fleetd/src/main/java/dev/ltms/fleet/auth/MemberLifecycle.java

@@ -7,15 +7,43 @@ public interface MemberLifecycle {
 
     MemberLifecycle NONE = new MemberLifecycle() {
         @Override
-        public void acquired(MemberRole role, String profile, String terminal) {
+        public MemberRole acquired(MemberRole role, String profile, String terminal) {
+            return role; // no registry configured — nothing to bind against, so the request stands
         }
 
         @Override
         public void released(String terminal) {
         }
+
+        @Override
+        public void requireSlotFor(MemberRole role, String profile) {
+            // no registry configured — nothing to validate against, so nothing is refused
+        }
     };
 
-    void acquired(MemberRole role, String profile, String terminal);
+    /**
+     * Try to bind a newly spawned {@code terminal} into the role it was granted.
+     *
+     * @return the role this session actually holds: {@code role} unchanged for a role with no
+     *         live slot-binding semantics (dev, reviewer), or when the bind succeeded; a fallback
+     *         role — never {@code role} — when a slot-bound role (architect) could not be bound.
+     *         Callers must record THIS value on the session, never the requested {@code role}, so
+     *         a later roster read never reports a role the session does not hold (CB-619). In
+     *         normal operation this fallback should not happen once {@link #requireSlotFor} has
+     *         refused every unbindable spawn upfront — but a slot can still be lost between that
+     *         check and this call to a concurrent spawn racing for the same slot, so the honest
+     *         answer is still needed here too.
+     */
+    MemberRole acquired(MemberRole role, String profile, String terminal);
 
     void released(String terminal);
+
+    /**
+     * Refuse an acquire before anything spawns when {@code role} requires a live slot binding and
+     * no configured slot carries {@code profile} (CB-619 / fleetd #123). A no-op for a role with
+     * no slot-binding semantics.
+     *
+     * @throws IllegalArgumentException naming the role, the profile, and the pools that do carry it
+     */
+    void requireSlotFor(MemberRole role, String profile);
 }

fleetd/src/main/java/dev/ltms/fleet/auth/MemberRegistry.java

@@ -8,6 +8,7 @@ import org.slf4j.LoggerFactory;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.LinkedHashMap;
+import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 
@@ -206,19 +207,72 @@ public final class MemberRegistry implements MemberLifecycle {
      *
      * <p>The role check is lifecycle policy. {@link CallerResolver} repeats it when resolving a
      * binding, so a later lifecycle regression cannot turn a worker into an architect.
+     *
+     * <p>CB-619 / fleetd #123: the return value is the role this session actually holds, and the
+     * caller is required to record THAT — never the requested {@code role} — on the session. Before
+     * this fix the caller kept the requested role regardless of whether the bind below succeeded, so
+     * a demoted session's {@code GET /members} row still said {@code "architect"} while
+     * {@code fleet_whoami} (which reads the live binding, not the request) correctly said
+     * {@code "worker"} — three sources of truth that disagreed about one live member, silently.
      */
     @Override
-    public void acquired(MemberRole role, String profile, String terminal) {
+    public MemberRole acquired(MemberRole role, String profile, String terminal) {
         if (role != MemberRole.ARCHITECT || terminal == null || terminal.isBlank()) {
-            return;
+            return role;
         }
         // slotsFor preserves definition order, so duplicate-profile slots use the first free one.
         for (Entry entry : slotsFor(MemberRole.ARCHITECT).values()) {
             if (Objects.equals(profile, entry.profile()) && bind(entry.key(), terminal)) {
-                return;
+                return MemberRole.ARCHITECT;
             }
         }
-        log.info("member slot: no free architect slot for profile={}; session remains a worker", profile);
+        // fleetd #123: at least WARN — a role downgrade that the roster must now also reflect is
+        // not routine bookkeeping. requireSlotFor already refuses the config-gap case (no slot at
+        // all carries this profile) before a process ever spawns; reaching here means the config DID
+        // carry a matching slot but every one of them was already bound to a different terminal — a
+        // race this pre-spawn check cannot close on its own (see requireSlotFor's javadoc).
+        log.warn("member slot: no free architect slot for profile={} terminal={}; holding the session "
+                + "as {} instead of the architect it asked for — every configured slot for this "
+                + "profile is already bound to a different terminal", profile, terminal,
+                MemberRole.DEV.wireName());
+        return MemberRole.DEV;
+    }
+
+    /**
+     * CB-619 / fleetd #123: refuse an architect acquire before anything spawns when no configured
+     * slot carries {@code profile} — the config-gap case from the original defect report (a spawn
+     * asked for {@code role=architect, profile=sonnet}, and {@code fleet.architects} carried only
+     * {@code opus} and {@code sol}). A dev/reviewer acquire is always a no-op: those pools are
+     * placement candidates only (see {@code CompositePeerLauncher}), never a live identity binding,
+     * so there is nothing here to refuse — an explicit profile outside the pool for those roles is a
+     * documented operator override, not a defect.
+     *
+     * <p>This closes the config-gap case, not the live-capacity case: a profile that DOES carry a
+     * slot can still lose the race to a concurrent spawn between this check and the actual
+     * {@link #bind}, which is why {@link #acquired} must still answer honestly even after this
+     * check has passed.
+     */
+    @Override
+    public void requireSlotFor(MemberRole role, String profile) {
+        if (role != MemberRole.ARCHITECT) {
+            return;
+        }
+        boolean hasSlot = slotsFor(MemberRole.ARCHITECT).values().stream()
+                .anyMatch(e -> Objects.equals(profile, e.profile()));
+        if (hasSlot) {
+            return;
+        }
+        List<String> pools = slotsFor(MemberRole.ARCHITECT).values().stream()
+                .map(Entry::profile)
+                .distinct()
+                .toList();
+        throw new IllegalArgumentException(
+                "no " + role.wireName() + " slot for profile '" + profile + "' — an architect's "
+                        + "identity IS the slot it is bound to, so there is nothing to bind this "
+                        + "session's identity to. fleet." + role.configKey() + " carries profiles: "
+                        + (pools.isEmpty() ? "(none configured)" : String.join(", ", pools))
+                        + "; add profile '" + profile + "' there, or spawn " + role.wireName()
+                        + " on one of those profiles instead");
     }
 
     /** Unbind a released terminal using the compare-safe registry operation. */

fleetd/src/main/java/dev/ltms/fleet/session/SessionManager.java

@@ -183,6 +183,13 @@ public final class SessionManager implements TurnListener {
                                  String sessionName, String resumeSessionId) {
         MemberRole memberRole = (role == null) ? MemberRole.DEV : role;
         requireResumeCapability(profile, resumeSessionId);
+        // CB-619 / fleetd #123: an explicit profile bypasses placement (CompositePeerLauncher only
+        // constrains an UNQUALIFIED spawn to the role's pool), so it is the one path that can ask
+        // for a role with no slot to bind it to. Refuse before anything spawns. A blank profile is
+        // left to placement, which already restricts an unqualified spawn to the role's pool.
+        if (profile != null && !profile.isBlank()) {
+            memberLifecycle.requireSlotFor(memberRole, profile);
+        }
         if (wt == null) {
             // CB-557: the role must ride on the SpawnRequest, not stay a local. The launcher needs it
             // to pick the profile out of that role's pool and to label the tab; a role kept only on
@@ -198,11 +205,15 @@ public final class SessionManager implements TurnListener {
             String resolvedProfile = resolveProfile(handle, profile);
             String cwd = launcher.effectiveCwd(new SpawnRequest(resolvedProfile, requestedCwd, callerCwd));
             long now = nowNanos.getAsLong();
+            // CB-619: bind (or fail to bind) BEFORE the session is recorded, and store whatever role
+            // this call actually returns — never the requested memberRole — so the session's role,
+            // what GET /members and fleet_list report, is never a lie about what this terminal holds.
+            MemberRole actualRole = memberLifecycle.acquired(memberRole, resolvedProfile, handle.terminalId());
             MemberSession session = new MemberSession(
                     handle.id(),
                     handle.terminalId(),
                     resolvedProfile,
-                    memberRole,
+                    actualRole,
                     cwd,
                     ownerTerminal,
                     now,
@@ -215,7 +226,6 @@ public final class SessionManager implements TurnListener {
                     handle.agentSessionId());
             registry.put(handle.id(), session);
             handles.put(handle.id(), handle);
-            memberLifecycle.acquired(session.role(), session.profile(), session.terminalId());
             log.debug("acquired session id={} terminal={} profile={} owner={}",
                     handle.id(), handle.terminalId(), session.profile(), session.ownerTerminal());
             notifyAcquired(session.terminalId());
@@ -509,11 +519,14 @@ public final class SessionManager implements TurnListener {
         String resolvedProfile = resolveProfile(handle, profile);
         String cwd = launcher.effectiveCwd(new SpawnRequest(resolvedProfile, path, callerCwd));
         long now = nowNanos.getAsLong();
+        // CB-619: see the no-worktree path above — bind before recording, and store the returned
+        // actual role, so this session's role is never a lie about what it actually holds.
+        MemberRole actualRole = memberLifecycle.acquired(memberRole, resolvedProfile, handle.terminalId());
         MemberSession session = new MemberSession(
                 handle.id(),
                 handle.terminalId(),
                 resolvedProfile,
-                memberRole,
+                actualRole,
                 cwd,
                 ownerTerminal,
                 now,
@@ -526,7 +539,6 @@ public final class SessionManager implements TurnListener {
                 handle.agentSessionId());
         registry.put(handle.id(), session);
         handles.put(handle.id(), handle);
-        memberLifecycle.acquired(session.role(), session.profile(), session.terminalId());
         log.debug("acquired worktree session id={} terminal={} profile={} branch={} path={}",
                 handle.id(), handle.terminalId(), session.profile(), session.branch(), session.worktree());
         notifyAcquired(session.terminalId());

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpTest.java

@@ -1,10 +1,13 @@
 package dev.ltms.fleet.mcp;
 
+import dev.ltms.fleet.auth.CallerResolver;
+import dev.ltms.fleet.auth.MemberRegistry;
 import dev.ltms.fleet.auth.Principal;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.PaneLocator;
 import dev.ltms.fleet.herdr.WorkspaceControl;
 import dev.ltms.fleet.inject.Injector;
 import dev.ltms.fleet.msg.MessageService;
@@ -1024,6 +1027,87 @@ class FleetMcpTest {
         assertTrue(textOf(res).contains("architect, dev, reviewer"), textOf(res));
     }
 
+    // ── CB-619 / fleetd #123: a spawn asking for a role its profile has no slot for must be
+    //    refused, never silently demoted with the roster still lying about it ───────────────────
+
+    /** Two profiles on one launcher, so a role's pool can name one and exclude the other. */
+    private static ClaudeCodeLauncher architectCapableLauncher(FakeHerdr h) {
+        FleetConfig.Profile opus = new FleetConfig.Profile(
+                "opus", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN", null,
+                "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
+        FleetConfig.Profile sonnet = new FleetConfig.Profile(
+                "sonnet", "http://gx00.gw:8000", "coder", null, "FLEETD_WORKER_TOKEN", null,
+                "tab", "fleetd-workers", "worker: {profile} #{n}", null, null, null);
+        return new ClaudeCodeLauncher(new AgentControl(h), new WorkspaceControl(h),
+                new SubscriptionGuard(Set.of("gx00.gw")), Map.of("opus", opus, "sonnet", sonnet),
+                "sonnet", _ -> "tok");
+    }
+
+    /** {@code fleet.architects} carries only {@code opus} — {@code sonnet} has no matching slot. */
+    private static MemberRegistry architectRegistry() {
+        return new MemberRegistry(new FleetConfig.Fleet(Map.of(),
+                Map.of("opus", new FleetConfig.Slot("opus")), Map.of(), Map.of(), null));
+    }
+
+    /**
+     * The literal defect (fleetd #123): {@code role=architect, profile=sonnet}, where
+     * {@code fleet.architects} carries only {@code opus}. Drives the real path —
+     * {@link FleetMcp#spawn} calls {@link SessionManager#acquire}, which must refuse before ever
+     * reaching the real {@link ClaudeCodeLauncher} — never {@link MemberRegistry#bind} called
+     * directly, which would walk around the gate under test.
+     */
+    @Test
+    void spawnRefusesAnArchitectWithNoMatchingSlotAndNeverTouchesTheLauncher() {
+        FakeHerdr h = new FakeHerdr();
+        SessionManager sessions = new SessionManager(architectCapableLauncher(h));
+        sessions.setMemberLifecycle(architectRegistry());
+
+        McpSchema.CallToolResult res = FleetMcp.spawn(sessions, "sonnet", "architect",
+                null, null, null, null, null, null);
+
+        assertEquals(Boolean.TRUE, res.isError(), textOf(res));
+        String msg = textOf(res);
+        assertTrue(msg.contains("architect"), "names the role asked for: " + msg);
+        assertTrue(msg.contains("sonnet"), "names the profile: " + msg);
+        assertTrue(msg.contains("opus"), "names the pool that does carry the role: " + msg);
+        assertTrue(sessions.roster().isEmpty(), "a refused spawn must register no session");
+        assertTrue(h.calls.stream().noneMatch(c -> c.method().equals("agent.start")),
+                "a refused spawn must never reach the launcher — no process should ever start");
+    }
+
+    /**
+     * Positive control / parity check: when the profile DOES carry a slot, the spawn succeeds, and
+     * {@code GET /members} ({@link FleetMcp#listFleet}) and {@code fleet_whoami}
+     * ({@link FleetMcp#whoami}) — resolved through the SAME live {@link MemberRegistry} binding via
+     * a real {@link CallerResolver}, exactly as the daemon resolves a real MCP caller — must never
+     * disagree about this one live member's role.
+     */
+    @Test
+    void rosterAndWhoamiAgreeOnceTheArchitectSlotBinds() {
+        FakeHerdr h = new FakeHerdr();
+        // Pin the spawn onto the one pane FakeHerdr's canned pane.process_info maps to WORKER_PID,
+        // so a CallerResolver can resolve THIS session's own terminal, not a fixture double.
+        h.pinNextStarts(1, "term_a", "w2:p7");
+        SessionManager sessions = new SessionManager(architectCapableLauncher(h));
+        MemberRegistry members = architectRegistry();
+        sessions.setMemberLifecycle(members);
+
+        McpSchema.CallToolResult spawnRes = FleetMcp.spawn(sessions, "opus", "architect",
+                null, null, null, null, null, null);
+        assertNotEquals(Boolean.TRUE, spawnRes.isError(), textOf(spawnRes));
+        assertTrue(textOf(spawnRes).contains("\"role\":\"architect\""), textOf(spawnRes));
+
+        String roster = textOf(FleetMcp.listFleet(architectCapableLauncher(h), sessions, Map.of(), ""));
+        assertTrue(roster.contains("\"role\":\"architect\""), "GET /members: " + roster);
+
+        ConnectionIdentity identity = new ConnectionIdentity(new PaneLocator(h), _ -> FakeHerdr.WORKER_PID);
+        CallerResolver resolver = CallerResolver.withLeadsAndMembers(identity, false, null, Map::of, members);
+        Principal caller = resolver.resolve("127.0.0.1", 42, null);
+        assertTrue(caller.isArchitect(), "fleet_whoami's own resolver must agree the terminal is bound");
+        String whoami = textOf(FleetMcp.whoami(caller, sessions));
+        assertTrue(whoami.contains("\"role\":\"architect\""), "fleet_whoami: " + whoami);
+    }
+
     // ── CB-584: fleet_spawn accepts sessionName/resumeSessionId; roster shows agentSessionId ──
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/session/SessionManagerTest.java

@@ -4,6 +4,7 @@ import ch.qos.logback.classic.Level;
 import ch.qos.logback.classic.LoggerContext;
 import ch.qos.logback.classic.spi.ILoggingEvent;
 import ch.qos.logback.core.read.ListAppender;
+import dev.ltms.fleet.auth.MemberRegistry;
 import dev.ltms.fleet.config.FleetConfig;
 import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.AgentControl;
@@ -333,6 +334,57 @@ class SessionManagerTest {
         }
     }
 
+    /**
+     * CB-619 / fleetd #123: {@code requireSlotFor} closes the config-gap case (no slot at all
+     * carries the profile) before anything spawns, but a profile that DOES carry a slot can still
+     * lose the bind to a concurrent spawn racing for the same slot. This drives that residual case
+     * through the REAL path — {@link SessionManager#acquire} against the real {@link
+     * dev.ltms.fleet.member.ClaudeCodeLauncher} and {@link FakeHerdr} — never {@link
+     * dev.ltms.fleet.auth.MemberRegistry#bind} directly for the session under test (only the
+     * precondition uses it, to occupy the slot before the real spawn happens). The session that
+     * loses the race must be held as a plain {@code dev}, never left claiming {@code architect} in
+     * the roster, and the daemon log must say so at WARN.
+     */
+    @Test
+    void aSecondArchitectOnAnAlreadyBoundProfileIsHeldAsDevNotArchitectAndWarnsLoudly() {
+        LoggerContext ctx = (LoggerContext) LoggerFactory.getILoggerFactory();
+        ch.qos.logback.classic.Logger registryLog = (ch.qos.logback.classic.Logger)
+                LoggerFactory.getLogger(MemberRegistry.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.setContext(ctx);
+        appender.start();
+        registryLog.addAppender(appender);
+        registryLog.setLevel(Level.WARN);
+        try {
+            FakeHerdr herdr = new FakeHerdr();
+            SessionManager sessions = sessionManager(herdr);
+            MemberRegistry members = new MemberRegistry(
+                    new FleetConfig.Fleet(Map.of(), Map.of("opus", new FleetConfig.Slot("ltms-local")),
+                            Map.of(), Map.of(), null));
+            assertTrue(members.bind("architect:opus", "term_already_bound"),
+                    "precondition: occupy the sole architect slot before the real spawn under test");
+            sessions.setMemberLifecycle(members);
+
+            MemberSession session = sessions.acquire("ltms-local", MemberRole.ARCHITECT, null,
+                    "/caller", "term_primary", null);
+
+            assertEquals(MemberRole.DEV, session.role(),
+                    "the slot is taken, so this session must be held as a plain member, never a lie");
+            assertEquals("dev", SessionManager.rosterView(session, null).get("role"),
+                    "the roster must report what this session actually holds, not what it asked for");
+
+            String warn = appender.list.stream()
+                    .filter(e -> e.getLevel().equals(Level.WARN))
+                    .map(ILoggingEvent::getFormattedMessage)
+                    .findFirst()
+                    .orElse("no slot-exhaustion WARN logged");
+            assertTrue(warn.contains("ltms-local"), "the log names the profile: " + warn);
+            assertTrue(warn.contains(session.terminalId()), "the log names the terminal: " + warn);
+        } finally {
+            registryLog.detachAppender(appender);
+        }
+    }
+
     @Test
     void rosterReflectsAcquiredMinusReleased() {
         FakeHerdr herdr = new FakeHerdr();