@@ -515,5 +515,6 @@ supervisor listener at port 9443 without discovery or a proxy. Provision the
 operator TLS Secret and an ingress-client NetworkPolicy first. Follow
 `e2e/kubernetes/app-listener/README.md` for direct in-cluster verification,
 shared-member selection, and the HA follow-up checks. Keep the fixture disabled
-in default profiles. Shared headless app Services enumerate members and must not
-be treated as load-balanced routes for sandboxes with different owners.
+in default profiles. Shared supervisors expose app ports on their Pod IPs
+without a shared app Service. Select the member owning the sandbox; automatic
+owner selection belongs to the later discovery API.
@@ -216,7 +216,7 @@ This path uses application or trusted-edge authentication independently from
 gateway authentication. It validates Host against SNI, preserves public
 Host/Origin and application cookies, strips gateway/edge identity material, and
 retains service-specific bearer passthrough. It has no discovery API or public
-URL selection. A shared pool's headless Service enumerates member addresses;
-clients must select the member owning their sandbox rather than connect to an
-arbitrary member. HA takeover may preserve the workload generation; existing ingress streams
+URL selection. Shared supervisors expose the app listener on each member's Pod
+IP without a shared app Service. Clients must select the member owning their
+sandbox. HA takeover may preserve the workload generation; existing ingress streams
 are not migrated. Runtime ownership fencing must reject stale connectors.
@@ -174,28 +174,6 @@ spec:
               - key: ca.crt
                 path: ca.crt
         {{- end }}
-{{- if and (get $app "enabled") (get $appDeployment "create_service") }}
----
-# Enumerates supervisor member addresses. Select the current owner before
-# connecting; this is not a load-balanced app endpoint for arbitrary members.
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ $name }}-app
-  namespace: {{ .Release.Namespace }}
-  labels:
-    {{- include "openshell.labels" . | nindent 4 }}
-    app.kubernetes.io/component: supervisor-app
-spec:
-  clusterIP: None
-  selector:
-    {{- include "openshell.supervisorSelectorLabels" . | nindent 4 }}
-  ports:
-    - name: app
-      port: {{ $appPort }}
-      targetPort: app
-      protocol: TCP
-{{- end }}
 ---
 apiVersion: v1
 kind: Service
 
@@ -32,7 +32,7 @@ tests:
             name: app-tls
           any: true
         documentIndex: 0
-  - it: uses the common nondefault app port and a separate headless member Service
+  - it: enables the common nondefault app port without creating a shared app Service
     set:
       gatewayConfig:
         openshell.drivers.kubernetes:
@@ -46,7 +46,7 @@ tests:
           create_service: true
     asserts:
       - hasDocuments:
-          count: 5
+          count: 4
       - contains:
           path: spec.template.spec.containers[0].env
           content:
@@ -60,13 +60,13 @@ tests:
             secret:
               secretName: app-tls
         documentIndex: 0
-      - equal:
-          path: spec.clusterIP
-          value: None
+      - lengthEqual:
+          path: spec.ports
+          count: 1
         documentIndex: 1
       - equal:
           path: spec.ports[0].port
-          value: 9443
+          value: 5500
         documentIndex: 1
       - equal:
           path: spec.selector["app.kubernetes.io/name"]
 
@@ -1587,10 +1587,10 @@ On Kubernetes, provide a TLS Secret with `tls.crt` and `tls.key` matching
 clients to reach the app port through NetworkPolicy. The driver mounts the Secret
 only in supervisor containers. Restart supervisors after changing certificates.
 With `create_service = true`, dedicated supervisors get a sandbox-owned headless
-`os-app-<sandbox-id>` Service; shared supervisors get a separate
-`<supervisor-name>-app` headless Service. Shared endpoints enumerate members:
-select the supervisor owning the sandbox, rather than load-balancing requests
-across different owners.
+`os-app-<sandbox-id>` Service. This option applies only to dedicated supervisors.
+Shared supervisors expose the app listener directly on each member's Pod IP;
+no shared app Service is created. Select the supervisor owning the sandbox
+when routing application traffic.
 
 The Helm chart grants dedicated endpoint management the Service `patch` and
 `delete` permissions when `create_service` is set. If you supply RBAC separately,
 
@@ -20,10 +20,12 @@ this stage. Use these direct-listener hostnames instead:
 - `default--<sandbox>.services.example.com` for the unnamed service.
 - `default--<sandbox>--web.services.example.com` for the named service.
 
-Inspect supervisor Pods and the app Service's EndpointSlices. For dedicated
-supervisors, use `os-app-<sandbox-id>`. For shared supervisors, enumerate members
-through `<supervisor-name>-app` and select the Pod IP actually owning the sandbox.
-Do not select an arbitrary address when more than one member is present.
+Inspect supervisor Pods. Dedicated supervisors optionally expose
+`os-app-<sandbox-id>`; inspect that Service's EndpointSlices. Shared supervisors
+have no app Service: select the Pod IP actually owning the sandbox and use its
+configured app port. Do not select an arbitrary member when more than one is
+present. Check ownership through supervisor admission/release logs in this
+stage; automated owner selection belongs to the later discovery API.
 
 From a permitted client Pod, mount only the public app certificate/CA and run:
 
 
@@ -1358,9 +1358,9 @@ mount or app port. TLS material is mounted only in supervisors and reloads on
 supervisor restart.
 
 Inspect supervisor Pods, app Services, and EndpointSlices with `kubectl`. A
-dedicated endpoint is `os-app-<sandbox-id>`; a shared endpoint is
-`<supervisor-name>-app`. Headless shared endpoints enumerate members: select the
-current sandbox owner, not an arbitrary member IP. Preserve service SNI and Host
+dedicated endpoint is `os-app-<sandbox-id>`. Shared supervisors have no app
+Service: connect to the current sandbox owner's Pod IP and configured app port.
+Preserve service SNI and Host
 when using curl's `--connect-to`, and verify the application certificate. A
 port-forward bypasses Service and NetworkPolicy forwarding; also test from a
 permitted in-cluster client. Operators provide ingress network rules.