fleetd #668: add the missing validateLeadRollover reachability case

validateAllReachesEveryOneOfTodaysRealValidators now exercises all
eight FleetConfig validators through validateAll(), not seven -
adding a minimal leadRollover: block with no handoverPath as the
eighth fixture. The canary's failure message in
fleetConfigDeclaresExactlyTheseValidatorsToday now also points the
reader at the reachability enumeration, since updating the expected
set alone does not prove validateAll() reaches a newly added
validator.

.claude/skills/redeploy-fleetd/SKILL.md

@@ -26,9 +26,15 @@ scripts/redeploy-fleetd.sh --no-build # restart the jar already on disk
 when you just built and nothing changed since. It gives up the protection in the next paragraph: no
 build runs, so a stale or missing jar is not caught early. The script still checks the file is there
 and dies with `no jar at … — run without --no-build` if it is not, but it cannot tell you the jar is
-old. A `mvn clean` in the tree deletes that jar while the daemon keeps running on it, and nothing
-degrades until the next restart. Run `--check` first: it prints the jar's hash and its modification
-time, so you can see for yourself whether the jar is missing or older than the code you mean to ship.
+old. Any build that writes `fleetd/target/fleetd.jar` while the daemon runs, including `mvn install`
+with or without `clean`, breaks that daemon's shutdown drain. The drain loads its classes lazily at
+shutdown from the jar file the JVM opened at boot. Deleting is not the only hazard; replacing the jar
+is enough. Nothing warns at the time. The damage appears at the next restart, where it looks like the
+restart's fault. Verify a merge by building in a throwaway git worktree. Let only
+`scripts/redeploy-fleetd.sh` touch the main clone's jar. Its stage-then-swap protects its own build,
+but it cannot undo a replacement that already happened. Run `--check` first: it prints the jar's hash
+and its modification time, so you can see for yourself whether the jar is missing or older than the
+code you mean to ship.
 
 It builds before it stops anything, so a failed build never leaves the fleet down; it waits for the
 old process to exit rather than assuming; it polls `/healthz`; and it anchors its log checks to a

CLAUDE.md

@@ -323,6 +323,12 @@ must obey belongs in the charter, not here.
   reference**, with the intent→tool table above as the short form. `McpContractDocTest` fails if
   that page names a `fleet_*` tool the server does not register. The flows are kept out of this
   file because this file loads into every session's context.
+- **Never build into the main clone while `fleetd` runs.** Any build that writes
+  `fleetd/target/fleetd.jar`, with or without `clean`, breaks the shutdown drain because its classes
+  load lazily from the jar file the JVM opened at boot. Nothing warns at the time. The damage appears
+  at the next restart, where it looks like the restart's fault. Verify merges in a throwaway git
+  worktree. Let only `scripts/redeploy-fleetd.sh` touch the main clone's jar. Its stage-then-swap
+  cannot undo a replacement that already happened.
 
 ### Redeploying the daemon — the lead may do this (primary only)
 

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -1123,17 +1123,12 @@ public final class Fleetd {
      * @param liveLeadTerminals     terminal id → lead name for every CURRENTLY recognised lead
      * @param configDirForLeadName  lead name → {@code configDir}, normally {@link
      *                              #leadConfigDirLookup}'s return
-     */
-    static Function<String, LeadContextGauge.Reading> leadContextLookup(LeadContextGauge gauge, AgentControl agents,
-            Supplier<Map<String, String>> liveLeadTerminals, Function<String, String> configDirForLeadName) {
-        return leadContextLookup(gauge, agents, liveLeadTerminals, configDirForLeadName, _ -> null);
-    }
-
-    /**
-     * As above, additionally resolving each lead's effective auto-compact window (normally {@link
-     * #leadContextWindowLookup}'s return) and passing it through to {@link LeadContextGauge#read},
-     * so the heartbeat's own HIGH reading scales with that lead's real window instead of always the
-     * gauge's fixed fallback.
+     * @param windowForLeadName     lead name → that lead's profile's effective auto-compact window,
+     *                              normally {@link #leadContextWindowLookup}'s return, and passed
+     *                              through to {@link LeadContextGauge#read} so the heartbeat's own
+     *                              HIGH reading scales with that lead's real window, or {@code null}
+     *                              when it cannot be resolved — either way {@link LeadContextGauge}
+     *                              falls back to its own fixed HIGH threshold
      */
     static Function<String, LeadContextGauge.Reading> leadContextLookup(LeadContextGauge gauge, AgentControl agents,
             Supplier<Map<String, String>> liveLeadTerminals, Function<String, String> configDirForLeadName,
@@ -1162,13 +1157,6 @@ public final class Fleetd {
      * factory {@code main} calls, rather than only a lookup nothing in {@code main} is proven to use
      * (see {@code FleetdLeadConfigDirSourceWiringTest}'s javadoc for the measured gap this shape closes).
      */
-    static LeadHeartbeatLoop.LeadContextSource leadContextSource(LeadContextGauge gauge, AgentControl agents,
-            Supplier<Map<String, String>> liveLeadTerminals, Function<String, String> configDirForLeadName) {
-        return new LeadHeartbeatLoop.LeadContextSource(
-                leadContextLookup(gauge, agents, liveLeadTerminals, configDirForLeadName));
-    }
-
-    /** As above, additionally threading the effective-window lookup through. */
     static LeadHeartbeatLoop.LeadContextSource leadContextSource(LeadContextGauge gauge, AgentControl agents,
             Supplier<Map<String, String>> liveLeadTerminals, Function<String, String> configDirForLeadName,
             Function<String, Long> windowForLeadName) {

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -2688,9 +2688,10 @@ public record FleetConfig(
      * tab labels — every member gets one rendered into its tab. Choose a lead {@code tabPrefix} that
      * a member template matches and the daemon starts labelling its own members as leads, promoting
      * the entire fleet to {@link dev.ltms.fleet.auth.Role#PRIMARY} with no message and no diff.
-     * The member-space exclusion in {@link dev.ltms.fleet.herdr.LeadTabScanner} already blocks the
-     * realistic path, but defence that depends on one workspace label holding is not defence enough
-     * for a privilege boundary.
+     * {@link #validatePanePlacementAgainstLeadTabs()} is the check that stops a pane-placed member
+     * from landing inside a lead's tab in the first place; this check is a second, independent
+     * guard that catches the hazard even when every profile places members correctly, by refusing
+     * a label that a scan would still misread as a lead.
      *
      * <p>CB-557 shrank this check rather than removing it. The default template is
      * {@code "{role}: {profile} #{n}"} and {@code {role}} comes from a closed enum, so a
@@ -2737,6 +2738,45 @@ public record FleetConfig(
                 + "lead tabs cannot be confused.");
     }
 
+    /**
+     * Reject a profile that places its members by {@code "pane"} while any {@code fleet.leaders}
+     * entry names a {@code tab}. A pane-placed member lands inside the focused tab rather than its
+     * own, so it can land inside a lead's own labelled tab. {@link
+     * dev.ltms.fleet.herdr.LeadTabScanner} identifies a lead purely by that tab's label — it does
+     * not exclude the member space — so a member that ends up there would be read back as the lead
+     * and granted spawn/stop/send on the whole fleet.
+     *
+     * <p>Only a leader with a non-blank {@code tab} is in scope: one with no {@code tab} feeds
+     * nothing into {@link dev.ltms.fleet.herdr.LeadTabScanner}, so it creates no hazard here.
+     *
+     * @throws IllegalStateException when any {@code profiles:} entry is pane-placed while any
+     *                               {@code fleet.leaders} entry names a non-blank {@code tab}
+     */
+    public void validatePanePlacementAgainstLeadTabs() {
+        if (fleet == null || fleet.leaders().isEmpty()) {
+            return;
+        }
+        boolean anyLeaderHasTab = fleet.leaders().values().stream()
+                .anyMatch(leader -> leader != null && leader.tab() != null && !leader.tab().isBlank());
+        if (!anyLeaderHasTab) {
+            return;
+        }
+        List<String> bad = new ArrayList<>();
+        profiles().entrySet().stream()
+                .filter(e -> !e.getValue().tabPlacement())
+                .map(Map.Entry::getKey)
+                .sorted()
+                .forEach(bad::add);
+        if (bad.isEmpty()) {
+            return;
+        }
+        throw new IllegalStateException("refusing to start: profile(s) " + bad
+                + " use placement: pane while fleet.leaders names a tab. A pane-placed member can "
+                + "land inside a lead's labelled tab and be read back as the lead, granted "
+                + "spawn/stop/send on the whole fleet. Set placement: tab for each named profile, "
+                + "or remove the tab from every fleet.leaders entry.");
+    }
+
     /**
      * Reject a present {@code leadRollover:} block with no (or a blank) {@code handoverPath}
      * (fleetd #480). There is no sane non-null default for an operator-specific file path, unlike
@@ -2937,11 +2977,11 @@ public record FleetConfig(
      * Runs every validator this class declares — found by reflection, not by name.
      *
      * <p>fleetd ticket "central allow-list of usable models", follow-up: mutation testing found
-     * that although each of the six validators above was well pinned on its own, nothing proved
+     * that although each validator above was well pinned on its own, nothing proved
      * either real caller ({@code Fleetd.main} and {@link ConfigRef#reload()}) still
-     * invoked it — deleting a call site left the full suite green. The fix is not a seventh test
-     * per caller; a hand-maintained list of six names here would have the exact same defect its
-     * own javadoc would warn against: the seventh validator someone adds next month has no reason
+     * invoked it — deleting a call site left the full suite green. The fix is not one more test
+     * per caller; a hand-maintained list of names here would have the exact same defect its
+     * own javadoc would warn against: the next validator someone adds has no reason
      * to be added to it. So this method does not name any validator. It sweeps {@link
      * #getClass()}'s own public, no-argument, {@code void} methods whose name starts with {@code
      * "validate"} (excluding itself) and invokes every one it finds, via {@link
@@ -2950,7 +2990,7 @@ public record FleetConfig(
      * which it silently never runs.
      *
      * <p>{@code Fleetd.main} and {@link ConfigRef#reload()} each call this one method instead of
-     * the six individually — see the comments at those two call sites for why
+     * each validator individually — see the comments at those two call sites for why
      * each must run it.
      *
      * <p>Methods run in a fixed (alphabetical) order, so a config with more than one violation
@@ -2967,9 +3007,9 @@ public record FleetConfig(
     /**
      * The reflective sweep behind {@link #validateAll()}, kept as its own method — taking any
      * {@code target}, not just {@code this} — so a test can prove the MECHANISM is generic (it
-     * would sweep a seventh {@code validateXxx()} method added to any class, not just something
-     * special-cased to today's six on {@link FleetConfig}) without needing to add a real, unwanted
-     * seventh validator to this class just to exercise that claim. See {@code
+     * would sweep any new {@code validateXxx()} method added to any class, not just something
+     * special-cased to the set {@link FleetConfig} declares today) without needing to add a real,
+     * unwanted extra validator to this class just to exercise that claim. See {@code
      * FleetConfigValidateAllTest} for that proof.
      *
      * @param target an object whose public, no-argument, {@code void} methods named {@code

fleetd/src/main/java/dev/ltms/fleet/herdr/LeadTabScanner.java

@@ -37,8 +37,11 @@ import java.util.function.Supplier;
  * <p><strong>Direction of trust.</strong> The label names the lead; it never <em>grants</em>
  * anything a pane could take for itself. Three properties keep that honest:
  * <ol>
- *   <li>Worker spaces are excluded wholesale ({@code excludedWorkspaceLabels}), so a worker cannot
- *       become a lead by being placed — as a split, say — inside a matching tab.</li>
+ *   <li>{@code excludedWorkspaceLabels} can filter a workspace out of the scan, but this class does
+ *       not by itself stop a worker from landing inside a matching tab — a caller may pass an empty
+ *       set, and the daemon does. The guard against that is {@code
+ *       FleetConfig.validatePanePlacementAgainstLeadTabs}: it refuses, at startup, any profile that
+ *       places members by pane while a lead names a tab.</li>
  *   <li>A worker cannot rename a tab: {@code tab.rename} is reachable only through
  *       {@link WorkspaceControl}, which no {@code fleet_*} tool exposes. The label is writable by
  *       the human at the terminal and by nobody the bridge is defending against.</li>

fleetd/src/main/java/dev/ltms/fleet/lead/LeadContextGauge.java

@@ -172,12 +172,6 @@ public final class LeadContextGauge {
      *                  {@code "claude"} (including {@code null}, meaning undetected) reports
      *                  {@link State#UNKNOWN} — this reader only understands Claude Code's own
      *                  transcript format
-     */
-    public Reading read(String configDir, String sessionId, String agentType) {
-        return read(configDir, sessionId, agentType, null);
-    }
-
-    /**
      * @param effectiveWindowTokens the caller's resolved effective auto-compact window for this
      *                              lead's own profile, or {@code null} when it cannot be resolved.
      *                              HIGH fires at {@link #HIGH_THRESHOLD_FRACTION} of this value;

fleetd/src/main/java/dev/ltms/fleet/lead/LeadLauncher.java

@@ -201,8 +201,8 @@ public final class LeadLauncher {
     /**
      * How many live leads exist per configured name, and which of that name's labelled tabs are
      * <em>not</em> live: a running agent in a tab labelled with that lead's exact {@code tab}
-     * (CB-579). Member workspaces are excluded, exactly as the scanner excludes them: a member must
-     * not be counted as a lead because it happens to sit in a matching tab.
+     * (CB-579). A member sitting in the same shared workspace is not counted as a lead because its
+     * tab carries a different label, not because any workspace is excluded from this count.
      *
      * <p>There used to be a second path here — a running agent on the terminal a
      * {@code fleet.leaders.<name>.terminal} pin named, for a lead opened and pinned by hand. That

fleetd/src/main/java/dev/ltms/fleet/mcp/FleetMcp.java

@@ -293,14 +293,6 @@ public final class FleetMcp {
     public record LeadConfigDirSource(Function<String, String> configDirFor, Function<String, Long> windowFor) {
         /** Inert source — every lead reads {@link LeadContextGauge}'s built-in defaults. */
         public static LeadConfigDirSource none() { return new LeadConfigDirSource(_ -> null, _ -> null); }
-
-        /**
-         * Constructor that resolves no window — every lead this source answers for keeps
-         * {@link LeadContextGauge}'s fixed HIGH threshold.
-         */
-        public LeadConfigDirSource(Function<String, String> configDirFor) {
-            this(configDirFor, _ -> null);
-        }
     }
 
     /**

fleetd/src/test/java/dev/ltms/fleet/FleetdAssemblyLeadTabScannerExclusionTest.java

@@ -0,0 +1,201 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.herdr.LeadTabScanner;
+import dev.ltms.fleet.msg.LeadChannelHandle;
+import dev.ltms.fleet.msg.LeadCoordLoop;
+import dev.ltms.fleet.msg.LeadMessage;
+import dev.ltms.fleet.msg.ReplyInbox;
+import io.javalin.Javalin;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.lang.reflect.Field;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.function.LongSupplier;
+import java.util.function.Supplier;
+
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #670 — pins the {@code excludedWorkspaceLabels} argument {@link FleetdAssembly}'s
+ * production boot path passes to {@link LeadTabScanner} at {@code FleetdAssembly.java:265}
+ * ({@code Set.of()}).
+ *
+ * <p>{@code LeadTabScannerTest} already covers this constructor parameter, but it builds its own
+ * {@link LeadTabScanner} with its own set, so it tests the seam and proves nothing about the
+ * producer. This test instead reaches the exact object {@link FleetdAssembly#assembleAndStart}
+ * builds: a {@code fleet.leaders:} block makes the assembly construct a real
+ * {@link LeadTabScanner} for its local {@code leads} supplier, and a {@code coordinator:} block
+ * makes it hand that same supplier instance to {@link LeadCoordLoop} (fleetd #637), which stores
+ * it as a field. Reflection recovers it from there, and then from the scanner itself, so the
+ * assertion is against the real production argument rather than a copy built for this test.
+ */
+class FleetdAssemblyLeadTabScannerExclusionTest {
+
+    private static final class FakeLeadChannel implements LeadChannelHandle {
+        @Override
+        public void publish(String toCoordId, LeadMessage message) {
+        }
+
+        @Override
+        public List<LeadMessage> peek() {
+            return List.of();
+        }
+
+        @Override
+        public void ack(String msgId) {
+        }
+
+        @Override
+        public String selfCoordId() {
+            return "test-lead";
+        }
+
+        @Override
+        public boolean heldDurable() {
+            return true;
+        }
+
+        @Override
+        public MailboxState inspect(String coordId) {
+            return MailboxState.unknown(coordId);
+        }
+
+        @Override
+        public void close() {
+        }
+    }
+
+    private static final class TestResourcePorts implements ResourcePorts {
+        final FakeHerdr herdr = new FakeHerdr();
+        Runnable shutdownHook;
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of();
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> new ReplyInbox() {
+                @Override public void own(String target) { }
+                @Override public void release(String target) { }
+                @Override public void publish(String target, String msgId, String content) { }
+                @Override public List<InboxMessage> peek(String target) { return List.of(); }
+                @Override public boolean ack(String target, String msgId) { return false; }
+            };
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> new FakeLeadChannel();
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+            shutdownHook = hook;
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+            // Do not bind a real port in this assembly test.
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            return () -> {
+                throw new UnsupportedOperationException("FakeHerdr is healthy; no poll wait is expected");
+            };
+        }
+    }
+
+    private static FleetConfig writeConfig(Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                idleSleepGuard:
+                  enabled: false
+                coordinator:
+                  uri: "amqp://fake-lead-broker/vh"
+                  selfId: "test-lead"
+                fleet:
+                  leaders:
+                    primary:
+                      tab: "lead: primary"
+                      profile: sonnet
+                profiles:
+                  sonnet:
+                    subscription: true
+                    argv: ["ccs", "sonnet"]
+                """);
+        return FleetConfig.load(file);
+    }
+
+    @Test
+    void productionBootPathPassesNoExcludedWorkspaceLabels(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir);
+        TestResourcePorts ports = new TestResourcePorts();
+        FleetdRuntime runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg,
+                new ConfigRef(dir.resolve("fleetd.yaml"), cfg), new SubscriptionGuard(cfg.guard().hostSet())), ports);
+        try {
+            LeadCoordLoop coordLoop = runtime.leadCoordLoop();
+            assertNotNull(coordLoop, "control: a configured coordinator: block must build LeadCoordLoop");
+
+            Field leadsField = LeadCoordLoop.class.getDeclaredField("leads");
+            leadsField.setAccessible(true);
+            @SuppressWarnings("unchecked")
+            Supplier<Map<String, String>> leads = (Supplier<Map<String, String>>) leadsField.get(coordLoop);
+
+            assertInstanceOf(LeadTabScanner.class, leads,
+                    "control: a non-empty fleet.leaders: block must make FleetdAssembly build a real "
+                            + "LeadTabScanner for its `leads` supplier, not the Map::of fallback — "
+                            + "otherwise this test would pass for the wrong reason");
+
+            Field excludedField = LeadTabScanner.class.getDeclaredField("excludedWorkspaceLabels");
+            excludedField.setAccessible(true);
+            Set<?> excluded = (Set<?>) excludedField.get(leads);
+
+            assertTrue(excluded.isEmpty(),
+                    "FleetdAssembly.java:265 must pass an empty excludedWorkspaceLabels to "
+                            + "LeadTabScanner — scanning member tabs would demote the lead to a worker");
+        } finally {
+            assertNotNull(ports.shutdownHook, "control: assembly must capture its shutdown hook");
+            ports.shutdownHook.run();
+        }
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadContextLookupTest.java

@@ -99,7 +99,7 @@ class FleetdLeadContextLookupTest {
     @DisplayName("an unrecognised terminal resolves to UNKNOWN, not a thrown exception")
     void unrecognisedTerminalResolvesToUnknown() {
         Function<String, LeadContextGauge.Reading> lookup = Fleetd.leadContextLookup(
-                new LeadContextGauge(), throwingAgentControl(), Map::of, name -> null);
+                new LeadContextGauge(), throwingAgentControl(), Map::of, name -> null, name -> null);
 
         LeadContextGauge.Reading reading = assertDoesNotThrow(() -> lookup.apply("ghost-terminal"));
 
@@ -112,7 +112,7 @@ class FleetdLeadContextLookupTest {
     void agentsGetThrowingDegradesToUnknown() {
         Map<String, String> liveLeadTerminals = Map.of(LEAD_TERMINAL, LEAD_NAME);
         Function<String, LeadContextGauge.Reading> lookup = Fleetd.leadContextLookup(
-                new LeadContextGauge(), throwingAgentControl(), () -> liveLeadTerminals, name -> null);
+                new LeadContextGauge(), throwingAgentControl(), () -> liveLeadTerminals, name -> null, name -> null);
 
         LeadContextGauge.Reading reading = assertDoesNotThrow(() -> lookup.apply(LEAD_TERMINAL));
 
@@ -128,7 +128,7 @@ class FleetdLeadContextLookupTest {
         AgentControl agents = agentControlStub(SESSION_ID, "claude", "idle");
         Function<String, LeadContextGauge.Reading> lookup = Fleetd.leadContextLookup(
                 new LeadContextGauge(), agents, () -> liveLeadTerminals,
-                name -> LEAD_NAME.equals(name) ? tmp.toString() : null);
+                name -> LEAD_NAME.equals(name) ? tmp.toString() : null, name -> null);
 
         LeadContextGauge.Reading reading = lookup.apply(LEAD_TERMINAL);
 
@@ -146,7 +146,7 @@ class FleetdLeadContextLookupTest {
         AgentControl agents = agentControlStub(SESSION_ID, "opencode", "idle");
         Function<String, LeadContextGauge.Reading> lookup = Fleetd.leadContextLookup(
                 new LeadContextGauge(), agents, () -> liveLeadTerminals,
-                name -> LEAD_NAME.equals(name) ? tmp.toString() : null);
+                name -> LEAD_NAME.equals(name) ? tmp.toString() : null, name -> null);
 
         LeadContextGauge.Reading reading = lookup.apply(LEAD_TERMINAL);
 

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadContextSourceWindowAssemblyTest.java

@@ -0,0 +1,223 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.lead.LeadContextGauge;
+import dev.ltms.fleet.msg.LeadHeartbeatLoop;
+import dev.ltms.fleet.msg.ReplyInbox;
+import io.javalin.Javalin;
+import org.junit.jupiter.api.DisplayName;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.io.IOException;
+import java.lang.reflect.Field;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.function.LongSupplier;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * fleetd #659: {@code FleetdAssembly.java} wires {@code Fleetd.leadContextSource}'s window-lookup
+ * argument with {@code Fleetd.leadContextWindowLookup(() -> config.get().profiles(), leaders)} —
+ * but nothing called the real assembled {@link LeadHeartbeatLoop} far enough to prove that
+ * argument is the one the live heartbeat reads through. Measured: swapping that one call-site
+ * argument for {@code _ -> null} compiles with 0 errors and leaves the full suite green.
+ *
+ * <p>This test drives the REAL {@link LeadHeartbeatLoop} the real {@link
+ * FleetdAssembly#assembleAndStart} builds, reached through {@link FleetdRuntime#heartbeat()}, and
+ * reads its private {@code contextSource} field via reflection — the loop exposes no public
+ * accessor for it, the same reason {@link FleetdLeadConfigDirSourceAssemblyTest} reflects on
+ * {@code FleetMcp.leadConfigDirs}. The configured profile's {@code autoCompactWindow: 100000}
+ * resolves a HIGH threshold of {@code 66666} ({@link LeadContextGauge}'s {@code 2/3} fraction) —
+ * far below the fixed {@code 200000} fallback a lost window argument would silently revert to.
+ * {@code 90000} live tokens sits between the two: HIGH under the real window, OK under the
+ * fallback — a property the fallback can never produce by accident.
+ */
+class FleetdLeadContextSourceWindowAssemblyTest {
+
+    private static final String LEAD_NAME = "opus";
+    private static final String LEAD_TAB = "lead: opus";
+    private static final String LEAD_PROFILE = "sonnet";
+    /** {@code FakeHerdr}'s own default {@code agent.list} entry: terminal {@code term_a}, session {@code sess-1111}. */
+    private static final String LEAD_TERMINAL = "term_a";
+    private static final String LEAD_SESSION_ID = "sess-1111";
+
+    private static final class RecordingResourcePorts implements ResourcePorts {
+
+        final FakeHerdr herdr = new FakeHerdr();
+        final SentinelReplyInbox replyInbox = new SentinelReplyInbox();
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of();
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> replyInbox;
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> {
+                throw new UnsupportedOperationException(
+                        "leadMailboxOpener must not be called — no coordinator: block is configured");
+            };
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            // Never invoked: this test's FakeHerdr answers immediately, so awaitHerdr never polls.
+            return () -> {
+                throw new UnsupportedOperationException("herdrPollWait must not be called — herdr is healthy");
+            };
+        }
+    }
+
+    private static final class SentinelReplyInbox implements ReplyInbox, AutoCloseable {
+        @Override
+        public void own(String target) {
+        }
+
+        @Override
+        public void release(String target) {
+        }
+
+        @Override
+        public void publish(String target, String msgId, String content) {
+        }
+
+        @Override
+        public List<InboxMessage> peek(String target) {
+            return List.of();
+        }
+
+        @Override
+        public boolean ack(String target, String msgId) {
+            return false;
+        }
+
+        @Override
+        public void close() {
+        }
+    }
+
+    private static String usageLine(long tokens) {
+        return "{\"type\":\"assistant\",\"message\":{\"role\":\"assistant\",\"usage\":{"
+                + "\"input_tokens\":" + tokens + ",\"cache_read_input_tokens\":0,\"cache_creation_input_tokens\":0}}}";
+    }
+
+    /** Lays out {@code <configDir>/projects/<anySlug>/<sessionId>.jsonl} carrying one usage record. */
+    private static void writeTranscript(Path configDir, String sessionId, long tokens) throws IOException {
+        Path projectDir = configDir.resolve("projects").resolve("some-project-slug");
+        Files.createDirectories(projectDir);
+        Files.writeString(projectDir.resolve(sessionId + ".jsonl"), usageLine(tokens) + "\n", StandardCharsets.UTF_8);
+    }
+
+    private static FleetConfig writeConfig(Path dir, String configDir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                idleSleepGuard:
+                  enabled: false
+                broker:
+                  uri: "amqp://fake-test-broker/vh"
+                leadHeartbeat:
+                  idleAfterSeconds: 600
+                  backoffMs: 15000
+                  quietNudgeCap: 5
+                fleet:
+                  leaders:
+                    %s:
+                      tab: "%s"
+                      profile: %s
+                profiles:
+                  %s:
+                    subscription: true
+                    argv: ["ccs", "sonnet"]
+                    configDir: "%s"
+                    autoCompactWindow: 100000
+                """.formatted(LEAD_NAME, LEAD_TAB, LEAD_PROFILE, LEAD_PROFILE, configDir));
+        return FleetConfig.load(f);
+    }
+
+    @SuppressWarnings("unchecked")
+    private static LeadHeartbeatLoop.LeadContextSource contextSourceOf(LeadHeartbeatLoop heartbeat) throws Exception {
+        Field field = LeadHeartbeatLoop.class.getDeclaredField("contextSource");
+        field.setAccessible(true);
+        return (LeadHeartbeatLoop.LeadContextSource) field.get(heartbeat);
+    }
+
+    @Test
+    @DisplayName("[BEHAVIOURAL] the real assembled heartbeat loop resolves HIGH against the lead's "
+            + "REAL configured window, not the fixed 200000 fallback a lost window argument reverts to")
+    void assembledHeartbeatContextSourceResolvesTheRealConfiguredWindow(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir, dir.toString());
+        writeTranscript(dir, LEAD_SESSION_ID, 90_000);
+        ConfigRef config = new ConfigRef(dir.resolve("fleetd.yaml"), cfg);
+        SubscriptionGuard guard = new SubscriptionGuard(cfg.guard().hostSet());
+        RecordingResourcePorts ports = new RecordingResourcePorts();
+        // Label FakeHerdr's own default pane's tab (term_a / w2:p7 / w2:t7, already carrying a live
+        // agent on session sess-1111) to match fleet.leaders.opus.tab exactly, so LeadTabScanner
+        // recognises it as the live "opus" lead without a second auto-launched pane.
+        ports.herdr.withTab("w2", "w2:t7", LEAD_TAB).agentSessionId(LEAD_SESSION_ID);
+
+        FleetdRuntime runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg, config, guard), ports);
+        try {
+            LeadHeartbeatLoop.LeadContextSource source = contextSourceOf(runtime.heartbeat());
+
+            LeadContextGauge.Reading reading = source.readingFor().apply(LEAD_TERMINAL);
+
+            assertEquals(LeadContextGauge.State.HIGH, reading.state(),
+                    "profiles." + LEAD_PROFILE + ".autoCompactWindow: 100000 resolves a HIGH threshold "
+                            + "of 66666 tokens — 90000 live tokens must read HIGH against it. Mutating "
+                            + "FleetdAssembly's window-lookup argument to `_ -> null` falls back to the "
+                            + "fixed 200000 threshold, under which 90000 reads OK instead: " + reading);
+        } finally {
+            // Surefire runs the whole suite in one JVM fork (fleetd/pom.xml sets no forkCount /
+            // reuseForks), so the scheduler/loops this assembly starts must be torn down here, on the
+            // failure path too — hence try/finally rather than a bare statement at the end.
+            runtime.close();
+        }
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/FleetdLeadContextSourceWiringTest.java

@@ -87,7 +87,8 @@ class FleetdLeadContextSourceWiringTest {
         Map<String, String> liveLeadTerminals = Map.of(LEAD_TERMINAL, LEAD_NAME);
 
         LeadHeartbeatLoop.LeadContextSource source = Fleetd.leadContextSource(new LeadContextGauge(),
-                agentControlStub(), () -> liveLeadTerminals, name -> LEAD_NAME.equals(name) ? tmp.toString() : null);
+                agentControlStub(), () -> liveLeadTerminals,
+                name -> LEAD_NAME.equals(name) ? tmp.toString() : null, name -> null);
 
         LeadContextGauge.Reading reading = source.readingFor().apply(LEAD_TERMINAL);
 
@@ -101,7 +102,7 @@ class FleetdLeadContextSourceWiringTest {
     @DisplayName("an unrecognised lead terminal resolves to UNKNOWN, not a thrown exception")
     void unrecognisedTerminalResolvesToUnknown() {
         LeadHeartbeatLoop.LeadContextSource source = Fleetd.leadContextSource(new LeadContextGauge(),
-                agentControlStub(), Map::of, name -> null);
+                agentControlStub(), Map::of, name -> null, name -> null);
 
         assertEquals(LeadContextGauge.State.UNKNOWN, source.readingFor().apply("ghost-terminal").state());
     }

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java

@@ -765,6 +765,92 @@ class FleetConfigTest {
                 "a label that collides with a convention nobody reads is not a problem");
     }
 
+    // ── validatePanePlacementAgainstLeadTabs ────────────────────────────────────────────────────
+
+    /**
+     * The hazard this guard closes: a pane-placed member lands inside the focused tab rather than
+     * its own, so it can land inside a lead's labelled tab and be read back as that lead.
+     */
+    @Test
+    void aPanePlacedProfileWithALeadTabRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("pane-hazard.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class,
+                cfg::validatePanePlacementAgainstLeadTabs);
+        assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
+    }
+
+    @Test
+    void aPanePlacedProfileWithNoLeadTabIsAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("pane-no-tab.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  leaders:
+                    opus:
+                      profile: gx10
+                """);
+
+        assertDoesNotThrow(() -> FleetConfig.load(f).validatePanePlacementAgainstLeadTabs(),
+                "a leader with no tab feeds nothing into the scanner, so pane placement is safe");
+    }
+
+    @Test
+    void aTabPlacedProfileWithALeadTabIsAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("tab-safe.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: tab
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """);
+
+        assertDoesNotThrow(() -> FleetConfig.load(f).validatePanePlacementAgainstLeadTabs(),
+                "a member in its own tab cannot land inside a lead's tab");
+    }
+
+    /** Proves the reflective sweep behind {@code validateAll} really reaches this validator. */
+    @Test
+    void validateAllAlsoRefusesPanePlacementAgainstALeadTab(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("pane-hazard-sweep.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateAll);
+        assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
+    }
+
     // ── CB-530/CB-579: the leaders registry ─────────────────────────────────────────────────────
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigValidateAllTest.java

@@ -42,12 +42,13 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
  *       has right now. This is the proof that a future, real seventh validator on {@link
  *       FleetConfig} would be swept automatically, without needing to add a real (unwanted)
  *       seventh validator just to exercise the claim.</li>
- *   <li>{@link #validateAllReachesEveryOneOfTodaysSixValidators()} proves {@link
+ *   <li>{@link #validateAllReachesEveryOneOfTodaysRealValidators()} proves {@link
  *       FleetConfig#validateAll()} itself is wired to that same generic mechanism and genuinely
- *       reaches each of today's six real validators — reusing the exact minimal failing
- *       configurations {@code FleetConfigTest} already established for each one directly, so a
- *       single call to {@code validateAll()} is shown to reproduce every one of those six
- *       failures.</li>
+ *       reaches every one of today's eight real validators — reusing the exact minimal failing
+ *       configurations {@code FleetConfigTest} already established for each one directly, plus a
+ *       dedicated fixture for {@link FleetConfig#validateLeadRollover()}, which no other test
+ *       drives through {@code validateAll()} — so a single call to {@code validateAll()} is shown
+ *       to reproduce every one of those eight failures.</li>
  * </ol>
  *
  * <p>Together with the direct-{@code Fleetd.main}-invocation tests in {@code
@@ -62,8 +63,8 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
  * the generic sweep — claim 1 proves {@link FleetConfig#invokeAllValidators} is generic, and claim
  * 2 proves {@code validateAll()} reaches today's six, and a hardcoded list satisfies both. So the
  * reflective sweep is a convenience, not the guarantee. The guarantee is {@link
- * #fleetConfigDeclaresExactlyTheseSixValidatorsToday()}: it fails the moment a seventh validator
- * is declared, which forces whoever adds it to look at this file.
+ * #fleetConfigDeclaresExactlyTheseValidatorsToday()}: it fails the moment any validator is added
+ * or removed, which forces whoever changes the set to look at this file.
  */
 class FleetConfigValidateAllTest {
 
@@ -209,18 +210,24 @@ class FleetConfigValidateAllTest {
                         + "name) must all be skipped");
     }
 
-    // ── Claim 2: FleetConfig.validateAll() is wired to that mechanism and reaches all six today ──
+    // ── Claim 2: FleetConfig.validateAll() is wired to that mechanism and reaches seven of eight today ──
 
     /**
      * Reflectively enumerates {@link FleetConfig}'s own public, no-arg, void {@code validateXxx()}
      * methods (excluding {@code validateAll} itself) — the exact same filter {@link
      * FleetConfig#invokeAllValidators} applies. This is not the mechanism proof (that is claim 1,
-     * above, on an unrelated class) — it is a visible denominator: today there are six, named
-     * here, so a reader adding a seventh sees this assertion name the new count rather than a
-     * silent pass at the old one.
+     * above, on an unrelated class) — it is a visible denominator: today there are eight, named in
+     * the {@code Set.of} below, so a reader adding or removing one sees this assertion name the new
+     * count rather than a silent pass at the old one. The count lives only in that set, not in this
+     * method's name, so the two cannot drift apart.
+     *
+     * <p>This assertion alone proves only that the validator exists with the right shape — it
+     * cannot prove {@code validateAll()} actually reaches it. Only {@link
+     * #validateAllReachesEveryOneOfTodaysRealValidators()} proves reachability, which is why this
+     * method's failure message sends the reader there too.
      */
     @Test
-    void fleetConfigDeclaresExactlyTheseSixValidatorsToday() {
+    void fleetConfigDeclaresExactlyTheseValidatorsToday() {
         Set<String> names = new TreeSet<>();
         for (Method m : FleetConfig.class.getMethods()) {
             if (java.lang.reflect.Modifier.isPublic(m.getModifiers())
@@ -233,12 +240,18 @@ class FleetConfigValidateAllTest {
         }
         assertEquals(new TreeSet<>(Set.of("validateAuthExposure", "validateLeadTabPrefixes",
                 "validateSubscriptionProfiles", "validateCharters", "validateMembers",
-                "validateModels", "validateLeadRollover")), names,
-                "FleetConfig's public validate*() methods changed. Do TWO things, in this "
+                "validateModels", "validateLeadRollover", "validatePanePlacementAgainstLeadTabs")),
+                names,
+                "FleetConfig's public validate*() methods changed. Do THREE things, in this "
                         + "order. First confirm validateAll() still delegates to "
                         + "invokeAllValidators(this) — a hardcoded list there passes every other "
                         + "test in this class, so this assertion is the only place that will ever "
-                        + "make you check. Only then update the expected set to match.");
+                        + "make you check. Second, update the expected set below to match. Third, "
+                        + "add or remove a case for that validator in "
+                        + "validateAllReachesEveryOneOfTodaysRealValidators() below — this "
+                        + "assertion proves only that the validator exists with the right shape, "
+                        + "never that validateAll() reaches it; that enumeration is the test that "
+                        + "does.");
     }
 
     /** A minimal, otherwise-valid file — same shape FleetConfigTest and ConfigRefTest use. */
@@ -262,14 +275,21 @@ class FleetConfigValidateAllTest {
     }
 
     /**
-     * The heart of claim 2: for each of today's six real validators, a minimal file that fails
-     * ONLY that one — the exact fixtures {@code FleetConfigTest} uses to test each validator
-     * directly — must also fail through {@link FleetConfig#validateAll()}. If a future edit to
-     * {@code validateAll()} silently dropped one validator from the sweep (e.g. a typo'd name
-     * filter), exactly one of these six would start passing when it must not.
+     * The heart of claim 2: for every one of today's eight real validators, a minimal file that
+     * fails ONLY that one — the exact fixtures {@code FleetConfigTest} uses to test each validator
+     * directly, or a dedicated minimal fixture where no other test drives that validator through
+     * {@code validateAll()} — must also fail through {@link FleetConfig#validateAll()}. If a
+     * future edit to {@code validateAll()} silently dropped one of these eight from the sweep
+     * (e.g. a typo'd name filter), exactly one of them would start passing when it must not.
+     *
+     * <p>This is the single place that proves {@code validateAll()} reaches a given validator.
+     * Adding or removing a validator on {@link FleetConfig} must add or remove a case here, not
+     * only an updated name in {@link #fleetConfigDeclaresExactlyTheseValidatorsToday()}'s expected
+     * set — that assertion proves the validator's shape, never that {@code validateAll()} reaches
+     * it.
      */
     @Test
-    void validateAllReachesEveryOneOfTodaysSixValidators(@TempDir Path dir) throws Exception {
+    void validateAllReachesEveryOneOfTodaysRealValidators(@TempDir Path dir) throws Exception {
         // validateAuthExposure: a non-loopback bind without token mode.
         assertValidateAllRefuses(dir, "auth-exposure.yaml", """
                 bind:
@@ -342,6 +362,29 @@ class FleetConfigValidateAllTest {
                   allow:
                     - model: claude-sonnet-5
                 """, "rogue");
+
+        // validatePanePlacementAgainstLeadTabs: a pane-placed profile while a lead names a tab.
+        assertValidateAllRefuses(dir, "pane-placement.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """, "gx10");
+
+        // validateLeadRollover: a leadRollover: block present with no handoverPath.
+        assertValidateAllRefuses(dir, "lead-rollover.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                leadRollover:
+                  requireOperatorConfirm: false
+                """, "handoverPath");
     }
 
     private static void assertValidateAllRefuses(Path dir, String fileName, String yaml,

fleetd/src/test/java/dev/ltms/fleet/herdr/FakeHerdr.java

@@ -51,6 +51,7 @@ public final class FakeHerdr implements HerdrClient {
     private boolean noPanes = false;
     private volatile String agentStatus = "idle"; // steady-state agent.get status
     private volatile String agentType = "claude"; // detected agent kind on agent.get; null = undetected
+    private volatile String agentSessionId = null; // agent_session.value on agent.get; null = omitted
     private volatile String readText = "worker transcript tail"; // canned agent.read output
     private int pinnedStarts = 0;   // how many upcoming agent.start calls report a fixed pane
     private String pinnedStartTerminal;
@@ -173,6 +174,16 @@ public final class FakeHerdr implements HerdrClient {
         return this;
     }
 
+    /**
+     * Set the {@code agent_session.value} that {@code agent.get} reports for {@code term_a} — the
+     * default omits the field entirely (herdr not yet having resolved one), matching the real
+     * daemon's own "not resolved yet" shape.
+     */
+    public FakeHerdr agentSessionId(String sessionId) {
+        this.agentSessionId = sessionId;
+        return this;
+    }
+
     /**
      * Make {@code agent.get} succeed normally for its first {@code okCalls} invocations, then fail
      * every call after that with {@code code} — fleetd #176 fix 1's "backend exited mid-wait"
@@ -311,10 +322,12 @@ public final class FakeHerdr implements HerdrClient {
                         }
                     }
                     String agentField = agentType == null ? "null" : "\"" + agentType + "\"";
+                    String sessionField = agentSessionId == null ? ""
+                            : ",\"agent_session\":{\"kind\":\"id\",\"value\":\"" + agentSessionId + "\"}";
                     yield mapper.readTree(("""
                         {"type":"agent_info","agent":{"terminal_id":"term_a","agent":%s,
-                          "agent_status":"%s","workspace_id":"w2","tab_id":"w2:t7","pane_id":"w2:p7"}}""")
-                            .formatted(agentField, agentStatus));
+                          "agent_status":"%s","workspace_id":"w2","tab_id":"w2:t7","pane_id":"w2:p7"%s}}""")
+                            .formatted(agentField, agentStatus, sessionField));
                 }
                 case "agent.read" -> mapper.readTree(mapper.writeValueAsString(
                         java.util.Map.of("type", "agent_read", "read", java.util.Map.of("text", readText))));

fleetd/src/test/java/dev/ltms/fleet/herdr/LeadTabScannerTest.java

@@ -232,8 +232,9 @@ class LeadTabScannerTest {
 
     @Test
     void everyPaneInALeadTabResolvesAsThatLead() {
-        // A human may split their own lead tab. Both panes are theirs, so both are that lead —
-        // nothing fleetd placed can land here (see the worker-space test above).
+        // A human may split their own lead tab. Both panes are theirs, so both are that lead.
+        // A pane-placed member landing here instead is refused at startup by
+        // FleetConfig.validatePanePlacementAgainstLeadTabs, not by this scanner.
         TopologyHerdr herdr = twoLeads().pane("w1:p1b", "w1:t1", "term_opus_split");
 
         assertEquals("opus-5.0",

fleetd/src/test/java/dev/ltms/fleet/lead/LeadContextGaugeHighThresholdTest.java

@@ -81,12 +81,6 @@ class LeadContextGaugeHighThresholdTest {
         assertEquals(LeadContextGauge.State.HIGH,
                 atGauge.read(atConfigDir, SESSION_ID, "claude", null).state(),
                 "the fixed default must still be 200,000 when no window is resolvable");
-
-        String legacyConfigDir = writeTranscript(tmp.resolve("legacy"), SESSION_ID, 200_000);
-        LeadContextGauge legacyGauge = new LeadContextGauge();
-        assertEquals(LeadContextGauge.State.HIGH,
-                legacyGauge.read(legacyConfigDir, SESSION_ID, "claude").state(),
-                "the 3-arg read() (no window argument at all) must behave exactly like passing a null window");
     }
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/lead/LeadContextGaugeTest.java

@@ -85,7 +85,7 @@ class LeadContextGaugeTest {
                 usageLine(40_000, 5_000, 3_000)); // last record: 48,000
         LeadContextGauge gauge = new LeadContextGauge();
 
-        LeadContextGauge.Reading first = gauge.read(configDir, SESSION_ID, "claude");
+        LeadContextGauge.Reading first = gauge.read(configDir, SESSION_ID, "claude", null);
         assertEquals(48_000L, first.tokens(), "must total input+cache_read+cache_creation of the LAST usage record");
         assertEquals(LeadContextGauge.State.OK, first.state());
 
@@ -93,7 +93,7 @@ class LeadContextGaugeTest {
         // must change with it, not stay pinned to the first fixture's total.
         String otherSession = "22222222-2222-2222-2222-222222222222";
         writeTranscript(tmp, otherSession, usageLine(100_000, 50_000, 50_000)); // last record: 200,000
-        LeadContextGauge.Reading second = gauge.read(configDir, otherSession, "claude");
+        LeadContextGauge.Reading second = gauge.read(configDir, otherSession, "claude", null);
         assertEquals(200_000L, second.tokens());
         assertTrue(second.tokens() != first.tokens(), "changing N in the fixture must change the reported number");
     }
@@ -111,12 +111,12 @@ class LeadContextGaugeTest {
                 compactionLine(),
                 usageLine(3_000, 0, 0));
         LeadContextGauge gauge = new LeadContextGauge();
-        LeadContextGauge.Reading twoCompactions = gauge.read(tmp.toString(), sessionTwoCompactions, "claude");
+        LeadContextGauge.Reading twoCompactions = gauge.read(tmp.toString(), sessionTwoCompactions, "claude", null);
         assertEquals(2, twoCompactions.compactions());
 
         String sessionZeroCompactions = "44444444-4444-4444-4444-444444444444";
         writeTranscript(tmp, sessionZeroCompactions, usageLine(3_000, 0, 0));
-        LeadContextGauge.Reading zeroCompactions = gauge.read(tmp.toString(), sessionZeroCompactions, "claude");
+        LeadContextGauge.Reading zeroCompactions = gauge.read(tmp.toString(), sessionZeroCompactions, "claude", null);
         assertEquals(0, zeroCompactions.compactions(), "changing K in the fixture must change the reported count");
     }
 
@@ -126,7 +126,7 @@ class LeadContextGaugeTest {
     @DisplayName("a missing transcript file reports UNKNOWN with no token number")
     void missingFileIsUnknown(@TempDir Path tmp) {
         LeadContextGauge gauge = new LeadContextGauge();
-        LeadContextGauge.Reading reading = gauge.read(tmp.toString(), SESSION_ID, "claude");
+        LeadContextGauge.Reading reading = gauge.read(tmp.toString(), SESSION_ID, "claude", null);
         assertEquals(LeadContextGauge.State.UNKNOWN, reading.state());
         assertNull(reading.tokens());
     }
@@ -148,7 +148,7 @@ class LeadContextGaugeTest {
             assumeFalse(Files.isReadable(file),
                     "runs as root (CI container): the read bit does not stop root, so this case cannot be set up here");
             LeadContextGauge gauge = new LeadContextGauge();
-            LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude");
+            LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude", null);
             assertEquals(LeadContextGauge.State.UNKNOWN, reading.state());
             assertNull(reading.tokens());
         } finally {
@@ -171,7 +171,7 @@ class LeadContextGaugeTest {
         Files.writeString(file, lastCompleteLine + "\n" + tornLine, StandardCharsets.UTF_8);
 
         LeadContextGauge gauge = new LeadContextGauge();
-        LeadContextGauge.Reading reading = gauge.read(tmp.toString(), SESSION_ID, "claude");
+        LeadContextGauge.Reading reading = gauge.read(tmp.toString(), SESSION_ID, "claude", null);
         assertEquals(LeadContextGauge.State.OK, reading.state(),
                 "a torn final line must not turn a good earlier reading into UNKNOWN");
         assertEquals(6_000L, reading.tokens(),
@@ -187,7 +187,7 @@ class LeadContextGaugeTest {
                 "{this is not json at all",
                 "neither is this{{{");
         LeadContextGauge gauge = new LeadContextGauge();
-        LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude");
+        LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude", null);
         assertEquals(LeadContextGauge.State.UNKNOWN, reading.state(),
                 "every line unparseable is the real format-change signal and must still report UNKNOWN");
         assertNull(reading.tokens());
@@ -224,12 +224,12 @@ class LeadContextGaugeTest {
         AtomicLong now = new AtomicLong(0);
         LeadContextGauge gauge = new LeadContextGauge(now::get, 5_000);
 
-        gauge.read(configDir, SESSION_ID, "claude");
-        gauge.read(configDir, SESSION_ID, "claude"); // still inside the TTL window
+        gauge.read(configDir, SESSION_ID, "claude", null);
+        gauge.read(configDir, SESSION_ID, "claude", null); // still inside the TTL window
         assertEquals(1, gauge.diskReadCount(), "two reads inside the TTL must touch disk once");
 
         now.set(6_000); // past the TTL
-        gauge.read(configDir, SESSION_ID, "claude");
+        gauge.read(configDir, SESSION_ID, "claude", null);
         assertEquals(2, gauge.diskReadCount(), "a read past the TTL must touch disk again");
     }
 
@@ -241,8 +241,8 @@ class LeadContextGaugeTest {
         String configDir = writeTranscript(tmp, SESSION_ID, usageLine(1_000, 0, 0));
         LeadContextGauge gauge = new LeadContextGauge();
 
-        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, SESSION_ID, "opencode").state());
-        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, SESSION_ID, null).state());
-        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, null, "claude").state());
+        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, SESSION_ID, "opencode", null).state());
+        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, SESSION_ID, null, null).state());
+        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, null, "claude", null).state());
     }
 }

fleetd/src/test/java/dev/ltms/fleet/mcp/FleetMcpLeadContextGaugeWiringTest.java

@@ -86,7 +86,7 @@ class FleetMcpLeadContextGaugeWiringTest {
         LeadContextGauge contextGauge = new LeadContextGauge();
         AtomicReference<String> configuredDir = new AtomicReference<>(dirA.toString());
         FleetMcp.LeadConfigDirSource source = new FleetMcp.LeadConfigDirSource(name ->
-                LEAD_NAME.equals(name) ? configuredDir.get() : null);
+                LEAD_NAME.equals(name) ? configuredDir.get() : null, _ -> null);
 
         String firstRead = textOf(listFleet(herdr, sessions, contextGauge, source));
         assertTrue(firstRead.contains("\"tokens\":11000"),

scripts/test-config-edit.sh

@@ -474,6 +474,90 @@ test_passphrase_key_is_redacted() {
   assert_not_contains "FAKELEAK-PASSPHRASE" "$RUN_OUTPUT" "passphrase case: the passphrase VALUE must never leak"
 }
 
+# ------------------- acceptance criterion 19: the key line falls outside the printed hunk
+# fleetd #656 — criteria 15a/15b both put the edit right next to the key line, so the key line is
+# always inside diff -u's default 3-line context. Neither covers the actual case #639 fixed: an
+# 8-line block-scalar body with only its SIXTH line changed, so the printed hunk (3 lines of
+# context on each side of the change) covers body lines 3-8 and never includes the "token:" key
+# line at all. The old, line-by-line redact() only ever masks after it has SEEN the key line go
+# past; with the key line outside the hunk it never sets its mask, and the whole body — the
+# changed line included — passes through raw. The control key sits right after the body, inside
+# the same hunk, so the positive control below proves the fix is not simply printing nothing.
+new_fixture_hunk_without_key_line() {
+  local dir
+  dir="$(mktemp -d "$TMP/fixture.XXXXXX")"
+  cat > "$dir/fleetd.yaml" <<'YAML'
+bind:
+  host: 127.0.0.1
+  port: 19999
+broker:
+  uri: amqp://user:hunter2@host/vhost
+auth:
+  token: |
+    SECRET-LINE-1
+    SECRET-LINE-2
+    SECRET-LINE-3
+    SECRET-LINE-4
+    SECRET-LINE-5
+    SECRET-LINE-6
+    SECRET-LINE-7
+    SECRET-LINE-8
+  control: CTRL-MUST-APPEAR
+profiles:
+  sonnet:
+    weight: 3
+    maxLoad: 5
+YAML
+  : > "$dir/fleetd.out"
+  printf '%s' "$dir"
+}
+
+test_key_line_outside_hunk_is_still_redacted() {
+  local dir
+  dir="$(new_fixture_hunk_without_key_line)"
+  sed 's/SECRET-LINE-6$/SECRET-LINE-6-CHANGED/' "$dir/fleetd.yaml" > "$dir/candidate.yaml"
+
+  start_run "$dir" 5 --from "$dir/candidate.yaml"
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "hunk-without-key-line case reload exit code"
+  # Positive control FIRST: without this, a diff that printed nothing at all would pass the
+  # negative assertion right below identically to a correctly redacted one.
+  assert_contains "CTRL-MUST-APPEAR" "$RUN_OUTPUT" "hunk-without-key-line case: the non-secret control line must still print unmasked"
+  assert_not_contains "SECRET-LINE-6-CHANGED" "$RUN_OUTPUT" "hunk-without-key-line case: the changed body line must never leak, even with the key line outside the printed hunk"
+}
+
+# ------------------------------- acceptance criterion 20: a blank line inside the value
+# fleetd #656 — the old, line-by-line redact() reset its mask on any line whose indentation was
+# not STRICTLY greater than the key's, and a wholly blank line has indentation 0, so it reset the
+# mask exactly like the "control:" line that legitimately ends the block scalar. Everything after
+# the blank line then printed raw. The current fix tracks masked lines by FILE line number instead
+# of by indentation seen so far, so a blank line inside the value stays masked.
+new_fixture_blank_line_in_value() {
+  local dir
+  dir="$(mktemp -d "$TMP/fixture.XXXXXX")"
+  printf 'bind:\n  host: 127.0.0.1\n  port: 19999\nbroker:\n  uri: amqp://user:hunter2@host/vhost\nauth:\n  token: |\n    LEAK-BEFORE-BLANK\n\n    LEAK-AFTER-BLANK\n  control: CTRL-MUST-APPEAR\nprofiles:\n  sonnet:\n    weight: 3\n    maxLoad: 5\n' > "$dir/fleetd.yaml"
+  : > "$dir/fleetd.out"
+  printf '%s' "$dir"
+}
+
+test_blank_line_inside_value_is_still_redacted() {
+  local dir
+  dir="$(new_fixture_blank_line_in_value)"
+  sed 's/LEAK-AFTER-BLANK$/LEAK-AFTER-BLANK-CHANGED/' "$dir/fleetd.yaml" > "$dir/candidate.yaml"
+
+  start_run "$dir" 5 --from "$dir/candidate.yaml"
+  sleep 1
+  printf 'config reloaded\n' >> "$dir/fleetd.out"
+  collect_run "$dir"
+
+  assert_equals 0 "$RUN_RC" "blank-line-in-value case reload exit code"
+  assert_contains "CTRL-MUST-APPEAR" "$RUN_OUTPUT" "blank-line-in-value case: the non-secret control line must still print unmasked"
+  assert_not_contains "LEAK-AFTER-BLANK-CHANGED" "$RUN_OUTPUT" "blank-line-in-value case: the line after the blank must never leak"
+}
+
 # ----------------------------------- acceptance criterion 16: a failing --set must not echo value
 # fleetd #635 follow-up (ticket comment 17673, defect 8) — apply_set_pairs used to echo the FULL
 # "$kv" (path=value, exactly as typed) in its yq-failure messages, so a broken --set with a
@@ -624,6 +708,10 @@ echo "== acceptance criterion 15a: a block scalar's continuation lines are redac
 test_block_scalar_continuation_is_redacted
 echo "== acceptance criterion 15b: a passphrase key is also recognised =="
 test_passphrase_key_is_redacted
+echo "== acceptance criterion 19: the key line falls outside the printed hunk =="
+test_key_line_outside_hunk_is_still_redacted
+echo "== acceptance criterion 20: a blank line inside the value =="
+test_blank_line_inside_value_is_still_redacted
 echo "== acceptance criterion 16: a failing --set must not echo its value =="
 test_failing_set_does_not_echo_its_value
 echo "== extra: dry-run never installs, and redacts =="