fleetd #670: pin excludedWorkspaceLabels at FleetdAssembly.java:265

Adds a test that reaches the real LeadTabScanner FleetdAssembly's
production boot path builds (via the LeadCoordLoop field that stores
the same leads supplier instance) and asserts, by reflection, that
the excludedWorkspaceLabels field is empty. Mutating line 265 to any
non-empty set now turns this test red.

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -2688,9 +2688,10 @@ public record FleetConfig(
      * tab labels — every member gets one rendered into its tab. Choose a lead {@code tabPrefix} that
      * a member template matches and the daemon starts labelling its own members as leads, promoting
      * the entire fleet to {@link dev.ltms.fleet.auth.Role#PRIMARY} with no message and no diff.
-     * The member-space exclusion in {@link dev.ltms.fleet.herdr.LeadTabScanner} already blocks the
-     * realistic path, but defence that depends on one workspace label holding is not defence enough
-     * for a privilege boundary.
+     * {@link #validatePanePlacementAgainstLeadTabs()} is the check that stops a pane-placed member
+     * from landing inside a lead's tab in the first place; this check is a second, independent
+     * guard that catches the hazard even when every profile places members correctly, by refusing
+     * a label that a scan would still misread as a lead.
      *
      * <p>CB-557 shrank this check rather than removing it. The default template is
      * {@code "{role}: {profile} #{n}"} and {@code {role}} comes from a closed enum, so a
@@ -2737,6 +2738,45 @@ public record FleetConfig(
                 + "lead tabs cannot be confused.");
     }
 
+    /**
+     * Reject a profile that places its members by {@code "pane"} while any {@code fleet.leaders}
+     * entry names a {@code tab}. A pane-placed member lands inside the focused tab rather than its
+     * own, so it can land inside a lead's own labelled tab. {@link
+     * dev.ltms.fleet.herdr.LeadTabScanner} identifies a lead purely by that tab's label — it does
+     * not exclude the member space — so a member that ends up there would be read back as the lead
+     * and granted spawn/stop/send on the whole fleet.
+     *
+     * <p>Only a leader with a non-blank {@code tab} is in scope: one with no {@code tab} feeds
+     * nothing into {@link dev.ltms.fleet.herdr.LeadTabScanner}, so it creates no hazard here.
+     *
+     * @throws IllegalStateException when any {@code profiles:} entry is pane-placed while any
+     *                               {@code fleet.leaders} entry names a non-blank {@code tab}
+     */
+    public void validatePanePlacementAgainstLeadTabs() {
+        if (fleet == null || fleet.leaders().isEmpty()) {
+            return;
+        }
+        boolean anyLeaderHasTab = fleet.leaders().values().stream()
+                .anyMatch(leader -> leader != null && leader.tab() != null && !leader.tab().isBlank());
+        if (!anyLeaderHasTab) {
+            return;
+        }
+        List<String> bad = new ArrayList<>();
+        profiles().entrySet().stream()
+                .filter(e -> !e.getValue().tabPlacement())
+                .map(Map.Entry::getKey)
+                .sorted()
+                .forEach(bad::add);
+        if (bad.isEmpty()) {
+            return;
+        }
+        throw new IllegalStateException("refusing to start: profile(s) " + bad
+                + " use placement: pane while fleet.leaders names a tab. A pane-placed member can "
+                + "land inside a lead's labelled tab and be read back as the lead, granted "
+                + "spawn/stop/send on the whole fleet. Set placement: tab for each named profile, "
+                + "or remove the tab from every fleet.leaders entry.");
+    }
+
     /**
      * Reject a present {@code leadRollover:} block with no (or a blank) {@code handoverPath}
      * (fleetd #480). There is no sane non-null default for an operator-specific file path, unlike
@@ -2937,11 +2977,11 @@ public record FleetConfig(
      * Runs every validator this class declares — found by reflection, not by name.
      *
      * <p>fleetd ticket "central allow-list of usable models", follow-up: mutation testing found
-     * that although each of the six validators above was well pinned on its own, nothing proved
+     * that although each validator above was well pinned on its own, nothing proved
      * either real caller ({@code Fleetd.main} and {@link ConfigRef#reload()}) still
-     * invoked it — deleting a call site left the full suite green. The fix is not a seventh test
-     * per caller; a hand-maintained list of six names here would have the exact same defect its
-     * own javadoc would warn against: the seventh validator someone adds next month has no reason
+     * invoked it — deleting a call site left the full suite green. The fix is not one more test
+     * per caller; a hand-maintained list of names here would have the exact same defect its
+     * own javadoc would warn against: the next validator someone adds has no reason
      * to be added to it. So this method does not name any validator. It sweeps {@link
      * #getClass()}'s own public, no-argument, {@code void} methods whose name starts with {@code
      * "validate"} (excluding itself) and invokes every one it finds, via {@link
@@ -2950,7 +2990,7 @@ public record FleetConfig(
      * which it silently never runs.
      *
      * <p>{@code Fleetd.main} and {@link ConfigRef#reload()} each call this one method instead of
-     * the six individually — see the comments at those two call sites for why
+     * each validator individually — see the comments at those two call sites for why
      * each must run it.
      *
      * <p>Methods run in a fixed (alphabetical) order, so a config with more than one violation
@@ -2967,9 +3007,9 @@ public record FleetConfig(
     /**
      * The reflective sweep behind {@link #validateAll()}, kept as its own method — taking any
      * {@code target}, not just {@code this} — so a test can prove the MECHANISM is generic (it
-     * would sweep a seventh {@code validateXxx()} method added to any class, not just something
-     * special-cased to today's six on {@link FleetConfig}) without needing to add a real, unwanted
-     * seventh validator to this class just to exercise that claim. See {@code
+     * would sweep any new {@code validateXxx()} method added to any class, not just something
+     * special-cased to the set {@link FleetConfig} declares today) without needing to add a real,
+     * unwanted extra validator to this class just to exercise that claim. See {@code
      * FleetConfigValidateAllTest} for that proof.
      *
      * @param target an object whose public, no-argument, {@code void} methods named {@code

fleetd/src/main/java/dev/ltms/fleet/herdr/LeadTabScanner.java

@@ -37,8 +37,11 @@ import java.util.function.Supplier;
  * <p><strong>Direction of trust.</strong> The label names the lead; it never <em>grants</em>
  * anything a pane could take for itself. Three properties keep that honest:
  * <ol>
- *   <li>Worker spaces are excluded wholesale ({@code excludedWorkspaceLabels}), so a worker cannot
- *       become a lead by being placed — as a split, say — inside a matching tab.</li>
+ *   <li>{@code excludedWorkspaceLabels} can filter a workspace out of the scan, but this class does
+ *       not by itself stop a worker from landing inside a matching tab — a caller may pass an empty
+ *       set, and the daemon does. The guard against that is {@code
+ *       FleetConfig.validatePanePlacementAgainstLeadTabs}: it refuses, at startup, any profile that
+ *       places members by pane while a lead names a tab.</li>
  *   <li>A worker cannot rename a tab: {@code tab.rename} is reachable only through
  *       {@link WorkspaceControl}, which no {@code fleet_*} tool exposes. The label is writable by
  *       the human at the terminal and by nobody the bridge is defending against.</li>

fleetd/src/main/java/dev/ltms/fleet/lead/LeadContextGauge.java

@@ -172,12 +172,6 @@ public final class LeadContextGauge {
      *                  {@code "claude"} (including {@code null}, meaning undetected) reports
      *                  {@link State#UNKNOWN} — this reader only understands Claude Code's own
      *                  transcript format
-     */
-    public Reading read(String configDir, String sessionId, String agentType) {
-        return read(configDir, sessionId, agentType, null);
-    }
-
-    /**
      * @param effectiveWindowTokens the caller's resolved effective auto-compact window for this
      *                              lead's own profile, or {@code null} when it cannot be resolved.
      *                              HIGH fires at {@link #HIGH_THRESHOLD_FRACTION} of this value;

fleetd/src/main/java/dev/ltms/fleet/lead/LeadLauncher.java

@@ -201,8 +201,8 @@ public final class LeadLauncher {
     /**
      * How many live leads exist per configured name, and which of that name's labelled tabs are
      * <em>not</em> live: a running agent in a tab labelled with that lead's exact {@code tab}
-     * (CB-579). Member workspaces are excluded, exactly as the scanner excludes them: a member must
-     * not be counted as a lead because it happens to sit in a matching tab.
+     * (CB-579). A member sitting in the same shared workspace is not counted as a lead because its
+     * tab carries a different label, not because any workspace is excluded from this count.
      *
      * <p>There used to be a second path here — a running agent on the terminal a
      * {@code fleet.leaders.<name>.terminal} pin named, for a lead opened and pinned by hand. That

fleetd/src/test/java/dev/ltms/fleet/FleetdAssemblyLeadTabScannerExclusionTest.java

@@ -0,0 +1,201 @@
+package dev.ltms.fleet;
+
+import dev.ltms.fleet.config.ConfigRef;
+import dev.ltms.fleet.config.FleetConfig;
+import dev.ltms.fleet.guard.SubscriptionGuard;
+import dev.ltms.fleet.herdr.FakeHerdr;
+import dev.ltms.fleet.herdr.HerdrClient;
+import dev.ltms.fleet.herdr.LeadTabScanner;
+import dev.ltms.fleet.msg.LeadChannelHandle;
+import dev.ltms.fleet.msg.LeadCoordLoop;
+import dev.ltms.fleet.msg.LeadMessage;
+import dev.ltms.fleet.msg.ReplyInbox;
+import io.javalin.Javalin;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+import java.lang.reflect.Field;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.function.LongSupplier;
+import java.util.function.Supplier;
+
+import static org.junit.jupiter.api.Assertions.assertInstanceOf;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #670 — pins the {@code excludedWorkspaceLabels} argument {@link FleetdAssembly}'s
+ * production boot path passes to {@link LeadTabScanner} at {@code FleetdAssembly.java:265}
+ * ({@code Set.of()}).
+ *
+ * <p>{@code LeadTabScannerTest} already covers this constructor parameter, but it builds its own
+ * {@link LeadTabScanner} with its own set, so it tests the seam and proves nothing about the
+ * producer. This test instead reaches the exact object {@link FleetdAssembly#assembleAndStart}
+ * builds: a {@code fleet.leaders:} block makes the assembly construct a real
+ * {@link LeadTabScanner} for its local {@code leads} supplier, and a {@code coordinator:} block
+ * makes it hand that same supplier instance to {@link LeadCoordLoop} (fleetd #637), which stores
+ * it as a field. Reflection recovers it from there, and then from the scanner itself, so the
+ * assertion is against the real production argument rather than a copy built for this test.
+ */
+class FleetdAssemblyLeadTabScannerExclusionTest {
+
+    private static final class FakeLeadChannel implements LeadChannelHandle {
+        @Override
+        public void publish(String toCoordId, LeadMessage message) {
+        }
+
+        @Override
+        public List<LeadMessage> peek() {
+            return List.of();
+        }
+
+        @Override
+        public void ack(String msgId) {
+        }
+
+        @Override
+        public String selfCoordId() {
+            return "test-lead";
+        }
+
+        @Override
+        public boolean heldDurable() {
+            return true;
+        }
+
+        @Override
+        public MailboxState inspect(String coordId) {
+            return MailboxState.unknown(coordId);
+        }
+
+        @Override
+        public void close() {
+        }
+    }
+
+    private static final class TestResourcePorts implements ResourcePorts {
+        final FakeHerdr herdr = new FakeHerdr();
+        Runnable shutdownHook;
+
+        @Override
+        public Map<String, String> environment() {
+            return Map.of();
+        }
+
+        @Override
+        public HerdrClient connectHerdr(Path socketPath) {
+            return herdr;
+        }
+
+        @Override
+        public Fleetd.AmqpOpener replyInboxOpener() {
+            return (uri, prefetch) -> new ReplyInbox() {
+                @Override public void own(String target) { }
+                @Override public void release(String target) { }
+                @Override public void publish(String target, String msgId, String content) { }
+                @Override public List<InboxMessage> peek(String target) { return List.of(); }
+                @Override public boolean ack(String target, String msgId) { return false; }
+            };
+        }
+
+        @Override
+        public Fleetd.LeadMailboxOpener leadMailboxOpener() {
+            return (uri, selfCoordId, prefetch) -> new FakeLeadChannel();
+        }
+
+        @Override
+        public LongSupplier nanoClock() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public LongSupplier wallClockNanos() {
+            return System::nanoTime;
+        }
+
+        @Override
+        public ScheduledExecutorService newScheduler(String purpose) {
+            return Executors.newSingleThreadScheduledExecutor();
+        }
+
+        @Override
+        public void addShutdownHook(Runnable hook) {
+            shutdownHook = hook;
+        }
+
+        @Override
+        public void startHttp(Javalin app, String host, int port) {
+            // Do not bind a real port in this assembly test.
+        }
+
+        @Override
+        public Runnable herdrPollWait() {
+            return () -> {
+                throw new UnsupportedOperationException("FakeHerdr is healthy; no poll wait is expected");
+            };
+        }
+    }
+
+    private static FleetConfig writeConfig(Path dir) throws Exception {
+        Path file = dir.resolve("fleetd.yaml");
+        Files.writeString(file, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                idleSleepGuard:
+                  enabled: false
+                coordinator:
+                  uri: "amqp://fake-lead-broker/vh"
+                  selfId: "test-lead"
+                fleet:
+                  leaders:
+                    primary:
+                      tab: "lead: primary"
+                      profile: sonnet
+                profiles:
+                  sonnet:
+                    subscription: true
+                    argv: ["ccs", "sonnet"]
+                """);
+        return FleetConfig.load(file);
+    }
+
+    @Test
+    void productionBootPathPassesNoExcludedWorkspaceLabels(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = writeConfig(dir);
+        TestResourcePorts ports = new TestResourcePorts();
+        FleetdRuntime runtime = FleetdAssembly.assembleAndStart(new AssemblyInputs(cfg,
+                new ConfigRef(dir.resolve("fleetd.yaml"), cfg), new SubscriptionGuard(cfg.guard().hostSet())), ports);
+        try {
+            LeadCoordLoop coordLoop = runtime.leadCoordLoop();
+            assertNotNull(coordLoop, "control: a configured coordinator: block must build LeadCoordLoop");
+
+            Field leadsField = LeadCoordLoop.class.getDeclaredField("leads");
+            leadsField.setAccessible(true);
+            @SuppressWarnings("unchecked")
+            Supplier<Map<String, String>> leads = (Supplier<Map<String, String>>) leadsField.get(coordLoop);
+
+            assertInstanceOf(LeadTabScanner.class, leads,
+                    "control: a non-empty fleet.leaders: block must make FleetdAssembly build a real "
+                            + "LeadTabScanner for its `leads` supplier, not the Map::of fallback — "
+                            + "otherwise this test would pass for the wrong reason");
+
+            Field excludedField = LeadTabScanner.class.getDeclaredField("excludedWorkspaceLabels");
+            excludedField.setAccessible(true);
+            Set<?> excluded = (Set<?>) excludedField.get(leads);
+
+            assertTrue(excluded.isEmpty(),
+                    "FleetdAssembly.java:265 must pass an empty excludedWorkspaceLabels to "
+                            + "LeadTabScanner — scanning member tabs would demote the lead to a worker");
+        } finally {
+            assertNotNull(ports.shutdownHook, "control: assembly must capture its shutdown hook");
+            ports.shutdownHook.run();
+        }
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java

@@ -765,6 +765,92 @@ class FleetConfigTest {
                 "a label that collides with a convention nobody reads is not a problem");
     }
 
+    // ── validatePanePlacementAgainstLeadTabs ────────────────────────────────────────────────────
+
+    /**
+     * The hazard this guard closes: a pane-placed member lands inside the focused tab rather than
+     * its own, so it can land inside a lead's labelled tab and be read back as that lead.
+     */
+    @Test
+    void aPanePlacedProfileWithALeadTabRefusesToStart(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("pane-hazard.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class,
+                cfg::validatePanePlacementAgainstLeadTabs);
+        assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
+    }
+
+    @Test
+    void aPanePlacedProfileWithNoLeadTabIsAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("pane-no-tab.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  leaders:
+                    opus:
+                      profile: gx10
+                """);
+
+        assertDoesNotThrow(() -> FleetConfig.load(f).validatePanePlacementAgainstLeadTabs(),
+                "a leader with no tab feeds nothing into the scanner, so pane placement is safe");
+    }
+
+    @Test
+    void aTabPlacedProfileWithALeadTabIsAllowed(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("tab-safe.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: tab
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """);
+
+        assertDoesNotThrow(() -> FleetConfig.load(f).validatePanePlacementAgainstLeadTabs(),
+                "a member in its own tab cannot land inside a lead's tab");
+    }
+
+    /** Proves the reflective sweep behind {@code validateAll} really reaches this validator. */
+    @Test
+    void validateAllAlsoRefusesPanePlacementAgainstALeadTab(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("pane-hazard-sweep.yaml");
+        Files.writeString(f, """
+                bind:
+                  port: 8080
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """);
+        FleetConfig cfg = FleetConfig.load(f);
+
+        IllegalStateException e = assertThrows(IllegalStateException.class, cfg::validateAll);
+        assertTrue(e.getMessage().contains("gx10"), "the message must name the offending profile");
+    }
+
     // ── CB-530/CB-579: the leaders registry ─────────────────────────────────────────────────────
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigValidateAllTest.java

@@ -42,12 +42,13 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
  *       has right now. This is the proof that a future, real seventh validator on {@link
  *       FleetConfig} would be swept automatically, without needing to add a real (unwanted)
  *       seventh validator just to exercise the claim.</li>
- *   <li>{@link #validateAllReachesEveryOneOfTodaysSixValidators()} proves {@link
+ *   <li>{@link #validateAllReachesEveryOneOfTodaysRealValidators()} proves {@link
  *       FleetConfig#validateAll()} itself is wired to that same generic mechanism and genuinely
- *       reaches each of today's six real validators — reusing the exact minimal failing
+ *       reaches seven of today's eight real validators — reusing the exact minimal failing
  *       configurations {@code FleetConfigTest} already established for each one directly, so a
- *       single call to {@code validateAll()} is shown to reproduce every one of those six
- *       failures.</li>
+ *       single call to {@code validateAll()} is shown to reproduce every one of those seven
+ *       failures. The eighth, {@link FleetConfig#validateLeadRollover()}, has no case here yet —
+ *       a pre-existing gap tracked as fleetd #668.</li>
  * </ol>
  *
  * <p>Together with the direct-{@code Fleetd.main}-invocation tests in {@code
@@ -62,8 +63,8 @@ import static org.junit.jupiter.api.Assertions.assertTrue;
  * the generic sweep — claim 1 proves {@link FleetConfig#invokeAllValidators} is generic, and claim
  * 2 proves {@code validateAll()} reaches today's six, and a hardcoded list satisfies both. So the
  * reflective sweep is a convenience, not the guarantee. The guarantee is {@link
- * #fleetConfigDeclaresExactlyTheseSixValidatorsToday()}: it fails the moment a seventh validator
- * is declared, which forces whoever adds it to look at this file.
+ * #fleetConfigDeclaresExactlyTheseValidatorsToday()}: it fails the moment any validator is added
+ * or removed, which forces whoever changes the set to look at this file.
  */
 class FleetConfigValidateAllTest {
 
@@ -209,18 +210,19 @@ class FleetConfigValidateAllTest {
                         + "name) must all be skipped");
     }
 
-    // ── Claim 2: FleetConfig.validateAll() is wired to that mechanism and reaches all six today ──
+    // ── Claim 2: FleetConfig.validateAll() is wired to that mechanism and reaches seven of eight today ──
 
     /**
      * Reflectively enumerates {@link FleetConfig}'s own public, no-arg, void {@code validateXxx()}
      * methods (excluding {@code validateAll} itself) — the exact same filter {@link
      * FleetConfig#invokeAllValidators} applies. This is not the mechanism proof (that is claim 1,
-     * above, on an unrelated class) — it is a visible denominator: today there are six, named
-     * here, so a reader adding a seventh sees this assertion name the new count rather than a
-     * silent pass at the old one.
+     * above, on an unrelated class) — it is a visible denominator: today there are eight, named in
+     * the {@code Set.of} below, so a reader adding or removing one sees this assertion name the new
+     * count rather than a silent pass at the old one. The count lives only in that set, not in this
+     * method's name, so the two cannot drift apart.
      */
     @Test
-    void fleetConfigDeclaresExactlyTheseSixValidatorsToday() {
+    void fleetConfigDeclaresExactlyTheseValidatorsToday() {
         Set<String> names = new TreeSet<>();
         for (Method m : FleetConfig.class.getMethods()) {
             if (java.lang.reflect.Modifier.isPublic(m.getModifiers())
@@ -233,7 +235,8 @@ class FleetConfigValidateAllTest {
         }
         assertEquals(new TreeSet<>(Set.of("validateAuthExposure", "validateLeadTabPrefixes",
                 "validateSubscriptionProfiles", "validateCharters", "validateMembers",
-                "validateModels", "validateLeadRollover")), names,
+                "validateModels", "validateLeadRollover", "validatePanePlacementAgainstLeadTabs")),
+                names,
                 "FleetConfig's public validate*() methods changed. Do TWO things, in this "
                         + "order. First confirm validateAll() still delegates to "
                         + "invokeAllValidators(this) — a hardcoded list there passes every other "
@@ -262,14 +265,17 @@ class FleetConfigValidateAllTest {
     }
 
     /**
-     * The heart of claim 2: for each of today's six real validators, a minimal file that fails
+     * The heart of claim 2: for seven of today's eight real validators, a minimal file that fails
      * ONLY that one — the exact fixtures {@code FleetConfigTest} uses to test each validator
      * directly — must also fail through {@link FleetConfig#validateAll()}. If a future edit to
-     * {@code validateAll()} silently dropped one validator from the sweep (e.g. a typo'd name
-     * filter), exactly one of these six would start passing when it must not.
+     * {@code validateAll()} silently dropped one of these seven from the sweep (e.g. a typo'd name
+     * filter), exactly one of them would start passing when it must not.
+     *
+     * <p>The eighth, {@link FleetConfig#validateLeadRollover()}, has no case here — a pre-existing
+     * gap tracked as fleetd #668, not fixed by this change.
      */
     @Test
-    void validateAllReachesEveryOneOfTodaysSixValidators(@TempDir Path dir) throws Exception {
+    void validateAllReachesEveryOneOfTodaysRealValidators(@TempDir Path dir) throws Exception {
         // validateAuthExposure: a non-loopback bind without token mode.
         assertValidateAllRefuses(dir, "auth-exposure.yaml", """
                 bind:
@@ -342,6 +348,20 @@ class FleetConfigValidateAllTest {
                   allow:
                     - model: claude-sonnet-5
                 """, "rogue");
+
+        // validatePanePlacementAgainstLeadTabs: a pane-placed profile while a lead names a tab.
+        assertValidateAllRefuses(dir, "pane-placement.yaml", """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                profiles:
+                  gx10:
+                    placement: pane
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus"
+                """, "gx10");
     }
 
     private static void assertValidateAllRefuses(Path dir, String fileName, String yaml,

fleetd/src/test/java/dev/ltms/fleet/herdr/LeadTabScannerTest.java

@@ -232,8 +232,9 @@ class LeadTabScannerTest {
 
     @Test
     void everyPaneInALeadTabResolvesAsThatLead() {
-        // A human may split their own lead tab. Both panes are theirs, so both are that lead —
-        // nothing fleetd placed can land here (see the worker-space test above).
+        // A human may split their own lead tab. Both panes are theirs, so both are that lead.
+        // A pane-placed member landing here instead is refused at startup by
+        // FleetConfig.validatePanePlacementAgainstLeadTabs, not by this scanner.
         TopologyHerdr herdr = twoLeads().pane("w1:p1b", "w1:t1", "term_opus_split");
 
         assertEquals("opus-5.0",

fleetd/src/test/java/dev/ltms/fleet/lead/LeadContextGaugeHighThresholdTest.java

@@ -81,12 +81,6 @@ class LeadContextGaugeHighThresholdTest {
         assertEquals(LeadContextGauge.State.HIGH,
                 atGauge.read(atConfigDir, SESSION_ID, "claude", null).state(),
                 "the fixed default must still be 200,000 when no window is resolvable");
-
-        String legacyConfigDir = writeTranscript(tmp.resolve("legacy"), SESSION_ID, 200_000);
-        LeadContextGauge legacyGauge = new LeadContextGauge();
-        assertEquals(LeadContextGauge.State.HIGH,
-                legacyGauge.read(legacyConfigDir, SESSION_ID, "claude").state(),
-                "the 3-arg read() (no window argument at all) must behave exactly like passing a null window");
     }
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/lead/LeadContextGaugeTest.java

@@ -85,7 +85,7 @@ class LeadContextGaugeTest {
                 usageLine(40_000, 5_000, 3_000)); // last record: 48,000
         LeadContextGauge gauge = new LeadContextGauge();
 
-        LeadContextGauge.Reading first = gauge.read(configDir, SESSION_ID, "claude");
+        LeadContextGauge.Reading first = gauge.read(configDir, SESSION_ID, "claude", null);
         assertEquals(48_000L, first.tokens(), "must total input+cache_read+cache_creation of the LAST usage record");
         assertEquals(LeadContextGauge.State.OK, first.state());
 
@@ -93,7 +93,7 @@ class LeadContextGaugeTest {
         // must change with it, not stay pinned to the first fixture's total.
         String otherSession = "22222222-2222-2222-2222-222222222222";
         writeTranscript(tmp, otherSession, usageLine(100_000, 50_000, 50_000)); // last record: 200,000
-        LeadContextGauge.Reading second = gauge.read(configDir, otherSession, "claude");
+        LeadContextGauge.Reading second = gauge.read(configDir, otherSession, "claude", null);
         assertEquals(200_000L, second.tokens());
         assertTrue(second.tokens() != first.tokens(), "changing N in the fixture must change the reported number");
     }
@@ -111,12 +111,12 @@ class LeadContextGaugeTest {
                 compactionLine(),
                 usageLine(3_000, 0, 0));
         LeadContextGauge gauge = new LeadContextGauge();
-        LeadContextGauge.Reading twoCompactions = gauge.read(tmp.toString(), sessionTwoCompactions, "claude");
+        LeadContextGauge.Reading twoCompactions = gauge.read(tmp.toString(), sessionTwoCompactions, "claude", null);
         assertEquals(2, twoCompactions.compactions());
 
         String sessionZeroCompactions = "44444444-4444-4444-4444-444444444444";
         writeTranscript(tmp, sessionZeroCompactions, usageLine(3_000, 0, 0));
-        LeadContextGauge.Reading zeroCompactions = gauge.read(tmp.toString(), sessionZeroCompactions, "claude");
+        LeadContextGauge.Reading zeroCompactions = gauge.read(tmp.toString(), sessionZeroCompactions, "claude", null);
         assertEquals(0, zeroCompactions.compactions(), "changing K in the fixture must change the reported count");
     }
 
@@ -126,7 +126,7 @@ class LeadContextGaugeTest {
     @DisplayName("a missing transcript file reports UNKNOWN with no token number")
     void missingFileIsUnknown(@TempDir Path tmp) {
         LeadContextGauge gauge = new LeadContextGauge();
-        LeadContextGauge.Reading reading = gauge.read(tmp.toString(), SESSION_ID, "claude");
+        LeadContextGauge.Reading reading = gauge.read(tmp.toString(), SESSION_ID, "claude", null);
         assertEquals(LeadContextGauge.State.UNKNOWN, reading.state());
         assertNull(reading.tokens());
     }
@@ -148,7 +148,7 @@ class LeadContextGaugeTest {
             assumeFalse(Files.isReadable(file),
                     "runs as root (CI container): the read bit does not stop root, so this case cannot be set up here");
             LeadContextGauge gauge = new LeadContextGauge();
-            LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude");
+            LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude", null);
             assertEquals(LeadContextGauge.State.UNKNOWN, reading.state());
             assertNull(reading.tokens());
         } finally {
@@ -171,7 +171,7 @@ class LeadContextGaugeTest {
         Files.writeString(file, lastCompleteLine + "\n" + tornLine, StandardCharsets.UTF_8);
 
         LeadContextGauge gauge = new LeadContextGauge();
-        LeadContextGauge.Reading reading = gauge.read(tmp.toString(), SESSION_ID, "claude");
+        LeadContextGauge.Reading reading = gauge.read(tmp.toString(), SESSION_ID, "claude", null);
         assertEquals(LeadContextGauge.State.OK, reading.state(),
                 "a torn final line must not turn a good earlier reading into UNKNOWN");
         assertEquals(6_000L, reading.tokens(),
@@ -187,7 +187,7 @@ class LeadContextGaugeTest {
                 "{this is not json at all",
                 "neither is this{{{");
         LeadContextGauge gauge = new LeadContextGauge();
-        LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude");
+        LeadContextGauge.Reading reading = gauge.read(configDir, SESSION_ID, "claude", null);
         assertEquals(LeadContextGauge.State.UNKNOWN, reading.state(),
                 "every line unparseable is the real format-change signal and must still report UNKNOWN");
         assertNull(reading.tokens());
@@ -224,12 +224,12 @@ class LeadContextGaugeTest {
         AtomicLong now = new AtomicLong(0);
         LeadContextGauge gauge = new LeadContextGauge(now::get, 5_000);
 
-        gauge.read(configDir, SESSION_ID, "claude");
-        gauge.read(configDir, SESSION_ID, "claude"); // still inside the TTL window
+        gauge.read(configDir, SESSION_ID, "claude", null);
+        gauge.read(configDir, SESSION_ID, "claude", null); // still inside the TTL window
         assertEquals(1, gauge.diskReadCount(), "two reads inside the TTL must touch disk once");
 
         now.set(6_000); // past the TTL
-        gauge.read(configDir, SESSION_ID, "claude");
+        gauge.read(configDir, SESSION_ID, "claude", null);
         assertEquals(2, gauge.diskReadCount(), "a read past the TTL must touch disk again");
     }
 
@@ -241,8 +241,8 @@ class LeadContextGaugeTest {
         String configDir = writeTranscript(tmp, SESSION_ID, usageLine(1_000, 0, 0));
         LeadContextGauge gauge = new LeadContextGauge();
 
-        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, SESSION_ID, "opencode").state());
-        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, SESSION_ID, null).state());
-        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, null, "claude").state());
+        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, SESSION_ID, "opencode", null).state());
+        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, SESSION_ID, null, null).state());
+        assertEquals(LeadContextGauge.State.UNKNOWN, gauge.read(configDir, null, "claude", null).state());
     }
 }