fleetd #672: pin AuthorizationMode.ENFORCED at FleetdAssembly.java:481

Adds FleetdAssemblyAuthorizationModeTest: drives FleetMcp#denyFor (via reflection, since it is package-private to dev.ltms.fleet.mcp) on the real FleetMcp FleetdAssembly#assembleAndStart builds, asserting an unauthorized worker is refused SPAWN and the primary is still allowed. Mutating line 481 to UNENFORCED turns this test red and no other test.

.claude/skills/redeploy-fleetd/SKILL.md

@@ -26,9 +26,15 @@ scripts/redeploy-fleetd.sh --no-build # restart the jar already on disk
 when you just built and nothing changed since. It gives up the protection in the next paragraph: no
 build runs, so a stale or missing jar is not caught early. The script still checks the file is there
 and dies with `no jar at … — run without --no-build` if it is not, but it cannot tell you the jar is
-old. A `mvn clean` in the tree deletes that jar while the daemon keeps running on it, and nothing
-degrades until the next restart. Run `--check` first: it prints the jar's hash and its modification
-time, so you can see for yourself whether the jar is missing or older than the code you mean to ship.
+old. Any build that writes `fleetd/target/fleetd.jar` while the daemon runs, including `mvn install`
+with or without `clean`, breaks that daemon's shutdown drain. The drain loads its classes lazily at
+shutdown from the jar file the JVM opened at boot. Deleting is not the only hazard; replacing the jar
+is enough. Nothing warns at the time. The damage appears at the next restart, where it looks like the
+restart's fault. Verify a merge by building in a throwaway git worktree. Let only
+`scripts/redeploy-fleetd.sh` touch the main clone's jar. Its stage-then-swap protects its own build,
+but it cannot undo a replacement that already happened. Run `--check` first: it prints the jar's hash
+and its modification time, so you can see for yourself whether the jar is missing or older than the
+code you mean to ship.
 
 It builds before it stops anything, so a failed build never leaves the fleet down; it waits for the
 old process to exit rather than assuming; it polls `/healthz`; and it anchors its log checks to a

CLAUDE.md

@@ -323,6 +323,12 @@ must obey belongs in the charter, not here.
   reference**, with the intent→tool table above as the short form. `McpContractDocTest` fails if
   that page names a `fleet_*` tool the server does not register. The flows are kept out of this
   file because this file loads into every session's context.
+- **Never build into the main clone while `fleetd` runs.** Any build that writes
+  `fleetd/target/fleetd.jar`, with or without `clean`, breaks the shutdown drain because its classes
+  load lazily from the jar file the JVM opened at boot. Nothing warns at the time. The damage appears
+  at the next restart, where it looks like the restart's fault. Verify merges in a throwaway git
+  worktree. Let only `scripts/redeploy-fleetd.sh` touch the main clone's jar. Its stage-then-swap
+  cannot undo a replacement that already happened.
 
 ### Redeploying the daemon — the lead may do this (primary only)
 

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -1075,7 +1075,33 @@ public final class Fleetd {
      */
     static FleetMcp.LeadConfigDirSource leadConfigDirSource(Supplier<Map<String, FleetConfig.Profile>> profiles,
             Map<String, FleetConfig.Leader> leaders) {
-        return new FleetMcp.LeadConfigDirSource(leadConfigDirLookup(profiles, leaders));
+        return new FleetMcp.LeadConfigDirSource(leadConfigDirLookup(profiles, leaders),
+                leadContextWindowLookup(profiles, leaders));
+    }
+
+    /**
+     * Per-lead-name factory for the effective auto-compact window {@link LeadContextGauge} scales
+     * its HIGH threshold against — the same {@code fleet.leaders.<name>.profile} link {@link
+     * #leadConfigDirLookup} already follows, one step further to that profile's own {@link
+     * FleetConfig.Profile#effectiveAutoCompactWindow()}. A lead entry that names no
+     * {@code profile:}, or whose named profile is not configured, or whose profile resolves no
+     * window at all, returns {@code null} — {@link LeadContextGauge} then falls back to its own
+     * fixed HIGH threshold.
+     */
+    static Function<String, Long> leadContextWindowLookup(Supplier<Map<String, FleetConfig.Profile>> profiles,
+            Map<String, FleetConfig.Leader> leaders) {
+        return leadName -> {
+            FleetConfig.Leader lead = leaders.get(leadName);
+            if (lead == null || lead.profile() == null || lead.profile().isBlank()) {
+                return null;
+            }
+            FleetConfig.Profile leadProfile = profiles.get().get(lead.profile());
+            if (leadProfile == null) {
+                return null;
+            }
+            Integer window = leadProfile.effectiveAutoCompactWindow();
+            return window == null ? null : window.longValue();
+        };
     }
 
     /**
@@ -1097,22 +1123,30 @@ public final class Fleetd {
      * @param liveLeadTerminals     terminal id → lead name for every CURRENTLY recognised lead
      * @param configDirForLeadName  lead name → {@code configDir}, normally {@link
      *                              #leadConfigDirLookup}'s return
+     * @param windowForLeadName     lead name → that lead's profile's effective auto-compact window,
+     *                              normally {@link #leadContextWindowLookup}'s return, and passed
+     *                              through to {@link LeadContextGauge#read} so the heartbeat's own
+     *                              HIGH reading scales with that lead's real window, or {@code null}
+     *                              when it cannot be resolved — either way {@link LeadContextGauge}
+     *                              falls back to its own fixed HIGH threshold
      */
     static Function<String, LeadContextGauge.Reading> leadContextLookup(LeadContextGauge gauge, AgentControl agents,
-            Supplier<Map<String, String>> liveLeadTerminals, Function<String, String> configDirForLeadName) {
+            Supplier<Map<String, String>> liveLeadTerminals, Function<String, String> configDirForLeadName,
+            Function<String, Long> windowForLeadName) {
         return terminal -> {
             String leadName = liveLeadTerminals.get().get(terminal);
             if (leadName == null) {
                 return LeadContextGauge.Reading.unknown();
             }
             String configDir = configDirForLeadName.apply(leadName);
+            Long effectiveWindow = windowForLeadName.apply(leadName);
             Agent live;
             try {
                 live = agents.get(terminal);
             } catch (RuntimeException e) {
                 return LeadContextGauge.Reading.unknown();
             }
-            return gauge.read(configDir, live.sessionId(), live.agentType());
+            return gauge.read(configDir, live.sessionId(), live.agentType(), effectiveWindow);
         };
     }
 
@@ -1124,9 +1158,10 @@ public final class Fleetd {
      * (see {@code FleetdLeadConfigDirSourceWiringTest}'s javadoc for the measured gap this shape closes).
      */
     static LeadHeartbeatLoop.LeadContextSource leadContextSource(LeadContextGauge gauge, AgentControl agents,
-            Supplier<Map<String, String>> liveLeadTerminals, Function<String, String> configDirForLeadName) {
+            Supplier<Map<String, String>> liveLeadTerminals, Function<String, String> configDirForLeadName,
+            Function<String, Long> windowForLeadName) {
         return new LeadHeartbeatLoop.LeadContextSource(
-                leadContextLookup(gauge, agents, liveLeadTerminals, configDirForLeadName));
+                leadContextLookup(gauge, agents, liveLeadTerminals, configDirForLeadName, windowForLeadName));
     }
 
     /**

fleetd/src/main/java/dev/ltms/fleet/FleetdAssembly.java

@@ -405,7 +405,8 @@ final class FleetdAssembly {
                     TimeUnit.SECONDS.toNanos(hb.idleAfterSeconds()), hb.backoffMs(), hb.quietNudgeCap(),
                     metrics,
                     Fleetd.leadContextSource(leadContextGauge, router.leadAgents(), leads,
-                            Fleetd.leadConfigDirLookup(() -> config.get().profiles(), leaders)),
+                            Fleetd.leadConfigDirLookup(() -> config.get().profiles(), leaders),
+                            Fleetd.leadContextWindowLookup(() -> config.get().profiles(), leaders)),
                     Boolean.TRUE.equals(hb.contextHighNudge()), requireOperatorConfirm);
             heartbeat.start();
         } else {

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -798,6 +798,25 @@ public record FleetConfig(
             return isSubscription() ? SUBSCRIPTION_CREDENTIAL_ID : profile;
         }
 
+        /**
+         * The auto-compaction window a launched Claude Code session actually runs on: {@code env:
+         * CLAUDE_CODE_AUTO_COMPACT_WINDOW} when it parses as an integer, since that environment
+         * variable wins over the {@code --autocompact} flag {@link #autoCompactWindow} produces (see
+         * {@code ClaudeCodeArguments}); {@link #autoCompactWindow} otherwise. {@code null} when
+         * neither resolves to a usable number.
+         */
+        public Integer effectiveAutoCompactWindow() {
+            String envValue = env.get(CLAUDE_CODE_AUTO_COMPACT_WINDOW_ENV);
+            if (envValue == null) {
+                return autoCompactWindow;
+            }
+            try {
+                return Integer.valueOf(envValue.trim());
+            } catch (NumberFormatException e) {
+                return autoCompactWindow;
+            }
+        }
+
         /** True when this profile's workers are granted a forge token to open their own PR (CB-302). */
         public boolean hasGitToken() {
             return gitTokenEnv != null && !gitTokenEnv.isBlank();
@@ -2184,6 +2203,12 @@ public record FleetConfig(
     static final int AUTO_COMPACT_WINDOW_MIN = 100_000;
     /** Highest {@code autoCompactWindow} Claude Code's {@code --autocompact <tokens>} flag accepts. */
     static final int AUTO_COMPACT_WINDOW_MAX = 1_000_000;
+    /**
+     * The {@code env:} key a launched Claude Code session reads for its auto-compaction window,
+     * ahead of the {@code --autocompact} launch flag {@code autoCompactWindow} produces (see
+     * {@link Profile#effectiveAutoCompactWindow()}).
+     */
+    static final String CLAUDE_CODE_AUTO_COMPACT_WINDOW_ENV = "CLAUDE_CODE_AUTO_COMPACT_WINDOW";
 
     /**
      * Reject a profile whose {@code autoCompactWindow:} is set but outside the token band Claude
@@ -2265,13 +2290,13 @@ public record FleetConfig(
             if (!(entry.getValue() instanceof Map<?, ?> profile)
                     || !(profile.get("autoCompactWindow") instanceof Number window)
                     || !(profile.get("env") instanceof Map<?, ?> env)
-                    || !env.containsKey("CLAUDE_CODE_AUTO_COMPACT_WINDOW")) {
+                    || !env.containsKey(CLAUDE_CODE_AUTO_COMPACT_WINDOW_ENV)) {
                 continue;
             }
             Object kind = profile.get("kind");
             boolean claudeCode = kind == null || String.valueOf(kind).isBlank()
                     || Profile.KIND_CLAUDE_CODE.equalsIgnoreCase(String.valueOf(kind));
-            Object envValue = env.get("CLAUDE_CODE_AUTO_COMPACT_WINDOW");
+            Object envValue = env.get(CLAUDE_CODE_AUTO_COMPACT_WINDOW_ENV);
             if (claudeCode && !String.valueOf(window).equals(String.valueOf(envValue))) {
                 String name = String.valueOf(entry.getKey());
                 names.add(name);
@@ -2663,9 +2688,10 @@ public record FleetConfig(
      * tab labels — every member gets one rendered into its tab. Choose a lead {@code tabPrefix} that
      * a member template matches and the daemon starts labelling its own members as leads, promoting
      * the entire fleet to {@link dev.ltms.fleet.auth.Role#PRIMARY} with no message and no diff.
-     * The member-space exclusion in {@link dev.ltms.fleet.herdr.LeadTabScanner} already blocks the
-     * realistic path, but defence that depends on one workspace label holding is not defence enough
-     * for a privilege boundary.
+     * {@link #validatePanePlacementAgainstLeadTabs()} is the check that stops a pane-placed member
+     * from landing inside a lead's tab in the first place; this check is a second, independent
+     * guard that catches the hazard even when every profile places members correctly, by refusing
+     * a label that a scan would still misread as a lead.
      *
      * <p>CB-557 shrank this check rather than removing it. The default template is
      * {@code "{role}: {profile} #{n}"} and {@code {role}} comes from a closed enum, so a
@@ -2712,6 +2738,45 @@ public record FleetConfig(
                 + "lead tabs cannot be confused.");
     }
 
+    /**
+     * Reject a profile that places its members by {@code "pane"} while any {@code fleet.leaders}
+     * entry names a {@code tab}. A pane-placed member lands inside the focused tab rather than its
+     * own, so it can land inside a lead's own labelled tab. {@link
+     * dev.ltms.fleet.herdr.LeadTabScanner} identifies a lead purely by that tab's label — it does
+     * not exclude the member space — so a member that ends up there would be read back as the lead
+     * and granted spawn/stop/send on the whole fleet.
+     *
+     * <p>Only a leader with a non-blank {@code tab} is in scope: one with no {@code tab} feeds
+     * nothing into {@link dev.ltms.fleet.herdr.LeadTabScanner}, so it creates no hazard here.
+     *
+     * @throws IllegalStateException when any {@code profiles:} entry is pane-placed while any
+     *                               {@code fleet.leaders} entry names a non-blank {@code tab}
+     */
+    public void validatePanePlacementAgainstLeadTabs() {
+        if (fleet == null || fleet.leaders().isEmpty()) {
+            return;
+        }
+        boolean anyLeaderHasTab = fleet.leaders().values().stream()
+                .anyMatch(leader -> leader != null && leader.tab() != null && !leader.tab().isBlank());
+        if (!anyLeaderHasTab) {
+            return;
+        }
+        List<String> bad = new ArrayList<>();
+        profiles().entrySet().stream()
+                .filter(e -> !e.getValue().tabPlacement())
+                .map(Map.Entry::getKey)
+                .sorted()
+                .forEach(bad::add);
+        if (bad.isEmpty()) {
+            return;
+        }
+        throw new IllegalStateException("refusing to start: profile(s) " + bad
+                + " use placement: pane while fleet.leaders names a tab. A pane-placed member can "
+                + "land inside a lead's labelled tab and be read back as the lead, granted "
+                + "spawn/stop/send on the whole fleet. Set placement: tab for each named profile, "
+                + "or remove the tab from every fleet.leaders entry.");
+    }
+
     /**
      * Reject a present {@code leadRollover:} block with no (or a blank) {@code handoverPath}
      * (fleetd #480). There is no sane non-null default for an operator-specific file path, unlike
@@ -2912,11 +2977,11 @@ public record FleetConfig(
      * Runs every validator this class declares — found by reflection, not by name.
      *
      * <p>fleetd ticket "central allow-list of usable models", follow-up: mutation testing found
-     * that although each of the six validators above was well pinned on its own, nothing proved
+     * that although each validator above was well pinned on its own, nothing proved
      * either real caller ({@code Fleetd.main} and {@link ConfigRef#reload()}) still
-     * invoked it — deleting a call site left the full suite green. The fix is not a seventh test
-     * per caller; a hand-maintained list of six names here would have the exact same defect its
-     * own javadoc would warn against: the seventh validator someone adds next month has no reason
+     * invoked it — deleting a call site left the full suite green. The fix is not one more test
+     * per caller; a hand-maintained list of names here would have the exact same defect its
+     * own javadoc would warn against: the next validator someone adds has no reason
      * to be added to it. So this method does not name any validator. It sweeps {@link
      * #getClass()}'s own public, no-argument, {@code void} methods whose name starts with {@code
      * "validate"} (excluding itself) and invokes every one it finds, via {@link
@@ -2925,7 +2990,7 @@ public record FleetConfig(
      * which it silently never runs.
      *
      * <p>{@code Fleetd.main} and {@link ConfigRef#reload()} each call this one method instead of
-     * the six individually — see the comments at those two call sites for why
+     * each validator individually — see the comments at those two call sites for why
      * each must run it.
      *
      * <p>Methods run in a fixed (alphabetical) order, so a config with more than one violation
@@ -2942,9 +3007,9 @@ public record FleetConfig(
     /**
      * The reflective sweep behind {@link #validateAll()}, kept as its own method — taking any
      * {@code target}, not just {@code this} — so a test can prove the MECHANISM is generic (it
-     * would sweep a seventh {@code validateXxx()} method added to any class, not just something
-     * special-cased to today's six on {@link FleetConfig}) without needing to add a real, unwanted
-     * seventh validator to this class just to exercise that claim. See {@code
+     * would sweep any new {@code validateXxx()} method added to any class, not just something
+     * special-cased to the set {@link FleetConfig} declares today) without needing to add a real,
+     * unwanted extra validator to this class just to exercise that claim. See {@code
      * FleetConfigValidateAllTest} for that proof.
      *
      * @param target an object whose public, no-argument, {@code void} methods named {@code

fleetd/src/main/java/dev/ltms/fleet/herdr/LeadTabScanner.java

@@ -37,8 +37,11 @@ import java.util.function.Supplier;
  * <p><strong>Direction of trust.</strong> The label names the lead; it never <em>grants</em>
  * anything a pane could take for itself. Three properties keep that honest:
  * <ol>
- *   <li>Worker spaces are excluded wholesale ({@code excludedWorkspaceLabels}), so a worker cannot
- *       become a lead by being placed — as a split, say — inside a matching tab.</li>
+ *   <li>{@code excludedWorkspaceLabels} can filter a workspace out of the scan, but this class does
+ *       not by itself stop a worker from landing inside a matching tab — a caller may pass an empty
+ *       set, and the daemon does. The guard against that is {@code
+ *       FleetConfig.validatePanePlacementAgainstLeadTabs}: it refuses, at startup, any profile that
+ *       places members by pane while a lead names a tab.</li>
  *   <li>A worker cannot rename a tab: {@code tab.rename} is reachable only through
  *       {@link WorkspaceControl}, which no {@code fleet_*} tool exposes. The label is writable by
  *       the human at the terminal and by nobody the bridge is defending against.</li>

fleetd/src/main/java/dev/ltms/fleet/lead/LeadContextGauge.java

@@ -68,8 +68,10 @@ import java.util.function.LongSupplier;
  * (never the whole 52 MB a long-lived transcript reaches on the host this was measured on), and
  * {@link #DEFAULT_CACHE_TTL_MILLIS} bounds how often that bounded read actually happens — a burst
  * of {@code fleet_list} calls inside one TTL window reads the file once. One instance's cache is
- * keyed by {@code (configDir, sessionId)}, so it is safe to share across every lead a single
- * {@code fleet_list} call reports on.
+ * keyed by {@code (configDir, sessionId, highThreshold)}, so it is safe to share across every lead
+ * a single {@code fleet_list} call reports on, and a call that resolves a different effective
+ * window for the same lead never reads back a state computed against the other window's
+ * threshold.
  */
 public final class LeadContextGauge {
 
@@ -97,14 +99,19 @@ public final class LeadContextGauge {
     static final long DEFAULT_CACHE_TTL_MILLIS = 5_000;
 
     /**
-     * Live tokens at or above this count report {@link State#HIGH}. On the host this was measured
-     * on, auto-compaction actually fires around 267,000–270,000 tokens, but the point of a HIGH
-     * state is to warn before that happens, not at it — 200,000 is the standard Claude context
-     * window size and a sensible built-in default: no config key is required to pick it, and a
-     * lead crossing it is already deep enough into its window that a compaction is foreseeable.
+     * Fallback HIGH threshold used when a caller resolves no effective auto-compact window for the
+     * lead being read (see {@link #read(String, String, String, Long)}) — the built-in default so
+     * no config key is required to get a warning at all.
      */
     static final long HIGH_THRESHOLD_TOKENS = 200_000;
 
+    /**
+     * The fraction of a resolved effective auto-compact window that HIGH warns at, so the warning
+     * margin scales with the window instead of only ever meaning something against the fixed
+     * {@link #HIGH_THRESHOLD_TOKENS} fallback.
+     */
+    static final double HIGH_THRESHOLD_FRACTION = 2.0 / 3.0;
+
     /** The only peer kind this reader understands ({@code Agent.agentType()}'s wire value). */
     private static final String CLAUDE_AGENT_TYPE = "claude";
 
@@ -165,8 +172,13 @@ public final class LeadContextGauge {
      *                  {@code "claude"} (including {@code null}, meaning undetected) reports
      *                  {@link State#UNKNOWN} — this reader only understands Claude Code's own
      *                  transcript format
+     * @param effectiveWindowTokens the caller's resolved effective auto-compact window for this
+     *                              lead's own profile, or {@code null} when it cannot be resolved.
+     *                              HIGH fires at {@link #HIGH_THRESHOLD_FRACTION} of this value;
+     *                              {@code null} (or a non-positive value) falls back to the fixed
+     *                              {@link #HIGH_THRESHOLD_TOKENS}
      */
-    public Reading read(String configDir, String sessionId, String agentType) {
+    public Reading read(String configDir, String sessionId, String agentType, Long effectiveWindowTokens) {
         if (sessionId == null || sessionId.isBlank()) {
             return Reading.unknown();
         }
@@ -176,18 +188,27 @@ public final class LeadContextGauge {
         String base = (configDir == null || configDir.isBlank())
                 ? System.getProperty("user.home") + "/.claude"
                 : configDir;
-        String cacheKey = base + '\u0000' + sessionId;
+        long highThreshold = highThreshold(effectiveWindowTokens);
+        String cacheKey = base + '\u0000' + sessionId + '\u0000' + highThreshold;
         long now = clock.getAsLong();
         CacheEntry cached = cache.get(cacheKey);
         if (cached != null && now - cached.readAtMillis() < ttlMillis) {
             return cached.reading();
         }
-        Reading fresh = readUncached(base, sessionId);
+        Reading fresh = readUncached(base, sessionId, highThreshold);
         cache.put(cacheKey, new CacheEntry(fresh, now));
         return fresh;
     }
 
-    private Reading readUncached(String base, String sessionId) {
+    /** {@link #HIGH_THRESHOLD_FRACTION} of {@code effectiveWindowTokens}, or the fixed fallback. */
+    private static long highThreshold(Long effectiveWindowTokens) {
+        if (effectiveWindowTokens == null || effectiveWindowTokens <= 0) {
+            return HIGH_THRESHOLD_TOKENS;
+        }
+        return (long) (effectiveWindowTokens * HIGH_THRESHOLD_FRACTION);
+    }
+
+    private Reading readUncached(String base, String sessionId, long highThreshold) {
         diskReads.incrementAndGet();
         Path file = findTranscript(base, sessionId);
         if (file == null) {
@@ -199,7 +220,7 @@ public final class LeadContextGauge {
         } catch (IOException e) {
             return Reading.unknown();
         }
-        return parse(tail);
+        return parse(tail, highThreshold);
     }
 
     /**
@@ -258,7 +279,7 @@ public final class LeadContextGauge {
      * read raced — see the "torn final line" section of the class javadoc) is skipped, not fatal.
      * Only when none of the remaining lines parse does this report {@link State#UNKNOWN}.
      */
-    private Reading parse(TailRead tail) {
+    private Reading parse(TailRead tail, long highThreshold) {
         String text = new String(tail.bytes(), StandardCharsets.UTF_8);
         List<String> lines = new ArrayList<>(List.of(text.split("\n", -1)));
         if (!lines.isEmpty() && lines.get(lines.size() - 1).isEmpty()) {
@@ -299,7 +320,7 @@ public final class LeadContextGauge {
         if (tokens == null) {
             return new Reading(State.UNKNOWN, null, compactions);
         }
-        State state = tokens >= HIGH_THRESHOLD_TOKENS ? State.HIGH : State.OK;
+        State state = tokens >= highThreshold ? State.HIGH : State.OK;
         return new Reading(state, tokens, compactions);
     }
 

fleetd/src/main/java/dev/ltms/fleet/lead/LeadLauncher.java

@@ -201,8 +201,8 @@ public final class LeadLauncher {
     /**
      * How many live leads exist per configured name, and which of that name's labelled tabs are
      * <em>not</em> live: a running agent in a tab labelled with that lead's exact {@code tab}
-     * (CB-579). Member workspaces are excluded, exactly as the scanner excludes them: a member must
-     * not be counted as a lead because it happens to sit in a matching tab.
+     * (CB-579). A member sitting in the same shared workspace is not counted as a lead because its
+     * tab carries a different label, not because any workspace is excluded from this count.
      *
      * <p>There used to be a second path here — a running agent on the terminal a
      * {@code fleet.leaders.<name>.terminal} pin named, for a lead opened and pinned by hand. That

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -284,10 +284,15 @@ public final class FleetMcp {
      *                      no profile, or that profile sets no {@code configDir} override — either
      *                      way {@link LeadContextGauge} then falls back to its own built-in default,
      *                      exactly as before this ticket
+     * @param windowFor    lead name → that lead's profile's effective auto-compact window (see
+     *                      {@code dev.ltms.fleet.config.FleetConfig.Profile
+     *                      #effectiveAutoCompactWindow()}), or {@code null} when it cannot be
+     *                      resolved — either way {@link LeadContextGauge} falls back to its own
+     *                      fixed HIGH threshold
      */
-    public record LeadConfigDirSource(Function<String, String> configDirFor) {
-        /** Inert source — every lead reads {@link LeadContextGauge}'s built-in default {@code configDir}. */
-        public static LeadConfigDirSource none() { return new LeadConfigDirSource(_ -> null); }
+    public record LeadConfigDirSource(Function<String, String> configDirFor, Function<String, Long> windowFor) {
+        /** Inert source — every lead reads {@link LeadContextGauge}'s built-in defaults. */
+        public static LeadConfigDirSource none() { return new LeadConfigDirSource(_ -> null, _ -> null); }
     }
 
     /**
@@ -2153,7 +2158,8 @@ public final class FleetMcp {
             m.put("self", true);
         }
         String configDir = leadConfigDirs.configDirFor().apply(name);
-        m.put("context", contextView(contextGauge, live, configDir));
+        Long effectiveWindow = leadConfigDirs.windowFor().apply(name);
+        m.put("context", contextView(contextGauge, live, configDir, effectiveWindow));
         return m;
     }
 
@@ -2163,12 +2169,15 @@ public final class FleetMcp {
      * {@code fleet.leaders.<name>.profile} → that profile's own {@code configDir:} — or {@code null}
      * when the lead's entry names no profile, or that profile sets no override, in which case
      * {@link LeadContextGauge#read} falls back to its own built-in default
-     * ({@code <user.home>/.claude}).
+     * ({@code <user.home>/.claude}). {@code effectiveWindowTokens} is the same lead's resolved
+     * auto-compact window, or {@code null} when it cannot be resolved, in which case the gauge
+     * falls back to its own fixed HIGH threshold instead.
      */
-    private static Map<String, Object> contextView(LeadContextGauge contextGauge, Agent live, String configDir) {
+    private static Map<String, Object> contextView(LeadContextGauge contextGauge, Agent live, String configDir,
+                                                     Long effectiveWindowTokens) {
         String sessionId = live == null ? null : live.sessionId();
         String agentType = live == null ? null : live.agentType();
-        LeadContextGauge.Reading reading = contextGauge.read(configDir, sessionId, agentType);
+        LeadContextGauge.Reading reading = contextGauge.read(configDir, sessionId, agentType, effectiveWindowTokens);
         Map<String, Object> c = new LinkedHashMap<>();
         c.put("state", reading.state().name().toLowerCase());
         if (reading.tokens() != null) {

fleetd/src/main/java/dev/ltms/fleet/msg/LeadHeartbeatLoop.java

@@ -461,9 +461,9 @@ public final class LeadHeartbeatLoop {
                     .append(reading.compactions()).append(' ').append(compactionWord).append(" so far.");
         } else {
             // A HIGH reading always carries a non-null token count today: LeadContextGauge only
-            // reaches HIGH by comparing a number against HIGH_THRESHOLD_TOKENS. That invariant
-            // lives in another class and nothing asserts it, so this branch does not rely on it —
-            // it drops the token clause rather than printing "null tokens".
+            // reaches HIGH by comparing a number against a threshold. That invariant lives in
+            // another class and nothing asserts it, so this branch does not rely on it — it drops
+            // the token clause rather than printing "null tokens".
             sb.append(" (").append(reading.compactions()).append(' ').append(compactionWord)
                     .append(" so far).");
         }

fleetd/src/test/java/dev/ltms/fleet/FleetdAssemblyAuthorizationModeTest.java

@@ -0,0 +1,185 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.auth.Authz;
+import dev.ltms.fleet.auth.Principal;
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.mcp.FleetMcp;
+import dev.ltms.fleet.msg.ReplyInbox;
+import io.javalin.Javalin;
+import io.modelcontextprotocol.spec.McpSchema;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.lang.reflect.Method;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #672 — pins the {@link FleetMcp.AuthorizationMode} that {@link FleetdAssembly}'s
+ * production boot path passes to {@link FleetMcp} at {@code FleetdAssembly.java:481}
+ * ({@code AuthorizationMode.ENFORCED}).
+ *
+ * <p>{@code FleetMcpAuthzTest} already exercises {@code FleetMcp#denyFor} against the CB-505
+ * table, but it constructs its own {@link FleetMcp} and chooses its own {@code AuthorizationMode}
+ * — it tests the seam, not the producer. This test instead reaches the exact {@link FleetMcp}
+ * {@link FleetdAssembly#assembleAndStart} builds (via {@code FleetdRuntime#mcp()}, the same
+ * accessor {@code FleetdAssemblyConnectionIdentityTest} uses for {@code identity()}) and asserts
+ * the consequence rather than reading the enum back: an unauthorized caller must actually be
+ * refused through it, and the primary must still be allowed, so the test cannot pass with the
+ * gate wired backwards.
+ *
+ * <p>{@code FleetMcp#denyFor} is package-private to {@code dev.ltms.fleet.mcp}; this test lives in
+ * {@code dev.ltms.fleet}, where {@link FleetdAssembly} and {@code FleetdRuntime#mcp()} live, so it
+ * cannot call {@code denyFor} directly. Reflection bridges that package boundary the same way
+ * {@code getDeclaredField} does in {@link FleetdAssemblyLeadTabScannerExclusionTest} — the
+ * assertion itself still exercises the real policy decision ({@code denyFor} calling
+ * {@code Authz.permits}), not a field read.
+ */
+class FleetdAssemblyAuthorizationModeTest {
+
+    private static final class TestResourcePorts implements ResourcePorts {
+        final FakeHerdr herdr = new FakeHerdr();
+        Runnable shutdownHook;
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of();
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> new ReplyInbox() {
+                @Override public void own(String target) { }
+                @Override public void release(String target) { }
+                @Override public void publish(String target, String msgId, String content) { }
+                @Override public List<InboxMessage> peek(String target) { return List.of(); }
+                @Override public boolean ack(String target, String msgId) { return false; }
+            };
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> {
+                throw new UnsupportedOperationException(
+                        "leadMailboxOpener must not be called — no coordinator: block is configured");
+            };
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+            shutdownHook = hook;
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+            // Do not bind a real port in this assembly test — see FleetdAssemblyLeadTabScannerExclusionTest.
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            return () -> {
+                throw new UnsupportedOperationException("FakeHerdr is healthy; no poll wait is expected");
+            };
+        }
+    }
+
+    private TestResourcePorts ports;
+
+    @AfterEach
+    void tearDown() {
+        if (ports != null && ports.shutdownHook != null) {
+            ports.shutdownHook.run();
+        }
+    }
+
+    private static FleetConfig writeConfig(Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                idleSleepGuard:
+                  enabled: false
+                health:
+                  enabled: false
+                broker:
+                  uri: "amqp://fake-test-broker/vh"
+                """);
+        return FleetConfig.load(file);
+    }
+
+    private FleetMcp assemble(Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir);
+        ports = new TestResourcePorts();
+        FleetdRuntime runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg,
+                new ConfigRef(dir.resolve("fleetd.yaml"), cfg), new SubscriptionGuard(cfg.guard().hostSet())), ports);
+        return runtime.mcp();
+    }
+
+    /**
+     * Invokes the real production {@code FleetMcp#denyFor} by reflection. The method is
+     * package-private to {@code dev.ltms.fleet.mcp}; this is the only seam available to this test
+     * without a full HTTP/servlet round trip (see this class's javadoc). No {@code catch} here can
+     * turn a missing method into a pass — a {@code NoSuchMethodException} propagates out of the
+     * test and fails it loudly if {@code denyFor} is ever renamed or removed.
+     */
+    private static McpSchema.CallToolResult denyFor(FleetMcp mcp, Principal caller, Authz.Action action,
+                                                      String target) throws Exception {
+        Method m = FleetMcp.class.getDeclaredMethod("denyFor", Principal.class, Authz.Action.class, String.class);
+        m.setAccessible(true);
+        return (McpSchema.CallToolResult) m.invoke(mcp, caller, action, target);
+    }
+
+    @Test
+    void productionBootPathRefusesAnUnauthorizedCallerThroughTheAssembledFleetMcp(@TempDir Path dir)
+            throws Exception {
+        FleetMcp mcp = assemble(dir);
+
+        McpSchema.CallToolResult deniedForWorker = denyFor(mcp, Principal.worker("term_a", 200),
+                Authz.Action.SPAWN, "term_a");
+        assertNotNull(deniedForWorker,
+                "FleetdAssembly.java:481 must pass AuthorizationMode.ENFORCED to FleetMcp — a worker "
+                        + "must not be able to fleet_spawn through the assembled production object");
+        assertTrue(deniedForWorker.isError(), "a refusal is returned as an MCP tool error");
+
+        McpSchema.CallToolResult allowedForPrimary = denyFor(mcp, Principal.primary(100),
+                Authz.Action.SPAWN, "term_a");
+        assertNull(allowedForPrimary,
+                "control: the primary must still be allowed to fleet_spawn — otherwise the worker "
+                        + "refusal above would pass even with the gate wired backwards");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdAssemblyFleetAppTest.java

@@ -58,20 +58,31 @@ import static org.junit.jupiter.api.Assertions.assertEquals;
  * {@code HttpClient} — no accessor needed for this half.
  *
  * <p><strong>{@code GET /sessions} could not be driven the same way</strong>, so this class does
- * not pin the merge half of the deleted test's javadoc. {@code /sessions} requires
- * {@code Authz.Action.READ}, which — through the REAL assembly's real {@code
- * CallerResolver}/{@code ConnectionIdentity} (built with a hardcoded {@code
- * new LsofPeerPidLookup()}) — needs {@code Caller.resolved()}, i.e. a real positive pid from
- * {@code lsof}. {@code LsofPeerPidLookup} excludes its own pid (see its javadoc), and a JUnit
- * test's HTTP client and the daemon under test share one JVM pid, so the resolved pid is always
- * {@code -1} and every such request is refused as {@code ANONYMOUS} (fleetd #317's fail-closed
- * rule) before the route handler — and its {@code memberHerdr} merge — is ever reached. Verified
- * directly: driving {@code GET /sessions} here returns {@code 401 unauthenticated}, not the
- * merged body. {@code FleetAppTwoDaemonTest} avoids this because it builds {@code FleetApp} with
- * {@code callers: null}, which is not what the real assembly passes. The {@code /healthz} pin
- * below is what this class relies on for CB-185's {@code FleetApp} half; {@code
- * FleetAppTwoDaemonTest} remains the full behavioural proof that {@code FleetApp} itself merges
- * {@code /sessions} correctly once handed two clients.
+ * not pin the merge half of the deleted test's javadoc. This class configures no {@code auth:}
+ * block, so it runs under the default {@code loopback-trust} mode ({@code FleetConfig}). Under
+ * that mode, {@code /sessions} requires {@code Authz.Action.READ}, which — through the REAL
+ * assembly's real {@code CallerResolver}/{@code ConnectionIdentity} (built with a hardcoded
+ * {@code new LsofPeerPidLookup()}) — needs {@code Caller.resolved()}, i.e. a real positive pid
+ * from {@code lsof}. {@code LsofPeerPidLookup} excludes its own pid (see its javadoc), and a
+ * JUnit test's HTTP client and the daemon under test share one JVM pid, so the resolved pid is
+ * always {@code -1} and every such request is refused as {@code ANONYMOUS} (fleetd #317's
+ * fail-closed rule) before the route handler — and its {@code memberHerdr} merge — is ever
+ * reached. Verified directly: driving {@code GET /sessions} here returns {@code 401
+ * unauthenticated}, not the merged body. {@code FleetAppTwoDaemonTest} avoids this because it
+ * builds {@code FleetApp} with {@code callers: null}, which is not what the real assembly
+ * passes. The {@code /healthz} pin below is what this class relies on for CB-185's {@code
+ * FleetApp} half; {@code FleetAppTwoDaemonTest} remains the full behavioural proof that
+ * {@code FleetApp} itself merges {@code /sessions} correctly once handed two clients.
+ *
+ * <p><strong>This refusal is {@code loopback-trust}-specific, not a property of {@code
+ * CallerResolver} in general.</strong> Under {@code auth.mode: token}, {@code
+ * CallerResolver#resolve} returns before ever consulting {@code Caller.resolved()} or {@code
+ * Caller.scanComplete()}: a request carrying a valid bearer token in its {@code Authorization}
+ * header resolves to {@code Role#PRIMARY} with no pid lookup at all, so the same-JVM-pid
+ * exclusion above never comes into play. {@code FleetdQuarantineOutageDualWindowAssemblyTest}
+ * and {@code FleetdListReportingSourcesAssemblyTest} both drive {@code Authz.Action.READ} this
+ * way, over a real {@code McpSyncClient}/{@code HttpClient} against a real {@code
+ * FleetdAssembly#assembleAndStart}, and both get the real response rather than a refusal.
  *
  * <p><strong>fleetd #629 follow-up.</strong> The fix below (see {@link TwoHerdrResourcePorts})
  * makes {@link #healthzGoesRedWhenTheLeadDaemonIsDownEvenThoughTheMemberIsUp}'s fake {@code

fleetd/src/test/java/dev/ltms/fleet/FleetdAssemblyLeadTabScannerExclusionTest.java

@@ -0,0 +1,201 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.herdr.LeadTabScanner;
+import dev.ltms.fleet.msg.LeadChannelHandle;
+import dev.ltms.fleet.msg.LeadCoordLoop;
+import dev.ltms.fleet.msg.LeadMessage;
+import dev.ltms.fleet.msg.ReplyInbox;
+import io.javalin.Javalin;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.lang.reflect.Field;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.function.LongSupplier;
+import java.util.function.Supplier;
+
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #670 — pins the {@code excludedWorkspaceLabels} argument {@link FleetdAssembly}'s
+ * production boot path passes to {@link LeadTabScanner} at {@code FleetdAssembly.java:265}
+ * ({@code Set.of()}).
+ *
+ * <p>{@code LeadTabScannerTest} already covers this constructor parameter, but it builds its own
+ * {@link LeadTabScanner} with its own set, so it tests the seam and proves nothing about the
+ * producer. This test instead reaches the exact object {@link FleetdAssembly#assembleAndStart}
+ * builds: a {@code fleet.leaders:} block makes the assembly construct a real
+ * {@link LeadTabScanner} for its local {@code leads} supplier, and a {@code coordinator:} block
+ * makes it hand that same supplier instance to {@link LeadCoordLoop} (fleetd #637), which stores
+ * it as a field. Reflection recovers it from there, and then from the scanner itself, so the
+ * assertion is against the real production argument rather than a copy built for this test.
+ */
+class FleetdAssemblyLeadTabScannerExclusionTest {
+
+    private static final class FakeLeadChannel implements LeadChannelHandle {
+        @Override
+        public void publish(String toCoordId, LeadMessage message) {
+        }
+
+        @Override
+        public List<LeadMessage> peek() {
+            return List.of();
+        }
+
+        @Override
+        public void ack(String msgId) {
+        }
+
+        @Override
+        public String selfCoordId() {
+            return "test-lead";
+        }
+
+        @Override
+        public boolean heldDurable() {
+            return true;
+        }
+
+        @Override
+        public MailboxState inspect(String coordId) {
+            return MailboxState.unknown(coordId);
+        }
+
+        @Override
+        public void close() {
+        }
+    }
+
+    private static final class TestResourcePorts implements ResourcePorts {
+        final FakeHerdr herdr = new FakeHerdr();
+        Runnable shutdownHook;
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of();
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> new ReplyInbox() {
+                @Override public void own(String target) { }
+                @Override public void release(String target) { }
+                @Override public void publish(String target, String msgId, String content) { }
+                @Override public List<InboxMessage> peek(String target) { return List.of(); }
+                @Override public boolean ack(String target, String msgId) { return false; }
+            };
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> new FakeLeadChannel();
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+            shutdownHook = hook;
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+            // Do not bind a real port in this assembly test.
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            return () -> {
+                throw new UnsupportedOperationException("FakeHerdr is healthy; no poll wait is expected");
+            };
+        }
+    }
+
+    private static FleetConfig writeConfig(Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                idleSleepGuard:
+                  enabled: false
+                coordinator:
+                  uri: "amqp://fake-lead-broker/vh"
+                  selfId: "test-lead"
+                fleet:
+                  leaders:
+                    primary:
+                      tab: "lead: primary"
+                      profile: sonnet
+                profiles:
+                  sonnet:
+                    subscription: true
+                    argv: ["ccs", "sonnet"]
+                """);
+        return FleetConfig.load(file);
+    }
+
+    @Test
+    void productionBootPathPassesNoExcludedWorkspaceLabels(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir);
+        TestResourcePorts ports = new TestResourcePorts();
+        FleetdRuntime runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg,
+                new ConfigRef(dir.resolve("fleetd.yaml"), cfg), new SubscriptionGuard(cfg.guard().hostSet())), ports);
+        try {
+            LeadCoordLoop coordLoop = runtime.leadCoordLoop();
+            assertNotNull(coordLoop, "control: a configured coordinator: block must build LeadCoordLoop");
+
+            Field leadsField = LeadCoordLoop.class.getDeclaredField("leads");
+            leadsField.setAccessible(true);
+            @SuppressWarnings("unchecked")
+            Supplier<Map<String, String>> leads = (Supplier<Map<String, String>>) leadsField.get(coordLoop);
+
+            assertInstanceOf(LeadTabScanner.class, leads,
+                    "control: a non-empty fleet.leaders: block must make FleetdAssembly build a real "
+                            + "LeadTabScanner for its `leads` supplier, not the Map::of fallback — "
+                            + "otherwise this test would pass for the wrong reason");
+
+            Field excludedField = LeadTabScanner.class.getDeclaredField("excludedWorkspaceLabels");
+            excludedField.setAccessible(true);
+            Set<?> excluded = (Set<?>) excludedField.get(leads);
+
+            assertTrue(excluded.isEmpty(),
+                    "FleetdAssembly.java:265 must pass an empty excludedWorkspaceLabels to "
+                            + "LeadTabScanner — scanning member tabs would demote the lead to a worker");
+        } finally {
+            assertNotNull(ports.shutdownHook, "control: assembly must capture its shutdown hook");
+            ports.shutdownHook.run();
+        }
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdConfigRefWiringTest.java

@@ -24,8 +24,8 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
  * {@code ConfigRefTest} and {@code FleetdConfigRefCharterToolSurfaceWiringTest} case — because
  * neither of those tests constructs its {@code ConfigRef} through {@code main}; both build their own
  * instance directly, wired with the check by hand. That silent regression is exactly the shape
- * {@link FleetdBackendQuarantineWiringTest}, {@link FleetdLeadSeatWiringTest} and {@link
- * FleetdCompletionResolverWiringTest} already guard against for their own constructor arguments —
+ * {@link FleetdBackendQuarantineAssemblyTest}, {@link FleetdLeadSeatAssemblyTest} and {@link
+ * FleetdCompletionResolverAssemblyTest} already guard against for their own constructor arguments —
  * this class is the same class of gap for fleetd #474's {@code extraValidation} argument, following
  * their approach.
  *

fleetd/src/test/java/dev/ltms/fleet/FleetdHerdrControlConstructionTest.java

@@ -2,16 +2,67 @@ package dev.ltms.fleet;
 
 import java.nio.file.Files;
 import java.nio.file.Path;
+import org.junit.jupiter.api.DisplayName;
 import org.junit.jupiter.api.Test;
 
 import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
+/**
+ * {@code AgentControl} caches {@code paneByTerminal}, so {@code HerdrRouter} must be its only
+ * production factory — a second instance means a second cache; the same reasoning applies to
+ * {@code WorkspaceControl}. {@code HerdrRouter}'s constructor is the one place both are built.
+ *
+ * <p><b>This test checks source text, not runtime behaviour.</b> It never constructs a {@code
+ * HerdrRouter} and never runs {@code FleetdAssembly.assembleAndStart} — a green result proves only
+ * that neither watched file's text contains {@code new AgentControl(} or {@code new
+ * WorkspaceControl(}. It does not prove the instances {@code HerdrRouter} does build are the ones
+ * actually wired through the rest of the daemon, and it does not cover a bypass written into a
+ * production file other than the two this test reads.
+ */
 class FleetdHerdrControlConstructionTest {
+
+    private static String source(String relativePath) throws Exception {
+        return Files.readString(Path.of(relativePath));
+    }
+
     @Test
+    @DisplayName("[SOURCE TEXT] Fleetd.java never constructs AgentControl or WorkspaceControl directly")
     void fleetdDelegatesStatefulControlsToTheRouter() throws Exception {
-        // AgentControl caches paneByTerminal, so the router must be its only production factory.
-        String source = Files.readString(Path.of("src/main/java/dev/ltms/fleet/Fleetd.java"));
-        assertFalse(source.contains("new AgentControl("));
-        assertFalse(source.contains("new WorkspaceControl("));
+        String source = source("src/main/java/dev/ltms/fleet/Fleetd.java");
+
+        // A broken read (wrong working directory, wrong path, a file that came back empty) would
+        // make the assertFalse checks below pass vacuously — a "clean" negative check that actually
+        // checked nothing. Guard against that first, with an anchor that has nothing to do with
+        // this mutation, so a bad read fails loudly here instead of silently proving nothing below.
+        assertTrue(source.contains("public final class Fleetd"),
+                "the read of Fleetd.java did not come back containing its own class declaration — "
+                        + "the assertFalse checks below would pass vacuously on a broken read; fix the "
+                        + "read before trusting this test.");
+
+        assertFalse(source.contains("new AgentControl("),
+                "Fleetd.java must not construct AgentControl directly — HerdrRouter is its only "
+                        + "production factory");
+        assertFalse(source.contains("new WorkspaceControl("),
+                "Fleetd.java must not construct WorkspaceControl directly — HerdrRouter is its only "
+                        + "production factory");
+    }
+
+    @Test
+    @DisplayName("[SOURCE TEXT] FleetdAssembly.java never constructs AgentControl or WorkspaceControl directly")
+    void fleetdAssemblyDelegatesStatefulControlsToTheRouter() throws Exception {
+        String source = source("src/main/java/dev/ltms/fleet/FleetdAssembly.java");
+
+        assertTrue(source.contains("final class FleetdAssembly"),
+                "the read of FleetdAssembly.java did not come back containing its own class "
+                        + "declaration — the assertFalse checks below would pass vacuously on a broken "
+                        + "read; fix the read before trusting this test.");
+
+        assertFalse(source.contains("new AgentControl("),
+                "FleetdAssembly.java must not construct AgentControl directly — HerdrRouter is its "
+                        + "only production factory");
+        assertFalse(source.contains("new WorkspaceControl("),
+                "FleetdAssembly.java must not construct WorkspaceControl directly — HerdrRouter is "
+                        + "its only production factory");
     }
 }

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadConfigDirSourceWindowWiringTest.java

@@ -0,0 +1,63 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.mcp.FleetMcp;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+/**
+ * Pins {@link Fleetd#leadConfigDirSource}'s own wiring of the window lookup into the returned
+ * {@link FleetMcp.LeadConfigDirSource}, not only the detached {@link Fleetd#leadContextWindowLookup}
+ * factory it delegates to. Calls the producer directly, with real {@link FleetConfig.Profile}/
+ * {@link FleetConfig.Leader} fixtures, and asserts on {@code windowFor()} — the companion of
+ * {@link FleetdLeadConfigDirSourceWiringTest}, which pins the same factory's {@code configDirFor()}.
+ */
+class FleetdLeadConfigDirSourceWindowWiringTest {
+
+    private static FleetConfig.Profile profileWithWindow(String name, Integer autoCompactWindow) {
+        return new FleetConfig.Profile(name, null, "claude-sonnet-5", null, null, null,
+                "tab", "fleet", "w #{n}", null, null, null, null, null, null, null,
+                null, null, true, null, null, null, null, null, autoCompactWindow, null);
+    }
+
+    private static FleetConfig.Leader leadOnProfile(String profile) {
+        return new FleetConfig.Leader(profile, "lead: primary", 1, "lead:", 10, "claude", "claude-sonnet-5");
+    }
+
+    @Test
+    @DisplayName("the returned source resolves the lead's REAL configured effective window, not a hardcoded null")
+    void resolvesTheRealConfiguredWindow() {
+        Map<String, FleetConfig.Profile> profiles = Map.of("opus", profileWithWindow("opus", 250_000));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("opus"));
+
+        FleetMcp.LeadConfigDirSource source = Fleetd.leadConfigDirSource(() -> profiles, leaders);
+
+        assertEquals(250_000L, source.windowFor().apply("primary"),
+                "windowFor must delegate to the real leadContextWindowLookup, not a stub that always "
+                        + "returns null");
+    }
+
+    @Test
+    @DisplayName("a lead on a profile with no window configured still resolves to null, not a crash")
+    void leadWithNoWindowConfiguredResolvesToNull() {
+        Map<String, FleetConfig.Profile> profiles = Map.of("opus", profileWithWindow("opus", null));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("opus"));
+
+        FleetMcp.LeadConfigDirSource source = Fleetd.leadConfigDirSource(() -> profiles, leaders);
+
+        assertNull(source.windowFor().apply("primary"));
+    }
+
+    @Test
+    @DisplayName("an unrecognised lead name resolves to null, not a thrown exception")
+    void unrecognisedLeadNameResolvesToNull() {
+        FleetMcp.LeadConfigDirSource source = Fleetd.leadConfigDirSource(Map::of, Map.of());
+
+        assertNull(source.windowFor().apply("ghost-lead"));
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadContextLookupTest.java

@@ -99,7 +99,7 @@ class FleetdLeadContextLookupTest {
     @DisplayName("an unrecognised terminal resolves to UNKNOWN, not a thrown exception")
     void unrecognisedTerminalResolvesToUnknown() {
         Function<String, LeadContextGauge.Reading> lookup = Fleetd.leadContextLookup(
-                new LeadContextGauge(), throwingAgentControl(), Map::of, name -> null);
+                new LeadContextGauge(), throwingAgentControl(), Map::of, name -> null, name -> null);
 
         LeadContextGauge.Reading reading = assertDoesNotThrow(() -> lookup.apply("ghost-terminal"));
 
@@ -112,7 +112,7 @@ class FleetdLeadContextLookupTest {
     void agentsGetThrowingDegradesToUnknown() {
         Map<String, String> liveLeadTerminals = Map.of(LEAD_TERMINAL, LEAD_NAME);
         Function<String, LeadContextGauge.Reading> lookup = Fleetd.leadContextLookup(
-                new LeadContextGauge(), throwingAgentControl(), () -> liveLeadTerminals, name -> null);
+                new LeadContextGauge(), throwingAgentControl(), () -> liveLeadTerminals, name -> null, name -> null);
 
         LeadContextGauge.Reading reading = assertDoesNotThrow(() -> lookup.apply(LEAD_TERMINAL));
 
@@ -128,7 +128,7 @@ class FleetdLeadContextLookupTest {
         AgentControl agents = agentControlStub(SESSION_ID, "claude", "idle");
         Function<String, LeadContextGauge.Reading> lookup = Fleetd.leadContextLookup(
                 new LeadContextGauge(), agents, () -> liveLeadTerminals,
-                name -> LEAD_NAME.equals(name) ? tmp.toString() : null);
+                name -> LEAD_NAME.equals(name) ? tmp.toString() : null, name -> null);
 
         LeadContextGauge.Reading reading = lookup.apply(LEAD_TERMINAL);
 
@@ -146,7 +146,7 @@ class FleetdLeadContextLookupTest {
         AgentControl agents = agentControlStub(SESSION_ID, "opencode", "idle");
         Function<String, LeadContextGauge.Reading> lookup = Fleetd.leadContextLookup(
                 new LeadContextGauge(), agents, () -> liveLeadTerminals,
-                name -> LEAD_NAME.equals(name) ? tmp.toString() : null);
+                name -> LEAD_NAME.equals(name) ? tmp.toString() : null, name -> null);
 
         LeadContextGauge.Reading reading = lookup.apply(LEAD_TERMINAL);
 

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadContextSourceWindowAssemblyTest.java

@@ -0,0 +1,223 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.lead.LeadContextGauge;
+import dev.ltms.fleet.msg.LeadHeartbeatLoop;
+import dev.ltms.fleet.msg.ReplyInbox;
+import io.javalin.Javalin;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * fleetd #659: {@code FleetdAssembly.java} wires {@code Fleetd.leadContextSource}'s window-lookup
+ * argument with {@code Fleetd.leadContextWindowLookup(() -> config.get().profiles(), leaders)} —
+ * but nothing called the real assembled {@link LeadHeartbeatLoop} far enough to prove that
+ * argument is the one the live heartbeat reads through. Measured: swapping that one call-site
+ * argument for {@code _ -> null} compiles with 0 errors and leaves the full suite green.
+ *
+ * <p>This test drives the REAL {@link LeadHeartbeatLoop} the real {@link
+ * FleetdAssembly#assembleAndStart} builds, reached through {@link FleetdRuntime#heartbeat()}, and
+ * reads its private {@code contextSource} field via reflection — the loop exposes no public
+ * accessor for it, the same reason {@link FleetdLeadConfigDirSourceAssemblyTest} reflects on
+ * {@code FleetMcp.leadConfigDirs}. The configured profile's {@code autoCompactWindow: 100000}
+ * resolves a HIGH threshold of {@code 66666} ({@link LeadContextGauge}'s {@code 2/3} fraction) —
+ * far below the fixed {@code 200000} fallback a lost window argument would silently revert to.
+ * {@code 90000} live tokens sits between the two: HIGH under the real window, OK under the
+ * fallback — a property the fallback can never produce by accident.
+ */
+class FleetdLeadContextSourceWindowAssemblyTest {
+
+    private static final String LEAD_NAME = "opus";
+    private static final String LEAD_TAB = "lead: opus";
+    private static final String LEAD_PROFILE = "sonnet";
+    /** {@code FakeHerdr}'s own default {@code agent.list} entry: terminal {@code term_a}, session {@code sess-1111}. */
+    private static final String LEAD_TERMINAL = "term_a";
+    private static final String LEAD_SESSION_ID = "sess-1111";
+
+    private static final class RecordingResourcePorts implements ResourcePorts {
+
+        final FakeHerdr herdr = new FakeHerdr();
+        final SentinelReplyInbox replyInbox = new SentinelReplyInbox();
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of();
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> replyInbox;
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> {
+                throw new UnsupportedOperationException(
+                        "leadMailboxOpener must not be called — no coordinator: block is configured");
+            };
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            // Never invoked: this test's FakeHerdr answers immediately, so awaitHerdr never polls.
+            return () -> {
+                throw new UnsupportedOperationException("herdrPollWait must not be called — herdr is healthy");
+            };
+        }
+    }
+
+    private static final class SentinelReplyInbox implements ReplyInbox, AutoCloseable {
+        @Override
+        public void own(String target) {
+        }
+
+        @Override
+        public void release(String target) {
+        }
+
+        @Override
+        public void publish(String target, String msgId, String content) {
+        }
+
+        @Override
+        public List<InboxMessage> peek(String target) {
+            return List.of();
+        }
+
+        @Override
+        public boolean ack(String target, String msgId) {
+            return false;
+        }
+
+        @Override
+        public void close() {
+        }
+    }
+
+    private static String usageLine(long tokens) {
+        return "{\"type\":\"assistant\",\"message\":{\"role\":\"assistant\",\"usage\":{"
+                + "\"input_tokens\":" + tokens + ",\"cache_read_input_tokens\":0,\"cache_creation_input_tokens\":0}}}";
+    }
+
+    /** Lays out {@code <configDir>/projects/<anySlug>/<sessionId>.jsonl} carrying one usage record. */
+    private static void writeTranscript(Path configDir, String sessionId, long tokens) throws IOException {
+        Path projectDir = configDir.resolve("projects").resolve("some-project-slug");
+        Files.createDirectories(projectDir);
+        Files.writeString(projectDir.resolve(sessionId + ".jsonl"), usageLine(tokens) + "\n", StandardCharsets.UTF_8);
+    }
+
+    private static FleetConfig writeConfig(Path dir, String configDir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                idleSleepGuard:
+                  enabled: false
+                broker:
+                  uri: "amqp://fake-test-broker/vh"
+                leadHeartbeat:
+                  idleAfterSeconds: 600
+                  backoffMs: 15000
+                  quietNudgeCap: 5
+                fleet:
+                  leaders:
+                    %s:
+                      tab: "%s"
+                      profile: %s
+                profiles:
+                  %s:
+                    subscription: true
+                    argv: ["ccs", "sonnet"]
+                    configDir: "%s"
+                    autoCompactWindow: 100000
+                """.formatted(LEAD_NAME, LEAD_TAB, LEAD_PROFILE, LEAD_PROFILE, configDir));
+        return FleetConfig.load(f);
+    }
+
+    @SuppressWarnings("unchecked")
+    private static LeadHeartbeatLoop.LeadContextSource contextSourceOf(LeadHeartbeatLoop heartbeat) throws Exception {
+        Field field = LeadHeartbeatLoop.class.getDeclaredField("contextSource");
+        field.setAccessible(true);
+        return (LeadHeartbeatLoop.LeadContextSource) field.get(heartbeat);
+    }
+
+    @Test
+    @DisplayName("[BEHAVIOURAL] the real assembled heartbeat loop resolves HIGH against the lead's "
+            + "REAL configured window, not the fixed 200000 fallback a lost window argument reverts to")
+    void assembledHeartbeatContextSourceResolvesTheRealConfiguredWindow(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir, dir.toString());
+        writeTranscript(dir, LEAD_SESSION_ID, 90_000);
+        ConfigRef config = new ConfigRef(dir.resolve("fleetd.yaml"), cfg);
+        SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
+        RecordingResourcePorts ports = new RecordingResourcePorts();
+        // Label FakeHerdr's own default pane's tab (term_a / w2:p7 / w2:t7, already carrying a live
+        // agent on session sess-1111) to match fleet.leaders.opus.tab exactly, so LeadTabScanner
+        // recognises it as the live "opus" lead without a second auto-launched pane.
+        ports.herdr.withTab("w2", "w2:t7", LEAD_TAB).agentSessionId(LEAD_SESSION_ID);
+
+        FleetdRuntime runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg, config, guard), ports);
+        try {
+            LeadHeartbeatLoop.LeadContextSource source = contextSourceOf(runtime.heartbeat());
+
+            LeadContextGauge.Reading reading = source.readingFor().apply(LEAD_TERMINAL);
+
+            assertEquals(LeadContextGauge.State.HIGH, reading.state(),
+                    "profiles." + LEAD_PROFILE + ".autoCompactWindow: 100000 resolves a HIGH threshold "
+                            + "of 66666 tokens — 90000 live tokens must read HIGH against it. Mutating "
+                            + "FleetdAssembly's window-lookup argument to `_ -> null` falls back to the "
+                            + "fixed 200000 threshold, under which 90000 reads OK instead: " + reading);
+        } finally {
+            // Surefire runs the whole suite in one JVM fork (fleetd/pom.xml sets no forkCount /
+            // reuseForks), so the scheduler/loops this assembly starts must be torn down here, on the
+            // failure path too — hence try/finally rather than a bare statement at the end.
+            runtime.close();
+        }
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadContextSourceWiringTest.java

@@ -87,7 +87,8 @@ class FleetdLeadContextSourceWiringTest {
         Map<String, String> liveLeadTerminals = Map.of(LEAD_TERMINAL, LEAD_NAME);
 
         LeadHeartbeatLoop.LeadContextSource source = Fleetd.leadContextSource(new LeadContextGauge(),
-                agentControlStub(), () -> liveLeadTerminals, name -> LEAD_NAME.equals(name) ? tmp.toString() : null);
+                agentControlStub(), () -> liveLeadTerminals,
+                name -> LEAD_NAME.equals(name) ? tmp.toString() : null, name -> null);
 
         LeadContextGauge.Reading reading = source.readingFor().apply(LEAD_TERMINAL);
 
@@ -101,7 +102,7 @@ class FleetdLeadContextSourceWiringTest {
     @DisplayName("an unrecognised lead terminal resolves to UNKNOWN, not a thrown exception")
     void unrecognisedTerminalResolvesToUnknown() {
         LeadHeartbeatLoop.LeadContextSource source = Fleetd.leadContextSource(new LeadContextGauge(),
-                agentControlStub(), Map::of, name -> null);
+                agentControlStub(), Map::of, name -> null, name -> null);
 
         assertEquals(LeadContextGauge.State.UNKNOWN, source.readingFor().apply("ghost-terminal").state());
     }

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadContextWindowLookupTest.java

@@ -0,0 +1,96 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.FleetConfig;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+import java.util.function.Function;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+/**
+ * {@link Fleetd#leadContextWindowLookup} is the factory wired into {@code
+ * FleetMcp.LeadConfigDirSource} and {@code LeadHeartbeatLoop.LeadContextSource} so {@link
+ * dev.ltms.fleet.lead.LeadContextGauge} scales its HIGH threshold against a lead's own profile's
+ * effective auto-compact window instead of always the gauge's fixed fallback — the same {@code
+ * fleet.leaders.<name>.profile} link {@link Fleetd#leadConfigDirLookup} already follows, one step
+ * further to {@link FleetConfig.Profile#effectiveAutoCompactWindow()}.
+ */
+class FleetdLeadContextWindowLookupTest {
+
+    private static FleetConfig.Profile profileWithWindow(String name, Integer autoCompactWindow,
+            Map<String, String> env) {
+        return new FleetConfig.Profile(name, null, "claude-sonnet-5", null, null, null,
+                "tab", "fleet", "w #{n}", null, null, null, null, null, null, env,
+                null, null, true, null, null, null, null, null, autoCompactWindow, null);
+    }
+
+    private static FleetConfig.Leader leadOnProfile(String profile) {
+        return new FleetConfig.Leader(profile, "lead: primary", 1, "lead:", 10, "claude", "claude-sonnet-5");
+    }
+
+    @Test
+    @DisplayName("a lead on a profile that sets autoCompactWindow resolves to that window")
+    void leadOnAProfileWithAutoCompactWindowResolvesToIt() {
+        Map<String, FleetConfig.Profile> profiles =
+                Map.of("opus", profileWithWindow("opus", 250_000, Map.of()));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("opus"));
+        Function<String, Long> lookup = Fleetd.leadContextWindowLookup(() -> profiles, leaders);
+
+        assertEquals(250_000L, lookup.apply("primary"));
+    }
+
+    @Test
+    @DisplayName("yaml and env disagree: the lookup resolves the env value, not the yaml one")
+    void yamlAndEnvDisagreeLookupResolvesTheEnvValue() {
+        Map<String, FleetConfig.Profile> profiles = Map.of("opus",
+                profileWithWindow("opus", 250_000, Map.of("CLAUDE_CODE_AUTO_COMPACT_WINDOW", "150000")));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("opus"));
+        Function<String, Long> lookup = Fleetd.leadContextWindowLookup(() -> profiles, leaders);
+
+        assertEquals(150_000L, lookup.apply("primary"));
+    }
+
+    @Test
+    @DisplayName("a lead entry with no `profile:` resolves to null, not a thrown exception")
+    void recogniseOnlyLeadWithNoProfileResolvesToNull() {
+        Map<String, FleetConfig.Profile> profiles =
+                Map.of("opus", profileWithWindow("opus", 250_000, Map.of()));
+        FleetConfig.Leader recogniseOnly = new FleetConfig.Leader(null, "lead: primary", 1, "lead:", 10,
+                "claude", "claude-sonnet-5");
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", recogniseOnly);
+        Function<String, Long> lookup = Fleetd.leadContextWindowLookup(() -> profiles, leaders);
+
+        assertNull(lookup.apply("primary"));
+    }
+
+    @Test
+    @DisplayName("a lead naming a profile that is not configured resolves to null, not a thrown exception")
+    void leadOnAnUnconfiguredProfileResolvesToNull() {
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("ghost-profile"));
+        Function<String, Long> lookup = Fleetd.leadContextWindowLookup(Map::of, leaders);
+
+        assertNull(lookup.apply("primary"));
+    }
+
+    @Test
+    @DisplayName("a lead on a profile that resolves no window at all resolves to null")
+    void leadOnAProfileWithNoWindowResolvesToNull() {
+        Map<String, FleetConfig.Profile> profiles =
+                Map.of("opus", profileWithWindow("opus", null, Map.of()));
+        Map<String, FleetConfig.Leader> leaders = Map.of("primary", leadOnProfile("opus"));
+        Function<String, Long> lookup = Fleetd.leadContextWindowLookup(() -> profiles, leaders);
+
+        assertNull(lookup.apply("primary"));
+    }
+
+    @Test
+    @DisplayName("an unrecognised lead name resolves to null, not a thrown exception")
+    void unrecognisedLeadNameResolvesToNull() {
+        Function<String, Long> lookup = Fleetd.leadContextWindowLookup(Map::of, Map.of());
+
+        assertNull(lookup.apply("ghost-lead"));
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdQuarantineOutageDualWindowAssemblyTest.java

@@ -0,0 +1,368 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.inject.CompletionResolver;
+import dev.ltms.fleet.msg.Rendezvous;
+import dev.ltms.fleet.msg.TurnToken;
+import dev.ltms.fleet.session.MemberSession;
+import io.javalin.Javalin;
+import io.modelcontextprotocol.client.McpClient;
+import io.modelcontextprotocol.client.McpSyncClient;
+import io.modelcontextprotocol.client.transport.HttpClientStreamableHttpTransport;
+import io.modelcontextprotocol.spec.McpClientTransport;
+import io.modelcontextprotocol.spec.McpSchema;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.Timeout;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Map;
+import java.util.concurrent.CompletableFuture;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicLong;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #612 Shape A, unit r4 — {@link FleetdAssembly}'s {@code quarantineSource} (lines 471-472)
+ * and {@code outageSource} (lines 473-476 at {@code main} = {@code 141ae3b}), EACH of which feeds
+ * two separate consumers: {@code FleetMcp} ({@code fleet_profiles}) and {@code FleetApp}
+ * ({@code GET /profiles}), one call site ({@code :484}/{@code :486}) into the MCP constructor and
+ * the SAME shared local again ({@code :529}) into the REST constructor.
+ *
+ * <p><strong>The property pinned here</strong> (from the ticket): when the real assembly has built
+ * a real {@link dev.ltms.fleet.placement.BackendQuarantine} holding a quarantined credential, and a
+ * real {@link dev.ltms.fleet.placement.BackendOutagePolicy} holding a cooling-off credential, BOTH
+ * operator windows must report that state — the real assembled {@code FleetMcp} (reached through
+ * {@link FleetdRuntime#mcp()}) and the real assembled REST surface (reached through {@link
+ * FleetdRuntime#app()}). A mutation that starves one consumer while leaving the other wired must
+ * make only that consumer's assertion go red.
+ *
+ * <p><strong>No source-text assertion anywhere in this file.</strong> Both windows are read off the
+ * REAL running objects: {@code fleet_profiles} is called through a real MCP client over a real
+ * HTTP connection to the servlet {@link FleetdAssembly} actually mounted, and {@code GET /profiles}
+ * is called through a real {@link java.net.http.HttpClient} against the real bound {@link
+ * FleetdRuntime#app()}. Neither is a copy built alongside the assembly for this test's benefit.
+ *
+ * <p><strong>How this gets past CB-185's own pid-resolution dead end.</strong> {@code
+ * FleetdAssemblyFleetAppTest}'s class javadoc explains that {@code GET /sessions} cannot be driven
+ * over real HTTP here because {@code LsofPeerPidLookup} excludes its own pid and an in-process test
+ * client/server share one JVM pid — every such request resolves {@code ANONYMOUS} and is refused
+ * before the handler runs. {@code GET /profiles} and {@code fleet_profiles} sit behind the exact
+ * same {@code Authz.Action.READ} gate. This test sidesteps the dead end instead of hitting it:
+ * {@code auth.mode: token} (see {@link dev.ltms.fleet.auth.CallerResolver#resolve}) resolves a
+ * caller to {@code PRIMARY} from a valid {@code Authorization: Bearer} header ALONE, with no pid
+ * resolution involved at all — the same technique {@code FleetMcpContextExtractorTest} already uses
+ * to drive a real {@code fleet_whoami} call through the real transport.
+ *
+ * <p><strong>How the quarantined/cooling-off state is set up.</strong> Both {@code BackendQuarantine}
+ * and {@code BackendOutagePolicy} are private to the collaborators the assembly wires them into, and
+ * (unlike {@code quarantineSource()}) neither {@code FleetMcp} nor {@code FleetApp} exposes a public
+ * accessor for the live {@code BackendOutagePolicy} instance. Rather than add one (acceptance
+ * criterion 1: no production change), this test drives the REAL production classification path —
+ * exactly the recipe {@code FleetdExhaustedPatternAssemblyTest} (quarantine) and {@code
+ * FleetdCompletionResolverAssemblyTest} (cool-off) already proved works end to end against this same
+ * {@link FleetdAssembly#assembleAndStart}: acquire a real {@link MemberSession}, feed the real {@link
+ * CompletionResolver} a pane scrape matching the profile's configured {@code exhaustedPattern} /
+ * {@code errorPattern}, and let the real {@code exhaustionSink}/{@code backendErrorSink} write into
+ * the real, shared tracker. Each setup step asserts its own {@link Rendezvous.Kind} as a CONTROL —
+ * if the resolver were never actually exercised, the setup itself fails loudly before either window
+ * is ever read.
+ */
+class FleetdQuarantineOutageDualWindowAssemblyTest {
+
+    private static final String TOKEN = "s3cret-r4-token";
+    private static final String TOKEN_ENV = "FLEETD_R4_TEST_TOKEN";
+
+    private static final class ControllableResourcePorts implements ResourcePorts {
+
+        final FakeHerdr herdr;
+        final AtomicLong nowNanos = new AtomicLong(1_000_000_000L); // arbitrary non-zero start
+        Runnable shutdownHook;
+
+        ControllableResourcePorts(FakeHerdr herdr) {
+            this.herdr = herdr;
+        }
+
+        void advanceSeconds(long seconds) {
+            nowNanos.addAndGet(TimeUnit.SECONDS.toNanos(seconds));
+        }
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of(TOKEN_ENV, TOKEN);
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            // Never invoked: this test's config has no `broker:` block.
+            return (uri, prefetch) -> {
+                throw new UnsupportedOperationException("replyInboxOpener must not be called — no broker: block");
+            };
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            // Never invoked: this test's config has no `coordinator:` block.
+            return (uri, selfCoordId, prefetch) -> {
+                throw new UnsupportedOperationException(
+                        "leadMailboxOpener must not be called — no coordinator: block is configured");
+            };
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return nowNanos::get;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return nowNanos::get;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+            this.shutdownHook = hook;
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+            // Deliberately never bind here — this test binds runtime.app() itself, for real, below.
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            // Never invoked: this test's FakeHerdr answers immediately, so awaitHerdr never polls.
+            return () -> {
+                throw new UnsupportedOperationException("herdrPollWait must not be called — herdr is healthy");
+            };
+        }
+    }
+
+    private FleetdRuntime runtime;
+    private ControllableResourcePorts ports;
+    private Javalin boundApp;
+
+    @AfterEach
+    void tearDown() {
+        if (boundApp != null) {
+            boundApp.stop();
+        }
+        if (ports != null && ports.shutdownHook != null) {
+            ports.shutdownHook.run();
+        }
+    }
+
+    private static FleetConfig writeConfig(Path dir, int cooldownSeconds) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                auth:
+                  mode: token
+                  tokenEnv: %s
+                idleSleepGuard:
+                  enabled: false
+                quarantineCooldownSeconds: %d
+                profiles:
+                  exhaustprofile:
+                    baseUrl: http://exhausthost.local:8000
+                    model: sonnet
+                    exhaustedPattern: "usage limit reached"
+                  coolprofile:
+                    baseUrl: http://coolhost.local:8000
+                    model: sonnet
+                    errorPattern: "credential outage"
+                guard:
+                  offSubscriptionHosts:
+                    - exhausthost.local
+                    - coolhost.local
+                """.formatted(TOKEN_ENV, cooldownSeconds));
+        return FleetConfig.load(f);
+    }
+
+    /** Assembles the real graph, then binds the real {@code Javalin app} to an ephemeral port. */
+    private int assembleAndBind(Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir, 120);
+        ConfigRef config = new ConfigRef(dir.resolve("fleetd.yaml"), cfg);
+        SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
+        ports = new ControllableResourcePorts(new FakeHerdr());
+        runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg, config, guard), ports);
+        boundApp = runtime.app().start("127.0.0.1", 0);
+        return boundApp.port();
+    }
+
+    /**
+     * Drives the real assembled {@link CompletionResolver} through a scrape matching {@code
+     * exhaustprofile}'s configured {@code exhaustedPattern}, exactly {@code
+     * FleetdExhaustedPatternAssemblyTest}'s own recipe, so the real {@code exhaustionSink} quarantines
+     * the credential ({@code effectiveCredentialId() == "exhaustprofile"}, no explicit credentialId
+     * configured).
+     */
+    private void quarantineExhaustProfile(Path dir) {
+        MemberSession session = runtime.sessions().acquire("exhaustprofile", null, dir.toString(), null);
+        String target = session.terminalId();
+
+        CompletionResolver completion = runtime.completion();
+        CompletableFuture<Rendezvous.Resolution> waiter = new CompletableFuture<>();
+
+        ports.herdr.readText("idle, nothing yet");
+        completion.onDelivered(target, new TurnToken(target, waiter, null));
+        ports.herdr.readText("usage limit reached: try again in a few hours");
+        ports.advanceSeconds(3); // clear CompletionResolver.MIN_TURN_NANOS (2s), no real sleep
+        completion.resolveBeforePostAction(target);
+
+        Rendezvous.Resolution resolution = waiter.getNow(null);
+        assertTrue(resolution != null && resolution.kind() == Rendezvous.Kind.BACKEND_EXHAUSTED,
+                "CONTROL: setup must classify as BACKEND_EXHAUSTED before either window is read — "
+                        + "if this fails, the assembled resolver was never actually exercised: " + resolution);
+    }
+
+    /**
+     * Drives the real assembled {@link CompletionResolver} with TWO distinct targets on {@code
+     * coolprofile}, each matching its configured {@code errorPattern}, exactly {@code
+     * FleetdCompletionResolverAssemblyTest}'s own recipe, so the real {@code backendErrorSink} cools
+     * the credential off ({@code effectiveCredentialId() == "coolprofile"}).
+     */
+    private void coolOffCoolProfile(Path dir) {
+        MemberSession s1 = runtime.sessions().acquire("coolprofile", null, dir.toString(), null);
+        MemberSession s2 = runtime.sessions().acquire("coolprofile", null, dir.toString(), null);
+        CompletionResolver completion = runtime.completion();
+
+        String t1 = s1.terminalId();
+        CompletableFuture<Rendezvous.Resolution> w1 = new CompletableFuture<>();
+        ports.herdr.readText("idle 1");
+        completion.onDelivered(t1, new TurnToken(t1, w1, null));
+        ports.herdr.readText("credential outage: upstream 503");
+        ports.advanceSeconds(3);
+        completion.resolveBeforePostAction(t1);
+        Rendezvous.Resolution r1 = w1.getNow(null);
+        assertTrue(r1 != null && r1.kind() == Rendezvous.Kind.FAILED,
+                "CONTROL: target1's setup must classify FAILED (backend error): " + r1);
+
+        String t2 = s2.terminalId();
+        CompletableFuture<Rendezvous.Resolution> w2 = new CompletableFuture<>();
+        ports.herdr.readText("idle 2");
+        completion.onDelivered(t2, new TurnToken(t2, w2, null));
+        ports.herdr.readText("credential outage: upstream 503 again");
+        ports.advanceSeconds(3);
+        completion.resolveBeforePostAction(t2);
+        Rendezvous.Resolution r2 = w2.getNow(null);
+        assertTrue(r2 != null && r2.kind() == Rendezvous.Kind.FAILED,
+                "CONTROL: target2's setup must classify FAILED (backend error) — two distinct "
+                        + "targets are required to cross BackendOutagePolicy.THRESHOLD: " + r2);
+    }
+
+    /** Calls the real {@code fleet_profiles} tool over a real MCP client, token-authenticated as PRIMARY. */
+    private static McpSchema.CallToolResult callProfilesViaMcp(int port) {
+        HttpRequest.Builder requestTemplate = HttpRequest.newBuilder().header("Authorization", "Bearer " + TOKEN);
+        McpClientTransport transport = HttpClientStreamableHttpTransport.builder("http://127.0.0.1:" + port)
+                .endpoint("/mcp")
+                .requestBuilder(requestTemplate)
+                .build();
+        try (McpSyncClient client = McpClient.sync(transport).build()) {
+            client.initialize();
+            return client.callTool(McpSchema.CallToolRequest.builder("fleet_profiles").arguments(Map.of()).build());
+        }
+    }
+
+    private static String textOf(McpSchema.CallToolResult r) {
+        return ((McpSchema.TextContent) r.content().getFirst()).text();
+    }
+
+    /** Calls the real {@code GET /profiles} route over a real {@link HttpClient}, same token. */
+    private static String getProfilesViaRest(int port) throws Exception {
+        HttpClient http = HttpClient.newHttpClient();
+        HttpRequest req = HttpRequest.newBuilder(URI.create("http://127.0.0.1:" + port + "/profiles"))
+                .header("Authorization", "Bearer " + TOKEN)
+                .GET().build();
+        HttpResponse<String> res = http.send(req, HttpResponse.BodyHandlers.ofString());
+        assertEquals(200, res.statusCode(), "GET /profiles must succeed with the real token: " + res.body());
+        return res.body();
+    }
+
+    // --- quarantineSource (FleetdAssembly.java :471-472) --------------------------------------
+
+    @Test
+    @Timeout(value = 15, unit = TimeUnit.SECONDS, threadMode = Timeout.ThreadMode.SEPARATE_THREAD)
+    void quarantinedCredentialIsReportedByTheRealAssembledFleetMcp(@TempDir Path dir) throws Exception {
+        int port = assembleAndBind(dir);
+        quarantineExhaustProfile(dir);
+
+        String out = textOf(callProfilesViaMcp(port));
+
+        assertTrue(out.contains("\"quarantined\""), "fleet_profiles must report a quarantined "
+                + "section once the real BackendQuarantine holds a quarantined credential: " + out);
+        assertTrue(out.contains("\"exhaustprofile\""), out);
+        assertTrue(out.contains("\"quarantinedForSeconds\""), out);
+    }
+
+    @Test
+    @Timeout(value = 15, unit = TimeUnit.SECONDS, threadMode = Timeout.ThreadMode.SEPARATE_THREAD)
+    void quarantinedCredentialIsReportedByTheRealAssembledFleetApp(@TempDir Path dir) throws Exception {
+        int port = assembleAndBind(dir);
+        quarantineExhaustProfile(dir);
+
+        String out = getProfilesViaRest(port);
+
+        assertTrue(out.contains("\"quarantined\""), "GET /profiles must report a quarantined "
+                + "section once the real BackendQuarantine holds a quarantined credential: " + out);
+        assertTrue(out.contains("\"exhaustprofile\""), out);
+        assertTrue(out.contains("\"quarantinedForSeconds\""), out);
+    }
+
+    // --- outageSource (FleetdAssembly.java :473-476) -------------------------------------------
+
+    @Test
+    @Timeout(value = 15, unit = TimeUnit.SECONDS, threadMode = Timeout.ThreadMode.SEPARATE_THREAD)
+    void coolingOffCredentialIsReportedByTheRealAssembledFleetMcp(@TempDir Path dir) throws Exception {
+        int port = assembleAndBind(dir);
+        coolOffCoolProfile(dir);
+
+        String out = textOf(callProfilesViaMcp(port));
+
+        assertTrue(out.contains("\"coolingOff\""), "fleet_profiles must report a coolingOff "
+                + "section once the real BackendOutagePolicy holds a cooling-off credential: " + out);
+        assertTrue(out.contains("\"coolprofile\""), out);
+        assertTrue(out.contains("\"coolingOffForSeconds\""), out);
+    }
+
+    @Test
+    @Timeout(value = 15, unit = TimeUnit.SECONDS, threadMode = Timeout.ThreadMode.SEPARATE_THREAD)
+    void coolingOffCredentialIsReportedByTheRealAssembledFleetApp(@TempDir Path dir) throws Exception {
+        int port = assembleAndBind(dir);
+        coolOffCoolProfile(dir);
+
+        String out = getProfilesViaRest(port);
+
+        assertTrue(out.contains("\"coolingOff\""), "GET /profiles must report a coolingOff "
+                + "section once the real BackendOutagePolicy holds a cooling-off credential: " + out);
+        assertTrue(out.contains("\"coolprofile\""), out);
+        assertTrue(out.contains("\"coolingOffForSeconds\""), out);
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigProfileEffectiveAutoCompactWindowTest.java

@@ -0,0 +1,65 @@
+package dev.ltms.fleet.config;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+
+import java.util.Map;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNull;
+
+/**
+ * {@link FleetConfig.Profile#effectiveAutoCompactWindow()} resolves the window a launched Claude
+ * Code session actually runs on, not just the {@code autoCompactWindow:} launch flag — {@code env:
+ * CLAUDE_CODE_AUTO_COMPACT_WINDOW} overrides that flag, so a profile setting both resolves from the
+ * environment variable.
+ */
+class FleetConfigProfileEffectiveAutoCompactWindowTest {
+
+    private static FleetConfig.Profile profile(Integer autoCompactWindow, Map<String, String> env) {
+        return new FleetConfig.Profile("sonnet", null, "claude-sonnet-5", null, null, null,
+                "tab", "fleet", "w #{n}", null, null, null, null, null, null, env,
+                null, null, true, null, null, null, null, null, autoCompactWindow, null);
+    }
+
+    @Test
+    @DisplayName("yaml and env disagree: the env var wins, not the yaml key")
+    void yamlAndEnvDisagreeEnvWins() {
+        FleetConfig.Profile p = profile(250_000, Map.of("CLAUDE_CODE_AUTO_COMPACT_WINDOW", "150000"));
+
+        assertEquals(150_000, p.effectiveAutoCompactWindow(),
+                "the two inputs must give DIFFERENT thresholds (150,000 vs 250,000) and the env value must win");
+    }
+
+    @Test
+    @DisplayName("only autoCompactWindow set: that value resolves")
+    void onlyAutoCompactWindowSetResolvesToIt() {
+        FleetConfig.Profile p = profile(250_000, Map.of());
+
+        assertEquals(250_000, p.effectiveAutoCompactWindow());
+    }
+
+    @Test
+    @DisplayName("only the env var set: that value resolves")
+    void onlyEnvVarSetResolvesToIt() {
+        FleetConfig.Profile p = profile(null, Map.of("CLAUDE_CODE_AUTO_COMPACT_WINDOW", "150000"));
+
+        assertEquals(150_000, p.effectiveAutoCompactWindow());
+    }
+
+    @Test
+    @DisplayName("neither set: resolves to null")
+    void neitherSetResolvesToNull() {
+        FleetConfig.Profile p = profile(null, Map.of());
+
+        assertNull(p.effectiveAutoCompactWindow());
+    }
+
+    @Test
+    @DisplayName("an unparseable env value falls back to autoCompactWindow rather than throwing")
+    void unparseableEnvValueFallsBackToAutoCompactWindow() {
+        FleetConfig.Profile p = profile(250_000, Map.of("CLAUDE_CODE_AUTO_COMPACT_WINDOW", "not-a-number"));
+
+        assertEquals(250_000, p.effectiveAutoCompactWindow());
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java

@@ -765,6 +765,92 @@ class FleetConfigTest {
                 "a label that collides with a convention nobody reads is not a problem");
     }
 
+    // ── validatePanePlacementAgainstLeadTabs ────────────────────────────────────────────────────
+
+    /**
+     * The hazard this guard closes: a pane-placed member lands inside the focused tab rather than
+     * its own, so it can land inside a lead's labelled tab and be read back as that lead.
+     */
+    @Test
+    void aPanePlacedProfileWithALeadTabRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("pane-hazard.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class,
+                cfg::validatePanePlacementAgainstLeadTabs);
+        assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
+    }
+
+    @Test
+    void aPanePlacedProfileWithNoLeadTabIsAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("pane-no-tab.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  leaders:
+                    opus:
+                      profile: gx10
+                """);
+
+        assertDoesNotThrow(() -> FleetConfig.load(f).validatePanePlacementAgainstLeadTabs(),
+                "a leader with no tab feeds nothing into the scanner, so pane placement is safe");
+    }
+
+    @Test
+    void aTabPlacedProfileWithALeadTabIsAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("tab-safe.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: tab
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """);
+
+        assertDoesNotThrow(() -> FleetConfig.load(f).validatePanePlacementAgainstLeadTabs(),
+                "a member in its own tab cannot land inside a lead's tab");
+    }
+
+    /** Proves the reflective sweep behind {@code validateAll} really reaches this validator. */
+    @Test
+    void validateAllAlsoRefusesPanePlacementAgainstALeadTab(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("pane-hazard-sweep.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateAll);
+        assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
+    }
+
     // ── CB-530/CB-579: the leaders registry ─────────────────────────────────────────────────────
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigValidateAllTest.java

@@ -42,12 +42,13 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
  *       has right now. This is the proof that a future, real seventh validator on {@link
  *       FleetConfig} would be swept automatically, without needing to add a real (unwanted)
  *       seventh validator just to exercise the claim.</li>
- *   <li>{@link #validateAllReachesEveryOneOfTodaysSixValidators()} proves {@link
+ *   <li>{@link #validateAllReachesEveryOneOfTodaysRealValidators()} proves {@link
  *       FleetConfig#validateAll()} itself is wired to that same generic mechanism and genuinely
- *       reaches each of today's six real validators — reusing the exact minimal failing
+ *       reaches seven of today's eight real validators — reusing the exact minimal failing
  *       configurations {@code FleetConfigTest} already established for each one directly, so a
- *       single call to {@code validateAll()} is shown to reproduce every one of those six
- *       failures.</li>
+ *       single call to {@code validateAll()} is shown to reproduce every one of those seven
+ *       failures. The eighth, {@link FleetConfig#validateLeadRollover()}, has no case here yet —
+ *       a pre-existing gap tracked as fleetd #668.</li>
  * </ol>
  *
  * <p>Together with the direct-{@code Fleetd.main}-invocation tests in {@code
@@ -62,8 +63,8 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
  * the generic sweep — claim 1 proves {@link FleetConfig#invokeAllValidators} is generic, and claim
  * 2 proves {@code validateAll()} reaches today's six, and a hardcoded list satisfies both. So the
  * reflective sweep is a convenience, not the guarantee. The guarantee is {@link
- * #fleetConfigDeclaresExactlyTheseSixValidatorsToday()}: it fails the moment a seventh validator
- * is declared, which forces whoever adds it to look at this file.
+ * #fleetConfigDeclaresExactlyTheseValidatorsToday()}: it fails the moment any validator is added
+ * or removed, which forces whoever changes the set to look at this file.
  */
 class FleetConfigValidateAllTest {
 
@@ -209,18 +210,19 @@ class FleetConfigValidateAllTest {
                         + "name) must all be skipped");
     }
 
-    // ── Claim 2: FleetConfig.validateAll() is wired to that mechanism and reaches all six today ──
+    // ── Claim 2: FleetConfig.validateAll() is wired to that mechanism and reaches seven of eight today ──
 
     /**
      * Reflectively enumerates {@link FleetConfig}'s own public, no-arg, void {@code validateXxx()}
      * methods (excluding {@code validateAll} itself) — the exact same filter {@link
      * FleetConfig#invokeAllValidators} applies. This is not the mechanism proof (that is claim 1,
-     * above, on an unrelated class) — it is a visible denominator: today there are six, named
-     * here, so a reader adding a seventh sees this assertion name the new count rather than a
-     * silent pass at the old one.
+     * above, on an unrelated class) — it is a visible denominator: today there are eight, named in
+     * the {@code Set.of} below, so a reader adding or removing one sees this assertion name the new
+     * count rather than a silent pass at the old one. The count lives only in that set, not in this
+     * method's name, so the two cannot drift apart.
      */
     @Test
-    void fleetConfigDeclaresExactlyTheseSixValidatorsToday() {
+    void fleetConfigDeclaresExactlyTheseValidatorsToday() {
         Set<String> names = new TreeSet<>();
         for (Method m : FleetConfig.class.getMethods()) {
             if (java.lang.reflect.Modifier.isPublic(m.getModifiers())
@@ -233,7 +235,8 @@ class FleetConfigValidateAllTest {
         }
         assertEquals(new TreeSet<>(Set.of("validateAuthExposure", "validateLeadTabPrefixes",
                 "validateSubscriptionProfiles", "validateCharters", "validateMembers",
-                "validateModels", "validateLeadRollover")), names,
+                "validateModels", "validateLeadRollover", "validatePanePlacementAgainstLeadTabs")),
+                names,
                 "FleetConfig's public validate*() methods changed. Do TWO things, in this "
                         + "order. First confirm validateAll() still delegates to "
                         + "invokeAllValidators(this) — a hardcoded list there passes every other "
@@ -262,14 +265,17 @@ class FleetConfigValidateAllTest {
     }
 
     /**
-     * The heart of claim 2: for each of today's six real validators, a minimal file that fails
+     * The heart of claim 2: for seven of today's eight real validators, a minimal file that fails
      * ONLY that one — the exact fixtures {@code FleetConfigTest} uses to test each validator
      * directly — must also fail through {@link FleetConfig#validateAll()}. If a future edit to
-     * {@code validateAll()} silently dropped one validator from the sweep (e.g. a typo'd name
-     * filter), exactly one of these six would start passing when it must not.
+     * {@code validateAll()} silently dropped one of these seven from the sweep (e.g. a typo'd name
+     * filter), exactly one of them would start passing when it must not.
+     *
+     * <p>The eighth, {@link FleetConfig#validateLeadRollover()}, has no case here — a pre-existing
+     * gap tracked as fleetd #668, not fixed by this change.
      */
     @Test
-    void validateAllReachesEveryOneOfTodaysSixValidators(@TempDir Path dir) throws Exception {
+    void validateAllReachesEveryOneOfTodaysRealValidators(@TempDir Path dir) throws Exception {
         // validateAuthExposure: a non-loopback bind without token mode.
         assertValidateAllRefuses(dir, "auth-exposure.yaml", """
                 bind:
@@ -342,6 +348,20 @@ class FleetConfigValidateAllTest {
                   allow:
                     - model: claude-sonnet-5
                 """, "rogue");
+
+        // validatePanePlacementAgainstLeadTabs: a pane-placed profile while a lead names a tab.
+        assertValidateAllRefuses(dir, "pane-placement.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """, "gx10");
     }
 
     private static void assertValidateAllRefuses(Path dir, String fileName, String yaml,

fleetd/src/test/java/dev/ltms/fleet/herdr/FakeHerdr.java

@@ -51,6 +51,7 @@ public final class FakeHerdr implements HerdrClient {
     private boolean noPanes = false;
     private volatile String agentStatus = "idle"; // steady-state agent.get status
     private volatile String agentType = "claude"; // detected agent kind on agent.get; null = undetected
+    private volatile String agentSessionId = null; // agent_session.value on agent.get; null = omitted
     private volatile String readText = "worker transcript tail"; // canned agent.read output
     private int pinnedStarts = 0;   // how many upcoming agent.start calls report a fixed pane
     private String pinnedStartTerminal;
@@ -173,6 +174,16 @@ public final class FakeHerdr implements HerdrClient {
         return this;
     }
 
+    /**
+     * Set the {@code agent_session.value} that {@code agent.get} reports for {@code term_a} — the
+     * default omits the field entirely (herdr not yet having resolved one), matching the real
+     * daemon's own "not resolved yet" shape.
+     */
+    public FakeHerdr agentSessionId(String sessionId) {
+        this.agentSessionId = sessionId;
+        return this;
+    }
+
     /**
      * Make {@code agent.get} succeed normally for its first {@code okCalls} invocations, then fail
      * every call after that with {@code code} — fleetd #176 fix 1's "backend exited mid-wait"
@@ -311,10 +322,12 @@ public final class FakeHerdr implements HerdrClient {
                         }
                     }
                     String agentField = agentType == null ? "null" : "\"" + agentType + "\"";
+                    String sessionField = agentSessionId == null ? ""
+                            : ",\"agent_session\":{\"kind\":\"id\",\"value\":\"" + agentSessionId + "\"}";
                     yield mapper.readTree(("""
                         {"type":"agent_info","agent":{"terminal_id":"term_a","agent":%s,
-                          "agent_status":"%s","workspace_id":"w2","tab_id":"w2:t7","pane_id":"w2:p7"}}""")
-                            .formatted(agentField, agentStatus));
+                          "agent_status":"%s","workspace_id":"w2","tab_id":"w2:t7","pane_id":"w2:p7"%s}}""")
+                            .formatted(agentField, agentStatus, sessionField));
                 }
                 case "agent.read" -> mapper.readTree(mapper.writeValueAsString(
                         java.util.Map.of("type", "agent_read", "read", java.util.Map.of("text", readText))));

fleetd/src/test/java/dev/ltms/fleet/herdr/LeadTabScannerTest.java

@@ -232,8 +232,9 @@ class LeadTabScannerTest {
 
     @Test
     void everyPaneInALeadTabResolvesAsThatLead() {
-        // A human may split their own lead tab. Both panes are theirs, so both are that lead —
-        // nothing fleetd placed can land here (see the worker-space test above).
+        // A human may split their own lead tab. Both panes are theirs, so both are that lead.
+        // A pane-placed member landing here instead is refused at startup by
+        // FleetConfig.validatePanePlacementAgainstLeadTabs, not by this scanner.
         TopologyHerdr herdr = twoLeads().pane("w1:p1b", "w1:t1", "term_opus_split");
 
         assertEquals("opus-5.0",

fleetd/src/test/java/dev/ltms/fleet/lead/LeadContextGaugeHighThresholdTest.java

@@ -0,0 +1,104 @@
+package dev.ltms.fleet.lead;
+
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * {@code LeadContextGauge}'s HIGH threshold scales with the caller's resolved effective
+ * auto-compact window, so the margin it warns at makes sense against a window that can legally sit
+ * as low as {@code 100_000}, not only against the fixed fallback. These properties pin that
+ * scaling, its boundary, and the fallback used when no window is resolvable.
+ */
+class LeadContextGaugeHighThresholdTest {
+
+    private static final String SESSION_ID = "55555555-5555-5555-5555-555555555555";
+
+    private static String usageLine(long tokens) {
+        return "{\"type\":\"assistant\",\"message\":{\"role\":\"assistant\",\"usage\":{"
+                + "\"input_tokens\":" + tokens + ",\"cache_read_input_tokens\":0,\"cache_creation_input_tokens\":0}}}";
+    }
+
+    private static String writeTranscript(Path configDir, String sessionId, long tokens) throws IOException {
+        Path projectDir = configDir.resolve("projects").resolve("some-project-slug");
+        Files.createDirectories(projectDir);
+        Files.writeString(projectDir.resolve(sessionId + ".jsonl"), usageLine(tokens) + "\n", StandardCharsets.UTF_8);
+        return configDir.toString();
+    }
+
+    @Test
+    @DisplayName("an effective window of 100000 reports HIGH strictly below 100000")
+    void effectiveWindowOf100000ReportsHighStrictlyBelow100000(@TempDir Path tmp) throws IOException {
+        // 90,000 is below the 100,000 window itself, but above a fixed 200,000 fallback would ever
+        // reach — only a threshold that scales with the window can report HIGH here.
+        String configDir = writeTranscript(tmp, SESSION_ID, 90_000);
+        LeadContextGauge gauge = new LeadContextGauge();
+
+        LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude", 100_000L);
+
+        assertEquals(LeadContextGauge.State.HIGH, reading.state(),
+                "90,000 tokens against a 100,000 effective window must already be HIGH, with margin to spare "
+                        + "before a compaction at the window itself");
+    }
+
+    @Test
+    @DisplayName("the boundary sits strictly between OK and HIGH on both sides")
+    void boundarySitsStrictlyBetweenOkAndHighOnBothSides(@TempDir Path tmp) throws IOException {
+        long window = 100_000L;
+        long threshold = (long) (window * (2.0 / 3.0)); // 66,666
+
+        String belowConfigDir = writeTranscript(tmp.resolve("below"), SESSION_ID, threshold - 1);
+        LeadContextGauge belowGauge = new LeadContextGauge();
+        assertEquals(LeadContextGauge.State.OK,
+                belowGauge.read(belowConfigDir, SESSION_ID, "claude", window).state(),
+                "one token short of the threshold must stay OK");
+
+        String atConfigDir = writeTranscript(tmp.resolve("at"), SESSION_ID, threshold);
+        LeadContextGauge atGauge = new LeadContextGauge();
+        assertEquals(LeadContextGauge.State.HIGH,
+                atGauge.read(atConfigDir, SESSION_ID, "claude", window).state(),
+                "exactly at the threshold must already be HIGH");
+    }
+
+    @Test
+    @DisplayName("with no effective window resolvable, the threshold is still the fixed 200000 default")
+    void noEffectiveWindowFallsBackToTheFixed200000Default(@TempDir Path tmp) throws IOException {
+        String belowConfigDir = writeTranscript(tmp.resolve("below"), SESSION_ID, 199_999);
+        LeadContextGauge belowGauge = new LeadContextGauge();
+        assertEquals(LeadContextGauge.State.OK,
+                belowGauge.read(belowConfigDir, SESSION_ID, "claude", null).state(),
+                "one token short of the fixed default must stay OK when no window is resolvable");
+
+        String atConfigDir = writeTranscript(tmp.resolve("at"), SESSION_ID, 200_000);
+        LeadContextGauge atGauge = new LeadContextGauge();
+        assertEquals(LeadContextGauge.State.HIGH,
+                atGauge.read(atConfigDir, SESSION_ID, "claude", null).state(),
+                "the fixed default must still be 200,000 when no window is resolvable");
+    }
+
+    @Test
+    @DisplayName("a second read with a different window, within the TTL, reports against its own window, not the first call's cached state")
+    void aSecondReadWithADifferentWindowWithinTheTtlReportsAgainstItsOwnWindow(@TempDir Path tmp) throws IOException {
+        String configDir = writeTranscript(tmp, SESSION_ID, 90_000);
+        long[] now = {0L};
+        LeadContextGauge gauge = new LeadContextGauge(() -> now[0], 5_000);
+
+        LeadContextGauge.Reading first = gauge.read(configDir, SESSION_ID, "claude", 100_000L);
+        assertEquals(LeadContextGauge.State.HIGH, first.state(),
+                "90,000 tokens against a 100,000 window is HIGH");
+
+        now[0] += 1_000; // stays inside the 5,000ms TTL — the cache key must still vary with the window
+        LeadContextGauge.Reading second = gauge.read(configDir, SESSION_ID, "claude", 1_000_000L);
+
+        assertEquals(LeadContextGauge.State.OK, second.state(),
+                "90,000 tokens against a 1,000,000 window must report OK regardless of the previous call's "
+                        + "window, even while that call's cache entry is still within its TTL");
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/lead/LeadContextGaugeTest.java

@@ -85,7 +85,7 @@ class LeadContextGaugeTest {
                 usageLine(40_000, 5_000, 3_000)); // last record: 48,000
         LeadContextGauge gauge = new LeadContextGauge();
 
-        LeadContextGauge.Reading first = gauge.read(configDir, SESSION_ID, "claude");
+        LeadContextGauge.Reading first = gauge.read(configDir, SESSION_ID, "claude", null);
         assertEquals(48_000L, first.tokens(), "must total input+cache_read+cache_creation of the LAST usage record");
         assertEquals(LeadContextGauge.State.OK, first.state());
 
@@ -93,7 +93,7 @@ class LeadContextGaugeTest {
         // must change with it, not stay pinned to the first fixture's total.
         String otherSession = "22222222-2222-2222-2222-222222222222";
         writeTranscript(tmp, otherSession, usageLine(100_000, 50_000, 50_000)); // last record: 200,000
-        LeadContextGauge.Reading second = gauge.read(configDir, otherSession, "claude");
+        LeadContextGauge.Reading second = gauge.read(configDir, otherSession, "claude", null);
         assertEquals(200_000L, second.tokens());
         assertTrue(second.tokens() != first.tokens(), "changing N in the fixture must change the reported number");
     }
@@ -111,12 +111,12 @@ class LeadContextGaugeTest {
                 compactionLine(),
                 usageLine(3_000, 0, 0));
         LeadContextGauge gauge = new LeadContextGauge();
-        LeadContextGauge.Reading twoCompactions = gauge.read(tmp.toString(), sessionTwoCompactions, "claude");
+        LeadContextGauge.Reading twoCompactions = gauge.read(tmp.toString(), sessionTwoCompactions, "claude", null);
         assertEquals(2, twoCompactions.compactions());
 
         String sessionZeroCompactions = "44444444-4444-4444-4444-444444444444";
         writeTranscript(tmp, sessionZeroCompactions, usageLine(3_000, 0, 0));
-        LeadContextGauge.Reading zeroCompactions = gauge.read(tmp.toString(), sessionZeroCompactions, "claude");
+        LeadContextGauge.Reading zeroCompactions = gauge.read(tmp.toString(), sessionZeroCompactions, "claude", null);
         assertEquals(0, zeroCompactions.compactions(), "changing K in the fixture must change the reported count");
     }
 
@@ -126,7 +126,7 @@ class LeadContextGaugeTest {
     @DisplayName("a missing transcript file reports UNKNOWN with no token number")
     void missingFileIsUnknown(@TempDir Path tmp) {
         LeadContextGauge gauge = new LeadContextGauge();
-        LeadContextGauge.Reading reading = gauge.read(tmp.toString(), SESSION_ID, "claude");
+        LeadContextGauge.Reading reading = gauge.read(tmp.toString(), SESSION_ID, "claude", null);
         assertEquals(LeadContextGauge.State.UNKNOWN, reading.state());
         assertNull(reading.tokens());
     }
@@ -148,7 +148,7 @@ class LeadContextGaugeTest {
             assumeFalse(Files.isReadable(file),
                     "runs as root (CI container): the read bit does not stop root, so this case cannot be set up here");
             LeadContextGauge gauge = new LeadContextGauge();
-            LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude");
+            LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude", null);
             assertEquals(LeadContextGauge.State.UNKNOWN, reading.state());
             assertNull(reading.tokens());
         } finally {
@@ -171,7 +171,7 @@ class LeadContextGaugeTest {
         Files.writeString(file, lastCompleteLine + "\n" + tornLine, StandardCharsets.UTF_8);
 
         LeadContextGauge gauge = new LeadContextGauge();
-        LeadContextGauge.Reading reading = gauge.read(tmp.toString(), SESSION_ID, "claude");
+        LeadContextGauge.Reading reading = gauge.read(tmp.toString(), SESSION_ID, "claude", null);
         assertEquals(LeadContextGauge.State.OK, reading.state(),
                 "a torn final line must not turn a good earlier reading into UNKNOWN");
         assertEquals(6_000L, reading.tokens(),
@@ -187,7 +187,7 @@ class LeadContextGaugeTest {
                 "{this is not json at all",
                 "neither is this{{{");
         LeadContextGauge gauge = new LeadContextGauge();
-        LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude");
+        LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude", null);
         assertEquals(LeadContextGauge.State.UNKNOWN, reading.state(),
                 "every line unparseable is the real format-change signal and must still report UNKNOWN");
         assertNull(reading.tokens());
@@ -224,12 +224,12 @@ class LeadContextGaugeTest {
         AtomicLong now = new AtomicLong(0);
         LeadContextGauge gauge = new LeadContextGauge(now::get, 5_000);
 
-        gauge.read(configDir, SESSION_ID, "claude");
-        gauge.read(configDir, SESSION_ID, "claude"); // still inside the TTL window
+        gauge.read(configDir, SESSION_ID, "claude", null);
+        gauge.read(configDir, SESSION_ID, "claude", null); // still inside the TTL window
         assertEquals(1, gauge.diskReadCount(), "two reads inside the TTL must touch disk once");
 
         now.set(6_000); // past the TTL
-        gauge.read(configDir, SESSION_ID, "claude");
+        gauge.read(configDir, SESSION_ID, "claude", null);
         assertEquals(2, gauge.diskReadCount(), "a read past the TTL must touch disk again");
     }
 
@@ -241,8 +241,8 @@ class LeadContextGaugeTest {
         String configDir = writeTranscript(tmp, SESSION_ID, usageLine(1_000, 0, 0));
         LeadContextGauge gauge = new LeadContextGauge();
 
-        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, SESSION_ID, "opencode").state());
-        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, SESSION_ID, null).state());
-        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, null, "claude").state());
+        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, SESSION_ID, "opencode", null).state());
+        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, SESSION_ID, null, null).state());
+        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, null, "claude", null).state());
     }
 }

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpLeadContextGaugeWiringTest.java

@@ -86,7 +86,7 @@ class FleetMcpLeadContextGaugeWiringTest {
         LeadContextGauge contextGauge = new LeadContextGauge();
         AtomicReference<String> configuredDir = new AtomicReference<>(dirA.toString());
         FleetMcp.LeadConfigDirSource source = new FleetMcp.LeadConfigDirSource(name ->
-                LEAD_NAME.equals(name) ? configuredDir.get() : null);
+                LEAD_NAME.equals(name) ? configuredDir.get() : null, _ -> null);
 
         String firstRead = textOf(listFleet(herdr, sessions, contextGauge, source));
         assertTrue(firstRead.contains("\"tokens\":11000"),

scripts/config-edit.sh

@@ -2,6 +2,10 @@
 #
 # The one auditable way to edit the live fleetd.yaml.
 #
+# `--set` uses yq and rewrites the whole YAML document in yq's output style. Use `--from` for a
+# candidate whose comment alignment or other formatting carries meaning: it copies that file
+# verbatim while keeping this script's backup, parse check, atomic install, and verdict read-back.
+#
 # fleetd ticket #635 — why this exists at all: fleetd.yaml is gitignored and holds the live
 # fleet's settings. A bad raw edit reaches a daemon that is already serving, so a direct `Edit`
 # on it is refused by policy. This script is the allow-listed alternative, and it is not just
@@ -46,6 +50,11 @@
 #   scripts/config-edit.sh --dry-run --set <yq-path>=<value>
 #   scripts/config-edit.sh --restore
 #
+# `--set` rewrites the whole file in yq's output style, not only the requested keys. The script
+# warns before installation when the candidate changes more lines than its number of --set pairs.
+# Use `--from <candidate.yaml>` when comment alignment or other formatting is meaningful: --from
+# copies the candidate verbatim, with no yq round-trip.
+#
 # `--set .a.b=` (an empty value — a forgotten typo) is REFUSED, not accepted as "clear the
 # field": a null value falls back to its default rather than erroring, which is silent, not
 # safe. To clear a key on purpose, write a literal null: `--set .a.b=null`. Every other value
@@ -154,18 +163,10 @@ done
 # story: a YAML block scalar (`|`, `|-`, `>`, `>-`, ...) puts the VALUE on the lines that follow
 # the key, each indented deeper than it. The key-name match above only ever sees the key line
 # itself, so those continuation lines used to flow straight through unredacted while the key line
-# right above them printed a reassuring "<redacted>" — an incomplete redactor that looks complete
-# is worse than one that visibly does nothing, because it stops a reviewer from looking further.
-# The fix is structural, not another name to match: once a key line is masked, every following
-# line indented STRICTLY DEEPER than that key is masked too, by indentation alone, until the
-# indentation returns to the key's own level or shallower. This needs no knowledge of the key's
-# name, so it covers a block scalar under any masked key — but ONLY while that key's own line is
-# itself inside the hunk being printed. `diff -u` prints just three lines of context, so a block
-# scalar's body often reaches this function with its key line left out; there is then nothing to
-# anchor to, `masked` is never set, and the body prints in full. A blank line inside a block
-# scalar loses the anchor the same way, because a blank diff line measures as indent 0. Both are
-# measured and filed as fleetd #639 — do not read this paragraph as a guarantee that a masked
-# key's value can never be printed.
+# right above them printed a reassuring "<redacted>". The redactor maps masked continuation lines
+# from each complete file before it reads the diff. It then masks a printed line when that file
+# line is inside a masked key's value. This covers block-scalar bodies even when the key line is
+# outside the printed hunk, and it keeps blank lines inside the value masked.
 #
 # `redact` is always fed `diff -u` output, and every line of a unified diff starts with exactly
 # one of ' ', '+', '-' (the three body markers; '@'/'-'/'+' for the three header-line kinds too).
@@ -174,37 +175,102 @@ done
 # column shallower than it really is, and either wrongly escapes a continuation mask or wrongly
 # ends one early. Tabs are out of scope: YAML forbids them for indentation, and this is a bounded
 # fix, not a YAML parser.
+map_masked_lines() {
+  local file="$1" side="$2" line content indent lead key line_number=0
+  local masked=0 masked_indent=0
+
+  case "$side" in
+    old) OLD_MASKED_LINES=() ;;
+    new) NEW_MASKED_LINES=() ;;
+    *) die "internal error: unknown redaction map side $side" ;;
+  esac
+
+  while IFS= read -r line || [ -n "$line" ]; do
+    line_number=$((line_number + 1))
+    content="$line"
+    indent=0
+    while [ "${content:$indent:1}" = " " ]; do indent=$((indent + 1)); done
+
+    if [ "$masked" = 1 ]; then
+      if [ -z "${content// /}" ] || [ "$indent" -gt "$masked_indent" ]; then
+        case "$side" in
+          old) OLD_MASKED_LINES[$line_number]=1 ;;
+          new) NEW_MASKED_LINES[$line_number]=1 ;;
+        esac
+        continue
+      fi
+      masked=0
+    fi
+
+    if [[ "$content" =~ ^([[:space:]]*)([A-Za-z0-9_.-]+:) ]]; then
+      lead="${BASH_REMATCH[1]}"
+      key="${BASH_REMATCH[2]}"
+      if [[ "$key" =~ (TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|CREDENTIAL|URI|_KEY) ]]; then
+        masked=1
+        masked_indent="$indent"
+      fi
+    fi
+  done < "$file"
+}
+
 redact() {
-  local line prefix content indent lead key
-  local masked=0 masked_indent=0 saved_nocasematch=0
+  local old_file="$1" new_file="$2"
+  local line prefix content indent lead key old_line=0 new_line=0 in_hunk=0
+  local old_masked new_masked saved_nocasematch=0
   shopt -q nocasematch && saved_nocasematch=1
   shopt -s nocasematch
-  sed -E 's#://[^@]*@#://<redacted>@#g' | while IFS= read -r line || [ -n "$line" ]; do
+
+  map_masked_lines "$old_file" old
+  map_masked_lines "$new_file" new
+
+  while IFS= read -r line || [ -n "$line" ]; do
+    if [[ "$line" =~ ^@@\ -([0-9]+)(,([0-9]+))?\ \+([0-9]+)(,([0-9]+))?\ @@ ]]; then
+      old_line="${BASH_REMATCH[1]}"
+      new_line="${BASH_REMATCH[4]}"
+      in_hunk=1
+      printf '%s\n' "$line"
+      continue
+    fi
+
     case "$line" in
       [\ +-]*) prefix="${line:0:1}"; content="${line:1}" ;;
       *)       prefix="";            content="$line" ;;
     esac
 
+    old_masked=0
+    new_masked=0
+    if [ "$in_hunk" = 1 ]; then
+      case "$prefix" in
+        ' ')
+          [ "${OLD_MASKED_LINES[$old_line]:-}" = 1 ] && old_masked=1
+          [ "${NEW_MASKED_LINES[$new_line]:-}" = 1 ] && new_masked=1
+          old_line=$((old_line + 1)); new_line=$((new_line + 1)) ;;
+        -)
+          [ "${OLD_MASKED_LINES[$old_line]:-}" = 1 ] && old_masked=1
+          old_line=$((old_line + 1)) ;;
+        +)
+          [ "${NEW_MASKED_LINES[$new_line]:-}" = 1 ] && new_masked=1
+          new_line=$((new_line + 1)) ;;
+      esac
+    fi
+
     indent=0
     while [ "${content:$indent:1}" = " " ]; do indent=$((indent + 1)); done
 
-    if [ "$masked" = 1 ] && [ "$indent" -gt "$masked_indent" ]; then
+    if [ "$old_masked" = 1 ] || [ "$new_masked" = 1 ]; then
       printf '%s%*s<redacted>\n' "$prefix" "$indent" ""
       continue
     fi
-    masked=0
 
     if [[ "$content" =~ ^([[:space:]]*)([A-Za-z0-9_.-]+:) ]]; then
       lead="${BASH_REMATCH[1]}"
       key="${BASH_REMATCH[2]}"
       if [[ "$key" =~ (TOKEN|SECRET|PASSWORD|PASSWD|PASSPHRASE|CREDENTIAL|URI|_KEY) ]]; then
         printf '%s%s%s <redacted>\n' "$prefix" "$lead" "$key"
-        masked=1
-        masked_indent="$indent"
         continue
       fi
     fi
-    printf '%s\n' "$line"
+    printf '%s\n' "$line" | sed -E 's#://[^@]*@#://<redacted>@#g'
   done
   [ "$saved_nocasematch" = 1 ] || shopt -u nocasematch
 }
@@ -463,6 +529,50 @@ parse_check() {
   yq eval '.' "$1" >/dev/null 2>&1
 }
 
+# Count logical changed lines in a unified diff. A replacement counts once, while an added or
+# deleted line also counts once. One changed `--set` value normally produces one changed line.
+changed_line_count() {
+  local before="$1" after="$2" line count=0 old_count=0 new_count=0
+  while IFS= read -r line || [ -n "$line" ]; do
+    case "$line" in
+      ---\ *|+++\ *|@@\ *)
+        if [ "$old_count" -gt "$new_count" ]; then
+          count=$((count + old_count))
+        else
+          count=$((count + new_count))
+        fi
+        old_count=0
+        new_count=0
+        ;;
+      -*) old_count=$((old_count + 1)) ;;
+      +*) new_count=$((new_count + 1)) ;;
+      *)
+        if [ "$old_count" -gt "$new_count" ]; then
+          count=$((count + old_count))
+        else
+          count=$((count + new_count))
+        fi
+        old_count=0
+        new_count=0
+        ;;
+    esac
+  done < <(diff -u "$before" "$after" || true)
+  if [ "$old_count" -gt "$new_count" ]; then
+    count=$((count + old_count))
+  else
+    count=$((count + new_count))
+  fi
+  printf '%s' "$count"
+}
+
+warn_set_reformat() {
+  local before="$1" after="$2" changed
+  changed="$(changed_line_count "$before" "$after")"
+  if [ "$changed" -gt "${#SETS[@]}" ]; then
+    warn "--set changed $changed candidate lines for ${#SETS[@]} pair(s); yq reformatted the whole file. Use --from for meaningful comment alignment or formatting."
+  fi
+}
+
 install_candidate() {
   local cand="$1" live="$2"
   mv -f "$cand" "$live"
@@ -624,10 +734,14 @@ run_edit() {
   fi
   ok "candidate parses"
 
+  if [ "$MODE" = "set" ]; then
+    warn_set_reformat "$backup" "$cand"
+  fi
+
   apply_mode "$cand" "$orig_mode"
 
   say "change (redacted)"
-  diff -u "$backup" "$cand" | redact || true
+  diff -u "$backup" "$cand" | redact "$backup" "$cand" || true
 
   say "install"
   install_candidate "$cand" "$CONFIG" \
@@ -655,8 +769,11 @@ dry_run_diff() {
     rm -f "$cand"; CAND=""
     die "candidate does not parse as valid YAML — this was a --dry-run, nothing would have been installed either"
   fi
+  if [ "$MODE" = "set" ]; then
+    warn_set_reformat "$CONFIG" "$cand"
+  fi
   say "dry run — diff (redacted), nothing installed"
-  diff -u "$CONFIG" "$cand" | redact || true
+  diff -u "$CONFIG" "$cand" | redact "$CONFIG" "$cand" || true
   rm -f "$cand"; CAND=""
   return 0
 }

scripts/test-config-edit.sh

@@ -474,6 +474,90 @@ test_passphrase_key_is_redacted() {
   assert_not_contains "FAKELEAK-PASSPHRASE" "$RUN_OUTPUT" "passphrase case: the passphrase VALUE must never leak"
 }
 
+# ------------------- acceptance criterion 19: the key line falls outside the printed hunk
+# fleetd #656 — criteria 15a/15b both put the edit right next to the key line, so the key line is
+# always inside diff -u's default 3-line context. Neither covers the actual case #639 fixed: an
+# 8-line block-scalar body with only its SIXTH line changed, so the printed hunk (3 lines of
+# context on each side of the change) covers body lines 3-8 and never includes the "token:" key
+# line at all. The old, line-by-line redact() only ever masks after it has SEEN the key line go
+# past; with the key line outside the hunk it never sets its mask, and the whole body — the
+# changed line included — passes through raw. The control key sits right after the body, inside
+# the same hunk, so the positive control below proves the fix is not simply printing nothing.
+new_fixture_hunk_without_key_line() {
+  local dir
+  dir="$(mktemp -d "$TMP/fixture.XXXXXX")"
+  cat > "$dir/fleetd.yaml" <<'YAML'
+bind:
+  host: 127.0.0.1
+  port: 19999
+broker:
+  uri: amqp://user:hunter2@host/vhost
+auth:
+  token: |
+    SECRET-LINE-1
+    SECRET-LINE-2
+    SECRET-LINE-3
+    SECRET-LINE-4
+    SECRET-LINE-5
+    SECRET-LINE-6
+    SECRET-LINE-7
+    SECRET-LINE-8
+  control: CTRL-MUST-APPEAR
+profiles:
+  sonnet:
+    weight: 3
+    maxLoad: 5
+YAML
+  : > "$dir/fleetd.out"
+  printf '%s' "$dir"
+}
+
+test_key_line_outside_hunk_is_still_redacted() {
+  local dir
+  dir="$(new_fixture_hunk_without_key_line)"
+  sed 's/SECRET-LINE-6$/SECRET-LINE-6-CHANGED/' "$dir/fleetd.yaml" > "$dir/candidate.yaml"
+
+  start_run "$dir" 5 --from "$dir/candidate.yaml"
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "hunk-without-key-line case reload exit code"
+  # Positive control FIRST: without this, a diff that printed nothing at all would pass the
+  # negative assertion right below identically to a correctly redacted one.
+  assert_contains "CTRL-MUST-APPEAR" "$RUN_OUTPUT" "hunk-without-key-line case: the non-secret control line must still print unmasked"
+  assert_not_contains "SECRET-LINE-6-CHANGED" "$RUN_OUTPUT" "hunk-without-key-line case: the changed body line must never leak, even with the key line outside the printed hunk"
+}
+
+# ------------------------------- acceptance criterion 20: a blank line inside the value
+# fleetd #656 — the old, line-by-line redact() reset its mask on any line whose indentation was
+# not STRICTLY greater than the key's, and a wholly blank line has indentation 0, so it reset the
+# mask exactly like the "control:" line that legitimately ends the block scalar. Everything after
+# the blank line then printed raw. The current fix tracks masked lines by FILE line number instead
+# of by indentation seen so far, so a blank line inside the value stays masked.
+new_fixture_blank_line_in_value() {
+  local dir
+  dir="$(mktemp -d "$TMP/fixture.XXXXXX")"
+  printf 'bind:\n  host: 127.0.0.1\n  port: 19999\nbroker:\n  uri: amqp://user:hunter2@host/vhost\nauth:\n  token: |\n    LEAK-BEFORE-BLANK\n\n    LEAK-AFTER-BLANK\n  control: CTRL-MUST-APPEAR\nprofiles:\n  sonnet:\n    weight: 3\n    maxLoad: 5\n' > "$dir/fleetd.yaml"
+  : > "$dir/fleetd.out"
+  printf '%s' "$dir"
+}
+
+test_blank_line_inside_value_is_still_redacted() {
+  local dir
+  dir="$(new_fixture_blank_line_in_value)"
+  sed 's/LEAK-AFTER-BLANK$/LEAK-AFTER-BLANK-CHANGED/' "$dir/fleetd.yaml" > "$dir/candidate.yaml"
+
+  start_run "$dir" 5 --from "$dir/candidate.yaml"
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "blank-line-in-value case reload exit code"
+  assert_contains "CTRL-MUST-APPEAR" "$RUN_OUTPUT" "blank-line-in-value case: the non-secret control line must still print unmasked"
+  assert_not_contains "LEAK-AFTER-BLANK-CHANGED" "$RUN_OUTPUT" "blank-line-in-value case: the line after the blank must never leak"
+}
+
 # ----------------------------------- acceptance criterion 16: a failing --set must not echo value
 # fleetd #635 follow-up (ticket comment 17673, defect 8) — apply_set_pairs used to echo the FULL
 # "$kv" (path=value, exactly as typed) in its yq-failure messages, so a broken --set with a
@@ -545,6 +629,57 @@ test_refusal_shape_from_parse_failure_wording_is_recognised() {
   assert_equals 4 "$RUN_RC" "the parse-failure refusal shape must also exit 4, not be read as silence"
 }
 
+# --set runs yq over the whole candidate. It warns when that changes more lines than the requested
+# pairs, but a simple file with only the intended changed line must stay quiet.
+new_fixture_reformat_sensitive() {
+  local dir
+  dir="$(mktemp -d "$TMP/fixture.XXXXXX")"
+  cat > "$dir/fleetd.yaml" <<'YAML'
+# A section comment that documents the next block.
+bind:
+  host: 127.0.0.1 # Keep this aligned with the port note.
+  port: 19999     # A fixture port.
+
+# These comments use their placement as documentation.
+profiles:
+  sonnet:
+    weight: 3
+    bootstrapText: >-
+      First line.
+      Second line.
+YAML
+  : > "$dir/fleetd.out"
+  printf '%s' "$dir"
+}
+
+test_set_warns_when_yq_reformats_extra_lines() {
+  local dir
+  dir="$(new_fixture_reformat_sensitive)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.weight=4'
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "reformat warning case reload exit code"
+  assert_contains "yq reformatted the whole file" "$RUN_OUTPUT" \
+    "a --set that changes extra candidate lines must warn before installation"
+}
+
+test_set_stays_quiet_without_formatting_churn() {
+  local dir
+  dir="$(new_fixture)"
+
+  start_run "$dir" 5 --set '.profiles.sonnet.weight=4'
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "no-reformat warning case reload exit code"
+  assert_not_contains "yq reformatted the whole file" "$RUN_OUTPUT" \
+    "a --set that changes only its requested candidate line must not warn"
+}
+
 echo "== acceptance criterion 1: refusal restores byte for byte =="
 test_refusal_restores_byte_for_byte
 echo "== acceptance criterion 2: clean reload keeps the edit =="
@@ -573,6 +708,10 @@ echo "== acceptance criterion 15a: a block scalar's continuation lines are redac
 test_block_scalar_continuation_is_redacted
 echo "== acceptance criterion 15b: a passphrase key is also recognised =="
 test_passphrase_key_is_redacted
+echo "== acceptance criterion 19: the key line falls outside the printed hunk =="
+test_key_line_outside_hunk_is_still_redacted
+echo "== acceptance criterion 20: a blank line inside the value =="
+test_blank_line_inside_value_is_still_redacted
 echo "== acceptance criterion 16: a failing --set must not echo its value =="
 test_failing_set_does_not_echo_its_value
 echo "== extra: dry-run never installs, and redacts =="
@@ -581,5 +720,9 @@ echo "== extra: --check is read-only and always exits 0 =="
 test_check_is_read_only_and_exits_zero
 echo "== extra: the parse-failure refusal shape is also recognised =="
 test_refusal_shape_from_parse_failure_wording_is_recognised
+echo "== acceptance criterion 17: --set warns about yq formatting churn =="
+test_set_warns_when_yq_reformats_extra_lines
+echo "== acceptance criterion 18: --set stays quiet without formatting churn =="
+test_set_stays_quiet_without_formatting_churn
 
 printf 'PASS: config-edit acceptance criteria\n'