fleetd #615: write FAILED instead of leaving status(token) stuck at IN_PROGRESS

LeadRollover.runRollover made two unwrapped agents.send calls. HerdrException
is unchecked, and the production continuationRunner is a bare virtual thread
with no uncaught-exception handler, so a throw from either send call killed
the continuation silently — confirm() had already written IN_PROGRESS into
outcomes before scheduling it, and nothing ever overwrote that entry with a
terminal state.

Wrap the whole continuation body in one try/catch(RuntimeException), matching
the local convention already used around agents.status in
waitUntilAtTurnBoundary. On a throw, write a new terminal RollState.FAILED
entry naming the exception, in the same diagnostic style as
TURN_NEVER_SETTLED and CLEAR_NEVER_SETTLED.

Two new tests make send() throw on the /clear call and on the bootstrap-text
call respectively, each asserting status(token) reports FAILED, not
IN_PROGRESS. Reverting only the production catch (keeping the tests) turns
both red; restoring it turns them green again.

fleetd/fleetd.example.yaml

@@ -209,13 +209,13 @@ herdrSocket: ~/.config/herdr/herdr.sock
 #                      e.g. `env DISPLAY=:10.0 idea {dir}`. Best-effort: a failure is logged, never
 #                      fails the spawn. Omit to open the member's module by hand. There is no close
 #                      half yet — an opened module stays open until the operator closes it.
-#   autoCompactWindow → opt-in, default off. A bounded token window that forces a launched Claude Code
-#                      lead or member to compact its context instead of running on the backend's own
-#                      default. A member that runs out of context can die mid-turn and lose its fleet_reply.
+#   autoCompactWindow → opt-in, default off. A bounded token window that forces a spawned member to
+#                      compact its context instead of running on the backend's own default and dying
+#                      mid-turn (losing its fleet_reply — the whole point of the turn — with it).
 #                      Validated at config load to [100000, 1000000] — the band Claude Code's own
 #                      --autocompact flag accepts.
 #                      CROSS-BACKEND SEMANTICS DIFFER: on claude-code this is a launch-time
-#                      `--autocompact <tokens>` flag — the Claude Code session compacts AT this window. opencode
+#                      `--autocompact <tokens>` flag — the member compacts AT this window. opencode
 #                      has no equivalent flag (it only forces `compaction.auto: true`, unconditionally,
 #                      already), so this is instead applied as the model's `limit.context` in the
 #                      generated opencode.json — the member compacts WITHIN this window, not exactly
@@ -415,7 +415,7 @@ profiles:
     # ideMcpUrl: http://127.0.0.1:29170/index-mcp/streamable-http   # opt-in (CB-634): IDE code intelligence, pinned to the worktree
     # ideProjectDir: fleetd          # CB-634: module dir the IDE opens + the overlay pins (this repo's pom is in fleetd/)
     # ideOpenCommand: env DISPLAY=:10.0 idea {dir}   # CB-634 auto-open: opens {dir} in the IDE at spawn; omit to open by hand
-    # autoCompactWindow: 250000   # opt-in: bound Claude Code lead/member context; claude-code compacts AT this, opencode within it (model limit.context)
+    # autoCompactWindow: 250000   # opt-in: bound member context; claude-code compacts AT this, opencode within it (model limit.context)
   gx11:                              # a second backend, so `placement: weighted` has a choice
     baseUrl: http://gx01.gw:8000     # self-hosted; ccs handles the model + token
     placement: tab

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -462,8 +462,8 @@ public record FleetConfig(
      *                       profile that does not opt in. Read live off the current config, so it is
      *                       HOT: a change takes effect on the next exhaustion classification / spawn,
      *                       no restart needed.
-     * @param autoCompactWindow  opt-in per-profile token window that forces a launched Claude Code
-     *                       session to auto-compact its context at, or an opencode session within, a bound the
+     * @param autoCompactWindow  opt-in per-profile token window that forces a spawned member to
+     *                       auto-compact its context at (Claude Code) or within (opencode) a bound the
      *                       operator chooses, instead of the backend's own default. {@code null} (the
      *                       default) leaves today's behaviour exactly — opencode already forces
      *                       {@code compaction.auto: true} unconditionally (CB-523) but has no absolute
@@ -1875,7 +1875,6 @@ public record FleetConfig(
             rejectDuplicateMemberSlots(yaml);
             rejectNegativeMaxLoad(yaml);
             rejectAutoCompactWindowOutOfRange(yaml);
-            warnConflictingAutoCompactWindows(yaml);
             rejectMalformedProfilePatterns(yaml);
             rejectUnknownKind(yaml);
             rejectUnknownAuthMode(yaml);
@@ -2226,71 +2225,6 @@ public record FleetConfig(
         }
     }
 
-    /**
-     * Warn (never refuse to start) about a Claude Code profile whose auto-compaction flag and
-     * environment setting disagree.
-     *
-     * <p>Renamed from {@code rejectConflictingAutoCompactWindows} (fleetd #601 review, measured
-     * 2026-09-22): that method threw {@link IllegalStateException}, so {@link #load(Path)} refused
-     * to start on a config carrying this conflict. On this host, four profiles trip it, including
-     * the lead's own profile and the one every worker spawns on — so the throw is not a rare edge
-     * case. Under launchd, a throw inside {@code load()} is a restart loop, not an error an operator
-     * reads once, and the config that would fix it ({@code fleetd/fleetd.yaml}) is gitignored, so
-     * the cause is invisible on the host where it bites. A WARN gives the operator the same
-     * information — which profiles, and now both values, so they can fix it without reading the
-     * source — without ever taking the fleet down.
-     *
-     * <p>Which of the two inputs Claude Code actually follows when they disagree is intentionally
-     * <em>not</em> asserted here. {@code ClaudeCodeArguments}'s javadoc used to state the
-     * environment variable always wins; nobody had measured that, and this host's own
-     * {@code fleetd.yaml} asserts the opposite in a comment. This method only detects and reports
-     * the disagreement — see {@link dev.ltms.fleet.launch.ClaudeCodeArguments}.
-     *
-     * <p>Equal values never warn: either input then produces the same session window, so there is
-     * nothing to reconcile.
-     */
-    static void warnConflictingAutoCompactWindows(String yaml) {
-        Map<?, ?> raw;
-        try {
-            raw = YAML.readValue(yaml, Map.class);
-        } catch (IOException | IllegalArgumentException e) {
-            return;
-        }
-        if (raw == null || !(raw.get("profiles") instanceof Map<?, ?> profiles)) {
-            return;
-        }
-        List<String> names = new ArrayList<>();
-        List<String> detail = new ArrayList<>();
-        for (Map.Entry<?, ?> entry : profiles.entrySet()) {
-            if (!(entry.getValue() instanceof Map<?, ?> profile)
-                    || !(profile.get("autoCompactWindow") instanceof Number window)
-                    || !(profile.get("env") instanceof Map<?, ?> env)
-                    || !env.containsKey("CLAUDE_CODE_AUTO_COMPACT_WINDOW")) {
-                continue;
-            }
-            Object kind = profile.get("kind");
-            boolean claudeCode = kind == null || String.valueOf(kind).isBlank()
-                    || Profile.KIND_CLAUDE_CODE.equalsIgnoreCase(String.valueOf(kind));
-            Object envValue = env.get("CLAUDE_CODE_AUTO_COMPACT_WINDOW");
-            if (claudeCode && !String.valueOf(window).equals(String.valueOf(envValue))) {
-                String name = String.valueOf(entry.getKey());
-                names.add(name);
-                detail.add(name + " (autoCompactWindow=" + window
-                        + ", env.CLAUDE_CODE_AUTO_COMPACT_WINDOW=" + envValue + ")");
-            }
-        }
-        if (names.isEmpty()) {
-            return;
-        }
-        names.sort(String::compareTo);
-        detail.sort(String::compareTo);
-        log.warn("Claude Code profile(s) {} set disagreeing autoCompactWindow and env."
-                        + "CLAUDE_CODE_AUTO_COMPACT_WINDOW — the daemon starts anyway. Fix by "
-                        + "removing one key or setting equal values on each: {}. Which input Claude "
-                        + "Code actually follows when they disagree is not verified here.",
-                names, String.join(", ", detail));
-    }
-
     /**
      * Reject a profile whose {@code errorPattern} (fleetd #201 Unit 5) or {@code exhaustedPattern}
      * (CB-578 stage A) is not a valid Java regex, naming the profile, the key, and the parser's own

fleetd/src/main/java/dev/ltms/fleet/launch/ClaudeCodeArguments.java

@@ -1,35 +0,0 @@
-package dev.ltms.fleet.launch;
-
-import dev.ltms.fleet.config.FleetConfig;
-
-import java.util.ArrayList;
-import java.util.List;
-
-/** Arguments shared by every fleetd path that starts Claude Code. */
-public final class ClaudeCodeArguments {
-
-    private ClaudeCodeArguments() {
-    }
-
-    /**
-     * Append the configured Claude Code auto-compaction window when the profile opts in.
-     *
-     * <p>This flag and the environment variable {@code CLAUDE_CODE_AUTO_COMPACT_WINDOW} can
-     * disagree. Which one Claude Code actually follows when they do is NOT verified here — this
-     * javadoc used to claim the environment variable always wins, but nobody had measured that, and
-     * this host's own {@code fleetd.yaml} asserts the opposite in a comment. So this javadoc no
-     * longer picks a side. {@link FleetConfig#load(java.nio.file.Path)} only WARNS when a Claude
-     * Code profile sets both to different values (see {@code
-     * FleetConfig.warnConflictingAutoCompactWindows}) — it does not stop the daemon from starting,
-     * and a launched session may end up honouring either window.
-     */
-    public static List<String> withAutoCompactWindow(List<String> argv, FleetConfig.Profile profile) {
-        if (profile.autoCompactWindow() == null) {
-            return argv;
-        }
-        List<String> withAutoCompact = new ArrayList<>(argv);
-        withAutoCompact.add("--autocompact");
-        withAutoCompact.add(String.valueOf(profile.autoCompactWindow()));
-        return withAutoCompact;
-    }
-}

fleetd/src/main/java/dev/ltms/fleet/lead/LeadLauncher.java

@@ -8,7 +8,6 @@ import dev.ltms.fleet.herdr.PendingCloseMarker;
 import dev.ltms.fleet.herdr.Tab;
 import dev.ltms.fleet.herdr.Workspace;
 import dev.ltms.fleet.herdr.WorkspaceControl;
-import dev.ltms.fleet.launch.ClaudeCodeArguments;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -359,8 +358,7 @@ public final class LeadLauncher {
     }
 
     /**
-     * The lead's argv: the profile's own command, the model and auto-compaction pins, and the bridge
-     * MCP mount.
+     * The lead's argv: the profile's own command, the model pin, and the bridge MCP mount.
      *
      * <p>No {@code --append-system-prompt}. That flag carries the worker reply charter, and a lead
      * is not a worker — it reads its orchestration rules from the project's {@code CLAUDE.md} like
@@ -382,7 +380,7 @@ public final class LeadLauncher {
             argv.add("--model");
             argv.add(profile.model());
         }
-        return profile.isOpenCode() ? argv : ClaudeCodeArguments.withAutoCompactWindow(argv, profile);
+        return argv;
     }
 
     /**

fleetd/src/main/java/dev/ltms/fleet/lead/LeadRollover.java

@@ -231,7 +231,9 @@ public final class LeadRollover {
          * #status} could wrongly answer {@link #UNKNOWN} ("nothing was ever requested") for a roll
          * that is, in fact, actively running. This is not sticky: the deferred continuation
          * overwrites this same entry with a terminal state ({@link #ROLLED}, {@link
-         * #TURN_NEVER_SETTLED}, or {@link #CLEAR_NEVER_SETTLED}) once it finishes.
+         * #TURN_NEVER_SETTLED}, {@link #CLEAR_NEVER_SETTLED}, or {@link #FAILED}) once it finishes
+         * — including by throwing, which fleetd #615's catch in {@link #runRollover} now turns into
+         * {@link #FAILED} instead of leaving this entry stuck forever.
          */
         IN_PROGRESS,
         /**
@@ -253,6 +255,19 @@ public final class LeadRollover {
          * within {@code clearSettleSeconds} — {@code bootstrapText} was never sent.
          */
         CLEAR_NEVER_SETTLED,
+        /**
+         * fleetd #615: the deferred continuation threw a {@link RuntimeException} — most likely a
+         * {@link dev.ltms.fleet.herdr.HerdrException} out of one of the two unwrapped {@code
+         * agents.send} calls in {@link #runRollover} — and the continuation thread died with it.
+         * Before this state existed, that throw left {@link #outcomes} holding {@link #IN_PROGRESS}
+         * forever, because the production {@code continuationRunner} is a bare virtual thread with
+         * no uncaught-exception handler and nothing downstream of the throw ever ran to write a
+         * terminal outcome. {@code detail} names the exception, so a reader has something to act on
+         * — the same diagnostic style as {@link #TURN_NEVER_SETTLED} and {@link
+         * #CLEAR_NEVER_SETTLED}. The roll is dead at this point and does not retry itself; a stuck
+         * lead must {@link #open} a fresh request.
+         */
+        FAILED,
         /**
          * {@code token} names nothing this instance currently knows about: never issued by {@link
          * #open}, dropped by {@link #cancel}, or aged out of {@link #outcomes}'s bounded history.
@@ -493,8 +508,42 @@ public final class LeadRollover {
      * entirely after {@link #confirm} has returned to its caller — see this class's javadoc for the
      * four-step order. There is no result to return to by this point, so every outcome is logged
      * only.
+     *
+     * <p><strong>fleetd #615 — the whole body is wrapped in one {@code try}.</strong> The two {@code
+     * agents.send} calls below are not wrapped individually: {@code send} → {@code agentCall} →
+     * {@code herdr.call} can throw an unchecked {@link dev.ltms.fleet.herdr.HerdrException} (see
+     * {@code AgentControl.java}), and the production {@code continuationRunner} is a bare virtual
+     * thread with no uncaught-exception handler (see this class's public constructor). Before this
+     * fix, either throw killed the continuation thread silently, leaving the {@link
+     * RollState#IN_PROGRESS} entry {@link #confirm} wrote at hand-off stuck forever — {@link
+     * #status} had no way to tell a dead roll from one still genuinely running. The {@code catch}
+     * below is scoped to the method body rather than to each {@code send} call individually, so it
+     * also covers anything else added to this continuation later, not just today's two call sites —
+     * the same reasoning that put the write-a-terminal-outcome step at each of this method's other
+     * exits (see the {@link RollState#TURN_NEVER_SETTLED} and {@link RollState#CLEAR_NEVER_SETTLED}
+     * branches below) rather than inside the helpers that detect them.</p>
+     *
+     * <p>Only {@link RuntimeException} is caught, matching the local convention {@link
+     * #waitUntilAtTurnBoundary} already set around its own {@code agents.status} call — not the
+     * broader {@link Exception} or {@link Throwable}, which would also swallow something like an
+     * {@link OutOfMemoryError} this continuation has no business handling.</p>
      */
     private void runRollover(PendingRollover p, FleetConfig.LeadRollover cfg) {
+        try {
+            runRolloverUnguarded(p, cfg);
+        } catch (RuntimeException e) {
+            log.warn("lead-rollover: continuation for token={} lead={} threw {} — the roll is dead; "
+                            + "no further step in this continuation will run",
+                    p.token(), p.leadTerminal(), e.toString(), e);
+            outcomes.put(p.token(), new RollStatus(RollState.FAILED,
+                    "the roll's continuation threw " + e.toString() + " — the roll is dead and will "
+                            + "not retry itself; check the daemon log for the stack trace, then open() "
+                            + "a fresh rollover request"));
+        }
+    }
+
+    /** The actual body of {@link #runRollover}, unwrapped — see that method's javadoc for the catch. */
+    private void runRolloverUnguarded(PendingRollover p, FleetConfig.LeadRollover cfg) {
         String lead = p.leadTerminal();
         long rollStartMillis = nowMillis.getAsLong();
         TurnSettleResult turnResult = waitUntilAtTurnBoundary(lead, cfg.turnSettleSeconds());

fleetd/src/main/java/dev/ltms/fleet/member/ClaudeCodeLauncher.java

@@ -8,7 +8,6 @@ import dev.ltms.fleet.guard.SubscriptionGuard;
 import dev.ltms.fleet.herdr.Agent;
 import dev.ltms.fleet.herdr.AgentControl;
 import dev.ltms.fleet.herdr.WorkspaceControl;
-import dev.ltms.fleet.launch.ClaudeCodeArguments;
 import dev.ltms.fleet.peer.Capability;
 import dev.ltms.fleet.peer.PeerLauncher;
 import org.slf4j.Logger;
@@ -299,7 +298,7 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
         // has neither MCP nor a charter — session flags must be added into a list we own.
         List<String> argv = mutableArgv(argvWithFleet(cfg, spec));
         String agentSessionId = applySessionIdentity(argv, spec.sessionName(), spec.resumeSessionId());
-        return new Launch(workerEnv, ClaudeCodeArguments.withAutoCompactWindow(argvWithModel(argv, cfg), cfg), agentSessionId);
+        return new Launch(workerEnv, argvWithAutoCompact(argvWithModel(argv, cfg), cfg), agentSessionId);
     }
 
     /**
@@ -909,6 +908,30 @@ public final class ClaudeCodeLauncher extends HerdrPeerLauncher {
         return withModel;
     }
 
+    /**
+     * Pin a bounded auto-compaction window on the command line via {@code --autocompact <tokens>},
+     * opt-in per profile (CB-634's sibling ticket: a member that runs out of context dies mid-turn
+     * and its {@code fleet_reply} — the whole point of the turn — is lost with it; opencode already
+     * forces {@code compaction.auto: true} unconditionally, CB-523, but Claude Code has no equivalent
+     * and runs at the backend's own default window).
+     *
+     * <p>Mirrors {@link #argvWithModel}: appended after it, so it survives the {@code ccs <profile>}
+     * wrapper the same way {@code --model} does, and outranks env/settings and the operator's own
+     * {@code argv}. Verified: {@code claude 2.1.241 --help} lists {@code --autocompact <auto|tokens>}
+     * (either the literal {@code auto}, or an integer 100k–1M) — {@link FleetConfig#load} rejects a
+     * configured value outside that band before this ever runs, so the flag Claude Code receives here
+     * is always in range.
+     */
+    private static List<String> argvWithAutoCompact(List<String> argv, FleetConfig.Profile cfg) {
+        if (cfg.autoCompactWindow() == null) {
+            return argv;
+        }
+        List<String> withAutoCompact = mutableArgv(argv);
+        withAutoCompact.add("--autocompact");
+        withAutoCompact.add(String.valueOf(cfg.autoCompactWindow()));
+        return withAutoCompact;
+    }
+
     // --- Agent-returning convenience spawns (used by callers/tests that want the herdr Agent) ---
 
     /** Spawn a worker for the default profile in the resolved default cwd. */

fleetd/src/test/java/dev/ltms/fleet/config/FleetConfigTest.java

@@ -1,11 +1,8 @@
 package dev.ltms.fleet.config;
 
-import ch.qos.logback.classic.Level;
-import ch.qos.logback.classic.spi.ILoggingEvent;
 import dev.ltms.fleet.auth.MemberRegistry;
 import dev.ltms.fleet.msg.LeadMailbox;
 import dev.ltms.fleet.peer.MemberRole;
-import dev.ltms.fleet.testing.CapturedLog;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
 
@@ -96,72 +93,6 @@ class FleetConfigTest {
                 "unset means off — today's behaviour, unchanged");
     }
 
-    /**
-     * fleetd #601 review (measured 2026-09-22): this guard used to throw {@link
-     * IllegalStateException} and refuse to start. On a host with the conflict configured, that
-     * turned into a launchd restart loop with no readable cause, since {@code fleetd.yaml} is
-     * gitignored. It must now WARN and let the daemon start, and the warning must carry both values
-     * so an operator can fix the config without reading the source. Pinning the log line itself (via
-     * {@link CapturedLog}) rather than a snippet of production source text — the latter is the
-     * anti-pattern this repo avoids; the former is the actual observable behaviour a reader (or an
-     * alert on the log) depends on.
-     */
-    @Test
-    void aClaudeProfileWithConflictingAutoCompactFlagAndEnvironmentWindowLoadsAndWarnsWithBothValues(
-            @TempDir Path dir) throws Exception {
-        Path f = dir.resolve("conflicting-auto-compact-window.yaml");
-        Files.writeString(f, """
-                profiles:
-                  claude-profile:
-                    autoCompactWindow: 250000
-                    env:
-                      CLAUDE_CODE_AUTO_COMPACT_WINDOW: "300000"
-                """);
-
-        FleetConfig cfg;
-        List<String> warnings;
-        try (CapturedLog log = CapturedLog.at(FleetConfig.class, Level.WARN)) {
-            cfg = FleetConfig.load(f);
-            warnings = log.events().stream().map(ILoggingEvent::getFormattedMessage).toList();
-        }
-
-        assertEquals(250_000, cfg.profiles().get("claude-profile").autoCompactWindow(),
-                "the disagreement is reported, not corrected — the flag value still loads as-is");
-        assertEquals(1, warnings.size(), "exactly one warning for the one conflicting profile: " + warnings);
-        String warning = warnings.get(0);
-        assertTrue(warning.contains("claude-profile"), "names the offending profile: " + warning);
-        assertTrue(warning.contains("autoCompactWindow=250000"), "names the flag value: " + warning);
-        assertTrue(warning.contains("CLAUDE_CODE_AUTO_COMPACT_WINDOW=300000"), "names the env value: " + warning);
-    }
-
-    /**
-     * The negative probe paired with the test above (per fleetd #601 review): a warning that fires
-     * on every load and a warning that never fires read the same from a single test, so both must be
-     * checked. No conflict here — the flag and the env value agree — so no warning should be logged.
-     */
-    @Test
-    void aClaudeProfileWithEqualAutoCompactFlagAndEnvironmentWindowLoadsWithNoWarning(@TempDir Path dir)
-            throws Exception {
-        Path f = dir.resolve("equal-auto-compact-window.yaml");
-        Files.writeString(f, """
-                profiles:
-                  claude-profile:
-                    autoCompactWindow: 250000
-                    env:
-                      CLAUDE_CODE_AUTO_COMPACT_WINDOW: "250000"
-                """);
-
-        FleetConfig cfg;
-        List<ILoggingEvent> events;
-        try (CapturedLog log = CapturedLog.at(FleetConfig.class, Level.WARN)) {
-            cfg = FleetConfig.load(f);
-            events = log.events();
-        }
-
-        assertEquals(250_000, cfg.profiles().get("claude-profile").autoCompactWindow());
-        assertTrue(events.isEmpty(), "equal values must not warn: " + events);
-    }
-
     // ── fleetd #201 Unit 5: errorPattern ────────────────────────────────────────────────────────
 
     @Test

fleetd/src/test/java/dev/ltms/fleet/lead/LeadLauncherTest.java

@@ -32,26 +32,13 @@ class LeadLauncherTest {
                 Map.of("CLAUDE_CODE_AUTO_COMPACT_WINDOW", "300000"), null, null, true, null);
     }
 
-    private static FleetConfig.Profile profileWithAutoCompactWindow(String kind) {
-        return new FleetConfig.Profile(
-                "opus", null, "claude-opus-5", null, "FLEETD_WORKER_TOKEN",
-                List.of("ccs", "ltms"), "tab", "fleet", null,
-                "http://127.0.0.1:8765/mcp", null, null,
-                null, null, kind, Map.of(), null, null, true, null, null,
-                null, null, null, 250_000);
-    }
-
     private static FleetConfig configWith(FleetConfig.Leader lead) {
-        return configWith(lead, opusProfile());
-    }
-
-    private static FleetConfig configWith(FleetConfig.Leader lead, FleetConfig.Profile profile) {
         Map<String, FleetConfig.Leader> leaders = new LinkedHashMap<>();
         leaders.put("opus", lead);
         FleetConfig.Fleet fleet =
                 new FleetConfig.Fleet(leaders, Map.of(), Map.of(), Map.of(), null);
         return new FleetConfig(
-                null, null, Map.of("opus", profile), null, null, null, null, null,
+                null, null, Map.of("opus", opusProfile()), null, null, null, null, null,
                 null, null, fleet, null, "fixed", null).withDefaults();
     }
 
@@ -343,36 +330,6 @@ class LeadLauncherTest {
                 "--model is appended last so it outranks the ccs wrapper (CB-533)");
     }
 
-    @Test
-    void aClaudeLeadPassesItsConfiguredAutoCompactWindowToClaudeCode() {
-        FakeHerdr herdr = new FakeHerdr();
-        FleetConfig.Profile profile = profileWithAutoCompactWindow("claude-code");
-
-        launcher(herdr, configWith(lead("opus", "lead: opus", 1), profile)).ensureLeads();
-
-        List<String> args = startedArgs(herdr);
-        assertEquals("250000", args.get(args.indexOf("--autocompact") + 1));
-    }
-
-    @Test
-    void aClaudeLeadWithNoAutoCompactWindowGetsNoAutoCompactFlag() {
-        FakeHerdr herdr = new FakeHerdr();
-
-        launcher(herdr, configWith(lead("opus", "lead: opus", 1))).ensureLeads();
-
-        assertFalse(startedArgs(herdr).contains("--autocompact"));
-    }
-
-    @Test
-    void aNonClaudeLeadDoesNotGetAnAutoCompactFlag() {
-        FakeHerdr herdr = new FakeHerdr();
-        FleetConfig.Profile profile = profileWithAutoCompactWindow("opencode");
-
-        launcher(herdr, configWith(lead("opus", "lead: opus", 1), profile)).ensureLeads();
-
-        assertFalse(startedArgs(herdr).contains("--autocompact"));
-    }
-
     /** A lead runs on the operator's subscription. Nothing may move it off. */
     @Test
     void theLeadEnvCarriesNoAnthropicBinding() {

fleetd/src/test/java/dev/ltms/fleet/lead/LeadRolloverTest.java

@@ -1359,4 +1359,92 @@ class LeadRolloverTest {
                     + "it were the measured wait duration: " + message);
         }
     }
+
+    // ---- fleetd #615: a HerdrException out of either unwrapped agents.send call must leave a ----
+    // ---- TERMINAL FAILED outcome, never a stuck IN_PROGRESS ---------------------------------------
+
+    @Test
+    @DisplayName("[fleetd #615 — 1] send() throwing on the /clear call leaves status(token) "
+            + "reporting FAILED, not stuck at IN_PROGRESS")
+    void sendThrowingOnClearLeavesStatusReportingFailed() throws IOException {
+        FakeHerdr fake = new FakeHerdr(); // default idle — the turn-settle wait passes immediately
+        HerdrClient throwsOnClear = new HerdrClient() {
+            @Override
+            public JsonNode call(String method, Object params) throws HerdrException {
+                if ("agent.prompt".equals(method) && String.valueOf(params).contains("/clear")) {
+                    throw new HerdrException("simulated herdr transport failure sending /clear");
+                }
+                return fake.call(method, params);
+            }
+
+            @Override
+            public void close() {
+                fake.close();
+            }
+        };
+        Path handover = writeHandover("handover contents");
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(throwsOnClear, cfg(handover.toString()), fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertTrue(decision.accepted(), "every synchronous gate passes; the throw happens only "
+                + "inside the deferred continuation, which this test's synchronous runner has "
+                + "already run to completion by the time confirm() returns");
+
+        LeadRollover.RollStatus status = rollover.status(pending.token());
+        assertEquals(LeadRollover.RollState.FAILED, status.state(),
+                "a HerdrException out of the /clear send must leave a TERMINAL FAILED outcome — "
+                        + "before fleetd #615's fix, the continuation thread died silently and "
+                        + "status() was stuck reporting the IN_PROGRESS confirm() wrote at hand-off, "
+                        + "forever: got " + status.state() + " / " + status.detail());
+        assertNotEquals(LeadRollover.RollState.IN_PROGRESS, status.state());
+        assertTrue(status.detail().contains("HerdrException"), "the detail must name the exception "
+                + "so an operator reading status() has something to act on: " + status.detail());
+    }
+
+    @Test
+    @DisplayName("[fleetd #615 — 2] send() throwing on the bootstrap-text call (after /clear "
+            + "succeeded and the pane settled) also leaves status(token) reporting FAILED — a "
+            + "DIFFERENT exit from the /clear-throw case above")
+    void sendThrowingOnBootstrapTextLeavesStatusReportingFailed() throws IOException {
+        FakeHerdr fake = new FakeHerdr(); // default idle throughout — both settle waits pass promptly
+        HerdrClient throwsOnBootstrapText = new HerdrClient() {
+            @Override
+            public JsonNode call(String method, Object params) throws HerdrException {
+                if ("agent.prompt".equals(method) && String.valueOf(params).contains("read the handover file")) {
+                    throw new HerdrException("simulated herdr transport failure sending bootstrapText");
+                }
+                return fake.call(method, params);
+            }
+
+            @Override
+            public void close() {
+                fake.close();
+            }
+        };
+        Path handover = writeHandover("handover contents");
+        AtomicLong clock = new AtomicLong(1_000);
+        LeadRollover rollover = newRollover(throwsOnBootstrapText, cfg(handover.toString()), fixedClock(clock));
+
+        LeadRollover.PendingRollover pending = rollover.open(LEAD, "context is full");
+        LeadRollover.RollDecision decision = rollover.confirm(LEAD, pending.token(), true);
+
+        assertTrue(decision.accepted(), "every synchronous gate passes; the throw happens only "
+                + "inside the deferred continuation, which this test's synchronous runner has "
+                + "already run to completion by the time confirm() returns");
+        assertEquals(1, promptCallCount(fake), "sanity: /clear was sent and settled — only the "
+                + "SECOND agent.prompt call (bootstrapText) threw");
+
+        LeadRollover.RollStatus status = rollover.status(pending.token());
+        assertEquals(LeadRollover.RollState.FAILED, status.state(),
+                "a HerdrException out of the bootstrapText send — a DIFFERENT exit from the /clear "
+                        + "throw, reached only after /clear already succeeded and the pane already "
+                        + "settled — must also leave a TERMINAL FAILED outcome, not a stuck "
+                        + "IN_PROGRESS: got " + status.state() + " / " + status.detail());
+        assertNotEquals(LeadRollover.RollState.IN_PROGRESS, status.state());
+        assertTrue(status.detail().contains("HerdrException"), "the detail must name the exception "
+                + "so an operator reading status() has something to act on: " + status.detail());
+    }
 }