fleetd #618: fix the third stale spot the brief missed

The method-level javadoc on FleetConfig.warnConflictingAutoCompactWindows
(above the log.warn call) still claimed the autoCompactWindow vs
CLAUDE_CODE_AUTO_COMPACT_WINDOW precedence was 'intentionally not
asserted' and cited fleetd.yaml's now-corrected comment as evidence the
question was open. Replace it with the measured answer from #618: the
env var wins, so autoCompactWindow is inert on a profile that sets both.
Kept the WARN-not-throw rationale paragraph above it untouched (#601)
and kept the ClaudeCodeArguments cross-reference, which now points to an
agreeing claim instead of a contradicting one. No behaviour change.

fleetd/fleetd.example.yaml

@@ -209,13 +209,13 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      e.g. `env DISPLAY=:10.0 idea {dir}`. Best-effort: a failure is logged, never
 #                      fails the spawn. Omit to open the member's module by hand. There is no close
 #                      half yet — an opened module stays open until the operator closes it.
-#   autoCompactWindow → opt-in, default off. A bounded token window that forces a spawned member to
-#                      compact its context instead of running on the backend's own default and dying
-#                      mid-turn (losing its fleet_reply — the whole point of the turn — with it).
+#   autoCompactWindow → opt-in, default off. A bounded token window that forces a launched Claude Code
+#                      lead or member to compact its context instead of running on the backend's own
+#                      default. A member that runs out of context can die mid-turn and lose its fleet_reply.
 #                      Validated at config load to [100000, 1000000] — the band Claude Code's own
 #                      --autocompact flag accepts.
 #                      CROSS-BACKEND SEMANTICS DIFFER: on claude-code this is a launch-time
-#                      `--autocompact <tokens>` flag — the member compacts AT this window. opencode
+#                      `--autocompact <tokens>` flag — the Claude Code session compacts AT this window. opencode
 #                      has no equivalent flag (it only forces `compaction.auto: true`, unconditionally,
 #                      already), so this is instead applied as the model's `limit.context` in the
 #                      generated opencode.json — the member compacts WITHIN this window, not exactly
@@ -415,7 +415,7 @@ profiles:
     # ideMcpUrl: http://127.0.0.1:29170/index-mcp/streamable-http   # opt-in (CB-634): IDE code intelligence, pinned to the worktree
     # ideProjectDir: fleetd          # CB-634: module dir the IDE opens + the overlay pins (this repo's pom is in fleetd/)
     # ideOpenCommand: env DISPLAY=:10.0 idea {dir}   # CB-634 auto-open: opens {dir} in the IDE at spawn; omit to open by hand
-    # autoCompactWindow: 250000   # opt-in: bound member context; claude-code compacts AT this, opencode within it (model limit.context)
+    # autoCompactWindow: 250000   # opt-in: bound Claude Code lead/member context; claude-code compacts AT this, opencode within it (model limit.context)
   gx11:                              # a second backend, so `placement: weighted` has a choice
     baseUrl: http://gx01.gw:8000     # self-hosted; ccs handles the model + token
     placement: tab

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -53,6 +53,7 @@ import dev.ltms.fleet.rest.FleetApp;
 import dev.ltms.fleet.session.GitWorktrees;
 import dev.ltms.fleet.session.MemberSession;
 import dev.ltms.fleet.session.SessionManager;
+import dev.ltms.fleet.peer.MemberRole;
 import dev.ltms.fleet.peer.PeerLauncher;
 import dev.ltms.fleet.session.SessionReaper;
 import dev.ltms.fleet.member.ClaudeCodeLauncher;
@@ -176,6 +177,12 @@ public final class Fleetd {
         // and the Fleetd-startup tests actually pin — see FleetConfig#validateAll's javadoc for
         // why a name-by-name list here would have the same defect it replaces.
         cfg.validateAll();
+        // fleetd #613: validateAll() (validateMembers() inside it) only refuses a slot that names a
+        // bad role or profile — it says nothing about a role that has NO pool or NO charter at all,
+        // because both are legitimate ("unconstrained") states, not errors. Report them here, right
+        // after validation passes, so an operator sees the gap once per restart instead of finding
+        // it later in a roster row (see reportRoleFallbackGaps' javadoc for the measured cause).
+        reportRoleFallbackGaps(cfg);
         // fleetd #469, follow-up to #464: validateAll() (and validateCharters() inside it) only
         // checks that a charter's KEY is a role wire name and its text is non-blank — it never
         // looks at what the text actually names. This is the separate check that does: it asks
@@ -2175,6 +2182,58 @@ public final class Fleetd {
         }
     }
 
+    /**
+     * fleetd #613: {@code FleetConfig.candidateProfiles(MemberRole)} (FleetConfig.java:1827) and
+     * {@code CompositePeerLauncher.poolFor} (CompositePeerLauncher.java:598-603) both fall back to
+     * <em>every</em> configured profile when a role has no {@code fleet.<role>s:} pool — a
+     * deliberate "unconstrained" behaviour, kept unchanged here, that lets a config with only
+     * {@code profiles:} and no {@code fleet:} block still spawn. That fallback is silent, and on
+     * the host that opened this ticket it widened an unqualified {@code hunter} spawn to all 8
+     * configured profiles and picked {@code local} as the resolved first choice — a profile every
+     * other pool on that same config gives weight 0 to. Report it once at boot instead, naming both
+     * how many profiles the gap opens onto and the exact first choice, since the first choice (not
+     * the pool size) is what actually surprised the operator.
+     *
+     * <p>A missing {@code fleet.charters.<role>:} entry is reported separately: the member still
+     * runs, but with only the launcher's own reply charter and no role contract. Unlike the pool
+     * gap this already has a per-spawn instrument ({@code HerdrPeerLauncher.logCharterReceipt},
+     * {@code SessionManager}'s {@code charterSource} roster field) — this boot line is the same
+     * information surfaced once, up front, rather than discovered per member later.
+     *
+     * <p>Never refuses to start over either gap — both are legitimate configurations, and this is a
+     * report, not a validation. Package-private so a test can call it directly and capture the log
+     * via a {@link ch.qos.logback.core.read.ListAppender}, the same pattern {@link
+     * #reportExhaustedPatternGap} and {@link #reportMemberCredentialsGap} already use.
+     */
+    static void reportRoleFallbackGaps(FleetConfig cfg) {
+        List<String> poolGaps = new ArrayList<>();
+        List<String> charterGaps = new ArrayList<>();
+        int profileCount = cfg.profiles().size();
+        for (MemberRole role : MemberRole.values()) {
+            boolean hasPool = cfg.fleet() != null && !cfg.fleet().profilesFor(role).isEmpty();
+            if (!hasPool) {
+                String firstChoice = cfg.defaultProfileFor(role);
+                poolGaps.add(role.wireName() + " (may land on any of " + profileCount
+                        + " profile(s), first choice "
+                        + (firstChoice == null ? "none — no profiles configured" : "'" + firstChoice + "'")
+                        + ")");
+            }
+            String charter = cfg.fleet() == null ? null : cfg.fleet().charterFor(role);
+            if (charter == null || charter.isBlank()) {
+                charterGaps.add(role.wireName());
+            }
+        }
+        if (!poolGaps.isEmpty()) {
+            log.info("role fallback: no fleet.<role>s: pool for {} — an unqualified spawn of that "
+                    + "role falls back to every configured profile (deliberate; see "
+                    + "FleetConfig#candidateProfiles)", poolGaps);
+        }
+        if (!charterGaps.isEmpty()) {
+            log.info("role fallback: no fleet.charters: entry for {} — that role runs with only "
+                    + "the launcher's reply charter, no role contract", charterGaps);
+        }
+    }
+
     /**
      * fleetd #474: the one place both the startup call (right after {@code cfg.validateAll()} in
      * {@link #main}) and the reload call (wired into {@code config}'s {@code extraValidation} above,

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -462,8 +462,8 @@ public record FleetConfig(
      *                       profile that does not opt in. Read live off the current config, so it is
      *                       HOT: a change takes effect on the next exhaustion classification / spawn,
      *                       no restart needed.
-     * @param autoCompactWindow  opt-in per-profile token window that forces a spawned member to
-     *                       auto-compact its context at (Claude Code) or within (opencode) a bound the
+     * @param autoCompactWindow  opt-in per-profile token window that forces a launched Claude Code
+     *                       session to auto-compact its context at, or an opencode session within, a bound the
      *                       operator chooses, instead of the backend's own default. {@code null} (the
      *                       default) leaves today's behaviour exactly — opencode already forces
      *                       {@code compaction.auto: true} unconditionally (CB-523) but has no absolute
@@ -1875,6 +1875,7 @@ public record FleetConfig(
             rejectDuplicateMemberSlots(yaml);
             rejectNegativeMaxLoad(yaml);
             rejectAutoCompactWindowOutOfRange(yaml);
+            warnConflictingAutoCompactWindows(yaml);
             rejectMalformedProfilePatterns(yaml);
             rejectUnknownKind(yaml);
             rejectUnknownAuthMode(yaml);
@@ -2225,6 +2226,73 @@ public record FleetConfig(
         }
     }
 
+    /**
+     * Warn (never refuse to start) about a Claude Code profile whose auto-compaction flag and
+     * environment setting disagree.
+     *
+     * <p>Renamed from {@code rejectConflictingAutoCompactWindows} (fleetd #601 review, measured
+     * 2026-09-22): that method threw {@link IllegalStateException}, so {@link #load(Path)} refused
+     * to start on a config carrying this conflict. On this host, four profiles trip it, including
+     * the lead's own profile and the one every worker spawns on — so the throw is not a rare edge
+     * case. Under launchd, a throw inside {@code load()} is a restart loop, not an error an operator
+     * reads once, and the config that would fix it ({@code fleetd/fleetd.yaml}) is gitignored, so
+     * the cause is invisible on the host where it bites. A WARN gives the operator the same
+     * information — which profiles, and now both values, so they can fix it without reading the
+     * source — without ever taking the fleet down.
+     *
+     * <p>fleetd #618 measured which of the two inputs Claude Code actually follows when they
+     * disagree: the environment variable wins, so {@code autoCompactWindow} is inert on a profile
+     * that also sets the env var. This method only detects and reports the disagreement — it does
+     * not correct it — see {@link dev.ltms.fleet.launch.ClaudeCodeArguments} for the full measured
+     * precedence.
+     *
+     * <p>Equal values never warn: either input then produces the same session window, so there is
+     * nothing to reconcile.
+     */
+    static void warnConflictingAutoCompactWindows(String yaml) {
+        Map<?, ?> raw;
+        try {
+            raw = YAML.readValue(yaml, Map.class);
+        } catch (IOException | IllegalArgumentException e) {
+            return;
+        }
+        if (raw == null || !(raw.get("profiles") instanceof Map<?, ?> profiles)) {
+            return;
+        }
+        List<String> names = new ArrayList<>();
+        List<String> detail = new ArrayList<>();
+        for (Map.Entry<?, ?> entry : profiles.entrySet()) {
+            if (!(entry.getValue() instanceof Map<?, ?> profile)
+                    || !(profile.get("autoCompactWindow") instanceof Number window)
+                    || !(profile.get("env") instanceof Map<?, ?> env)
+                    || !env.containsKey("CLAUDE_CODE_AUTO_COMPACT_WINDOW")) {
+                continue;
+            }
+            Object kind = profile.get("kind");
+            boolean claudeCode = kind == null || String.valueOf(kind).isBlank()
+                    || Profile.KIND_CLAUDE_CODE.equalsIgnoreCase(String.valueOf(kind));
+            Object envValue = env.get("CLAUDE_CODE_AUTO_COMPACT_WINDOW");
+            if (claudeCode && !String.valueOf(window).equals(String.valueOf(envValue))) {
+                String name = String.valueOf(entry.getKey());
+                names.add(name);
+                detail.add(name + " (autoCompactWindow=" + window
+                        + ", env.CLAUDE_CODE_AUTO_COMPACT_WINDOW=" + envValue + ")");
+            }
+        }
+        if (names.isEmpty()) {
+            return;
+        }
+        names.sort(String::compareTo);
+        detail.sort(String::compareTo);
+        log.warn("Claude Code profile(s) {} set disagreeing autoCompactWindow and env."
+                        + "CLAUDE_CODE_AUTO_COMPACT_WINDOW — the daemon starts anyway: {}. fleetd "
+                        + "#618 measured that CLAUDE_CODE_AUTO_COMPACT_WINDOW wins, so "
+                        + "autoCompactWindow is inert on these profiles. Set equal values on each "
+                        + "to resolve this — do not just delete the env var, since that LOWERS the "
+                        + "live window to autoCompactWindow's value rather than fixing anything.",
+                names, String.join(", ", detail));
+    }
+
     /**
      * Reject a profile whose {@code errorPattern} (fleetd #201 Unit 5) or {@code exhaustedPattern}
      * (CB-578 stage A) is not a valid Java regex, naming the profile, the key, and the parser's own

fleetd/src/main/java/dev/ltms/fleet/launch/ClaudeCodeArguments.java

@@ -0,0 +1,37 @@
+package dev.ltms.fleet.launch;
+
+import dev.ltms.fleet.config.FleetConfig;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/** Arguments shared by every fleetd path that starts Claude Code. */
+public final class ClaudeCodeArguments {
+
+    private ClaudeCodeArguments() {
+    }
+
+    /**
+     * Append the configured Claude Code auto-compaction window when the profile opts in.
+     *
+     * <p>This flag and the environment variable {@code CLAUDE_CODE_AUTO_COMPACT_WINDOW} can
+     * disagree, and fleetd #618 measured which one Claude Code actually follows: the environment
+     * variable wins, ahead of this {@code --autocompact} flag, ahead of the settings file, ahead of
+     * clientdata, the experiment, and the model default. So when a profile sets both, the flag this
+     * method appends has NO effect — Claude Code reads {@code CLAUDE_CODE_AUTO_COMPACT_WINDOW}
+     * first and never consults the flag. {@link FleetConfig#load(java.nio.file.Path)} only WARNS
+     * when a Claude Code profile sets both to different values (see {@code
+     * FleetConfig.warnConflictingAutoCompactWindows}) — it does not stop the daemon from starting,
+     * and the launched session honours the env var, not this flag. Measured against Claude Code
+     * 2.1.278 (fleetd #618) — a later version could reorder this precedence.
+     */
+    public static List<String> withAutoCompactWindow(List<String> argv, FleetConfig.Profile profile) {
+        if (profile.autoCompactWindow() == null) {
+            return argv;
+        }
+        List<String> withAutoCompact = new ArrayList<>(argv);
+        withAutoCompact.add("--autocompact");
+        withAutoCompact.add(String.valueOf(profile.autoCompactWindow()));
+        return withAutoCompact;
+    }
+}

fleetd/src/main/java/dev/ltms/fleet/lead/LeadLauncher.java

@@ -8,6 +8,7 @@ import dev.ltms.fleet.herdr.PendingCloseMarker;
 import dev.ltms.fleet.herdr.Tab;
 import dev.ltms.fleet.herdr.Workspace;
 import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.launch.ClaudeCodeArguments;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -358,7 +359,8 @@ public final class LeadLauncher {
     }
 
     /**
-     * The lead's argv: the profile's own command, the model pin, and the bridge MCP mount.
+     * The lead's argv: the profile's own command, the model and auto-compaction pins, and the bridge
+     * MCP mount.
      *
      * <p>No {@code --append-system-prompt}. That flag carries the worker reply charter, and a lead
      * is not a worker — it reads its orchestration rules from the project's {@code CLAUDE.md} like
@@ -380,7 +382,7 @@ public final class LeadLauncher {
             argv.add("--model");
             argv.add(profile.model());
         }
-        return argv;
+        return profile.isOpenCode() ? argv : ClaudeCodeArguments.withAutoCompactWindow(argv, profile);
     }
 
     /**

fleetd/src/main/java/dev/ltms/fleet/member/ClaudeCodeLauncher.java

@@ -8,6 +8,7 @@ import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.WorkspaceControl;
+import dev.ltms.fleet.launch.ClaudeCodeArguments;
 import dev.ltms.fleet.peer.Capability;
 import dev.ltms.fleet.peer.PeerLauncher;
 import org.slf4j.Logger;
@@ -298,7 +299,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
         // has neither MCP nor a charter — session flags must be added into a list we own.
         List<String> argv = mutableArgv(argvWithFleet(cfg, spec));
         String agentSessionId = applySessionIdentity(argv, spec.sessionName(), spec.resumeSessionId());
-        return new Launch(workerEnv, argvWithAutoCompact(argvWithModel(argv, cfg), cfg), agentSessionId);
+        return new Launch(workerEnv, ClaudeCodeArguments.withAutoCompactWindow(argvWithModel(argv, cfg), cfg), agentSessionId);
     }
 
     /**
@@ -908,30 +909,6 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
         return withModel;
     }
 
-    /**
-     * Pin a bounded auto-compaction window on the command line via {@code --autocompact <tokens>},
-     * opt-in per profile (CB-634's sibling ticket: a member that runs out of context dies mid-turn
-     * and its {@code fleet_reply} — the whole point of the turn — is lost with it; opencode already
-     * forces {@code compaction.auto: true} unconditionally, CB-523, but Claude Code has no equivalent
-     * and runs at the backend's own default window).
-     *
-     * <p>Mirrors {@link #argvWithModel}: appended after it, so it survives the {@code ccs <profile>}
-     * wrapper the same way {@code --model} does, and outranks env/settings and the operator's own
-     * {@code argv}. Verified: {@code claude 2.1.241 --help} lists {@code --autocompact <auto|tokens>}
-     * (either the literal {@code auto}, or an integer 100k–1M) — {@link FleetConfig#load} rejects a
-     * configured value outside that band before this ever runs, so the flag Claude Code receives here
-     * is always in range.
-     */
-    private static List<String> argvWithAutoCompact(List<String> argv, FleetConfig.Profile cfg) {
-        if (cfg.autoCompactWindow() == null) {
-            return argv;
-        }
-        List<String> withAutoCompact = mutableArgv(argv);
-        withAutoCompact.add("--autocompact");
-        withAutoCompact.add(String.valueOf(cfg.autoCompactWindow()));
-        return withAutoCompact;
-    }
-
     // --- Agent-returning convenience spawns (used by callers/tests that want the herdr Agent) ---
 
     /** Spawn a worker for the default profile in the resolved default cwd. */

fleetd/src/main/java/dev/ltms/fleet/msg/LeadHeartbeatLoop.java

@@ -271,8 +271,13 @@ public final class LeadHeartbeatLoop {
      * does not evaluate the lead's idle state before the fleet has settled.
      */
     public void start() {
-        log.info("idle-lead heartbeat: on — nudge lead after {}s idle (recheck {}ms, quiet cap {})",
-                TimeUnit.NANOSECONDS.toSeconds(idleAfterNanos), backoffMs, quietNudgeCap);
+        // fleetd #613: contextHighNudge added alongside the three settings already here — an
+        // operator otherwise cannot tell from the boot log whether the #609 handover notice is
+        // armed, and had to load the deployed jar's config to confirm it.
+        log.info("idle-lead heartbeat: on — nudge lead after {}s idle (recheck {}ms, quiet cap {}, "
+                        + "context-high nudge {})",
+                TimeUnit.NANOSECONDS.toSeconds(idleAfterNanos), backoffMs, quietNudgeCap,
+                contextHighNudge);
         scheduler.schedule(this::tick, backoffMs, TimeUnit.MILLISECONDS);
     }
 

fleetd/src/test/java/dev/ltms/fleet/RoleFallbackGapReportTest.java

@@ -0,0 +1,252 @@
+package dev.ltms.fleet;
+
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
+import dev.ltms.fleet.config.FleetConfig;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+import org.slf4j.LoggerFactory;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+/**
+ * fleetd #613: a {@code MemberRole} with no {@code fleet.<role>s:} pool falls back to
+ * <em>every</em> configured profile ({@code FleetConfig#candidateProfiles}), and one with no
+ * {@code fleet.charters.<role>:} entry runs with only the launcher's reply charter. Both are
+ * deliberate, legitimate states — neither is refused by {@code validateMembers()} — but both were
+ * silent at boot. On the host that opened this ticket, an unqualified {@code hunter} spawn silently
+ * widened to all 8 configured profiles and its resolved first choice was {@code local}, a profile
+ * every other pool on that same config gave weight 0 to.
+ *
+ * <p>{@link Fleetd#reportRoleFallbackGaps} must name every gapped role, and for a pool gap, the
+ * exact resolved first-choice profile — that number, not the pool size, is what actually surprised
+ * the operator. Mirrors {@link ExhaustedPatternGapReportTest}'s pattern: capture the real log via a
+ * {@link ListAppender} rather than asserting on the call site's source text.
+ */
+class RoleFallbackGapReportTest {
+
+    private static FleetConfig load(Path dir, String yaml) throws Exception {
+        Path f = dir.resolve("fleetd.yaml");
+        Files.writeString(f, yaml);
+        return FleetConfig.load(f);
+    }
+
+    /**
+     * The level this logger had before {@link #attach()} raised it, so {@link #detach} can put it
+     * back. {@code null} means "inherit from the parent" — the state this logger starts in.
+     */
+    private static Level originalLevel;
+
+    /**
+     * {@code reportRoleFallbackGaps} logs at INFO, and {@code logback-test.xml} sets
+     * {@code dev.ltms.fleet} to WARN — so INFO events are dropped by the level check before any
+     * appender sees them. Raise the level for the duration of the test, exactly like {@code
+     * GitHostShapeReportTest#attach}.
+     */
+    private static ListAppender<ILoggingEvent> attach() {
+        Logger logger = (Logger) LoggerFactory.getLogger(Fleetd.class);
+        originalLevel = logger.getLevel();
+        logger.setLevel(Level.INFO);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        return appender;
+    }
+
+    private static void detach(ListAppender<ILoggingEvent> appender) {
+        Logger logger = (Logger) LoggerFactory.getLogger(Fleetd.class);
+        logger.detachAppender(appender);
+        logger.setLevel(originalLevel);
+    }
+
+    private static List<String> infoMessages(ListAppender<ILoggingEvent> appender) {
+        return appender.list.stream()
+                .filter(e -> e.getLevel() == Level.INFO)
+                .map(ILoggingEvent::getFormattedMessage)
+                .toList();
+    }
+
+    /**
+     * Reproduces the shape measured in the ticket: {@code dev}, {@code reviewer} and
+     * {@code architect} each have a pool and a charter; {@code hunter} has neither. The pool-gap
+     * line must name {@code hunter}, the profile count (3), and the resolved first choice
+     * ({@code local}, the first profile in definition order) — and must not name the three healthy
+     * roles. The charter-gap line must separately name only {@code hunter}.
+     */
+    @Test
+    void hunterWithNoPoolOrCharterIsNamedWithItsResolvedFirstChoice(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = load(dir, """
+                profiles:
+                  local:
+                    baseUrl: http://gx00.gw:8000
+                  sonnet:
+                    baseUrl: https://llm.ltms.dev/v1
+                  terra:
+                    baseUrl: https://llm.ltms.dev/v1
+                fleet:
+                  developers:
+                    a:
+                      profile: sonnet
+                  reviewers:
+                    b:
+                      profile: terra
+                  architects:
+                    c:
+                      profile: sonnet
+                  charters:
+                    dev: "dev charter text"
+                    reviewer: "reviewer charter text"
+                    architect: "architect charter text"
+                """);
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            Fleetd.reportRoleFallbackGaps(cfg);
+        } finally {
+            detach(appender);
+        }
+
+        List<String> infos = infoMessages(appender);
+
+        String poolLine = infos.stream()
+                .filter(m -> m.contains("no fleet.<role>s: pool"))
+                .findFirst()
+                .orElseThrow(() -> new AssertionError("expected a pool-gap INFO line: " + infos));
+        assertTrue(poolLine.contains("hunter"), poolLine);
+        assertTrue(poolLine.contains("3"), "must name the profile count the gap opens onto: " + poolLine);
+        assertTrue(poolLine.contains("'local'"),
+                "must name the resolved first-choice profile, the number that actually surprised "
+                        + "the operator: " + poolLine);
+        for (String healthy : List.of("dev", "reviewer", "architect")) {
+            assertFalse(poolLine.contains(healthy),
+                    "pool-gap line must not name a role that has a pool: " + poolLine);
+        }
+
+        String charterLine = infos.stream()
+                .filter(m -> m.contains("no fleet.charters: entry"))
+                .findFirst()
+                .orElseThrow(() -> new AssertionError("expected a charter-gap INFO line: " + infos));
+        assertTrue(charterLine.contains("hunter"), charterLine);
+        for (String healthy : List.of("dev", "reviewer", "architect")) {
+            assertFalse(charterLine.contains(healthy),
+                    "charter-gap line must not name a role that has a charter: " + charterLine);
+        }
+    }
+
+    /**
+     * The resolved first choice must be genuinely computed from definition order, not hardcoded —
+     * reordering {@code profiles:} so a different entry comes first changes the reported choice.
+     */
+    @Test
+    void theResolvedFirstChoiceFollowsProfileDefinitionOrder(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = load(dir, """
+                profiles:
+                  sonnet:
+                    baseUrl: https://llm.ltms.dev/v1
+                  local:
+                    baseUrl: http://gx00.gw:8000
+                fleet:
+                  developers:
+                    a:
+                      profile: sonnet
+                  charters:
+                    dev: "dev charter text"
+                """);
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            Fleetd.reportRoleFallbackGaps(cfg);
+        } finally {
+            detach(appender);
+        }
+
+        String poolLine = infoMessages(appender).stream()
+                .filter(m -> m.contains("no fleet.<role>s: pool"))
+                .findFirst()
+                .orElseThrow();
+        // hunter, reviewer and architect all lack a pool here; each falls back to the full 2-profile
+        // set and the first-choice is 'sonnet' because it is first in profiles: definition order.
+        assertTrue(poolLine.contains("'sonnet'"), poolLine);
+        assertFalse(poolLine.contains("'local'"), poolLine);
+    }
+
+    /** A config with a pool and a charter for every role produces no role-fallback log at all. */
+    @Test
+    void everyRoleWithAPoolAndACharterProducesNoLogAtAll(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = load(dir, """
+                profiles:
+                  sonnet:
+                    baseUrl: https://llm.ltms.dev/v1
+                fleet:
+                  developers:
+                    a:
+                      profile: sonnet
+                  reviewers:
+                    b:
+                      profile: sonnet
+                  hunters:
+                    c:
+                      profile: sonnet
+                  architects:
+                    d:
+                      profile: sonnet
+                  charters:
+                    dev: "dev charter text"
+                    reviewer: "reviewer charter text"
+                    hunter: "hunter charter text"
+                    architect: "architect charter text"
+                """);
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            Fleetd.reportRoleFallbackGaps(cfg);
+        } finally {
+            detach(appender);
+        }
+
+        assertTrue(appender.list.isEmpty(),
+                "a config with no gaps must not print a per-role block: " + infoMessages(appender));
+    }
+
+    /**
+     * A config with only {@code profiles:} and no {@code fleet:} block at all must still be
+     * reported (every role is gapped, both pool and charter) rather than throwing — this is the
+     * exact shape {@code candidateProfiles}' fallback exists to keep starting.
+     */
+    @Test
+    void aConfigWithNoFleetBlockAtAllReportsEveryRoleGapped(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = load(dir, """
+                profiles:
+                  sonnet:
+                    baseUrl: https://llm.ltms.dev/v1
+                """);
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            Fleetd.reportRoleFallbackGaps(cfg);
+        } finally {
+            detach(appender);
+        }
+
+        List<String> infos = infoMessages(appender);
+        String poolLine = infos.stream()
+                .filter(m -> m.contains("no fleet.<role>s: pool"))
+                .findFirst()
+                .orElseThrow(() -> new AssertionError("expected a pool-gap INFO line: " + infos));
+        String charterLine = infos.stream()
+                .filter(m -> m.contains("no fleet.charters: entry"))
+                .findFirst()
+                .orElseThrow(() -> new AssertionError("expected a charter-gap INFO line: " + infos));
+        for (String role : List.of("dev", "hunter", "reviewer", "architect")) {
+            assertTrue(poolLine.contains(role), poolLine);
+            assertTrue(charterLine.contains(role), charterLine);
+        }
+    }
+}

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java

@@ -1,8 +1,11 @@
 package dev.ltms.fleet.config;
 
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.spi.ILoggingEvent;
 import dev.ltms.fleet.auth.MemberRegistry;
 import dev.ltms.fleet.msg.LeadMailbox;
 import dev.ltms.fleet.peer.MemberRole;
+import dev.ltms.fleet.testing.CapturedLog;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
@@ -93,6 +96,72 @@ class FleetConfigTest {
                 "unset means off — today's behaviour, unchanged");
     }
 
+    /**
+     * fleetd #601 review (measured 2026-09-22): this guard used to throw {@link
+     * IllegalStateException} and refuse to start. On a host with the conflict configured, that
+     * turned into a launchd restart loop with no readable cause, since {@code fleetd.yaml} is
+     * gitignored. It must now WARN and let the daemon start, and the warning must carry both values
+     * so an operator can fix the config without reading the source. Pinning the log line itself (via
+     * {@link CapturedLog}) rather than a snippet of production source text — the latter is the
+     * anti-pattern this repo avoids; the former is the actual observable behaviour a reader (or an
+     * alert on the log) depends on.
+     */
+    @Test
+    void aClaudeProfileWithConflictingAutoCompactFlagAndEnvironmentWindowLoadsAndWarnsWithBothValues(
+            @TempDir Path dir) throws Exception {
+        Path f = dir.resolve("conflicting-auto-compact-window.yaml");
+        Files.writeString(f, """
+                profiles:
+                  claude-profile:
+                    autoCompactWindow: 250000
+                    env:
+                      CLAUDE_CODE_AUTO_COMPACT_WINDOW: "300000"
+                """);
+
+        FleetConfig cfg;
+        List<String> warnings;
+        try (CapturedLog log = CapturedLog.at(FleetConfig.class, Level.WARN)) {
+            cfg = FleetConfig.load(f);
+            warnings = log.events().stream().map(ILoggingEvent::getFormattedMessage).toList();
+        }
+
+        assertEquals(250_000, cfg.profiles().get("claude-profile").autoCompactWindow(),
+                "the disagreement is reported, not corrected — the flag value still loads as-is");
+        assertEquals(1, warnings.size(), "exactly one warning for the one conflicting profile: " + warnings);
+        String warning = warnings.get(0);
+        assertTrue(warning.contains("claude-profile"), "names the offending profile: " + warning);
+        assertTrue(warning.contains("autoCompactWindow=250000"), "names the flag value: " + warning);
+        assertTrue(warning.contains("CLAUDE_CODE_AUTO_COMPACT_WINDOW=300000"), "names the env value: " + warning);
+    }
+
+    /**
+     * The negative probe paired with the test above (per fleetd #601 review): a warning that fires
+     * on every load and a warning that never fires read the same from a single test, so both must be
+     * checked. No conflict here — the flag and the env value agree — so no warning should be logged.
+     */
+    @Test
+    void aClaudeProfileWithEqualAutoCompactFlagAndEnvironmentWindowLoadsWithNoWarning(@TempDir Path dir)
+            throws Exception {
+        Path f = dir.resolve("equal-auto-compact-window.yaml");
+        Files.writeString(f, """
+                profiles:
+                  claude-profile:
+                    autoCompactWindow: 250000
+                    env:
+                      CLAUDE_CODE_AUTO_COMPACT_WINDOW: "250000"
+                """);
+
+        FleetConfig cfg;
+        List<ILoggingEvent> events;
+        try (CapturedLog log = CapturedLog.at(FleetConfig.class, Level.WARN)) {
+            cfg = FleetConfig.load(f);
+            events = log.events();
+        }
+
+        assertEquals(250_000, cfg.profiles().get("claude-profile").autoCompactWindow());
+        assertTrue(events.isEmpty(), "equal values must not warn: " + events);
+    }
+
     // ── fleetd #201 Unit 5: errorPattern ────────────────────────────────────────────────────────
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/lead/LeadLauncherTest.java

@@ -32,13 +32,26 @@ class LeadLauncherTest {
                 Map.of("CLAUDE_CODE_AUTO_COMPACT_WINDOW", "300000"), null, null, true, null);
     }
 
+    private static FleetConfig.Profile profileWithAutoCompactWindow(String kind) {
+        return new FleetConfig.Profile(
+                "opus", null, "claude-opus-5", null, "FLEETD_WORKER_TOKEN",
+                List.of("ccs", "ltms"), "tab", "fleet", null,
+                "http://127.0.0.1:8765/mcp", null, null,
+                null, null, kind, Map.of(), null, null, true, null, null,
+                null, null, null, 250_000);
+    }
+
     private static FleetConfig configWith(FleetConfig.Leader lead) {
+        return configWith(lead, opusProfile());
+    }
+
+    private static FleetConfig configWith(FleetConfig.Leader lead, FleetConfig.Profile profile) {
         Map<String, FleetConfig.Leader> leaders = new LinkedHashMap<>();
         leaders.put("opus", lead);
         FleetConfig.Fleet fleet =
                 new FleetConfig.Fleet(leaders, Map.of(), Map.of(), Map.of(), null);
         return new FleetConfig(
-                null, null, Map.of("opus", opusProfile()), null, null, null, null, null,
+                null, null, Map.of("opus", profile), null, null, null, null, null,
                 null, null, fleet, null, "fixed", null).withDefaults();
     }
 
@@ -330,6 +343,36 @@ class LeadLauncherTest {
                 "--model is appended last so it outranks the ccs wrapper (CB-533)");
     }
 
+    @Test
+    void aClaudeLeadPassesItsConfiguredAutoCompactWindowToClaudeCode() {
+        FakeHerdr herdr = new FakeHerdr();
+        FleetConfig.Profile profile = profileWithAutoCompactWindow("claude-code");
+
+        launcher(herdr, configWith(lead("opus", "lead: opus", 1), profile)).ensureLeads();
+
+        List<String> args = startedArgs(herdr);
+        assertEquals("250000", args.get(args.indexOf("--autocompact") + 1));
+    }
+
+    @Test
+    void aClaudeLeadWithNoAutoCompactWindowGetsNoAutoCompactFlag() {
+        FakeHerdr herdr = new FakeHerdr();
+
+        launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads();
+
+        assertFalse(startedArgs(herdr).contains("--autocompact"));
+    }
+
+    @Test
+    void aNonClaudeLeadDoesNotGetAnAutoCompactFlag() {
+        FakeHerdr herdr = new FakeHerdr();
+        FleetConfig.Profile profile = profileWithAutoCompactWindow("opencode");
+
+        launcher(herdr, configWith(lead("opus", "lead: opus", 1), profile)).ensureLeads();
+
+        assertFalse(startedArgs(herdr).contains("--autocompact"));
+    }
+
     /** A lead runs on the operator's subscription. Nothing may move it off. */
     @Test
     void theLeadEnvCarriesNoAnthropicBinding() {

fleetd/src/test/java/dev/ltms/fleet/msg/LeadHeartbeatLoopTest.java

@@ -1,5 +1,9 @@
 package dev.ltms.fleet.msg;
 
+import ch.qos.logback.classic.Level;
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import dev.ltms.fleet.herdr.AgentControl;
@@ -12,6 +16,7 @@ import dev.ltms.fleet.session.MemberSession;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
+import org.slf4j.LoggerFactory;
 
 import java.util.ArrayList;
 import java.util.List;
@@ -107,6 +112,58 @@ class LeadHeartbeatLoopTest {
                 "never inject into a state the loop cannot read");
     }
 
+    // ── fleetd #613: the boot line names all four heartbeat settings ──────────────────────────
+
+    /**
+     * fleetd #613: {@link LeadHeartbeatLoop#start()}'s boot line named only 3 of the 4 constructor
+     * settings — {@code contextHighNudge} (fleetd #609) was missing, so an operator could not tell
+     * from the log whether the handover notice was armed. Captures the real log via a
+     * {@link ListAppender}, raising the logger's level past {@code logback-test.xml}'s
+     * {@code dev.ltms.fleet -> WARN} override for the duration of the call — the same seam {@code
+     * GitHostShapeReportTest#attach} uses for its own INFO-level boot line.
+     */
+    private static String heartbeatBootLine(boolean contextHighNudge, ScheduledExecutorService scheduler) {
+        Logger logger = (Logger) LoggerFactory.getLogger(LeadHeartbeatLoop.class);
+        Level originalLevel = logger.getLevel();
+        logger.setLevel(Level.INFO);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        try {
+            LeadHeartbeatLoop l = new LeadHeartbeatLoop(
+                    new PrimaryRegistry("term_lead"), null /*agents*/, null /*inbox*/, List::of,
+                    null /*pushLoop*/, scheduler, () -> 0L, IDLE_AFTER_NANOS, 1_000L, 3, null,
+                    LeadHeartbeatLoop.LeadContextSource.none(), contextHighNudge);
+            l.start();
+        } finally {
+            logger.detachAppender(appender);
+            logger.setLevel(originalLevel);
+        }
+        return appender.list.stream()
+                .filter(e -> e.getLevel() == Level.INFO)
+                .map(ILoggingEvent::getFormattedMessage)
+                .filter(m -> m.startsWith("idle-lead heartbeat:"))
+                .findFirst()
+                .orElseThrow(() -> new AssertionError("expected the heartbeat boot line to be logged"));
+    }
+
+    @Test
+    void theBootLineNamesContextHighNudgeWhenArmed() {
+        String line = heartbeatBootLine(true, scheduler);
+        assertTrue(line.contains("300s idle"), line);
+        assertTrue(line.contains("recheck 1000ms"), line);
+        assertTrue(line.contains("quiet cap 3"), line);
+        assertTrue(line.contains("context-high nudge true"),
+                "the boot line must name the 4th setting, contextHighNudge, alongside the other "
+                        + "three: " + line);
+    }
+
+    @Test
+    void theBootLineNamesContextHighNudgeWhenOff() {
+        String line = heartbeatBootLine(false, scheduler);
+        assertTrue(line.contains("context-high nudge false"), line);
+    }
+
     // ── (b) an idle lead within the quiet period is not yet injected ───────────────────────────
 
     @Test