fleetd #711: re-key two pane-tab hazard reasons onto the unregistered-pane condition

Both refusals said a member landing in a lead's or collaborator's
labelled tab would be read back as that identity. CallerResolver
consults the spawned-member roster ahead of every tab map, so a live
registered member is never misread this way. State the real condition
instead: the hazard applies only while the pane is alive and carries
no entry in the spawned-member roster.

fleetd/src/main/java/dev/ltms/fleet/auth/CallerResolver.java

@@ -249,6 +249,17 @@ public final class CallerResolver {
         return leadTerminals.get();
     }
 
+    /**
+     * The currently-recognised architect slots, {@code terminal_id → slot name} (CB-548).
+     *
+     * <p>Read from the same supplier {@link #resolve} consults, so a slot that is <em>listed</em>
+     * here but would not <em>resolve</em> (or the reverse) cannot drift apart. Live for the same
+     * reason as {@link #leads()}.
+     */
+    public Map<String, String> members() {
+        return architectTerminals.get();
+    }
+
     /**
      * The currently-recognised collaborator tabs, {@code terminal_id → name}.
      *

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -2776,9 +2776,10 @@ public record FleetConfig(
         });
         if (!bad.isEmpty()) {
             throw new IllegalStateException("refusing to start: " + String.join("; ", bad)
-                    + ". Every member labelled that way would be read back as a lead or "
-                    + "collaborator and granted that identity's authority. Change one of the two "
-                    + "so member tabs cannot be confused with a lead's or collaborator's tab.");
+                    + ". A member labelled that way, while its pane carries no entry in the "
+                    + "spawned-member roster, is read back as a lead or collaborator and granted "
+                    + "that identity's authority. Change one of the two so member tabs cannot be "
+                    + "confused with a lead's or collaborator's tab.");
         }
 
         List<String> collisions = new ArrayList<>();
@@ -2877,7 +2878,8 @@ public record FleetConfig(
      * the focused tab rather than its own, so it can land inside a lead's or collaborator's own
      * labelled tab. {@link dev.ltms.fleet.herdr.LeadTabScanner} identifies a lead or collaborator
      * purely by that tab's label — it does not exclude the member space — so a member that ends up
-     * there would be read back as that lead or collaborator and granted that identity's authority.
+     * there, while its pane carries no entry in the spawned-member roster, is read back as that
+     * lead or collaborator and granted that identity's authority.
      *
      * <p>Only an entry with a non-blank {@code tab} is in scope: one with no {@code tab} feeds
      * nothing into {@link dev.ltms.fleet.herdr.LeadTabScanner}, so it creates no hazard here.
@@ -2908,8 +2910,9 @@ public record FleetConfig(
         }
         throw new IllegalStateException("refusing to start: profile(s) " + bad
                 + " use placement: pane while fleet.leaders or fleet.collaborators names a tab. A "
-                + "pane-placed member can land inside that labelled tab and be read back as the "
-                + "lead or collaborator, granted that identity's authority. Set placement: tab for "
+                + "pane-placed member can land inside that labelled tab, and while its pane "
+                + "carries no entry in the spawned-member roster, it is read back as the lead or "
+                + "collaborator and granted that identity's authority. Set placement: tab for "
                 + "each named profile, or remove the tab from every fleet.leaders and "
                 + "fleet.collaborators entry.");
     }

fleetd/src/test/java/dev/ltms/fleet/auth/CallerResolverTest.java

@@ -460,6 +460,7 @@ class CallerResolverTest {
         assertTrue(members.bind("architect:lead-designer", "term_a")); // the later lifecycle binds the slot
 
         assertEquals(Role.ARCHITECT, r.resolve("127.0.0.1", 42, null).role());
+        assertEquals("architect:lead-designer", r.members().get("term_a"));
     }
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java

@@ -850,7 +850,8 @@ class FleetConfigTest {
 
     /**
      * The hazard this guard closes: a pane-placed member lands inside the focused tab rather than
-     * its own, so it can land inside a lead's labelled tab and be read back as that lead.
+     * its own, so it can land inside a lead's labelled tab and, while its pane carries no entry in
+     * the spawned-member roster, be read back as that lead.
      */
     @Test
     void aPanePlacedProfileWithALeadTabRefusesToStart(@TempDir Path dir) throws Exception {
@@ -1087,8 +1088,9 @@ class FleetConfigTest {
     }
 
     /**
-     * fleetd #669: a member tabLabel that can render as a configured collaborator tab is the same
-     * hazard as the lead case above — a member labelled that way is read back as the collaborator.
+     * A member tabLabel that can render as a configured collaborator tab is the same hazard as the
+     * lead case above — while its pane carries no entry in the spawned-member roster, a member
+     * labelled that way is read back as the collaborator.
      */
     @Test
     void aProfileTabLabelOverrideMatchingACollaboratorTabRefusesToStart(@TempDir Path dir)