fleetd#333: fleet.leaders is split too, and split membership now proves reporting exists

F1: fleet: was sitting in ConfigRefTopLevelCoverageTest's HOT_EXCLUDED_TOP_LEVEL_KEYS escape hatch, even though fleet.leaders is read only at startup (LeadTabScanner's identity map, LeadLauncher.ensureLeads) while the rest of fleet: (role pools, charters, tabLabel) is live. A reload changing only fleet.leaders reported a bare "config reloaded" -- the operator edits a lead's tab: label, sees the reload succeed, and the pane keeps resolving as a worker. Moved fleet into ConfigRef.SPLIT_KEYS; changedSplitKeys now compares fleet.leaders specifically (not the whole Fleet record, which would over-claim "restart" for a tabLabel-only change) and names both halves in the message. F2: membership in SPLIT_KEYS/COLD_KEYS never proved a matching branch existed in changedSplitKeys/changedColdKeys -- measured by dropping the coordinator branch while leaving "coordinator" in SPLIT_KEYS: both ConfigRefTopLevelCoverageTest and the in-method "kept in step" assert stayed green. Added ConfigRefTopLevelReportingCoverageTest, the ConfigRefProfileCoverageTest mechanism one level up: reflection-built FleetConfig pairs that differ in exactly one top-level component, calling the real (now package-private) changedColdKeys/ changedSplitKeys to prove each COLD_KEYS/SPLIT_KEYS member is actually reported. Scoped to split+cold, not deferred -- see the new test's javadoc for why and what that leaves open. Both findings carry a behavioural test in ConfigRefTest plus a mutation proof (revert -> real failure -> restore) recorded in the PR description.
Merge #330 : a fourth reload class for split keys, and a top-level coverage checker
2026-09-04 15:36:40 +07:00 · 2026-09-04 15:19:14 +07:00 · 2026-09-04 15:16:45 +07:00 · 2026-09-04 14:58:07 +07:00 · 2026-09-04 14:53:50 +07:00 · 2026-09-04 14:44:42 +07:00
5 changed files with 1245 additions and 33 deletions
@@ -22,46 +22,148 @@ import java.util.function.Supplier;
 * choice rather than an accident of where the field was initialised.
 *
 * <h2>Not every key can change under a running daemon</h2>
- * Keys fall into three classes, and the difference is about what already exists when the reload
+ * Keys fall into four classes, and the difference is about what already exists when the reload
 * happens — not about how important the key is.
 *
 * <ul>
 *   <li><strong>Hot</strong> — re-read per use, so a reload takes effect on the next spawn:
- *       {@code fleet:} (every role pool, {@code charters}, and {@code tabLabel}),
- *       {@code placement:}, and an existing profile's {@code weight} / {@code maxLoad}. Those
- *       three are read through a supplier on {@code CompositePeerLauncher}, which is what makes
- *       them hot — not the fact that they are config. <strong>This does NOT include
- *       {@code fleet.leaders}</strong>: {@code Fleetd.main} reads {@code cfg.fleet().leaders()}
- *       once at startup to build the {@code LeadTabScanner} and the {@code LeadLauncher}, and
- *       neither is reconstructed on reload — so a lead added, removed, or re-{@code tab}'d under
- *       {@code fleet.leaders} needs a restart, the same as any deferred key below.</li>
+ *       {@code placement:}, and an existing profile's {@code weight} / {@code maxLoad}. Both are
+ *       read through a supplier on {@code CompositePeerLauncher}, which is what makes them hot —
+ *       not the fact that they are config. Most of {@code fleet:} — every role pool
+ *       ({@code architects}/{@code developers}/{@code reviewers}), {@code charters}, and
+ *       {@code tabLabel} — is read the same live way, through the same supplier
+ *       ({@code () -> config.get().fleet()}). <strong>But {@code fleet:} as a whole is NOT in this
+ *       class</strong>: {@code fleet.leaders} inside the same key is frozen, which is exactly what
+ *       makes {@code fleet:} split rather than hot — see below.</li>
 *   <li><strong>Deferred</strong> — accepted into the new snapshot, but the wiring built at startup
 *       keeps the old value until a restart: {@code lifecycle:}, {@code leadHeartbeat:},
 *       {@code spawnReadyTimeoutMs} / {@code spawnReadyPollMs}, {@code quarantineCooldownSeconds}
 *       (CB-578 stage B — baked once into the {@code BackendQuarantine} built at startup),
- *       {@code guard:}, {@code worktreeRoot:}, adding or removing a profile (a new backend needs its own launcher,
+ *       {@code guard:}, {@code worktreeRoot:} and {@code worktreeGroup:} (both baked once into the
+ *       {@code GitWorktrees} built at {@code Fleetd.java:251} and never rebuilt — fleetd #323
+ *       instance 2 found {@code worktreeGroup} missing from this list and from
+ *       {@link #changedDeferredKeys}), {@code primary:} (fleetd #326 — {@code Fleetd.java:506, 519,
+ *       520} read {@code cfg.primary()} only off the startup snapshot to build {@code
+ *       PrimaryRegistry} and size {@code ReplyPushLoop}'s reminder cap/backoff, and neither is
+ *       rebuilt on reload. Say the consequence exactly: {@code primary.terminal} is DEPRECATED
+ *       (CB-532, and {@code Fleetd.java:511} warns about it at startup) — a lead's identity comes
+ *       from {@code leaders:}/{@code leadScan:}, so changing this pin does not demote or promote a
+ *       lead that uses those. What a changed pin still does not take effect on until a restart is
+ *       the fallback nudge destination the pin remains, the deprecated identity path for an operator
+ *       who still relies on it, and {@code pushReminders}/{@code pushBackoffMs}), {@code configReload:} (fleetd #326 — {@code
+ *       Fleetd.java:679-680} read it only at startup to decide whether to build a {@code
+ *       ConfigWatcher} at all and with what interval; the watcher that would apply a later change is
+ *       itself built once, so a running watcher keeps polling on its original enabled flag and
+ *       interval regardless of what a reload changes it to, the same shape as {@code lifecycle} —
+ *       not cold, because no already-open resource goes inconsistent with the new value, the watcher
+ *       (if any) simply keeps its old settings), adding or removing a profile (a new backend needs its own launcher,
 *       which is constructed once), <em>and an existing profile's launch settings</em> —
 *       {@code model}, {@code baseUrl}, {@code argv}, {@code env}, {@code mcpUrl},
 *       {@code exhaustedPattern} (CB-578 stage A — compiled once into {@code Fleetd.main}'s
 *       pattern map at startup), {@code errorPattern} (fleetd #201 Unit 5 — compiled once into
- *       {@code Fleetd.main}'s backend-error pattern map at startup, the same way), and the rest.
+ *       {@code Fleetd.main}'s backend-error pattern map at startup, the same way),
+ *       {@code ideProjectDir} / {@code ideOpenCommand} / {@code autoCompactWindow} (fleetd #323
+ *       instance 1 — all three are read at spawn off the same frozen profile map and were missing
+ *       from {@link #sameLaunchSettings}), and the rest of {@link #sameLaunchSettings}.
 *       {@code credentialId} (CB-578 stage B) is NOT on
 *       this list — it is read live off the config supplier at every quarantine check and
 *       exhaustion event, exactly like {@code weight} / {@code maxLoad}, so it is hot instead.
 *       {@code HerdrPeerLauncher} takes {@code Map.copyOf(profiles)} at construction and resolves
 *       each spawn out of that copy, so those never reach a launch until the daemon restarts. A
 *       reload logs these rather than pretending they applied.</li>
+ *   <li><strong>Split</strong> (fleetd #330; extended to a third key by fleetd #333) — read
+ *       <em>both</em> ways at different sites, so the key does not fit any class above as a whole:
+ *       {@code health:}, {@code coordinator:} and {@code fleet:}. Each is read off the startup
+ *       snapshot to build a long-lived object, and read live off {@link #get()} at a different,
+ *       unrelated site — so half of a reload's effect already applies while the other half waits
+ *       for a restart, and a bare "config reloaded" would under-claim by exactly that half.
+ *       <ul>
+ *         <li>{@code health:} — the monitor itself ({@code enabled}, {@code intervalSeconds},
+ *             {@code workingSuspectAfterSeconds}) is built once at {@code Fleetd.java:556-563}
+ *             and never rebuilt, so a changed value needs a restart to actually start, stop, or
+ *             retime it. The coverage string {@code fleet_profiles} reports
+ *             ({@code Fleetd.java:648-650}) is read live off {@link #get()} on every call, so it
+ *             already reflects the new value.</li>
+ *         <li>{@code coordinator:} — the {@code LeadMailbox} connection ({@code uri},
+ *             {@code uriEnv}, {@code selfId}, {@code prefetch}) is opened once at
+ *             {@code Fleetd.java:502} and never reopened, so a changed value needs a restart —
+ *             {@code selfId} in particular names this daemon's own AMQP inbox queue, and a peer
+ *             lead that learned the old name would not discover a new one on its own. The broker
+ *             URI env-var <em>name</em> that {@code MemberEnvAllowList} keeps out of a member's
+ *             environment is read live off {@link #get()} on every spawn
+ *             ({@code HerdrPeerLauncher.java:1530}), so it already applies.</li>
+ *         <li>{@code fleet:} (fleetd #333) — {@code fleet.leaders} is the frozen half:
+ *             {@code Fleetd.java:281} reads {@code cfg.fleet().leaders()} off the startup snapshot
+ *             for two long-lived objects built right after it and never rebuilt — the
+ *             {@code LeadTabScanner}'s {@code tab label → lead name} map ({@code Fleetd.java:301},
+ *             wired into {@code CallerResolver.withLeadsAndMembers} at {@code Fleetd.java:620/624},
+ *             which is how a caller's pane is recognised as a lead at all) and, when herdr answered
+ *             at startup, {@code LeadLauncher(...).ensureLeads()} ({@code Fleetd.java:315}), which
+ *             auto-launches each declared lead up to its {@code instances} count. So a lead added,
+ *             removed, or given a new {@code tab:} label under {@code fleet.leaders} needs a
+ *             restart — until then it is invisible to identity resolution, and this is exactly the
+ *             scenario fleetd #333 named: an operator edits a lead's {@code tab:} to match a
+ *             renamed pane, sees "config reloaded", and the pane keeps resolving as a worker,
+ *             because {@code CallerResolver} is still matching against the old label. The live
+ *             half is the rest of {@code fleet:} — {@code architects}/{@code developers}/
+ *             {@code reviewers}, {@code charters}, {@code tabLabel} — read live through the same
+ *             {@code CompositePeerLauncher} supplier the Hot bullet above names, so a reload that
+ *             only touches those already applies with nothing to report. Because the hot and frozen
+ *             halves of {@code fleet:} are disjoint sub-fields rather than the same fields read two
+ *             ways (contrast {@code coordinator.uriEnv} above), {@link #changedSplitKeys} compares
+ *             {@code fleet.leaders} alone, not the whole {@code Fleet} record — comparing the whole
+ *             record would report "split" for a {@code tabLabel}-only change that is actually fully
+ *             hot, over-claiming in exactly the direction this class exists to avoid under-claiming
+ *             in.</li>
+ *       </ul>
+ *       A split change is still accepted — {@link Outcome#applied()} stays {@code true}, the same
+ *       as a deferred change — because the live half genuinely took effect; refusing the whole
+ *       reload would leave the operator worse off than today. {@link Outcome#split()} names the
+ *       key and says which half is which each time, rather than trying to score "how changed" a
+ *       mixed key is or handle "both halves changed in one reload" as a special case.</li>
 *   <li><strong>Cold</strong> — cannot change at all under a running daemon: {@code bind:},
 *       {@code herdrSocket:}, {@code broker:} and {@code auth:}. The socket is bound, the broker
 *       connection is open, and the auth mode decides who may reach the port that is already
 *       listening.</li>
 * </ul>
 *
+ * <p><strong>The denominator, measured on 2026-09-04 (fleetd #330; recounted for fleetd #333).</strong>
+ * {@code FleetConfig} has 22 top-level record components: 5 cold, 11 deferred, 3 split, 3
+ * hot-excluded. Three of them are named nowhere in this file, and the reason is the same for all
+ * three: {@code placement}, {@code memberCredentials} and {@code memberLoginShell} are
+ * <strong>hot</strong> and correctly absent — all three are read live off {@code config.get()}
+ * (placement through the {@code CompositePeerLauncher} supplier the Hot bullet names;
+ * {@code memberCredentials}/{@code memberLoginShell} at spawn time, {@code Fleetd.java:198, 205, 729}
+ * and {@code HerdrPeerLauncher#configuredMemberLoginShell}), so a reload takes effect on the next
+ * spawn with no entry needed here.
+ * {@code health} and {@code coordinator} used to be a third kind — <strong>undecided</strong>, not
+ * hot — until fleetd #330 added the <strong>split</strong> class above and gave them a home. A
+ * reload touching either used to report a bare "config reloaded", which under-claimed; now it names
+ * the key and says which half is which. {@code fleet} was the same story in reverse: fleetd #330's
+ * own fact-find named {@code health}/{@code coordinator} as "the complete set of split-shaped keys"
+ * and filed {@code fleet.leaders}'s restart requirement as a documented caveat sitting in the
+ * <strong>hot-excluded</strong> escape hatch instead — correctly documented, but in the one bucket
+ * this file's own coverage test cannot check the truth of (see that test's javadoc). fleetd #333
+ * moved it into <strong>split</strong>, where {@link #changedSplitKeys} actually reports it.
+ * <p>The point of writing the count down: "not mentioned in this file" looks identical for a key
+ * that is correctly hot and for a key nobody triaged. Three times now — {@code worktreeGroup} (#323),
+ * {@code primary}/{@code configReload} (#326), and {@code fleet.leaders} sitting in the escape hatch
+ * (#333) — the second kind hid among the first. A top-level coverage checker in the
+ * {@link ConfigRefProfileCoverageTest} shape (one level up, over {@code FleetConfig} itself rather
+ * than {@code FleetConfig.Profile}) proves this file's four classes exhaust the record's components
+ * — see {@code ConfigRefTopLevelCoverageTest}. That test proves the record's <em>shape</em> is fully
+ * triaged; it does NOT prove a {@code SPLIT_KEYS}/{@code COLD_KEYS} member has any reporting code
+ * behind it at all — {@code ConfigRefTopLevelReportingCoverageTest} is what fleetd #333 added for
+ * that, after measuring that a {@code SPLIT_KEYS} entry with its reporting branch deleted passes
+ * both this file's own "kept in step" assert and {@code ConfigRefTopLevelCoverageTest} unchanged.
+ *
 * <p><strong>A cold change refuses the whole reload.</strong> Not the hot half applied and the cold
 * half warned about: that would leave the running daemon in a state matching no file on disk, which
 * is the worst thing a reload can do to an operator debugging one. Refusing keeps the invariant that
 * the live config is always some version of the file, and the message names the keys that must
- * change through a restart.
+ * change through a restart. A split change does <em>not</em> refuse, for a different reason than a
+ * deferred change does not: its live half genuinely took effect, so refusing would throw that away
+ * and leave the operator worse off than the partial-but-honest report {@link Outcome#split()} gives.
 *
 * <p>A reload that fails to parse or fails validation is also refused, and the previous config keeps
 * running. A config file being edited is normally read once mid-save; degrading a working daemon
@@ -71,10 +173,24 @@ public final class ConfigRef implements Supplier<FleetConfig> {

    private static final Logger log = LoggerFactory.getLogger(ConfigRef.class);

-    /** Keys that cannot change under a running daemon — see the class doc. */
-    private static final Set<String> COLD_KEYS =
+    /**
+     * Keys that cannot change under a running daemon — see the class doc.
+     *
+     * <p>Package-private (not {@code private}) so {@code ConfigRefTopLevelCoverageTest} can fold it
+     * into the top-level triage it checks, the same way it reads {@link #SPLIT_KEYS}.
+     */
+    static final Set<String> COLD_KEYS =
             Set.of("bind", "herdrSocket", "memberHerdrSocket", "broker", "auth");

+    /**
+     * Keys read BOTH off the startup snapshot and live off {@link #get()} at different sites, so
+     * neither the hot, deferred nor cold class fits them as a whole — see the class doc's Split
+     * bullet (fleetd #330). A changed split key is accepted ({@link Outcome#applied()} stays
+     * {@code true}) and reported by name, with a message naming which half is live and which needs
+     * a restart.
+     */
+    static final Set<String> SPLIT_KEYS = Set.of("health", "coordinator", "fleet");
+
    private final Path path;
    private final AtomicReference<FleetConfig> current;

@@ -102,25 +218,37 @@ public final class ConfigRef implements Supplier<FleetConfig> {
    /**
     * What a reload attempt did.
     *
+     * <p>{@code split} is a separate field from {@code deferred} rather than a differently-worded
+     * entry inside it, because the two carry different guarantees for any caller that branches on
+     * them rather than just printing {@link #summary()}: every {@code deferred} entry means "this
+     * key's whole change waits for a restart", while every {@code split} entry means "part of this
+     * key's change already applied, and the message says which part" — collapsing them would force
+     * a caller to re-parse the message to tell those apart. See the class doc's Split bullet
+     * (fleetd #330) for why the key needs this at all.
+     *
     * @param applied  true when the new config is now live
     * @param coldKeys cold keys whose value changed, which is why an unapplied reload was refused
-     * @param deferred keys that changed and were accepted, but whose effect waits for a restart
+     * @param deferred keys that changed and were accepted, but whose effect waits entirely on a
+     *                 restart
+     * @param split    split keys that changed and were accepted, each named with which half of it
+     *                 is already live and which half waits for a restart
     * @param error    the parse or validation failure that refused the reload, else {@code null}
     */
    public record Outcome(boolean applied, List<String> coldKeys, List<String> deferred,
-                          String error) {
+                          List<String> split, String error) {

        public Outcome {
            coldKeys = List.copyOf(coldKeys);
            deferred = List.copyOf(deferred);
+            split = List.copyOf(split);
        }

        static Outcome refusedCold(List<String> keys) {
-            return new Outcome(false, keys, List.of(), null);
+            return new Outcome(false, keys, List.of(), List.of(), null);
        }

        static Outcome failed(String error) {
-            return new Outcome(false, List.of(), List.of(), error);
+            return new Outcome(false, List.of(), List.of(), List.of(), error);
        }

        /** A one-line summary for the operator — the reason, not just the verdict. */
@@ -132,11 +260,18 @@ public final class ConfigRef implements Supplier<FleetConfig> {
                return "config reload refused — these keys cannot change under a running daemon: "
                        + String.join(", ", coldKeys) + ". Restart fleetd to apply them.";
            }
-            if (!deferred.isEmpty()) {
-                return "config reloaded; these changes need a restart to take effect: "
-                        + String.join(", ", deferred);
+            if (deferred.isEmpty() && split.isEmpty()) {
+                return "config reloaded";
            }
-            return "config reloaded";
+            StringBuilder out = new StringBuilder("config reloaded");
+            if (!deferred.isEmpty()) {
+                out.append("; these changes need a restart to take effect: ")
+                        .append(String.join(", ", deferred));
+            }
+            if (!split.isEmpty()) {
+                out.append("; partially live — ").append(String.join(" | ", split));
+            }
+            return out.toString();
        }
    }

@@ -177,14 +312,21 @@ public final class ConfigRef implements Supplier<FleetConfig> {
        }

        List<String> deferred = changedDeferredKeys(old, fresh);
+        List<String> split = changedSplitKeys(old, fresh);
        current.set(fresh);
-        Outcome out = new Outcome(true, List.of(), deferred, null);
+        Outcome out = new Outcome(true, List.of(), deferred, split, null);
        log.info(out.summary());
        return out;
    }

-    /** Cold keys whose value differs between the running config and the candidate. */
-    private static List<String> changedColdKeys(FleetConfig old, FleetConfig fresh) {
+    /**
+     * Cold keys whose value differs between the running config and the candidate.
+     *
+     * <p>Package-private (not {@code private}) so {@code ConfigRefTopLevelReportingCoverageTest}
+     * can call it directly with a reflection-built {@code FleetConfig} pair, the same reason
+     * {@link #sameLaunchSettings} is package-private — see that test's class doc (fleetd #333).
+     */
+    static List<String> changedColdKeys(FleetConfig old, FleetConfig fresh) {
        List<String> changed = new ArrayList<>();
        if (!Objects.equals(old.bind(), fresh.bind())) {
            changed.add("bind");
@@ -221,6 +363,29 @@ public final class ConfigRef implements Supplier<FleetConfig> {
        if (!Objects.equals(old.worktreeRoot(), fresh.worktreeRoot())) {
            changed.add("worktreeRoot");
        }
+        // Baked into the same GitWorktrees as worktreeRoot (Fleetd.java:251) and never rebuilt
+        // either — see the class doc. Missing this check was fleetd #323 instance 2: a reload
+        // that changed only worktreeGroup reported "config reloaded" with nothing deferred, and
+        // newly provisioned worktrees kept the old sharing behaviour.
+        if (!Objects.equals(old.worktreeGroup(), fresh.worktreeGroup())) {
+            changed.add("worktreeGroup");
+        }
+        // fleetd #326: Fleetd.java:506, 519, 520 read cfg.primary() only off the startup snapshot
+        // (PrimaryRegistry's pinned terminal, ReplyPushLoop's reminder cap and backoff) — neither is
+        // rebuilt on reload, so a changed value needs a restart. Note what it does NOT mean:
+        // primary.terminal is deprecated (CB-532), identity comes from leaders:/leadScan:, so a lead
+        // using those is unaffected by this pin either way. See the class doc for the exact scope.
+        if (!Objects.equals(old.primary(), fresh.primary())) {
+            changed.add("primary");
+        }
+        // fleetd #326: Fleetd.java:679-680 read cfg.configReload() only at startup to decide whether
+        // to build a ConfigWatcher at all and with what interval — the watcher that would apply a
+        // later change is itself built once, so a running watcher keeps its original enabled flag and
+        // interval regardless of what a reload changes it to. Not cold: no already-open resource goes
+        // inconsistent with the new value, a watcher (if any) simply keeps polling on the old settings.
+        if (!Objects.equals(old.configReload(), fresh.configReload())) {
+            changed.add("configReload");
+        }
        if (!Objects.equals(old.spawnReadyTimeoutMs(), fresh.spawnReadyTimeoutMs())
                || !Objects.equals(old.spawnReadyPollMs(), fresh.spawnReadyPollMs())) {
            changed.add("spawnReady*");
@@ -265,14 +430,101 @@ public final class ConfigRef implements Supplier<FleetConfig> {
    }

    /**
-     * Whether two versions of a profile would launch a peer identically. Compares every component
-     * the launcher reads at spawn; {@code weight}, {@code maxLoad} and {@code credentialId} are
-     * excluded because those are read live (by the placement policy and, for credentialId, by
-     * {@code CompositePeerLauncher}/the CB-578 stage B exhaustion sink) and really do take effect on
-     * the next spawn.
+     * Split keys whose value differs between the running config and the candidate — see the class
+     * doc's Split bullet (fleetd #330, extended for {@code fleet:} by fleetd #333). Unlike
+     * {@link #changedDeferredKeys}, this does not try to tell which sub-field moved for {@code
+     * health:} or {@code coordinator:}: any change to either gets the same fixed message, because
+     * the message already names both halves every time, so there is no "which half changed"
+     * question left for the caller to answer. {@code fleet:} is different on purpose — see below.
+     *
+     * <p>Package-private (not {@code private}) so {@code ConfigRefTopLevelReportingCoverageTest}
+     * can call it directly with a reflection-built {@code FleetConfig} pair, the same reason
+     * {@link #sameLaunchSettings} is package-private — see that test's class doc (fleetd #333). That
+     * test exists because membership in {@link #SPLIT_KEYS} proves nothing about this method on its
+     * own: fleetd #333 measured that dropping the {@code coordinator} branch out of this method
+     * while leaving {@code "coordinator"} in {@code SPLIT_KEYS} left the whole suite green except a
+     * hand-written {@code ConfigRefTest} case — neither {@code ConfigRefTopLevelCoverageTest} (it
+     * only reads the set) nor the "kept in step" assert below (it only checks the reported keys are
+     * a SUBSET of {@code SPLIT_KEYS}, never that every {@code SPLIT_KEYS} member has a branch here)
+     * would have caught it.
     */
-    private static boolean sameLaunchSettings(FleetConfig.Profile a, FleetConfig.Profile b) {
-        return Objects.equals(a.baseUrl(), b.baseUrl())
+    static List<String> changedSplitKeys(FleetConfig old, FleetConfig fresh) {
+        List<String> changed = new ArrayList<>();
+        if (!Objects.equals(old.health(), fresh.health())) {
+            changed.add("health: the monitor itself (enabled, interval, workingSuspectAfter) is "
+                    + "frozen at startup and needs a restart; the coverage status fleet_profiles "
+                    + "reports is read live and already applied");
+        }
+        if (!Objects.equals(old.coordinator(), fresh.coordinator())) {
+            changed.add("coordinator: the LeadMailbox connection (uri, uriEnv, selfId, prefetch) is "
+                    + "opened once and needs a restart; the broker URI env-var name kept out of a "
+                    + "member's environment is read live on every spawn and already applied");
+        }
+        // fleetd #333: unlike health/coordinator above, most of `fleet:` (architects, developers,
+        // reviewers, charters, tabLabel) is genuinely hot — ConfigRefTest.aHotChangeIsAppliedAndRead-
+        // ThroughGet and aCharterChangeIsHotAndReachesTheLiveConfig prove it reaches the live config
+        // with no restart note. Only fleet.leaders is frozen (Fleetd.java:281 reads
+        // cfg.fleet().leaders() off the startup snapshot to build both the LeadTabScanner's
+        // tab-label-to-name map, wired into CallerResolver.withLeadsAndMembers at Fleetd.java:620/624,
+        // and — when herdr answered — LeadLauncher(...).ensureLeads() at Fleetd.java:315, which
+        // auto-launches each lead up to its `instances` count; neither is rebuilt on reload). So this
+        // compares fleet.leaders alone, not the whole Fleet record: comparing the whole record would
+        // report "split" for a tabLabel-only or charters-only change that is actually fully hot,
+        // which is the over-claim mirror of the under-claim bug this class exists to prevent.
+        if (!Objects.equals(leadersOf(old), leadersOf(fresh))) {
+            changed.add("fleet: fleet.leaders (each lead's tab, workspace, cwd, profile and "
+                    + "instances count) is read once at startup to build the LeadTabScanner's "
+                    + "identity map and to auto-launch leads, and neither is rebuilt on reload, so a "
+                    + "lead added, removed, or given a new tab: label needs a restart — until then it "
+                    + "stays unrecognised, and a caller from its new tab resolves as a worker, not a "
+                    + "lead; the rest of fleet: (architects, developers, reviewers, charters, "
+                    + "tabLabel) is read live through the supplier on CompositePeerLauncher and "
+                    + "already applied");
+        }
+        // Kept in step with SPLIT_KEYS the same way changedColdKeys is kept in step with COLD_KEYS —
+        // every message here must be traceable to one of the split keys the class doc documents.
+        // NOTE what this does NOT prove, per the javadoc above: it does not catch a SPLIT_KEYS
+        // member with no branch above at all, only a branch whose message is mis-worded relative to
+        // the set. ConfigRefTopLevelReportingCoverageTest is what proves the former.
+        assert changed.stream().allMatch(m -> SPLIT_KEYS.stream().anyMatch(k -> m.startsWith(k + ":")))
+                : "a split entry was reported that does not start with a SPLIT_KEYS name: " + changed;
+        return changed;
+    }
+
+    /** {@code cfg.fleet().leaders()}, defensively, in case a caller hands in a non-defaulted config. */
+    private static Map<String, FleetConfig.Leader> leadersOf(FleetConfig cfg) {
+        return cfg.fleet() == null ? Map.of() : cfg.fleet().leaders();
+    }
+
+    /**
+     * {@link FleetConfig.Profile} record components deliberately left out of
+     * {@link #sameLaunchSettings} because they are read <em>live</em>, not baked in at spawn — see
+     * the class doc's <em>Hot</em> bullet. {@code weight} and {@code maxLoad} are read live by the
+     * placement policy on every spawn; {@code credentialId} is read live by
+     * {@code CompositePeerLauncher} and the CB-578 stage B exhaustion sink. Nothing else is
+     * excluded — see {@code sameLaunchSettingsComparesEveryProfileComponentOrExcludesIt} in
+     * {@code ConfigRefProfileCoverageTest}, which enumerates every {@code Profile} record component
+     * by reflection and fails the build if one is neither compared below nor named here.
+     */
+    static final Set<String> LAUNCH_SETTINGS_EXCLUDED = Set.of("weight", "maxLoad", "credentialId");
+
+    /**
+     * Whether two versions of a profile would launch a peer identically.
+     *
+     * <p>This must compare every {@link FleetConfig.Profile} record component except the three in
+     * {@link #LAUNCH_SETTINGS_EXCLUDED}. That is not a claim this javadoc can make good on by
+     * itself — a javadoc saying "compares every component" is exactly what fleetd #323 found to be
+     * false for three fields (and a sibling method's field list, for a fourth). The actual
+     * guarantee comes from {@code ConfigRefProfileCoverageTest}: it enumerates every record
+     * component of {@code FleetConfig.Profile} by reflection, mutates each one not in
+     * {@code LAUNCH_SETTINGS_EXCLUDED} on a base profile, and asserts this method reports a
+     * difference — so a new component that is neither compared here nor added to
+     * {@code LAUNCH_SETTINGS_EXCLUDED} (with a reason) fails that test by name, rather than
+     * silently reporting "config reloaded" for a value the daemon never picked up.
+     */
+    static boolean sameLaunchSettings(FleetConfig.Profile a, FleetConfig.Profile b) {
+        return Objects.equals(a.profile(), b.profile())
+                && Objects.equals(a.baseUrl(), b.baseUrl())
                && Objects.equals(a.model(), b.model())
                && Objects.equals(a.configDir(), b.configDir())
                && Objects.equals(a.tokenEnv(), b.tokenEnv())
@@ -298,6 +550,16 @@ public final class ConfigRef implements Supplier<FleetConfig> {
                // fleetd #201 Unit 5: errorPattern is compiled once into Fleetd.main's backend-error
                // pattern map at startup (see BackendErrorPatternLookup wiring), the same way
                // exhaustedPattern is — a reload never re-reads it either.
-                && Objects.equals(a.errorPattern(), b.errorPattern());
+                && Objects.equals(a.errorPattern(), b.errorPattern())
+                // fleetd #323 instance 1: ideProjectDir and ideOpenCommand are read at spawn off the
+                // same frozen profile map as ideMcpUrl above (ClaudeCodeLauncher.java:267/269,
+                // OpenCodeLauncher.java:474/480/486) and were missing from this comparison.
+                && Objects.equals(a.ideProjectDir(), b.ideProjectDir())
+                && Objects.equals(a.ideOpenCommand(), b.ideOpenCommand())
+                // fleetd #323 instance 1: autoCompactWindow is read at spawn the same way
+                // (ClaudeCodeLauncher.java:926, OpenCodeLauncher.java:650). Comparing it here only
+                // makes the reload REPORT that a restart is needed — it deliberately does not make
+                // autoCompactWindow take effect live, which is a separate, larger change.
+                && Objects.equals(a.autoCompactWindow(), b.autoCompactWindow());
    }
 }
@@ -0,0 +1,202 @@
+package dev.ltms.fleet.config;
+
+import org.junit.jupiter.api.Test;
+
+import java.lang.reflect.Constructor;
+import java.lang.reflect.RecordComponent;
+import java.util.Arrays;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.TreeSet;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #323: {@code ConfigRef.sameLaunchSettings} javadoc used to claim it "compares every
+ * component the launcher reads at spawn". It did not — {@code ideProjectDir}, {@code
+ * ideOpenCommand} and {@code autoCompactWindow} were all baked in at daemon startup (see
+ * {@code ClaudeCodeLauncher}/{@code OpenCodeLauncher}) and missing from the comparison, so a reload
+ * that changed only one of them reported "config reloaded" and the running daemon kept the old
+ * value.
+ *
+ * <p>This class is the mechanism the issue asked for: it enumerates every record component of
+ * {@link FleetConfig.Profile} by reflection and proves — by actually mutating a base profile one
+ * field at a time and calling the real method — that each component is either compared by
+ * {@link ConfigRef#sameLaunchSettings} or named in {@link ConfigRef#LAUNCH_SETTINGS_EXCLUDED} with
+ * a reason. A new profile field that is neither fails this test by name, not a hand-maintained list
+ * going stale.
+ */
+class ConfigRefProfileCoverageTest {
+
+    private static final RecordComponent[] COMPONENTS = FleetConfig.Profile.class.getRecordComponents();
+
+    /**
+     * One valid, non-blank value per record component — "the a value". None of these trip any
+     * defaulting/normalization in {@code Profile}'s compact constructor (see {@code
+     * FleetConfig.java}), so what goes in is what {@code sameLaunchSettings} sees back out.
+     */
+    private static final Map<String, Object> BASE = baseValues();
+
+    /** The same shape, each value distinct from {@link #BASE} — "the b value". */
+    private static final Map<String, Object> ALT = altValues();
+
+    private static Map<String, Object> baseValues() {
+        Map<String, Object> v = new LinkedHashMap<>();
+        v.put("profile", "sonnet");
+        v.put("baseUrl", "http://gx00.gw:8000");
+        v.put("model", "sonnet");
+        v.put("configDir", "/config/a");
+        v.put("tokenEnv", "TOKEN_A");
+        v.put("argv", List.of("claude", "--flag-a"));
+        v.put("placement", "tab");
+        v.put("workspace", "workspace-a");
+        v.put("tabLabel", "label-a");
+        v.put("mcpUrl", "http://mcp-a");
+        v.put("cwd", "/cwd/a");
+        v.put("parityOverlay", List.of(".env", ".env.a"));
+        v.put("gitTokenEnv", "GIT_TOKEN_A");
+        v.put("gitHostEnv", "GITEA_HOST_A");
+        v.put("kind", "claude-code");
+        v.put("env", Map.of("K", "A"));
+        v.put("weight", 1.0f);
+        v.put("maxLoad", 5);
+        v.put("subscription", Boolean.TRUE);
+        v.put("exhaustedPattern", "usage limit a");
+        v.put("credentialId", "cred-a");
+        v.put("ideMcpUrl", "http://ide-mcp-a");
+        v.put("ideProjectDir", "modules/a");
+        v.put("ideOpenCommand", "open-cmd-a {dir}");
+        v.put("autoCompactWindow", 150000);
+        v.put("errorPattern", "error a");
+        assertNamesMatchComponents(v);
+        return v;
+    }
+
+    private static Map<String, Object> altValues() {
+        Map<String, Object> v = new LinkedHashMap<>();
+        v.put("profile", "sonnet-b");
+        v.put("baseUrl", "http://gx01.gw:8000");
+        v.put("model", "haiku");
+        v.put("configDir", "/config/b");
+        v.put("tokenEnv", "TOKEN_B");
+        v.put("argv", List.of("claude", "--flag-b"));
+        v.put("placement", "weighted");
+        v.put("workspace", "workspace-b");
+        v.put("tabLabel", "label-b");
+        v.put("mcpUrl", "http://mcp-b");
+        v.put("cwd", "/cwd/b");
+        v.put("parityOverlay", List.of(".env", ".env.b"));
+        v.put("gitTokenEnv", "GIT_TOKEN_B");
+        v.put("gitHostEnv", "GITEA_HOST_B");
+        v.put("kind", "opencode");
+        v.put("env", Map.of("K", "B"));
+        v.put("weight", 2.0f);
+        v.put("maxLoad", 9);
+        v.put("subscription", Boolean.FALSE);
+        v.put("exhaustedPattern", "usage limit b");
+        v.put("credentialId", "cred-b");
+        v.put("ideMcpUrl", "http://ide-mcp-b");
+        v.put("ideProjectDir", "modules/b");
+        v.put("ideOpenCommand", "open-cmd-b {dir}");
+        v.put("autoCompactWindow", 250000);
+        v.put("errorPattern", "error b");
+        assertNamesMatchComponents(v);
+        return v;
+    }
+
+    private static void assertNamesMatchComponents(Map<String, Object> values) {
+        Set<String> componentNames = new TreeSet<>();
+        for (RecordComponent rc : COMPONENTS) {
+            componentNames.add(rc.getName());
+        }
+        assertEquals(componentNames, new TreeSet<>(values.keySet()),
+                "this test's value map has drifted from FleetConfig.Profile's actual components — "
+                        + "update BASE/ALT alongside the record");
+    }
+
+    private static FleetConfig.Profile profileOf(Map<String, Object> values) throws ReflectiveOperationException {
+        Class<?>[] types = Arrays.stream(COMPONENTS).map(RecordComponent::getType).toArray(Class<?>[]::new);
+        Object[] args = Arrays.stream(COMPONENTS)
+                .map(rc -> values.get(rc.getName()))
+                .toArray();
+        Constructor<FleetConfig.Profile> ctor = FleetConfig.Profile.class.getDeclaredConstructor(types);
+        return ctor.newInstance(args);
+    }
+
+    /** {@code BASE} with exactly one named component swapped for its {@code ALT} value. */
+    private static FleetConfig.Profile mutate(String componentName) throws ReflectiveOperationException {
+        Map<String, Object> values = new LinkedHashMap<>(BASE);
+        values.put(componentName, ALT.get(componentName));
+        return profileOf(values);
+    }
+
+    /**
+     * The mechanism fleetd #323 asked for: enumerate {@link FleetConfig.Profile}'s record
+     * components, mutate each non-excluded one, and prove {@code sameLaunchSettings} actually
+     * notices — not just that some hand-maintained list claims it does. Prints the denominator
+     * (total / compared / excluded) the issue required: a checker that cannot state its own
+     * denominator is the failure this repo keeps hitting.
+     */
+    @Test
+    void sameLaunchSettingsComparesEveryProfileComponentOrExcludesIt() throws ReflectiveOperationException {
+        int total = COMPONENTS.length;
+        Set<String> excluded = ConfigRef.LAUNCH_SETTINGS_EXCLUDED;
+
+        Set<String> allNames = new TreeSet<>();
+        for (RecordComponent rc : COMPONENTS) {
+            allNames.add(rc.getName());
+        }
+        assertTrue(allNames.containsAll(excluded),
+                "ConfigRef.LAUNCH_SETTINGS_EXCLUDED names a component that does not exist on "
+                        + "FleetConfig.Profile — check for a typo: " + excluded);
+
+        // The exclusion set is this mechanism's own escape hatch, so it has to be pinned too.
+        // Found by mutation while verifying fleetd #323: moving autoCompactWindow and
+        // ideOpenCommand OUT of the comparison and INTO the exclusion set left the whole suite
+        // green — the loop below simply skips them, and the denominator assertion still balances.
+        // That is exactly the lazy move a failing coverage test invites, and it silently restores
+        // the #323 bug. Only ideProjectDir and worktreeGroup were saved by a behavioural test in
+        // ConfigRefTest; the other two had none. So: growing this set now requires editing this
+        // line as well, which is a visible, deliberate diff rather than a quiet one.
+        assertEquals(Set.of("weight", "maxLoad", "credentialId"), excluded,
+                "ConfigRef.LAUNCH_SETTINGS_EXCLUDED changed. A component belongs in it ONLY if it "
+                        + "is read live off the config supplier, not baked into a launcher at "
+                        + "startup. If you are adding one to silence this test, that is fleetd #323 "
+                        + "happening again: compare it in sameLaunchSettings instead. If it really "
+                        + "is read live, name where it is read and update this assertion.");
+
+        FleetConfig.Profile base = profileOf(BASE);
+        List<String> uncovered = new java.util.ArrayList<>();
+        int compared = 0;
+        for (RecordComponent rc : COMPONENTS) {
+            String name = rc.getName();
+            if (excluded.contains(name)) {
+                continue;
+            }
+            FleetConfig.Profile mutated = mutate(name);
+            if (ConfigRef.sameLaunchSettings(base, mutated)) {
+                uncovered.add(name);
+            } else {
+                compared++;
+            }
+        }
+
+        System.out.printf(
+                "ConfigRef.sameLaunchSettings coverage — %d Profile components total, %d compared, "
+                        + "%d excluded (%s)%n",
+                total, compared, excluded.size(), excluded);
+
+        assertEquals(List.of(), uncovered,
+                "these FleetConfig.Profile components changed but ConfigRef.sameLaunchSettings "
+                        + "reported no difference — add each one to the comparison (it is read at "
+                        + "spawn and baked in until a restart) or to ConfigRef.LAUNCH_SETTINGS_EXCLUDED "
+                        + "with a reason it is genuinely read live: " + uncovered);
+        assertEquals(total, compared + excluded.size(),
+                "every FleetConfig.Profile record component must be either compared or excluded — "
+                        + total + " components, " + compared + " compared, " + excluded.size()
+                        + " excluded");
+    }
+}
@@ -434,6 +434,364 @@ class ConfigRefTest {
        assertEquals("provider 5xx", ref.get().profiles().get("sonnet").errorPattern());
    }

+    /**
+     * fleetd #323 instance 1: {@code ideProjectDir} is read at spawn off the frozen profile map
+     * (see {@code ClaudeCodeLauncher}/{@code OpenCodeLauncher}) exactly like {@code model}, but was
+     * missing from {@code sameLaunchSettings} — a reload changing only this field used to report a
+     * bare "config reloaded" and the running daemon kept launching with the old value.
+     */
+    @Test
+    void changingAProfilesIdeProjectDirIsReportedAsDeferred(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                herdrSocket: ~/.config/herdr/herdr.sock
+                profiles:
+                  sonnet:
+                    baseUrl: http://gx00.gw:8000
+                    model: sonnet
+                    ideProjectDir: fleetd
+                guard:
+                  offSubscriptionHosts:
+                    - gx00.gw
+                """);
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, """
+                bind:
+                  host: 127.0.0.1
+                  port: 8765
+                herdrSocket: ~/.config/herdr/herdr.sock
+                profiles:
+                  sonnet:
+                    baseUrl: http://gx00.gw:8000
+                    model: sonnet
+                    ideProjectDir: fleetd-renamed
+                guard:
+                  offSubscriptionHosts:
+                    - gx00.gw
+                """);
+        ConfigRef.Outcome out = ref.reload();
+
+        assertTrue(out.applied());
+        assertEquals(1, out.deferred().size(), out.deferred().toString());
+        assertTrue(out.deferred().getFirst().contains("sonnet"), out.deferred().toString());
+        assertTrue(out.deferred().getFirst().contains("launch settings"), out.deferred().toString());
+        // The snapshot still carries the new value — a restart is what makes it take effect.
+        assertEquals("fleetd-renamed", ref.get().profiles().get("sonnet").ideProjectDir());
+    }
+
+    /**
+     * fleetd #323 instance 2: {@code worktreeGroup} is baked into the same {@code GitWorktrees}
+     * as {@code worktreeRoot} (Fleetd.java:251) and never rebuilt, but only {@code worktreeRoot}
+     * was on {@code changedDeferredKeys} — a reload changing only the group reported a bare
+     * "config reloaded" and newly provisioned worktrees kept the old sharing behaviour.
+     */
+    @Test
+    void changingWorktreeGroupIsReportedAsDeferred(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("worktreeGroup: devgroup\n"));
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, yaml("worktreeGroup: devgroup2\n"));
+        ConfigRef.Outcome out = ref.reload();
+
+        assertTrue(out.applied());
+        assertEquals(java.util.List.of("worktreeGroup"), out.deferred());
+        assertTrue(out.summary().contains("needs a restart") || out.summary().contains("need a restart"),
+                out.summary());
+        // The snapshot still carries the new value — a restart is what makes it take effect.
+        assertEquals("devgroup2", ref.get().worktreeGroup());
+    }
+
+    /**
+     * fleetd #326: {@code primary} is read only off the startup snapshot — {@code Fleetd.java:506,
+     * 519, 520} feed {@code PrimaryRegistry} and {@code ReplyPushLoop} at construction and neither is
+     * rebuilt on reload — but it was missing from {@link ConfigRef#changedDeferredKeys}, so a reload
+     * that only changed the pinned primary terminal reported a bare "config reloaded" while a lead
+     * whose tab no longer matched stayed demoted to worker.
+     */
+    @Test
+    void changingPrimaryIsReportedAsDeferred(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("""
+                primary:
+                  terminal: term-a
+                """));
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, yaml("""
+                primary:
+                  terminal: term-b
+                """));
+        ConfigRef.Outcome out = ref.reload();
+
+        assertTrue(out.applied());
+        assertEquals(java.util.List.of("primary"), out.deferred());
+        assertTrue(out.summary().contains("need") && out.summary().contains("restart"), out.summary());
+        // The snapshot still carries the new value — a restart is what makes it take effect.
+        assertEquals("term-b", ref.get().primary().terminal());
+    }
+
+    /**
+     * fleetd #326: {@code configReload} itself is read only at startup ({@code Fleetd.java:679-680})
+     * to decide whether to build a {@code ConfigWatcher} at all, and with what interval — the watcher
+     * that would apply a later change is itself built once, so it is deferred rather than cold (see
+     * {@link ConfigRef}'s class doc: cold means an already-open resource would go inconsistent with
+     * the new value, and there is no such resource here — a running watcher just keeps polling on its
+     * original enabled/interval until a restart, exactly like {@code lifecycle} or {@code guard}).
+     * Before this fix, turning reload off (or changing its interval) through a reload reported a bare
+     * "config reloaded" — the obvious joke the issue names.
+     */
+    @Test
+    void changingConfigReloadIsReportedAsDeferred(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("""
+                configReload:
+                  enabled: true
+                  intervalSeconds: 10
+                """));
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, yaml("""
+                configReload:
+                  enabled: false
+                  intervalSeconds: 30
+                """));
+        ConfigRef.Outcome out = ref.reload();
+
+        assertTrue(out.applied());
+        assertEquals(java.util.List.of("configReload"), out.deferred());
+        assertTrue(out.summary().contains("need") && out.summary().contains("restart"), out.summary());
+        // The snapshot still carries the new value — a restart is what makes it take effect.
+        assertFalse(ref.get().configReload().isEnabled());
+        assertEquals(30, ref.get().configReload().intervalSeconds());
+    }
+
+    /**
+     * fleetd #330: {@code health:} is read both ways — {@code Fleetd.java:556-563} builds the
+     * monitor off the startup snapshot and never rebuilds it, but {@code Fleetd.java:648-650} reads
+     * {@code config.get().health()} live on every {@code fleet_profiles} call. A changed value is
+     * neither purely hot nor purely deferred, so it gets its own {@code split} report naming both
+     * halves rather than a bare "config reloaded" (which would hide the frozen half) or a plain
+     * {@code deferred} entry (which would hide that the coverage string already applied).
+     */
+    @Test
+    void changingHealthIsReportedAsSplit(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("""
+                health:
+                  enabled: true
+                  intervalSeconds: 30
+                """));
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, yaml("""
+                health:
+                  enabled: true
+                  intervalSeconds: 90
+                """));
+        ConfigRef.Outcome out = ref.reload();
+
+        assertTrue(out.applied());
+        assertTrue(out.deferred().isEmpty(), out.deferred().toString());
+        assertEquals(1, out.split().size(), out.split().toString());
+        assertTrue(out.split().getFirst().startsWith("health:"), out.split().toString());
+        assertTrue(out.split().getFirst().contains("restart"), out.split().toString());
+        assertTrue(out.split().getFirst().contains("live"), out.split().toString());
+        assertTrue(out.summary().contains("partially live"), out.summary());
+        // The snapshot still carries the new value — the monitor itself is what waits for a restart.
+        assertEquals(90, ref.get().health().intervalSeconds());
+    }
+
+    /**
+     * fleetd #330: {@code coordinator:} is the other split key — {@code Fleetd.java:502} opens the
+     * {@code LeadMailbox} off the startup snapshot and never reopens it, but
+     * {@code HerdrPeerLauncher.java:1530} reads {@code config.get().coordinator()} live on every
+     * spawn to keep the broker URI env-var name out of a member's environment.
+     */
+    @Test
+    void changingCoordinatorIsReportedAsSplit(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("""
+                coordinator:
+                  selfId: mac-a
+                """));
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, yaml("""
+                coordinator:
+                  selfId: mac-b
+                """));
+        ConfigRef.Outcome out = ref.reload();
+
+        assertTrue(out.applied());
+        assertTrue(out.deferred().isEmpty(), out.deferred().toString());
+        assertEquals(1, out.split().size(), out.split().toString());
+        assertTrue(out.split().getFirst().startsWith("coordinator:"), out.split().toString());
+        assertTrue(out.split().getFirst().contains("restart"), out.split().toString());
+        assertTrue(out.split().getFirst().contains("live"), out.split().toString());
+        // The snapshot still carries the new value — the LeadMailbox connection is what waits for a
+        // restart; selfId names this daemon's own inbox queue and a peer cannot discover a rename.
+        assertEquals("mac-b", ref.get().coordinator().selfId());
+    }
+
+    /**
+     * fleetd #333: {@code fleet:} is split too — {@code fleet.leaders} is read only at
+     * {@code Fleetd.java:281} to build the {@code LeadTabScanner}'s identity map (fed into
+     * {@code CallerResolver}) and to auto-launch leads via {@code LeadLauncher.ensureLeads()}, and
+     * neither is rebuilt on reload, while the rest of {@code fleet:} (role pools, charters,
+     * tabLabel) is read live through the {@code CompositePeerLauncher} supplier. Before this fix
+     * {@code fleet} sat in the coverage checker's hot-excluded escape hatch, so a reload that
+     * changed only {@code fleet.leaders} reported a bare "config reloaded" — exactly the
+     * under-claim the split class exists to prevent for {@code health}/{@code coordinator}.
+     */
+    @Test
+    void changingFleetLeadersIsReportedAsSplit(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("""
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus-a"
+                      profile: sonnet
+                """));
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, yaml("""
+                fleet:
+                  leaders:
+                    opus:
+                      tab: "lead: opus-b"
+                      profile: sonnet
+                """));
+        ConfigRef.Outcome out = ref.reload();
+
+        assertTrue(out.applied());
+        assertTrue(out.deferred().isEmpty(), out.deferred().toString());
+        assertEquals(1, out.split().size(), out.split().toString());
+        assertTrue(out.split().getFirst().startsWith("fleet:"), out.split().toString());
+        assertTrue(out.split().getFirst().contains("restart"), out.split().toString());
+        assertTrue(out.split().getFirst().contains("live"), out.split().toString());
+        assertTrue(out.summary().contains("partially live"), out.summary());
+        // The snapshot still carries the new value — the LeadTabScanner's identity map and
+        // LeadLauncher's auto-launch are what wait for a restart; a reload rebuilds neither.
+        assertEquals("lead: opus-b", ref.get().fleet().leaders().get("opus").tab());
+    }
+
+    /**
+     * fleetd #333: {@code fleet.leaders} is the ONLY frozen part of {@code fleet:}. A reload that
+     * changes {@code tabLabel} (or charters, or a role pool) without touching {@code fleet.leaders}
+     * must stay fully hot with nothing reported — proving {@link ConfigRef#changedSplitKeys}
+     * compares {@code fleet.leaders} specifically rather than the whole {@code Fleet} record, which
+     * would over-claim "needs a restart" for a change that is genuinely all live (the mirror
+     * mistake of the under-claim this class exists to prevent).
+     */
+    @Test
+    void changingFleetTabLabelWithoutLeadersStaysFullyHot(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("""
+                fleet:
+                  tabLabel: "{role}: {profile} #{n}"
+                """));
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, yaml("""
+                fleet:
+                  tabLabel: "[{profile}] {role}"
+                """));
+        ConfigRef.Outcome out = ref.reload();
+
+        assertTrue(out.applied());
+        assertTrue(out.deferred().isEmpty(), out.deferred().toString());
+        assertTrue(out.split().isEmpty(), out.split().toString());
+        assertEquals("config reloaded", out.summary());
+        assertEquals("[{profile}] {role}", ref.get().fleet().tabLabel());
+    }
+
+    /**
+     * A split change must not refuse the reload (invariant 2 of fleetd #330) and
+     * {@code Outcome.applied()} must stay {@code true} (invariant 3) — unlike a cold change, the
+     * live half of a split key genuinely took effect, so refusing would throw that away.
+     */
+    @Test
+    void aSplitChangeDoesNotRefuseTheReload(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("coordinator:\n  selfId: mac-a\n"));
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, yaml("coordinator:\n  selfId: mac-b\n"));
+        ConfigRef.Outcome out = ref.reload();
+
+        assertTrue(out.applied());
+        assertTrue(out.error() == null);
+        assertTrue(out.coldKeys().isEmpty());
+    }
+
+    /**
+     * Both split keys can change in one reload — the report names both, and a caller reading
+     * {@code split} does not have to guess which half of which key already applied.
+     */
+    @Test
+    void changingBothSplitKeysReportsBoth(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("""
+                health:
+                  enabled: true
+                coordinator:
+                  selfId: mac-a
+                """));
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, yaml("""
+                health:
+                  enabled: false
+                coordinator:
+                  selfId: mac-b
+                """));
+        ConfigRef.Outcome out = ref.reload();
+
+        assertTrue(out.applied());
+        assertEquals(2, out.split().size(), out.split().toString());
+        assertTrue(out.split().stream().anyMatch(s -> s.startsWith("health:")), out.split().toString());
+        assertTrue(out.split().stream().anyMatch(s -> s.startsWith("coordinator:")), out.split().toString());
+    }
+
+    /**
+     * A split key and a deferred key changing in the same reload must both show up, each in its own
+     * list — proving the two fields do not step on each other and {@link ConfigRef.Outcome#summary()}
+     * reports both halves of the message.
+     */
+    @Test
+    void aSplitChangeAndADeferredChangeCoexist(@TempDir Path dir) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml("""
+                coordinator:
+                  selfId: mac-a
+                lifecycle:
+                  drainTimeoutSeconds: 30
+                """));
+        ConfigRef ref = refFor(f);
+
+        Files.writeString(f, yaml("""
+                coordinator:
+                  selfId: mac-b
+                lifecycle:
+                  drainTimeoutSeconds: 60
+                """));
+        ConfigRef.Outcome out = ref.reload();
+
+        assertTrue(out.applied());
+        assertEquals(java.util.List.of("lifecycle"), out.deferred());
+        assertEquals(1, out.split().size(), out.split().toString());
+        assertTrue(out.split().getFirst().startsWith("coordinator:"), out.split().toString());
+        assertTrue(out.summary().contains("need a restart") || out.summary().contains("needs a restart"),
+                out.summary());
+        assertTrue(out.summary().contains("partially live"), out.summary());
+    }
+
    @Test
    void aFixedRefHasNoFileAndRefusesToReload() {
        FleetConfig cfg = new FleetConfig(null, null, null, null, null, null,
@@ -0,0 +1,171 @@
+package dev.ltms.fleet.config;
+
+import org.junit.jupiter.api.Test;
+
+import java.lang.reflect.RecordComponent;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.TreeSet;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #330: a new top-level {@link FleetConfig} record component must be triaged into a reload
+ * class before it ships, or it repeats fleetd #323 ({@code worktreeGroup} missing from {@code
+ * ConfigRef.changedDeferredKeys}) and fleetd #326 ({@code primary}/{@code configReload} missing the
+ * same way) — a key silently absent from {@link ConfigRef}'s reload machinery, so a reload changing
+ * only that key reports a bare "config reloaded" for a change the running daemon never picked up.
+ *
+ * <p>This is the top-level counterpart of {@link ConfigRefProfileCoverageTest}: instead of
+ * enumerating {@link FleetConfig.Profile}'s record components, it enumerates {@link FleetConfig}'s
+ * own — {@code bind}, {@code health}, {@code memberCredentials}, and so on — and requires each to
+ * fall into exactly one of four homes: {@link ConfigRef#COLD_KEYS}, {@link #DEFERRED_TOP_LEVEL_KEYS}
+ * (compared in {@code ConfigRef.changedDeferredKeys}), {@link ConfigRef#SPLIT_KEYS}, or
+ * {@link #HOT_EXCLUDED_TOP_LEVEL_KEYS} (the escape hatch: read live off the config supplier, so no
+ * reload bookkeeping is needed for it at all).
+ *
+ * <h2>What this checker can and cannot prove</h2>
+ * It proves the record's <em>shape</em> is fully triaged: every one of {@code FleetConfig}'s
+ * components sits in exactly one of the four sets, none sits in two, and the escape hatch
+ * ({@link #HOT_EXCLUDED_TOP_LEVEL_KEYS}) cannot silently grow without a visible diff to this file.
+ * That is what "a new component cannot be added without someone triaging it" means in practice.
+ *
+ * <p>It CANNOT prove that any of the citations are <em>true</em>. "Compared in {@code
+ * changedDeferredKeys}" and "read live off {@code config.get()}" are facts about {@code
+ * ConfigRef.java}, {@code Fleetd.java} and {@code HerdrPeerLauncher.java} that a reflection-only
+ * test over {@code FleetConfig}'s shape has no way to inspect — this test would pass identically
+ * whether or not the cited line still does what the comment next to it says. Trust the citation
+ * because a person read the source (the exact call sites are named next to each set below), not
+ * because this test is green. {@link ConfigRefTest} is what behaviourally proves the deferred and
+ * split keys it covers actually get reported; {@link ConfigRefProfileCoverageTest} does the same,
+ * behaviourally, for {@code FleetConfig.Profile}'s own fields.
+ */
+class ConfigRefTopLevelCoverageTest {
+
+    private static final RecordComponent[] COMPONENTS = FleetConfig.class.getRecordComponents();
+
+    /**
+     * Top-level components whose change {@code ConfigRef.changedDeferredKeys} reads and reports on
+     * — verified by reading that method as of fleetd #330, not derived from this test.
+     * {@code spawnReadyTimeoutMs}/{@code spawnReadyPollMs} are compared together and reported under
+     * one combined label ({@code "spawnReady*"}); {@code profiles} is compared twice over — once for
+     * added/removed profile names, once for an existing profile's launch settings — and that second
+     * comparison excludes {@code weight}/{@code maxLoad}/{@code credentialId} as hot sub-fields,
+     * which is what {@link ConfigRefProfileCoverageTest} exists to keep honest at the sub-field
+     * level. {@code profiles} itself still belongs here, not in the hot-exclusion set below: most of
+     * a profile's fields are NOT read live, so citing "read live off the config supplier" for the
+     * whole top-level key would be false.
+     */
+    private static final Set<String> DEFERRED_TOP_LEVEL_KEYS = Set.of(
+            "guard", "worktreeRoot", "worktreeGroup", "primary", "configReload",
+            "leadHeartbeat", "lifecycle", "spawnReadyTimeoutMs", "spawnReadyPollMs",
+            "quarantineCooldownSeconds", "profiles");
+
+    /**
+     * The escape hatch: top-level components with no reload bookkeeping at all, because every read
+     * of them goes live through {@link ConfigRef#get()} rather than off a startup snapshot. A
+     * component belongs here ONLY if that is true — never because adding it here makes this test
+     * pass. fleetd #323 is the cautionary tale for exactly this pattern: the identical hatch on
+     * {@code ConfigRef.LAUNCH_SETTINGS_EXCLUDED} let two profile fields be silently re-broken with
+     * the whole suite green, and it was only caught by mutating the checker itself (see this class's
+     * own mutation test below, and {@code ConfigRefProfileCoverageTest}'s equivalent).
+     *
+     * <ul>
+     *   <li>{@code placement} — read live by the placement policy on every spawn (class doc, Hot
+     *       bullet; {@code ConfigRefTest.aConsumerHoldingTheRefSeesTheNewValue} proves it
+     *       behaviourally).</li>
+     *   <li>{@code memberCredentials} — read live at {@code Fleetd.java:198, 205, 729}.</li>
+     *   <li>{@code memberLoginShell} — read live at
+     *       {@code HerdrPeerLauncher#configuredMemberLoginShell}.</li>
+     * </ul>
+     *
+     * <p>{@code fleet} used to sit here too, on the strength of most of it (role pools, charters,
+     * tabLabel) being read the same live way — but {@code fleet.leaders} inside the same key is
+     * read only at startup and genuinely needs a restart, which is a real gap this escape hatch
+     * cannot represent: it excuses a whole top-level key from reload bookkeeping, and {@code fleet}
+     * needed exactly half of it excused. fleetd #333 moved it into {@link ConfigRef#SPLIT_KEYS}
+     * instead, where {@code changedSplitKeys} reports the frozen half by name. That is the
+     * cautionary tale this test's own javadoc already told: this checker proves the record's shape
+     * is triaged, never that a bucket a key sits in is the right one — a person has to read the
+     * source, which is exactly how fleetd #333 found {@code fleet} sitting in the wrong bucket
+     * while this test stayed green throughout.</p>
+     */
+    private static final Set<String> HOT_EXCLUDED_TOP_LEVEL_KEYS =
+            Set.of("placement", "memberCredentials", "memberLoginShell");
+
+    @Test
+    void everyTopLevelComponentIsAccountedForInExactlyOneClass() {
+        Set<String> allNames = new TreeSet<>();
+        for (RecordComponent rc : COMPONENTS) {
+            allNames.add(rc.getName());
+        }
+
+        Set<String> cold = ConfigRef.COLD_KEYS;
+        Set<String> split = ConfigRef.SPLIT_KEYS;
+        Set<String> deferred = DEFERRED_TOP_LEVEL_KEYS;
+        Set<String> hot = HOT_EXCLUDED_TOP_LEVEL_KEYS;
+
+        // Typo guard on each set — the same check ConfigRefProfileCoverageTest runs on
+        // LAUNCH_SETTINGS_EXCLUDED. A name that does not exist on FleetConfig is a silent no-op.
+        assertTrue(allNames.containsAll(cold),
+                "ConfigRef.COLD_KEYS names a component that does not exist on FleetConfig: " + cold);
+        assertTrue(allNames.containsAll(split),
+                "ConfigRef.SPLIT_KEYS names a component that does not exist on FleetConfig: " + split);
+        assertTrue(allNames.containsAll(deferred),
+                "DEFERRED_TOP_LEVEL_KEYS names a component that does not exist on FleetConfig: " + deferred);
+        assertTrue(allNames.containsAll(hot),
+                "HOT_EXCLUDED_TOP_LEVEL_KEYS names a component that does not exist on FleetConfig: " + hot);
+
+        // The escape hatch is pinned. Growing it requires editing this line — a visible, deliberate
+        // diff, not a quiet one. See the field javadoc above for what "belongs here" actually means.
+        assertEquals(Set.of("placement", "memberCredentials", "memberLoginShell"), hot,
+                "HOT_EXCLUDED_TOP_LEVEL_KEYS changed. A component belongs here ONLY if it is read "
+                        + "live off the config supplier, never because adding it makes this test "
+                        + "pass. If you are adding one to silence this test, that is fleetd #323 "
+                        + "happening again: account for it in ConfigRef.changedDeferredKeys (or "
+                        + "COLD_KEYS/SPLIT_KEYS) instead. If it really is read live, name where and "
+                        + "update this assertion and the field javadoc together.");
+
+        // No component may sit in two buckets at once — the denominator check below could not catch
+        // that on its own (two buckets double-booking one key still sums to the right total if
+        // another key is simultaneously missing), so check every pair directly and name the culprit.
+        record Bucket(String name, Set<String> keys) {}
+        List<Bucket> buckets = List.of(
+                new Bucket("COLD_KEYS", cold), new Bucket("SPLIT_KEYS", split),
+                new Bucket("DEFERRED_TOP_LEVEL_KEYS", deferred), new Bucket("HOT_EXCLUDED_TOP_LEVEL_KEYS", hot));
+        for (int i = 0; i < buckets.size(); i++) {
+            for (int j = i + 1; j < buckets.size(); j++) {
+                Set<String> overlap = new LinkedHashSet<>(buckets.get(i).keys());
+                overlap.retainAll(buckets.get(j).keys());
+                assertEquals(Set.of(), overlap, "a component is in both " + buckets.get(i).name()
+                        + " and " + buckets.get(j).name() + ": " + overlap);
+            }
+        }
+
+        Set<String> union = new TreeSet<>();
+        union.addAll(cold);
+        union.addAll(split);
+        union.addAll(deferred);
+        union.addAll(hot);
+
+        System.out.printf(
+                "FleetConfig top-level coverage — %d components total: %d cold %s, %d deferred %s, "
+                        + "%d split %s, %d hot-excluded %s%n",
+                allNames.size(), cold.size(), cold, deferred.size(), deferred, split.size(), split,
+                hot.size(), hot);
+
+        Set<String> missing = new TreeSet<>(allNames);
+        missing.removeAll(union);
+        assertEquals(Set.of(), missing,
+                "these FleetConfig components are in none of COLD_KEYS, DEFERRED_TOP_LEVEL_KEYS, "
+                        + "SPLIT_KEYS or HOT_EXCLUDED_TOP_LEVEL_KEYS — triage each one into whichever "
+                        + "actually describes it: " + missing);
+        assertEquals(allNames.size(), cold.size() + deferred.size() + split.size() + hot.size(),
+                "counts don't sum to the component total even though every component was found in "
+                        + "the union — " + allNames.size() + " components, " + cold.size()
+                        + " cold + " + deferred.size() + " deferred + " + split.size() + " split + "
+                        + hot.size() + " hot-excluded");
+    }
+}
@@ -0,0 +1,219 @@
+package dev.ltms.fleet.config;
+
+import org.junit.jupiter.api.Test;
+
+import java.lang.reflect.Constructor;
+import java.lang.reflect.RecordComponent;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.TreeSet;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+
+/**
+ * fleetd #333, finding F2: {@link ConfigRefTopLevelCoverageTest} proves every {@link FleetConfig}
+ * top-level component sits in exactly one of {@link ConfigRef#COLD_KEYS}, {@code
+ * DEFERRED_TOP_LEVEL_KEYS}, {@link ConfigRef#SPLIT_KEYS} or the hot-excluded set. It does
+ * <strong>not</strong> prove that a key's membership in {@code COLD_KEYS} or {@code SPLIT_KEYS}
+ * corresponds to any actual comparison in {@link ConfigRef}: a key can sit in either set with no
+ * branch in {@code changedColdKeys}/{@code changedSplitKeys} checking it, and both
+ * {@link ConfigRefTopLevelCoverageTest} and the "kept in step" {@code assert} inside each of those
+ * methods stay green, because neither one reads the method body — the coverage test only reads
+ * set membership, and the assert only checks that reported entries are a SUBSET of the set, never
+ * that every set member produced a reported entry.
+ *
+ * <p>Measured directly, live, while fixing fleetd #333: dropping the {@code coordinator} branch out
+ * of {@code ConfigRef.changedSplitKeys} while leaving {@code "coordinator"} in
+ * {@link ConfigRef#SPLIT_KEYS} left {@link ConfigRefTopLevelCoverageTest} and the in-method assert
+ * both green — only a hand-written behavioural case in {@link ConfigRefTest} caught it, because it
+ * happened to name that exact key. This is the {@link ConfigRefProfileCoverageTest} mechanism one
+ * level up, generalised over every {@code COLD_KEYS}/{@code SPLIT_KEYS} member rather than one
+ * hand-picked field: enumerate {@link FleetConfig}'s own record components by reflection, build "a
+ * config where only {@code <key>} differs" for each cold/split key, and call the real
+ * {@link ConfigRef#changedColdKeys}/{@link ConfigRef#changedSplitKeys} methods (made
+ * package-private for exactly this, the same reason {@link ConfigRef#sameLaunchSettings} already
+ * is) to prove each one is actually reported — not assumed from a set literal.
+ *
+ * <h2>What this deliberately does NOT cover</h2>
+ * {@code DEFERRED_TOP_LEVEL_KEYS} is not exercised here. That bucket carries the identical
+ * one-way risk in principle — a key added to it with no matching branch in
+ * {@code changedDeferredKeys} would pass {@link ConfigRefTopLevelCoverageTest} exactly the way
+ * {@code coordinator} passed it above — but this test stays narrow to {@code COLD_KEYS} and
+ * {@code SPLIT_KEYS} for two reasons. First, that is where fleetd #333 actually found and measured
+ * the gap (F1 was a live instance of it). Second, most of {@code DEFERRED_TOP_LEVEL_KEYS} already
+ * carries an individual behavioural test in {@link ConfigRefTest} naming it by key — {@code
+ * worktreeGroup}, {@code primary}, {@code configReload}, {@code profiles}' launch settings /
+ * weight-maxLoad / exhaustedPattern / errorPattern / ideProjectDir — which is the same protection
+ * this class gives {@code COLD_KEYS}/{@code SPLIT_KEYS}, just written by hand per key instead of
+ * generated by reflection over the whole set. {@code guard}, {@code lifecycle},
+ * {@code leadHeartbeat}, {@code spawnReadyTimeoutMs}/{@code spawnReadyPollMs} and
+ * {@code quarantineCooldownSeconds} do NOT have a dedicated behavioural test naming them, so the
+ * one-way gap fleetd's own memory notes ("pre-existing on COLD_KEYS and on the test's own
+ * DEFERRED_TOP_LEVEL_KEYS") is real and not fully closed by this class — extending this mechanism's
+ * {@code BASE}/{@code ALT} map to cover every top-level component and adding a third
+ * {@code everyDeferredKeyIsActuallyReportedByChangedDeferredKeys} test is the natural next step, left
+ * for whoever next finds a deferred key with the same shape as this ticket's {@code fleet.leaders}.
+ */
+class ConfigRefTopLevelReportingCoverageTest {
+
+    private static final RecordComponent[] COMPONENTS = FleetConfig.class.getRecordComponents();
+
+    /**
+     * One valid value per top-level {@link FleetConfig} component — "the a value". Components not
+     * exercised by either test below ({@code profiles}, {@code guard}, {@code worktreeRoot}, …) are
+     * left {@code null}/empty; {@link FleetConfig}'s compact constructor only normalizes
+     * {@code profiles}, so every other field accepts {@code null} unmutated.
+     */
+    private static final Map<String, Object> BASE = baseValues();
+
+    /** The same shape, each value distinct from {@link #BASE} — "the b value" — for COLD_KEYS/SPLIT_KEYS only. */
+    private static final Map<String, Object> ALT = altValues();
+
+    private static Map<String, Object> baseValues() {
+        Map<String, Object> v = new LinkedHashMap<>();
+        v.put("bind", new FleetConfig.Bind("127.0.0.1", 8765));
+        v.put("herdrSocket", "~/.config/herdr/a.sock");
+        v.put("memberHerdrSocket", "~/.config/herdr/member-a.sock");
+        v.put("profiles", Map.of());
+        v.put("guard", null);
+        v.put("worktreeRoot", null);
+        v.put("lifecycle", null);
+        v.put("spawnReadyTimeoutMs", null);
+        v.put("spawnReadyPollMs", null);
+        v.put("broker", new FleetConfig.Broker("amqp://a", null, 1));
+        v.put("primary", null);
+        v.put("fleet", new FleetConfig.Fleet(
+                Map.of("opus", new FleetConfig.Leader("sonnet", "lead: opus-a", 1, null, 10,
+                        "claude", null, null, null)),
+                Map.of(), Map.of(), Map.of(), Map.of(), "{role}: {profile} #{n}"));
+        v.put("leadHeartbeat", null);
+        v.put("health", new FleetConfig.Health(true, 30, 600, null, null));
+        v.put("placement", null);
+        v.put("auth", new FleetConfig.Auth("loopback-trust", null));
+        v.put("configReload", null);
+        v.put("quarantineCooldownSeconds", null);
+        v.put("memberCredentials", null);
+        v.put("coordinator", new FleetConfig.Coordinator("amqp://coord-a", null, "self-a", 1));
+        v.put("worktreeGroup", null);
+        v.put("memberLoginShell", null);
+        assertNamesMatchComponents(v);
+        return v;
+    }
+
+    private static Map<String, Object> altValues() {
+        Map<String, Object> v = new LinkedHashMap<>();
+        v.put("bind", new FleetConfig.Bind("127.0.0.2", 8766));
+        v.put("herdrSocket", "~/.config/herdr/b.sock");
+        v.put("memberHerdrSocket", "~/.config/herdr/member-b.sock");
+        v.put("profiles", Map.of());
+        v.put("guard", null);
+        v.put("worktreeRoot", null);
+        v.put("lifecycle", null);
+        v.put("spawnReadyTimeoutMs", null);
+        v.put("spawnReadyPollMs", null);
+        v.put("broker", new FleetConfig.Broker("amqp://b", null, 2));
+        v.put("primary", null);
+        // Differs from BASE.fleet only in fleet.leaders (a different tab for "opus") — the frozen
+        // sub-field ConfigRef.changedSplitKeys actually compares. A Fleet that instead differed only
+        // in tabLabel would correctly NOT be reported (see
+        // ConfigRefTest.changingFleetTabLabelWithoutLeadersStaysFullyHot) and would wrongly fail this
+        // test — that is by design, not a gap: this map exists to prove fleet.leaders is covered.
+        v.put("fleet", new FleetConfig.Fleet(
+                Map.of("opus", new FleetConfig.Leader("sonnet", "lead: opus-b", 1, null, 10,
+                        "claude", null, null, null)),
+                Map.of(), Map.of(), Map.of(), Map.of(), "{role}: {profile} #{n}"));
+        v.put("leadHeartbeat", null);
+        v.put("health", new FleetConfig.Health(false, 90, 900, null, null));
+        v.put("placement", null);
+        v.put("auth", new FleetConfig.Auth("token", "TOKEN_ENV"));
+        v.put("configReload", null);
+        v.put("quarantineCooldownSeconds", null);
+        v.put("memberCredentials", null);
+        v.put("coordinator", new FleetConfig.Coordinator("amqp://coord-b", null, "self-b", 2));
+        v.put("worktreeGroup", null);
+        v.put("memberLoginShell", null);
+        assertNamesMatchComponents(v);
+        return v;
+    }
+
+    private static void assertNamesMatchComponents(Map<String, Object> values) {
+        Set<String> names = new TreeSet<>();
+        for (RecordComponent rc : COMPONENTS) {
+            names.add(rc.getName());
+        }
+        assertEquals(names, new TreeSet<>(values.keySet()),
+                "this test's value map has drifted from FleetConfig's actual top-level components — "
+                        + "update BASE/ALT alongside the record");
+    }
+
+    private static FleetConfig configOf(Map<String, Object> values) throws ReflectiveOperationException {
+        Class<?>[] types = Arrays.stream(COMPONENTS).map(RecordComponent::getType).toArray(Class<?>[]::new);
+        Object[] args = Arrays.stream(COMPONENTS).map(rc -> values.get(rc.getName())).toArray();
+        Constructor<FleetConfig> ctor = FleetConfig.class.getDeclaredConstructor(types);
+        return ctor.newInstance(args);
+    }
+
+    /** {@code BASE} with exactly one named top-level component swapped for its {@code ALT} value. */
+    private static FleetConfig mutate(String componentName) throws ReflectiveOperationException {
+        Map<String, Object> values = new LinkedHashMap<>(BASE);
+        values.put(componentName, ALT.get(componentName));
+        return configOf(values);
+    }
+
+    /**
+     * The mechanism fleetd #333 F2 asked for, applied to {@link ConfigRef#COLD_KEYS}: mutate each
+     * cold key in isolation and prove {@code changedColdKeys} actually names it, not just that
+     * {@code COLD_KEYS} claims it does.
+     */
+    @Test
+    void everyColdKeyIsActuallyReportedByChangedColdKeys() throws ReflectiveOperationException {
+        FleetConfig base = configOf(BASE);
+        List<String> uncovered = new ArrayList<>();
+        for (String key : new TreeSet<>(ConfigRef.COLD_KEYS)) {
+            FleetConfig mutated = mutate(key);
+            if (!ConfigRef.changedColdKeys(base, mutated).contains(key)) {
+                uncovered.add(key);
+            }
+        }
+        System.out.printf(
+                "ConfigRef.changedColdKeys reporting coverage — %d COLD_KEYS, %d verified%n",
+                ConfigRef.COLD_KEYS.size(), ConfigRef.COLD_KEYS.size() - uncovered.size());
+        assertEquals(List.of(), uncovered,
+                "these keys are in ConfigRef.COLD_KEYS but mutating them alone produces no matching "
+                        + "entry from changedColdKeys — a set entry with no comparison behind it: "
+                        + uncovered);
+    }
+
+    /**
+     * The same mechanism applied to {@link ConfigRef#SPLIT_KEYS}: mutate each split key in
+     * isolation and prove {@code changedSplitKeys} actually names it (message starting with
+     * {@code "<key>:"}), not just that {@code SPLIT_KEYS} claims it does. This is the exact check
+     * that would have failed fleetd #333's own reproduction — dropping the {@code coordinator}
+     * branch from {@code changedSplitKeys} while {@code "coordinator"} stayed in {@code SPLIT_KEYS}
+     * — see the mutation proof in the fleetd #333 PR description; the earlier checkers here (the
+     * shape test and the in-method assert) do not.
+     */
+    @Test
+    void everySplitKeyIsActuallyReportedByChangedSplitKeys() throws ReflectiveOperationException {
+        FleetConfig base = configOf(BASE);
+        List<String> uncovered = new ArrayList<>();
+        for (String key : new TreeSet<>(ConfigRef.SPLIT_KEYS)) {
+            FleetConfig mutated = mutate(key);
+            List<String> split = ConfigRef.changedSplitKeys(base, mutated);
+            if (split.stream().noneMatch(s -> s.startsWith(key + ":"))) {
+                uncovered.add(key);
+            }
+        }
+        System.out.printf(
+                "ConfigRef.changedSplitKeys reporting coverage — %d SPLIT_KEYS, %d verified%n",
+                ConfigRef.SPLIT_KEYS.size(), ConfigRef.SPLIT_KEYS.size() - uncovered.size());
+        assertEquals(List.of(), uncovered,
+                "these keys are in ConfigRef.SPLIT_KEYS but mutating them alone produces no matching "
+                        + "entry from changedSplitKeys — a set entry with no comparison behind it, "
+                        + "exactly the fleetd #333 F2 shape: " + uncovered);
+    }
+}
Author	SHA1	Message	Date
Dai Ha	3aca53b967	fleetd#333: fleet.leaders is split too, and split membership now proves reporting exists CI / contract (pull_request) Successful in 1m12s Details CI / build (pull_request) Failing after 1m59s Details F1: fleet: was sitting in ConfigRefTopLevelCoverageTest's HOT_EXCLUDED_TOP_LEVEL_KEYS escape hatch, even though fleet.leaders is read only at startup (LeadTabScanner's identity map, LeadLauncher.ensureLeads) while the rest of fleet: (role pools, charters, tabLabel) is live. A reload changing only fleet.leaders reported a bare "config reloaded" -- the operator edits a lead's tab: label, sees the reload succeed, and the pane keeps resolving as a worker. Moved fleet into ConfigRef.SPLIT_KEYS; changedSplitKeys now compares fleet.leaders specifically (not the whole Fleet record, which would over-claim "restart" for a tabLabel-only change) and names both halves in the message. F2: membership in SPLIT_KEYS/COLD_KEYS never proved a matching branch existed in changedSplitKeys/changedColdKeys -- measured by dropping the coordinator branch while leaving "coordinator" in SPLIT_KEYS: both ConfigRefTopLevelCoverageTest and the in-method "kept in step" assert stayed green. Added ConfigRefTopLevelReportingCoverageTest, the ConfigRefProfileCoverageTest mechanism one level up: reflection-built FleetConfig pairs that differ in exactly one top-level component, calling the real (now package-private) changedColdKeys/ changedSplitKeys to prove each COLD_KEYS/SPLIT_KEYS member is actually reported. Scoped to split+cold, not deferred -- see the new test's javadoc for why and what that leaves open. Both findings carry a behavioural test in ConfigRefTest plus a mutation proof (revert -> real failure -> restore) recorded in the PR description.	2026-09-04 15:36:40 +07:00
Dai Ha	7b918c51ff	Merge #330 : a fourth reload class for split keys, and a top-level coverage checker CI / build (push) Successful in 1m46s Details CI / contract (push) Successful in 1m48s Details	2026-09-04 15:19:14 +07:00
Dai Ha	554395b104	fleetd#330: split reload class for health/coordinator + top-level coverage CI / contract (pull_request) Successful in 53s Details CI / build (pull_request) Successful in 2m17s Details Unit 1: ConfigRef gets a fourth reload class, `split`, for keys read both off the startup snapshot and live off config.get() at different sites (health:, coordinator:). A split change is accepted (Outcome.applied() stays true) and reported by name, naming which half is live and which needs a restart, via a new Outcome.split() field kept separate from deferred() since the two carry different guarantees for any caller that branches on them, not just prose in summary(). Class doc updated: four classes now, denominator note no longer calls health/coordinator undecided. Unit 2: ConfigRefTopLevelCoverageTest enumerates FleetConfig's 22 top-level record components and requires each to sit in exactly one of COLD_KEYS, a pinned "compared in changedDeferredKeys" set, SPLIT_KEYS, or a pinned hot-exclusion escape hatch — printing its own denominator and pinning the escape hatch's exact contents the way #323 asked for. Deviates from the issue's starting values by one key: `profiles` moves from the suggested Hot bucket into the deferred bucket, because changedDeferredKeys demonstrably compares it (add/remove and launch settings), and citing "read live off the config supplier" for the whole key would be false — most Profile fields are not read live, only weight/maxLoad/credentialId are (and those are already covered by ConfigRefProfileCoverageTest). Cold=5, split=2, deferred=11, hot=4, total=22 — verified against the record and against ConfigRef's code, not copied from the issue.	2026-09-04 15:16:45 +07:00
Dai Ha	823976c1b5	#326 : state primary's real consequence, and write down the denominator CI / contract (push) Successful in 56s Details CI / build (push) Successful in 2m5s Details The merged javadoc said a changed primary.terminal leaves a lead 'unresolved as primary until a restart'. That over-claims. CB-532 made the pin deprecated: identity comes from leaders:/leadScan:, and Fleetd.java:511 warns about the pin at startup. A changed pin still needs a restart, but for the fallback nudge destination, the deprecated identity path, and pushReminders/pushBackoffMs - not for a lead that uses leaders:. Also record what I measured. FleetConfig has 22 top-level components; four are named nowhere in ConfigRef. memberCredentials and memberLoginShell are hot and correctly absent (both read live off config.get() at spawn). health and coordinator are undecided, not hot. 'Absent' looks the same for both kinds, and twice now the forgotten kind hid among the correct kind.	2026-09-04 14:58:07 +07:00
Dai Ha	c8388a7f92	Merge #326 : primary and configReload are deferred keys, so a reload says a restart is needed	2026-09-04 14:53:50 +07:00
Dai Ha	02e6aef98c	Merge #324 : read task.turnId once in finishAsyncTask, so a concurrent clear cannot make the removal key null CI / contract (push) Successful in 1m11s Details CI / build (push) Successful in 1m29s Details	2026-09-04 14:44:42 +07:00
Dai Ha	6d493bc7bb	fleetd#326: classify primary and configReload as deferred top-level keys CI / contract (pull_request) Successful in 1m3s Details CI / build (pull_request) Failing after 1m44s Details ConfigRef.changedDeferredKeys only classified seven top-level FleetConfig keys (#323 fixed the profile side). Two more keys are read only off the startup snapshot and were missing: - primary: Fleetd.java:506/519/520 feed PrimaryRegistry and ReplyPushLoop at construction; neither is rebuilt on reload. - configReload: Fleetd.java:679-680 decide once at startup whether to build a ConfigWatcher at all, and with what interval; the watcher that would apply a later change is itself built once, so it is deferred (not cold — no already-open resource goes inconsistent, a running watcher just keeps its original settings). health and coordinator are deliberately left unclassified: both are read both off the startup snapshot AND live off the config supplier at a second call site, so no single bucket is correct for either — see the PR body for the options writeup and the coordinator.uriEnv exposure question the issue asked to be answered. Each fix is proven with a failing-first test in ConfigRefTest and a revert-quote-restore mutation check (see PR body for the transcripts).	2026-09-04 14:42:24 +07:00
Dai Ha	e545c08082	#323 : pin the exclusion set — the coverage mechanism's own escape hatch, found by mutation CI / contract (push) Successful in 1m29s Details CI / build (push) Successful in 2m10s Details	2026-09-04 14:32:08 +07:00
Dai Ha	efa0deb9b2	Merge #323 : the reload classifier proves its own coverage instead of claiming it	2026-09-04 14:29:10 +07:00
Dai Ha	ca47e90c01	fleetd#323: close the reload-classifier drift with a reflection coverage test CI / contract (pull_request) Successful in 1m11s Details CI / build (pull_request) Successful in 2m6s Details ConfigRef.sameLaunchSettings' javadoc claimed it compares every component the launcher reads at spawn. It missed ideProjectDir, ideOpenCommand and autoCompactWindow, and changedDeferredKeys separately missed worktreeGroup (baked into the same GitWorktrees as worktreeRoot, Fleetd.java:251). A reload that changed only one of those keys reported "config reloaded" with nothing deferred, and the running daemon kept the old value. Fix the four instances, and add ConfigRefProfileCoverageTest: it enumerates every FleetConfig.Profile record component by reflection, mutates each one not in the new ConfigRef.LAUNCH_SETTINGS_EXCLUDED set on a base profile, and asserts sameLaunchSettings actually notices — so a fifth missed field fails the build by name instead of drifting silently. It also prints its own denominator (26 components, 23 compared, 3 excluded) per the ticket's requirement that a checker must be able to state what it checked. Also add the `profile` field itself to the comparison (it was neither compared nor excluded before this fix — the coverage test surfaced it). Rewrote the sameLaunchSettings javadoc to describe what the coverage test actually guarantees instead of repeating the unchecked claim.	2026-09-04 14:26:09 +07:00