");
-        assertEquals(30, off.intervalSeconds());
-    }
-}
@@ -1,170 +0,0 @@
-package dev.ltms.bridged.health;
-
-import ch.qos.logback.classic.Logger;
-import ch.qos.logback.classic.spi.ILoggingEvent;
-import ch.qos.logback.core.read.ListAppender;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.FakeHerdr;
-import dev.ltms.bridged.inject.Injector;
-import dev.ltms.bridged.msg.InMemoryReplyInbox;
-import dev.ltms.bridged.msg.MessageService;
-import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.member.ClaudeCodeLauncher;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.guard.SubscriptionGuard;
-import dev.ltms.bridged.config.BridgedConfig;
-import org.junit.jupiter.api.Test;
-import org.slf4j.LoggerFactory;
-
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.Executors;
-import java.util.function.BiConsumer;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-class FleetHealthMonitorTest {
-    @Test void oneTickUsesOneFleetListForAnyRosterSize() {
-        FakeHerdr herdr = new FakeHerdr();
-        AgentControl agents = new AgentControl(herdr);
-        BridgedConfig.Profile profile = new BridgedConfig.Profile("test", "http://test:1", null,
-                null, null, null, null, null, null, null, null, null);
-        ClaudeCodeLauncher launcher = new ClaudeCodeLauncher(agents, new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("test")), Map.of("test", profile), "test", _ -> "token");
-        SessionManager sessions = new SessionManager(launcher);
-        sessions.acquire("test", null, null, null);
-        sessions.acquire("test", null, null, null);
-        herdr.calls.clear();
-        MessageService messages = new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox());
-        var scheduler = Executors.newSingleThreadScheduledExecutor();
-        FleetHealthMonitor monitor = new FleetHealthMonitor(agents, sessions::roster, messages, scheduler, () -> 1, 60,
-                (_, _) -> { });
-        monitor.tick();
-        monitor.stop();
-        assertEquals(1, herdr.calls.stream().filter(call -> call.method().equals("agent.list")).count());
-    }
-
-    @Test void failedTickDoesNotStopTheNextTick() {
-        FakeHerdr herdr = new FakeHerdr().healthy(false);
-        AgentControl agents = new AgentControl(herdr);
-        var scheduler = Executors.newSingleThreadScheduledExecutor();
-        FleetHealthMonitor monitor = new FleetHealthMonitor(agents, java.util.List::of,
-                new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
-                scheduler, () -> 1, 60, (_, _) -> { });
-        monitor.tick();
-        herdr.healthy(true);
-        monitor.tick();
-        monitor.stop();
-        assertEquals(2, herdr.calls.stream().filter(call -> call.method().equals("agent.list")).count());
-    }
-
-    @Test void faultTransitionLogsOnlyOnceUntilItChanges() {
-        Logger logger = (Logger) LoggerFactory.getLogger(FleetHealthMonitor.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.start();
-        logger.addAppender(appender);
-        try {
-            FakeHerdr herdr = new FakeHerdr();
-            AgentControl agents = new AgentControl(herdr);
-            var scheduler = Executors.newSingleThreadScheduledExecutor();
-            FleetHealthMonitor monitor = new FleetHealthMonitor(agents, java.util.List::of,
-                    new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
-                    scheduler, () -> 1, 60, (_, _) -> { });
-            monitor.reportTransition("term_a", HealthState.TURN_BOUNDARY_LOST);
-            monitor.reportTransition("term_a", HealthState.TURN_BOUNDARY_LOST);
-            monitor.stop();
-            assertEquals(1, appender.list.stream().filter(event -> event.getFormattedMessage()
-                    .contains("member=term_a state=TURN_BOUNDARY_LOST")).count());
-        } finally {
-            logger.detachAppender(appender);
-        }
-    }
-
-    // --- CB-580: a member that reaches GONE/NEVER_READY must fail its waiting tickets
-
-    private static FleetHealthMonitor monitorWith(BiConsumer<String, String> failTarget) {
-        FakeHerdr herdr = new FakeHerdr();
-        AgentControl agents = new AgentControl(herdr);
-        var scheduler = Executors.newSingleThreadScheduledExecutor();
-        return new FleetHealthMonitor(agents, java.util.List::of,
-                new MessageService(agents, new Injector(agents), new Rendezvous(), new InMemoryReplyInbox()),
-                scheduler, () -> 1, 60, failTarget);
-    }
-
-    @Test void terminalTransitionFailsTheTargetOnce() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.stop();
-        assertEquals(1, failTarget.calls.size());
-        assertEquals("term_a", failTarget.calls.get(0).target());
-        assertTrue(failTarget.calls.get(0).reason().contains("GONE"));
-    }
-
-    @Test void neverReadyNamesItselfAsTheReason() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.NEVER_READY);
-        monitor.stop();
-        assertEquals(1, failTarget.calls.size());
-        assertTrue(failTarget.calls.get(0).reason().contains("NEVER_READY"));
-    }
-
-    @Test void stayingInATerminalStateProducesOneFailureNotN() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.stop();
-        assertEquals(1, failTarget.calls.size());
-    }
-
-    @Test void aNonTerminalFaultStateDoesNotFailTheTarget() {
-        RecordingFailTarget failTarget = new RecordingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.TURN_BOUNDARY_LOST);
-        monitor.stop();
-        assertEquals(0, failTarget.calls.size());
-    }
-
-    @Test void failTargetRetryIsBounded() {
-        AlwaysThrowingFailTarget failTarget = new AlwaysThrowingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.stop();
-        assertEquals(FleetHealthMonitor.MAX_FAIL_TARGET_ATTEMPTS, failTarget.calls);
-    }
-
-    @Test void exhaustedRetryStillDoesNotRefireOnAnUnchangedTick() {
-        AlwaysThrowingFailTarget failTarget = new AlwaysThrowingFailTarget();
-        FleetHealthMonitor monitor = monitorWith(failTarget);
-        monitor.reportTransition("term_a", HealthState.GONE);
-        int afterFirstTransition = failTarget.calls;
-        monitor.reportTransition("term_a", HealthState.GONE);
-        monitor.stop();
-        assertEquals(afterFirstTransition, failTarget.calls);
-    }
-
-    private record RecordedCall(String target, String reason) { }
-
-    private static final class RecordingFailTarget implements BiConsumer<String, String> {
-        final java.util.List<RecordedCall> calls = new java.util.ArrayList<>();
-
-        @Override public void accept(String target, String reason) {
-            calls.add(new RecordedCall(target, reason));
-        }
-    }
-
-    private static final class AlwaysThrowingFailTarget implements BiConsumer<String, String> {
-        int calls = 0;
-
-        @Override public void accept(String target, String reason) {
-            calls++;
-            throw new RuntimeException("boom");
-        }
-    }
-}
@@ -1,56 +0,0 @@
-package dev.ltms.bridged.health;
-
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.session.MemberSession;
-import dev.ltms.bridged.msg.Rendezvous;
-import org.junit.jupiter.api.Test;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-
-class FleetHealthTest {
-    @Test void muteCountsOnlyCompletionFallbacks() {
-        MuteCounter mute = new MuteCounter();
-        mute.observe("target", "terra", Rendezvous.Kind.REPLY);
-        mute.observe("target", "terra", Rendezvous.Kind.COMPLETION);
-        assertEquals(1, mute.forTarget("target"));
-        assertEquals(1, mute.forProfile("terra"));
-    }
-    @Test void turnBoundaryNeedsTwoSnapshots() {
-        HealthSnapshot s = snapshot(MemberSession.State.BUSY, AgentStatus.DONE, true);
-        HealthDecision first = FleetHealth.decide(s, HealthPrior.NONE, 1);
-        assertEquals(HealthState.WORKING, first.state());
-        assertEquals(new HealthPrior(true), first.prior());
-        assertEquals(HealthState.TURN_BOUNDARY_LOST, FleetHealth.decide(s, first.prior(), 2).state());
-    }
-
-    @Test void unknownLiveStatusWithAcceptedDeliveryIsNotIdle() {
-        assertEquals(HealthState.WORKING, FleetHealth.decide(
-                snapshot(MemberSession.State.BUSY, AgentStatus.UNKNOWN, true), HealthPrior.NONE, 1).state());
-    }
-
-    @Test void acceptedDeliveryNeverReportsIdle() {
-        for (MemberSession.State session : MemberSession.State.values()) {
-            for (AgentStatus live : AgentStatus.values()) {
-                HealthSnapshot s = snapshot(session, live, true);
-                assertEquals(false, FleetHealth.decide(s, HealthPrior.NONE, 1).state() == HealthState.IDLE,
-                        () -> "accepted delivery returned IDLE for " + session + "/" + live);
-            }
-        }
-    }
-
-    @Test void blockedDoesNotGuessPromptKind() {
-        assertEquals(HealthState.BLOCKED_AMBIGUOUS, FleetHealth.decide(
-                snapshot(MemberSession.State.BUSY, AgentStatus.BLOCKED, true), HealthPrior.NONE, 1).state());
-    }
-
-    @Test void controlLinkOutranksMemberFault() {
-        HealthSnapshot s = new HealthSnapshot(MemberSession.State.BUSY, AgentStatus.DONE, true, false,
-                false, true, true, true, false, true, true, true);
-        assertEquals(HealthState.CONTROL_LINK_DOWN, FleetHealth.decide(s, HealthPrior.NONE, 1).state());
-    }
-
-    private static HealthSnapshot snapshot(MemberSession.State state, AgentStatus live, boolean accepted) {
-        return new HealthSnapshot(state, live, accepted, false, false, true, false, false,
-                false, false, false, false);
-    }
-}
@@ -1,14 +0,0 @@
-package dev.ltms.bridged.health;
-
-import org.junit.jupiter.api.Test;
-import java.util.List;
-import static org.junit.jupiter.api.Assertions.assertEquals;
-
-class PaneBudgetTest {
-    @Test void fixedLimitsIgnoreWeakerConfig() {
-        PaneBudget budget = new PaneBudget();
-        List<String> targets = List.of("a", "b", "c");
-        assertEquals(List.of("a", "b"), budget.choose(targets, 0, 0));
-        assertEquals(List.of("c"), budget.choose(targets, 1, 0));
-    }
-}
@@ -4,9 +4,7 @@ import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;

 import java.util.ArrayList;
-import java.util.LinkedHashMap;
 import java.util.List;
-import java.util.Map;

 /**
 * Recording fake {@link HerdrClient} for unit/acceptance tests. Returns canned frames
@@ -26,8 +24,6 @@ public final class FakeHerdr implements HerdrClient {
    private boolean healthy = true;
    private final List<String> extraWorkspaces = new ArrayList<>();
    private final List<String> extraAgents = new ArrayList<>();
-    /** workspaceId → extra tabs that {@code tab.list} reports for it (CB-558 lead scans). */
-    private final Map<String, List<String>> extraTabs = new LinkedHashMap<>();
    private int agentNameTakenFor = 0;
    private int agentPaneBusyFor = 0;
    private int workerTabPaneCount = 1;
@@ -113,18 +109,6 @@ public final class FakeHerdr implements HerdrClient {
        return this;
    }

-    /**
-     * Seed a labelled tab into {@code tab.list} for one workspace (e.g. an existing {@code lead: x}
-     * tab). Pair it with {@link #withAgent} on the same {@code tabId} to make the lead <em>live</em>;
-     * seeding the tab alone models the stale-label case.
-     */
-    public FakeHerdr withTab(String workspaceId, String tabId, String label) {
-        extraTabs.computeIfAbsent(workspaceId, _ -> new ArrayList<>())
-                .add(("{\"tab_id\":\"%s\",\"workspace_id\":\"%s\",\"label\":\"%s\",\"pane_count\":1}")
-                        .formatted(tabId, workspaceId, label));
-        return this;
-    }
-
    /** Seed an additional workspace into {@code workspace.list} (e.g. a pre-existing worker space). */
    public FakeHerdr withWorkspace(String id, String label) {
        extraWorkspaces.add(("{\"workspace_id\":\"%s\",\"label\":\"%s\",\"focused\":false,"
@@ -244,19 +228,11 @@ public final class FakeHerdr implements HerdrClient {
                case "tab.rename" -> mapper.readTree("""
                        {"type":"tab_info","tab":{"tab_id":"w9:t2","workspace_id":"w9",
                          "label":"worker: ltms-local","pane_count":1}}""");
-                case "tab.list" -> {
-                    // The base pair is returned for every workspace, exactly as before. Seeded tabs
-                    // are appended only for the workspace they were registered against, so a test
-                    // that seeds none sees the historical response byte for byte.
-                    Object wsId = params instanceof java.util.Map<?, ?> m ? m.get("workspace_id") : null;
-                    List<String> seeded = extraTabs.getOrDefault(String.valueOf(wsId), List.of());
-                    yield mapper.readTree(("""
+                case "tab.list" -> mapper.readTree(("""
                        {"type":"tab_list","tabs":[
                          {"tab_id":"w9:t1","workspace_id":"w9","label":"1","pane_count":1},
-                          {"tab_id":"w9:t2","workspace_id":"w9","label":"worker: ltms-local","pane_count":%d}%s]}""")
-                            .formatted(workerTabPaneCount,
-                                    seeded.isEmpty() ? "" : "," + String.join(",", seeded)));
-                }
+                          {"tab_id":"w9:t2","workspace_id":"w9","label":"worker: ltms-local","pane_count":%d}]}""")
+                        .formatted(workerTabPaneCount));
                case "tab.close" -> mapper.readTree("{\"type\":\"ok\"}");
                case "pane.get" -> mapper.readTree("""
                        {"type":"pane_info","pane":{"pane_id":"w9:pW","workspace_id":"w9",
@@ -15,9 +15,8 @@ import java.util.concurrent.atomic.AtomicLong;
 import static org.junit.jupiter.api.Assertions.*;

 /**
- * CB-531/CB-579. A lead is never spawned, so the daemon has to <em>find</em> it: these assert that
- * an operator-labelled tab matching a configured {@code tab:} is what makes a pane a lead, and —
- * just as importantly — what does not, and that a stale entry does not linger forever.
+ * CB-531. A lead is never spawned, so the daemon has to <em>find</em> it: these assert that an
+ * operator-labelled tab is what makes a pane a lead, and — just as importantly — what does not.
 */
 class LeadTabScannerTest {

@@ -121,48 +120,23 @@ class LeadTabScannerTest {
                .pane("w9:p1", "w9:t1", "term_worker");
    }

-    /** The {@code tab:} → name map {@code twoLeads()}'s two lead tabs are configured under. */
-    private static Map<String, String> twoLeadsConfigured() {
-        return Map.of("lead: opus-5.0", "opus-5.0", "lead: gpt-sol-5.6", "gpt-sol-5.6");
-    }
-
-    private LeadTabScanner scanner(TopologyHerdr herdr, Map<String, String> tabToName,
+    private LeadTabScanner scanner(TopologyHerdr herdr, Map<String, String> configured,
                                   AtomicLong clock) {
-        return new LeadTabScanner(herdr, tabToName, Set.of("bridged-workers"), TTL, clock::get);
+        return new LeadTabScanner(herdr, "lead:", Set.of("bridged-workers"), configured, TTL,
+                clock::get);
    }

    @Test
-    void everyConfiguredTabBecomesALeadNamedByItsEntry() {
-        Map<String, String> leads = scanner(twoLeads(), twoLeadsConfigured(), new AtomicLong()).get();
+    void everyLabelledTabBecomesALeadNamedByItsLabel() {
+        Map<String, String> leads = scanner(twoLeads(), Map.of(), new AtomicLong()).get();

        assertEquals(Map.of("term_opus", "opus-5.0", "term_gpt", "gpt-sol-5.6"), leads,
-                "two leads discovered by their configured tab — no terminal_id was ever configured");
+                "two leads discovered from labels alone — no terminal_id was ever configured");
    }

    @Test
-    void anUnconfiguredTabContributesNothing() {
-        assertFalse(scanner(twoLeads(), twoLeadsConfigured(), new AtomicLong())
-                .get().containsKey("term_notes"));
-    }
-
-    /**
-     * CB-579: matching is exact against the configured map now, not a shared prefix — two leads with
-     * completely different labels are both discovered by one scanner, no convention required.
-     */
-    @Test
-    void twoLeadsWithCompletelyDifferentLabelsAreBothDiscovered() {
-        TopologyHerdr herdr = new TopologyHerdr()
-                .workspace("w1", "main")
-                .tab("w1:t1", "w1", "orchestrator: opus")
-                .tab("w1:t2", "w1", "captain: sol")
-                .pane("w1:p1", "w1:t1", "term_opus")
-                .pane("w1:p2", "w1:t2", "term_sol");
-        Map<String, String> tabToName = Map.of("orchestrator: opus", "opus", "captain: sol", "sol");
-
-        Map<String, String> leads = scanner(herdr, tabToName, new AtomicLong()).get();
-
-        assertEquals(Map.of("term_opus", "opus", "term_sol", "sol"), leads,
-                "no shared prefix needed — each lead is matched by its own configured tab");
+    void anUnlabelledTabContributesNothing() {
+        assertFalse(scanner(twoLeads(), Map.of(), new AtomicLong()).get().containsKey("term_notes"));
    }

    /**
@@ -174,28 +148,25 @@ class LeadTabScannerTest {
    void aTabInAWorkerSpaceIsNeverALeadEvenWhenItsLabelMatches() {
        TopologyHerdr herdr = twoLeads().tab("w9:t2", "w9", "lead: impostor")
                .pane("w9:p2", "w9:t2", "term_impostor");
-        Map<String, String> tabToName = new LinkedHashMap<>(twoLeadsConfigured());
-        tabToName.put("lead: impostor", "impostor");

-        assertFalse(scanner(herdr, tabToName, new AtomicLong()).get().containsKey("term_impostor"));
+        assertFalse(scanner(herdr, Map.of(), new AtomicLong()).get().containsKey("term_impostor"));
    }

    @Test
-    void aLabelWithNoConfiguredEntryIsIgnored() {
+    void aBarePrefixNamesNobodyAndIsRejected() {
        TopologyHerdr herdr = new TopologyHerdr().workspace("w1", "main")
-                .tab("w1:t1", "w1", "lead: nobody-configured").pane("w1:p1", "w1:t1", "term_a");
+                .tab("w1:t1", "w1", "lead:").pane("w1:p1", "w1:t1", "term_a");

-        assertEquals(Map.of(), scanner(herdr, twoLeadsConfigured(), new AtomicLong()).get(),
-                "a label that names no configured lead resolves nobody");
+        assertEquals(Map.of(), scanner(herdr, Map.of(), new AtomicLong()).get(),
+                "a lead with no name would resolve as PRIMARY with nothing to attribute it to");
    }

    @Test
-    void matchingIsCaseInsensitiveAndToleratesSurroundingWhitespace() {
+    void thePrefixMatchesCaseInsensitivelyAndTheNameIsTrimmed() {
        TopologyHerdr herdr = new TopologyHerdr().workspace("w1", "main")
-                .tab("w1:t1", "w1", "  LEAD: Opus-5.0  ").pane("w1:p1", "w1:t1", "term_a");
+                .tab("w1:t1", "w1", "  LEAD:   opus-5.0  ").pane("w1:p1", "w1:t1", "term_a");

-        assertEquals(Map.of("term_a", "opus-5.0"),
-                scanner(herdr, Map.of("lead: Opus-5.0", "opus-5.0"), new AtomicLong()).get());
+        assertEquals(Map.of("term_a", "opus-5.0"), scanner(herdr, Map.of(), new AtomicLong()).get());
    }

    @Test
@@ -204,51 +175,18 @@ class LeadTabScannerTest {
        // nothing bridged placed can land here (see the worker-space test above).
        TopologyHerdr herdr = twoLeads().pane("w1:p1b", "w1:t1", "term_opus_split");

-        assertEquals("opus-5.0",
-                scanner(herdr, twoLeadsConfigured(), new AtomicLong()).get().get("term_opus_split"));
+        assertEquals("opus-5.0", scanner(herdr, Map.of(), new AtomicLong()).get().get("term_opus_split"));
    }

-    /**
-     * CB-579 acceptance (6): this is the bug the ticket closes. A stale pin used to be merged back
-     * over every scan and never expire; now a scan is the whole answer, so a lead whose tab is gone
-     * drops out on the very next scan.
-     */
    @Test
-    void aTabNoLongerPresentDropsTheLeadOnTheNextScan() {
-        TopologyHerdr herdr = twoLeads();
-        AtomicLong clock = new AtomicLong();
-        LeadTabScanner s = scanner(herdr, twoLeadsConfigured(), clock);
-        assertTrue(s.get().containsKey("term_opus"));
+    void anExplicitlyConfiguredLeadIsMergedInAndOutranksALabel() {
+        Map<String, String> configured = Map.of("term_opus", "pinned-name", "term_extra", "from-config");

-        // The session behind term_opus restarted — herdr no longer reports that tab or pane at all.
-        herdr.tabs.remove("w1:t1");
-        herdr.panes.remove("w1:p1");
-        clock.addAndGet(TTL);
+        Map<String, String> leads = scanner(twoLeads(), configured, new AtomicLong()).get();

-        assertFalse(s.get().containsKey("term_opus"),
-                "a stale entry must expire once the tab it named is gone, not be merged back forever");
-    }
-
-    /**
-     * CB-579 acceptance (5): the whole point of matching by tab instead of {@code terminal_id} — a
-     * restart changes the terminal, not the tab, so the lead resolves under the same name with no
-     * config edit.
-     */
-    @Test
-    void aLeadRestartingInTheSameTabResolvesUnderTheSameName() {
-        TopologyHerdr herdr = twoLeads();
-        AtomicLong clock = new AtomicLong();
-        LeadTabScanner s = scanner(herdr, twoLeadsConfigured(), clock);
-        assertEquals("opus-5.0", s.get().get("term_opus"));
-
-        // The session restarts: herdr assigns the pane a new terminal_id, same tab (w1:t1).
-        herdr.panes.remove("w1:p1");
-        herdr.pane("w1:p1", "w1:t1", "term_opus_v2");
-        clock.addAndGet(TTL);
-
-        Map<String, String> leads = s.get();
-        assertEquals("opus-5.0", leads.get("term_opus_v2"), "the new terminal resolves immediately");
-        assertFalse(leads.containsKey("term_opus"), "the old terminal_id is simply gone, not carried");
+        assertEquals("pinned-name", leads.get("term_opus"), "an explicit pin is the operator's last word");
+        assertEquals("from-config", leads.get("term_extra"), "a configured lead needs no tab at all");
+        assertEquals("gpt-sol-5.6", leads.get("term_gpt"));
    }

    // ── caching ─────────────────────────────────────────────────────────────────────────────────
@@ -257,7 +195,7 @@ class LeadTabScannerTest {
    void aSecondLookupWithinTheTtlDoesNotTouchHerdr() {
        TopologyHerdr herdr = twoLeads();
        AtomicLong clock = new AtomicLong();
-        LeadTabScanner s = scanner(herdr, twoLeadsConfigured(), clock);
+        LeadTabScanner s = scanner(herdr, Map.of(), clock);

        s.get();
        int afterFirst = herdr.calls;
@@ -272,23 +210,21 @@ class LeadTabScannerTest {
    void aTabLabelledAfterStartupIsPickedUpOnceTheTtlExpires() {
        TopologyHerdr herdr = twoLeads();
        AtomicLong clock = new AtomicLong();
-        Map<String, String> tabToName = new LinkedHashMap<>(twoLeadsConfigured());
-        tabToName.put("lead: late-arrival", "late-arrival");
-        LeadTabScanner s = scanner(herdr, tabToName, clock);
+        LeadTabScanner s = scanner(herdr, Map.of(), clock);
        assertFalse(s.get().containsKey("term_notes"));

        herdr.tab("w1:t3", "w1", "lead: late-arrival"); // the operator renames their tab
        clock.addAndGet(TTL);

        assertEquals("late-arrival", s.get().get("term_notes"),
-                "the whole point over a config-held terminal_id: no config edit, no restart");
+                "the whole point over `leaders:`: no config edit, no restart");
    }

    @Test
    void aFailedScanKeepsTheLeadsAlreadyKnownRatherThanDemotingThem() {
        TopologyHerdr herdr = twoLeads();
        AtomicLong clock = new AtomicLong();
-        LeadTabScanner s = scanner(herdr, twoLeadsConfigured(), clock);
+        LeadTabScanner s = scanner(herdr, Map.of(), clock);
        Map<String, String> before = s.get();

        herdr.failing = true;
@@ -299,14 +235,14 @@ class LeadTabScannerTest {
    }

    @Test
-    void aFailedFirstScanReturnsEmptyRatherThanThrowing() {
+    void aFailedFirstScanStillHonoursTheConfiguredLeads() {
        TopologyHerdr herdr = twoLeads();
        herdr.failing = true;

-        Map<String, String> leads = scanner(herdr, twoLeadsConfigured(), new AtomicLong()).get();
+        Map<String, String> leads = scanner(herdr, Map.of("term_x", "opus-5.0"), new AtomicLong()).get();

-        assertEquals(Map.of(), leads,
-                "with nothing scanned yet and no override to fall back on, the map is simply empty");
+        assertEquals(Map.of("term_x", "opus-5.0"), leads,
+                "config-named leads must not depend on herdr answering at all");
    }

    @Test
@@ -314,7 +250,7 @@ class LeadTabScannerTest {
        TopologyHerdr herdr = twoLeads();
        herdr.failing = true;
        AtomicLong clock = new AtomicLong();
-        LeadTabScanner s = scanner(herdr, twoLeadsConfigured(), clock);
+        LeadTabScanner s = scanner(herdr, Map.of(), clock);

        s.get();
        int afterFirst = herdr.calls;
@@ -1,19 +1,9 @@
 package dev.ltms.bridged.inject;

-import ch.qos.logback.classic.Level;
-import ch.qos.logback.classic.LoggerContext;
-import ch.qos.logback.classic.spi.ILoggingEvent;
-import ch.qos.logback.core.read.ListAppender;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.msg.Rendezvous;
-import dev.ltms.bridged.msg.TestTurnTokens;
-import dev.ltms.bridged.msg.TurnToken;
 import org.junit.jupiter.api.Test;
-import org.slf4j.LoggerFactory;
-
-import java.util.Set;
-import java.util.regex.Pattern;

 import static org.junit.jupiter.api.Assertions.assertEquals;
 import static org.junit.jupiter.api.Assertions.assertFalse;
@@ -26,7 +16,7 @@ class CompletionResolverTest {
    void skipsTheScrapeWhenNoSendIsWaiting() {
        FakeHerdr herdr = new FakeHerdr();
        Rendezvous rendezvous = new Rendezvous(); // no waiter opened
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);

        resolver.resolve("term_a", null); // no in-flight turn captured for this target

@@ -38,7 +28,7 @@ class CompletionResolverTest {
    void failSkipsTheScrapeWhenNoSendIsWaiting() {
        FakeHerdr herdr = new FakeHerdr();
        Rendezvous rendezvous = new Rendezvous(); // no waiter opened
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);

        resolver.fail("term_a", null); // no in-flight turn, and no registered waiter to fall back to

@@ -50,9 +40,9 @@ class CompletionResolverTest {
    void captureBaselineSkipsTheReadWhenNoSendIsWaiting() {
        FakeHerdr herdr = new FakeHerdr().readText("⏺ X\n❯ ");
        Rendezvous rendezvous = new Rendezvous(); // no waiter opened
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);

-        resolver.captureBaseline("term_a", TestTurnTokens.inert("term_a")); // no send to attribute a later completion to
+        resolver.captureBaseline("term_a"); // no send to attribute a later completion to

        assertFalse(herdr.called("agent.read"),
                "with no waiting send there is no turn to baseline — skip the scrape");
@@ -139,7 +129,7 @@ class CompletionResolverTest {
        // send must NOT be resolved with the stale answer.
        FakeHerdr herdr = new FakeHerdr().readText("⏺ 391\n❯ ");
        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);

        var waiter = rendezvous.open("term_a");   // a send is blocked on this turn
        // The turn as captured at delivery: its waiter, and the previous turn's answer still on screen.
@@ -154,7 +144,7 @@ class CompletionResolverTest {
    void resolvesACompletionWhoseScrapeChangedSinceDelivery() {
        FakeHerdr herdr = new FakeHerdr().readText("⏺ No, 391 = 17 × 23.\n❯ "); // the worker's real answer
        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);

        var waiter = rendezvous.open("term_a");
        // Delivery baseline was the previous turn's "391"; the scrape now differs → resolve.
@@ -166,40 +156,13 @@ class CompletionResolverTest {
        assertEquals("No, 391 = 17 × 23.", waiter.getNow(null).text());
    }

-    @Test
-    void marksAClippedCompletionPaneTail() {
-        String block = "⏺ " + "x".repeat(CompletionResolver.MAX_SCRAPE_CHARS + 1) + "\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(block);
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertEquals("x".repeat(CompletionResolver.MAX_SCRAPE_CHARS)
-                        + "\n[Pane tail clipped: member did not call bridge_reply.]",
-                waiter.getNow(null).text());
-    }
-
-    @Test
-    void leavesAnUnclippedCompletionPaneTailUnmarked() {
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ complete report\n❯ ");
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertEquals("complete report", waiter.getNow(null).text());
-    }
-
    @Test
    void resolvesSynchronouslyBeforePostTurnContextClearing() {
        FakeHerdr herdr = new FakeHerdr().readText("⏺ previous answer\n❯ ");
        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);
        var waiter = rendezvous.open("term_a");
-        resolver.captureBaseline("term_a", new TurnToken("term_a", waiter));
+        resolver.captureBaseline("term_a");
        herdr.readText("⏺ answer that /clear would erase\n❯ ");

        resolver.resolveBeforePostAction("term_a");
@@ -214,15 +177,14 @@ class CompletionResolverTest {
        // block while resolve compares against a clip()'d tail. For a block longer than MAX_SCRAPE_CHARS
        // the two capped representations differ even when the pane never changed, so the CB-115
        // byte-identical guard failed to fire and a stale completion could resolve the send. Both sides
-        // must clip identically. The returned-text marker is added only after this comparison, so an
-        // unchanged >cap block on rapid back-to-back turns still stays suppressed.
+        // must clip identically; here an unchanged >cap block on rapid back-to-back turns stays suppressed.
        String longBlock = "⏺ " + "x".repeat(CompletionResolver.MAX_SCRAPE_CHARS + 500) + "\n❯ ";
        FakeHerdr herdr = new FakeHerdr().readText(longBlock);
        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);

        var waiter = rendezvous.open("term_a");        // a send is blocked on this turn
-        resolver.captureBaseline("term_a", new TurnToken("term_a", waiter)); // baseline is the clipped >cap block
+        resolver.captureBaseline("term_a");            // baseline is the clipped >cap block
        var turn = resolver.inFlight("term_a");
        assertEquals(CompletionResolver.MAX_SCRAPE_CHARS, turn.baseline().length(),
                "the delivery baseline is clipped to the same cap resolve() applies to the tail");
@@ -239,7 +201,7 @@ class CompletionResolverTest {
        // No delivery baseline (e.g. the pre-turn read failed) ⇒ never suppress; the completion resolves.
        FakeHerdr herdr = new FakeHerdr().readText("⏺ hello\n❯ ");
        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);

        var waiter = rendezvous.open("term_a");
        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
@@ -257,7 +219,7 @@ class CompletionResolverTest {
        // byte-identical guard would wrongly match the empty tail and suppress.
        FakeHerdr herdr = new FakeHerdr().healthy(false); // agent.read throws HerdrException
        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);

        var waiter = rendezvous.open("term_a");
        var turn = new CompletionResolver.InFlight(waiter, ""); // empty pane baselined at delivery
@@ -277,7 +239,7 @@ class CompletionResolverTest {
        // fail must not overwrite that value, and must not even scrape the worker — nobody needs it.
        FakeHerdr herdr = new FakeHerdr().readText("an error screen");
        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);

        var waiter = rendezvous.open("term_a");
        var turn = new CompletionResolver.InFlight(waiter, null);
@@ -298,7 +260,7 @@ class CompletionResolverTest {
        // fail falls back to the waiter currently registered on the Rendezvous and fails it.
        FakeHerdr herdr = new FakeHerdr().readText("stuck on an error screen");
        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);

        var waiter = rendezvous.open("term_a"); // send registered, but no captureBaseline ever ran
        resolver.fail("term_a", null);          // no in-flight turn → fall back to the registered waiter
@@ -308,40 +270,6 @@ class CompletionResolverTest {
        assertEquals("stuck on an error screen", waiter.getNow(null).text());
    }

-    @Test
-    void failIsLoggedAtWarnWithTheReason() {
-        // CB-564: this used to be a bare DEBUG "failed send to X via turn-stall fallback" — a symptom
-        // with no cause, and below the level anyone watching for member health would see. A fail that
-        // resolves a caller's blocked send is at least WARN and must carry the reason.
-        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
-        ch.qos.logback.classic.Logger resolverLog =
-                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(CompletionResolver.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.setContext(ctx);
-        appender.start();
-        resolverLog.addAppender(appender);
-        resolverLog.setLevel(Level.WARN);
-        try {
-            FakeHerdr herdr = new FakeHerdr().readText("stuck on an error screen");
-            Rendezvous rendezvous = new Rendezvous();
-            CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-            var waiter = rendezvous.open("term_a");
-
-            resolver.fail("term_a", null);
-
-            String warn = appender.list.stream()
-                    .filter(e -> e.getLevel().equals(Level.WARN))
-                    .map(ILoggingEvent::getFormattedMessage)
-                    .findFirst()
-                    .orElse("no turn-stall WARN logged");
-            assertTrue(warn.contains("term_a"), "the log names the target: " + warn);
-            assertTrue(warn.contains("stuck on an error screen"), "the log carries the reason: " + warn);
-            assertTrue(waiter.isDone());
-        } finally {
-            resolverLog.detachAppender(appender);
-        }
-    }
-
    // --- CB-116 waiter identity: a late completion never crosses into the next turn ---------

    @Test
@@ -352,7 +280,7 @@ class CompletionResolverTest {
        // scrape to turn N+1; targeting turn N's captured waiter makes the late completion a no-op.
        FakeHerdr herdr = new FakeHerdr().readText("⏺ turn N answer\n❯ ");
        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous);

        var waiterN = rendezvous.open("term_a"); // turn N's send
        // The turn as the injector captured it at delivery (waiter + pre-turn baseline).
@@ -373,129 +301,4 @@ class CompletionResolverTest {
                "turn N stays resolved by its own reply");
        assertTrue(rendezvous.isWaiting("term_a"), "turn N+1 is still awaiting its own resolution");
    }
-
-    // --- CB-578 stage A: backend-exhausted classification ---------------------------------
-
-    @Test
-    void classifiesAMatchingScrapeAsBackendExhaustedInsteadOfACompletedReply() {
-        String block = "⏺ Working on it...\nThe usage limit has been reached. Try again later.\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(block);
-        Rendezvous rendezvous = new Rendezvous();
-        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertTrue(waiter.isDone(), "a matching scrape still resolves the blocked send");
-        assertEquals(Rendezvous.Kind.BACKEND_EXHAUSTED, waiter.getNow(null).kind(),
-                "not reported as a completed reply — the classification is distinct");
-    }
-
-    @Test
-    void theExhaustedReasonCarriesTheMatchedLine() {
-        String block = "⏺ Working on it...\nThe usage limit has been reached. Try again later.\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(block);
-        Rendezvous rendezvous = new Rendezvous();
-        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertEquals("backend exhausted (usage limit): The usage limit has been reached. Try again later.",
-                waiter.getNow(null).text(), "the reason names the real cause and carries the matched line");
-    }
-
-    @Test
-    void aWinningBackendExhaustedClassificationNotifiesTheExhaustionSink() {
-        String block = "⏺ Working on it...\nThe usage limit has been reached. Try again later.\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(block);
-        Rendezvous rendezvous = new Rendezvous();
-        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
-        java.util.List<String> notified = new java.util.ArrayList<>();
-        ExhaustionSink sink = (target, reason) -> notified.add(target + ": " + reason);
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, sink);
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertEquals(1, notified.size(), "the sink is notified exactly once for the winning classification");
-        assertTrue(notified.get(0).startsWith("term_a: "), "the sink is told which target exhausted");
-        assertTrue(notified.get(0).contains("The usage limit has been reached"),
-                "the sink is told the matched reason: " + notified.get(0));
-    }
-
-    @Test
-    void aLosingBackendExhaustedClassificationNeverNotifiesTheExhaustionSink() {
-        // The waiter was already resolved (e.g. by the worker's own reply) before this scrape landed —
-        // resolveExhausted loses the race and must return false, so the sink must not fire either.
-        String block = "⏺ Working on it...\nThe usage limit has been reached. Try again later.\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(block);
-        Rendezvous rendezvous = new Rendezvous();
-        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
-        java.util.List<String> notified = new java.util.ArrayList<>();
-        ExhaustionSink sink = (target, reason) -> notified.add(target + ": " + reason);
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, sink);
-
-        var waiter = rendezvous.open("term_a");
-        var turn = new CompletionResolver.InFlight(waiter, null);
-        assertTrue(rendezvous.resolveCompletion(waiter, "already replied"));
-
-        resolver.resolve("term_a", turn);
-
-        assertTrue(notified.isEmpty(), "a classification that loses the race must not quarantine anything");
-        assertEquals("already replied", waiter.getNow(null).text(), "the earlier resolution stands untouched");
-    }
-
-    @Test
-    void aNonMatchingScrapeResolvesAsAnOrdinaryCompletion() {
-        FakeHerdr herdr = new FakeHerdr().readText("⏺ complete report\n❯ ");
-        Rendezvous rendezvous = new Rendezvous();
-        ExhaustedPatternLookup patterns = target -> Pattern.compile("usage limit has been reached");
-        CompletionResolver resolver = new CompletionResolver(new AgentControl(herdr), rendezvous, patterns, ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertEquals(Rendezvous.Kind.COMPLETION, waiter.getNow(null).kind(),
-                "a scrape that does not match the pattern is an ordinary completion");
-        assertEquals("complete report", waiter.getNow(null).text());
-    }
-
-    @Test
-    void aProfileWithNoConfiguredPatternKeepsTodaysCompletionFallbackUnchanged() {
-        // Even a scrape that WOULD have matched some other profile's pattern must resolve as a
-        // plain completion when this target's own profile has none configured (CB-578 criterion 4).
-        String block = "⏺ The usage limit has been reached.\n❯ ";
-        FakeHerdr herdr = new FakeHerdr().readText(block);
-        Rendezvous rendezvous = new Rendezvous();
-        CompletionResolver resolver =
-                new CompletionResolver(new AgentControl(herdr), rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
-
-        var waiter = rendezvous.open("term_a");
-        resolver.resolve("term_a", new CompletionResolver.InFlight(waiter, null));
-
-        assertEquals(Rendezvous.Kind.COMPLETION, waiter.getNow(null).kind(),
-                "no pattern configured for this target's profile ⇒ unchanged completion-fallback behaviour");
-        assertEquals("The usage limit has been reached.", waiter.getNow(null).text());
-    }
-
-    @Test
-    void coverageIsOffWhenNoProfileHasAPatternConfigured() {
-        assertEquals("off (no profile has an exhaustedPattern configured; profiles: [terra])",
-                CompletionResolver.coverage(Set.of("terra"), Set.of()));
-    }
-
-    @Test
-    void coverageIsFullWhenEveryProfileHasAPatternConfigured() {
-        assertEquals("full (all profiles configured: [gx10, terra])",
-                CompletionResolver.coverage(Set.of("terra", "gx10"), Set.of("terra", "gx10")));
-    }
-
-    @Test
-    void coverageIsPartialAndNamesWhichProfilesAreConfigured() {
-        assertEquals("partial (configured: [terra]; not configured: [gx10])",
-                CompletionResolver.coverage(Set.of("terra", "gx10"), Set.of("terra")));
-    }
 }
@@ -1,16 +1,10 @@
 package dev.ltms.bridged.inject;

-import ch.qos.logback.classic.Level;
-import ch.qos.logback.classic.LoggerContext;
-import ch.qos.logback.classic.spi.ILoggingEvent;
-import ch.qos.logback.core.read.ListAppender;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.AgentStatus;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.HerdrException;
-import dev.ltms.bridged.msg.TestTurnTokens;
 import org.junit.jupiter.api.Test;
-import org.slf4j.LoggerFactory;

 import java.util.ArrayList;
 import java.util.List;
@@ -48,7 +42,7 @@ class InjectorTest {

    @Test
    void deliversWhenIdle() {
-        CompletableFuture<Void> f = injector.enqueue(T, "hello", TestTurnTokens.inert(T));
+        CompletableFuture<Void> f = injector.enqueue(T, "hello");
        assertFalse(f.isDone(), "not delivered until an injectable status arrives");
        injector.onStatus(T, AgentStatus.IDLE);
        assertTrue(f.isDone());
@@ -60,7 +54,7 @@ class InjectorTest {
        // CB-113: idle alone is not enough — hold until the worker's MCP is connected (ready).
        java.util.Set<String> ready = new java.util.HashSet<>();
        Injector inj = new Injector(new AgentControl(herdr), TurnListener.NOOP, ready::contains);
-        inj.enqueue(T, "task", TestTurnTokens.inert(T));
+        inj.enqueue(T, "task");

        inj.onStatus(T, AgentStatus.IDLE); // idle but not yet available → held out of the boot window
        assertEquals(List.of(), sent(), "must not deliver into a not-yet-available worker");
@@ -80,7 +74,7 @@ class InjectorTest {
    void resubmitsEnterWhenADeliveredMessageIsNotPickedUp() {
        // CB-113: the Enter at delivery can race the paste; while the worker stays idle (not picked
        // up), the injector re-nudges Enter so the pending paste submits.
-        injector.enqueue(T, "task", TestTurnTokens.inert(T));
+        injector.enqueue(T, "task");
        injector.onStatus(T, AgentStatus.IDLE); // deliver: paste + one Enter
        long afterDeliver = enterKeystrokes();

@@ -96,7 +90,7 @@ class InjectorTest {

    @Test
    void holdsWhileWorkingThenDeliversOnIdle() {
-        injector.enqueue(T, "later", TestTurnTokens.inert(T));
+        injector.enqueue(T, "later");
        injector.onStatus(T, AgentStatus.WORKING);
        assertEquals(List.of(), sent(), "must not inject mid-turn");
        injector.onStatus(T, AgentStatus.IDLE);
@@ -105,7 +99,7 @@ class InjectorTest {

    @Test
    void blockedIsInjectableButUnknownIsNot() {
-        injector.enqueue(T, "answer", TestTurnTokens.inert(T));
+        injector.enqueue(T, "answer");
        injector.onStatus(T, AgentStatus.UNKNOWN);
        assertEquals(List.of(), sent(), "unknown status is not safe to inject");
        injector.onStatus(T, AgentStatus.BLOCKED);
@@ -114,8 +108,8 @@ class InjectorTest {

    @Test
    void twoRapidDeliveriesNeverInterleave() {
-        injector.enqueue(T, "m1", TestTurnTokens.inert(T));
-        injector.enqueue(T, "m2", TestTurnTokens.inert(T));
+        injector.enqueue(T, "m1");
+        injector.enqueue(T, "m2");

        // First idle window delivers only m1, even if idle is observed twice before pickup.
        injector.onStatus(T, AgentStatus.IDLE);
@@ -130,8 +124,8 @@ class InjectorTest {

    @Test
    void transientUnknownDoesNotReleaseThePickupLatch() {
-        injector.enqueue(T, "m1", TestTurnTokens.inert(T));
-        injector.enqueue(T, "m2", TestTurnTokens.inert(T));
+        injector.enqueue(T, "m1");
+        injector.enqueue(T, "m2");
        injector.onStatus(T, AgentStatus.IDLE); // m1 sent, awaiting pickup
        assertEquals(List.of("m1"), sent());

@@ -146,8 +140,8 @@ class InjectorTest {

    @Test
    void missedPickupEdgeIsReleasedByGraceSoTheQueueNeverWedges() {
-        injector.enqueue(T, "m1", TestTurnTokens.inert(T));
-        injector.enqueue(T, "m2", TestTurnTokens.inert(T));
+        injector.enqueue(T, "m1");
+        injector.enqueue(T, "m2");
        injector.onStatus(T, AgentStatus.IDLE); // m1 sent
        assertEquals(List.of("m1"), sent());

@@ -159,9 +153,9 @@ class InjectorTest {

    @Test
    void fifoOrderAcrossManyTurns() {
-        injector.enqueue(T, "a", TestTurnTokens.inert(T));
-        injector.enqueue(T, "b", TestTurnTokens.inert(T));
-        injector.enqueue(T, "c", TestTurnTokens.inert(T));
+        injector.enqueue(T, "a");
+        injector.enqueue(T, "b");
+        injector.enqueue(T, "c");
        for (int i = 0; i < 3; i++) {
            injector.onStatus(T, AgentStatus.IDLE);   // deliver one
            injector.onStatus(T, AgentStatus.WORKING); // pickup
@@ -173,7 +167,7 @@ class InjectorTest {
    @Test
    void activeWhileQueuedOrInFlightThenQuietAfterTurnCompletes() {
        assertTrue(injector.activeTargets().isEmpty());
-        injector.enqueue(T, "x", TestTurnTokens.inert(T));
+        injector.enqueue(T, "x");
        assertEquals(Set.of(T), injector.activeTargets(), "active while a message is queued");

        injector.onStatus(T, AgentStatus.IDLE); // delivers; awaiting pickup
@@ -192,7 +186,7 @@ class InjectorTest {
    void firesTurnCompleteOnAConfirmedWorkingThenIdle() {
        List<String> completed = new ArrayList<>();
        Injector inj = new Injector(new AgentControl(herdr), completed::add);
-        inj.enqueue(T, "task", TestTurnTokens.inert(T));
+        inj.enqueue(T, "task");

        inj.onStatus(T, AgentStatus.IDLE);    // deliver
        inj.onStatus(T, AgentStatus.WORKING); // pickup + turn running
@@ -227,8 +221,8 @@ class InjectorTest {
        }
        ResetListener listener = new ResetListener();
        Injector inj = new Injector(agents, listener);
-        inj.enqueue(T, "first", TestTurnTokens.inert(T));
-        inj.enqueue(T, "second", TestTurnTokens.inert(T));
+        inj.enqueue(T, "first");
+        inj.enqueue(T, "second");

        inj.onStatus(T, AgentStatus.IDLE);    // first delegation
        inj.onStatus(T, AgentStatus.WORKING);
@@ -247,7 +241,7 @@ class InjectorTest {
    void doesNotSynthesizeCompletionFromAnUnconfirmedTurn() {
        List<String> completed = new ArrayList<>();
        Injector inj = new Injector(new AgentControl(herdr), completed::add);
-        inj.enqueue(T, "task", TestTurnTokens.inert(T));
+        inj.enqueue(T, "task");

        // Deliver, then only ever idle — a `working` sample is never seen. The pickup grace unwedges
        // the queue but must NOT invent a completion: without a sampled turn there is no trustworthy
@@ -260,7 +254,6 @@ class InjectorTest {
    private static final class Captor implements TurnListener {
        final List<String> completed = new ArrayList<>();
        final List<String> failed = new ArrayList<>();
-        final List<String> failureReasons = new ArrayList<>();

        @Override
        public void onTurnComplete(String target) {
@@ -271,12 +264,6 @@ class InjectorTest {
        public void onTurnFailed(String target) {
            failed.add(target);
        }
-
-        @Override
-        public void onTurnFailed(String target, String reason) {
-            failed.add(target);
-            failureReasons.add(reason);
-        }
    }

    // ~30s of unknown at the 250ms prod poll interval; enough onStatus samples to trip the stall.
@@ -286,7 +273,7 @@ class InjectorTest {
    void failsAnOutstandingDelegationWhoseWorkerWedgesInUnknown() {
        Captor cap = new Captor();
        Injector inj = new Injector(new AgentControl(herdr), cap);
-        inj.enqueue(T, "task", TestTurnTokens.inert(T));
+        inj.enqueue(T, "task");

        inj.onStatus(T, AgentStatus.IDLE);    // deliver
        inj.onStatus(T, AgentStatus.WORKING); // worker starts the turn
@@ -301,7 +288,7 @@ class InjectorTest {
    void aTransientUnknownGlitchNeitherFailsNorBlocksCompletion() {
        Captor cap = new Captor();
        Injector inj = new Injector(new AgentControl(herdr), cap);
-        inj.enqueue(T, "task", TestTurnTokens.inert(T));
+        inj.enqueue(T, "task");

        inj.onStatus(T, AgentStatus.IDLE);    // deliver
        inj.onStatus(T, AgentStatus.WORKING); // confirmed turn
@@ -316,7 +303,7 @@ class InjectorTest {
    void sendFailureDropsMessageAndFailsItsFuture() {
        FakeHerdr failing = new FakeHerdr().agentSendFailsWith("send_failed");
        Injector inj = new Injector(new AgentControl(failing));
-        CompletableFuture<Void> f = inj.enqueue(T, "boom", TestTurnTokens.inert(T));
+        CompletableFuture<Void> f = inj.enqueue(T, "boom");

        inj.onStatus(T, AgentStatus.IDLE);
        assertTrue(f.isCompletedExceptionally());
@@ -325,35 +312,18 @@ class InjectorTest {

    @Test
    void dropFailsPendingWaiters() {
-        CompletableFuture<Void> f = injector.enqueue(T, "orphan", TestTurnTokens.inert(T));
+        CompletableFuture<Void> f = injector.enqueue(T, "orphan");
        injector.drop(T, new HerdrException("worker gone", "pane_not_found", null));
        assertTrue(f.isCompletedExceptionally(), "queued waiters unblock when the worker vanishes");
    }

-    @Test
-    void dropPassesTheRealCauseForQueuedAndDeliveredWork() {
-        Captor cap = new Captor();
-        Injector inj = new Injector(new AgentControl(herdr), cap);
-        CompletableFuture<Void> delivered = inj.enqueue(T, "delivered", TestTurnTokens.inert(T));
-        CompletableFuture<Void> queued = inj.enqueue(T, "queued", TestTurnTokens.inert(T));
-
-        inj.onStatus(T, AgentStatus.IDLE);    // deliver the first message
-        inj.onStatus(T, AgentStatus.WORKING); // its turn is now in flight; one remains queued
-        inj.drop(T, new HerdrException("agent target sol not found", "agent_not_found", null));
-
-        assertEquals(List.of(T), cap.failed, "drop signals one turn failure for both affected states");
-        assertEquals(List.of("agent target sol not found"), cap.failureReasons);
-        assertTrue(delivered.isDone(), "the delivered future has already completed");
-        assertTrue(queued.isCompletedExceptionally(), "the queued future fails with the drop cause");
-    }
-
    @Test
    void dropFailsTheTurnOfADeliveredMessageWhenTheWorkerVanishes() {
        // CB-110: the message was delivered (no longer queued), so failing queued waiters alone would
        // leave its send hanging. A vanished worker must fail that in-flight turn too.
        Captor cap = new Captor();
        Injector inj = new Injector(new AgentControl(herdr), cap);
-        inj.enqueue(T, "task", TestTurnTokens.inert(T));
+        inj.enqueue(T, "task");
        inj.onStatus(T, AgentStatus.IDLE);    // deliver
        inj.onStatus(T, AgentStatus.WORKING); // turn running

@@ -368,7 +338,7 @@ class InjectorTest {
        // by an off-sub worker's review of CB-110, delegated through the bridge.)
        Captor cap = new Captor();
        Injector inj = new Injector(new AgentControl(herdr), cap);
-        inj.enqueue(T, "task", TestTurnTokens.inert(T));
+        inj.enqueue(T, "task");
        inj.onStatus(T, AgentStatus.IDLE); // deliver; pickup never confirmed

        inj.drop(T, new HerdrException("worker gone", "pane_not_found", null));
@@ -387,7 +357,7 @@ class InjectorTest {
        Captor cap = new Captor();
        List<String> forgotten = new ArrayList<>();
        Injector inj = new Injector(new AgentControl(herdr), cap, _ -> false, forgotten::add);
-        CompletableFuture<Void> f = inj.enqueue(T, "task", TestTurnTokens.inert(T));
+        CompletableFuture<Void> f = inj.enqueue(T, "task");

        for (int i = 0; i < READINESS_SAMPLES; i++) inj.onStatus(T, AgentStatus.IDLE);

@@ -399,40 +369,6 @@ class InjectorTest {
        assertTrue(inj.activeTargets().isEmpty(), "the target is reclaimed, not polled forever");
    }

-    @Test
-    void readinessGraceExpiryIsLogged() {
-        // CB-562: the grace-expiry path used to clear the queue silently, so a message that never
-        // reached the worker's pane surfaced elsewhere as an unrelated turn-stall failure. Assert the
-        // expiry now names the real cause. (ListAppender capture pattern mirrors AuditLogTest.)
-        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
-        ch.qos.logback.classic.Logger injectorLog =
-                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(Injector.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.setContext(ctx);
-        appender.start();
-        injectorLog.addAppender(appender);
-        injectorLog.setLevel(Level.WARN);
-        try {
-            Injector inj = new Injector(new AgentControl(herdr), TurnListener.NOOP, _ -> false, _ -> {
-            });
-            inj.enqueue(T, "task", TestTurnTokens.inert(T));
-
-            for (int i = 0; i < READINESS_SAMPLES; i++) inj.onStatus(T, AgentStatus.IDLE);
-
-            String warn = appender.list.stream()
-                    .filter(e -> e.getLevel().equals(Level.WARN))
-                    .map(ILoggingEvent::getFormattedMessage)
-                    .findFirst()
-                    .orElse("no grace-expiry WARN logged");
-            assertTrue(warn.contains(T), "the log names the target terminal: " + warn);
-            assertTrue(warn.contains("never reached"), "the log names the real cause: " + warn);
-            assertTrue(warn.contains("1 queued message"),
-                    "the log carries the failed message count: " + warn);
-        } finally {
-            injectorLog.detachAppender(appender);
-        }
-    }
-
    @Test
    void aWorkerThatBecomesReadyWithinTheGraceIsDeliveredNormally() {
        // The readiness grace must not fail a worker that is merely slow to boot: once it becomes
@@ -440,7 +376,7 @@ class InjectorTest {
        Set<String> ready = new java.util.HashSet<>();
        Injector inj = new Injector(new AgentControl(herdr), TurnListener.NOOP, ready::contains, _ -> {
        });
-        inj.enqueue(T, "task", TestTurnTokens.inert(T));
+        inj.enqueue(T, "task");

        for (int i = 0; i < 100; i++) inj.onStatus(T, AgentStatus.IDLE); // still booting, well under grace
        assertEquals(List.of(), sent());
@@ -453,46 +389,14 @@ class InjectorTest {
    @Test
    void dropClearsWorkerPresence() {
        // CB-114 (finding #1): a vanished worker's readiness must be forgotten so a stale entry cannot
-        // linger past the worker's life (MemberPresence.forget had no caller before this).
+        // linger past the worker's life (WorkerPresence.forget had no caller before this).
        List<String> forgotten = new ArrayList<>();
        Injector inj = new Injector(new AgentControl(herdr), TurnListener.NOOP, _ -> true, forgotten::add);
-        inj.enqueue(T, "orphan", TestTurnTokens.inert(T));
+        inj.enqueue(T, "orphan");
        inj.drop(T, new HerdrException("worker gone", "pane_not_found", null));
        assertEquals(List.of(T), forgotten, "drop clears the gone worker's presence");
    }

-    @Test
-    void dropIsLogged() {
-        // CB-564: a vanished worker used to drop its queue with no log at all — the only trace was
-        // whatever failed downstream (e.g. a caller's send timing out with no clue why). Assert the
-        // drop itself now names the cause and the number of messages it failed.
-        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
-        ch.qos.logback.classic.Logger injectorLog =
-                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(Injector.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.setContext(ctx);
-        appender.start();
-        injectorLog.addAppender(appender);
-        injectorLog.setLevel(Level.WARN);
-        try {
-            Injector inj = new Injector(new AgentControl(herdr), TurnListener.NOOP, _ -> true, _ -> {
-            });
-            inj.enqueue(T, "orphan", TestTurnTokens.inert(T));
-            inj.drop(T, new HerdrException("worker gone", "pane_not_found", null));
-
-            String warn = appender.list.stream()
-                    .filter(e -> e.getLevel().equals(Level.WARN))
-                    .map(ILoggingEvent::getFormattedMessage)
-                    .findFirst()
-                    .orElse("no drop WARN logged");
-            assertTrue(warn.contains(T), "the log names the target terminal: " + warn);
-            assertTrue(warn.contains("1 message"), "the log carries the failed message count: " + warn);
-            assertTrue(warn.contains("worker gone"), "the log carries the real cause: " + warn);
-        } finally {
-            injectorLog.detachAppender(appender);
-        }
-    }
-
    @Test
    void pollerDeliversToAnIdleWorker() throws Exception {
        // End-to-end through the poller: idle worker → message delivered without manual onStatus.
@@ -501,7 +405,7 @@ class InjectorTest {
        StatusPoller poller = new StatusPoller(new AgentControl(idle), inj, 10);
        poller.start();
        try {
-            CompletableFuture<Void> delivered = inj.enqueue(T, "via-poller", TestTurnTokens.inert(T));
+            CompletableFuture<Void> delivered = inj.enqueue(T, "via-poller");
            delivered.get(2, TimeUnit.SECONDS); // completes when the poller drives the send
        } finally {
            poller.stop();
@@ -520,7 +424,7 @@ class InjectorTest {
    void deliveredFutureCarriesSendFailure() {
        FakeHerdr failing = new FakeHerdr().agentSendFailsWith("send_failed");
        Injector inj = new Injector(new AgentControl(failing));
-        CompletableFuture<Void> f = inj.enqueue(T, "boom", TestTurnTokens.inert(T));
+        CompletableFuture<Void> f = inj.enqueue(T, "boom");
        inj.onStatus(T, AgentStatus.IDLE);
        ExecutionException ex = assertThrows(ExecutionException.class, f::get);
        assertInstanceOf(HerdrException.class, ex.getCause());
@@ -11,7 +11,7 @@ class WorkerPresenceTest {

    @Test
    void tracksPresenceAndForgets() {
-        MemberPresence p = new MemberPresence();
+        WorkerPresence p = new WorkerPresence();
        assertFalse(p.isPresent("term_a"), "unseen worker is not available");

        p.markPresent("term_a");
@@ -23,7 +23,7 @@ class WorkerPresenceTest {

    @Test
    void nullOrBlankMarkIsANoOp() {
-        MemberPresence p = new MemberPresence();
+        WorkerPresence p = new WorkerPresence();
        assertDoesNotThrow(() -> {
            p.markPresent(null);
            p.markPresent("  ");
@@ -1,258 +0,0 @@
-package dev.ltms.bridged.lead;
-
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.FakeHerdr;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import org.junit.jupiter.api.Test;
-
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * CB-558 — the daemon starts a declared lead when none is running.
- *
- * <p>Two properties carry the whole feature. It must not double-spawn (a second orchestrator is
- * worse than none), and what it starts must be a <em>lead</em> and not a member: no reply charter,
- * no off-subscription env, and never registered with the session lifecycle.
- */
-class LeadLauncherTest {
-
-    /** The lead's backend: a subscription profile with the bridge mounted, as `opus` really is. */
-    private static BridgedConfig.Profile opusProfile() {
-        return new BridgedConfig.Profile(
-                "opus", null, "claude-opus-5", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", "ltms"), "tab", "bridged-workers", null,
-                "http://127.0.0.1:8765/mcp", null, null,
-                null, null, null,
-                Map.of("CLAUDE_CODE_AUTO_COMPACT_WINDOW", "300000"), null, null, true, null);
-    }
-
-    private static BridgedConfig configWith(BridgedConfig.Leader lead) {
-        Map<String, BridgedConfig.Leader> leaders = new LinkedHashMap<>();
-        leaders.put("opus", lead);
-        BridgedConfig.Fleet fleet =
-                new BridgedConfig.Fleet(leaders, Map.of(), Map.of(), Map.of(), null);
-        return new BridgedConfig(
-                null, null, Map.of("opus", opusProfile()), null, null, null, null, null,
-                null, null, fleet, null, "fixed", null).withDefaults();
-    }
-
-    private static BridgedConfig.Leader lead(String profile, String tab, int instances) {
-        return new BridgedConfig.Leader(profile, tab, instances, "lead:", 10, null, null,
-                "leads", "/repo");
-    }
-
-    private static LeadLauncher launcher(FakeHerdr herdr, BridgedConfig cfg) {
-        return new LeadLauncher(new AgentControl(herdr), new WorkspaceControl(herdr), cfg);
-    }
-
-    @SuppressWarnings("unchecked")
-    private static List<String> startedArgs(FakeHerdr herdr) {
-        return (List<String>) ((Map<String, Object>) herdr.lastCall("agent.start").params()).get("args");
-    }
-
-    private static String startedName(FakeHerdr herdr) {
-        return (String) ((Map<?, ?>) herdr.lastCall("agent.start").params()).get("name");
-    }
-
-    @SuppressWarnings("unchecked")
-    private static Map<String, String> tabEnv(FakeHerdr herdr) {
-        return (Map<String, String>) ((Map<String, Object>) herdr.lastCall("tab.create").params()).get("env");
-    }
-
-    // ── it starts a lead when none is live ────────────────────────────────────────────────────
-
-    @Test
-    void startsTheDeclaredLeadWhenNoneIsRunning() {
-        FakeHerdr herdr = new FakeHerdr();
-
-        assertEquals(1, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads());
-        assertTrue(herdr.called("agent.start"), "a lead must actually be started");
-        assertEquals("lead-opus", startedName(herdr));
-    }
-
-    /** The tab is labelled with the configured `tab:` so the scanner finds the lead on the next resolve. */
-    @Test
-    void labelsTheTabWithTheConfiguredTabValue() {
-        FakeHerdr herdr = new FakeHerdr();
-        launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads();
-
-        assertEquals("lead: opus",
-                ((Map<?, ?>) herdr.lastCall("tab.rename").params()).get("label"));
-    }
-
-    /** `instances: 2` with none live means two starts, not one. */
-    @Test
-    void startsAsManyInstancesAsAreDeclared() {
-        FakeHerdr herdr = new FakeHerdr();
-
-        assertEquals(2, launcher(herdr, configWith(lead("opus", "lead: opus", 2))).ensureLeads());
-        assertEquals(2, herdr.calls.stream().filter(c -> c.method().equals("agent.start")).count());
-    }
-
-    // ── it must not double-spawn ──────────────────────────────────────────────────────────────
-
-    /** A labelled tab WITH a running agent in it is a live lead — leave it alone. */
-    @Test
-    void doesNotStartASecondLeadWhenOneIsAlreadyRunning() {
-        FakeHerdr herdr = new FakeHerdr()
-                .withWorkspace("wL", "leads")
-                .withTab("wL", "wL:t1", "lead: opus")
-                .withAgent("lead-opus", "term_lead", "wL:p1", "wL:t1");
-
-        assertEquals(0, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads());
-        assertFalse(herdr.called("agent.start"), "the live lead must not be duplicated");
-    }
-
-    /**
-     * The reason liveness is not "does the label exist". A tab left labelled by a session that has
-     * since died must not block the relaunch, or one crash disables auto-launch permanently.
-     */
-    @Test
-    void aLabelledTabWithNoRunningAgentIsNotALiveLead() {
-        FakeHerdr herdr = new FakeHerdr()
-                .withWorkspace("wL", "leads")
-                .withTab("wL", "wL:t1", "lead: opus"); // label only — nothing running in it
-
-        assertEquals(1, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads(),
-                "a stale label is not a lead; the lead must be relaunched");
-    }
-
-    /**
-     * A lead the operator opened by hand is live once its tab carries the configured `tab:` label —
-     * CB-579 retired the `terminal:` pin, so a hand-opened lead is found the same way an
-     * auto-launched one is, by its tab, not by a terminal id nobody wrote down in advance.
-     */
-    @Test
-    void aHandOpenedLeadWithTheConfiguredTabLabelCountsAsLive() {
-        FakeHerdr herdr = new FakeHerdr()
-                .withWorkspace("wX", "main")
-                .withTab("wX", "wX:t1", "lead: opus")
-                .withAgent("hand-opened", "term_hand", "wX:p1", "wX:t1");
-
-        assertEquals(0, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads());
-        assertFalse(herdr.called("agent.start"));
-    }
-
-    /** A member sitting in a matching tab must never be counted — or spawn a lead — as one. */
-    @Test
-    void aMemberWorkspaceIsNeverScannedForLeads() {
-        FakeHerdr herdr = new FakeHerdr()
-                .withWorkspace("wM", "bridged-workers")            // a configured member space
-                .withTab("wM", "wM:t1", "lead: opus")              // a member tab that looks like a lead
-                .withAgent("claude-opus-x", "term_m", "wM:p1", "wM:t1");
-
-        assertEquals(1, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads(),
-                "a member in a lead-labelled tab is not a lead, so the real lead is still missing");
-    }
-
-    /** If herdr cannot be counted, start nothing: guessing risks a second orchestrator. */
-    @Test
-    void anUncountableHerdrStartsNothing() {
-        FakeHerdr herdr = new FakeHerdr().healthy(false);
-
-        assertEquals(0, launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads());
-        assertFalse(herdr.called("agent.start"));
-    }
-
-    // ── what it starts is a LEAD, not a member ────────────────────────────────────────────────
-
-    /**
-     * The single most important assertion here. The worker charter tells its reader it is an
-     * off-subscription worker that must end every turn with bridge_reply — the opposite of what an
-     * orchestrator is. A lead must never receive it.
-     */
-    @Test
-    void theLeadNeverReceivesTheWorkerReplyCharter() {
-        FakeHerdr herdr = new FakeHerdr();
-        launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads();
-
-        List<String> args = startedArgs(herdr);
-        assertFalse(args.contains("--append-system-prompt"),
-                "the reply charter is a worker contract and must not be injected into a lead");
-        assertTrue(args.stream().noneMatch(a -> a.contains("bridge_reply")), args.toString());
-    }
-
-    /** It still mounts the bridge — a lead that cannot orchestrate is pointless. */
-    @Test
-    void theLeadMountsTheBridgeMcpAndPinsItsModel() {
-        FakeHerdr herdr = new FakeHerdr();
-        launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads();
-
-        List<String> args = startedArgs(herdr);
-        assertTrue(args.contains("--mcp-config"));
-        assertTrue(args.stream().anyMatch(a -> a.contains("http://127.0.0.1:8765/mcp")), args.toString());
-        assertEquals("claude-opus-5", args.get(args.indexOf("--model") + 1));
-        assertTrue(args.indexOf("--model") > args.indexOf("--mcp-config"),
-                "--model is appended last so it outranks the ccs wrapper (CB-533)");
-    }
-
-    /** A lead runs on the operator's subscription. Nothing may move it off. */
-    @Test
-    void theLeadEnvCarriesNoAnthropicBinding() {
-        FakeHerdr herdr = new FakeHerdr();
-        launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads();
-
-        Map<String, String> env = tabEnv(herdr);
-        assertNull(env.get("ANTHROPIC_BASE_URL"));
-        assertNull(env.get("ANTHROPIC_AUTH_TOKEN"));
-        assertEquals("300000", env.get("CLAUDE_CODE_AUTO_COMPACT_WINDOW"),
-                "the profile's own env: still applies");
-    }
-
-    /** The lead's tab goes in its own workspace, never a member one — the scanner skips those. */
-    @Test
-    void theLeadTabIsCreatedOutsideEveryMemberWorkspace() {
-        FakeHerdr herdr = new FakeHerdr();
-        launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads();
-
-        String label = (String) ((Map<?, ?>) herdr.lastCall("workspace.create").params()).get("label");
-        assertEquals("leads", label);
-        assertNotEquals("bridged-workers", label);
-    }
-
-    // ── recognise-only and misconfiguration ───────────────────────────────────────────────────
-
-    /** A lead with a tab but no profile is recognise-only by design — not an error, not a launch. */
-    @Test
-    void aLeadThatNamesNoProfileIsRecognisedButNeverLaunched() {
-        FakeHerdr herdr = new FakeHerdr();
-
-        assertEquals(0, launcher(herdr, configWith(lead(null, "lead: dead", 1))).ensureLeads());
-        assertFalse(herdr.called("agent.start"));
-    }
-
-    /** `instances: 0` is a deliberate off switch. */
-    @Test
-    void zeroInstancesLaunchesNothing() {
-        FakeHerdr herdr = new FakeHerdr();
-
-        assertEquals(0, launcher(herdr, configWith(lead("opus", "lead: opus", 0))).ensureLeads());
-        assertFalse(herdr.called("agent.start"));
-    }
-
-    /** A profile name with no matching profile is logged and skipped, never a daemon crash. */
-    @Test
-    void anUnknownProfileIsSkippedRatherThanThrown() {
-        FakeHerdr herdr = new FakeHerdr();
-
-        assertEquals(0, launcher(herdr, configWith(lead("nope", "lead: opus", 1))).ensureLeads());
-        assertFalse(herdr.called("agent.start"));
-    }
-
-    /** No leads declared at all: not a herdr call in sight. */
-    @Test
-    void noLeadersConfiguredTouchesHerdrNotAtAll() {
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig cfg = new BridgedConfig(
-                null, null, Map.of("opus", opusProfile()), null, null, null, null, null,
-                null, null, null, null, "fixed", null).withDefaults();
-
-        assertEquals(0, launcher(herdr, cfg).ensureLeads());
-        assertTrue(herdr.calls.isEmpty(), "nothing declared ⇒ nothing scanned");
-    }
-}
@@ -1,37 +0,0 @@
-package dev.ltms.bridged.logging;
-
-import ch.qos.logback.classic.Level;
-import ch.qos.logback.classic.Logger;
-import ch.qos.logback.classic.spi.ILoggingEvent;
-import ch.qos.logback.core.read.ListAppender;
-import io.modelcontextprotocol.spec.McpSchema;
-import org.junit.jupiter.api.Test;
-import org.slf4j.LoggerFactory;
-
-import java.util.Map;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-class McpCancelledNotificationFilterTest {
-
-    @Test
-    void suppressesOnlyTheCancelledNotificationWarning() {
-        Logger logger = (Logger) LoggerFactory.getLogger(McpCancelledNotificationFilter.LOGGER);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.start();
-        logger.addAppender(appender);
-        try {
-            logger.warn(McpCancelledNotificationFilter.UNHANDLED_NOTIFICATION,
-                    new McpSchema.JSONRPCNotification("notifications/cancelled", Map.of("requestId", 7)));
-            logger.warn(McpCancelledNotificationFilter.UNHANDLED_NOTIFICATION,
-                    new McpSchema.JSONRPCNotification("notifications/progress", Map.of("progress", 1)));
-
-            assertEquals(1, appender.list.size());
-            assertEquals(Level.WARN, appender.list.getFirst().getLevel());
-            assertTrue(appender.list.getFirst().getFormattedMessage().contains("notifications/progress"));
-        } finally {
-            logger.detachAppender(appender);
-        }
-    }
-}
@@ -2,7 +2,6 @@ package dev.ltms.bridged.mcp;

 import dev.ltms.bridged.auth.Authz;
 import dev.ltms.bridged.auth.CallerResolver;
-import dev.ltms.bridged.auth.MemberRegistry;
 import dev.ltms.bridged.auth.Principal;
 import dev.ltms.bridged.auth.Role;
 import dev.ltms.bridged.config.BridgedConfig;
@@ -19,7 +18,7 @@ import dev.ltms.bridged.msg.MessageService;
 import dev.ltms.bridged.msg.Rendezvous;
 import dev.ltms.bridged.session.FakeWorktrees;
 import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.member.ClaudeCodeLauncher;
+import dev.ltms.bridged.worker.ClaudeCodeLauncher;
 import io.modelcontextprotocol.spec.McpSchema;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
@@ -56,7 +55,7 @@ class BridgeMcpAuthzTest {

    /** A fully wired BridgeMcp on fakes — constructing it is itself part of what is under test. */
    private BridgeMcp mcp(boolean enforce) {
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN", null,
                "tab", "bridged-workers", "worker: {profile} #{n}", null, null, null);
        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(agents, new WorkspaceControl(herdr),
@@ -70,10 +69,8 @@ class BridgeMcpAuthzTest {

        mcp = new BridgeMcp(messages, workers, sessions, identity, sessions.asPresence(),
                new PrimaryRegistry(null),
-                enforce ? CallerResolver.withLeadsAndMembers(identity, false, null,
-                Map::of, new MemberRegistry(null)) : null,
-                metrics, BridgeMcp.CapacitySource.none(), new BridgeMcp.HealthCoverageSource(() -> "off"),
-                BridgeMcp.QuarantineSource.none());
+                enforce ? new CallerResolver(identity) : null,
+                metrics);
        return mcp;
    }

@@ -11,12 +11,9 @@ import dev.ltms.bridged.msg.MessageService;
 import dev.ltms.bridged.msg.Rendezvous;
 import dev.ltms.bridged.session.FakeWorktrees;
 import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.inject.MemberPresence;
-import dev.ltms.bridged.session.MemberSession;
+import dev.ltms.bridged.session.WorkerSession;
 import dev.ltms.bridged.session.WorktreeRequest;
-import dev.ltms.bridged.member.ClaudeCodeLauncher;
-import dev.ltms.bridged.placement.BackendQuarantine;
+import dev.ltms.bridged.worker.ClaudeCodeLauncher;
 import io.modelcontextprotocol.spec.McpSchema;
 import dev.ltms.bridged.msg.InMemoryReplyInbox;
 import org.junit.jupiter.api.BeforeEach;
@@ -54,20 +51,8 @@ class BridgeMcpTest {
        return ((McpSchema.TextContent) r.content().getFirst()).text();
    }

-    private void assertSendRoundTrips(String target, Set<String> profiles) throws Exception {
-        CompletableFuture<McpSchema.CallToolResult> send = CompletableFuture.supplyAsync(
-                () -> BridgeMcp.send(messages, target, "hi", 4000L, null, profiles));
-        long deadline = System.currentTimeMillis() + 3000;
-        while (!rendezvous.isWaiting(target) && System.currentTimeMillis() < deadline) {
-            Thread.sleep(5);
-        }
-        assertTrue(rendezvous.isWaiting(target), "send should be accepted for " + target);
-        BridgeMcp.reply(messages, target, "received");
-        assertEquals("received", textOf(send.get(6, TimeUnit.SECONDS)));
-    }
-
    private static ClaudeCodeLauncher workerService(FakeHerdr h, String baseUrl, Set<String> allow) {
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "ltms-local", baseUrl, "coder", null, "BRIDGED_WORKER_TOKEN", null,
                "tab", "bridged-workers", "worker: {profile} #{n}", null, null, null);
        return new ClaudeCodeLauncher(new AgentControl(h), new WorkspaceControl(h),
@@ -82,7 +67,7 @@ class BridgeMcpTest {
    void sendThenReplyRoundTrips() throws Exception {
        // bridge_send blocks; bridge_reply resolves it with the worker's structured answer.
        CompletableFuture<McpSchema.CallToolResult> send = CompletableFuture.supplyAsync(
-                () -> BridgeMcp.send(messages, "term_a", "review this", 4000L, null, Set.of()));
+                () -> BridgeMcp.send(messages, "term_a", "review this", 4000L));

        // Wait until the send has opened its waiter so the reply resolves it (CB-307: reply now
        // queues in the inbox if no waiter is open, which would break the round-trip).
@@ -104,7 +89,7 @@ class BridgeMcpTest {
    @Test
    void asyncSendReturnsATicketThenPollReportsTheReply() throws Exception {
        // wait:false parity — a ticket is issued, resolved by a reply, and surfaced by bridge_poll.
-        McpSchema.CallToolResult accepted = BridgeMcp.sendAsync(messages, "term_a", "do it", null, Set.of());
+        McpSchema.CallToolResult accepted = BridgeMcp.sendAsync(messages, "term_a", "do it");
        assertNotEquals(Boolean.TRUE, accepted.isError());
        String out = textOf(accepted);
        assertTrue(out.contains("ticket="), out);
@@ -133,131 +118,6 @@ class BridgeMcpTest {
        assertEquals("async LGTM", textOf(polled));
    }

-    @Test
-    void asyncSendSurfacesAnAskThenKeepsTheTicketForTheFinalReply() throws Exception {
-        McpSchema.CallToolResult accepted = BridgeMcp.sendAsync(messages, "term_a", "do it", null, Set.of());
-        String ticket = textOf(accepted).substring(textOf(accepted).indexOf("ticket=") + "ticket=".length()).trim();
-
-        long deadline = System.currentTimeMillis() + 3000;
-        while (!rendezvous.isWaiting("term_a") && System.currentTimeMillis() < deadline) {
-            Thread.sleep(5);
-        }
-        assertTrue(rendezvous.isWaiting("term_a"));
-
-        CompletableFuture<McpSchema.CallToolResult> ask = CompletableFuture.supplyAsync(
-                () -> BridgeMcp.ask(messages, "term_a", "which config?", 5000L));
-        McpSchema.CallToolResult question = BridgeMcp.poll(messages, ticket, null);
-        deadline = System.currentTimeMillis() + 3000;
-        while (!textOf(question).contains("[question") && System.currentTimeMillis() < deadline) {
-            Thread.sleep(5);
-            question = BridgeMcp.poll(messages, ticket, null);
-        }
-        assertTrue(textOf(question).contains("which config?"), textOf(question));
-        String questionText = textOf(question);
-        String afterTurnId = questionText.substring(questionText.indexOf("turnId=\"") + "turnId=\"".length());
-        String turnId = afterTurnId.substring(0, afterTurnId.indexOf('"'));
-
-        CompletableFuture<McpSchema.CallToolResult> answer = CompletableFuture.supplyAsync(
-                () -> BridgeMcp.answer(messages, turnId, "config.yaml", 5000L));
-        assertEquals("config.yaml", textOf(ask.get(6, TimeUnit.SECONDS)));
-
-        deadline = System.currentTimeMillis() + 3000;
-        while (!rendezvous.isWaiting("term_a") && System.currentTimeMillis() < deadline) {
-            Thread.sleep(5);
-        }
-        assertTrue(rendezvous.isWaiting("term_a"));
-        BridgeMcp.reply(messages, "term_a", "done");
-        assertEquals("done", textOf(answer.get(6, TimeUnit.SECONDS)));
-
-        McpSchema.CallToolResult done = BridgeMcp.poll(messages, ticket, null);
-        deadline = System.currentTimeMillis() + 3000;
-        while (!"done".equals(textOf(done)) && System.currentTimeMillis() < deadline) {
-            Thread.sleep(5);
-            done = BridgeMcp.poll(messages, ticket, null);
-        }
-        assertEquals("done", textOf(done));
-    }
-
-    @Test
-    void unansweredAsyncAskReturnsTheTicketToPending() throws Exception {
-        McpSchema.CallToolResult accepted = BridgeMcp.sendAsync(messages, "term_a", "do it", null, Set.of());
-        String ticket = textOf(accepted).substring(textOf(accepted).indexOf("ticket=") + "ticket=".length()).trim();
-
-        long deadline = System.currentTimeMillis() + 3000;
-        while (!rendezvous.isWaiting("term_a") && System.currentTimeMillis() < deadline) {
-            Thread.sleep(5);
-        }
-        assertTrue(rendezvous.isWaiting("term_a"));
-
-        McpSchema.CallToolResult ask = BridgeMcp.ask(messages, "term_a", "still there?", 50L);
-        assertTrue(textOf(ask).contains("no answer"), textOf(ask));
-        assertTrue(textOf(BridgeMcp.poll(messages, ticket, null)).startsWith("[pending"));
-
-        BridgeMcp.reply(messages, "term_a", "finished after timeout");
-        assertEquals("finished after timeout", messages.drainReplies("term_a").getFirst().content());
-    }
-
-    @Test
-    void asyncSendFailureDoesNotLeaveItsTicketPending() throws Exception {
-        String ticket = messages.sendAsync("term_a", "do it", () -> {
-            throw new IllegalStateException("accept failed");
-        });
-
-        long deadline = System.currentTimeMillis() + 3000;
-        MessageService.TaskView view = messages.poll(ticket);
-        while (view.phase() == MessageService.Phase.PENDING && System.currentTimeMillis() < deadline) {
-            Thread.sleep(5);
-            view = messages.poll(ticket);
-        }
-        assertEquals(MessageService.Phase.FAILED, view.phase());
-        assertEquals("accept failed", view.detail());
-    }
-
-    @Test
-    void anotherAsyncTicketCannotCaptureAReplyWhileTheFirstTicketIsAsking() throws Exception {
-        McpSchema.CallToolResult firstAccepted = BridgeMcp.sendAsync(messages, "term_a", "first", null, Set.of());
-        String firstTicket = textOf(firstAccepted).substring(textOf(firstAccepted).indexOf("ticket=") + "ticket=".length()).trim();
-
-        long deadline = System.currentTimeMillis() + 3000;
-        while (!rendezvous.isWaiting("term_a") && System.currentTimeMillis() < deadline) {
-            Thread.sleep(5);
-        }
-        assertTrue(rendezvous.isWaiting("term_a"));
-
-        CompletableFuture<McpSchema.CallToolResult> ask = CompletableFuture.supplyAsync(
-                () -> BridgeMcp.ask(messages, "term_a", "which config?", 5000L));
-        MessageService.TaskView first = messages.poll(firstTicket);
-        deadline = System.currentTimeMillis() + 3000;
-        while (first.phase() != MessageService.Phase.ASKING && System.currentTimeMillis() < deadline) {
-            Thread.sleep(5);
-            first = messages.poll(firstTicket);
-        }
-        assertEquals(MessageService.Phase.ASKING, first.phase());
-        String firstTurnId = first.turnId();
-
-        McpSchema.CallToolResult secondAccepted = BridgeMcp.sendAsync(messages, "term_a", "second", null, Set.of());
-        String secondTicket = textOf(secondAccepted).substring(textOf(secondAccepted).indexOf("ticket=") + "ticket=".length()).trim();
-        MessageService.TaskView second = messages.poll(secondTicket);
-        deadline = System.currentTimeMillis() + 3000;
-        while (second.phase() == MessageService.Phase.PENDING && System.currentTimeMillis() < deadline) {
-            Thread.sleep(5);
-            second = messages.poll(secondTicket);
-        }
-        assertEquals(MessageService.Phase.FAILED, second.phase());
-
-        BridgeMcp.reply(messages, "term_a", "late reply");
-        assertEquals("late reply", messages.drainReplies("term_a").getFirst().content());
-
-        CompletableFuture<McpSchema.CallToolResult> answer = CompletableFuture.supplyAsync(
-                () -> BridgeMcp.answer(messages, firstTurnId, "config.yaml", 5000L));
-        assertEquals("config.yaml", textOf(ask.get(6, TimeUnit.SECONDS)));
-        while (!rendezvous.isWaiting("term_a") && System.currentTimeMillis() < deadline) {
-            Thread.sleep(5);
-        }
-        BridgeMcp.reply(messages, "term_a", "done");
-        assertEquals("done", textOf(answer.get(6, TimeUnit.SECONDS)));
-    }
-
    @Test
    void pollUnknownTicketIsAnError() {
        McpSchema.CallToolResult res = BridgeMcp.poll(messages, "task-999", null);
@@ -267,40 +127,15 @@ class BridgeMcpTest {

    @Test
    void sendTimesOutWithAWorkingNote() {
-        McpSchema.CallToolResult res = BridgeMcp.send(messages, "term_a", "hi", 120L, null, Set.of());
+        McpSchema.CallToolResult res = BridgeMcp.send(messages, "term_a", "hi", 120L);
        assertNotEquals(Boolean.TRUE, res.isError(), "a timeout is informational, not a tool error");
        assertTrue(textOf(res).contains("no reply"), "got: " + textOf(res));
    }

    @Test
    void sendRejectsMissingArgs() {
-        assertTrue(BridgeMcp.send(messages, null, "hi", null, null, Set.of()).isError());
-        assertTrue(BridgeMcp.send(messages, "term_a", "  ", null, null, Set.of()).isError());
-    }
-
-    @Test
-    void sendRejectsAConfiguredProfileNameBeforeAcceptingIt() {
-        McpSchema.CallToolResult blocking = BridgeMcp.send(messages, "sol", "hi", 100L, null, Set.of("sol"));
-        McpSchema.CallToolResult async = BridgeMcp.sendAsync(messages, "sol", "hi", null, Set.of("sol"));
-
-        assertTrue(blocking.isError());
-        assertTrue(async.isError());
-        assertTrue(textOf(blocking).contains("sol"));
-        assertTrue(textOf(blocking).contains("configured profile name"));
-        assertTrue(textOf(blocking).contains("bridge_list"));
-        assertFalse(textOf(async).contains("ticket="));
-    }
-
-    @Test
-    void sendAllowsPeerLeadMemberAndUnclassifiedTargets() throws Exception {
-        Set<String> profiles = Set.of("sol");
-
-        assertSendRoundTrips("term_peer_lead", profiles);
-        assertSendRoundTrips("term_live_member", profiles);
-
-        // A herdr-owned pane outside the bridge roster cannot be classified at accept time.
-        McpSchema.CallToolResult result = BridgeMcp.send(messages, "external-pane", "hi", 10L, null, profiles);
-        assertFalse(result.isError(), "an unclassified target must not be rejected at acceptance time");
+        assertTrue(BridgeMcp.send(messages, null, "hi", null).isError());
+        assertTrue(BridgeMcp.send(messages, "term_a", "  ", null).isError());
    }

    @Test
@@ -336,7 +171,7 @@ class BridgeMcpTest {
    void askThenAnswerRoundTrips() throws Exception {
        // The primary delegates and blocks; wait until its waiter is open before the worker asks.
        CompletableFuture<McpSchema.CallToolResult> send = CompletableFuture.supplyAsync(
-                () -> BridgeMcp.send(messages, "term_a", "do X", 5000L, null, Set.of()));
+                () -> BridgeMcp.send(messages, "term_a", "do X", 5000L));
        long deadline = System.currentTimeMillis() + 3000;
        while (!rendezvous.isWaiting("term_a") && System.currentTimeMillis() < deadline) {
            //noinspection BusyWait
@@ -398,7 +233,7 @@ class BridgeMcpTest {
        String out = textOf(res);
        assertTrue(out.contains("\"sessionId\":\"term_new_1\""), out);
        // CB-519: the "paneId" wire field now carries the host-unique opaque id, not the herdr pane.
-        MemberSession s = sm.roster().getFirst();
+        WorkerSession s = sm.roster().getFirst();
        assertTrue(out.contains("\"paneId\":\"" + s.paneId() + "\""), out);
        assertNotEquals("w9:pRoot_1", s.paneId(), "the id is decoupled from the herdr pane coordinate");
        assertTrue(out.contains("\"status\":\"spawning\""), out);
@@ -427,8 +262,7 @@ class BridgeMcpTest {
    void spawnPassesTheRequestedCwdToTheWorker() {
        FakeHerdr h = new FakeHerdr();
        McpSchema.CallToolResult res = BridgeMcp.spawn(
-                sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw")), null, null, "/req/dir", null, null, null,
-                null, null);
+                sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw")), null, "/req/dir", null, null, null);
        assertNotEquals(Boolean.TRUE, res.isError());
        // Protocol 19: the requested cwd roots the worker's pane at creation (tab.create).
        @SuppressWarnings("unchecked")
@@ -439,29 +273,11 @@ class BridgeMcpTest {
    @Test
    void profilesListsConfiguredProfilesAndDefault() {
        FakeHerdr h = new FakeHerdr();
-        McpSchema.CallToolResult res = BridgeMcp.profiles(
-                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), BridgeMcp.QuarantineSource.none());
+        McpSchema.CallToolResult res = BridgeMcp.profiles(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
        assertNotEquals(Boolean.TRUE, res.isError());
        String out = textOf(res);
        assertTrue(out.contains("ltms-local"), out);
        assertTrue(out.contains("\"default\":\"ltms-local\""), out);
-        assertFalse(out.contains("quarantined"), "no profile is quarantined, so the key is omitted: " + out);
-    }
-
-    @Test
-    void profilesReportsAQuarantinedCredential() {
-        FakeHerdr h = new FakeHerdr();
-        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
-        quarantine.quarantine("shared-openai");
-        BridgeMcp.QuarantineSource source = new BridgeMcp.QuarantineSource(
-                profile -> "ltms-local".equals(profile) ? "shared-openai" : null, quarantine);
-        McpSchema.CallToolResult res = BridgeMcp.profiles(
-                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), source);
-        assertNotEquals(Boolean.TRUE, res.isError());
-        String out = textOf(res);
-        assertTrue(out.contains("\"quarantined\""), out);
-        assertTrue(out.contains("shared-openai"), out);
-        assertTrue(out.contains("\"quarantinedForSeconds\":1800"), out);
    }

    @Test
@@ -469,7 +285,7 @@ class BridgeMcpTest {
        FakeHerdr h = new FakeHerdr();
        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", "term_primary",
+        WorkerSession s = sessions.acquire("ltms-local", null, "/caller/proj", "term_primary",
                new WorktreeRequest("cb-304", null));

        McpSchema.CallToolResult res = BridgeMcp.listFleet(
@@ -487,126 +303,6 @@ class BridgeMcpTest {
        assertTrue(out.contains("\"liveStatus\":\"unknown\""), out);
    }

-    @Test
-    void capacityUsesThePlacementLiveCount() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-        sessions.acquire("ltms-local", null, null, null);
-        McpSchema.CallToolResult res = BridgeMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
-                sessions, null, new BridgeMcp.CapacitySource(profile -> 2, profile -> 2,
-                () -> Set.of("ltms-local"), () -> 0), new BridgeMcp.HealthCoverageSource(() -> "off"),
-                BridgeMcp.QuarantineSource.none(), Map.of(), "");
-        String out = textOf(res);
-        assertTrue(out.contains("\"maxLoad\":2"), out);
-        assertTrue(out.contains("\"live\":2"), out);
-        assertTrue(out.contains("\"free\":0"), out);
-        assertFalse(out.contains("credentialId"), "nothing is quarantined, so no new key appears: " + out);
-        assertFalse(out.contains("quarantinedForSeconds"), out);
-    }
-
-    @Test
-    void capacityIncludesConfiguredProfileWithoutMembers() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-        String out = textOf(BridgeMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
-                sessions, null, new BridgeMcp.CapacitySource(profile -> 0, profile -> 2,
-                () -> Set.of("terra"), () -> 0), new BridgeMcp.HealthCoverageSource(() -> "off"),
-                BridgeMcp.QuarantineSource.none(), Map.of(), ""));
-        assertTrue(out.contains("\"profile\":\"terra\""), out);
-        assertTrue(out.contains("\"live\":0"), out);
-        assertTrue(out.contains("\"free\":2"), out);
-        assertTrue(out.contains("\"reclaimable\":0"), out);
-    }
-
-    @Test
-    void inertCapacitySourceOmitsCapacityBlock() {
-        FakeHerdr h = new FakeHerdr();
-        String out = textOf(BridgeMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
-                new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw"))), null,
-                BridgeMcp.CapacitySource.none(), new BridgeMcp.HealthCoverageSource(() -> "off"),
-                BridgeMcp.QuarantineSource.none(), Map.of(), ""));
-        assertFalse(out.contains("\"capacity\":"), out);
-    }
-
-    @Test
-    void quarantinedProfileReportsZeroFreeRegardlessOfMaxLoadAndLive() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(20));
-        quarantine.quarantine("shared-openai");
-        BridgeMcp.QuarantineSource source = new BridgeMcp.QuarantineSource(
-                profile -> "terra".equals(profile) ? "shared-openai" : null, quarantine);
-
-        String out = textOf(BridgeMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
-                sessions, null, new BridgeMcp.CapacitySource(profile -> 0, profile -> 2,
-                () -> Set.of("terra"), () -> 0), new BridgeMcp.HealthCoverageSource(() -> "off"),
-                source, Map.of(), ""));
-
-        assertTrue(out.contains("\"profile\":\"terra\""), out);
-        assertTrue(out.contains("\"maxLoad\":2"), out);
-        assertTrue(out.contains("\"live\":0"), out);
-        assertTrue(out.contains("\"free\":0"), out);
-        assertTrue(out.contains("\"credentialId\":\"shared-openai\""), out);
-        assertTrue(out.contains("\"quarantinedForSeconds\":1200"), out);
-    }
-
-    @Test
-    void everyProfileSharingTheQuarantinedCredentialReportsZeroFree() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(20));
-        quarantine.quarantine("shared-openai");
-        BridgeMcp.QuarantineSource source = new BridgeMcp.QuarantineSource(_ -> "shared-openai", quarantine);
-
-        String out = textOf(BridgeMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
-                sessions, null, new BridgeMcp.CapacitySource(profile -> 0, profile -> 2,
-                () -> Set.of("terra", "sol"), () -> 0), new BridgeMcp.HealthCoverageSource(() -> "off"),
-                source, Map.of(), ""));
-
-        assertEquals(2, out.split("\"free\":0", -1).length - 1, out);
-    }
-
-    @Test
-    void listAndProfilesAgreeOnWhatIsQuarantined() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(20));
-        quarantine.quarantine("shared-openai");
-        BridgeMcp.QuarantineSource source = new BridgeMcp.QuarantineSource(
-                profile -> "ltms-local".equals(profile) ? "shared-openai" : null, quarantine);
-        var workers = workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw"));
-
-        String listOut = textOf(BridgeMcp.listFleet(workers, sessions, null,
-                new BridgeMcp.CapacitySource(profile -> 0, profile -> 2, () -> Set.of("ltms-local"), () -> 0),
-                new BridgeMcp.HealthCoverageSource(() -> "off"), source, Map.of(), ""));
-        String profilesOut = textOf(BridgeMcp.profiles(workers, source));
-
-        assertTrue(listOut.contains("\"free\":0"), listOut);
-        assertTrue(listOut.contains("\"credentialId\":\"shared-openai\""), listOut);
-        assertTrue(profilesOut.contains("\"quarantined\""), profilesOut);
-        assertTrue(profilesOut.contains("shared-openai"), profilesOut);
-    }
-
-    @Test
-    void expiredQuarantineLeavesTheCapacityRowOrdinary() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-        long[] clockNanos = {0L};
-        BackendQuarantine quarantine = new BackendQuarantine(() -> clockNanos[0], TimeUnit.MINUTES.toNanos(20));
-        quarantine.quarantine("shared-openai");
-        clockNanos[0] = TimeUnit.MINUTES.toNanos(21); // clock advances past the cooldown
-        BridgeMcp.QuarantineSource source = new BridgeMcp.QuarantineSource(
-                profile -> "terra".equals(profile) ? "shared-openai" : null, quarantine);
-
-        String out = textOf(BridgeMcp.listFleet(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")),
-                sessions, null, new BridgeMcp.CapacitySource(profile -> 0, profile -> 2,
-                () -> Set.of("terra"), () -> 0), new BridgeMcp.HealthCoverageSource(() -> "off"),
-                source, Map.of(), ""));
-
-        assertTrue(out.contains("\"free\":2"), out);
-        assertFalse(out.contains("quarantinedForSeconds"), out);
-    }
-
    @Test
    void listReportsLeadsAndFlagsTheCallersOwnRow() {
        FakeHerdr h = new FakeHerdr();
@@ -637,10 +333,10 @@ class BridgeMcpTest {
        McpSchema.CallToolResult res = BridgeMcp.listFleet(
                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, Map.of(), "");

-        // An absent "leads" key is what made an empty member roster read as "no peers" (CB-535).
+        // An absent "leads" key is what made an empty worker roster read as "no peers" (CB-535).
        String out = textOf(res);
        assertTrue(out.contains("\"leads\":[]"), out);
-        assertTrue(out.contains("\"members\":[]"), out);
+        assertTrue(out.contains("\"workers\":[]"), out);
    }

    @Test
@@ -707,30 +403,6 @@ class BridgeMcpTest {
        assertDoesNotThrow(() -> messages.ackReply("term_a", msgId));
    }

-    @Test
-    void spawnedMembersAreMarkedPresent() {
-        Principal worker = Principal.worker("term_worker", 200);
-        Principal architect = Principal.architect("lead-designer", "term_design", 400);
-        MemberPresence presence = new MemberPresence();
-
-        BridgeMcp.markSpawnedMemberPresent(worker, presence);
-        BridgeMcp.markSpawnedMemberPresent(architect, presence);
-
-        assertTrue(presence.isPresent("term_worker"));
-        assertTrue(presence.isPresent("term_design"));
-    }
-
-    @Test
-    void nonMembersAreNotMarkedPresent() {
-        Principal lead = Principal.leader("opus", "term_lead", 100);
-        MemberPresence presence = new MemberPresence();
-
-        BridgeMcp.markSpawnedMemberPresent(lead, presence);
-        BridgeMcp.markSpawnedMemberPresent(Principal.anonymous(), presence);
-
-        assertFalse(presence.isPresent("term_lead"));
-    }
-
    @Test
    void statusReportsLiveAgentStatus() {
        FakeHerdr blocked = new FakeHerdr().agentStatus("blocked");
@@ -762,7 +434,7 @@ class BridgeMcpTest {
        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
        SessionManager sessions = new SessionManager(
                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", "term_primary",
+        WorkerSession s = sessions.acquire("ltms-local", null, "/caller/proj", "term_primary",
                new WorktreeRequest("cb-517", null));

        McpSchema.CallToolResult res = BridgeMcp.whoami(Principal.worker(s.terminalId(), 200), sessions);
@@ -845,101 +517,4 @@ class BridgeMcpTest {
        BridgeMcp.recordPrimarySingleton(legacy, "term_x", null);
        assertTrue(legacy.primaryTerminal().isEmpty(), "no caller means nothing is recorded");
    }
-
-    // --- member taxonomy (CB-557) ---------------------------------------------------------
-
-    @Test
-    void bridgeListReportsMembersNotWorkersAndCarriesEachRole() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-        sessions.acquire("ltms-local", MemberRole.REVIEWER, null, "/caller/proj", "term_primary", null);
-
-        McpSchema.CallToolResult res = BridgeMcp.listFleet(
-                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, Map.of(), "");
-
-        String out = textOf(res);
-        assertTrue(out.contains("\"members\":"), "the roster half is named members: " + out);
-        assertFalse(out.contains("\"workers\":"), "the old key must be gone: " + out);
-        assertTrue(out.contains("\"role\":\"reviewer\""), out);
-    }
-
-    /**
-     * Role and profile are separate axes, so the roster has to report both. Two members on one
-     * backend may still be allowed to do entirely different things.
-     */
-    @Test
-    void aRosterRowCarriesBothItsRoleAndItsProfile() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = new SessionManager(workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")));
-        sessions.acquire("ltms-local", MemberRole.DEV, null, "/caller/proj", "term_primary", null);
-        sessions.acquire("ltms-local", MemberRole.REVIEWER, null, "/caller/proj", "term_primary", null);
-
-        String out = textOf(BridgeMcp.listFleet(
-                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, Map.of(), ""));
-
-        assertTrue(out.contains("\"role\":\"dev\""), out);
-        assertTrue(out.contains("\"role\":\"reviewer\""), out);
-        assertEquals(2, out.split("\"profile\":\"ltms-local\"", -1).length - 1,
-                "inert capacity is omitted, leaving the two member rows: " + out);
-    }
-
-    @Test
-    void spawnDefaultsTheRoleToDev() {
-        FakeHerdr h = new FakeHerdr();
-        McpSchema.CallToolResult res = BridgeMcp.spawn(
-                sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw")), null, null, null, null, null, null,
-                null, null);
-
-        assertNotEquals(Boolean.TRUE, res.isError());
-        assertTrue(textOf(res).contains("\"role\":\"dev\""), textOf(res));
-    }
-
-    @Test
-    void spawnAcceptsAnExplicitRole() {
-        FakeHerdr h = new FakeHerdr();
-        McpSchema.CallToolResult res = BridgeMcp.spawn(
-                sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw")), null, "architect",
-                null, null, null, null, null, null);
-
-        assertNotEquals(Boolean.TRUE, res.isError());
-        assertTrue(textOf(res).contains("\"role\":\"architect\""), textOf(res));
-    }
-
-    @Test
-    void spawnRejectsAnUnknownRoleAndNamesTheValidOnes() {
-        FakeHerdr h = new FakeHerdr();
-        McpSchema.CallToolResult res = BridgeMcp.spawn(
-                sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw")), null, "worker",
-                null, null, null, null, null, null);
-
-        assertEquals(Boolean.TRUE, res.isError());
-        assertTrue(textOf(res).contains("architect, dev, reviewer"), textOf(res));
-    }
-
-    // ── CB-584: bridge_spawn accepts sessionName/resumeSessionId; roster shows agentSessionId ──
-
-    @Test
-    void spawnWithResumeSessionIdPutsTheIdOnTheRoster() {
-        FakeHerdr h = new FakeHerdr();
-        SessionManager sessions = sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw"));
-
-        McpSchema.CallToolResult res = BridgeMcp.spawn(sessions, "ltms-local", null, null, null, null, null,
-                null, "cb-resume-99");
-        assertNotEquals(Boolean.TRUE, res.isError(), textOf(res));
-
-        String listOut = textOf(BridgeMcp.listFleet(
-                workerService(h, "http://gx00.gw:8000", Set.of("gx00.gw")), sessions, Map.of(), ""));
-        assertTrue(listOut.contains("\"agentSessionId\":\"cb-resume-99\""), listOut);
-    }
-
-    @Test
-    void spawnRefusesResumeSessionIdWithoutAnExplicitProfile() {
-        FakeHerdr h = new FakeHerdr();
-        McpSchema.CallToolResult res = BridgeMcp.spawn(
-                sessionManager(h, "http://gx00.gw:8000", Set.of("gx00.gw")), null, null,
-                null, null, null, null, null, "cb-resume-99");
-
-        assertEquals(Boolean.TRUE, res.isError());
-        assertTrue(textOf(res).contains("explicit profile"), textOf(res));
-    }
 }
@@ -1,136 +0,0 @@
-package dev.ltms.bridged.member;
-
-import ch.qos.logback.classic.Level;
-import ch.qos.logback.classic.Logger;
-import ch.qos.logback.classic.spi.ILoggingEvent;
-import ch.qos.logback.core.read.ListAppender;
-import dev.ltms.bridged.config.BridgedConfig;
-import dev.ltms.bridged.herdr.AgentControl;
-import dev.ltms.bridged.herdr.FakeHerdr;
-import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.CharterReceipt;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.peer.SpawnRequest;
-import org.junit.jupiter.api.Test;
-import org.slf4j.LoggerFactory;
-
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-import java.util.concurrent.atomic.AtomicReference;
-import java.util.function.Supplier;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-class HerdrPeerLauncherCharterTest {
-
-    @Test
-    void readsAndComposesTheFleetCharterForEachSpawn() {
-        AtomicReference<BridgedConfig.Fleet> fleet = new AtomicReference<>(fleet(Map.of()));
-        CapturingLauncher launcher = new CapturingLauncher(fleet::get);
-
-        launcher.spawn(new SpawnRequest("mcp", null, null, null, null, MemberRole.DEV));
-        fleet.set(fleet(Map.of("dev", "role charter")));
-        launcher.spawn(new SpawnRequest("mcp", null, null, null, null, MemberRole.DEV));
-        launcher.spawn(new SpawnRequest("no-mcp", null, null, null, null, MemberRole.DEV));
-
-        assertEquals(HerdrPeerLauncher.REPLY_CHARTER, launcher.specs.get(0).charter(),
-                "without a role charter, MCP profiles receive only the reply charter");
-        assertEquals("role charter\n\n" + HerdrPeerLauncher.REPLY_CHARTER, launcher.specs.get(1).charter(),
-                "the changed supplier value is read for the next spawn and the reply rule is last");
-        assertEquals("role charter", launcher.specs.get(2).charter(),
-                "a role charter does not depend on an MCP mount");
-    }
-
-    @Test
-    void panePlacementSpawnLogNeverContainsTheCharterText() {
-        // A pane-placement spawn used to log the whole argv (CB-571), and the charter travels
-        // inside argv — so the charter text leaked to the daemon log. Prove the legacy pane path
-        // now redacts it to its digest.
-        String secret = "TOP SECRET charter marker 99x"; // distinctive, so a leak is unambiguous
-        AtomicReference<BridgedConfig.Fleet> fleet = new AtomicReference<>(fleet(Map.of("dev", secret)));
-        CharterArgLauncher launcher = new CharterArgLauncher(fleet::get);
-
-        Logger logger = (Logger) LoggerFactory.getLogger(HerdrPeerLauncher.class);
-        Level previous = logger.getLevel();
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.start();
-        logger.addAppender(appender);
-        logger.setLevel(Level.INFO); // the test logback sets dev.ltms.bridged to WARN; a leak lives at INFO
-        try {
-            launcher.spawn(new SpawnRequest("mcp", null, null, null, null, MemberRole.DEV));
-
-            String all = String.join("\n", appender.list.stream().map(ILoggingEvent::getFormattedMessage).toList());
-            assertFalse(all.contains(secret),
-                    "the pane-placement spawn log must not contain the charter text; got:\n" + all);
-            // The "mcp" profile composes role + reply charter; the digest must match that composed
-            // string (the exact bytes the adapter receives), proving the redaction hashes and
-            // removes the real, full charter — not some placeholder.
-            String composed = secret + "\n\n" + HerdrPeerLauncher.REPLY_CHARTER;
-            assertTrue(all.contains("<charter sha256=" + CharterReceipt.digestOf(composed) + ">"),
-                    "the charter argv argument should be replaced by its digest; got:\n" + all);
-        } finally {
-            logger.setLevel(previous);
-            logger.detachAppender(appender);
-        }
-    }
-
-    private static BridgedConfig.Fleet fleet(Map<String, String> charters) {
-        return new BridgedConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(), charters, null);
-    }
-
-    private static BridgedConfig.Profile profile(String name, String mcpUrl) {
-        return new BridgedConfig.Profile(name, "http://gx00.gw:8000", null, null,
-                "BRIDGED_WORKER_TOKEN", List.of("test"), "pane", null, null, mcpUrl, null, null);
-    }
-
-    /**
-     * A launcher whose {@code buildLaunch} hands the composed charter to herdr as one argv element
-     * (what the claude-cod adapter does), so a pane-placement spawn log would print it unless the
-     * base redacts it.
-     */
-    private static final class CharterArgLauncher extends HerdrPeerLauncher {
-
-        CharterArgLauncher(Supplier<BridgedConfig.Fleet> fleet) {
-            super("test", new AgentControl(new FakeHerdr()), new WorkspaceControl(new FakeHerdr()),
-                    Map.of("mcp", profile("mcp", "http://bridge")),
-                    "mcp", _ -> null, 0, () -> 0L, () -> { }, fleet);
-        }
-
-        @Override
-        protected Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec) {
-            return new Launch(Map.of(), List.of("test", spec.charter() == null ? "none" : spec.charter()));
-        }
-
-        @Override
-        public Set<Capability> capabilities() {
-            return Set.of();
-        }
-    }
-
-    private static final class CapturingLauncher extends HerdrPeerLauncher {
-        private final List<LaunchSpec> specs = new ArrayList<>();
-
-        CapturingLauncher(Supplier<BridgedConfig.Fleet> fleet) {
-            super("test", new AgentControl(new FakeHerdr()), new WorkspaceControl(new FakeHerdr()),
-                    Map.of("mcp", profile("mcp", "http://bridge"),
-                            "no-mcp", profile("no-mcp", null)),
-                    "mcp", _ -> null, 0, () -> 0L, () -> { }, fleet);
-        }
-
-        @Override
-        protected Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec) {
-            specs.add(spec);
-            return new Launch(Map.of(), List.of("test"));
-        }
-
-        @Override
-        public Set<Capability> capabilities() {
-            return Set.of();
-        }
-    }
-}
@@ -1,216 +0,0 @@
-package dev.ltms.bridged.msg;
-
-import dev.ltms.bridged.herdr.AgentStatus;
-import dev.ltms.bridged.mcp.PrimaryRegistry;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.session.MemberSession;
-import org.junit.jupiter.api.AfterEach;
-import org.junit.jupiter.api.BeforeEach;
-import org.junit.jupiter.api.Test;
-
-import java.util.List;
-import java.util.concurrent.Executors;
-import java.util.concurrent.ScheduledExecutorService;
-import java.util.concurrent.TimeUnit;
-
-import static org.junit.jupiter.api.Assertions.*;
-
-/**
- * Unit tests for the CB-551 idle-lead heartbeat: the pure {@link LeadHeartbeatLoop#decide} decision
- * function, the nudge text, and the {@link LeadHeartbeatLoop#snapshot} fleet snapshot.
- *
- * <p>All decision tests call {@code decide} directly with explicit nanoTime values from an injected
- * clock — no sleeping, no scheduler races. This mirrors how {@code ReplyPushLoopTest} pins the pure
- * decision before exercising the loop.
- */
-class LeadHeartbeatLoopTest {
-
-    /** Arbitrary nanoTime origin for the fake clock. */
-    private static final long NOW = 1_000_000_000L;
-    /** 300s (the default quiet period) in nanos — under it the lead is "within the quiet period". */
-    private static final long IDLE_AFTER_NANOS = TimeUnit.SECONDS.toNanos(300);
-    /** 400s of idle — clearly past the quiet period. */
-    private static final long IDLE_PAST = NOW - TimeUnit.SECONDS.toNanos(400);
-    /** 10s of idle — clearly within the quiet period. */
-    private static final long IDLE_WITHIN = NOW - TimeUnit.SECONDS.toNanos(10);
-
-    private ScheduledExecutorService scheduler;
-
-    @BeforeEach
-    void setUp() {
-        scheduler = Executors.newSingleThreadScheduledExecutor();
-    }
-
-    @AfterEach
-    void tearDown() {
-        scheduler.shutdownNow();
-    }
-
-    /** A fleet with nothing pending. */
-    private static LeadHeartbeatLoop.FleetState quietFleet() {
-        return new LeadHeartbeatLoop.FleetState(0, 0, 2, List.of());
-    }
-
-    /** A fleet with a pending reply and a DONE session. */
-    private static LeadHeartbeatLoop.FleetState pendingFleet() {
-        return new LeadHeartbeatLoop.FleetState(2, 1, 3, List.of("term_a", "term_b"));
-    }
-
-    /** The loop under test; the scheduler is never invoked on the pure decide path. */
-    private static LeadHeartbeatLoop loop(int quietCap) {
-        return new LeadHeartbeatLoop(
-                new PrimaryRegistry("term_lead"), null /*agents — unused on the decide path*/,
-                null /*inbox*/, List::of, null /*pushLoop*/, null /*scheduler*/, () -> 0L,
-                IDLE_AFTER_NANOS, 1_000L, quietCap);
-    }
-
-    // ── (a) a working lead is never injected ───────────────────────────────────────────────────
-
-    @Test
-    void aWorkingLeadIsNeverInjected() {
-        LeadHeartbeatLoop.Decision d = loop(3).decide(
-                NOW, IDLE_PAST, 0, AgentStatus.WORKING, false, true, quietFleet());
-        assertEquals(LeadHeartbeatLoop.Action.LEAD_BUSY, d.action(),
-                "a WORKING lead is making progress and must not be touched");
-        assertNull(d.idleSinceNanos(), "a busy lead resets the idle window");
-        assertEquals(0, d.quietCount(), "a busy lead re-arms the quiet counter");
-    }
-
-    @Test
-    void anUnreadableStatusIsNeverInjectedEither() {
-        // A failed status read (or a gone agent) must degrade to "do not inject", never hammer the pane.
-        LeadHeartbeatLoop.Decision d = loop(3).decide(
-                NOW, IDLE_PAST, 0, AgentStatus.UNKNOWN, false, true, pendingFleet());
-        assertEquals(LeadHeartbeatLoop.Action.LEAD_BUSY, d.action(),
-                "never inject into a state the loop cannot read");
-    }
-
-    // ── (b) an idle lead within the quiet period is not yet injected ───────────────────────────
-
-    @Test
-    void justBecameIdleStartsTheDebounceWindow() {
-        LeadHeartbeatLoop.Decision d = loop(3).decide(
-                NOW, null, 0, AgentStatus.IDLE, false, true, quietFleet());
-        assertEquals(LeadHeartbeatLoop.Action.WAIT_IDLE, d.action(),
-                "the first injectable tick only records the start of the idle stretch");
-        assertEquals(NOW, d.idleSinceNanos(), "the idle window opens at the moment the lead became injectable");
-    }
-
-    @Test
-    void idleWithinQuietPeriodIsNotInjected() {
-        LeadHeartbeatLoop.Decision d = loop(3).decide(
-                NOW, IDLE_WITHIN, 0, AgentStatus.IDLE, false, true, quietFleet());
-        assertEquals(LeadHeartbeatLoop.Action.WAIT_IDLE, d.action(),
-                "a lead idle for 10s (< 300s) has just finished a turn — do not re-prompt it");
-    }
-
-    // ── (c) an idle lead past the quiet period is injected ─────────────────────────────────────
-
-    @Test
-    void idlePastQuietPeriodIsInjected() {
-        LeadHeartbeatLoop.Decision d = loop(3).decide(
-                NOW, IDLE_PAST, 0, AgentStatus.IDLE, false, true, quietFleet());
-        assertEquals(LeadHeartbeatLoop.Action.INJECT, d.action(),
-                "a lead continuously idle past the quiet period is the reason to nudge");
-    }
-
-    @Test
-    void blockedAndDoneAreInjectableViewsOfIdle() {
-        assertEquals(LeadHeartbeatLoop.Action.INJECT, loop(3).decide(
-                NOW, IDLE_PAST, 0, AgentStatus.BLOCKED, false, true, quietFleet()).action());
-        assertEquals(LeadHeartbeatLoop.Action.INJECT, loop(3).decide(
-                NOW, IDLE_PAST, 0, AgentStatus.DONE, false, true, quietFleet()).action());
-    }
-
-    @Test
-    void nothingIsInjectedWhenNoLeadIsKnown() {
-        var d = loop(3).decide(NOW, IDLE_PAST, 0, AgentStatus.IDLE, false, false, pendingFleet());
-        assertEquals(LeadHeartbeatLoop.Action.WAIT_IDLE, d.action(),
-                "with no known lead there is nobody to nudge — keep waiting until one is discovered");
-        assertEquals(IDLE_PAST, d.idleSinceNanos(), "the idle window stays open so discovery re-arms it");
-    }
-
-    // ── (d) the quiet-nudge cap stops the loop ──────────────────────────────────────────────────
-
-    @Test
-    void quietNudgeCapStopsTheLoopWhenNothingIsPending() {
-        LeadHeartbeatLoop.Decision d = loop(3).decide(
-                NOW, IDLE_PAST, 3, AgentStatus.IDLE, false, true, quietFleet());
-        assertEquals(LeadHeartbeatLoop.Action.QUIET_DONE, d.action(),
-                "3 consecutive nothing-pending nudges have already happened — stop nagging an empty fleet");
-    }
-
-    // ── (e) new pending state resets the cap and re-arms the loop ───────────────────────────────
-
-    @Test
-    void newPendingStateResetsTheQuietCap() {
-        LeadHeartbeatLoop.Decision d = loop(3).decide(
-                NOW, IDLE_PAST, 3, AgentStatus.IDLE, false, true, pendingFleet());
-        assertEquals(LeadHeartbeatLoop.Action.INJECT, d.action(),
-                "real state appearing re-arms the loop past an exhausted cap");
-        assertEquals(0, d.quietCount(), "the pending state resets the consecutive-quiet counter");
-    }
-
-    // ── constraint 6: never race ReplyPushLoop ─────────────────────────────────────────────────
-
-    @Test
-    void standsDownWhileReplyPushLoopIsActive() {
-        LeadHeartbeatLoop.Decision d = loop(3).decide(
-                NOW, IDLE_PAST, 2, AgentStatus.IDLE, true, true, quietFleet());
-        assertEquals(LeadHeartbeatLoop.Action.STAND_DOWN, d.action(),
-                "a second injection would start a competing turn — stand aside instead");
-        assertEquals(0, d.quietCount(), "the active push is real state, so it re-arms the cap");
-    }
-
-    // ── nudge text (constraint 5: the nudge must carry state) ──────────────────────────────────
-
-    @Test
-    void pendingNudgeCarriesTheFleetFacts() {
-        String t = pendingFleet().nudgeText();
-        assertTrue(t.startsWith("Heartbeat:"), "the nudge identifies itself as a heartbeat");
-        assertTrue(t.contains("2 worker replies pending collection"), t);
-        assertTrue(t.contains("bridge_poll(target=term_a)"), t);
-        assertTrue(t.contains("bridge_poll(target=term_b)"), t);
-        assertTrue(t.contains("1 DONE session awaiting teardown"), t);
-        assertTrue(t.contains("3 workers live"), t);
-    }
-
-    @Test
-    void nothingPendingNudgeSaysExactlyThatSoTheLeadCanStandDown() {
-        String t = quietFleet().nudgeText();
-        assertTrue(t.contains("nothing pending to collect"), t);
-        assertTrue(t.contains("0 worker replies"), t);
-        assertTrue(t.contains("0 DONE sessions"), t);
-        assertTrue(t.contains("2 workers live"), t);
-        assertTrue(t.contains("stand down"), "allow the lead to stand down rather than hunt");
-    }
-
-    // ── snapshot over roster + inbox ───────────────────────────────────────────────────────────
-
-    @Test
-    void snapshotCountsRepliesDoneSessionsAndLiveWorkers() {
-        InMemoryReplyInbox inbox = new InMemoryReplyInbox();
-        inbox.own("term_w1");
-        inbox.publish("term_w1", "m1", "hello");
-        MemberSession done = new MemberSession("p1", "term_w1", "prof", MemberRole.DEV, "/cwd", null,
-                0, 0, 0, MemberSession.State.DONE, null, null);
-        MemberSession ready = new MemberSession("p2", "term_w2", "prof", MemberRole.DEV, "/cwd", null,
-                0, 0, 0, MemberSession.State.READY, null, null);
-
-        LeadHeartbeatLoop.FleetState fs = LeadHeartbeatLoop.snapshot(inbox, () -> List.of(done, ready));
-
-        assertEquals(1, fs.pendingReplies(), "one undrained reply on term_w1");
-        assertEquals(1, fs.doneSessions(), "term_w1 is DONE, awaiting teardown");
-        assertEquals(2, fs.liveWorkers(), "both sessions are still registered");
-        assertEquals(List.of("term_w1"), fs.replyTargets(), "the target with a pending reply is named");
-        assertTrue(fs.hasPending(), "a pending reply counts as fleet state to collect");
-    }
-
-    @Test
-    void snapshotWithEmptyRosterHasNoPendingState() {
-        InMemoryReplyInbox inbox = new InMemoryReplyInbox();
-        LeadHeartbeatLoop.FleetState fs = LeadHeartbeatLoop.snapshot(inbox, List::of);
-        assertFalse(fs.hasPending());
-        assertEquals(0, fs.liveWorkers());
-    }
-}
@@ -5,8 +5,6 @@ import dev.ltms.bridged.herdr.AgentStatus;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.HerdrException;
 import dev.ltms.bridged.inject.CompletionResolver;
-import dev.ltms.bridged.inject.ExhaustedPatternLookup;
-import dev.ltms.bridged.inject.ExhaustionSink;
 import dev.ltms.bridged.mcp.PrimaryRegistry;
 import dev.ltms.bridged.inject.Injector;
 import org.junit.jupiter.api.BeforeEach;
@@ -33,8 +31,7 @@ class MessageServiceTest {
    private final FakeHerdr herdr = new FakeHerdr().readText("BUILD GREEN: 391 files");
    private final AgentControl agents = new AgentControl(herdr);
    private final Rendezvous rendezvous = new Rendezvous();
-    private final CompletionResolver completion =
-            new CompletionResolver(agents, rendezvous, ExhaustedPatternLookup.none(), ExhaustionSink.none());
+    private final CompletionResolver completion = new CompletionResolver(agents, rendezvous);
    private final Injector injector = new Injector(agents, completion);
    private final InMemoryReplyInbox inbox = new InMemoryReplyInbox();
    private final MessageService messages = new MessageService(agents, injector, rendezvous, inbox);
@@ -123,36 +120,6 @@ class MessageServiceTest {
        assertFalse(reply.completed());
    }

-    @Test
-    void droppedQueuedAndDeliveredTurnsExposeTheRealCauseExactlyOnce() throws Exception {
-        CompletableFuture<MessageService.Reply> first = sendAsync();
-        awaitWaiting();
-        injector.onStatus(T, AgentStatus.IDLE);    // first delivery
-        injector.onStatus(T, AgentStatus.WORKING); // first turn in flight
-
-        CompletableFuture<Void> queued = injector.enqueue(T, "second task", TestTurnTokens.inert(T));
-        CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.currentWaiter(T);
-        injector.drop(T, new HerdrException("agent target sol not found", "agent_not_found", null));
-
-        MessageService.Reply reply = first.get(5, TimeUnit.SECONDS);
-        assertEquals(MessageService.Outcome.WORKER_FAILED, reply.outcome());
-        assertEquals("agent target sol not found", reply.text());
-        assertTrue(queued.isCompletedExceptionally(), "the queued delivery future also fails");
-        assertFalse(rendezvous.resolveFailure(waiter, "second failure"), "the waiter fails exactly once");
-    }
-
-    @Test
-    void noDropReasonKeepsTheExistingFallbackText() throws Exception {
-        herdr.readText("");
-        CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.open(T);
-
-        completion.onTurnFailed(T);
-
-        Rendezvous.Resolution resolution = waiter.get(2, TimeUnit.SECONDS);
-        assertEquals("worker did not reply; its turn ended in an unrecoverable state "
-                + "(worker unreachable or stuck)", resolution.text());
-    }
-
    // --- bridge_ask reverse rendezvous (CB-205) ------------------------------------------------

    @Test
@@ -642,298 +609,4 @@ class MessageServiceTest {
        assertTrue(view.detail() != null && view.detail().contains("released"),
                "and the detail says why, rather than 'worker unknown'");
    }
-
-    @Test
-    void abandonFailsEveryPendingAsyncTicketForTheReleasedTarget() throws Exception {
-        String first = messages.sendAsync(T, "first task");
-        awaitWaiting(); // first task owns the target lock and rendezvous waiter
-        String second = messages.sendAsync(T, "second task"); // parked on the same lock, not yet queued
-        String third = messages.sendAsync(T, "third task"); // a second queued ticket proves the full sweep
-
-        assertTrue(messages.abandon(T, "agent target term_a not found"));
-
-        assertFailedTicket(first, "agent target term_a not found");
-        assertFailedTicket(second, "agent target term_a not found");
-        assertFailedTicket(third, "agent target term_a not found");
-    }
-
-    @Test
-    void abandonDoesNotFailAnAsyncTicketWaitingForAnAnswer() throws Exception {
-        String ticket = messages.sendAsync(T, "task that asks");
-        awaitWaiting();
-        injectDelivery();
-
-        CompletableFuture<MessageService.AskResult> ask =
-                CompletableFuture.supplyAsync(() -> messages.ask(T, "which config?", 5000));
-        MessageService.TaskView asking = awaitTicketPhase(ticket, MessageService.Phase.ASKING);
-
-        assertFalse(messages.abandon(T, "agent target term_a not found"),
-                "an asking ticket is an active turn, not a pending send to sweep");
-        assertEquals(MessageService.Phase.ASKING, messages.poll(ticket).phase());
-
-        CompletableFuture<MessageService.Reply> answer = CompletableFuture.supplyAsync(
-                () -> messages.answer(asking.turnId(), "config.yaml", 5000));
-        assertEquals("config.yaml", ask.get(5, TimeUnit.SECONDS).answer());
-        awaitWaiting();
-        assertTrue(rendezvous.resolve(T, "done"));
-        assertEquals(MessageService.Outcome.REPLIED, answer.get(5, TimeUnit.SECONDS).outcome());
-    }
-
-    @Test
-    void unansweredAsyncQuestionReturnsTheTicketToPendingAndReleasesItsTarget() throws Exception {
-        String ticket = messages.sendAsync(T, "task that asks");
-        awaitWaiting();
-        injectDelivery();
-
-        assertEquals(MessageService.AskOutcome.TIMED_OUT,
-                messages.ask(T, "which config?", 200).outcome());
-        assertEquals(MessageService.Phase.PENDING, messages.poll(ticket).phase(),
-                "only the question wait ended; the delegated turn may still finish");
-
-        String next = messages.sendAsync(T, "next task");
-        awaitWaiting();
-        assertTrue(rendezvous.resolve(T, "done"));
-        assertEquals(MessageService.Phase.DONE, awaitTicketPhase(next, MessageService.Phase.DONE).phase());
-    }
-
-    @Test
-    void asyncQuestionBelongsToTheTaskThatOwnsItsForwardWaiter() throws Exception {
-        String first = messages.sendAsync(T, "first task");
-        awaitWaiting();
-
-        CompletableFuture<MessageService.AskResult> ask =
-                CompletableFuture.supplyAsync(() -> messages.ask(T, "which config?", 5000));
-        assertEquals(MessageService.Phase.ASKING, awaitTicketPhase(first, MessageService.Phase.ASKING).phase());
-
-        MessageService.TaskView asking = messages.poll(first);
-        CompletableFuture<MessageService.Reply> answer = CompletableFuture.supplyAsync(
-                () -> messages.answer(asking.turnId(), "config.yaml", 5000));
-        assertEquals("config.yaml", ask.get(5, TimeUnit.SECONDS).answer());
-        awaitWaiting();
-        assertTrue(rendezvous.resolve(T, "done"));
-        assertEquals(MessageService.Outcome.REPLIED, answer.get(5, TimeUnit.SECONDS).outcome());
-    }
-
-    // --- CB-588: async ticket terminal nudges ---------------------------------------------------
-    //
-    // MessageService.reply's rendezvous fast path is exactly what an async ticket always takes
-    // (sendAsync registers a rendezvous waiter — see asyncTasksByWaiter), so it never reached
-    // ReplyPushLoop.onReplyQueued. These prove the ticket reaches ReplyPushLoop through the new
-    // onTicketTerminal entry point instead, with no bridge_poll from the lead first.
-
-    private static final String LEAD = "term_lead";
-
-    /** A MessageService wired to a real ReplyPushLoop pointed at a private herdr fake for the lead. */
-    private record PushWiring(MessageService service, FakeHerdr leadHerdr,
-                              java.util.concurrent.ScheduledExecutorService scheduler) implements AutoCloseable {
-        @Override
-        public void close() {
-            scheduler.shutdownNow();
-        }
-    }
-
-    private PushWiring wireWithPushLoop(int maxReminders, long backoffMs) {
-        return wireWithPushLoop(maxReminders, backoffMs, System::nanoTime);
-    }
-
-    /** As above, with an injectable clock (CB-588 follow-up: exercise pruneTerminalTickets' TTL). */
-    private PushWiring wireWithPushLoop(int maxReminders, long backoffMs, java.util.function.LongSupplier nowNanos) {
-        PrimaryRegistry registry = new PrimaryRegistry(null);
-        registry.recordDelegation(T, LEAD);
-        FakeHerdr leadHerdr = new FakeHerdr();
-        AgentControl leadAgents = new AgentControl(leadHerdr);
-        var scheduler = java.util.concurrent.Executors.newSingleThreadScheduledExecutor();
-        ReplyPushLoop pushLoop = new ReplyPushLoop(registry, leadAgents, inbox, scheduler, maxReminders, backoffMs);
-        MessageService service = new MessageService(agents, injector, rendezvous, inbox, pushLoop, null, nowNanos);
-        return new PushWiring(service, leadHerdr, scheduler);
-    }
-
-    private void awaitNudge(FakeHerdr leadHerdr) throws InterruptedException {
-        long deadline = System.currentTimeMillis() + 3000;
-        while (!leadHerdr.called("agent.prompt") && System.currentTimeMillis() < deadline) {
-            Thread.sleep(10);
-        }
-        assertTrue(leadHerdr.called("agent.prompt"), "expected a nudge in the lead's pane");
-    }
-
-    @Test
-    void anAsyncTicketThatFinishesNudgesTheLeadWithNoPriorPollCall() throws Exception {
-        try (var wiring = wireWithPushLoop(1, 50)) {
-            String ticket = wiring.service().sendAsync(T, "long task");
-            awaitWaiting();
-            injectDelivery();
-            assertTrue(rendezvous.resolve(T, "async result"));
-
-            awaitNudge(wiring.leadHerdr());
-            String nudge = wiring.leadHerdr().lastCall("agent.prompt").params().toString();
-            assertTrue(nudge.contains(ticket), "the nudge should name the ticket: " + nudge);
-            assertTrue(nudge.contains("bridge_poll(ticket="),
-                    "the nudge should name the exact ticket-collecting call: " + nudge);
-            assertFalse(nudge.toUpperCase().contains("FAILED"),
-                    "a successfully-replied ticket's nudge must not say it failed: " + nudge);
-        }
-    }
-
-    @Test
-    void aFailedAsyncTicketAlsoNudgesAndSaysSo() throws Exception {
-        try (var wiring = wireWithPushLoop(1, 50)) {
-            wiring.service().sendAsync(T, "long task");
-            awaitWaiting();
-            wiring.service().abandon(T, "session released"); // a terminal failure phase
-
-            awaitNudge(wiring.leadHerdr());
-            String nudge = wiring.leadHerdr().lastCall("agent.prompt").params().toString();
-            assertTrue(nudge.toUpperCase().contains("FAILED"), "a failed ticket's nudge must say so: " + nudge);
-        }
-    }
-
-    @Test
-    void anAlreadyCollectedTicketProducesNoNudge() throws Exception {
-        try (var wiring = wireWithPushLoop(1, 300)) { // wide backoff: poll before the first tick fires
-            String ticket = wiring.service().sendAsync(T, "long task");
-            awaitWaiting();
-            injectDelivery();
-            assertTrue(rendezvous.resolve(T, "async result"));
-
-            MessageService.TaskView view = awaitTicketPhaseOn(wiring.service(), ticket, MessageService.Phase.DONE);
-            assertEquals(MessageService.Phase.DONE, view.phase());
-
-            Thread.sleep(400); // let the scheduled tick run — it must find nothing pending
-            assertFalse(wiring.leadHerdr().called("agent.prompt"),
-                    "a ticket the lead already polled must never be nudged");
-        }
-    }
-
-    @Test
-    void severalAsyncTicketsFinishingTogetherProduceOneCoalescedNudge() throws Exception {
-        try (var wiring = wireWithPushLoop(1, 300)) { // wide backoff: both tickets land before the tick fires
-            String first = wiring.service().sendAsync(T, "first task");
-            awaitWaiting();
-            injectDelivery();
-            assertTrue(rendezvous.resolve(T, "first done"));
-            // Settle without polling: poll() itself marks a ticket collected (that's the point of
-            // anAlreadyCollectedTicketProducesNoNudge above) — using it here to detect completion
-            // would collect the ticket before the coalescing this test checks ever gets a chance.
-            Thread.sleep(100);
-
-            String second = wiring.service().sendAsync(T, "second task");
-            awaitWaiting();
-            injectDelivery();
-            assertTrue(rendezvous.resolve(T, "second done"));
-            Thread.sleep(100);
-
-            awaitNudge(wiring.leadHerdr());
-            Thread.sleep(200); // settle — nothing more should arrive beyond the one coalesced nudge
-            long nudgeCount = wiring.leadHerdr().calls.stream()
-                    .filter(c -> c.method().equals("agent.prompt")).count();
-            assertEquals(1, nudgeCount, "two tickets finishing together must produce ONE nudge, not two");
-            String nudge = wiring.leadHerdr().lastCall("agent.prompt").params().toString();
-            assertTrue(nudge.contains(first) && nudge.contains(second),
-                    "the coalesced nudge should name both tickets: " + nudge);
-        }
-    }
-
-    @Test
-    void aFleetWithNoPushLoopConfiguredBehavesExactlyAsToday() throws Exception {
-        // `messages` (the shared field) uses the no-pushLoop constructor — poll() must not throw,
-        // and no nudge mechanism exists to fire regardless of how the ticket resolves.
-        String ticket = messages.sendAsync(T, "long task");
-        awaitWaiting();
-        injectDelivery();
-        assertTrue(rendezvous.resolve(T, "async result"));
-
-        MessageService.TaskView view = awaitTicketPhase(ticket, MessageService.Phase.DONE);
-        assertEquals(MessageService.Phase.DONE, view.phase());
-        assertEquals("async result", view.reply());
-    }
-
-    /**
-     * CB-588 follow-up: {@code tasks} is the sole authority on whether a ticket exists, and
-     * {@code pruneTerminalTickets} drops entries from it once {@link MessageService#TICKET_TTL_NANOS}
-     * elapses. Before this test, that prune never told {@code ReplyPushLoop} — its own
-     * {@code pendingTickets} entry for a pruned, never-collected ticket had no remover at all, so it
-     * rode along on every later nudge to the same lead, naming a ticket {@code bridge_poll} could no
-     * longer find. Uses the injectable clock (mirroring {@code SessionManager}'s {@code nowNanos} seam
-     * for its idle reaper) to cross the 10-minute TTL without a real wait.
-     */
-    @Test
-    void aPrunedTicketIsReclaimedFromThePushLoopNotLeakedForever() throws Exception {
-        java.util.concurrent.atomic.AtomicLong clock = new java.util.concurrent.atomic.AtomicLong(1_000_000_000L);
-        // maxReminders=1 + a short backoff: the stale ticket gets its one legitimate reminder, then
-        // decideTickets hits the cap and STOPs — activeLeads drops the lead, but (before the fix)
-        // pendingTickets never drops the ticket. That is the exact "cap already STOPped" branch of
-        // the bug report, reached deterministically rather than by timing it against a live tick.
-        try (var wiring = wireWithPushLoop(1, 50, clock::get)) {
-            String stale = wiring.service().sendAsync(T, "first task");
-            awaitWaiting();
-            injectDelivery();
-            assertTrue(rendezvous.resolve(T, "stale result"));
-
-            // Let the reminder loop fire its one nudge and hit the cap (STOP removes it from
-            // activeLeads; pendingTickets is untouched either way — that asymmetry is the bug).
-            awaitNudge(wiring.leadHerdr());
-            Thread.sleep(300);
-            assertTrue(wiring.leadHerdr().lastCall("agent.prompt").params().toString().contains(stale),
-                    "sanity: the stale ticket's own reminder must have fired first");
-
-            // Cross the TTL — a real clock would need 10 minutes; the injected one does it instantly.
-            clock.addAndGet(MessageService.TICKET_TTL_NANOS + TimeUnit.SECONDS.toNanos(1));
-
-            // A second, unrelated ticket to the same target/lead reaches sendAsync, which prunes.
-            String fresh = wiring.service().sendAsync(T, "second task");
-            awaitWaiting();
-            injectDelivery();
-            assertTrue(rendezvous.resolve(T, "fresh result"));
-
-            // The fresh ticket restarts the (now-dormant) reminder loop with its own nudge.
-            long before = wiring.leadHerdr().calls.stream().filter(c -> c.method().equals("agent.prompt")).count();
-            long deadline = System.currentTimeMillis() + 3000;
-            while (wiring.leadHerdr().calls.stream().filter(c -> c.method().equals("agent.prompt")).count() <= before
-                    && System.currentTimeMillis() < deadline) {
-                Thread.sleep(10);
-            }
-            String latestNudge = wiring.leadHerdr().lastCall("agent.prompt").params().toString();
-            assertTrue(latestNudge.contains(fresh), "the fresh ticket's nudge must still arrive: " + latestNudge);
-            assertFalse(latestNudge.contains(stale),
-                    "a pruned ticket must never be named in a later nudge — it is gone and bridge_poll "
-                            + "on it would return nothing: " + latestNudge);
-
-            // And bridge_poll(ticket=stale) really does return nothing now — the nudge would have lied.
-            assertNull(wiring.service().poll(stale), "the pruned ticket must actually be gone, not just unmentioned");
-        }
-    }
-
-    private MessageService.TaskView awaitTicketPhaseOn(MessageService svc, String ticket,
-            MessageService.Phase phase) throws Exception {
-        long deadline = System.currentTimeMillis() + 3000;
-        MessageService.TaskView view;
-        do {
-            view = svc.poll(ticket);
-            if (view.phase() == phase) {
-                return view;
-            }
-            Thread.sleep(5);
-        } while (System.currentTimeMillis() < deadline);
-        assertEquals(phase, view.phase());
-        return view;
-    }
-
-    private void assertFailedTicket(String ticket, String reason) throws Exception {
-        MessageService.TaskView view = awaitTicketPhase(ticket, MessageService.Phase.FAILED);
-        assertEquals(reason, view.detail());
-    }
-
-    private MessageService.TaskView awaitTicketPhase(String ticket, MessageService.Phase phase) throws Exception {
-        long deadline = System.currentTimeMillis() + 3000;
-        MessageService.TaskView view;
-        do {
-            view = messages.poll(ticket);
-            if (view.phase() == phase) {
-                return view;
-            }
-            Thread.sleep(5);
-        } while (System.currentTimeMillis() < deadline);
-        assertEquals(phase, view.phase());
-        return view;
-    }
 }
@@ -114,17 +114,6 @@ class RendezvousTest {
                "the first resolution wins; the stored value is unchanged");
    }

-    @Test
-    void resolveExhaustedTwiceIsANoOpTheSecondTime() {
-        CompletableFuture<Rendezvous.Resolution> waiter = rendezvous.open(W);
-        assertTrue(rendezvous.resolveExhausted(waiter, "first reason"), "the first classification resolves");
-        assertFalse(rendezvous.resolveExhausted(waiter, "second reason"),
-                "a second exhausted resolution on an already-resolved waiter returns false");
-        assertEquals(Rendezvous.Kind.BACKEND_EXHAUSTED, waiter.getNow(null).kind());
-        assertEquals("first reason", waiter.getNow(null).text(),
-                "the first resolution wins; the stored value is unchanged");
-    }
-
    @Test
    void closeAskRemovesTheTurn() {
        Rendezvous.AskTicket t = rendezvous.openAsk(W);
@@ -15,7 +15,6 @@ import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 import java.util.Map;
-import java.util.Set;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.Executors;
 import java.util.concurrent.ScheduledExecutorService;
@@ -180,20 +179,6 @@ class ReplyPushLoopTest {

    // --- nudge format --------------------------------------------------------------------------

-    @Test
-    void isActiveReflectsALiveScheduleForTheHeartbeatStandDown() {
-        var rec = recordingClient();
-        agents = new AgentControl(rec);
-        inbox.publish(WORKER, "m1", "hello");
-        ReplyPushLoop loop = loop(1, 100_000); // long backoff so the tick cannot fire mid-test
-
-        loop.onReplyQueued(WORKER);
-        assertTrue(loop.isActive(), "CB-551: the heartbeat must stand aside while a reminder is live");
-
-        loop.stop();
-        assertFalse(loop.isActive(), "stopping clears the active schedule");
-    }
-
    @Test
    void nudgeFormatIsCorrect() {
        String nudge = ReplyPushLoop.NUDGE_FORMAT.formatted(WORKER, WORKER);
@@ -201,210 +186,6 @@ class ReplyPushLoopTest {
        assertTrue(nudge.contains("bridge_poll(target=term_worker)"));
    }

-    // --- CB-588: async ticket terminal nudges — decideTickets() logic --------------------------
-
-    @Test
-    void decideTicketsWithNothingPendingIsStop() {
-        agents = agentWithStatus("idle");
-        assertEquals(ReplyPushLoop.Action.STOP, loop().decideTickets(PRIMARY, 0));
-    }
-
-    @Test
-    void decideTicketsAtCapIsStop() {
-        agents = agentWithStatus("idle");
-        var loop = loop(2, 100_000);
-        loop.onTicketTerminal("task-1", WORKER, false);
-        assertEquals(ReplyPushLoop.Action.STOP, loop.decideTickets(PRIMARY, 2));
-    }
-
-    @Test
-    void decideTicketsUnderCapWithInjectableLeadIsInject() {
-        agents = agentWithStatus("idle");
-        var loop = loop(5, 100_000);
-        loop.onTicketTerminal("task-1", WORKER, false);
-        assertEquals(ReplyPushLoop.Action.INJECT, loop.decideTickets(PRIMARY, 0));
-    }
-
-    @Test
-    void decideTicketsUnderCapWithBusyLeadIsWaitBusy() {
-        agents = agentWithStatus("working");
-        var loop = loop(5, 100_000);
-        loop.onTicketTerminal("task-1", WORKER, false);
-        assertEquals(ReplyPushLoop.Action.WAIT_BUSY, loop.decideTickets(PRIMARY, 0));
-    }
-
-    @Test
-    void decideTicketsWithoutAKnownLeadIsStop() {
-        agents = agentWithStatus("idle");
-        var loop = new ReplyPushLoop(new PrimaryRegistry(null), agents, inbox, scheduler, 5, 100_000);
-        loop.onTicketTerminal("task-1", WORKER, false); // no lead known -> never registered as pending
-        assertEquals(ReplyPushLoop.Action.STOP, loop.decideTickets(PRIMARY, 0));
-    }
-
-    // --- CB-588: onTicketTerminal integration ---------------------------------------------------
-
-    @Test
-    void onTicketTerminalCausesExactlyOneNudgeNamingTheTicketAndThePollCall() throws Exception {
-        var rec = recordingClient();
-        agents = new AgentControl(rec);
-
-        loop(1, 50).onTicketTerminal("task-1", WORKER, false);
-
-        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS), "one ticket nudge should have been sent");
-        assertEquals(1, rec.sendCount());
-        String nudge = rec.sentParams().getFirst().getValue().toString();
-        assertTrue(nudge.contains("task-1"), "nudge should name the ticket");
-        assertTrue(nudge.contains("bridge_poll(ticket="), "nudge should name the exact ticket-poll call");
-        assertFalse(nudge.contains("bridge_poll(target="), "a ticket nudge must not tell the lead to run the target-poll call");
-    }
-
-    @Test
-    void aFailedTicketNudgeSaysItWasAFailure() throws Exception {
-        var rec = recordingClient();
-        agents = new AgentControl(rec);
-
-        loop(1, 50).onTicketTerminal("task-1", WORKER, true);
-
-        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS));
-        String nudge = rec.sentParams().getFirst().getValue().toString();
-        assertTrue(nudge.toUpperCase().contains("FAILED"), "a failed ticket's nudge must say so: " + nudge);
-    }
-
-    @Test
-    void severalTicketsFinishingTogetherProduceOneCoalescedNudge() throws Exception {
-        var rec = recordingClient();
-        agents = new AgentControl(rec);
-        var loop = loop(1, 300); // backoff wide enough that both onTicketTerminal calls land first
-
-        loop.onTicketTerminal("task-1", WORKER, false);
-        loop.onTicketTerminal("task-2", WORKER, true); // arrives while the schedule is already active
-
-        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS), "one coalesced nudge should have been sent");
-        assertEquals(1, rec.sendCount(), "two tickets finishing together must produce ONE nudge, not two");
-        String nudge = rec.sentParams().getFirst().getValue().toString();
-        assertTrue(nudge.contains("task-1") && nudge.contains("task-2"),
-                "the coalesced nudge should name both tickets: " + nudge);
-        assertTrue(nudge.contains("2 tickets"), "the coalesced nudge should name the count: " + nudge);
-    }
-
-    @Test
-    void onTicketTerminalIsIdempotentPerLeadWhileActive() throws Exception {
-        var rec = recordingClient();
-        agents = new AgentControl(rec);
-        rec.sendLatch = new CountDownLatch(1);
-
-        var loop = loop(1, 100);
-        loop.onTicketTerminal("task-1", WORKER, false);
-        loop.onTicketTerminal("task-1", WORKER, false); // duplicate — should not start a second schedule
-
-        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS));
-        Thread.sleep(200);
-        assertEquals(1, rec.sendCount(), "a duplicate onTicketTerminal for the same lead must not double-nudge");
-    }
-
-    @Test
-    void aTicketAlreadyCollectedProducesNoNudge() throws Exception {
-        var rec = recordingClient();
-        agents = new AgentControl(rec);
-        var loop = loop(1, 100);
-
-        loop.onTicketTerminal("task-1", WORKER, false);
-        loop.ticketCollected("task-1"); // the lead polled before the first tick fired
-
-        Thread.sleep(300); // let the scheduled tick run
-        assertEquals(0, rec.sendCount(), "an already-collected ticket must never be nudged");
-    }
-
-    @Test
-    void ticketNudgesSendUpToCapThenStop() throws Exception {
-        int cap = 2;
-        var rec = recordingClient();
-        agents = new AgentControl(rec);
-        rec.sendLatch = new CountDownLatch(cap);
-
-        loop(cap, 50).onTicketTerminal("task-1", WORKER, false);
-
-        assertTrue(rec.sendLatch.await(5, TimeUnit.SECONDS), cap + " ticket nudges should have fired");
-        Thread.sleep(300);
-        assertEquals(cap, rec.sendCount(), "exactly " + cap + " ticket nudges (cap=" + cap + ")");
-    }
-
-    @Test
-    void isActiveReflectsALiveTicketScheduleForTheHeartbeatStandDown() {
-        var rec = recordingClient();
-        agents = new AgentControl(rec);
-        ReplyPushLoop loop = loop(1, 100_000); // long backoff so the tick cannot fire mid-test
-
-        loop.onTicketTerminal("task-1", WORKER, false);
-        assertTrue(loop.isActive(), "an active ticket-reminder schedule must also stand off the heartbeat");
-
-        loop.stop();
-        assertFalse(loop.isActive(), "stopping clears the active ticket schedule too");
-    }
-
-    @Test
-    void aTicketStillPendingWhenTheLoopStopsIsNotStranded() {
-        // Regression for the race a reviewer found in gitea PR #73: onTicketTerminal's
-        // activeLeads.putIfAbsent can see the lead's slot as still occupied a moment before
-        // decideTickets' STOP releases it, so the ticket coalesces onto a schedule that is about to
-        // die and nothing ever nudges about it. Forcing that exact thread interleaving is not
-        // reliable, so this drives stopOrRestartTicketLoop — the STOP path's own release-and-recheck —
-        // directly, arranging the state it must not lose a ticket in: a ticket pending for the lead
-        // that was NOT part of the pre-decision snapshot (pendingBefore=empty), standing in for one
-        // that races in during the decision-to-release window.
-        var rec = recordingClient();
-        agents = new AgentControl(rec);
-        ReplyPushLoop loop = loop(1, 100_000); // long backoff — no natural tick fires during this test
-
-        loop.onTicketTerminal("task-1", WORKER, false); // pendingTickets={task-1}; activeLeads={PRIMARY}
-
-        // Stand in for the scheduler thread reaching decideTickets==STOP for this lead — with nothing
-        // pending at decide time — while task-1 races in before the release below runs.
-        loop.stopOrRestartTicketLoop(PRIMARY, Set.of());
-
-        assertTrue(loop.isActive(), "a ticket that raced the loop's stop must reclaim the schedule "
-                + "slot, not be stranded with no schedule left to ever nudge about it");
-    }
-
-    @Test
-    void aStaleUncollectedTicketAtCapDoesNotRestartTheLoop() {
-        // The other direction of the same fix: restarting on ANY non-empty pendingFor(lead) would be
-        // wrong. When STOP is reached because the reminder cap was hit, the same never-collected
-        // ticket is expected to still be there — that is the cap doing its job (acceptance criterion
-        // #7: nudges stay bounded). task-1 here was already accounted for at decide time (it is in
-        // pendingBefore), so it must not restart the loop just because it is still sitting there.
-        var rec = recordingClient();
-        agents = new AgentControl(rec);
-        ReplyPushLoop loop = loop(1, 100_000);
-
-        loop.onTicketTerminal("task-1", WORKER, false); // pendingTickets={task-1}; activeLeads={PRIMARY}
-
-        loop.stopOrRestartTicketLoop(PRIMARY, Set.of("task-1"));
-
-        assertFalse(loop.isActive(), "a stale ticket already accounted for at decide time must not "
-                + "restart the loop — that would defeat the reminder cap");
-    }
-
-    @Test
-    void ticketNudgeFormatIsCorrect() {
-        String single = ReplyPushLoop.TICKET_NUDGE_FORMAT.formatted("task-1", "", "task-1");
-        assertTrue(single.contains("Ticket task-1"));
-        assertTrue(single.contains("bridge_poll(ticket=task-1)"));
-
-        String multi = ReplyPushLoop.TICKETS_NUDGE_FORMAT.formatted(2, "", "task-1, task-2");
-        assertTrue(multi.contains("2 tickets"));
-        assertTrue(multi.contains("bridge_poll(ticket=...)"));
-    }
-
-    // --- CB-307 nudge path is unchanged (regression) --------------------------------------------
-
-    @Test
-    void inboxNudgeStillUsesTheOriginalTargetPollCall() {
-        String nudge = ReplyPushLoop.NUDGE_FORMAT.formatted(WORKER, WORKER);
-        assertTrue(nudge.contains("bridge_poll(target=" + WORKER + ")"),
-                "CB-588 must not change the CB-307 inbox nudge's call shape");
-    }
-
    // --- metrics (CB-512) ----------------------------------------------------------------------

    @Test
@@ -438,33 +219,6 @@ class ReplyPushLoopTest {
        assertEquals(0, metrics.count(BridgedMetrics.PUSH_NUDGES, "outcome", "delivered"));
    }

-    @Test
-    void successfulTicketNudgeIncrementsDelivered() throws Exception {
-        var rec = recordingClient();
-        agents = new AgentControl(rec);
-        Metrics metrics = new Metrics();
-
-        loop(1, 50, metrics).onTicketTerminal("task-1", WORKER, false);
-
-        assertTrue(rec.sendLatch.await(3, TimeUnit.SECONDS), "one ticket nudge should have been sent");
-        Thread.sleep(200);
-        assertEquals(1, metrics.count(BridgedMetrics.PUSH_NUDGES, "outcome", "delivered"),
-                "a successfully sent ticket nudge must count as delivered, same metric as CB-307");
-    }
-
-    @Test
-    void ticketReminderCapIncrementsExhausted() {
-        agents = agentWithStatus("idle");
-        Metrics metrics = new Metrics();
-        var loop = loop(2, 100_000, metrics);
-        loop.onTicketTerminal("task-1", WORKER, false);
-
-        assertEquals(ReplyPushLoop.Action.STOP, loop.decideTickets(PRIMARY, 2));
-
-        assertEquals(1, metrics.count(BridgedMetrics.PUSH_NUDGES, "outcome", "exhausted"),
-                "hitting the ticket reminder cap must count as exhausted");
-    }
-
    // --- helpers -------------------------------------------------------------------------------

    private ReplyPushLoop loop() {
@@ -1,20 +0,0 @@
-package dev.ltms.bridged.msg;
-
-/**
- * Explicit unbound tokens for tests that exercise delivery without an accepted send.
- *
- * <p>The waiter is {@code null} on purpose. "No accepted send" is an <em>absence</em>, and a helper
- * that handed back a fresh {@code CompletableFuture} would invent one — which is how the first
- * version of this class turned {@code captureBaselineSkipsTheReadWhenNoSendIsWaiting} red: the
- * resolver saw a non-null waiter, decided a turn was in flight, and scraped a pane that no send was
- * blocked on. An inert value must omit the fact, never fabricate it.
- */
-public final class TestTurnTokens {
-    private TestTurnTokens() {
-    }
-
-    /** A token for a delivery that no send is waiting on: it authorises nothing. */
-    public static TurnToken inert(String target) {
-        return new TurnToken(target, null);
-    }
-}
@@ -1,57 +0,0 @@
-package dev.ltms.bridged.peer;
-
-import org.junit.jupiter.api.Test;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertNotEquals;
-import static org.junit.jupiter.api.Assertions.assertNull;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-class CharterReceiptTest {
-
-    @Test
-    void recordsNoCharterConfiguredDistinctFromCharterDelivered() {
-        // No role charter configured — only the reply charter is composed. Source is "none", but
-        // text was still delivered, so absent() is false and the digest is present.
-        CharterReceipt viaReply = CharterReceipt.compose(MemberRole.DEV, "s", null, "reply charter");
-        // A role charter was configured AND delivered.
-        CharterReceipt delivered = CharterReceipt.compose(MemberRole.DEV, "s", "role charter",
-                "role charter\n\nreply charter");
-
-        // The two cases must not collapse: the no-role-charter case reports "none", the delivered
-        // case reports the config key, and their digests differ.
-        assertEquals(CharterReceipt.NO_SOURCE, viaReply.charterSource());
-        assertEquals("fleet.charters.dev", delivered.charterSource());
-        assertNotEquals(viaReply.charterSource(), delivered.charterSource());
-        assertNotEquals(viaReply.charterSha256(), delivered.charterSha256());
-
-        // Both actually delivered text — the distinction is the source and digest, not absence.
-        assertFalse(viaReply.absent());
-        assertFalse(delivered.absent());
-    }
-
-    @Test
-    void recordsExplicitAbsenceWhenNoCharterIsComposed() {
-        CharterReceipt none = CharterReceipt.compose(MemberRole.REVIEWER, "s", null, null);
-        assertTrue(none.absent());
-        assertNull(none.charterSha256());
-        assertEquals(0, none.charterBytes());
-        assertEquals(CharterReceipt.NO_SOURCE, none.charterSource(),
-                "no configured charter and nothing composed still reports a source, never a gap");
-    }
-
-    @Test
-    void digestIsStableForSameTextAndDiffersForDifferentText() {
-        assertEquals(CharterReceipt.digestOf("charter-aaa"), CharterReceipt.digestOf("charter-aaa"),
-                "the same text must always produce the same digest");
-        assertNotEquals(CharterReceipt.digestOf("charter-aaa"), CharterReceipt.digestOf("charter-bbb"),
-                "different text must produce a different digest");
-        assertNull(CharterReceipt.digestOf(""), "blank text carries no digest");
-
-        // The record's fingerprint matches the standalone digest for the same composed string.
-        CharterReceipt r = CharterReceipt.compose(MemberRole.DEV, "s", "role", "the composed text");
-        assertEquals(CharterReceipt.digestOf("the composed text"), r.charterSha256());
-        assertFalse(r.absent());
-    }
-}
@@ -1,67 +0,0 @@
-package dev.ltms.bridged.peer;
-
-import org.junit.jupiter.api.Test;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertSame;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-class MemberRoleTest {
-
-    @Test
-    void theThreeRolesAreArchitectDevAndReviewer() {
-        assertEquals(3, MemberRole.values().length,
-                "a new role changes the charter, the role file, the skill and the authz row — "
-                        + "adding one is a deliberate act, so this count is meant to fail first");
-        assertEquals("architect", MemberRole.ARCHITECT.wireName());
-        assertEquals("dev", MemberRole.DEV.wireName());
-        assertEquals("reviewer", MemberRole.REVIEWER.wireName());
-    }
-
-    @Test
-    void parseAcceptsTheWireSpelling() {
-        for (MemberRole r : MemberRole.values()) {
-            assertSame(r, MemberRole.parse(r.wireName()));
-        }
-    }
-
-    @Test
-    void parseIsCaseInsensitiveAndTrimsSurroundingSpace() {
-        assertSame(MemberRole.ARCHITECT, MemberRole.parse("Architect"));
-        assertSame(MemberRole.DEV, MemberRole.parse("  DEV  "));
-        assertSame(MemberRole.REVIEWER, MemberRole.parse("ReViEwEr"));
-    }
-
-    @Test
-    void parseRejectsAnUnknownRoleAndListsTheValidOnes() {
-        IllegalArgumentException e =
-                assertThrows(IllegalArgumentException.class, () -> MemberRole.parse("archtiect"));
-        assertTrue(e.getMessage().contains("archtiect"), e.getMessage());
-        assertTrue(e.getMessage().contains("architect, dev, reviewer"),
-                "a typo in config should be fixable from the message alone: " + e.getMessage());
-    }
-
-    @Test
-    void parseRejectsNullAndBlank() {
-        assertThrows(IllegalArgumentException.class, () -> MemberRole.parse(null));
-        assertThrows(IllegalArgumentException.class, () -> MemberRole.parse(""));
-        assertThrows(IllegalArgumentException.class, () -> MemberRole.parse("   "));
-    }
-
-    /**
-     * A lead is not a member role. A lead is not spawned — it is a pre-existing session that config
-     * recognises — so it has no launch charter to pick and never appears in a {@code members:} slot.
-     */
-    @Test
-    void leadIsNotAMemberRole() {
-        assertThrows(IllegalArgumentException.class, () -> MemberRole.parse("lead"));
-        assertThrows(IllegalArgumentException.class, () -> MemberRole.parse("primary"));
-    }
-
-    /** "worker" is the name this taxonomy replaced; it must not quietly keep working. */
-    @Test
-    void workerIsNoLongerARole() {
-        assertThrows(IllegalArgumentException.class, () -> MemberRole.parse("worker"));
-    }
-}
@@ -1,119 +0,0 @@
-package dev.ltms.bridged.placement;
-
-import org.junit.jupiter.api.Test;
-
-import java.util.Map;
-import java.util.OptionalLong;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicLong;
-
-import static org.junit.jupiter.api.Assertions.assertEquals;
-import static org.junit.jupiter.api.Assertions.assertFalse;
-import static org.junit.jupiter.api.Assertions.assertThrows;
-import static org.junit.jupiter.api.Assertions.assertTrue;
-
-/**
- * CB-578 stage B: the credential-keyed quarantine tracker itself, isolated from placement/spawn
- * wiring (that's {@code CompositePeerLauncherTest}). The clock is a plain {@link AtomicLong} of
- * nanos so expiry is exercised without a real sleep.
- */
-class BackendQuarantineTest {
-
-    @Test
-    void aFreshCredentialIsNotQuarantined() {
-        BackendQuarantine q = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
-        assertFalse(q.isQuarantined("shared-openai"));
-        assertEquals(OptionalLong.empty(), q.remainingSeconds("shared-openai"));
-    }
-
-    @Test
-    void quarantineBlocksTheCredentialForTheFullCooldown() {
-        BackendQuarantine q = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
-        q.quarantine("shared-openai");
-
-        assertTrue(q.isQuarantined("shared-openai"));
-        assertEquals(OptionalLong.of(1800L), q.remainingSeconds("shared-openai"));
-    }
-
-    @Test
-    void onlyTheQuarantinedCredentialIsAffected() {
-        BackendQuarantine q = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
-        q.quarantine("shared-openai");
-
-        assertFalse(q.isQuarantined("some-other-credential"),
-                "an unrelated credential must not be swept into the quarantine");
-    }
-
-    @Test
-    void expiresOnTheInjectedClock() {
-        AtomicLong now = new AtomicLong(0L);
-        BackendQuarantine q = new BackendQuarantine(now::get, TimeUnit.MINUTES.toNanos(30));
-        q.quarantine("shared-openai");
-        assertTrue(q.isQuarantined("shared-openai"));
-
-        now.set(TimeUnit.MINUTES.toNanos(29));
-        assertTrue(q.isQuarantined("shared-openai"), "still inside the cooldown");
-
-        now.set(TimeUnit.MINUTES.toNanos(31));
-        assertFalse(q.isQuarantined("shared-openai"), "the cooldown has elapsed on the injected clock");
-        assertEquals(OptionalLong.empty(), q.remainingSeconds("shared-openai"));
-    }
-
-    @Test
-    void aRepeatQuarantineCallRestartsTheCooldownAtFullLength() {
-        AtomicLong now = new AtomicLong(0L);
-        BackendQuarantine q = new BackendQuarantine(now::get, TimeUnit.MINUTES.toNanos(30));
-        q.quarantine("shared-openai");
-
-        now.set(TimeUnit.MINUTES.toNanos(20));
-        q.quarantine("shared-openai");
-
-        now.set(TimeUnit.MINUTES.toNanos(45)); // 25 min after the second call, 45 after the first
-        assertTrue(q.isQuarantined("shared-openai"),
-                "a fresh exhaustion resets the cooldown to full length, not the earlier shorter wait");
-    }
-
-    @Test
-    void activeRemainingSecondsListsOnlyStillQuarantinedCredentials() {
-        AtomicLong now = new AtomicLong(0L);
-        BackendQuarantine q = new BackendQuarantine(now::get, TimeUnit.MINUTES.toNanos(30));
-        q.quarantine("shared-openai");
-        q.quarantine("another-credential");
-
-        now.set(TimeUnit.MINUTES.toNanos(31));
-        q.quarantine("shared-openai"); // re-quarantined after the first one expired
-
-        Map<String, Long> active = q.activeRemainingSeconds();
-        assertEquals(Map.of("shared-openai", 1800L), active,
-                "the expired credential is dropped; the re-quarantined one is reported");
-    }
-
-    @Test
-    void noneReportsNothingQuarantinedWhenNeverToldTo() {
-        BackendQuarantine q = BackendQuarantine.none();
-
-        assertFalse(q.isQuarantined("anything"));
-        assertTrue(q.activeRemainingSeconds().isEmpty());
-    }
-
-    @Test
-    void noneIgnoresAQuarantineCallInsteadOfLockingTheCredentialForever() {
-        // .none() holds a clock frozen at 0, so if #quarantine recorded a deadline the credential
-        // would never expire — locked out for the life of the daemon. Two production
-        // CompositePeerLauncher constructors default to none(), so that failure would be silent and
-        // permanent. An inert stand-in must omit the fact, never invent one.
-        BackendQuarantine q = BackendQuarantine.none();
-
-        q.quarantine("shared-openai");
-
-        assertFalse(q.isQuarantined("shared-openai"), "none() must not quarantine anything");
-        assertTrue(q.remainingSeconds("shared-openai").isEmpty());
-        assertTrue(q.activeRemainingSeconds().isEmpty());
-    }
-
-    @Test
-    void aNonPositiveCooldownIsRejected() {
-        assertThrows(IllegalArgumentException.class, () -> new BackendQuarantine(() -> 0L, 0L));
-        assertThrows(IllegalArgumentException.class, () -> new BackendQuarantine(() -> 0L, -1L));
-    }
-}
@@ -24,13 +24,7 @@ class PlacementPolicyTest {
    private static PlacementContext ctx(List<PlacementCandidate> candidates,
                                        Function<String, Integer> liveCount,
                                        Set<String> unreachable) {
-        return ctx(candidates, liveCount, unreachable, Set.of());
-    }
-
-    private static PlacementContext ctx(List<PlacementCandidate> candidates,
-                                        Function<String, Integer> liveCount,
-                                        Set<String> unreachable, Set<String> quarantined) {
-        return new PlacementContext("b", candidates, liveCount, unreachable, quarantined);
+        return new PlacementContext("b", candidates, liveCount, unreachable);
    }

    private static PlacementContext ctx(List<PlacementCandidate> candidates,
@@ -52,37 +46,17 @@ class PlacementPolicyTest {
        PlacementPolicy policy = PlacementPolicies.fixed();
        PlacementContext ctx = new PlacementContext(null,
                List.of(PlacementCandidate.profile("a"), PlacementCandidate.profile("b")),
-                noSessions(), Set.of(), Set.of());
+                noSessions(), Set.of());
        assertEquals("a", policy.select(ctx).profile());
    }

    @Test
    void fixedThrowsWhenNoProfilesAndNoDefault() {
        PlacementPolicy policy = PlacementPolicies.fixed();
-        PlacementContext ctx = new PlacementContext(null, List.of(), noSessions(), Set.of(), Set.of());
+        PlacementContext ctx = new PlacementContext(null, List.of(), noSessions(), Set.of());
        assertThrows(PlacementException.class, () -> policy.select(ctx));
    }

-    @Test
-    void fixedSkipsQuarantinedDefault() {
-        PlacementPolicy policy = PlacementPolicies.fixed();
-        PlacementContext ctx = new PlacementContext("b",
-                List.of(PlacementCandidate.profile("a"), PlacementCandidate.profile("b")),
-                noSessions(), Set.of(), Set.of("b"));
-        assertEquals("a", policy.select(ctx).profile(),
-                "the default 'b' is quarantined, so fixed falls through to the first un-quarantined candidate");
-    }
-
-    @Test
-    void fixedThrowsWhenDefaultAndEveryCandidateQuarantined() {
-        PlacementPolicy policy = PlacementPolicies.fixed();
-        PlacementContext ctx = new PlacementContext("b",
-                List.of(PlacementCandidate.profile("a"), PlacementCandidate.profile("b")),
-                noSessions(), Set.of(), Set.of("a", "b"));
-        PlacementException e = assertThrows(PlacementException.class, () -> policy.select(ctx));
-        assertTrue(e.getMessage().contains("quarantined"), e.getMessage());
-    }
-
    @Test
    void roundRobinCyclesThroughAvailableProfiles() {
        PlacementPolicy policy = PlacementPolicies.roundRobin();
@@ -108,18 +82,6 @@ class PlacementPolicyTest {
        }
    }

-    @Test
-    void roundRobinSkipsQuarantinedProfiles() {
-        PlacementPolicy policy = PlacementPolicies.roundRobin();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a"),
-                PlacementCandidate.profile("b"));
-        PlacementContext ctx = ctx(candidates, noSessions(), Set.of(), Set.of("a"));
-        for (int i = 0; i < 5; i++) {
-            assertEquals("b", policy.select(ctx).profile(), "a is quarantined, so every pick lands on b");
-        }
-    }
-
    @Test
    void roundRobinThrowsWhenAllAtMaxLoad() {
        PlacementPolicy policy = PlacementPolicies.roundRobin();
@@ -188,29 +150,6 @@ class PlacementPolicyTest {
        assertTrue(e.getMessage().contains("maxLoad"), e.getMessage());
    }

-    @Test
-    void weightedSkipsQuarantinedProfile() {
-        PlacementPolicy policy = PlacementPolicies.weighted();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a", 1.0f, null),
-                PlacementCandidate.profile("b", 1.0f, null));
-        PlacementContext ctx = ctx(candidates, noSessions(), Set.of(), Set.of("a"));
-        for (int i = 0; i < 5; i++) {
-            assertEquals("b", policy.select(ctx).profile(), "a is quarantined, so every pick lands on b");
-        }
-    }
-
-    @Test
-    void weightedThrowsWhenAllQuarantined() {
-        PlacementPolicy policy = PlacementPolicies.weighted();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a"),
-                PlacementCandidate.profile("b"));
-        PlacementException e = assertThrows(PlacementException.class,
-                () -> policy.select(ctx(candidates, noSessions(), Set.of(), Set.of("a", "b"))));
-        assertTrue(e.getMessage().contains("quarantined"), e.getMessage());
-    }
-
    @Test
    void weightedThrowsWhenAllUnreachable() {
        PlacementPolicy policy = PlacementPolicies.weighted();
@@ -237,134 +176,8 @@ class PlacementPolicyTest {
        assertTrue(e.getMessage().contains("1 unreachable"), e.getMessage());
    }

-    // --- CB-554: weight <= 0 excludes a candidate from automatic selection ------------------
-
-    @Test
-    void weightedSkipsWeightZeroProfile() {
-        PlacementPolicy policy = PlacementPolicies.weighted();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a", 0.0f, null),
-                PlacementCandidate.profile("b", 1.0f, null));
-        for (int i = 0; i < 5; i++) {
-            assertEquals("b", policy.select(ctx(candidates, noSessions())).profile(),
-                    "a has weight 0, so every pick lands on b");
-        }
-    }
-
-    @Test
-    void weightedThrowsWhenAllWeightZero() {
-        PlacementPolicy policy = PlacementPolicies.weighted();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a", 0.0f, null),
-                PlacementCandidate.profile("b", 0.0f, null));
-        PlacementException e = assertThrows(PlacementException.class,
-                () -> policy.select(ctx(candidates, noSessions())));
-        assertTrue(e.getMessage().contains("weight 0"), e.getMessage());
-    }
-
-    @Test
-    void weightedTreatsNegativeWeightAsExcludedNotError() {
-        PlacementPolicy policy = PlacementPolicies.weighted();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a", -1.0f, null),
-                PlacementCandidate.profile("b", 1.0f, null));
-        for (int i = 0; i < 5; i++) {
-            assertEquals("b", policy.select(ctx(candidates, noSessions())).profile(),
-                    "a has a negative weight, so it is excluded like weight 0 — never picked, never an error");
-        }
-    }
-
-    @Test
-    void weightZeroAndQuarantinedIsNotDoubleCounted() {
-        PlacementPolicy policy = PlacementPolicies.weighted();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a", 0.0f, null),
-                PlacementCandidate.profile("b", 1.0f, null),
-                PlacementCandidate.profile("c", 1.0f, null));
-        // a is BOTH weight-0 and quarantined; b and c are quarantined only. If a were counted
-        // into both buckets, "quarantined" would read 3 (or the arithmetic would go negative)
-        // instead of the true count of 2 candidates actually quarantined.
-        PlacementContext mixedCtx = ctx(candidates, noSessions(), Set.of(), Set.of("a", "b", "c"));
-        PlacementException e = assertThrows(PlacementException.class, () -> policy.select(mixedCtx));
-        assertTrue(e.getMessage().contains("1 weight-0"), e.getMessage());
-        assertTrue(e.getMessage().contains("2 quarantined"), e.getMessage());
-        assertTrue(e.getMessage().contains("0 remaining"), e.getMessage());
-    }
-
-    @Test
-    void roundRobinSkipsWeightZeroProfiles() {
-        PlacementPolicy policy = PlacementPolicies.roundRobin();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a", 0.0f, null),
-                PlacementCandidate.profile("b", 1.0f, null));
-        for (int i = 0; i < 5; i++) {
-            assertEquals("b", policy.select(ctx(candidates, noSessions())).profile(),
-                    "a has weight 0, so every pick lands on b");
-        }
-    }
-
-    @Test
-    void roundRobinThrowsWhenAllWeightZero() {
-        PlacementPolicy policy = PlacementPolicies.roundRobin();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a", 0.0f, null),
-                PlacementCandidate.profile("b", 0.0f, null));
-        PlacementException e = assertThrows(PlacementException.class,
-                () -> policy.select(ctx(candidates, noSessions())));
-        assertTrue(e.getMessage().contains("weight 0"), e.getMessage());
-    }
-
-    @Test
-    void fixedSkipsWeightZeroDefault() {
-        PlacementPolicy policy = PlacementPolicies.fixed();
-        PlacementContext ctx = new PlacementContext("b",
-                List.of(PlacementCandidate.profile("a", 1.0f, null),
-                        PlacementCandidate.profile("b", 0.0f, null)),
-                noSessions(), Set.of(), Set.of());
-        assertEquals("a", policy.select(ctx).profile(),
-                "the default 'b' has weight 0, so fixed falls through to the first available candidate");
-    }
-
-    @Test
-    void fixedThrowsWhenDefaultAndEveryCandidateWeightZero() {
-        PlacementPolicy policy = PlacementPolicies.fixed();
-        PlacementContext ctx = new PlacementContext("b",
-                List.of(PlacementCandidate.profile("a", 0.0f, null),
-                        PlacementCandidate.profile("b", 0.0f, null)),
-                noSessions(), Set.of(), Set.of());
-        PlacementException e = assertThrows(PlacementException.class, () -> policy.select(ctx));
-        assertTrue(e.getMessage().contains("weight 0"), e.getMessage());
-    }
-
    @Test
    void unknownPolicyNameThrows() {
        assertThrows(IllegalArgumentException.class, () -> PlacementPolicies.fromName("random"));
    }
-
-    // --- CB-585: maxLoad 0 caps a profile at zero live members, even with nothing live yet -----
-
-    @Test
-    void weightedSkipsMaxLoadZeroProfileEvenWithZeroLiveWorkers() {
-        PlacementPolicy policy = PlacementPolicies.weighted();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a", 1.0f, 0),
-                PlacementCandidate.profile("b", 1.0f, null));
-        Function<String, Integer> liveCount = _ -> 0;
-        for (int i = 0; i < 5; i++) {
-            assertEquals("b", policy.select(ctx(candidates, liveCount)).profile(),
-                    "a has maxLoad 0, so it is already at its cap with nobody live — every pick lands on b");
-        }
-    }
-
-    @Test
-    void weightedThrowsWhenAllMaxLoadZero() {
-        PlacementPolicy policy = PlacementPolicies.weighted();
-        List<PlacementCandidate> candidates = List.of(
-                PlacementCandidate.profile("a", 1.0f, 0),
-                PlacementCandidate.profile("b", 1.0f, 0));
-        Function<String, Integer> liveCount = _ -> 0;
-        PlacementException e = assertThrows(PlacementException.class,
-                () -> policy.select(ctx(candidates, liveCount)));
-        assertTrue(e.getMessage().contains("maxLoad"), e.getMessage());
-    }
 }
@@ -1,7 +1,6 @@
 package dev.ltms.bridged.rest;

 import dev.ltms.bridged.auth.CallerResolver;
-import dev.ltms.bridged.auth.MemberRegistry;
 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.guard.SubscriptionGuard;
 import dev.ltms.bridged.herdr.AgentControl;
@@ -16,7 +15,7 @@ import dev.ltms.bridged.msg.MessageService;
 import dev.ltms.bridged.msg.Rendezvous;
 import dev.ltms.bridged.session.FakeWorktrees;
 import dev.ltms.bridged.session.SessionManager;
-import dev.ltms.bridged.member.ClaudeCodeLauncher;
+import dev.ltms.bridged.worker.ClaudeCodeLauncher;
 import io.javalin.Javalin;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
@@ -53,7 +52,7 @@ class BridgedAppAuthTest {
     */
    private int start(long pid, boolean tokenMode, String token) {
        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile wcfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker wcfg = new BridgedConfig.Worker(
                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN", null,
                "tab", "bridged-workers", "worker: {profile} #{n}", null, null, null);
        AgentControl agents = new AgentControl(herdr);
@@ -66,8 +65,9 @@ class BridgedAppAuthTest {
        MessageService messages = new MessageService(agents, injector, new Rendezvous());

        ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(herdr), _ -> pid);
-        CallerResolver callers = CallerResolver.withLeadsAndMembers(identity, tokenMode, token,
-                Map::of, new MemberRegistry(null));
+        CallerResolver callers = tokenMode
+                ? new CallerResolver(identity, true, token)
+                : new CallerResolver(identity);
        metrics = BridgedMetrics.create(sessions, new dev.ltms.bridged.msg.InMemoryReplyInbox());

        app = new BridgedApp(herdr, workers, sessions, messages, sessions.asPresence(), null,
@@ -128,9 +128,9 @@ class BridgedAppAuthTest {
    void aWorkerMayNotOrchestrate() throws Exception {
        int port = start(FakeHerdr.WORKER_PID, false, null);

-        assertEquals(403, send(port, "POST", "/members", null, null).statusCode(),
+        assertEquals(403, send(port, "POST", "/workers", null, null).statusCode(),
                "a worker spawning workers would be escalating into the orchestrator role");
-        assertEquals(403, send(port, "DELETE", "/members/w2:p7", null, null).statusCode());
+        assertEquals(403, send(port, "DELETE", "/workers/w2:p7", null, null).statusCode());
        assertEquals(403, send(port, "POST", "/sessions/term_b/message",
                "{\"content\":\"hi\"}", null).statusCode());
        assertEquals(403, send(port, "GET", "/sessions/term_a/replies", null, null).statusCode(),
@@ -206,7 +206,7 @@ class BridgedAppAuthTest {
        // The 29 pre-existing acceptance tests rely on this: no auth fixture, no enforcement.
        FakeHerdr herdr = new FakeHerdr();
        AgentControl agents = new AgentControl(herdr);
-        BridgedConfig.Profile wcfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker wcfg = new BridgedConfig.Worker(
                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN", null,
                "tab", "bridged-workers", "worker: {profile} #{n}", null, null, null);
        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(
@@ -9,7 +9,7 @@ import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.inject.Injector;
 import dev.ltms.bridged.inject.StatusPoller;
-import dev.ltms.bridged.inject.MemberPresence;
+import dev.ltms.bridged.inject.WorkerPresence;
 import dev.ltms.bridged.msg.InMemoryReplyInbox;
 import dev.ltms.bridged.msg.MessageService;
 import dev.ltms.bridged.msg.Rendezvous;
@@ -17,7 +17,7 @@ import dev.ltms.bridged.session.FakeWorktrees;
 import dev.ltms.bridged.session.GitWorktrees;
 import dev.ltms.bridged.session.SessionManager;
 import dev.ltms.bridged.session.Worktrees;
-import dev.ltms.bridged.member.ClaudeCodeLauncher;
+import dev.ltms.bridged.worker.ClaudeCodeLauncher;
 import io.javalin.Javalin;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.Test;
@@ -43,7 +43,7 @@ class BridgedAppTest {

    private final ObjectMapper mapper = new ObjectMapper();
    private final HttpClient http = HttpClient.newHttpClient();
-    private MemberPresence presence;
+    private WorkerPresence presence;
    private Javalin app;
    private StatusPoller poller;

@@ -62,7 +62,7 @@ class BridgedAppTest {
    }

    private int start(FakeHerdr herdr, String workerBaseUrl, Set<String> allow, String placement, Worktrees worktrees) {
-        BridgedConfig.Profile wcfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker wcfg = new BridgedConfig.Worker(
                "ltms-local", workerBaseUrl, "coder", null, "BRIDGED_WORKER_TOKEN", null,
                placement, "bridged-workers", "worker: {profile} #{n}", null, null, null);
        AgentControl agents = new AgentControl(herdr);
@@ -160,7 +160,7 @@ class BridgedAppTest {
        FakeHerdr herdr = new FakeHerdr();
        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));

-        HttpResponse<String> res = req(port, "POST", "/members");
+        HttpResponse<String> res = req(port, "POST", "/workers");
        assertEquals(201, res.statusCode());
        JsonNode body = mapper.readTree(res.body());
        // CB-519: the responded paneId is a host-unique opaque UUID, not the herdr pane coordinate.
@@ -202,12 +202,12 @@ class BridgedAppTest {
        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"), "tab",
                new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt"));

-        HttpResponse<String> spawn = req(port, "POST", "/members?worktree=true&ticket=cb-304");
+        HttpResponse<String> spawn = req(port, "POST", "/workers?worktree=true&ticket=cb-304");
        assertEquals(201, spawn.statusCode());
        JsonNode spawned = mapper.readTree(spawn.body());
        String paneId = spawned.get("paneId").asText();

-        HttpResponse<String> res = req(port, "GET", "/members");
+        HttpResponse<String> res = req(port, "GET", "/workers");
        assertEquals(200, res.statusCode());
        JsonNode workers = mapper.readTree(res.body()).get("workers");
        assertEquals(1, workers.size());
@@ -226,7 +226,7 @@ class BridgedAppTest {
    void spawnWithACwdParamRootsTheWorkerThere() throws Exception {
        FakeHerdr herdr = new FakeHerdr();
        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-        assertEquals(201, req(port, "POST", "/members?cwd=/tmp/proj").statusCode());
+        assertEquals(201, req(port, "POST", "/workers?cwd=/tmp/proj").statusCode());
        assertEquals("/tmp/proj", params(herdr, "tab.create").get("cwd"), "the worker starts in cwd");
    }

@@ -234,7 +234,7 @@ class BridgedAppTest {
    void spawnWithAnUnknownProfileIs400() throws Exception {
        FakeHerdr herdr = new FakeHerdr();
        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));
-        HttpResponse<String> res = req(port, "POST", "/members?profile=nope");
+        HttpResponse<String> res = req(port, "POST", "/workers?profile=nope");
        assertEquals(400, res.statusCode());
        assertEquals("unknown_profile", mapper.readTree(res.body()).get("error").asText());
        assertFalse(herdr.called("agent.start"), "an unknown profile must not spawn anything");
@@ -246,7 +246,7 @@ class BridgedAppTest {
        FakeHerdr herdr = new FakeHerdr().withWorkspace("w9", "bridged-workers");
        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));

-        assertEquals(201, req(port, "POST", "/members").statusCode());
+        assertEquals(201, req(port, "POST", "/workers").statusCode());
        assertFalse(herdr.called("workspace.create"), "existing worker space must be reused, not recreated");
        assertTrue(herdr.called("tab.create"), "a fresh tab is still created for the worker");
    }
@@ -258,7 +258,7 @@ class BridgedAppTest {
        FakeHerdr herdr = new FakeHerdr().agentNameTakenTimes(2);
        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));

-        assertEquals(201, req(port, "POST", "/members").statusCode());
+        assertEquals(201, req(port, "POST", "/workers").statusCode());
        List<String> names = herdr.calls.stream()
                .filter(c -> c.method().equals("agent.start"))
                .map(c -> ((Map<String, Object>) c.params()).get("name").toString())
@@ -273,7 +273,7 @@ class BridgedAppTest {
        FakeHerdr herdr = new FakeHerdr().agentNameTakenTimes(99);
        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));

-        assertEquals(500, req(port, "POST", "/members").statusCode());
+        assertEquals(500, req(port, "POST", "/workers").statusCode());
        assertTrue(herdr.called("tab.create"), "a tab was created before the failed start");
        assertEquals("w9:t2", params(herdr, "tab.close").get("tab_id"), "orphaned tab must be closed");
    }
@@ -284,7 +284,7 @@ class BridgedAppTest {
        // base_url points at the subscription — guard must block before any herdr call.
        int port = start(herdr, "https://api.anthropic.com", Set.of("gx00.gw"));

-        HttpResponse<String> res = req(port, "POST", "/members");
+        HttpResponse<String> res = req(port, "POST", "/workers");
        assertEquals(403, res.statusCode());
        assertEquals("subscription_boundary", mapper.readTree(res.body()).get("error").asText());
        assertFalse(herdr.called("agent.start"), "guard must stop the spawn before herdr");
@@ -296,7 +296,7 @@ class BridgedAppTest {
        FakeHerdr herdr = new FakeHerdr();
        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"), "pane");

-        assertEquals(201, req(port, "POST", "/members").statusCode());
+        assertEquals(201, req(port, "POST", "/workers").statusCode());
        Map<String, Object> start = params(herdr, "agent.start");
        assertFalse(start.containsKey("tab_id"), "pane placement must not target a tab");
        assertFalse(herdr.called("workspace.create"), "pane placement uses no dedicated space");
@@ -308,7 +308,7 @@ class BridgedAppTest {
        FakeHerdr herdr = new FakeHerdr();
        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));

-        assertEquals(204, req(port, "DELETE", "/members/w9:pW").statusCode());
+        assertEquals(204, req(port, "DELETE", "/workers/w9:pW").statusCode());
        assertTrue(herdr.called("pane.close"));
        // Tab resolved from the pane (pane.get), then closed.
        assertEquals("w9:t2", params(herdr, "tab.close").get("tab_id"));
@@ -450,7 +450,7 @@ class BridgedAppTest {
        FakeHerdr herdr = new FakeHerdr();
        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"), "pane");

-        assertEquals(204, req(port, "DELETE", "/members/w9:pW").statusCode());
+        assertEquals(204, req(port, "DELETE", "/workers/w9:pW").statusCode());
        assertTrue(herdr.called("pane.close"));
        assertFalse(herdr.called("tab.close"), "pane placement owns no tab to close");
        assertFalse(herdr.called("pane.get"), "no tab resolution in pane placement");
@@ -462,7 +462,7 @@ class BridgedAppTest {
        FakeHerdr herdr = new FakeHerdr().withWorkerTabPaneCount(2);
        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));

-        assertEquals(204, req(port, "DELETE", "/members/w9:pW").statusCode());
+        assertEquals(204, req(port, "DELETE", "/workers/w9:pW").statusCode());
        assertTrue(herdr.called("pane.close"), "the worker's own pane is still closed");
        assertFalse(herdr.called("tab.close"), "must not close a tab that holds the user's other panes");
    }
@@ -473,7 +473,7 @@ class BridgedAppTest {
        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));

        // A genuine teardown failure must surface, not be reported as a successful 204.
-        assertEquals(500, req(port, "DELETE", "/members/w9:pW").statusCode());
+        assertEquals(500, req(port, "DELETE", "/workers/w9:pW").statusCode());
        assertFalse(herdr.called("tab.close"), "tab is not removed when the pane close failed");
    }

@@ -483,7 +483,7 @@ class BridgedAppTest {
        int port = start(herdr, "http://gx00.gw:8000", Set.of("gx00.gw"));

        // Already-gone is success; the (now-empty) tab is still cleaned up.
-        assertEquals(204, req(port, "DELETE", "/members/w9:pW").statusCode());
+        assertEquals(204, req(port, "DELETE", "/workers/w9:pW").statusCode());
        assertTrue(herdr.called("tab.close"));
    }
 }
@@ -2,11 +2,9 @@ package dev.ltms.bridged.session;

 import java.util.Collections;
 import java.util.List;
-import java.util.Optional;
 import java.util.Set;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.CopyOnWriteArrayList;
-import java.util.concurrent.atomic.AtomicLong;

 /** Recording fake {@link Worktrees} for CB-301-ext acceptance tests (no live git). */
 public final class FakeWorktrees implements Worktrees {
@@ -24,20 +22,13 @@ public final class FakeWorktrees implements Worktrees {
    public record RepoRootCall(String cwd) {
    }

-    public record SnapshotCall(String worktreePath, String branch, String message) {
-    }
-
    private final List<AddCall> addCalls = new CopyOnWriteArrayList<>();
    private final List<RemoveCall> removeCalls = new CopyOnWriteArrayList<>();
    private final List<OverlayCall> overlayCalls = new CopyOnWriteArrayList<>();
    private final List<RepoRootCall> repoRootCalls = new CopyOnWriteArrayList<>();
-    private final List<SnapshotCall> snapshotCalls = new CopyOnWriteArrayList<>();
    private final Set<String> existingPaths = ConcurrentHashMap.newKeySet();
    private final Set<String> trackedPaths = ConcurrentHashMap.newKeySet();
-    private final AtomicLong snapshotSeq = new AtomicLong();
    private volatile RuntimeException addFailure;
-    private volatile RuntimeException snapshotFailure;
-    private volatile boolean dirty = false;
    private volatile String repoRoot = "/repo";
    private volatile String prefix = "/worktrees";

@@ -70,18 +61,6 @@ public final class FakeWorktrees implements Worktrees {
        return this;
    }

-    /** Mark the worktree dirty so {@link #hasUncommitted} reports true (simulates uncommitted work). */
-    public FakeWorktrees withDirty(boolean dirty) {
-        this.dirty = dirty;
-        return this;
-    }
-
-    /** Make subsequent {@link #snapshot} calls throw (simulates a failing git snapshot). */
-    public FakeWorktrees failSnapshot(String message) {
-        this.snapshotFailure = new WorktreeException(message);
-        return this;
-    }
-
    @Override
    public String add(String repoRoot, String branch, String baseRef) {
        addCalls.add(new AddCall(repoRoot, branch, baseRef));
@@ -98,11 +77,6 @@ public final class FakeWorktrees implements Worktrees {
        removeCalls.add(new RemoveCall(repoRoot, worktreePath));
    }

-    @Override
-    public boolean hasUncommitted(String worktreePath) {
-        return dirty;
-    }
-
    @Override
    public void overlayParity(String repoRoot, String worktreePath, List<String> overlay) {
        List<String> copied = new java.util.ArrayList<>();
@@ -126,15 +100,6 @@ public final class FakeWorktrees implements Worktrees {
        return repoRoot;
    }

-    @Override
-    public Optional<String> snapshot(String worktreePath, String branch, String message) {
-        snapshotCalls.add(new SnapshotCall(worktreePath, branch, message));
-        if (snapshotFailure != null) {
-            throw snapshotFailure;
-        }
-        return Optional.of("wip" + snapshotSeq.incrementAndGet());
-    }
-
    public List<AddCall> addCalls() {
        return List.copyOf(addCalls);
    }
@@ -162,12 +127,4 @@ public final class FakeWorktrees implements Worktrees {
    public OverlayCall lastOverlay() {
        return overlayCalls.isEmpty() ? null : overlayCalls.getLast();
    }
-
-    public List<SnapshotCall> snapshotCalls() {
-        return List.copyOf(snapshotCalls);
-    }
-
-    public SnapshotCall lastSnapshot() {
-        return snapshotCalls.isEmpty() ? null : snapshotCalls.getLast();
-    }
 }
@@ -5,10 +5,7 @@ import org.junit.jupiter.api.io.TempDir;

 import java.nio.file.Files;
 import java.nio.file.Path;
-import java.util.HashSet;
 import java.util.List;
-import java.util.Optional;
-import java.util.Set;
 import java.util.concurrent.TimeUnit;

 import static org.junit.jupiter.api.Assertions.*;
@@ -71,73 +68,6 @@ class GitWorktreesTest {
        return out;
    }

-    /** Every pending change in {@code cwd} — the whole-tree porcelain status, unlike {@link #status}. */
-    private static String fullStatus(Path cwd) throws Exception {
-        Process p = new ProcessBuilder("git", "status", "--porcelain")
-                .directory(cwd.toFile()).redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git status timed out");
-        return out;
-    }
-
-    private static String revParse(Path cwd, String ref) throws Exception {
-        Process p = new ProcessBuilder("git", "-C", cwd.toString(), "rev-parse", ref)
-                .redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes()).trim();
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git rev-parse timed out");
-        assertEquals(0, p.exitValue(), "git rev-parse " + ref + " failed:\n" + out);
-        return out;
-    }
-
-    /** The recursive file list of a commit's tree — used to check what a snapshot actually committed. */
-    private static String lsTree(Path cwd, String ref) throws Exception {
-        Process p = new ProcessBuilder("git", "-C", cwd.toString(), "ls-tree", "-r", "--name-only", ref)
-                .redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git ls-tree timed out");
-        assertEquals(0, p.exitValue(), "git ls-tree " + ref + " failed:\n" + out);
-        return out;
-    }
-
-    /** The set of paths in {@code git diff --name-only from..to} — used to check exactly what a
-     *  snapshot's tree changed relative to its parent, the same shape {@code git status --porcelain}
-     *  reports for the worktree it was taken from. */
-    private static Set<String> diffNameOnly(Path cwd, String from, String to) throws Exception {
-        Process p = new ProcessBuilder("git", "-C", cwd.toString(), "diff", "--name-only", from, to)
-                .redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git diff timed out");
-        assertEquals(0, p.exitValue(), "git diff " + from + ".." + to + " failed:\n" + out);
-        Set<String> paths = new HashSet<>();
-        for (String line : out.split("\\R")) {
-            if (!line.isBlank()) {
-                paths.add(line.trim());
-            }
-        }
-        return paths;
-    }
-
-    /** The set of paths a {@code git status --porcelain} listing names, stripping the two-char status
-     *  code prefix each line carries. */
-    private static Set<String> porcelainPaths(String porcelain) {
-        Set<String> paths = new HashSet<>();
-        for (String line : porcelain.split("\\R")) {
-            if (!line.isBlank()) {
-                paths.add(line.substring(3).trim());
-            }
-        }
-        return paths;
-    }
-
-    private static String forEachRef(Path cwd, String pattern) throws Exception {
-        Process p = new ProcessBuilder("git", "-C", cwd.toString(), "for-each-ref", pattern)
-                .redirectErrorStream(true).start();
-        String out = new String(p.getInputStream().readAllBytes());
-        assertTrue(p.waitFor(30, TimeUnit.SECONDS), "git for-each-ref timed out");
-        assertEquals(0, p.exitValue(), "git for-each-ref " + pattern + " failed:\n" + out);
-        return out;
-    }
-
    /**
     * The heart of CB-525: a provisioned worktree must not inherit the primary's MCP servers. Without
     * the isolation step the checked-out {@code .mcp.json} carries them in, and a worker navigating
@@ -245,46 +175,6 @@ class GitWorktreesTest {
        assertTrue(Files.exists(Path.of(wt).resolve(".mcp.json")), ".mcp.json stub was dropped");
    }

-    /**
-     * CB-576. {@code hasUncommitted} must treat a freshly-provisioned worktree as clean, but a
-     * worktree holding a brand-new, never-added file as dirty. The untracked-file-only shape is
-     * exactly the work lost in the incident — a worker's draft that compiled but was never
-     * committed because it stopped to ask its lead a question.
-     */
-    @Test
-    void anUntrackedOnlyWorktreeCountsAsDirty(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String wt = gitWorktrees.add(repo.toString(), "cb-576-u", "HEAD");
-
-        assertFalse(gitWorktrees.hasUncommitted(wt),
-                "a freshly provisioned worktree must read as clean");
-
-        Files.writeString(Path.of(wt).resolve("brand-new.txt"), "draft that was never added\n");
-
-        assertTrue(gitWorktrees.hasUncommitted(wt),
-                "an untracked-only file must count as dirty");
-
-        Files.writeString(Path.of(wt).resolve("README.md"), "edited tracked file\n");
-        assertTrue(gitWorktrees.hasUncommitted(wt),
-                "a tracked modification must also count as dirty");
-    }
-
-    /**
-     * CB-576 review. {@code hasUncommitted} must tolerate a missing worktree exactly like
-     * {@code remove}: an already-gone directory holds no work to lose, and throwing here would
-     * break teardown — SessionManager.release() calls it before stopping the pane, so an
-     * exception would orphan a live pane and skip the release notification (CB-516).
-     */
-    @Test
-    void hasUncommittedOnAMissingWorktreeReturnsFalseWithoutThrowing(@TempDir Path tmp) {
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String gone = tmp.resolve("wts").resolve("does-not-exist").toString();
-
-        assertFalse(gitWorktrees.hasUncommitted(gone),
-                "a missing worktree is reported clean, not an error");
-    }
-
    /** All three protected configs are covered: each one present in a worktree is neutralized and hidden. */
    @Test
    void allThreeConfigsAreNeutralizedWhenPresent(@TempDir Path tmp) throws Exception {
@@ -315,163 +205,4 @@ class GitWorktreesTest {
        assertEquals("", status(Path.of(wt), "opencode.json"), "opencode.json still shows as modified");
        assertEquals("", status(Path.of(wt), ".autoenv"), ".autoenv still shows as modified");
    }
-
-    /**
-     * CB-578 stage C, acceptance criterion 1. A dirty worktree — a tracked edit plus a brand-new
-     * untracked file, exactly the shape lost in CB-576 — must land in {@code refs/wip/<branch>}'s
-     * tree, and that ref must live outside {@code refs/heads} so it never shows up in
-     * {@code git branch} or gets swept by a branch cleanup.
-     */
-    @Test
-    void dirtySnapshotCreatesARefWhoseTreeContainsUntrackedAndTrackedChanges(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String branch = "cb-578-c-a";
-        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
-        Files.writeString(Path.of(wt).resolve("untracked.txt"), "draft that was never added\n");
-        Files.writeString(Path.of(wt).resolve("README.md"), "edited tracked file\n");
-
-        Optional<String> ref = gitWorktrees.snapshot(wt, branch, "test snapshot");
-
-        assertTrue(ref.isPresent(), "a dirty worktree snapshot returns a commit sha");
-        String tree = lsTree(repo, "refs/wip/" + branch);
-        assertTrue(tree.contains("untracked.txt"), "snapshot tree must include the untracked file:\n" + tree);
-        assertTrue(tree.contains("README.md"), "snapshot tree must include the tracked edit:\n" + tree);
-        String heads = forEachRef(repo, "refs/heads");
-        assertFalse(heads.contains("refs/wip/"), "the snapshot ref must not live under refs/heads:\n" + heads);
-    }
-
-    /**
-     * CB-578 stage C, acceptance criterion 2. Building the commit through a temporary
-     * {@code GIT_INDEX_FILE} must leave the worker's own index, working tree, and HEAD exactly as
-     * they were — the worker may still be mid-write, and staging into the real index would corrupt
-     * that.
-     */
-    @Test
-    void snapshotDoesNotTouchTheWorkersOwnIndexWorkingTreeOrHead(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String branch = "cb-578-c-b";
-        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
-        Files.writeString(Path.of(wt).resolve("untracked.txt"), "draft that was never added\n");
-        Files.writeString(Path.of(wt).resolve("README.md"), "edited tracked file\n");
-        String headBefore = revParse(Path.of(wt), "HEAD");
-        String statusBefore = fullStatus(Path.of(wt));
-
-        gitWorktrees.snapshot(wt, branch, "test snapshot");
-
-        assertEquals(headBefore, revParse(Path.of(wt), "HEAD"), "snapshot must not move HEAD");
-        assertEquals(statusBefore, fullStatus(Path.of(wt)),
-                "snapshot must not change the worker's own index or working tree status");
-    }
-
-    /**
-     * CB-578 stage C, acceptance criterion 3. {@code add -A} (never {@code -f}) respects
-     * {@code .gitignore}, and that is the only thing keeping a gitignored file (secrets, local
-     * config) out of a snapshot commit — an untracked file that is NOT ignored must still be
-     * included, so this isn't just "untracked files are dropped".
-     */
-    @Test
-    void gitignoredFileIsExcludedButOtherUntrackedFilesAreNot(@TempDir Path tmp) throws Exception {
-        Path repo = tmp.resolve("repo");
-        Files.createDirectories(repo);
-        git(repo, "init", "-q", "-b", "main");
-        git(repo, "config", "user.email", "test@example.invalid");
-        git(repo, "config", "user.name", "Test");
-        Files.writeString(repo.resolve(".gitignore"), ".env\n");
-        Files.writeString(repo.resolve("README.md"), "seed\n");
-        git(repo, "add", ".gitignore", "README.md");
-        git(repo, "commit", "-q", "-m", "seed");
-
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String branch = "cb-578-c-c";
-        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
-        Files.writeString(Path.of(wt).resolve(".env"), "SECRET=shh\n");
-        Files.writeString(Path.of(wt).resolve("untracked.txt"), "draft that was never added\n");
-
-        Optional<String> ref = gitWorktrees.snapshot(wt, branch, "test snapshot");
-
-        assertTrue(ref.isPresent());
-        String tree = lsTree(repo, "refs/wip/" + branch);
-        assertFalse(tree.contains(".env"), "a gitignored file must never enter the snapshot:\n" + tree);
-        assertTrue(tree.contains("untracked.txt"),
-                "a non-ignored untracked file must still be included:\n" + tree);
-    }
-
-    /** CB-578 stage C. A clean worktree still produces a valid, if tree-identical, commit — the caller
-     *  (SessionManager) is the one that decides not to call this on a clean worktree. */
-    @Test
-    void snapshotOfAMissingWorktreeReturnsEmptyWithoutThrowing(@TempDir Path tmp) {
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String gone = tmp.resolve("wts").resolve("does-not-exist").toString();
-
-        assertTrue(gitWorktrees.snapshot(gone, "some-branch", "msg").isEmpty(),
-                "a missing worktree has nothing to snapshot, and must not throw");
-    }
-
-    /**
-     * CB-587, acceptance criteria 1 and 2. A file with a REAL {@code --skip-worktree} bit set in the
-     * worktree's own index must never enter the snapshot, even though its on-disk content has locally
-     * diverged from what is committed — that is exactly the divergence {@code --skip-worktree} exists
-     * to hide from {@code git status}, and a snapshot built from a fresh empty temp index (the bug)
-     * stages that local content anyway because the fresh index carries none of the real index's flags.
-     * The snapshot's diff against its parent must list exactly what {@code git status --porcelain}
-     * reports for the worktree — no more, no less.
-     */
-    @Test
-    void dirtySnapshotHonoursARealSkipWorktreeBit(@TempDir Path tmp) throws Exception {
-        Path repo = tmp.resolve("repo");
-        Files.createDirectories(repo);
-        git(repo, "init", "-q", "-b", "main");
-        git(repo, "config", "user.email", "test@example.invalid");
-        git(repo, "config", "user.name", "Test");
-        Files.writeString(repo.resolve("protected.cfg"), "committed-value\n");
-        Files.writeString(repo.resolve("README.md"), "seed\n");
-        git(repo, "add", "protected.cfg", "README.md");
-        git(repo, "commit", "-q", "-m", "seed");
-
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String branch = "cb-587-a";
-        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
-
-        git(Path.of(wt), "update-index", "--skip-worktree", "protected.cfg");
-        Files.writeString(Path.of(wt).resolve("protected.cfg"), "locally-diverged-never-commit\n");
-        Files.writeString(Path.of(wt).resolve("untracked.txt"), "draft that was never added\n");
-        Files.writeString(Path.of(wt).resolve("README.md"), "edited tracked file\n");
-
-        String porcelain = fullStatus(Path.of(wt));
-        assertFalse(porcelain.contains("protected.cfg"),
-                "test setup invalid — protected.cfg must not show in git status once skip-worktree is set:\n"
-                        + porcelain);
-
-        Optional<String> ref = gitWorktrees.snapshot(wt, branch, "test snapshot");
-
-        assertTrue(ref.isPresent(), "a dirty worktree snapshot returns a commit sha");
-        Set<String> diffPaths = diffNameOnly(repo, "HEAD", "refs/wip/" + branch);
-        assertFalse(diffPaths.contains("protected.cfg"),
-                "a --skip-worktree file's local drift leaked into the snapshot:\n" + diffPaths);
-        assertEquals(porcelainPaths(porcelain), diffPaths,
-                "snapshot diff must list exactly what git status --porcelain reports, no more, no less");
-    }
-
-    /**
-     * CB-587, acceptance criterion 6. If the worktree's real index cannot be resolved/read, snapshot
-     * must fail loudly (throw) rather than silently falling back to an empty temp index and producing
-     * a wrong snapshot. SessionManager's caller already catches and WARNs on any exception here — this
-     * only needs to confirm the failure is not swallowed inside snapshot() itself.
-     */
-    @Test
-    void snapshotThrowsWhenTheWorktreesRealIndexCannotBeResolved(@TempDir Path tmp) throws Exception {
-        Path repo = initRepo(tmp.resolve("repo"));
-        GitWorktrees gitWorktrees = new GitWorktrees(tmp.resolve("wts").toString());
-        String branch = "cb-587-b";
-        String wt = gitWorktrees.add(repo.toString(), branch, "HEAD");
-
-        // Break git's ability to resolve the worktree's real index by removing the linked worktree's
-        // `.git` file (which normally points at the main repo's worktrees/<name>/ directory).
-        Files.delete(Path.of(wt).resolve(".git"));
-
-        assertThrows(WorktreeException.class, () -> gitWorktrees.snapshot(wt, branch, "test snapshot"),
-                "an unresolvable real index must fail loudly, not silently snapshot from an empty index");
-    }
 }
@@ -1,25 +1,13 @@
 package dev.ltms.bridged.session;

-import ch.qos.logback.classic.Level;
-import ch.qos.logback.classic.LoggerContext;
-import ch.qos.logback.classic.spi.ILoggingEvent;
-import ch.qos.logback.core.read.ListAppender;
 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.guard.SubscriptionGuard;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.member.ClaudeCodeLauncher;
-import dev.ltms.bridged.msg.TestTurnTokens;
-import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.CharterReceipt;
-import dev.ltms.bridged.peer.MemberRole;
-import dev.ltms.bridged.peer.PeerHandle;
-import dev.ltms.bridged.peer.PeerLauncher;
+import dev.ltms.bridged.worker.ClaudeCodeLauncher;
 import dev.ltms.bridged.peer.PeerUnreachableException;
-import dev.ltms.bridged.peer.SpawnRequest;
 import org.junit.jupiter.api.Test;
-import org.slf4j.LoggerFactory;

 import java.util.List;
 import java.util.Map;
@@ -37,7 +25,7 @@ import static org.junit.jupiter.api.Assertions.*;
 class SessionManagerTest {

    private SessionManager sessionManager(FakeHerdr herdr) {
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
                "worker: {profile} #{n}", null, null, null);
@@ -50,110 +38,13 @@ class SessionManagerTest {
        return sessionManager(herdr, clock, 0);
    }

-    private SessionManager sessionManager(FakeHerdr herdr, Worktrees worktrees) {
-        return sessionManager(herdr, worktrees, System::nanoTime);
-    }
-
-    private SessionManager sessionManager(FakeHerdr herdr, Worktrees worktrees, LongSupplier clock) {
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
-                "worker: {profile} #{n}", null, null, null);
-        ClaudeCodeLauncher workers = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
-        return new SessionManager(workers, worktrees, clock);
-    }
-
-    /**
-     * CB-581: a {@link Worktrees} test double whose {@code hasUncommitted} and {@code remove} can
-     * be told to throw, so {@link SessionManager#release} can be exercised against exactly the
-     * failure {@code GitWorktrees} produces when {@code git status}/{@code git worktree remove}
-     * exits non-zero.
-     */
-    private static final class RecordingWorktrees implements Worktrees {
-        private final List<String> removeCalls = new java.util.ArrayList<>();
-        private final List<String> snapshotCalls = new java.util.ArrayList<>();
-        private final java.util.Set<String> failRemoveFor = new java.util.HashSet<>();
-        private volatile boolean dirty = false;
-        private volatile RuntimeException hasUncommittedFailure;
-        private volatile RuntimeException snapshotFailure;
-        private final java.util.concurrent.atomic.AtomicLong snapshotSeq = new java.util.concurrent.atomic.AtomicLong();
-
-        RecordingWorktrees dirty(boolean dirty) {
-            this.dirty = dirty;
-            return this;
-        }
-
-        RecordingWorktrees failHasUncommittedWith(RuntimeException e) {
-            this.hasUncommittedFailure = e;
-            return this;
-        }
-
-        RecordingWorktrees failRemoveFor(String worktreePath) {
-            failRemoveFor.add(worktreePath);
-            return this;
-        }
-
-        RecordingWorktrees failSnapshotWith(RuntimeException e) {
-            this.snapshotFailure = e;
-            return this;
-        }
-
-        @Override
-        public String add(String repoRoot, String branch, String baseRef) {
-            return "/wt/" + branch.replace('/', '_');
-        }
-
-        @Override
-        public void remove(String repoRoot, String worktreePath) {
-            if (failRemoveFor.contains(worktreePath)) {
-                throw new WorktreeException("simulated remove failure for " + worktreePath);
-            }
-            removeCalls.add(worktreePath);
-        }
-
-        @Override
-        public boolean hasUncommitted(String worktreePath) {
-            if (hasUncommittedFailure != null) {
-                throw hasUncommittedFailure;
-            }
-            return dirty;
-        }
-
-        @Override
-        public void overlayParity(String repoRoot, String worktreePath, List<String> overlay) {
-        }
-
-        @Override
-        public String repoRoot(String cwd) {
-            return "/repo";
-        }
-
-        @Override
-        public java.util.Optional<String> snapshot(String worktreePath, String branch, String message) {
-            snapshotCalls.add(worktreePath);
-            if (snapshotFailure != null) {
-                throw snapshotFailure;
-            }
-            return java.util.Optional.of("wip" + snapshotSeq.incrementAndGet());
-        }
-
-        List<String> removeCalls() {
-            return List.copyOf(removeCalls);
-        }
-
-        List<String> snapshotCalls() {
-            return List.copyOf(snapshotCalls);
-        }
-    }
-
    private SessionManager sessionManager(FakeHerdr herdr, LongSupplier clock, int contextCap) {
        return sessionManager(herdr, clock, contextCap, false);
    }

    private SessionManager sessionManager(FakeHerdr herdr, LongSupplier clock, int contextCap,
                                          boolean clearAfterTurn) {
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
                "worker: {profile} #{n}", null, null, null);
@@ -178,10 +69,10 @@ class SessionManagerTest {
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr);

-        MemberSession a = sessions.acquire("ltms-local", "/work/a", "/caller/a", "term_primary");
-        MemberSession b = sessions.acquire("ltms-local", "/work/b", "/caller/b", "term_primary");
+        WorkerSession a = sessions.acquire("ltms-local", "/work/a", "/caller/a", "term_primary");
+        WorkerSession b = sessions.acquire("ltms-local", "/work/b", "/caller/b", "term_primary");

-        assertEquals(MemberSession.State.SPAWNING, a.state(), "fresh session starts spawning");
+        assertEquals(WorkerSession.State.SPAWNING, a.state(), "fresh session starts spawning");
        assertEquals("ltms-local", a.profile());
        assertEquals("/work/a", a.cwd(), "explicit requested cwd is recorded");
        assertEquals("term_primary", a.ownerTerminal());
@@ -194,24 +85,6 @@ class SessionManagerTest {
        assertEquals(2, sessions.roster().size(), "both sessions are registered");
    }

-    @Test
-    void rosterViewExposesTheCharterReceiptButNeverTheCharterText() {
-        // The roster (bridge_list and GET /members both render through rosterView) must let a lead
-        // see which charter a member got, without ever carrying the charter prose itself (CB-571).
-        MemberSession s = new MemberSession("p1", "term1", "prof", MemberRole.DEV, "/cwd", null,
-                0, 0, 0, MemberSession.State.READY, null, null,
-                CharterReceipt.compose(MemberRole.DEV, "prof", "role charter", "role charter\n\nreply"), null);
-
-        Map<String, Object> view = SessionManager.rosterView(s, null);
-
-        assertEquals("fleet.charters.dev", view.get("charterSource"),
-                "the config key that supplied the role charter is reported");
-        assertEquals(CharterReceipt.digestOf("role charter\n\nreply"), view.get("charterSha256"),
-                "the digest of the exact composed charter bytes is reported");
-        assertFalse(view.values().toString().contains("role charter"),
-                "the roster row must not embed the charter text itself");
-    }
-
    @Test
    void aNullTerminalFromThePrimaryIsANoOpEvenWithSessionsRegistered() {
        // The primary resolves to a Principal with no terminal, and BridgeMcp's context extractor
@@ -219,15 +92,15 @@ class SessionManagerTest {
        // once a session existed, so this NPE'd the primary's second spawn while the first passed.
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");

        assertDoesNotThrow(() -> sessions.asPresence().markPresent(null),
                "the primary's null terminal must not blow up an unrelated tool call");
-        assertDoesNotThrow(() -> sessions.onDelivered(null, TestTurnTokens.inert(null)));
+        assertDoesNotThrow(() -> sessions.onDelivered(null));
        assertDoesNotThrow(() -> sessions.onTurnComplete(null));
        assertDoesNotThrow(() -> sessions.onTurnFailed(null));

-        assertEquals(MemberSession.State.SPAWNING, sessions.get(session.paneId()).orElseThrow().state(),
+        assertEquals(WorkerSession.State.SPAWNING, sessions.get(session.paneId()).orElseThrow().state(),
                "and must not transition any registered session");
    }

@@ -235,20 +108,20 @@ class SessionManagerTest {
    void presenceMovesSpawningToReadyAndDeliveredTurnMovesToDone() {
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
        String terminal = session.terminalId();

        sessions.asPresence().markPresent(terminal);
-        assertEquals(MemberSession.State.READY, sessions.get(session.paneId()).orElseThrow().state(),
+        assertEquals(WorkerSession.State.READY, sessions.get(session.paneId()).orElseThrow().state(),
                "MCP presence moves SPAWNING → READY");
        assertTrue(sessions.asPresence().isPresent(terminal), "presence is also recorded");

-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
-        assertEquals(MemberSession.State.BUSY, sessions.get(session.paneId()).orElseThrow().state(),
+        sessions.onDelivered(terminal);
+        assertEquals(WorkerSession.State.BUSY, sessions.get(session.paneId()).orElseThrow().state(),
                "delivery moves READY → BUSY");

        sessions.onTurnComplete(terminal);
-        assertEquals(MemberSession.State.DONE, sessions.get(session.paneId()).orElseThrow().state(),
+        assertEquals(WorkerSession.State.DONE, sessions.get(session.paneId()).orElseThrow().state(),
                "turn completion moves BUSY → DONE");
    }

@@ -256,7 +129,7 @@ class SessionManagerTest {
    void releaseTearsDownWorkerAndRemovesFromRosterAndIsIdempotent() {
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", null);
+        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", null);
        String paneId = session.paneId();

        sessions.release(paneId);
@@ -272,59 +145,53 @@ class SessionManagerTest {
    void onTurnFailedMovesSessionToFailed() {
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
        String terminal = session.terminalId();
        sessions.asPresence().markPresent(terminal);
-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
+        sessions.onDelivered(terminal);

        sessions.onTurnFailed(terminal);

-        MemberSession updated = sessions.get(session.paneId()).orElseThrow();
-        assertEquals(MemberSession.State.FAILED, updated.state(), "turn failure moves to FAILED");
+        WorkerSession updated = sessions.get(session.paneId()).orElseThrow();
+        assertEquals(WorkerSession.State.FAILED, updated.state(), "turn failure moves to FAILED");
        assertTrue(sessions.roster().contains(updated), "FAILED is still in acquired-minus-released roster");
    }

    @Test
-    void onTurnFailedIsLoggedAtWarnWithThePriorState() {
-        // CB-564: this transition used to be a bare DEBUG "session marked failed" — a symptom with no
-        // cause. A member that can no longer be delegated to must be at least WARN, and should name
-        // what stage it failed at (here: BUSY, i.e. a turn was in flight and never resolved).
-        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
-        ch.qos.logback.classic.Logger sessionLog =
-                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(SessionManager.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.setContext(ctx);
-        appender.start();
-        sessionLog.addAppender(appender);
-        sessionLog.setLevel(Level.WARN);
-        try {
-            FakeHerdr herdr = new FakeHerdr();
-            SessionManager sessions = sessionManager(herdr);
-            MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
-            String terminal = session.terminalId();
-            sessions.asPresence().markPresent(terminal);
-            sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
+    void recycleProducesNewPaneIdAndOldOneIsGone() {
+        FakeHerdr herdr = new FakeHerdr();
+        SessionManager sessions = sessionManager(herdr);
+        WorkerSession oldSession = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        String oldPane = oldSession.paneId();
+        String oldTerminal = oldSession.terminalId();

-            sessions.onTurnFailed(terminal);
+        WorkerSession fresh = sessions.recycle(oldPane);

-            String warn = appender.list.stream()
-                    .filter(e -> e.getLevel().equals(Level.WARN))
-                    .map(ILoggingEvent::getFormattedMessage)
-                    .findFirst()
-                    .orElse("no turn-failed WARN logged");
-            assertTrue(warn.contains(terminal), "the log names the member: " + warn);
-            assertTrue(warn.contains("BUSY"), "the log names the stage it failed at: " + warn);
-        } finally {
-            sessionLog.detachAppender(appender);
-        }
+        assertNotEquals(oldPane, fresh.paneId(), "recycle yields a new pane id");
+        assertNotEquals(oldTerminal, fresh.terminalId(), "recycle yields a new terminal id");
+        assertEquals(oldSession.profile(), fresh.profile(), "profile is preserved");
+        assertEquals(oldSession.cwd(), fresh.cwd(), "cwd is preserved");
+        assertEquals(oldSession.ownerTerminal(), fresh.ownerTerminal(), "owner is preserved");
+
+        assertTrue(sessions.get(oldPane).isEmpty(), "old pane is deregistered");
+        assertEquals(1, sessions.roster().size(), "only the fresh session remains");
+        assertEquals(fresh.paneId(), sessions.roster().getFirst().paneId());
+
+        // The old session was the first spawn → pane w9:pRoot_1 (CB-519: the registry key is the
+        // uuid id, so teardown is asserted on the real pane coordinate).
+        long paneCloseCount = herdr.calls.stream()
+                .filter(c -> "pane.close".equals(c.method()))
+                .filter(c -> "w9:pRoot_1".equals(((Map<?, ?>) c.params()).get("pane_id")))
+                .count();
+        assertEquals(1, paneCloseCount, "the old worker was torn down");
    }

    @Test
    void rosterReflectsAcquiredMinusReleased() {
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr);
-        MemberSession a = sessions.acquire("ltms-local", "/a", "/caller", "ownerA");
-        MemberSession b = sessions.acquire("ltms-local", "/b", "/caller", "ownerB");
+        WorkerSession a = sessions.acquire("ltms-local", "/a", "/caller", "ownerA");
+        WorkerSession b = sessions.acquire("ltms-local", "/b", "/caller", "ownerB");

        assertEquals(2, sessions.roster().size());
        assertTrue(sessions.roster().stream().anyMatch(s -> s.paneId().equals(a.paneId())));
@@ -352,7 +219,7 @@ class SessionManagerTest {
        long[] clock = {0};
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr, () -> clock[0]);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
        String terminal = session.terminalId();
        sessions.asPresence().markPresent(terminal);

@@ -367,13 +234,13 @@ class SessionManagerTest {
        long[] clock = {0};
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr, () -> clock[0]);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
        String terminal = session.terminalId();
        sessions.asPresence().markPresent(terminal);

        clock[0] = 5;
        assertEquals(0, sessions.reapIdle(10), "READY session within TTL is not reaped");
-        assertEquals(MemberSession.State.READY,
+        assertEquals(WorkerSession.State.READY,
                sessions.get(session.paneId()).orElseThrow().state(),
                "READY session survives");
    }
@@ -383,14 +250,14 @@ class SessionManagerTest {
        long[] clock = {0};
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr, () -> clock[0]);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
        String terminal = session.terminalId();
        sessions.asPresence().markPresent(terminal);
-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
+        sessions.onDelivered(terminal);

        clock[0] = 100;
        assertEquals(0, sessions.reapIdle(10), "BUSY session past TTL is never reaped");
-        assertEquals(MemberSession.State.BUSY,
+        assertEquals(WorkerSession.State.BUSY,
                sessions.get(session.paneId()).orElseThrow().state(),
                "BUSY session remains");
    }
@@ -400,10 +267,10 @@ class SessionManagerTest {
        long[] clock = {0};
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr, () -> clock[0]);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
        String terminal = session.terminalId();
        sessions.asPresence().markPresent(terminal);
-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
+        sessions.onDelivered(terminal);
        sessions.onTurnComplete(terminal);

        clock[0] = 21;
@@ -417,16 +284,16 @@ class SessionManagerTest {
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr, () -> clock[0]);

-        MemberSession ready = sessions.acquire("ltms-local", "/ready", "/caller", "owner1");
-        MemberSession busy = sessions.acquire("ltms-local", "/busy", "/caller", "owner2");
+        WorkerSession ready = sessions.acquire("ltms-local", "/ready", "/caller", "owner1");
+        WorkerSession busy = sessions.acquire("ltms-local", "/busy", "/caller", "owner2");
        sessions.asPresence().markPresent(ready.terminalId());
        sessions.asPresence().markPresent(busy.terminalId());
-        sessions.onDelivered(busy.terminalId(), TestTurnTokens.inert(busy.terminalId()));
+        sessions.onDelivered(busy.terminalId());

        clock[0] = 50;
        assertEquals(1, sessions.reapIdle(30), "only READY past TTL is reaped");
        assertTrue(sessions.get(ready.paneId()).isEmpty(), "READY session is gone");
-        assertEquals(MemberSession.State.BUSY,
+        assertEquals(WorkerSession.State.BUSY,
                sessions.get(busy.paneId()).orElseThrow().state(),
                "BUSY session is still registered");
    }
@@ -435,17 +302,17 @@ class SessionManagerTest {
    void contextCapDisabledSessionSurvivesMultipleTurns() {
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr, () -> 0L, 0);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
        String terminal = session.terminalId();
        sessions.asPresence().markPresent(terminal);

-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
+        sessions.onDelivered(terminal);
        sessions.onTurnComplete(terminal);
-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
+        sessions.onDelivered(terminal);
        sessions.onTurnComplete(terminal);

-        MemberSession updated = sessions.get(session.paneId()).orElseThrow();
-        assertEquals(MemberSession.State.DONE, updated.state(), "session finishes second turn");
+        WorkerSession updated = sessions.get(session.paneId()).orElseThrow();
+        assertEquals(WorkerSession.State.DONE, updated.state(), "session finishes second turn");
        assertEquals(2, updated.turnCount(), "turn count tracks both deliveries");
        long releaseCloseCount = paneCloseCallsFor(herdr, "w9:pRoot_1"); // the real pane coordinate
        assertEquals(0, releaseCloseCount, "cap disabled — no forced release of the worker pane");
@@ -455,17 +322,17 @@ class SessionManagerTest {
    void contextCapTwoReleasesAfterSecondComplete() {
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr, () -> 0L, 2);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
        String terminal = session.terminalId();
        sessions.asPresence().markPresent(terminal);

-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
+        sessions.onDelivered(terminal);
        sessions.onTurnComplete(terminal);
-        assertEquals(MemberSession.State.DONE,
+        assertEquals(WorkerSession.State.DONE,
                sessions.get(session.paneId()).orElseThrow().state(),
                "first turn completes without release");

-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal));
+        sessions.onDelivered(terminal);
        sessions.onTurnComplete(terminal);

        assertTrue(sessions.get(session.paneId()).isEmpty(), "session released after cap reached");
@@ -478,13 +345,13 @@ class SessionManagerTest {
    void clearAfterTurnResetsContextWithoutDoubleCountingTheTurn() {
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr, () -> 0L, 0, true);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
        sessions.asPresence().markPresent(session.terminalId());

-        sessions.onDelivered(session.terminalId(), TestTurnTokens.inert(session.terminalId()));
+        sessions.onDelivered(session.terminalId());
        assertTrue(sessions.onTurnCompleteWithPostAction(session.terminalId()));

-        MemberSession updated = sessions.get(session.paneId()).orElseThrow();
+        WorkerSession updated = sessions.get(session.paneId()).orElseThrow();
        assertEquals(1, updated.turnCount(), "the reset is housekeeping, not a second delegation");
        assertEquals(List.of("/clear"), promptTexts(herdr));
    }
@@ -493,9 +360,9 @@ class SessionManagerTest {
    void contextCapReleaseWinsOverClearAfterTurn() {
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr, () -> 0L, 1, true);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
        sessions.asPresence().markPresent(session.terminalId());
-        sessions.onDelivered(session.terminalId(), TestTurnTokens.inert(session.terminalId()));
+        sessions.onDelivered(session.terminalId());

        assertFalse(sessions.hasPostTurnAction(session.terminalId()),
                "a session at its cap will be released, not reset for reuse");
@@ -508,13 +375,13 @@ class SessionManagerTest {
    void clearAfterTurnFalsePreservesCompletionWithoutAControlPrompt() {
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr, () -> 0L, 0, false);
-        MemberSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
+        WorkerSession session = sessions.acquire("ltms-local", null, "/caller", "term_primary");
        sessions.asPresence().markPresent(session.terminalId());
-        sessions.onDelivered(session.terminalId(), TestTurnTokens.inert(session.terminalId()));
+        sessions.onDelivered(session.terminalId());

        sessions.onTurnComplete(session.terminalId());

-        assertEquals(MemberSession.State.DONE, sessions.get(session.paneId()).orElseThrow().state());
+        assertEquals(WorkerSession.State.DONE, sessions.get(session.paneId()).orElseThrow().state());
        assertTrue(promptTexts(herdr).isEmpty());
    }

@@ -524,11 +391,11 @@ class SessionManagerTest {
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr, () -> clock[0]);

-        MemberSession ready = sessions.acquire("ltms-local", "/ready", "/caller", "ownerR");
-        MemberSession busy = sessions.acquire("ltms-local", "/busy", "/caller", "ownerB");
+        WorkerSession ready = sessions.acquire("ltms-local", "/ready", "/caller", "ownerR");
+        WorkerSession busy = sessions.acquire("ltms-local", "/busy", "/caller", "ownerB");
        sessions.asPresence().markPresent(ready.terminalId());
        sessions.asPresence().markPresent(busy.terminalId());
-        sessions.onDelivered(busy.terminalId(), TestTurnTokens.inert(busy.terminalId()));
+        sessions.onDelivered(busy.terminalId());

        sessions.drainAll(TimeUnit.MILLISECONDS.toNanos(100));

@@ -565,7 +432,7 @@ class SessionManagerTest {
        long[] clock = {0};

        // Gate-enabled launcher (1 ms timeout + no-op sleeper that advances clock past deadline)
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
                "worker: {profile} #{n}", null, null, null);
@@ -592,9 +459,9 @@ class SessionManagerTest {
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr);
        java.util.List<String> released = new java.util.concurrent.CopyOnWriteArrayList<>();
-        sessions.onRelease(detail -> released.add(detail.terminalId()));
+        sessions.onRelease(released::add);

-        MemberSession s = sessions.acquire("ltms-local", null, "/caller", null);
+        WorkerSession s = sessions.acquire("ltms-local", null, "/caller", null);
        sessions.release(s.paneId());

        assertEquals(java.util.List.of(s.terminalId()), released,
@@ -606,7 +473,7 @@ class SessionManagerTest {
        FakeHerdr herdr = new FakeHerdr();
        SessionManager sessions = sessionManager(herdr);
        java.util.List<String> released = new java.util.concurrent.CopyOnWriteArrayList<>();
-        sessions.onRelease(detail -> released.add(detail.terminalId()));
+        sessions.onRelease(released::add);

        sessions.release("w9:p404"); // idempotent teardown of something already gone

@@ -621,300 +488,9 @@ class SessionManagerTest {
            throw new IllegalStateException("listener blew up");
        });

-        MemberSession s = sessions.acquire("ltms-local", null, "/caller", null);
+        WorkerSession s = sessions.acquire("ltms-local", null, "/caller", null);
        assertDoesNotThrow(() -> sessions.release(s.paneId()),
                "a listener failure must never prevent the teardown it is reacting to");
        assertTrue(sessions.get(s.paneId()).isEmpty(), "and the session is still deregistered");
    }
-
-    // --- CB-581: a throw inside release() must not orphan the pane or abort reapIdle -----------
-
-    @Test
-    void releasePreservesWorktreeWhenDirtyCheckThrows() {
-        FakeHerdr herdr = new FakeHerdr();
-        RecordingWorktrees worktrees = new RecordingWorktrees();
-        SessionManager sessions = sessionManager(herdr, worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581a", null));
-        worktrees.failHasUncommittedWith(new WorktreeException("git status exited 128"));
-
-        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
-        ch.qos.logback.classic.Logger sessionLog =
-                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(SessionManager.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.setContext(ctx);
-        appender.start();
-        sessionLog.addAppender(appender);
-        sessionLog.setLevel(Level.WARN);
-        try {
-            assertDoesNotThrow(() -> sessions.release(s.paneId()),
-                    "a throwing dirty check must not abort the release");
-
-            assertTrue(worktrees.removeCalls().isEmpty(),
-                    "the worktree is preserved when its dirty state cannot be determined");
-            String warn = appender.list.stream()
-                    .filter(e -> e.getLevel().equals(Level.WARN))
-                    .map(ILoggingEvent::getFormattedMessage)
-                    .filter(m -> m.contains(s.worktree()))
-                    .findFirst()
-                    .orElse("no warn logged naming the worktree");
-            assertTrue(warn.contains(s.paneId()), "the WARN names the pane: " + warn);
-            assertTrue(warn.contains(s.terminalId()), "the WARN names the terminal: " + warn);
-        } finally {
-            sessionLog.detachAppender(appender);
-        }
-    }
-
-    @Test
-    void releaseStillStopsThePaneWhenDirtyCheckThrows() {
-        FakeHerdr herdr = new FakeHerdr();
-        RecordingWorktrees worktrees = new RecordingWorktrees();
-        SessionManager sessions = sessionManager(herdr, worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581b", null));
-        worktrees.failHasUncommittedWith(new WorktreeException("git status exited 128"));
-
-        sessions.release(s.paneId());
-
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_1"),
-                "the pane is stopped exactly once even though the dirty check threw");
-    }
-
-    @Test
-    void releaseStillNotifiesTheListenerWhenDirtyCheckThrows() {
-        FakeHerdr herdr = new FakeHerdr();
-        RecordingWorktrees worktrees = new RecordingWorktrees();
-        SessionManager sessions = sessionManager(herdr, worktrees);
-        java.util.List<String> released = new java.util.concurrent.CopyOnWriteArrayList<>();
-        sessions.onRelease(detail -> released.add(detail.terminalId()));
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581c", null));
-        worktrees.failHasUncommittedWith(new WorktreeException("git status exited 128"));
-
-        sessions.release(s.paneId());
-
-        assertEquals(java.util.List.of(s.terminalId()), released,
-                "a blocked caller must still be told the terminal was released, even though the "
-                        + "dirty check threw");
-    }
-
-    @Test
-    void reapIdleSurvivesOneSessionThatFailsToRelease() {
-        long[] clock = {0};
-        FakeHerdr herdr = new FakeHerdr();
-        RecordingWorktrees worktrees = new RecordingWorktrees();
-        SessionManager sessions = sessionManager(herdr, worktrees, () -> clock[0]);
-        MemberSession a = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581d", null));
-        MemberSession b = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581e", null));
-        MemberSession c = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581f", null));
-        sessions.asPresence().markPresent(a.terminalId());
-        sessions.asPresence().markPresent(b.terminalId());
-        sessions.asPresence().markPresent(c.terminalId());
-        // The middle session's worktree removal fails — release() propagates that, so this is the
-        // one call reapIdle's per-session guard must survive without skipping the rest of the pass.
-        worktrees.failRemoveFor(b.worktree());
-
-        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
-        ch.qos.logback.classic.Logger sessionLog =
-                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(SessionManager.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.setContext(ctx);
-        appender.start();
-        sessionLog.addAppender(appender);
-        sessionLog.setLevel(Level.WARN);
-        int reaped;
-        try {
-            clock[0] = 100;
-            reaped = sessions.reapIdle(10);
-
-            String warn = appender.list.stream()
-                    .filter(e -> e.getLevel().equals(Level.WARN))
-                    .map(ILoggingEvent::getFormattedMessage)
-                    .filter(m -> m.contains(b.paneId()))
-                    .findFirst()
-                    .orElse("no reap-failure WARN logged");
-            assertTrue(warn.contains(b.terminalId()), "the WARN names the failed session's terminal: " + warn);
-            assertTrue(warn.contains(b.worktree()), "the WARN names the failed session's worktree: " + warn);
-        } finally {
-            sessionLog.detachAppender(appender);
-        }
-
-        assertEquals(2, reaped, "the middle session's failure is logged, not counted as reaped");
-        assertTrue(sessions.get(a.paneId()).isEmpty(), "the first session is still released");
-        assertTrue(sessions.get(c.paneId()).isEmpty(), "the third session is still released");
-        assertTrue(sessions.get(b.paneId()).isEmpty(),
-                "the middle session is still deregistered even though its worktree removal threw");
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_1"), "the first pane is stopped");
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_2"),
-                "the middle pane is still stopped even though its worktree removal failed");
-        assertEquals(1, paneCloseCallsFor(herdr, "w9:pRoot_3"), "the third pane is stopped");
-    }
-
-    @Test
-    void unchangedRegressionCleanCompletedReleaseStillRemovesTheWorktree() {
-        FakeHerdr herdr = new FakeHerdr();
-        RecordingWorktrees worktrees = new RecordingWorktrees();
-        SessionManager sessions = sessionManager(herdr, worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581g", null));
-
-        sessions.release(s.paneId());
-
-        assertEquals(List.of(s.worktree()), worktrees.removeCalls(),
-                "COMPLETED release of a clean worktree still removes it");
-    }
-
-    @Test
-    void unchangedRegressionDirtyCompletedReleaseStillPreservesTheWorktree() {
-        FakeHerdr herdr = new FakeHerdr();
-        RecordingWorktrees worktrees = new RecordingWorktrees().dirty(true);
-        SessionManager sessions = sessionManager(herdr, worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581h", null));
-
-        sessions.release(s.paneId());
-
-        assertTrue(worktrees.removeCalls().isEmpty(),
-                "COMPLETED release of a dirty worktree still preserves it");
-    }
-
-    @Test
-    void unchangedRegressionShutdownDrainStillPreservesTheWorktree() {
-        FakeHerdr herdr = new FakeHerdr();
-        RecordingWorktrees worktrees = new RecordingWorktrees();
-        SessionManager sessions = sessionManager(herdr, worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-581i", null));
-        sessions.asPresence().markPresent(s.terminalId());
-
-        sessions.drainAll(TimeUnit.MILLISECONDS.toNanos(100));
-
-        assertTrue(worktrees.removeCalls().isEmpty(), "SHUTDOWN drain still preserves the worktree");
-    }
-
-    // ── CB-584: agentSessionId recorded at acquire, and gated by Capability.SESSION_RESUME ─────
-
-    /**
-     * A minimal {@link PeerLauncher} whose capabilities exclude SESSION_RESUME — the "does not
-     * support it" case. {@link #requireResumeCapability} throws before ever reaching {@link #spawn},
-     * so every method beyond {@link #capabilitiesFor} is unreachable in these tests and left unimplemented.
-     */
-    private static final class NoResumeLauncher implements PeerLauncher {
-        @Override
-        public Set<Capability> capabilities() {
-            return Set.of(Capability.WORKTREE); // deliberately no SESSION_RESUME
-        }
-
-        @Override
-        public Set<Capability> capabilitiesFor(String profileName) {
-            return capabilities();
-        }
-
-        @Override
-        public PeerHandle spawn(SpawnRequest req) {
-            throw new UnsupportedOperationException("not reachable — the capability check refuses first");
-        }
-
-        @Override
-        public Set<String> profiles() {
-            return Set.of("stub-profile");
-        }
-
-        @Override
-        public String defaultProfile() {
-            return "stub-profile";
-        }
-
-        @Override
-        public String effectiveCwd(SpawnRequest req) {
-            throw new UnsupportedOperationException("not reachable — the capability check refuses first");
-        }
-
-        @Override
-        public List<String> parityOverlay(String profileName) {
-            return List.of();
-        }
-
-        @Override
-        public List<?> list() {
-            return List.of();
-        }
-
-        @Override
-        public int reapOrphanWorkers() {
-            return 0;
-        }
-
-        @Override
-        public void stop(String id) {
-        }
-
-        @Override
-        public boolean clearContext(String id) {
-            return false;
-        }
-    }
-
-    @Test
-    void acquireRecordsTheAgentSessionIdFromTheHandle() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-
-        MemberSession s = sessions.acquire("ltms-local", MemberRole.DEV, null, null, null, null,
-                "my-session-name", null);
-
-        assertNotNull(s.agentSessionId(), "a spawn that asked for session identity gets one back");
-        Map<String, Object> view = SessionManager.rosterView(s, null);
-        assertEquals(s.agentSessionId(), view.get("agentSessionId"),
-                "the roster exposes the same id the session recorded");
-    }
-
-    @Test
-    void acquireWithNeitherSessionFieldLeavesAgentSessionIdNull() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-
-        MemberSession s = sessions.acquire("ltms-local", null, null, null);
-
-        assertNull(s.agentSessionId(), "no identity requested — unchanged from before CB-584");
-        assertFalse(SessionManager.rosterView(s, null).containsKey("agentSessionId"),
-                "a null id is omitted from the roster, like charterSha256 for a receipt-less session");
-    }
-
-    @Test
-    void resumeSessionIdResumesTheSameConversationOnASupportingAdapter() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-
-        MemberSession s = sessions.acquire("ltms-local", MemberRole.DEV, null, null, null, null,
-                null, "cb-resume-77");
-
-        assertEquals("cb-resume-77", s.agentSessionId(),
-                "a resume adopts the prior id as its own agentSessionId");
-    }
-
-    @Test
-    void resumeSessionIdWithoutAnExplicitProfileIsRefused() {
-        FakeHerdr herdr = new FakeHerdr();
-        SessionManager sessions = sessionManager(herdr);
-
-        IllegalArgumentException e = assertThrows(IllegalArgumentException.class, () ->
-                sessions.acquire(null, MemberRole.DEV, null, null, null, null, null, "cb-resume-1"));
-
-        assertTrue(e.getMessage().contains("explicit profile"), e.getMessage());
-    }
-
-    @Test
-    void resumeSessionIdOnAnAdapterWithoutTheCapabilityIsRefusedNamingIt() {
-        SessionManager sessions = new SessionManager(new NoResumeLauncher());
-
-        IllegalArgumentException e = assertThrows(IllegalArgumentException.class, () ->
-                sessions.acquire("stub-profile", MemberRole.DEV, null, null, null, null, null, "cb-resume-1"));
-
-        assertTrue(e.getMessage().contains("SESSION_RESUME"), e.getMessage());
-        assertTrue(e.getMessage().contains("stub-profile"), e.getMessage());
-    }
 }
@@ -5,7 +5,7 @@ import dev.ltms.bridged.guard.SubscriptionGuard;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.WorkspaceControl;
-import dev.ltms.bridged.member.ClaudeCodeLauncher;
+import dev.ltms.bridged.worker.ClaudeCodeLauncher;
 import org.junit.jupiter.api.Test;

 import java.util.List;
@@ -29,7 +29,7 @@ class SessionReaperTest {

    private static ClaudeCodeLauncher launcher() {
        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
                "worker: {profile} #{n}", null, null, null);
@@ -1,25 +1,16 @@
 package dev.ltms.bridged.session;

-import dev.ltms.bridged.auth.MemberRegistry;
 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.guard.SubscriptionGuard;
 import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.WorkspaceControl;
-import ch.qos.logback.classic.Level;
-import ch.qos.logback.classic.LoggerContext;
-import ch.qos.logback.classic.spi.ILoggingEvent;
-import ch.qos.logback.core.read.ListAppender;
-import dev.ltms.bridged.member.ClaudeCodeLauncher;
-import dev.ltms.bridged.msg.TestTurnTokens;
-import dev.ltms.bridged.peer.MemberRole;
+import dev.ltms.bridged.worker.ClaudeCodeLauncher;
 import org.junit.jupiter.api.Test;
-import org.slf4j.LoggerFactory;

 import java.util.List;
 import java.util.Map;
 import java.util.Set;
-import java.util.concurrent.TimeUnit;

 import static org.junit.jupiter.api.Assertions.*;

@@ -30,15 +21,8 @@ import static org.junit.jupiter.api.Assertions.*;
 */
 class WorktreeSessionManagerTest {

-    private static MemberRegistry members() {
-        return new MemberRegistry(new BridgedConfig.Fleet(Map.of(),
-                Map.of("architect", new BridgedConfig.Slot("ltms-local")),
-                Map.of("dev", new BridgedConfig.Slot("ltms-local")),
-                Map.of("reviewer", new BridgedConfig.Slot("ltms-local")), null));
-    }
-
    private static ClaudeCodeLauncher workerService(FakeHerdr herdr) {
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
                "worker: {profile} #{n}", null, null, null);
@@ -60,7 +44,7 @@ class WorktreeSessionManagerTest {
        FakeWorktrees worktrees = new FakeWorktrees();
        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);

-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", "term_primary");
+        WorkerSession s = sessions.acquire("ltms-local", null, "/caller/proj", "term_primary");

        assertTrue(worktrees.addCalls().isEmpty(), "shared-tree acquire never adds a worktree");
        assertTrue(worktrees.repoRootCalls().isEmpty(), "shared-tree acquire never resolves a repo root");
@@ -71,43 +55,13 @@ class WorktreeSessionManagerTest {
        assertEquals("/caller/proj", startCwd(herdr), "spawn receives the caller's cwd");
    }

-    @Test
-    void onlyArchitectsBindAndReleaseMakesTheirSlotReusable() {
-        FakeHerdr herdr = new FakeHerdr();
-        MemberRegistry members = members();
-        SessionManager sessions = new SessionManager(workerService(herdr), new FakeWorktrees());
-        sessions.setMemberLifecycle(members);
-
-        MemberSession architect = sessions.acquire("ltms-local", MemberRole.ARCHITECT,
-                null, "/caller/proj", null, null);
-        MemberSession dev = sessions.acquire("ltms-local", MemberRole.DEV,
-                null, "/caller/proj", null, null);
-        MemberSession reviewer = sessions.acquire("ltms-local", MemberRole.REVIEWER,
-                null, "/caller/proj", null, null);
-
-        assertEquals("architect:architect", members.slotForTerminal(architect.terminalId()));
-        assertNull(members.slotForTerminal(dev.terminalId()), "a dev must never receive architect rights");
-        assertNull(members.slotForTerminal(reviewer.terminalId()),
-                "a reviewer must never receive architect rights");
-
-        sessions.release(architect.paneId());
-        MemberSession replacement = sessions.acquire("ltms-local", MemberRole.ARCHITECT,
-                null, "/caller/proj", null, null);
-        assertEquals("architect:architect", members.slotForTerminal(replacement.terminalId()));
-
-        MemberSession overflow = sessions.acquire("ltms-local", MemberRole.ARCHITECT,
-                null, "/caller/proj", null, null);
-        assertNull(members.slotForTerminal(overflow.terminalId()),
-                "a full slot pool must not stop the architect spawn");
-    }
-
    @Test
    void worktreeAcquireProvisionsAndRecordsPathAndBranch() {
        FakeHerdr herdr = new FakeHerdr();
        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);

-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", "term_primary",
+        WorkerSession s = sessions.acquire("ltms-local", null, "/caller/proj", "term_primary",
                new WorktreeRequest("cb-999", null));

        assertEquals(1, worktrees.addCalls().size(), "one worktree was added");
@@ -124,19 +78,6 @@ class WorktreeSessionManagerTest {
        assertEquals(expectedPath, s.cwd(), "session cwd is the worktree path");
    }

-    @Test
-    void worktreeArchitectAcquireAlsoBindsItsSlot() {
-        FakeHerdr herdr = new FakeHerdr();
-        MemberRegistry members = members();
-        SessionManager sessions = new SessionManager(workerService(herdr), new FakeWorktrees());
-        sessions.setMemberLifecycle(members);
-
-        MemberSession architect = sessions.acquire("ltms-local", MemberRole.ARCHITECT,
-                null, "/caller/proj", null, new WorktreeRequest("cb-548", null));
-
-        assertEquals("architect:architect", members.slotForTerminal(architect.terminalId()));
-    }
-
    @Test
    void worktreeAcquireRunsParityOverlayWithProfileDefaults() {
        FakeHerdr herdr = new FakeHerdr();
@@ -152,12 +93,12 @@ class WorktreeSessionManagerTest {
        FakeWorktrees.OverlayCall overlay = worktrees.lastOverlay();
        assertNotNull(overlay);
        assertEquals("/repo", overlay.repoRoot());
-        assertEquals(List.of(".env", ".envrc"),
+        assertEquals(List.of(".claude/settings.local.json", ".env", ".envrc"),
                overlay.requested(), "default parity overlay is used when unset");
        assertFalse(overlay.requested().contains(".mcp.json"),
                "CB-525: replicating the primary's MCP config gives a worker the primary's IDE "
                        + "servers, which navigate its edits out of its own worktree");
-        assertEquals(List.of(".envrc"), overlay.copied(),
+        assertEquals(List.of(".claude/settings.local.json", ".envrc"), overlay.copied(),
                "existing paths are copied; missing paths are skipped");
        assertEquals(List.of(".envrc"), overlay.skipWorktree(),
                "tracked copied paths are --skip-worktree'd");
@@ -168,7 +109,7 @@ class WorktreeSessionManagerTest {
        FakeHerdr herdr = new FakeHerdr();
        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
+        WorkerSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
                new WorktreeRequest("cb-666", null));
        String paneId = s.paneId();

@@ -184,91 +125,12 @@ class WorktreeSessionManagerTest {
        assertTrue(sessions.get(paneId).isEmpty(), "released session is no longer retrievable");
    }

-    /**
-     * CB-576. A normal {@code COMPLETED} release whose worktree holds uncommitted work must NOT
-     * remove it — {@code --force} would destroy the worker's only copy. The bridge cannot see
-     * uncommitted files, so the worktree is preserved and the release logged at WARN naming the
-     * path, the session, and the cause an operator needs to find the work.
-     */
-    @Test
-    void releasePreservesDirtyWorktreeAndLogsWarn() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt")
-                .withDirty(true);
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-576", null));
-
-        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
-        ch.qos.logback.classic.Logger sessionLog =
-                (ch.qos.logback.classic.Logger) LoggerFactory.getLogger(SessionManager.class);
-        ListAppender<ILoggingEvent> appender = new ListAppender<>();
-        appender.setContext(ctx);
-        appender.start();
-        sessionLog.addAppender(appender);
-        sessionLog.setLevel(Level.WARN);
-        try {
-            sessions.release(s.paneId());
-
-            assertTrue(herdr.called("pane.close"), "release still tears the worker pane down");
-            assertTrue(worktrees.removeCalls().isEmpty(),
-                    "a dirty worktree is never removed — it holds the only copy of the work");
-            String warn = appender.list.stream()
-                    .filter(e -> e.getLevel().equals(Level.WARN))
-                    .map(ILoggingEvent::getFormattedMessage)
-                    .filter(m -> m.contains("dirty worktree"))
-                    .findFirst()
-                    .orElse("no dirty-release WARN logged");
-            assertTrue(warn.contains(s.worktree()), "the WARN names the worktree path: " + warn);
-            assertTrue(warn.contains(s.terminalId()), "the WARN names the session: " + warn);
-            assertTrue(warn.contains("COMPLETED"), "the WARN names the release cause: " + warn);
-        } finally {
-            sessionLog.detachAppender(appender);
-        }
-    }
-
-    @Test
-    void drainAllPreservesWorktreeOfIdleSession() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-544", null));
-        sessions.asPresence().markPresent(s.terminalId()); // READY (idle)
-
-        sessions.drainAll(TimeUnit.MILLISECONDS.toNanos(100));
-
-        assertTrue(herdr.called("pane.close"), "shutdown drain still stops the worker pane");
-        assertTrue(worktrees.removeCalls().isEmpty(),
-                "shutdown drain must NOT remove the worktree — it is the only copy of the work");
-        assertTrue(sessions.roster().isEmpty(), "shutdown drain still deregisters the session");
-    }
-
-    @Test
-    void drainAllPreservesWorktreeOfSessionStillBusyAtTimeout() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-544", null));
-        String terminal = s.terminalId();
-        sessions.asPresence().markPresent(terminal);
-        sessions.onDelivered(terminal, TestTurnTokens.inert(terminal)); // BUSY, never completes → still BUSY when the timeout hits
-
-        sessions.drainAll(TimeUnit.MILLISECONDS.toNanos(100));
-
-        assertTrue(herdr.called("pane.close"), "shutdown drain stops the worker pane");
-        assertTrue(worktrees.removeCalls().isEmpty(),
-                "a session still BUSY at timeout must preserve its worktree unconditionally");
-        assertTrue(sessions.roster().isEmpty(), "shutdown drain still deregisters the session");
-    }
-
    @Test
    void sharedTreeReleaseMakesNoWorktreesCalls() {
        FakeHerdr herdr = new FakeHerdr();
        FakeWorktrees worktrees = new FakeWorktrees();
        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null);
+        WorkerSession s = sessions.acquire("ltms-local", null, "/caller/proj", null);

        sessions.release(s.paneId());

@@ -297,9 +159,9 @@ class WorktreeSessionManagerTest {
        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);

-        MemberSession a = sessions.acquire("ltms-local", null, "/caller/proj", null,
+        WorkerSession a = sessions.acquire("ltms-local", null, "/caller/proj", null,
                new WorktreeRequest("cb-444", null));
-        MemberSession b = sessions.acquire("ltms-local", null, "/caller/proj", null,
+        WorkerSession b = sessions.acquire("ltms-local", null, "/caller/proj", null,
                new WorktreeRequest("cb-444", null));

        assertNotEquals(a.branch(), b.branch(), "branches are distinct");
@@ -346,7 +208,7 @@ class WorktreeSessionManagerTest {
        FakeHerdr herdr = new FakeHerdr();
        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
        // Argument order matters: configDir is the 4th parameter, cwd the 11th (after mcpUrl).
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
                List.of("ccs", "ltms-local"), "tab", "bridged-workers",
                "worker: {profile} #{n}", null, "/pinned/dir", null);
@@ -362,86 +224,4 @@ class WorktreeSessionManagerTest {
                "the profile's configured cwd must reach repoRoot, not be ignored");
    }

-    // --- CB-578 stage C: snapshot a dirty worktree into git before the preserve-or-remove decision ---
-
-    @Test
-    void releaseOfACleanWorktreeNeverSnapshots() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt");
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-578c-a", null));
-
-        sessions.release(s.paneId());
-
-        assertTrue(worktrees.snapshotCalls().isEmpty(),
-                "acceptance criterion 4: a clean release must create no snapshot ref or commit");
-        assertEquals(1, worktrees.removeCalls().size(), "a clean worktree is still removed as before");
-    }
-
-    @Test
-    void releaseOfADirtyWorktreeSnapshotsBeforePreserving() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt")
-                .withDirty(true);
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-578c-b", null));
-
-        sessions.release(s.paneId());
-
-        assertEquals(1, worktrees.snapshotCalls().size(),
-                "acceptance criterion 1: a dirty release snapshots the worktree exactly once");
-        FakeWorktrees.SnapshotCall call = worktrees.lastSnapshot();
-        assertEquals(s.worktree(), call.worktreePath());
-        assertEquals(s.branch(), call.branch());
-        assertTrue(worktrees.removeCalls().isEmpty(), "the dirty worktree is still preserved, not removed");
-    }
-
-    @Test
-    void releaseNotifiesTheListenerWithWorktreeBranchAndSnapshotRef() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt")
-                .withDirty(true);
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-        java.util.List<SessionManager.ReleaseDetail> released = new java.util.concurrent.CopyOnWriteArrayList<>();
-        sessions.onRelease(released::add);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-578c-c", null));
-
-        sessions.release(s.paneId());
-
-        assertEquals(1, released.size());
-        SessionManager.ReleaseDetail detail = released.getFirst();
-        assertEquals(s.terminalId(), detail.terminalId());
-        assertEquals(s.worktree(), detail.worktreePath(),
-                "acceptance criterion 6: a failed ticket's detail must carry the worktree path");
-        assertEquals(s.branch(), detail.branch(),
-                "acceptance criterion 6: a failed ticket's detail must carry the branch");
-        assertEquals("wip1", detail.snapshotRef(),
-                "acceptance criterion 6: a failed ticket's detail must carry the snapshot ref");
-    }
-
-    @Test
-    void aFailingSnapshotStillPreservesTheWorktreeStopsThePaneAndNotifies() {
-        FakeHerdr herdr = new FakeHerdr();
-        FakeWorktrees worktrees = new FakeWorktrees().withRepoRoot("/repo").withPrefix("/wt")
-                .withDirty(true).failSnapshot("git commit-tree exited 128");
-        SessionManager sessions = new SessionManager(workerService(herdr), worktrees);
-        java.util.List<SessionManager.ReleaseDetail> released = new java.util.concurrent.CopyOnWriteArrayList<>();
-        sessions.onRelease(released::add);
-        MemberSession s = sessions.acquire("ltms-local", null, "/caller/proj", null,
-                new WorktreeRequest("cb-578c-d", null));
-
-        assertDoesNotThrow(() -> sessions.release(s.paneId()),
-                "acceptance criterion 5: a failing snapshot must not propagate out of release()");
-
-        assertTrue(herdr.called("pane.close"), "acceptance criterion 5: the pane must still stop");
-        assertTrue(worktrees.removeCalls().isEmpty(),
-                "acceptance criterion 5: the worktree must still be preserved when the snapshot fails");
-        assertEquals(1, released.size(), "acceptance criterion 5: the listener must still be notified");
-        assertNull(released.getFirst().snapshotRef(),
-                "a failed snapshot leaves no ref to report");
-    }
-
 }
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.member;
+package dev.ltms.bridged.worker;

 import dev.ltms.bridged.config.BridgedConfig;
 import dev.ltms.bridged.guard.GuardException;
@@ -7,7 +7,6 @@ import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.MemberRole;
 import dev.ltms.bridged.peer.PeerHandle;
 import dev.ltms.bridged.peer.PeerUnreachableException;
 import dev.ltms.bridged.peer.SpawnRequest;
@@ -17,9 +16,7 @@ import java.util.List;
 import java.util.Map;
 import java.util.Set;
 import java.util.UUID;
-import java.util.concurrent.atomic.AtomicReference;
 import java.util.function.Function;
-import java.util.function.Supplier;

 import static org.junit.jupiter.api.Assertions.*;

@@ -27,7 +24,7 @@ import static org.junit.jupiter.api.Assertions.*;
 class ClaudeCodeLauncherTest {

    private ClaudeCodeLauncher service(FakeHerdr herdr, List<String> argv, String mcpUrl) {
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
                argv, "tab", "bridged-workers", "worker: {profile} #{n}", mcpUrl, null, null);
        return new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
@@ -62,7 +59,7 @@ class ClaudeCodeLauncherTest {
        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(
                new AgentControl(herdr), new WorkspaceControl(herdr),
                new SubscriptionGuard(Set.of("gx00.gw")),
-                Map.of("ltms-local", new BridgedConfig.Profile(
+                Map.of("ltms-local", new BridgedConfig.Worker(
                        "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
                        List.of("claude"), "tab", "bridged-workers", "w #{n}", null, null, null)),
                "ltms-local", _ -> null,
@@ -102,57 +99,10 @@ class ClaudeCodeLauncherTest {
                "the operator's own args are preserved, in order, ahead of the model flag");
    }

-    @Test
-    void appendsTheBaseComposedRoleAndReplyCharter() {
-        FakeHerdr herdr = new FakeHerdr();
-        String roleCharter = "You review changes.";
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
-                "sonnet", "http://gx00.gw:8000", null, null, "BRIDGED_WORKER_TOKEN",
-                List.of("claude"), "tab", "bridged-workers", "w #{n}",
-                "http://127.0.0.1:8765/mcp", null, null);
-        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null,
-                0, 0L, () -> fleet(Map.of("reviewer", roleCharter), null));
-
-        svc.spawn(new SpawnRequest("sonnet", null, null, null, null, MemberRole.REVIEWER));
-
-        List<String> args = spawnedArgs(herdr);
-        int flag = args.indexOf("--append-system-prompt");
-        assertEquals(1, args.stream().filter("--append-system-prompt"::equals).count(),
-                "the composed charter is passed once");
-        assertEquals(roleCharter + "\n\n" + HerdrPeerLauncher.REPLY_CHARTER, args.get(flag + 1),
-                "the role charter comes first and the reply rule comes last");
-    }
-
-    @Test
-    void profileWithoutMcpOrRoleCharterGetsNoSystemPrompt() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = labelService(herdr, () -> fleet(Map.of(), null));
-
-        svc.spawn(new SpawnRequest("sonnet", null, null, null, null, MemberRole.DEV));
-
-        assertFalse(spawnedArgs(herdr).contains("--append-system-prompt"));
-    }
-
-    @Test
-    void profileWithoutMcpStillGetsItsRoleCharter() {
-        FakeHerdr herdr = new FakeHerdr();
-        String roleCharter = "You design changes.";
-        ClaudeCodeLauncher svc = labelService(herdr, () -> fleet(Map.of("architect", roleCharter), null));
-
-        svc.spawn(new SpawnRequest("sonnet", null, null, null, null, MemberRole.ARCHITECT));
-
-        List<String> args = spawnedArgs(herdr);
-        int flag = args.indexOf("--append-system-prompt");
-        assertTrue(flag >= 0, "a role charter does not need an MCP mount");
-        assertEquals(roleCharter, args.get(flag + 1));
-        assertFalse(args.contains("--mcp-config"));
-    }
-
    private ClaudeCodeLauncher multiProfile(FakeHerdr herdr) {
-        BridgedConfig.Profile gx10 = new BridgedConfig.Profile("gx10", "http://gx10.gw:8000", "coder",
+        BridgedConfig.Worker gx10 = new BridgedConfig.Worker("gx10", "http://gx10.gw:8000", "coder",
                null, "BRIDGED_WORKER_TOKEN", List.of("claude"), "tab", "bridged-workers", "w #{n}", null, null, null);
-        BridgedConfig.Profile ollama = new BridgedConfig.Profile("ollama", "http://ollama.ltms.dev", null,
+        BridgedConfig.Worker ollama = new BridgedConfig.Worker("ollama", "http://ollama.ltms.dev", null,
                null, "BRIDGED_WORKER_TOKEN", List.of("claude"), "tab", "bridged-workers", "w #{n}", null, null, null);
        return new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
                new SubscriptionGuard(Set.of("gx10.gw", "ollama.ltms.dev")),
@@ -193,7 +143,7 @@ class ClaudeCodeLauncherTest {
    @Test
    void profileConfigCwdBeatsTheCallerCwd() {
        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile("ltms-local", "http://gx00.gw:8000", "coder",
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker("ltms-local", "http://gx00.gw:8000", "coder",
                null, "BRIDGED_WORKER_TOKEN", List.of("ccs", "ltms-local"), "tab", "bridged-workers",
                "w #{n}", null, "/pinned/dir", null);
        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
@@ -220,7 +170,7 @@ class ClaudeCodeLauncherTest {
    @Test
    void injectsForgeTokenAndHostWhenProfileGrantsIt() {
        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "impl", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
                List.of("ccs", "impl"), "tab", "bridged-workers", "w #{n}", null, null, null,
                "GITEA_ACCESS_TOKEN", null); // parityOverlay null; gitHostEnv null → defaults to GITEA_HOST
@@ -242,7 +192,7 @@ class ClaudeCodeLauncherTest {
        FakeHerdr herdr = new FakeHerdr();
        // gitTokenEnv unset (12-arg ctor); the env would resolve a token if asked, proving the gate
        // is the profile config, not a missing env var.
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile("ltms-local", "http://gx00.gw:8000", "coder",
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker("ltms-local", "http://gx00.gw:8000", "coder",
                null, "BRIDGED_WORKER_TOKEN", List.of("ccs"), "tab", "bridged-workers", "w #{n}",
                null, null, null);
        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
@@ -373,7 +323,7 @@ class ClaudeCodeLauncherTest {
    @Test
    void capabilitiesIncludeSelfPrWhenProfileHasGitToken() {
        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "impl", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
                List.of("ccs", "impl"), "tab", "bridged-workers", "w #{n}", null, null, null,
                "GITEA_ACCESS_TOKEN", null);
@@ -526,8 +476,8 @@ class ClaudeCodeLauncherTest {

    // --- CB-306 spawn-readiness gate -----------------------------------------------------------

-    private static Map<String, BridgedConfig.Profile> workerConfigMap(String profile, String mcpUrl) {
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+    private static Map<String, BridgedConfig.Worker> workerConfigMap(String profile, String mcpUrl) {
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                profile, "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
                List.of("ccs", profile), "tab", "bridged-workers",
                "worker: {profile} #{n}", mcpUrl, null, null);
@@ -629,7 +579,7 @@ class ClaudeCodeLauncherTest {
    @Test
    void workerInheritsTheDaemonPath() {
        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
                List.of("claude"), "tab", "bridged-workers", "w #{n}", null, null, null);
        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
@@ -643,7 +593,7 @@ class ClaudeCodeLauncherTest {
    @Test
    void profileEnvIsInjectedIntoTheWorker() {
        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
                List.of("claude"), "tab", "bridged-workers", "w #{n}", null, null, null, null, null,
                null, Map.of("JAVA_HOME", "/opt/jdk", "PATH", "/profile/bin"), null, null);
@@ -664,7 +614,7 @@ class ClaudeCodeLauncherTest {
    @Test
    void profileEnvCannotOverrideGuardCheckedAnthropicVars() {
        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
                List.of("claude"), "tab", "bridged-workers", "w #{n}", null, null, null, null, null,
                null, Map.of("ANTHROPIC_BASE_URL", "http://evil.example.com"), null, null);
@@ -676,97 +626,18 @@ class ClaudeCodeLauncherTest {
                "the guard-checked baseUrl must win over any env: entry, or the boundary is bypassable");
    }

-    // --- CB-592: the admin GITEA_ACCESS_TOKEN never reaches a member -----------------------------
-
-    /**
-     * herdr's env map is an overlay onto its own (login-shell) process environment, so a worker
-     * inherits whatever the daemon's shell carries — including the admin GITEA_ACCESS_TOKEN — for
-     * every key baseEnv does not explicitly shadow. This pins that the launcher DOES send an
-     * explicit (non-blank) GITEA_ACCESS_TOKEN to herdr on every spawn, whatever the profile is, so
-     * a future baseEnv refactor cannot silently drop it and reopen the leak. Asserted against what
-     * tab.create's params actually carry, not an internal map built in the test (gitea #77).
-     *
-     * <p>Scope, measured on a live pane 2026-08-15: this pins what the launcher SENDS, and that is
-     * all it can pin. It does not prove the value survives, and it does not: the pane runs a login
-     * shell, ~/.zprofile sources secrets.sh, and its unconditional `export GITEA_ACCESS_TOKEN=...`
-     * puts the real token back over this sentinel. Closing that needs the operator to guard the
-     * export on BRIDGED_MEMBER — see everySpawnMarksThePaneAsAMember below.
-     */
-    @Test
-    void everySpawnShadowsTheAdminGiteaAccessToken() {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, List.of("claude"), null).spawn();
-
-        String shadowed = startEnv(herdr).get("GITEA_ACCESS_TOKEN");
-        assertNotNull(shadowed, "GITEA_ACCESS_TOKEN must be explicitly overlaid, not left unmentioned");
-        assertFalse(shadowed.isBlank(), "a blank overlay value's override behaviour is unverified — must be non-blank");
-    }
-
-    /**
-     * No profile — present or future — may restore the admin token by naming it in {@code env:}.
-     * The shadow is applied after the profile's own env in {@link HerdrPeerLauncher#baseEnv}
-     * precisely so this can never happen; this test pins that ordering.
-     */
-    @Test
-    void aProfileEnvEntryCannotRestoreTheAdminGiteaAccessToken() {
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("claude"), "tab", "bridged-workers", "w #{n}", null, null, null, null, null,
-                null, Map.of("GITEA_ACCESS_TOKEN", "admin-secret-from-profile-config"), null, null);
-        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
-                _ -> null).spawn();
-
-        assertNotEquals("admin-secret-from-profile-config", startEnv(herdr).get("GITEA_ACCESS_TOKEN"),
-                "a profile's own env: must not be able to smuggle the admin token back in");
-    }
-
-    /**
-     * The half of CB-592 that can actually survive the pane's login shell. BRIDGED_MEMBER is a name
-     * secrets.sh never exports, so nothing overwrites it — measured: GITEA_TOKEN is injected the
-     * same way, is absent from a login shell of its own, and was observed set inside a live member
-     * pane. It lets the operator guard the admin export with
-     * `[ -n "${BRIDGED_MEMBER:-}" ] || export GITEA_ACCESS_TOKEN=...`, which is the whole fix.
-     * Pinned here so a refactor cannot drop the marker and quietly un-guard every member (#77).
-     */
-    @Test
-    void everySpawnMarksThePaneAsAMember() {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, List.of("claude"), null).spawn();
-
-        assertEquals("1", startEnv(herdr).get("BRIDGED_MEMBER"),
-                "every member pane must be marked, or a shell file cannot tell it apart from the operator's");
-    }
-
-    /** A profile must not be able to hide that its pane is a member, for the same reason as above. */
-    @Test
-    void aProfileEnvEntryCannotClearTheMemberMarker() {
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
-                "ltms-local", "http://gx00.gw:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
-                List.of("claude"), "tab", "bridged-workers", "w #{n}", null, null, null, null, null,
-                null, Map.of("BRIDGED_MEMBER", ""), null, null);
-        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
-                _ -> null).spawn();
-
-        assertEquals("1", startEnv(herdr).get("BRIDGED_MEMBER"),
-                "a profile's own env: must not be able to unmark its pane");
-    }
-
    // ── CB-533: the model is pinned on the command line, not only in the environment ────────────

    /** A launcher for a profile identical but for its {@code model:} — the only variable here. */
    private ClaudeCodeLauncher serviceWithModel(FakeHerdr herdr, String model) {
-        BridgedConfig.Profile cfg = profileWithModel(model);
+        BridgedConfig.Worker cfg = profileWithModel(model);
        return new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
                _ -> null);
    }

-    private static BridgedConfig.Profile profileWithModel(String model) {
-        return new BridgedConfig.Profile("sonnet", "http://gx00.gw:8000", model, null,
+    private static BridgedConfig.Worker profileWithModel(String model) {
+        return new BridgedConfig.Worker("sonnet", "http://gx00.gw:8000", model, null,
                "BRIDGED_WORKER_TOKEN", List.of("ccs", "sonnet"), "tab", "bridged-workers",
                "w #{n}", "http://127.0.0.1:8765/mcp", null, null);
    }
@@ -808,11 +679,11 @@ class ClaudeCodeLauncherTest {
    // --- CB-539: subscription-profile opt-in ----------------------------------------------------

    /** A claude-code profile on the subscription: no baseUrl (by design), no off-sub endpoint. */
-    private static BridgedConfig.Profile subscriptionCfg(String profile, String baseUrl) {
-        return new BridgedConfig.Profile(
+    private static BridgedConfig.Worker subscriptionCfg(String profile, String baseUrl) {
+        return new BridgedConfig.Worker(
                profile, baseUrl, "sonnet", null, "BRIDGED_WORKER_TOKEN",
                List.of("ccs", profile), "tab", "bridged-workers", "w #{n}", null, null, null,
-                null, null, null, Map.of(), null, null, true, null);
+                null, null, null, Map.of(), null, null, true);
    }

    @Test
@@ -820,7 +691,7 @@ class ClaudeCodeLauncherTest {
        // Requirement 1: absent subscription:true ⇒ byte-identical refusal to today. A claude-code
        // profile with no baseUrl and no subscription must still be refused (it would bill the sub).
        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "ltms-local", null, "coder", null, "BRIDGED_WORKER_TOKEN",
                List.of("ccs", "ltms-local"), "tab", "bridged-workers", "w #{n}", null, null, null);
        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
@@ -839,7 +710,7 @@ class ClaudeCodeLauncherTest {
        // ANTHROPIC_BASE_URL nor ANTHROPIC_AUTH_TOKEN is injected even though the token env would
        // resolve one if asked.
        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile cfg = subscriptionCfg("sonnet", null);
+        BridgedConfig.Worker cfg = subscriptionCfg("sonnet", null);
        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
                _ -> "would-be-token").spawn();
@@ -856,7 +727,7 @@ class ClaudeCodeLauncherTest {
        // Requirement 2: subscription:true + a baseUrl state opposite intents — refuse at spawn,
        // naming the profile, rather than silently picking a winner.
        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile cfg = subscriptionCfg("sonnet", "http://gx00.gw:8000");
+        BridgedConfig.Worker cfg = subscriptionCfg("sonnet", "http://gx00.gw:8000");
        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);

@@ -873,7 +744,7 @@ class ClaudeCodeLauncherTest {
        // Requirement 3: the guard keeps its teeth for every other profile — a base_url whose host is
        // not on the allowlist is still refused, whether or not any subscription profile exists.
        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile rogue = new BridgedConfig.Profile(
+        BridgedConfig.Worker rogue = new BridgedConfig.Worker(
                "rogue", "http://evil.example.com:8000", "coder", null, "BRIDGED_WORKER_TOKEN",
                List.of("ccs", "rogue"), "tab", "bridged-workers", "w #{n}", null, null, null);
        ClaudeCodeLauncher svc = new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
@@ -892,13 +763,13 @@ class ClaudeCodeLauncherTest {
        // load refuses this loudly; this launcher-side strip is the belt-and-braces that makes the
        // invariant hold for a profile built in code that never passed through that validation.
        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
+        BridgedConfig.Worker cfg = new BridgedConfig.Worker(
                "sonnet", null, "sonnet", null, "BRIDGED_WORKER_TOKEN",
                List.of("ccs", "sonnet"), "tab", "bridged-workers", "w #{n}", null, null, null,
                null, null, null,
                Map.of("ANTHROPIC_BASE_URL", "http://evil.example.com",
                        "ANTHROPIC_AUTH_TOKEN", "sk-ant-bad", "JAVA_HOME", "/opt/jdk"),
-                null, null, true, null);
+                null, null, true);
        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
                _ -> "would-be-token").spawn();
@@ -911,101 +782,4 @@ class ClaudeCodeLauncherTest {
        assertEquals("/opt/jdk", env.get("JAVA_HOME"),
                "only the Anthropic binding keys are stripped; the rest of env: still applies");
    }
-
-    // ── CB-557: role-aware tab labels ─────────────────────────────────────────────────────────
-
-    /** The {@code label} of every {@code tab.rename}, in call order. */
-    private List<String> tabLabels(FakeHerdr herdr) {
-        return herdr.calls.stream()
-                .filter(c -> c.method().equals("tab.rename"))
-                .map(c -> (String) ((Map<?, ?>) c.params()).get("label"))
-                .toList();
-    }
-
-    private static BridgedConfig.Fleet fleet(Map<String, String> charters, String tabLabel) {
-        return new BridgedConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(), charters, tabLabel);
-    }
-
-    /** A profile with no {@code tabLabel:} of its own — the fleet template decides. */
-    private ClaudeCodeLauncher labelService(FakeHerdr herdr, Supplier<BridgedConfig.Fleet> fleet) {
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
-                "sonnet", "http://gx00.gw:8000", "sonnet", null, "BRIDGED_WORKER_TOKEN",
-                List.of("claude"), "tab", "bridged-workers", null, null, null, null);
-        return new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
-                _ -> null, 0, 0L, fleet);
-    }
-
-    /**
-     * The knob must reach the rename call. It was inert once — {@code HerdrPeerLauncher} accepted a
-     * template while {@code Bridged} passed none, and the label stayed right only because the
-     * fallback happened to match. Pin the wiring, not the coincidence.
-     */
-    @Test
-    void theFleetTemplateNamesTheRoleTheMemberWasSpawnedFor() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = labelService(herdr, () -> fleet(null, "{role}: {profile} #{n}"));
-
-        svc.spawn(new SpawnRequest("sonnet", null, null, null, null, MemberRole.REVIEWER));
-
-        assertEquals(List.of("reviewer: sonnet #1"), tabLabels(herdr));
-    }
-
-    /** The counter is per role+profile, so a dev and a reviewer on one profile both start at #1. */
-    @Test
-    void theCounterRunsPerRoleAndProfileNotPerFleet() {
-        FakeHerdr herdr = new FakeHerdr();
-        ClaudeCodeLauncher svc = labelService(herdr, () -> fleet(null, "{role}: {profile} #{n}"));
-
-        svc.spawn(new SpawnRequest("sonnet", null, null, null, null, MemberRole.DEV));
-        svc.spawn(new SpawnRequest("sonnet", null, null, null, null, MemberRole.REVIEWER));
-        svc.spawn(new SpawnRequest("sonnet", null, null, null, null, MemberRole.DEV));
-
-        assertEquals(List.of("dev: sonnet #1", "reviewer: sonnet #1", "dev: sonnet #2"),
-                tabLabels(herdr));
-    }
-
-    /** No fleet template configured ⇒ the built-in default, still role-first. */
-    @Test
-    void aBlankFleetTemplateFallsBackToTheRoleFirstDefault() {
-        FakeHerdr herdr = new FakeHerdr();
-        labelService(herdr, () -> fleet(null, null)).spawn(
-                new SpawnRequest("sonnet", null, null, null, null, MemberRole.ARCHITECT));
-
-        assertEquals(List.of("architect: sonnet #1"), tabLabels(herdr));
-        assertEquals("{role}: {profile} #{n}", BridgedConfig.Fleet.DEFAULT_TAB_LABEL);
-    }
-
-    /** A profile that wants its own label still outranks the fleet template. */
-    @Test
-    void aProfileTabLabelOverridesTheFleetTemplate() {
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile cfg = new BridgedConfig.Profile(
-                "sonnet", "http://gx00.gw:8000", "sonnet", null, "BRIDGED_WORKER_TOKEN",
-                List.of("claude"), "tab", "bridged-workers", "pinned {profile}", null, null, null);
-        new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                new SubscriptionGuard(Set.of("gx00.gw")), Map.of(cfg.profile(), cfg), cfg.profile(),
-                _ -> null, 0, 0L, () -> fleet(null, "{role}: {profile} #{n}"))
-                .spawn(new SpawnRequest("sonnet", null, null, null, null, MemberRole.REVIEWER));
-
-        assertEquals(List.of("pinned sonnet"), tabLabels(herdr));
-    }
-
-    /**
-     * CB-559: the template is read per spawn, not captured at construction. This is what makes
-     * {@code fleet.tabLabel} a hot key — a launcher built at boot must see an edit made an hour later
-     * without being rebuilt.
-     */
-    @Test
-    void theTemplateIsReadOnEverySpawnSoAnEditTakesEffect() {
-        FakeHerdr herdr = new FakeHerdr();
-        AtomicReference<String> template = new AtomicReference<>("{role}: {profile} #{n}");
-        ClaudeCodeLauncher svc = labelService(herdr, () -> fleet(null, template.get()));
-
-        svc.spawn(new SpawnRequest("sonnet", null, null, null, null, MemberRole.DEV));
-        template.set("[{profile}] {role} {n}");
-        svc.spawn(new SpawnRequest("sonnet", null, null, null, null, MemberRole.DEV));
-
-        assertEquals(List.of("dev: sonnet #1", "[sonnet] dev 2"), tabLabels(herdr));
-    }
 }
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.member;
+package dev.ltms.bridged.worker;

 import ch.qos.logback.classic.Logger;
 import ch.qos.logback.classic.spi.ILoggingEvent;
@@ -10,13 +10,10 @@ import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.CharterReceipt;
-import dev.ltms.bridged.peer.MemberRole;
 import dev.ltms.bridged.peer.PeerHandle;
 import dev.ltms.bridged.peer.PeerLauncher;
 import dev.ltms.bridged.peer.PeerUnreachableException;
 import dev.ltms.bridged.peer.SpawnRequest;
-import dev.ltms.bridged.placement.BackendQuarantine;
 import dev.ltms.bridged.placement.PlacementException;
 import dev.ltms.bridged.placement.PlacementPolicies;
 import org.junit.jupiter.api.Test;
@@ -24,12 +21,12 @@ import org.slf4j.LoggerFactory;

 import java.util.EnumSet;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicLong;
+import java.util.function.Function;

 import static org.junit.jupiter.api.Assertions.*;

@@ -43,7 +40,7 @@ class CompositePeerLauncherTest {

    private ClaudeCodeLauncher claudeAdapter(FakeHerdr herdr) {
        // 12-arg back-compat Worker ctor → kind defaults to claude-code.
-        BridgedConfig.Profile claude = new BridgedConfig.Profile("claude", "http://gx00.gw:8000", "coder",
+        BridgedConfig.Worker claude = new BridgedConfig.Worker("claude", "http://gx00.gw:8000", "coder",
                null, "BRIDGED_WORKER_TOKEN", List.of("claude"), "tab", "bridged-workers", "w #{n}",
                null, null, null);
        return new ClaudeCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
@@ -51,9 +48,9 @@ class CompositePeerLauncherTest {
    }

    private OpenCodeLauncher opencodeAdapter(FakeHerdr herdr) {
-        BridgedConfig.Profile gemini = new BridgedConfig.Profile("gemini", null, "google/gemini-2.5-pro",
+        BridgedConfig.Worker gemini = new BridgedConfig.Worker("gemini", null, "google/gemini-2.5-pro",
                null, "BRIDGED_WORKER_TOKEN", List.of("opencode"), "tab", "bridged-workers", "w #{n}",
-                null, null, null, "GITEA_ACCESS_TOKEN", null, BridgedConfig.Profile.KIND_OPENCODE);
+                null, null, null, "GITEA_ACCESS_TOKEN", null, BridgedConfig.Worker.KIND_OPENCODE);
        return new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
                Map.of("gemini", gemini), "gemini", _ -> "tok");
    }
@@ -73,7 +70,7 @@ class CompositePeerLauncherTest {
        private final Map<String, Integer> spawnCounts = new HashMap<>();

        StubLauncher(String prefix, FakeHerdr herdr,
-                     Map<String, BridgedConfig.Profile> profiles, String defaultProfile,
+                     Map<String, BridgedConfig.Worker> profiles, String defaultProfile,
                     Set<String> failProfiles) {
            super(prefix, new AgentControl(herdr), new WorkspaceControl(herdr),
                    profiles, defaultProfile, _ -> null, 0L, System::currentTimeMillis, () -> { });
@@ -81,7 +78,7 @@ class CompositePeerLauncherTest {
        }

        @Override
-        protected Launch buildLaunch(BridgedConfig.Profile cfg, LaunchSpec spec) {
+        protected Launch buildLaunch(BridgedConfig.Worker cfg) {
            return new Launch(Map.of(), List.of());
        }

@@ -97,8 +94,6 @@ class CompositePeerLauncherTest {
                @Override public String id() { return "pane-" + p; }
                @Override public String terminalId() { return "term-" + p; }
                @Override public String profile() { return p; }
-                @Override public String agentSessionId() { return null; }
-                @Override public CharterReceipt charterReceipt() { return null; }
            };
        }

@@ -119,35 +114,28 @@ class CompositePeerLauncherTest {
        }
    }

-    private static BridgedConfig.Profile stubWorker(String profile) {
-        return new BridgedConfig.Profile(profile, "http://gx00.gw:8000", "coder",
+    private static BridgedConfig.Worker stubWorker(String profile) {
+        return new BridgedConfig.Worker(profile, "http://gx00.gw:8000", "coder",
                null, "BRIDGED_WORKER_TOKEN", List.of("claude"), "tab", "bridged-workers",
                "w #{n}", null, null, null, null, null, null, null, null, null);
    }

-    private static BridgedConfig.Profile stubWorker(String profile, float weight, Integer maxLoad) {
-        return new BridgedConfig.Profile(profile, "http://gx00.gw:8000", "coder",
+    private static BridgedConfig.Worker stubWorker(String profile, float weight, Integer maxLoad) {
+        return new BridgedConfig.Worker(profile, "http://gx00.gw:8000", "coder",
                null, "BRIDGED_WORKER_TOKEN", List.of("claude"), "tab", "bridged-workers",
                "w #{n}", null, null, null, null, null, null, null,
                weight, maxLoad);
    }

-    private static BridgedConfig.Profile stubWorker(String profile, String credentialId) {
-        return new BridgedConfig.Profile(profile, "http://gx00.gw:8000", "coder",
-                null, "BRIDGED_WORKER_TOKEN", List.of("claude"), "tab", "bridged-workers",
-                "w #{n}", null, null, null, null, null, null, null, null, null,
-                null, null, credentialId);
-    }
-
    /**
     * An <em>order-preserving</em> profile map. Never {@code Map.of} here: its iteration order is
     * salted per JVM run, and the weighted policy breaks an exact-weight tie on candidate order —
     * so a {@code Map.of} would make "which profile is tried first" a coin flip per run and any
     * assertion about the first attempt intermittently false.
     */
-    private static Map<String, BridgedConfig.Profile> ordered(String first, BridgedConfig.Profile a,
-                                                             String second, BridgedConfig.Profile b) {
-        Map<String, BridgedConfig.Profile> m = new LinkedHashMap<>();
+    private static Map<String, BridgedConfig.Worker> ordered(String first, BridgedConfig.Worker a,
+                                                             String second, BridgedConfig.Worker b) {
+        Map<String, BridgedConfig.Worker> m = new LinkedHashMap<>();
        m.put(first, a);
        m.put(second, b);
        return m;
@@ -304,7 +292,7 @@ class CompositePeerLauncherTest {
    @Test
    void weightedPolicyGatesProfileAtMaxLoad() {
        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = ordered(
+        Map<String, BridgedConfig.Worker> profiles = ordered(
                "a", stubWorker("a", 1.0f, 1),
                "b", stubWorker("b", 1.0f, null));
        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of());
@@ -320,12 +308,12 @@ class CompositePeerLauncherTest {
    @Test
    void weightedPolicyDistributesAccordingToWeightRatio() {
        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = ordered(
+        Map<String, BridgedConfig.Worker> profiles = ordered(
                "a", stubWorker("a", 0.75f, null),
                "b", stubWorker("b", 0.25f, null));
        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of());
        CompositePeerLauncher composite = new CompositePeerLauncher(
-                List.of(adapter), "a", profiles, PlacementPolicies.weighted(), _ -> 0);
+                List.of(adapter), "a", profiles, PlacementPolicies.weighted(), name -> 0);

        int a = 0, b = 0;
        for (int i = 0; i < 40; i++) {
@@ -337,51 +325,15 @@ class CompositePeerLauncherTest {
        assertEquals(10, b);
    }

-    @Test
-    void weightedPolicySkipsWeightZeroProfileOnUnqualifiedSpawn() {
-        // CB-554: weight: 0 must exclude a profile from automatic placement, not coerce to 1.0.
-        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = ordered(
-                "a", stubWorker("a", 0.0f, null),
-                "b", stubWorker("b", 1.0f, null));
-        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of());
-        CompositePeerLauncher composite = new CompositePeerLauncher(
-                List.of(adapter), "a", profiles, PlacementPolicies.weighted(), _ -> 0);
-
-        for (int i = 0; i < 5; i++) {
-            PeerHandle h = composite.spawn(new SpawnRequest(null, null, null));
-            assertEquals("b", h.profile(), "profile a has weight 0, so every unqualified spawn must land on b");
-        }
-        assertEquals(0, adapter.spawnCount("a"), "a is never chosen automatically");
-    }
-
-    @Test
-    void explicitSpawnStillSucceedsOnWeightZeroProfile() {
-        // CB-554: weight: 0 excludes a profile from AUTOMATIC selection only — an explicit
-        // bridge_spawn{profile:"a"} must still work exactly as today (e.g. `opus` on the
-        // operator's own subscription, kept weight-0 so it is never picked automatically).
-        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = ordered(
-                "a", stubWorker("a", 0.0f, null),
-                "b", stubWorker("b", 1.0f, null));
-        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "b", Set.of());
-        CompositePeerLauncher composite = new CompositePeerLauncher(
-                List.of(adapter), "b", profiles, PlacementPolicies.weighted(), _ -> 0);
-
-        PeerHandle h = composite.spawn(new SpawnRequest("a", null, null));
-        assertEquals("a", h.profile(), "naming a weight-0 profile explicitly bypasses placement and still spawns it");
-        assertEquals(1, adapter.spawnCount("a"));
-    }
-
    @Test
    void failoverRetriesNextCandidateWhenProfileIsUnreachable() {
        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = ordered(
+        Map<String, BridgedConfig.Worker> profiles = ordered(
                "a", stubWorker("a"),
                "b", stubWorker("b"));
        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of("a"));
        CompositePeerLauncher composite = new CompositePeerLauncher(
-                List.of(adapter), "a", profiles, PlacementPolicies.weighted(), _ -> 0);
+                List.of(adapter), "a", profiles, PlacementPolicies.weighted(), name -> 0);

        PeerHandle h = composite.spawn(new SpawnRequest(null, null, null));
        assertEquals("b", h.profile(), "the spawn must fail over from unreachable a to b");
@@ -397,7 +349,7 @@ class CompositePeerLauncherTest {
    @Test
    void reversingDefinitionOrderReversesWhichProfileIsTriedFirst() {
        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = ordered(
+        Map<String, BridgedConfig.Worker> profiles = ordered(
                "b", stubWorker("b"),
                "a", stubWorker("a"));
        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of("b"));
@@ -412,12 +364,12 @@ class CompositePeerLauncherTest {
    @Test
    void failoverBoundedByCandidateCount() {
        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = ordered(
+        Map<String, BridgedConfig.Worker> profiles = ordered(
                "a", stubWorker("a"),
                "b", stubWorker("b"));
        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of("a", "b"));
        CompositePeerLauncher composite = new CompositePeerLauncher(
-                List.of(adapter), "a", profiles, PlacementPolicies.weighted(), _ -> 0);
+                List.of(adapter), "a", profiles, PlacementPolicies.weighted(), name -> 0);

        PeerUnreachableException e = assertThrows(PeerUnreachableException.class,
                () -> composite.spawn(new SpawnRequest(null, null, null)));
@@ -429,7 +381,7 @@ class CompositePeerLauncherTest {
    @Test
    void explicitSpawnAtMaxLoadThrowsPlacementExceptionNamingProfileLiveAndCap() {
        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = ordered(
+        Map<String, BridgedConfig.Worker> profiles = ordered(
                "a", stubWorker("a", 1.0f, 2),
                "b", stubWorker("b"));
        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of());
@@ -447,7 +399,7 @@ class CompositePeerLauncherTest {
    @Test
    void explicitSpawnUnderMaxLoadStillSucceeds() {
        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = ordered(
+        Map<String, BridgedConfig.Worker> profiles = ordered(
                "a", stubWorker("a", 1.0f, 2),
                "b", stubWorker("b"));
        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of());
@@ -462,265 +414,30 @@ class CompositePeerLauncherTest {
    @Test
    void explicitSpawnWithNullMaxLoadIsNeverCapped() {
        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = ordered(
+        Map<String, BridgedConfig.Worker> profiles = ordered(
                "a", stubWorker("a", 1.0f, null),
                "b", stubWorker("b"));
        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of());
        // A deliberately absurd live count: an unset maxLoad means unlimited, so it must never refuse.
        CompositePeerLauncher composite = new CompositePeerLauncher(
-                List.of(adapter), "a", profiles, PlacementPolicies.fixed(), _ -> 1000);
+                List.of(adapter), "a", profiles, PlacementPolicies.fixed(), name -> 1000);

        PeerHandle h = composite.spawn(new SpawnRequest("a", null, null));
        assertEquals("a", h.profile(), "a profile with no maxLoad is never capped, however many live workers");
    }

-    @Test
-    void explicitSpawnOnMaxLoadZeroProfileIsRefusedEvenWithZeroLiveWorkers() {
-        // CB-585: before the fix, maxLoad: 0 normalised to null (unlimited) in the compact
-        // constructor, so this exact case — naming a zero-cap profile explicitly, with nothing
-        // live on it yet — would have spawned instead of refusing. "at most zero members" must
-        // hold even when the profile is named directly, not only against automatic placement.
-        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = ordered(
-                "a", stubWorker("a", 1.0f, 0),
-                "b", stubWorker("b"));
-        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of());
-        CompositePeerLauncher composite = new CompositePeerLauncher(
-                List.of(adapter), "a", profiles, PlacementPolicies.fixed(), _ -> 0);
-
-        PlacementException e = assertThrows(PlacementException.class,
-                () -> composite.spawn(new SpawnRequest("a", null, null)));
-        assertTrue(e.getMessage().contains("'a'"), "message names the profile: " + e.getMessage());
-        assertTrue(e.getMessage().contains("0 cap"), "message names the zero cap: " + e.getMessage());
-        assertEquals(0, adapter.spawnCount("a"), "a maxLoad: 0 profile accepts no explicit spawn");
-    }
-
    @Test
    void emptyCandidateSetThrowsClearException() {
        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = ordered(
+        Map<String, BridgedConfig.Worker> profiles = ordered(
                "a", stubWorker("a", 1.0f, 1),
                "b", stubWorker("b", 1.0f, 1));
        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "a", Set.of());
        CompositePeerLauncher composite = new CompositePeerLauncher(
-                List.of(adapter), "a", profiles, PlacementPolicies.weighted(), _ -> 1);
+                List.of(adapter), "a", profiles, PlacementPolicies.weighted(), name -> 1);

        PlacementException e = assertThrows(PlacementException.class,
                () -> composite.spawn(new SpawnRequest(null, null, null)));
        assertTrue(e.getMessage().contains("maxLoad"), e.getMessage());
    }
-
-    // ── CB-557: an unqualified spawn is placed inside its role's pool ─────────────────────────
-
-    /** Three profiles in definition order — pools are carved out of this set. */
-    private static Map<String, BridgedConfig.Profile> threeProfiles() {
-        Map<String, BridgedConfig.Profile> m = new LinkedHashMap<>();
-        m.put("opus", stubWorker("opus", 1.0f, null));
-        m.put("sonnet", stubWorker("sonnet", 1.0f, null));
-        m.put("terra", stubWorker("terra", 1.0f, null));
-        return m;
-    }
-
-    private static Map<String, BridgedConfig.Slot> pool(String... names) {
-        Map<String, BridgedConfig.Slot> m = new LinkedHashMap<>();
-        for (String n : names) {
-            m.put(n, new BridgedConfig.Slot(n));
-        }
-        return m;
-    }
-
-    private static CompositePeerLauncher withPools(FakeHerdr herdr, BridgedConfig.Fleet fleet) {
-        Map<String, BridgedConfig.Profile> profiles = threeProfiles();
-        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "opus", Set.of());
-        return new CompositePeerLauncher(List.of(adapter), "opus", profiles,
-                PlacementPolicies.fixed(), _ -> 0, fleet);
-    }
-
-    /**
-     * The point of the pools: a role is placed only on a backend its pool names. Before CB-557 an
-     * unqualified spawn ranged over every configured profile, so a reviewer could land on the
-     * architect-only one.
-     */
-    @Test
-    void anUnqualifiedSpawnIsPlacedInsideItsRolePool() {
-        FakeHerdr herdr = new FakeHerdr();
-        CompositePeerLauncher composite = withPools(herdr, new BridgedConfig.Fleet(
-                Map.of(), pool("opus"), pool("terra"), pool("sonnet"), null));
-
-        assertEquals("opus", composite.spawn(
-                new SpawnRequest(null, null, null, null, null, MemberRole.ARCHITECT)).profile());
-        assertEquals("terra", composite.spawn(
-                new SpawnRequest(null, null, null, null, null, MemberRole.DEV)).profile());
-        assertEquals("sonnet", composite.spawn(
-                new SpawnRequest(null, null, null, null, null, MemberRole.REVIEWER)).profile());
-    }
-
-    /** Under `fixed`, the pool's first entry wins — not the global defaultProfile. */
-    @Test
-    void theRolePoolOutranksTheGlobalDefaultProfile() {
-        FakeHerdr herdr = new FakeHerdr();
-        CompositePeerLauncher composite = withPools(herdr, new BridgedConfig.Fleet(
-                Map.of(), Map.of(), pool("sonnet", "terra"), Map.of(), null));
-
-        assertEquals("sonnet", composite.spawn(
-                        new SpawnRequest(null, null, null, null, null, MemberRole.DEV)).profile(),
-                "the dev pool starts at sonnet, so the global default 'opus' must not win");
-    }
-
-    /**
-     * A role with no pool is unconstrained, not blocked. A config that declares pools for some roles
-     * and not others must keep spawning the rest.
-     */
-    @Test
-    void aRoleWithNoPoolFallsBackToEveryProfile() {
-        FakeHerdr herdr = new FakeHerdr();
-        CompositePeerLauncher composite = withPools(herdr, new BridgedConfig.Fleet(
-                Map.of(), pool("sonnet"), Map.of(), Map.of(), null));
-
-        assertEquals("opus", composite.spawn(
-                        new SpawnRequest(null, null, null, null, null, MemberRole.DEV)).profile(),
-                "no dev pool ⇒ all profiles are candidates, so `fixed` takes the first one");
-    }
-
-    /** No fleet at all is the pre-CB-557 wiring, and must behave exactly as it did. */
-    @Test
-    void noFleetConfiguredKeepsTheOldWholeProfileListBehaviour() {
-        FakeHerdr herdr = new FakeHerdr();
-        CompositePeerLauncher composite = withPools(herdr, null);
-
-        assertEquals("opus", composite.spawn(new SpawnRequest(null, null, null)).profile());
-    }
-
-    /**
-     * An explicit profile is the operator overriding and is NOT judged against the pool. It must
-     * stay that way: an unrolled `bridge_spawn{profile:"opus"}` carries no role, so it defaults to
-     * DEV, and enforcing the pool here would refuse a spawn the operator asked for by name.
-     */
-    @Test
-    void anExplicitProfileIsNotConfinedToTheRolePool() {
-        FakeHerdr herdr = new FakeHerdr();
-        CompositePeerLauncher composite = withPools(herdr, new BridgedConfig.Fleet(
-                Map.of(), pool("opus"), pool("terra"), Map.of(), null));
-
-        assertEquals("opus", composite.spawn(new SpawnRequest("opus", null, null)).profile(),
-                "naming opus explicitly must work even though the dev pool holds only terra");
-    }
-
-    /** Placement still respects maxLoad, but only across the pool — never by escaping it. */
-    @Test
-    void aFullPoolIsRefusedRatherThanSpilledOntoAnotherRolesProfile() {
-        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = new LinkedHashMap<>();
-        profiles.put("opus", stubWorker("opus", 1.0f, null));   // architect-only, uncapped
-        profiles.put("terra", stubWorker("terra", 1.0f, 1));    // the sole dev, capped at 1
-        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "opus", Set.of());
-        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "opus", profiles,
-                PlacementPolicies.weighted(), name -> "terra".equals(name) ? 1 : 0,
-                new BridgedConfig.Fleet(Map.of(), pool("opus"), pool("terra"), Map.of(), null));
-
-        PlacementException e = assertThrows(PlacementException.class, () -> composite.spawn(
-                new SpawnRequest(null, null, null, null, null, MemberRole.DEV)));
-        assertTrue(e.getMessage().contains("maxLoad"), e.getMessage());
-    }
-
-    // ── CB-578 stage B: a BACKEND_EXHAUSTED classification quarantines the credential ──────────
-
-    @Test
-    void explicitSpawnOntoAQuarantinedProfileIsRefusedNamingTheCredentialAndRemainingTime() {
-        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = ordered(
-                "sol", stubWorker("sol", "shared-openai"),
-                "terra", stubWorker("terra", "shared-openai"));
-        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "sol", Set.of());
-        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
-        quarantine.quarantine("shared-openai");
-        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "sol", profiles,
-                PlacementPolicies.fixed(), _ -> 0, null, quarantine);
-
-        PlacementException e = assertThrows(PlacementException.class,
-                () -> composite.spawn(new SpawnRequest("sol", null, null)));
-        assertTrue(e.getMessage().contains("sol"), "message names the profile: " + e.getMessage());
-        assertTrue(e.getMessage().contains("shared-openai"), "message names the credential: " + e.getMessage());
-        assertTrue(e.getMessage().contains("1800"), "message names roughly when it lifts: " + e.getMessage());
-        assertEquals(0, adapter.spawnCount("sol"), "the quarantined profile is never delegated to");
-    }
-
-    /**
-     * The part CB-578 stage B calls out as easy to get wrong: sol and terra are two different
-     * profiles sharing one OpenAI credential. Quarantining because of an exhaustion classified on
-     * ONE of them must lock out the other too, or the fleet just walks onto the same dead account
-     * under the sibling's name.
-     */
-    @Test
-    void twoProfilesSharingACredentialAreBothQuarantinedByOneExhaustionEvent() {
-        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = ordered(
-                "sol", stubWorker("sol", "shared-openai"),
-                "terra", stubWorker("terra", "shared-openai"));
-        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "sol", Set.of());
-        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
-        // Only "sol" was classified BACKEND_EXHAUSTED — but the two profiles share one credential.
-        quarantine.quarantine("shared-openai");
-        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "sol", profiles,
-                PlacementPolicies.fixed(), _ -> 0, null, quarantine);
-
-        assertThrows(PlacementException.class, () -> composite.spawn(new SpawnRequest("sol", null, null)),
-                "sol was the one classified exhausted");
-        assertThrows(PlacementException.class, () -> composite.spawn(new SpawnRequest("terra", null, null)),
-                "terra shares sol's credential, so it must be locked out too");
-        assertEquals(0, adapter.spawnCount("sol"));
-        assertEquals(0, adapter.spawnCount("terra"));
-    }
-
-    @Test
-    void placementSkipsAQuarantinedProfileAndRoutesToAnUnquarantinedOne() {
-        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = ordered(
-                "sol", stubWorker("sol", "shared-openai"),
-                "b", stubWorker("b"));
-        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "sol", Set.of());
-        BackendQuarantine quarantine = new BackendQuarantine(() -> 0L, TimeUnit.MINUTES.toNanos(30));
-        quarantine.quarantine("shared-openai");
-        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "sol", profiles,
-                PlacementPolicies.weighted(), _ -> 0, null, quarantine);
-
-        PeerHandle h = composite.spawn(new SpawnRequest(null, null, null));
-        assertEquals("b", h.profile(), "sol is quarantined, so an unqualified spawn must land on b");
-        assertEquals(0, adapter.spawnCount("sol"));
-    }
-
-    @Test
-    void aQuarantineLiftsOnTheInjectedClockAndTheProfileBecomesSpawnableAgain() {
-        FakeHerdr herdr = new FakeHerdr();
-        Map<String, BridgedConfig.Profile> profiles = ordered(
-                "sol", stubWorker("sol", "shared-openai"),
-                "b", stubWorker("b"));
-        StubLauncher adapter = new StubLauncher("claude", herdr, profiles, "sol", Set.of());
-        AtomicLong nowNanos = new AtomicLong(0L);
-        BackendQuarantine quarantine = new BackendQuarantine(nowNanos::get, TimeUnit.MINUTES.toNanos(30));
-        quarantine.quarantine("shared-openai");
-        CompositePeerLauncher composite = new CompositePeerLauncher(List.of(adapter), "sol", profiles,
-                PlacementPolicies.fixed(), _ -> 0, null, quarantine);
-
-        assertThrows(PlacementException.class, () -> composite.spawn(new SpawnRequest("sol", null, null)),
-                "still inside the cooldown");
-
-        nowNanos.set(TimeUnit.MINUTES.toNanos(31));
-
-        PeerHandle h = composite.spawn(new SpawnRequest("sol", null, null));
-        assertEquals("sol", h.profile(), "the cooldown expired on the injected clock — sol is spawnable again");
-        assertEquals(1, adapter.spawnCount("sol"));
-    }
-
-    @Test
-    void aFleetWithNoExhaustedPatternAnywhereBehavesExactlyAsBeforeQuarantineExisted() {
-        // BackendQuarantine.none() is the inert stand-in every constructor already defaults to when
-        // no quarantine is wired — the 2/5/6-arg constructors used throughout this file all exercise
-        // it. This test pins that an explicit .none() also never refuses a spawn, for any profile.
-        FakeHerdr herdr = new FakeHerdr();
-        PeerLauncher composite = composite(herdr);
-
-        assertDoesNotThrow(() -> composite.spawn(new SpawnRequest("claude", null, null)));
-        assertDoesNotThrow(() -> composite.spawn(new SpawnRequest("gemini", null, null)));
-    }
 }
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.member;
+package dev.ltms.bridged.worker;

 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
@@ -7,7 +7,6 @@ import dev.ltms.bridged.herdr.AgentControl;
 import dev.ltms.bridged.herdr.FakeHerdr;
 import dev.ltms.bridged.herdr.WorkspaceControl;
 import dev.ltms.bridged.peer.Capability;
-import dev.ltms.bridged.peer.CharterReceipt;
 import dev.ltms.bridged.peer.PeerHandle;
 import dev.ltms.bridged.peer.PeerUnreachableException;
 import dev.ltms.bridged.peer.SpawnRequest;
@@ -18,10 +17,6 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.List;
 import java.util.Map;
-import java.util.concurrent.ExecutorService;
-import java.util.concurrent.Executors;
-import java.util.concurrent.Future;
-import java.util.function.Supplier;

 import static org.junit.jupiter.api.Assertions.*;

@@ -32,26 +27,19 @@ import static org.junit.jupiter.api.Assertions.*;
 */
 class OpenCodeLauncherTest {

-    private static BridgedConfig.Profile opencodeCfg(String model, String mcpUrl, String gitTokenEnv) {
-        return new BridgedConfig.Profile("gemini", null, model, null, "BRIDGED_WORKER_TOKEN",
+    private static BridgedConfig.Worker opencodeCfg(String model, String mcpUrl, String gitTokenEnv) {
+        return new BridgedConfig.Worker("gemini", null, model, null, "BRIDGED_WORKER_TOKEN",
                List.of("opencode"), "tab", "bridged-workers", "opencode: {model} #{n}", mcpUrl,
-                null, null, gitTokenEnv, null, BridgedConfig.Profile.KIND_OPENCODE);
+                null, null, gitTokenEnv, null, BridgedConfig.Worker.KIND_OPENCODE);
    }

    /** Gate-disabled launcher whose per-spawn config dirs land under an inspectable temp root. */
-    private static OpenCodeLauncher service(FakeHerdr herdr, Path configRoot, BridgedConfig.Profile cfg) {
+    private OpenCodeLauncher service(FakeHerdr herdr, Path configRoot, BridgedConfig.Worker cfg) {
        return new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
                Map.of(cfg.profile(), cfg), cfg.profile(), k -> "GITEA_ACCESS_TOKEN".equals(k) ? "tok" : null,
                0, System::currentTimeMillis, () -> { }, configRoot, configRoot);
    }

-    private static OpenCodeLauncher service(FakeHerdr herdr, Path configRoot, BridgedConfig.Profile cfg,
-                                            Supplier<BridgedConfig.Fleet> fleet) {
-        return new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
-                Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null,
-                0, System::currentTimeMillis, () -> { }, configRoot, configRoot, fleet);
-    }
-
    @SuppressWarnings("unchecked")
    private static Map<String, Object> lastStart(FakeHerdr herdr) {
        return (Map<String, Object>) herdr.lastCall("agent.start").params();
@@ -74,10 +62,8 @@ class OpenCodeLauncherTest {
    @Test
    void writesRemoteMcpConfigAndCharterInstructionsWhenMcpUrlSet(@TempDir Path root) throws Exception {
        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Fleet fleet = new BridgedConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(),
-                Map.of("dev", "role rule"), null);
-        service(herdr, root, opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null),
-                () -> fleet).spawn();
+        service(herdr, root, opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null))
+                .spawn();

        Map<String, String> env = startEnv(herdr);
        assertNull(env.get("ANTHROPIC_BASE_URL"), "opencode carries no ANTHROPIC_* / subscription boundary");
@@ -88,23 +74,19 @@ class OpenCodeLauncherTest {
        // Assert on parsed structure, not substrings: the generated config is real JSON and its
        // whitespace is the formatter's business, not the contract's.
        JsonNode json = new ObjectMapper().readTree(Path.of(cfgPath).toFile());
-        assertTrue(json.path("compaction").path("auto").asBoolean(),
-                "spawned opencode peers explicitly enable automatic compaction");
        JsonNode bridge = json.path("mcp").path("bridge");
        assertEquals("remote", bridge.path("type").asText(), "bridge is mounted as a remote MCP server");
        assertEquals("http://127.0.0.1:8765/mcp", bridge.path("url").asText(),
                "the profile's bridge MCP url is present");
        assertTrue(bridge.path("enabled").asBoolean(), "the bridge server is enabled");
        assertTrue(json.path("instructions").isArray() && !json.path("instructions").isEmpty(),
-                "the member charter is mounted via instructions");
+                "the reply charter is mounted via instructions");

-        // The instructions entry is a real file path holding the composed member charter.
-        Path charter = Path.of(cfgPath).resolveSibling("member-charter.md");
+        // The instructions entry is a real file path holding the reply charter.
+        Path charter = Path.of(cfgPath).resolveSibling("reply-charter.md");
        assertTrue(Files.exists(charter), "the charter file the config references was written");
-        assertEquals("role rule\n\n" + HerdrPeerLauncher.REPLY_CHARTER, Files.readString(charter),
-                "the composed charter keeps the role rule first and the reply rule last");
-        assertEquals(charter.toAbsolutePath().toString(), json.path("instructions").get(0).asText(),
-                "instructions names the charter file by its absolute path");
+        assertTrue(Files.readString(charter).contains("bridge_reply"),
+                "the charter instructs the worker to answer via bridge_reply");
    }

    @Test
@@ -116,69 +98,6 @@ class OpenCodeLauncherTest {
                "no bridge MCP url → no config file and no OPENCODE_CONFIG");
    }

-    @Test
-    void roleCharterWithoutMcpOrCustomProviderStillWritesAConfig(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Fleet fleet = new BridgedConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(),
-                Map.of("dev", "role rule"), null);
-        Path configRoot = Files.createDirectory(root.resolve("configs"));
-        Path checkout = Files.createDirectory(root.resolve("checkout"));
-        service(herdr, configRoot, opencodeCfg("google/gemini-2.5-pro", null, null), () -> fleet).spawn();
-
-        String cfgPath = startEnv(herdr).get("OPENCODE_CONFIG");
-        assertNotNull(cfgPath, "a role charter needs a config even without MCP or custom provider");
-        JsonNode json = new ObjectMapper().readTree(Path.of(cfgPath).toFile());
-        Path charter = Path.of(json.path("instructions").get(0).asText());
-        assertEquals("role rule", Files.readString(charter), "the base-composed role charter is unchanged");
-        assertTrue(json.path("mcp").isMissingNode(), "a charter does not add an MCP mount");
-        assertTrue(charter.startsWith(configRoot), "the charter is written under the temp config root");
-        try (var files = Files.walk(checkout)) {
-            assertFalse(files.anyMatch(path -> path.getFileName().toString().equals("member-charter.md")),
-                    "the worker checkout receives no charter file");
-        }
-    }
-
-    @Test
-    void nullCharterWritesNoCharterFileOrInstructions(@TempDir Path root) throws Exception {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, pinnedCfg("local-vllm/model", "http://127.0.0.1:8000", null),
-                () -> new BridgedConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(), Map.of(), null)).spawn();
-
-        String config = startEnv(herdr).get("OPENCODE_CONFIG");
-        assertNotNull(config, "the custom provider still needs a config");
-        JsonNode json = new ObjectMapper().readTree(Path.of(config).toFile());
-        assertTrue(json.path("instructions").isMissingNode(), "a null charter adds no instructions entry");
-        try (var files = Files.walk(root)) {
-            assertFalse(files.anyMatch(path -> path.getFileName().toString().equals("member-charter.md")),
-                    "a null charter creates no charter file");
-        }
-    }
-
-    @Test
-    void concurrentSpawnsWriteSeparateCharterDirectories(@TempDir Path root) throws Exception {
-        BridgedConfig.Profile cfg = opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null);
-        ExecutorService executor = Executors.newFixedThreadPool(2);
-        try {
-            Future<String> first = executor.submit(() -> spawnConfigPath(root, cfg));
-            Future<String> second = executor.submit(() -> spawnConfigPath(root, cfg));
-
-            Path firstCharter = Path.of(first.get()).resolveSibling("member-charter.md");
-            Path secondCharter = Path.of(second.get()).resolveSibling("member-charter.md");
-            assertNotEquals(firstCharter.getParent(), secondCharter.getParent(),
-                    "each concurrent spawn owns a separate config directory");
-            assertTrue(Files.exists(firstCharter));
-            assertTrue(Files.exists(secondCharter));
-        } finally {
-            executor.shutdownNow();
-        }
-    }
-
-    private static String spawnConfigPath(Path root, BridgedConfig.Profile cfg) {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, cfg).spawn();
-        return startEnv(herdr).get("OPENCODE_CONFIG");
-    }
-
    @Test
    void passesTheModelAsDashMFlagAlongsideAutoApprove(@TempDir Path root) {
        FakeHerdr herdr = new FakeHerdr();
@@ -208,21 +127,6 @@ class OpenCodeLauncherTest {
                "a git-token profile gets the peer-neutral GITEA_TOKEN grant, same as Claude");
    }

-    /**
-     * CB-592: the shadow lives in {@link HerdrPeerLauncher#baseEnv}, shared by every adapter — this
-     * pins that the opencode path gets it too, not just Claude's. See the matching test in
-     * {@code ClaudeCodeLauncherTest} for the full rationale (gitea #77).
-     */
-    @Test
-    void everySpawnShadowsTheAdminGiteaAccessToken(@TempDir Path root) {
-        FakeHerdr herdr = new FakeHerdr();
-        service(herdr, root, opencodeCfg(null, null, null)).spawn();
-
-        String shadowed = startEnv(herdr).get("GITEA_ACCESS_TOKEN");
-        assertNotNull(shadowed, "GITEA_ACCESS_TOKEN must be explicitly overlaid, not left unmentioned");
-        assertFalse(shadowed.isBlank(), "a blank overlay value's override behaviour is unverified — must be non-blank");
-    }
-
    @Test
    void capabilitiesDeclareOrphanReapAndMcpAskAndConditionalSelfPr(@TempDir Path root) {
        FakeHerdr herdr = new FakeHerdr();
@@ -299,7 +203,7 @@ class OpenCodeLauncherTest {
    @Test
    void productionConstructorsWireThroughToTheBase() {
        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Profile cfg = opencodeCfg(null, null, null);
+        BridgedConfig.Worker cfg = opencodeCfg(null, null, null);
        // 5-arg (gate disabled) and 7-arg (gate enabled) production constructors both expose the profile.
        OpenCodeLauncher disabled = new OpenCodeLauncher(new AgentControl(herdr), new WorkspaceControl(herdr),
                Map.of(cfg.profile(), cfg), cfg.profile(), _ -> null);
@@ -338,33 +242,13 @@ class OpenCodeLauncherTest {
        assertFalse(herdr.called("agent.get"), "no polling when the gate is disabled");
    }

-    @Test
-    void handleCarriesTheRealCharterReceiptNotTheInterfaceDefault(@TempDir Path root) {
-        // The base's WorkerHandle computes a real CharterReceipt (CB-571), but the opencode adapter
-        // wraps it in SessionAwareHandle for lazy session discovery. Before this fix that decorator
-        // did not override charterReceipt(), so it silently inherited PeerHandle's `null` default
-        // and the real receipt sitting on its delegate was lost.
-        FakeHerdr herdr = new FakeHerdr();
-        BridgedConfig.Fleet fleet = new BridgedConfig.Fleet(Map.of(), Map.of(), Map.of(), Map.of(),
-                Map.of("dev", "role rule"), null);
-        PeerHandle handle = service(herdr, root,
-                opencodeCfg("google/gemini-2.5-pro", "http://127.0.0.1:8765/mcp", null), () -> fleet)
-                .spawn(new SpawnRequest(null, null, null));
-
-        assertNotNull(handle.charterReceipt(),
-                "an opencode spawn's charterReceipt() must not silently be null");
-        String composed = "role rule\n\n" + HerdrPeerLauncher.REPLY_CHARTER;
-        assertEquals(CharterReceipt.digestOf(composed), handle.charterReceipt().charterSha256(),
-                "the receipt on the wrapped handle must match the exact composed charter bytes");
-    }
-
    // --- CB-508: pinned OpenAI-compatible endpoint (e.g. a local vLLM) ---------------------------

    /** A profile with a baseUrl but no model provider prefix cannot be resolved — fail loudly. */
-    private static BridgedConfig.Profile pinnedCfg(String model, String baseUrl, String mcpUrl) {
-        return new BridgedConfig.Profile("local", baseUrl, model, null, "BRIDGED_WORKER_TOKEN",
+    private static BridgedConfig.Worker pinnedCfg(String model, String baseUrl, String mcpUrl) {
+        return new BridgedConfig.Worker("local", baseUrl, model, null, "BRIDGED_WORKER_TOKEN",
                List.of("opencode"), "tab", "bridged-workers", "opencode: {model} #{n}", mcpUrl,
-                null, null, null, null, BridgedConfig.Profile.KIND_OPENCODE);
+                null, null, null, null, BridgedConfig.Worker.KIND_OPENCODE);
    }

    @Test
@@ -1,4 +1,4 @@
-package dev.ltms.bridged.member;
+package dev.ltms.bridged.worker;

 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
@@ -16,9 +16,6 @@
          AuditLogTest, which attaches its own ListAppender and asserts on emitted records.
    -->

-    <!-- Keep the test logger behaviour aligned with the production cancellation filter. -->
-    <turboFilter class="dev.ltms.bridged.logging.McpCancelledNotificationFilter"/>
-
    <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
        <encoder>
            <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %msg%n</pattern>
@@ -37,4 +34,4 @@
        <appender-ref ref="STDOUT"/>
    </root>

-</configuration>
+</configuration>
--- a/Show More
+++ b/Show More