fleetd #618: fix the third stale spot the brief missed

The method-level javadoc on FleetConfig.warnConflictingAutoCompactWindows
(above the log.warn call) still claimed the autoCompactWindow vs
CLAUDE_CODE_AUTO_COMPACT_WINDOW precedence was 'intentionally not
asserted' and cited fleetd.yaml's now-corrected comment as evidence the
question was open. Replace it with the measured answer from #618: the
env var wins, so autoCompactWindow is inert on a profile that sets both.
Kept the WARN-not-throw rationale paragraph above it untouched (#601)
and kept the ClaudeCodeArguments cross-reference, which now points to an
agreeing claim instead of a contradicting one. No behaviour change.

fleetd/fleetd.example.yaml

@@ -209,13 +209,13 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      e.g. `env DISPLAY=:10.0 idea {dir}`. Best-effort: a failure is logged, never
 #                      fails the spawn. Omit to open the member's module by hand. There is no close
 #                      half yet — an opened module stays open until the operator closes it.
-#   autoCompactWindow → opt-in, default off. A bounded token window that forces a spawned member to
-#                      compact its context instead of running on the backend's own default and dying
-#                      mid-turn (losing its fleet_reply — the whole point of the turn — with it).
+#   autoCompactWindow → opt-in, default off. A bounded token window that forces a launched Claude Code
+#                      lead or member to compact its context instead of running on the backend's own
+#                      default. A member that runs out of context can die mid-turn and lose its fleet_reply.
 #                      Validated at config load to [100000, 1000000] — the band Claude Code's own
 #                      --autocompact flag accepts.
 #                      CROSS-BACKEND SEMANTICS DIFFER: on claude-code this is a launch-time
-#                      `--autocompact <tokens>` flag — the member compacts AT this window. opencode
+#                      `--autocompact <tokens>` flag — the Claude Code session compacts AT this window. opencode
 #                      has no equivalent flag (it only forces `compaction.auto: true`, unconditionally,
 #                      already), so this is instead applied as the model's `limit.context` in the
 #                      generated opencode.json — the member compacts WITHIN this window, not exactly
@@ -415,7 +415,7 @@ profiles:
     # ideMcpUrl: http://127.0.0.1:29170/index-mcp/streamable-http   # opt-in (CB-634): IDE code intelligence, pinned to the worktree
     # ideProjectDir: fleetd          # CB-634: module dir the IDE opens + the overlay pins (this repo's pom is in fleetd/)
     # ideOpenCommand: env DISPLAY=:10.0 idea {dir}   # CB-634 auto-open: opens {dir} in the IDE at spawn; omit to open by hand
-    # autoCompactWindow: 250000   # opt-in: bound member context; claude-code compacts AT this, opencode within it (model limit.context)
+    # autoCompactWindow: 250000   # opt-in: bound Claude Code lead/member context; claude-code compacts AT this, opencode within it (model limit.context)
   gx11:                              # a second backend, so `placement: weighted` has a choice
     baseUrl: http://gx01.gw:8000     # self-hosted; ccs handles the model + token
     placement: tab

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -462,8 +462,8 @@ public record FleetConfig(
      *                       profile that does not opt in. Read live off the current config, so it is
      *                       HOT: a change takes effect on the next exhaustion classification / spawn,
      *                       no restart needed.
-     * @param autoCompactWindow  opt-in per-profile token window that forces a spawned member to
-     *                       auto-compact its context at (Claude Code) or within (opencode) a bound the
+     * @param autoCompactWindow  opt-in per-profile token window that forces a launched Claude Code
+     *                       session to auto-compact its context at, or an opencode session within, a bound the
      *                       operator chooses, instead of the backend's own default. {@code null} (the
      *                       default) leaves today's behaviour exactly — opencode already forces
      *                       {@code compaction.auto: true} unconditionally (CB-523) but has no absolute
@@ -1875,6 +1875,7 @@ public record FleetConfig(
             rejectDuplicateMemberSlots(yaml);
             rejectNegativeMaxLoad(yaml);
             rejectAutoCompactWindowOutOfRange(yaml);
+            warnConflictingAutoCompactWindows(yaml);
             rejectMalformedProfilePatterns(yaml);
             rejectUnknownKind(yaml);
             rejectUnknownAuthMode(yaml);
@@ -2225,6 +2226,73 @@ public record FleetConfig(
         }
     }
 
+    /**
+     * Warn (never refuse to start) about a Claude Code profile whose auto-compaction flag and
+     * environment setting disagree.
+     *
+     * <p>Renamed from {@code rejectConflictingAutoCompactWindows} (fleetd #601 review, measured
+     * 2026-09-22): that method threw {@link IllegalStateException}, so {@link #load(Path)} refused
+     * to start on a config carrying this conflict. On this host, four profiles trip it, including
+     * the lead's own profile and the one every worker spawns on — so the throw is not a rare edge
+     * case. Under launchd, a throw inside {@code load()} is a restart loop, not an error an operator
+     * reads once, and the config that would fix it ({@code fleetd/fleetd.yaml}) is gitignored, so
+     * the cause is invisible on the host where it bites. A WARN gives the operator the same
+     * information — which profiles, and now both values, so they can fix it without reading the
+     * source — without ever taking the fleet down.
+     *
+     * <p>fleetd #618 measured which of the two inputs Claude Code actually follows when they
+     * disagree: the environment variable wins, so {@code autoCompactWindow} is inert on a profile
+     * that also sets the env var. This method only detects and reports the disagreement — it does
+     * not correct it — see {@link dev.ltms.fleet.launch.ClaudeCodeArguments} for the full measured
+     * precedence.
+     *
+     * <p>Equal values never warn: either input then produces the same session window, so there is
+     * nothing to reconcile.
+     */
+    static void warnConflictingAutoCompactWindows(String yaml) {
+        Map<?, ?> raw;
+        try {
+            raw = YAML.readValue(yaml, Map.class);
+        } catch (IOException | IllegalArgumentException e) {
+            return;
+        }
+        if (raw == null || !(raw.get("profiles") instanceof Map<?, ?> profiles)) {
+            return;
+        }
+        List<String> names = new ArrayList<>();
+        List<String> detail = new ArrayList<>();
+        for (Map.Entry<?, ?> entry : profiles.entrySet()) {
+            if (!(entry.getValue() instanceof Map<?, ?> profile)
+                    || !(profile.get("autoCompactWindow") instanceof Number window)
+                    || !(profile.get("env") instanceof Map<?, ?> env)
+                    || !env.containsKey("CLAUDE_CODE_AUTO_COMPACT_WINDOW")) {
+                continue;
+            }
+            Object kind = profile.get("kind");
+            boolean claudeCode = kind == null || String.valueOf(kind).isBlank()
+                    || Profile.KIND_CLAUDE_CODE.equalsIgnoreCase(String.valueOf(kind));
+            Object envValue = env.get("CLAUDE_CODE_AUTO_COMPACT_WINDOW");
+            if (claudeCode && !String.valueOf(window).equals(String.valueOf(envValue))) {
+                String name = String.valueOf(entry.getKey());
+                names.add(name);
+                detail.add(name + " (autoCompactWindow=" + window
+                        + ", env.CLAUDE_CODE_AUTO_COMPACT_WINDOW=" + envValue + ")");
+            }
+        }
+        if (names.isEmpty()) {
+            return;
+        }
+        names.sort(String::compareTo);
+        detail.sort(String::compareTo);
+        log.warn("Claude Code profile(s) {} set disagreeing autoCompactWindow and env."
+                        + "CLAUDE_CODE_AUTO_COMPACT_WINDOW — the daemon starts anyway: {}. fleetd "
+                        + "#618 measured that CLAUDE_CODE_AUTO_COMPACT_WINDOW wins, so "
+                        + "autoCompactWindow is inert on these profiles. Set equal values on each "
+                        + "to resolve this — do not just delete the env var, since that LOWERS the "
+                        + "live window to autoCompactWindow's value rather than fixing anything.",
+                names, String.join(", ", detail));
+    }
+
     /**
      * Reject a profile whose {@code errorPattern} (fleetd #201 Unit 5) or {@code exhaustedPattern}
      * (CB-578 stage A) is not a valid Java regex, naming the profile, the key, and the parser's own

fleetd/src/main/java/dev/ltms/fleet/launch/ClaudeCodeArguments.java

@@ -0,0 +1,37 @@
+package dev.ltms.fleet.launch;
+
+import dev.ltms.fleet.config.FleetConfig;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/** Arguments shared by every fleetd path that starts Claude Code. */
+public final class ClaudeCodeArguments {
+
+    private ClaudeCodeArguments() {
+    }
+
+    /**
+     * Append the configured Claude Code auto-compaction window when the profile opts in.
+     *
+     * <p>This flag and the environment variable {@code CLAUDE_CODE_AUTO_COMPACT_WINDOW} can
+     * disagree, and fleetd #618 measured which one Claude Code actually follows: the environment
+     * variable wins, ahead of this {@code --autocompact} flag, ahead of the settings file, ahead of
+     * clientdata, the experiment, and the model default. So when a profile sets both, the flag this
+     * method appends has NO effect — Claude Code reads {@code CLAUDE_CODE_AUTO_COMPACT_WINDOW}
+     * first and never consults the flag. {@link FleetConfig#load(java.nio.file.Path)} only WARNS
+     * when a Claude Code profile sets both to different values (see {@code
+     * FleetConfig.warnConflictingAutoCompactWindows}) — it does not stop the daemon from starting,
+     * and the launched session honours the env var, not this flag. Measured against Claude Code
+     * 2.1.278 (fleetd #618) — a later version could reorder this precedence.
+     */
+    public static List<String> withAutoCompactWindow(List<String> argv, FleetConfig.Profile profile) {
+        if (profile.autoCompactWindow() == null) {
+            return argv;
+        }
+        List<String> withAutoCompact = new ArrayList<>(argv);
+        withAutoCompact.add("--autocompact");
+        withAutoCompact.add(String.valueOf(profile.autoCompactWindow()));
+        return withAutoCompact;
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/lead/LeadLauncher.java

@@ -8,6 +8,7 @@ import dev.ltms.fleet.herdr.PendingCloseMarker;
 import dev.ltms.fleet.herdr.Tab;
 import dev.ltms.fleet.herdr.Workspace;
 import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.launch.ClaudeCodeArguments;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -358,7 +359,8 @@ public final class LeadLauncher {
     }
 
     /**
-     * The lead's argv: the profile's own command, the model pin, and the bridge MCP mount.
+     * The lead's argv: the profile's own command, the model and auto-compaction pins, and the bridge
+     * MCP mount.
      *
      * <p>No {@code --append-system-prompt}. That flag carries the worker reply charter, and a lead
      * is not a worker — it reads its orchestration rules from the project's {@code CLAUDE.md} like
@@ -380,7 +382,7 @@ public final class LeadLauncher {
             argv.add("--model");
             argv.add(profile.model());
         }
-        return argv;
+        return profile.isOpenCode() ? argv : ClaudeCodeArguments.withAutoCompactWindow(argv, profile);
     }
 
     /**

fleetd/src/main/java/dev/ltms/fleet/lead/LeadRollover.java

@@ -231,7 +231,9 @@ public final class LeadRollover {
          * #status} could wrongly answer {@link #UNKNOWN} ("nothing was ever requested") for a roll
          * that is, in fact, actively running. This is not sticky: the deferred continuation
          * overwrites this same entry with a terminal state ({@link #ROLLED}, {@link
-         * #TURN_NEVER_SETTLED}, or {@link #CLEAR_NEVER_SETTLED}) once it finishes.
+         * #TURN_NEVER_SETTLED}, {@link #CLEAR_NEVER_SETTLED}, or {@link #FAILED}) once it finishes
+         * — including by throwing, which fleetd #615's catch in {@link #runRollover} now turns into
+         * {@link #FAILED} instead of leaving this entry stuck forever.
          */
         IN_PROGRESS,
         /**
@@ -253,6 +255,19 @@ public final class LeadRollover {
          * within {@code clearSettleSeconds} — {@code bootstrapText} was never sent.
          */
         CLEAR_NEVER_SETTLED,
+        /**
+         * fleetd #615: the deferred continuation threw a {@link RuntimeException} — most likely a
+         * {@link dev.ltms.fleet.herdr.HerdrException} out of one of the two unwrapped {@code
+         * agents.send} calls in {@link #runRollover} — and the continuation thread died with it.
+         * Before this state existed, that throw left {@link #outcomes} holding {@link #IN_PROGRESS}
+         * forever, because the production {@code continuationRunner} is a bare virtual thread with
+         * no uncaught-exception handler and nothing downstream of the throw ever ran to write a
+         * terminal outcome. {@code detail} names the exception, so a reader has something to act on
+         * — the same diagnostic style as {@link #TURN_NEVER_SETTLED} and {@link
+         * #CLEAR_NEVER_SETTLED}. The roll is dead at this point and does not retry itself; a stuck
+         * lead must {@link #open} a fresh request.
+         */
+        FAILED,
         /**
          * {@code token} names nothing this instance currently knows about: never issued by {@link
          * #open}, dropped by {@link #cancel}, or aged out of {@link #outcomes}'s bounded history.
@@ -493,8 +508,42 @@ public final class LeadRollover {
      * entirely after {@link #confirm} has returned to its caller — see this class's javadoc for the
      * four-step order. There is no result to return to by this point, so every outcome is logged
      * only.
+     *
+     * <p><strong>fleetd #615 — the whole body is wrapped in one {@code try}.</strong> The two {@code
+     * agents.send} calls below are not wrapped individually: {@code send} → {@code agentCall} →
+     * {@code herdr.call} can throw an unchecked {@link dev.ltms.fleet.herdr.HerdrException} (see
+     * {@code AgentControl.java}), and the production {@code continuationRunner} is a bare virtual
+     * thread with no uncaught-exception handler (see this class's public constructor). Before this
+     * fix, either throw killed the continuation thread silently, leaving the {@link
+     * RollState#IN_PROGRESS} entry {@link #confirm} wrote at hand-off stuck forever — {@link
+     * #status} had no way to tell a dead roll from one still genuinely running. The {@code catch}
+     * below is scoped to the method body rather than to each {@code send} call individually, so it
+     * also covers anything else added to this continuation later, not just today's two call sites —
+     * the same reasoning that put the write-a-terminal-outcome step at each of this method's other
+     * exits (see the {@link RollState#TURN_NEVER_SETTLED} and {@link RollState#CLEAR_NEVER_SETTLED}
+     * branches below) rather than inside the helpers that detect them.</p>
+     *
+     * <p>Only {@link RuntimeException} is caught, matching the local convention {@link
+     * #waitUntilAtTurnBoundary} already set around its own {@code agents.status} call — not the
+     * broader {@link Exception} or {@link Throwable}, which would also swallow something like an
+     * {@link OutOfMemoryError} this continuation has no business handling.</p>
      */
     private void runRollover(PendingRollover p, FleetConfig.LeadRollover cfg) {
+        try {
+            runRolloverUnguarded(p, cfg);
+        } catch (RuntimeException e) {
+            log.warn("lead-rollover: continuation for token={} lead={} threw {} — the roll is dead; "
+                            + "no further step in this continuation will run",
+                    p.token(), p.leadTerminal(), e.toString(), e);
+            outcomes.put(p.token(), new RollStatus(RollState.FAILED,
+                    "the roll's continuation threw " + e.toString() + " — the roll is dead and will "
+                            + "not retry itself; check the daemon log for the stack trace, then open() "
+                            + "a fresh rollover request"));
+        }
+    }
+
+    /** The actual body of {@link #runRollover}, unwrapped — see that method's javadoc for the catch. */
+    private void runRolloverUnguarded(PendingRollover p, FleetConfig.LeadRollover cfg) {
         String lead = p.leadTerminal();
         long rollStartMillis = nowMillis.getAsLong();
         TurnSettleResult turnResult = waitUntilAtTurnBoundary(lead, cfg.turnSettleSeconds());

fleetd/src/main/java/dev/ltms/fleet/member/ClaudeCodeLauncher.java

@@ -8,6 +8,7 @@ import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.launch.ClaudeCodeArguments;
 import dev.ltms.fleet.peer.Capability;
 import dev.ltms.fleet.peer.PeerLauncher;
 import org.slf4j.Logger;
@@ -298,7 +299,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
         // has neither MCP nor a charter — session flags must be added into a list we own.
         List<String> argv = mutableArgv(argvWithFleet(cfg, spec));
         String agentSessionId = applySessionIdentity(argv, spec.sessionName(), spec.resumeSessionId());
-        return new Launch(workerEnv, argvWithAutoCompact(argvWithModel(argv, cfg), cfg), agentSessionId);
+        return new Launch(workerEnv, ClaudeCodeArguments.withAutoCompactWindow(argvWithModel(argv, cfg), cfg), agentSessionId);
     }
 
     /**
@@ -908,30 +909,6 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
         return withModel;
     }
 
-    /**
-     * Pin a bounded auto-compaction window on the command line via {@code --autocompact <tokens>},
-     * opt-in per profile (CB-634's sibling ticket: a member that runs out of context dies mid-turn
-     * and its {@code fleet_reply} — the whole point of the turn — is lost with it; opencode already
-     * forces {@code compaction.auto: true} unconditionally, CB-523, but Claude Code has no equivalent
-     * and runs at the backend's own default window).
-     *
-     * <p>Mirrors {@link #argvWithModel}: appended after it, so it survives the {@code ccs <profile>}
-     * wrapper the same way {@code --model} does, and outranks env/settings and the operator's own
-     * {@code argv}. Verified: {@code claude 2.1.241 --help} lists {@code --autocompact <auto|tokens>}
-     * (either the literal {@code auto}, or an integer 100k–1M) — {@link FleetConfig#load} rejects a
-     * configured value outside that band before this ever runs, so the flag Claude Code receives here
-     * is always in range.
-     */
-    private static List<String> argvWithAutoCompact(List<String> argv, FleetConfig.Profile cfg) {
-        if (cfg.autoCompactWindow() == null) {
-            return argv;
-        }
-        List<String> withAutoCompact = mutableArgv(argv);
-        withAutoCompact.add("--autocompact");
-        withAutoCompact.add(String.valueOf(cfg.autoCompactWindow()));
-        return withAutoCompact;
-    }
-
     // --- Agent-returning convenience spawns (used by callers/tests that want the herdr Agent) ---
 
     /** Spawn a worker for the default profile in the resolved default cwd. */

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java

@@ -1,8 +1,11 @@
 package dev.ltms.fleet.config;
 
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.spi.ILoggingEvent;
 import dev.ltms.fleet.auth.MemberRegistry;
 import dev.ltms.fleet.msg.LeadMailbox;
 import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.testing.CapturedLog;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
@@ -93,6 +96,72 @@ class FleetConfigTest {
                 "unset means off — today's behaviour, unchanged");
     }
 
+    /**
+     * fleetd #601 review (measured 2026-09-22): this guard used to throw {@link
+     * IllegalStateException} and refuse to start. On a host with the conflict configured, that
+     * turned into a launchd restart loop with no readable cause, since {@code fleetd.yaml} is
+     * gitignored. It must now WARN and let the daemon start, and the warning must carry both values
+     * so an operator can fix the config without reading the source. Pinning the log line itself (via
+     * {@link CapturedLog}) rather than a snippet of production source text — the latter is the
+     * anti-pattern this repo avoids; the former is the actual observable behaviour a reader (or an
+     * alert on the log) depends on.
+     */
+    @Test
+    void aClaudeProfileWithConflictingAutoCompactFlagAndEnvironmentWindowLoadsAndWarnsWithBothValues(
+            @TempDir Path dir) throws Exception {
+        Path f = dir.resolve("conflicting-auto-compact-window.yaml");
+        Files.writeString(f, """
+                profiles:
+                  claude-profile:
+                    autoCompactWindow: 250000
+                    env:
+                      CLAUDE_CODE_AUTO_COMPACT_WINDOW: "300000"
+                """);
+
+        FleetConfig cfg;
+        List<String> warnings;
+        try (CapturedLog log = CapturedLog.at(FleetConfig.class, Level.WARN)) {
+            cfg = FleetConfig.load(f);
+            warnings = log.events().stream().map(ILoggingEvent::getFormattedMessage).toList();
+        }
+
+        assertEquals(250_000, cfg.profiles().get("claude-profile").autoCompactWindow(),
+                "the disagreement is reported, not corrected — the flag value still loads as-is");
+        assertEquals(1, warnings.size(), "exactly one warning for the one conflicting profile: " + warnings);
+        String warning = warnings.get(0);
+        assertTrue(warning.contains("claude-profile"), "names the offending profile: " + warning);
+        assertTrue(warning.contains("autoCompactWindow=250000"), "names the flag value: " + warning);
+        assertTrue(warning.contains("CLAUDE_CODE_AUTO_COMPACT_WINDOW=300000"), "names the env value: " + warning);
+    }
+
+    /**
+     * The negative probe paired with the test above (per fleetd #601 review): a warning that fires
+     * on every load and a warning that never fires read the same from a single test, so both must be
+     * checked. No conflict here — the flag and the env value agree — so no warning should be logged.
+     */
+    @Test
+    void aClaudeProfileWithEqualAutoCompactFlagAndEnvironmentWindowLoadsWithNoWarning(@TempDir Path dir)
+            throws Exception {
+        Path f = dir.resolve("equal-auto-compact-window.yaml");
+        Files.writeString(f, """
+                profiles:
+                  claude-profile:
+                    autoCompactWindow: 250000
+                    env:
+                      CLAUDE_CODE_AUTO_COMPACT_WINDOW: "250000"
+                """);
+
+        FleetConfig cfg;
+        List<ILoggingEvent> events;
+        try (CapturedLog log = CapturedLog.at(FleetConfig.class, Level.WARN)) {
+            cfg = FleetConfig.load(f);
+            events = log.events();
+        }
+
+        assertEquals(250_000, cfg.profiles().get("claude-profile").autoCompactWindow());
+        assertTrue(events.isEmpty(), "equal values must not warn: " + events);
+    }
+
     // ── fleetd #201 Unit 5: errorPattern ────────────────────────────────────────────────────────
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/lead/LeadLauncherTest.java

@@ -32,13 +32,26 @@ class LeadLauncherTest {
                 Map.of("CLAUDE_CODE_AUTO_COMPACT_WINDOW", "300000"), null, null, true, null);
     }
 
+    private static FleetConfig.Profile profileWithAutoCompactWindow(String kind) {
+        return new FleetConfig.Profile(
+                "opus", null, "claude-opus-5", null, "FLEETD_WORKER_TOKEN",
+                List.of("ccs", "ltms"), "tab", "fleet", null,
+                "http://127.0.0.1:8765/mcp", null, null,
+                null, null, kind, Map.of(), null, null, true, null, null,
+                null, null, null, 250_000);
+    }
+
     private static FleetConfig configWith(FleetConfig.Leader lead) {
+        return configWith(lead, opusProfile());
+    }
+
+    private static FleetConfig configWith(FleetConfig.Leader lead, FleetConfig.Profile profile) {
         Map<String, FleetConfig.Leader> leaders = new LinkedHashMap<>();
         leaders.put("opus", lead);
         FleetConfig.Fleet fleet =
                 new FleetConfig.Fleet(leaders, Map.of(), Map.of(), Map.of(), null);
         return new FleetConfig(
-                null, null, Map.of("opus", opusProfile()), null, null, null, null, null,
+                null, null, Map.of("opus", profile), null, null, null, null, null,
                 null, null, fleet, null, "fixed", null).withDefaults();
     }
 
@@ -330,6 +343,36 @@ class LeadLauncherTest {
                 "--model is appended last so it outranks the ccs wrapper (CB-533)");
     }
 
+    @Test
+    void aClaudeLeadPassesItsConfiguredAutoCompactWindowToClaudeCode() {
+        FakeHerdr herdr = new FakeHerdr();
+        FleetConfig.Profile profile = profileWithAutoCompactWindow("claude-code");
+
+        launcher(herdr, configWith(lead("opus", "lead: opus", 1), profile)).ensureLeads();
+
+        List<String> args = startedArgs(herdr);
+        assertEquals("250000", args.get(args.indexOf("--autocompact") + 1));
+    }
+
+    @Test
+    void aClaudeLeadWithNoAutoCompactWindowGetsNoAutoCompactFlag() {
+        FakeHerdr herdr = new FakeHerdr();
+
+        launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads();
+
+        assertFalse(startedArgs(herdr).contains("--autocompact"));
+    }
+
+    @Test
+    void aNonClaudeLeadDoesNotGetAnAutoCompactFlag() {
+        FakeHerdr herdr = new FakeHerdr();
+        FleetConfig.Profile profile = profileWithAutoCompactWindow("opencode");
+
+        launcher(herdr, configWith(lead("opus", "lead: opus", 1), profile)).ensureLeads();
+
+        assertFalse(startedArgs(herdr).contains("--autocompact"));
+    }
+
     /** A lead runs on the operator's subscription. Nothing may move it off. */
     @Test
     void theLeadEnvCarriesNoAnthropicBinding() {

fleetd/src/test/java/dev/ltms/fleet/lead/LeadRolloverTest.java

@@ -1359,4 +1359,92 @@ class LeadRolloverTest {
                     + "it were the measured wait duration: " + message);
         }
     }
+
+    // ---- fleetd #615: a HerdrException out of either unwrapped agents.send call must leave a ----
+    // ---- TERMINAL FAILED outcome, never a stuck IN_PROGRESS ---------------------------------------
+
+    @Test
+    @DisplayName("[fleetd #615 — 1] send() throwing on the /clear call leaves status(token) "
+            + "reporting FAILED, not stuck at IN_PROGRESS")
+    void sendThrowingOnClearLeavesStatusReportingFailed() throws IOException {
+        FakeHerdr fake = new FakeHerdr(); // default idle — the turn-settle wait passes immediately
+        HerdrClient throwsOnClear = new HerdrClient() {
+            @Override
+            public JsonNode call(String method, Object params) throws HerdrException {
+                if ("agent.prompt".equals(method) && String.valueOf(params).contains("/clear")) {
+                    throw new HerdrException("simulated herdr transport failure sending /clear");
+                }
+                return fake.call(method, params);
+            }
+
+            @Override
+            public void close() {
+                fake.close();
+            }
+        };
+        Path handover = writeHandover("handover contents");
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(throwsOnClear, cfg(handover.toString()), fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertTrue(decision.accepted(), "every synchronous gate passes; the throw happens only "
+                + "inside the deferred continuation, which this test's synchronous runner has "
+                + "already run to completion by the time confirm() returns");
+
+        LeadRollover.RollStatus status = rollover.status(pending.token());
+        assertEquals(LeadRollover.RollState.FAILED, status.state(),
+                "a HerdrException out of the /clear send must leave a TERMINAL FAILED outcome — "
+                        + "before fleetd #615's fix, the continuation thread died silently and "
+                        + "status() was stuck reporting the IN_PROGRESS confirm() wrote at hand-off, "
+                        + "forever: got " + status.state() + " / " + status.detail());
+        assertNotEquals(LeadRollover.RollState.IN_PROGRESS, status.state());
+        assertTrue(status.detail().contains("HerdrException"), "the detail must name the exception "
+                + "so an operator reading status() has something to act on: " + status.detail());
+    }
+
+    @Test
+    @DisplayName("[fleetd #615 — 2] send() throwing on the bootstrap-text call (after /clear "
+            + "succeeded and the pane settled) also leaves status(token) reporting FAILED — a "
+            + "DIFFERENT exit from the /clear-throw case above")
+    void sendThrowingOnBootstrapTextLeavesStatusReportingFailed() throws IOException {
+        FakeHerdr fake = new FakeHerdr(); // default idle throughout — both settle waits pass promptly
+        HerdrClient throwsOnBootstrapText = new HerdrClient() {
+            @Override
+            public JsonNode call(String method, Object params) throws HerdrException {
+                if ("agent.prompt".equals(method) && String.valueOf(params).contains("read the handover file")) {
+                    throw new HerdrException("simulated herdr transport failure sending bootstrapText");
+                }
+                return fake.call(method, params);
+            }
+
+            @Override
+            public void close() {
+                fake.close();
+            }
+        };
+        Path handover = writeHandover("handover contents");
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(throwsOnBootstrapText, cfg(handover.toString()), fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertTrue(decision.accepted(), "every synchronous gate passes; the throw happens only "
+                + "inside the deferred continuation, which this test's synchronous runner has "
+                + "already run to completion by the time confirm() returns");
+        assertEquals(1, promptCallCount(fake), "sanity: /clear was sent and settled — only the "
+                + "SECOND agent.prompt call (bootstrapText) threw");
+
+        LeadRollover.RollStatus status = rollover.status(pending.token());
+        assertEquals(LeadRollover.RollState.FAILED, status.state(),
+                "a HerdrException out of the bootstrapText send — a DIFFERENT exit from the /clear "
+                        + "throw, reached only after /clear already succeeded and the pane already "
+                        + "settled — must also leave a TERMINAL FAILED outcome, not a stuck "
+                        + "IN_PROGRESS: got " + status.state() + " / " + status.detail());
+        assertNotEquals(LeadRollover.RollState.IN_PROGRESS, status.state());
+        assertTrue(status.detail().contains("HerdrException"), "the detail must name the exception "
+                + "so an operator reading status() has something to act on: " + status.detail());
+    }
 }