@link-assistant/hive-mind 2.10.4 → 2.10.5

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @link-assistant/hive-mind
 
+## 2.10.5
+
+### Patch Changes
+
+- 9772498: Stop reporting successful docker work sessions as failed. start-command can fabricate a detached-docker exit code from any `Exit Code: N` text the command itself printed (link-foundation/start#150), so the session monitor now trusts its own anchored log footer over `$ --status` and defers an uncorroborated docker failure for up to 60 seconds until the real footer is written.
+
 ## 2.10.4
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@link-assistant/hive-mind",
-  "version": "2.10.4",
+  "version": "2.10.5",
   "description": "AI-powered issue solver and hive mind for collaborative problem solving",
   "main": "src/hive.mjs",
   "type": "module",

package/src/exit-handler.lib.mjs

@@ -244,11 +244,22 @@ export const logActiveHandles = async (log = null) => {
  *   guidance for the pre-exit notifier.
  */
 export const safeExit = async (code = 0, reason = 'Process completed', { skipPreExit = false, failureActionSection = null } = {}) => {
-  await showExitMessage(reason, code);
+  // Issue #2117: every best-effort step below is diagnostic housekeeping. It may
+  // fail, but it must never change the exit code the caller asked for — neither
+  // by masking a failure nor by turning a success into an uncaught exception.
+  try {
+    await showExitMessage(reason, code);
+  } catch (error) {
+    console.warn(`⚠️  Could not show exit message: ${error?.message || error}`);
+  }
 
   // Issue #2090: collect the working session that is still uncollected (and the
   // log tail produced after it) before the process goes away.
-  await finalizeActiveDevelopmentLog({ force: true });
+  try {
+    await finalizeActiveDevelopmentLog({ force: true });
+  } catch {
+    // Best-effort finalization must never change the selected process exit.
+  }
 
   if (!skipPreExit && code !== 0 && preExitFunction && !preExitHandlerRan) {
     preExitHandlerRan = true;
@@ -267,7 +278,11 @@ export const safeExit = async (code = 0, reason = 'Process completed', { skipPre
   // Issue #1431: Drain/unref active handles so the event loop exits naturally.
   // This resolves the root causes of dangling ReadStream (stdin), Socket (undici),
   // ChildProcess (command-stream), and WriteStream (stdout/stderr) handles.
-  await drainHandles();
+  try {
+    await drainHandles();
+  } catch {
+    // Best-effort handle draining must never change the selected process exit.
+  }
 
   // Close Sentry to flush any pending events and allow the process to exit cleanly.
   // Use Promise.race with a hard timeout to guarantee sentry.close() never hangs
@@ -291,7 +306,7 @@ export const safeExit = async (code = 0, reason = 'Process completed', { skipPre
 /**
  * Install global exit handlers to ensure log path is always shown
  */
-export const installGlobalExitHandlers = () => {
+export const installGlobalExitHandlers = ({ handleProcessErrors = true } = {}) => {
   // Handle normal exit
   process.on('exit', code => {
     // Synchronous fallback - can't use async here
@@ -427,53 +442,55 @@ export const installGlobalExitHandlers = () => {
     process.exit(143);
   });
 
-  // Handle uncaught exceptions
-  process.on('uncaughtException', async error => {
-    if (cleanupFunction) {
+  if (handleProcessErrors) {
+    // Handle uncaught exceptions
+    process.on('uncaughtException', async error => {
+      if (cleanupFunction) {
+        try {
+          await cleanupFunction();
+        } catch {
+          // Ignore cleanup errors on exception
+        }
+      }
+      if (logFunction) {
+        await logFunction(`\n❌ Uncaught Exception: ${error.message}`, { level: 'error' });
+      }
+      await showExitMessage('Uncaught exception occurred', 1);
       try {
-        await cleanupFunction();
+        const sentry = await getSentry();
+        if (sentry && sentry.close) {
+          await Promise.race([sentry.close(2000), new Promise(resolve => setTimeout(resolve, 3000))]);
+        }
       } catch {
-        // Ignore cleanup errors on exception
+        // Ignore Sentry.close() errors
       }
-    }
-    if (logFunction) {
-      await logFunction(`\n❌ Uncaught Exception: ${error.message}`, { level: 'error' });
-    }
-    await showExitMessage('Uncaught exception occurred', 1);
-    try {
-      const sentry = await getSentry();
-      if (sentry && sentry.close) {
-        await Promise.race([sentry.close(2000), new Promise(resolve => setTimeout(resolve, 3000))]);
-      }
-    } catch {
-      // Ignore Sentry.close() errors
-    }
-    process.exit(1);
-  });
+      process.exit(1);
+    });
 
-  // Handle unhandled rejections
-  process.on('unhandledRejection', async reason => {
-    if (cleanupFunction) {
+    // Handle unhandled rejections
+    process.on('unhandledRejection', async reason => {
+      if (cleanupFunction) {
+        try {
+          await cleanupFunction();
+        } catch {
+          // Ignore cleanup errors on rejection
+        }
+      }
+      if (logFunction) {
+        await logFunction(`\n❌ Unhandled Rejection: ${reason}`, { level: 'error' });
+      }
+      await showExitMessage('Unhandled rejection occurred', 1);
       try {
-        await cleanupFunction();
+        const sentry = await getSentry();
+        if (sentry && sentry.close) {
+          await Promise.race([sentry.close(2000), new Promise(resolve => setTimeout(resolve, 3000))]);
+        }
       } catch {
-        // Ignore cleanup errors on rejection
-      }
-    }
-    if (logFunction) {
-      await logFunction(`\n❌ Unhandled Rejection: ${reason}`, { level: 'error' });
-    }
-    await showExitMessage('Unhandled rejection occurred', 1);
-    try {
-      const sentry = await getSentry();
-      if (sentry && sentry.close) {
-        await Promise.race([sentry.close(2000), new Promise(resolve => setTimeout(resolve, 3000))]);
+        // Ignore Sentry.close() errors
       }
-    } catch {
-      // Ignore Sentry.close() errors
-    }
-    process.exit(1);
-  });
+      process.exit(1);
+    });
+  }
 };
 
 /**

package/src/github-pr-state.lib.mjs

@@ -0,0 +1,56 @@
+import { execGhWithRetry } from './github-rate-limit.lib.mjs';
+
+/**
+ * Resolve the externally visible state of a GitHub pull request.
+ *
+ * A strict URL parser keeps the command limited to GitHub owner/repo/PR
+ * identifiers. The REST response exposes `merged` and `merged_at`, which are
+ * stronger evidence of goal completion than the detached runner's exit code.
+ *
+ * @param {string|null} pullRequestUrl
+ * @param {Object} [options]
+ * @param {Function} [options.lookupPullRequestState] - Test/application override
+ * @param {boolean} [options.verbose]
+ * @returns {Promise<{merged:boolean, mergedAt:string|null, state:string|null}|null>}
+ */
+export async function resolvePullRequestState(pullRequestUrl, { lookupPullRequestState = null, verbose = false } = {}) {
+  if (!pullRequestUrl) return null;
+  if (typeof lookupPullRequestState === 'function') {
+    return (await lookupPullRequestState(pullRequestUrl)) || null;
+  }
+
+  const match = String(pullRequestUrl).match(/^https:\/\/github\.com\/([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)\/pull\/(\d+)(?:[/?#].*)?$/i);
+  if (!match) {
+    if (verbose) console.log(`[VERBOSE] Cannot resolve PR state for unrecognized URL: ${pullRequestUrl}`);
+    return null;
+  }
+
+  const [, owner, repo, number] = match;
+  try {
+    const { stdout } = await execGhWithRetry(`gh api repos/${owner}/${repo}/pulls/${number} --jq '{merged: .merged, mergedAt: .merged_at, state: .state}'`, {
+      execOptions: {
+        encoding: 'utf8',
+        maxBuffer: 1024 * 1024,
+      },
+      label: `gh api pull request state (${owner}/${repo}#${number})`,
+    });
+    const state = JSON.parse(stdout);
+    return {
+      merged: state?.merged === true,
+      mergedAt: state?.mergedAt || null,
+      state: state?.state || null,
+    };
+  } catch (error) {
+    if (verbose) console.log(`[VERBOSE] Pull request state lookup failed for ${pullRequestUrl}: ${error?.message || error}`);
+    return null;
+  }
+}
+
+export async function resolveFailedSessionPullRequestState({ pullRequestUrl, outcome, lookupPullRequestState = null, verbose = false, sessionName = 'unknown', exitCode = null, status = null, logPath = null } = {}) {
+  if (!outcome?.failed || outcome.killed || !pullRequestUrl) return null;
+  const state = await resolvePullRequestState(pullRequestUrl, { lookupPullRequestState, verbose });
+  if (verbose && state) {
+    console.log(`[VERBOSE] Completion evidence for ${sessionName}: exitCode=${exitCode}, status=${status || 'unknown'}, pullRequest=${pullRequestUrl}, merged=${state.merged}, mergedAt=${state.mergedAt || 'unknown'}, logPath=${logPath || 'unknown'}`);
+  }
+  return state;
+}

package/src/locales/en.lino

@@ -649,6 +649,9 @@ en
         executing "⏳ Executing..."
         finished "Work session finished successfully"
         failed "Work session failed (exit code: {{exitCode}})"
+        merged_but_failed "Pull request merged, but the work session exited with code: {{exitCode}}"
+        merged_success "The requested pull request was merged successfully."
+        runner_also_failed "The runner also failed; its exit code is preserved for investigation."
         killed "Work session {{reason}}{{exitSuffix}}"
         stopped "Work session stopped by user{{requestedBy}}{{exitSuffix}}"
     duration

package/src/locales/hi.lino

@@ -649,6 +649,9 @@ hi
         executing "⏳ चल रहा है..."
         finished "कार्य सत्र सफलतापूर्वक पूरा हुआ"
         failed "कार्य सत्र विफल हुआ (exit code: {{exitCode}})"
+        merged_but_failed "पुल अनुरोध मर्ज हो गया, लेकिन कार्य सत्र कोड {{exitCode}} के साथ समाप्त हुआ"
+        merged_success "अनुरोधित पुल अनुरोध सफलतापूर्वक मर्ज हो गया।"
+        runner_also_failed "रनर भी विफल हुआ; जाँच के लिए उसका exit code सुरक्षित रखा गया है।"
         killed "कार्य सत्र रोका गया: {{reason}}{{exitSuffix}}"
         stopped "कार्य सत्र उपयोगकर्ता द्वारा रोका गया{{requestedBy}}{{exitSuffix}}"
     duration

package/src/locales/ru.lino

@@ -649,6 +649,9 @@ ru
         executing "⏳ Выполняется..."
         finished "Рабочий сеанс успешно завершен"
         failed "Рабочий сеанс завершился с ошибкой (код выхода: {{exitCode}})"
+        merged_but_failed "Пул-реквест объединён, но рабочий сеанс завершился с кодом: {{exitCode}}"
+        merged_success "Запрошенный пул-реквест успешно объединён."
+        runner_also_failed "Средство запуска также завершилось с ошибкой; код выхода сохранён для расследования."
         killed "Рабочий сеанс остановлен: {{reason}}{{exitSuffix}}"
         stopped "Рабочий сеанс остановлен пользователем{{requestedBy}}{{exitSuffix}}"
     duration

package/src/locales/zh.lino

@@ -649,6 +649,9 @@ zh
         executing "⏳ 正在执行..."
         finished "工作会话已成功完成"
         failed "工作会话失败（退出代码：{{exitCode}}）"
+        merged_but_failed "拉取请求已合并，但工作会话退出，代码为：{{exitCode}}"
+        merged_success "请求的拉取请求已成功合并。"
+        runner_also_failed "运行器也失败了；其退出代码已保留以供调查。"
         killed "工作会话已终止：{{reason}}{{exitSuffix}}"
         stopped "工作会话已由用户停止{{requestedBy}}{{exitSuffix}}"
     duration

package/src/session-monitor.docker-terminal.lib.mjs

@@ -0,0 +1,118 @@
+/**
+ * Issue #2117: guard against a *fabricated* terminal exit code for detached
+ * docker sessions.
+ *
+ * start-command derives the exit code of a detached docker session from an
+ * unanchored `Exit Code: N` scan over the whole execution log
+ * (`status-formatter.js#readExitCodeFromLog`), so any text the wrapped command
+ * prints — for example an AI agent echoing the tail of an older execution log —
+ * can be mistaken for the terminal footer. That is exactly how a `/solve` run
+ * that merged its pull request and exited 0 was announced as "Work session
+ * failed (exit code: 1)": the fabricated code entered the log 21 minutes before
+ * the command finished, and `$ --status` stamped the record with it the moment
+ * the container stopped — about two seconds before the real footer
+ * (`Exit Code: 0`) was appended by start-command's detached-docker watcher.
+ *
+ * The watcher always appends that footer right after the container exits, so a
+ * short deferral is enough for the authoritative value to appear. If it never
+ * does (e.g. the watcher itself was killed), the reported status is accepted
+ * once the grace period expires, preserving the previous behaviour: a real
+ * failure is still reported, just a minute later.
+ *
+ * @see https://github.com/link-assistant/hive-mind/issues/2117
+ * @see https://github.com/link-foundation/start/issues/150
+ */
+
+/** How long an uncorroborated docker terminal failure stays provisional. */
+export const DOCKER_TERMINAL_FOOTER_GRACE_MS = 60 * 1000;
+
+/** Session-snapshot field holding the first sighting of such a status. */
+export const DOCKER_TERMINAL_UNVERIFIED_FIRST_SEEN_FIELD = 'dockerTerminalUnverifiedFirstSeenAt';
+
+/**
+ * Whether the reported end of the session is recent enough for the fabrication
+ * race to still be open.
+ *
+ * start-command only invents a terminal result for a record it still has stored
+ * as `executing`, and it stamps that invention with `endTime = new Date()`
+ * (`status-formatter.js#enrichDetachedStatus`) — so a fabricated failure always
+ * looks like it ended just now, no matter how long ago the container really
+ * stopped. A record that reports an end time older than the grace period, on the
+ * other hand, has had all the time it needed for the footer to be written;
+ * deferring it would only postpone a real failure notification.
+ *
+ * @param {string|Date|null|undefined} endTime - End time from the status record.
+ * @param {number} nowMs - Current epoch milliseconds.
+ * @returns {boolean} True when the race cannot be ruled out.
+ */
+function terminalClaimIsRecent(endTime, nowMs) {
+  if (!endTime) return true; // No timestamp at all: the race cannot be ruled out.
+  const endMs = endTime instanceof Date ? endTime.getTime() : new Date(endTime).getTime();
+  if (!Number.isFinite(endMs)) return true;
+  return nowMs - endMs < DOCKER_TERMINAL_FOOTER_GRACE_MS;
+}
+
+/**
+ * Drop the deferral marker once the session's outcome is resolved (footer
+ * written, session running again, or the status accepted).
+ *
+ * @param {object|null|undefined} sessionInfo - Tracked session snapshot (mutated).
+ * @param {function} persistSnapshot - Callback persisting the updated snapshot.
+ */
+export function clearUnverifiedDockerTerminalMarker(sessionInfo, persistSnapshot) {
+  if (!sessionInfo?.[DOCKER_TERMINAL_UNVERIFIED_FIRST_SEEN_FIELD]) return;
+  delete sessionInfo[DOCKER_TERMINAL_UNVERIFIED_FIRST_SEEN_FIELD];
+  persistSnapshot();
+}
+
+/**
+ * Decide whether a docker terminal *failure* status that the log footer does not
+ * corroborate should be deferred (treated as still running) for now. The first
+ * sighting is persisted so the deferral survives a bot restart and cannot be
+ * reset forever by repeated polling.
+ *
+ * @param {string} sessionName - Session identifier, for verbose output only.
+ * @param {object|null|undefined} sessionInfo - Tracked session snapshot (mutated).
+ * @param {object} options
+ * @param {number|null} options.exitCode - Exit code `$ --status` reported.
+ * @param {string|Date|null} [options.endTime] - End time the status record reports.
+ * @param {boolean} options.verbose - Whether to explain the decision.
+ * @param {function} options.persistSnapshot - Callback persisting the snapshot.
+ * @returns {boolean} True while the status is still provisional.
+ */
+export function shouldDeferUnverifiedDockerTerminal(sessionName, sessionInfo, { exitCode, endTime = null, verbose, persistSnapshot }) {
+  const nowMs = Date.now();
+
+  if (!terminalClaimIsRecent(endTime, nowMs)) {
+    if (verbose) {
+      console.log(`[VERBOSE] Session ${sessionName} reports a terminal failure (exit ${exitCode}) that ended at ${endTime}, longer than ${DOCKER_TERMINAL_FOOTER_GRACE_MS}ms ago; the log footer had time to appear, so the reported exit code is accepted (issue #2117)`);
+    }
+    return false;
+  }
+
+  const raw = sessionInfo?.[DOCKER_TERMINAL_UNVERIFIED_FIRST_SEEN_FIELD];
+  const firstSeenMs = raw ? new Date(raw).getTime() : null;
+
+  if (firstSeenMs === null || !Number.isFinite(firstSeenMs)) {
+    if (sessionInfo) {
+      sessionInfo[DOCKER_TERMINAL_UNVERIFIED_FIRST_SEEN_FIELD] = new Date(nowMs).toISOString();
+      persistSnapshot();
+    }
+    if (verbose) {
+      console.log(`[VERBOSE] Session ${sessionName} reports a terminal failure (exit ${exitCode}) that no log footer corroborates; deferring for up to ${DOCKER_TERMINAL_FOOTER_GRACE_MS}ms until start-command writes the real footer (issue #2117)`);
+    }
+    return true;
+  }
+
+  if (nowMs - firstSeenMs < DOCKER_TERMINAL_FOOTER_GRACE_MS) {
+    if (verbose) {
+      console.log(`[VERBOSE] Session ${sessionName} still reports an unverified terminal failure (exit ${exitCode}); waiting for the log footer (issue #2117)`);
+    }
+    return true;
+  }
+
+  if (verbose) {
+    console.log(`[VERBOSE] Session ${sessionName} kept reporting a terminal failure (exit ${exitCode}) for ${DOCKER_TERMINAL_FOOTER_GRACE_MS}ms without a log footer; accepting the reported exit code (issue #2117)`);
+  }
+  return false;
+}

package/src/session-monitor.lib.mjs

@@ -26,8 +26,15 @@ import { formatSessionCompletionMessage, getSessionCompletionExitCode, classifyS
 import { notifySubscribers, getSubscriberCount } from './telegram-subscribers.lib.mjs';
 import { classifyExitStatus, normalizeExitCode } from './session-status.lib.mjs';
 import { readLastSessionIdFromLog, buildResumeCommand, formatResumeSection } from './session-resume.lib.mjs';
+import { resolveFailedSessionPullRequestState } from './github-pr-state.lib.mjs';
+// Issue #2117: a docker terminal failure that no anchored log footer corroborates
+// may be an exit code start-command fabricated from the command's own output.
+import { clearUnverifiedDockerTerminalMarker as clearUnverifiedDockerTerminalMarkerImpl, shouldDeferUnverifiedDockerTerminal as shouldDeferUnverifiedDockerTerminalImpl } from './session-monitor.docker-terminal.lib.mjs';
+import { isDockerIsolation, sessionStartMs, resolveOomKilledState, resolveStaleExecutingState as resolveStaleExecutingStateImpl } from './session-monitor.stale-executing.lib.mjs';
 
 export { formatSessionCompletionMessage, getSessionCompletionExitCode } from './work-session-formatting.lib.mjs';
+export { DOCKER_TERMINAL_FOOTER_GRACE_MS } from './session-monitor.docker-terminal.lib.mjs';
+export { STALE_EXECUTING_MIN_AGE_MS, DOCKER_BACKEND_GONE_GRACE_MS } from './session-monitor.stale-executing.lib.mjs';
 
 const exec = promisify(execCallback);
 
@@ -521,134 +528,16 @@ function isNonIsolationSessionActive(sessionName, sessionInfo, verbose = false)
   return true;
 }
 
-/**
- * Issue #1927: minimum age before a session that `$ --status` still reports as
- * `executing` is allowed to be declared dead purely on a backend-liveness probe
- * (the screen/tmux/docker session is gone). This avoids a race where a session
- * that has just been launched — but whose backend has not registered yet — is
- * falsely reported as killed. The authoritative log-footer check is NOT gated by
- * this, because a written "Exit Code:" footer is proof the command terminated.
- */
-export const STALE_EXECUTING_MIN_AGE_MS = 90 * 1000;
-export const DOCKER_BACKEND_GONE_GRACE_MS = 2 * 60 * 1000;
-const DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD = 'dockerBackendGoneFirstSeenAt';
-
-function sessionStartMs(sessionInfo) {
-  const start = sessionInfo?.startTime;
-  if (!start) return null;
-  const date = start instanceof Date ? start : new Date(start);
-  const ms = date.getTime();
-  return Number.isFinite(ms) ? ms : null;
-}
-
-function isDockerIsolation(sessionInfo, statusResult) {
-  return sessionInfo?.isolationBackend === 'docker' || statusResult?.isolation === 'docker';
+function clearUnverifiedDockerTerminalMarker(sessionName, sessionInfo) {
+  clearUnverifiedDockerTerminalMarkerImpl(sessionInfo, () => persistSessionSnapshot(sessionName, sessionInfo));
 }
 
-function getDockerBackendGoneFirstSeenMs(sessionInfo) {
-  const raw = sessionInfo?.[DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD];
-  if (!raw) return null;
-  const ms = new Date(raw).getTime();
-  return Number.isFinite(ms) ? ms : null;
+function shouldDeferUnverifiedDockerTerminal(sessionName, sessionInfo, { exitCode, endTime, verbose }) {
+  return shouldDeferUnverifiedDockerTerminalImpl(sessionName, sessionInfo, { exitCode, endTime, verbose, persistSnapshot: () => persistSessionSnapshot(sessionName, sessionInfo) });
 }
 
-function clearDockerBackendGoneMarker(sessionName, sessionInfo) {
-  if (!sessionInfo?.[DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD]) return;
-  delete sessionInfo[DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD];
-  persistSessionSnapshot(sessionName, sessionInfo);
-}
-
-/**
- * Cross-check whether a session that `$ --status` still reports as `executing`
- * has actually terminated. Issue #1927: start-command's status can get stuck on
- * `executing` after the process was killed (a lingering shell keeps the screen
- * session alive, flipping executed→executing), so a SIGKILLed /solve was never
- * reported. Two independent signals are consulted, strongest first:
- *
- *   1. The execution log FOOTER. When start-command wrote "Exit Code: N" the
- *      command terminated, full stop — regardless of what `--status` claims.
- *      This is authoritative and catches the dominant lingering-shell case.
- *   2. Backend LIVENESS. If no footer was written (e.g. the wrapper itself was
- *      hard-killed) but the backing screen/tmux/docker session is gone, the
- *      process cannot still be executing. Gated by STALE_EXECUTING_MIN_AGE_MS to
- *      avoid a just-launched-not-yet-registered race.
- *
- * @returns {Promise<{exitCode: number|null, status: string, reason: string}|null>}
- *   Terminal details when the session is actually dead, else null (still running).
- */
-async function resolveStaleExecutingState(sessionName, sessionInfo, statusResult, { verbose, runner, exitFromLog, backendAlive }) {
-  // 1. Authoritative: the log footer.
-  const logPath = statusResult?.logPath || sessionInfo?.logPath || null;
-  if (logPath) {
-    const readFooter = exitFromLog || runner.readSessionExitFromLog;
-    const footer = readFooter ? readFooter(logPath, { verbose }) : null;
-    if (footer?.finished) {
-      const status = classifyExitStatus(footer.exitCode) || (footer.exitCode === 0 ? 'executed' : 'failed');
-      return { exitCode: footer.exitCode, status, reason: `log-footer(exit ${footer.exitCode})` };
-    }
-  }
-
-  // 2. Liveness probe, only once the session is old enough to have registered.
-  const startMs = sessionStartMs(sessionInfo);
-  const ageMs = startMs != null ? Date.now() - startMs : Infinity;
-  if (ageMs >= STALE_EXECUTING_MIN_AGE_MS && sessionInfo?.isolationBackend) {
-    const probe = backendAlive || runner.checkBackendSessionAlive;
-    const alive = probe ? await probe(sessionInfo.sessionId || sessionName, sessionInfo.isolationBackend, verbose) : null;
-    // Only `false` (definitively gone) counts as killed; `null` (unknown backend)
-    // is treated as "no signal" so we don't kill on an indeterminate probe.
-    if (alive === false) {
-      if (isDockerIsolation(sessionInfo, statusResult)) {
-        const nowMs = Date.now();
-        const firstSeenMs = getDockerBackendGoneFirstSeenMs(sessionInfo);
-        if (firstSeenMs === null) {
-          sessionInfo[DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD] = new Date(nowMs).toISOString();
-          persistSessionSnapshot(sessionName, sessionInfo);
-          if (verbose) {
-            console.log(`[VERBOSE] Session ${sessionName} docker backend is gone but no terminal status/footer is available yet; deferring killed classification for ${DOCKER_BACKEND_GONE_GRACE_MS}ms`);
-          }
-          return null;
-        }
-        if (nowMs - firstSeenMs < DOCKER_BACKEND_GONE_GRACE_MS) {
-          if (verbose) {
-            console.log(`[VERBOSE] Session ${sessionName} docker backend is still gone; waiting for terminal status/footer before reporting killed`);
-          }
-          return null;
-        }
-      }
-      return { exitCode: null, status: 'killed', reason: 'backend-gone' };
-    }
-    if (alive === true) {
-      clearDockerBackendGoneMarker(sessionName, sessionInfo);
-    }
-  }
-
-  return null;
-}
-
-function resolveOomKilledState(sessionName, sessionInfo, statusResult, { verbose, runner, exitFromLog }) {
-  const logPath = statusResult?.logPath || sessionInfo?.logPath || null;
-  let footer = null;
-  if (logPath) {
-    const readFooter = exitFromLog || runner.readSessionExitFromLog;
-    footer = readFooter ? readFooter(logPath, { verbose }) : null;
-  }
-
-  const statusExitCode = normalizeExitCode(statusResult?.exitCode);
-  const footerExitCode = footer?.finished ? normalizeExitCode(footer.exitCode) : null;
-  let exitCode = 137;
-  if (statusExitCode !== null && statusExitCode > 0) {
-    exitCode = statusExitCode;
-  } else if (footerExitCode !== null && footerExitCode > 0) {
-    exitCode = footerExitCode;
-  }
-  const endTime = statusResult?.endTime || footer?.endTime || statusResult?.currentTime || null;
-  const corrected = { ...statusResult, status: 'oom-killed', exitCode, endTime };
-
-  if (verbose) {
-    console.log(`[VERBOSE] Session ${sessionName} status includes oomKilled=true; treating it as terminal oom-killed (exit ${exitCode})`);
-  }
-
-  return { running: false, exitCode, status: 'oom-killed', statusResult: corrected, stale: true };
+function resolveStaleExecutingState(sessionName, sessionInfo, statusResult, options) {
+  return resolveStaleExecutingStateImpl(sessionName, sessionInfo, statusResult, { ...options, persistSnapshot: () => persistSessionSnapshot(sessionName, sessionInfo) });
 }
 
 async function getIsolationSessionState(sessionName, sessionInfo, options = {}) {
@@ -678,25 +567,30 @@ async function getIsolationSessionState(sessionName, sessionInfo, options = {})
           const corrected = { ...statusResult, status: correctedStatus, exitCode: stale.exitCode, endTime: statusResult.endTime || stale.endTime || null };
           return { running: false, exitCode: stale.exitCode, status: correctedStatus, statusResult: corrected, stale: true };
         }
+        // Back to a plain `executing` report: any earlier unverified terminal
+        // failure was provisional and is now moot (issue #2117).
+        clearUnverifiedDockerTerminalMarker(sessionName, sessionInfo);
         return { running: true, exitCode: null, status: statusResult.status, statusResult };
       }
       if (runner.isTerminalSessionStatus(statusResult.status)) {
-        let exitCode = statusResult.exitCode !== undefined ? statusResult.exitCode : null;
-        // Issue #1927: when start-command reports a terminal status but a missing
-        // or sentinel (-1) exit code — which its lingering-shell reverse-flip can
-        // produce — recover the real code from the log footer so a SIGKILL is not
-        // mislabelled as a generic failure.
-        if ((exitCode === null || exitCode === -1) && (statusResult.logPath || sessionInfo?.logPath)) {
-          const readFooter = exitFromLog || runner.readSessionExitFromLog;
-          const footer = readFooter ? readFooter(statusResult.logPath || sessionInfo.logPath, { verbose }) : null;
-          if (footer?.finished) {
-            exitCode = footer.exitCode;
-            const correctedStatus = classifyExitStatus(footer.exitCode) || statusResult.status;
-            if (verbose) {
-              console.log(`[VERBOSE] Session ${sessionName} reported terminal '${statusResult.status}' with exit ${statusResult.exitCode}; recovered real exit ${exitCode} (${correctedStatus}) from log footer`);
-            }
-            return { running: false, exitCode, status: correctedStatus, statusResult: { ...statusResult, status: correctedStatus, exitCode } };
+        const exitCode = statusResult.exitCode !== undefined ? statusResult.exitCode : null;
+        const logPath = statusResult.logPath || sessionInfo?.logPath || null;
+        // The log FOOTER is the authoritative terminal result. It is anchored on
+        // the `=====` separator (see parseSessionExitFooter), so — unlike the
+        // exit code `$ --status` derives from an unanchored full-log scan — it
+        // cannot be forged by output the wrapped command printed (issue #2117).
+        // Prefer it whenever it exists: that both recovers a real code from a
+        // missing/sentinel status (issue #1927) and overrides a fabricated one.
+        const readFooter = exitFromLog || runner.readSessionExitFromLog;
+        const footer = logPath && readFooter ? readFooter(logPath, { verbose }) : null;
+        if (footer?.finished) {
+          const footerExitCode = footer.exitCode;
+          const correctedStatus = classifyExitStatus(footerExitCode) || statusResult.status;
+          if (verbose && normalizeExitCode(footerExitCode) !== normalizeExitCode(exitCode)) {
+            console.log(`[VERBOSE] Session ${sessionName} reported terminal '${statusResult.status}' with exit ${exitCode}; the log footer says exit ${footerExitCode} (${correctedStatus}) and wins (issues #1927/#2117)`);
           }
+          clearUnverifiedDockerTerminalMarker(sessionName, sessionInfo);
+          return { running: false, exitCode: footerExitCode, status: correctedStatus, statusResult: { ...statusResult, status: correctedStatus, exitCode: footerExitCode } };
         }
         // Issue #1939: a native docker session can report a terminal status
         // ("executed") with the unknown exit-code sentinel (-1) while the
@@ -704,8 +598,21 @@ async function getIsolationSessionState(sessionName, sessionInfo, options = {})
         // a real terminal exit, such a status is provisional — fall through to
         // isSessionRunning() below, which cross-checks the live container via
         // `docker inspect` before we notify the user the work finished.
-        const ambiguousDockerTerminal = sessionInfo.isolationBackend === 'docker' && typeof runner.isUnknownDockerExitCode === 'function' && runner.isUnknownDockerExitCode(exitCode);
+        const dockerSession = isDockerIsolation(sessionInfo, statusResult);
+        const ambiguousDockerTerminal = dockerSession && typeof runner.isUnknownDockerExitCode === 'function' && runner.isUnknownDockerExitCode(exitCode);
+        // Issue #2117: a docker terminal FAILURE with no corroborating footer is
+        // provisional too — start-command can fabricate that exit code from the
+        // command's own output. Give the real footer a moment to appear instead
+        // of announcing a failure the run never had. Only a *freshly* reported
+        // end time can still be in that race, so an older terminal record is
+        // still reported without delay.
+        const normalizedExitCode = normalizeExitCode(exitCode);
+        const unverifiedDockerFailure = dockerSession && !ambiguousDockerTerminal && normalizedExitCode !== null && normalizedExitCode !== 0;
+        if (unverifiedDockerFailure && shouldDeferUnverifiedDockerTerminal(sessionName, sessionInfo, { exitCode, endTime: statusResult.endTime || null, verbose })) {
+          return { running: true, exitCode: null, status: statusResult.status, statusResult, deferred: true };
+        }
         if (!ambiguousDockerTerminal) {
+          clearUnverifiedDockerTerminalMarker(sessionName, sessionInfo);
           return { running: false, exitCode, status: statusResult.status, statusResult };
         }
       }
@@ -844,11 +751,8 @@ export async function monitorSessions(bot, verbose = false, options = {}) {
           verbose,
         });
 
-        // Issue #1688/#1905: When the original /solve URL was an issue, look up
-        //   the created PR so the completion message can include both an
-        //   `Issue:` and a `Pull request:` line. The linked-issue API can lag
-        //   behind the solver's own verification log, so we also inspect the
-        //   completed session log before giving up.
+        // Issue #1688/#1905: Resolve the created PR from GitHub or, when its
+        // linked-issue API lags, from the completed solve log.
         let pullRequestUrl = null;
         try {
           pullRequestUrl = await resolvePullRequestUrlForSession(sessionInfo, {
@@ -863,10 +767,25 @@ export async function monitorSessions(bot, verbose = false, options = {}) {
           }
         }
 
-        // Issue #594: when --show-limits was used at command time, capture an
-        //   end-of-task limits snapshot and append a delta block to the
-        //   completion message. The cached helpers respect a 20-min TTL so
-        //   parallel sessions don't stampede the upstream API.
+        let pullRequestState = null;
+        const completionOutcome = classifySessionOutcome({ exitCode: finalExitCode, status: resolvedStatus });
+        try {
+          pullRequestState = await resolveFailedSessionPullRequestState({
+            pullRequestUrl,
+            outcome: completionOutcome,
+            lookupPullRequestState: options.lookupPullRequestState,
+            verbose,
+            sessionName,
+            exitCode: finalExitCode,
+            status: resolvedStatus,
+            logPath: statusResult?.logPath || sessionInfo?.logPath,
+          });
+        } catch (stateError) {
+          if (verbose) console.log(`[VERBOSE] Pull request state resolution failed for ${sessionName}: ${stateError?.message || stateError}`);
+        }
+
+        // Issue #594: append an end-of-task limits snapshot/delta. Cached
+        // helpers prevent parallel sessions from stampeding the upstream API.
         const limitsExtraSections = [];
         if (sessionInfo?.showLimits) {
           try {
@@ -895,15 +814,8 @@ export async function monitorSessions(bot, verbose = false, options = {}) {
           }
         }
 
-        // Issue #1927 (review follow-up): when a /solve session was KILLED
-        //   (OOM/SIGKILL — the silent failure this issue is about), surface a
-        //   ready-to-run `--resume <lastSessionId>` command so the surviving
-        //   parent (the operator, or an automation watching the bot) can pick the
-        //   work back up. We deliberately do NOT auto-relaunch here: a job that
-        //   reliably OOMs would storm. The rule "use the LAST of multiple
-        //   sessions" is honored by reading the last `Session ID:` marker from
-        //   the captured log. Purely additive — failures never block the
-        //   completion notification, preserving backward compatibility.
+        // Issue #1927: for a killed /solve, offer a command using the last tool
+        // session ID in the log. Do not auto-relaunch work that may reliably OOM.
         const resumeExtraSections = [];
         try {
           const outcome = classifySessionOutcome({ exitCode: finalExitCode, status: resolvedStatus });
@@ -961,6 +873,7 @@ export async function monitorSessions(bot, verbose = false, options = {}) {
           exitCode: finalExitCode,
           infoBlock: sessionInfo?.infoBlock || '',
           pullRequestUrl,
+          pullRequestState,
           extraSections: [...limitsExtraSections, ...resumeExtraSections, ...diskExtraSections, ...dockerTaskContainerExtraSections],
         });
 

package/src/session-monitor.stale-executing.lib.mjs

@@ -0,0 +1,151 @@
+/**
+ * Terminal-state reconciliation helpers for tracked isolation sessions.
+ *
+ * These live next to session-monitor.lib.mjs (which is at its `max-lines`
+ * budget) and cover two independent defects:
+ *
+ *   - issue #1927: `$ --status` can stay stuck on `executing` after the process
+ *     was killed, so the monitor has to cross-check the log footer and the
+ *     backing screen/tmux/docker session.
+ *   - issue #2015: a docker session reported with `oomKilled=true` is terminal
+ *     and must be surfaced as such instead of being polled forever.
+ *
+ * @see https://github.com/link-assistant/hive-mind/issues/1927
+ * @see https://github.com/link-assistant/hive-mind/issues/2015
+ */
+
+import { classifyExitStatus, normalizeExitCode } from './session-status.lib.mjs';
+
+/**
+ * Issue #1927: minimum age before a session that `$ --status` still reports as
+ * `executing` is allowed to be declared dead purely on a backend-liveness probe
+ * (the screen/tmux/docker session is gone). This avoids a race where a session
+ * that has just been launched — but whose backend has not registered yet — is
+ * falsely reported as killed. The authoritative log-footer check is NOT gated by
+ * this, because a written "Exit Code:" footer is proof the command terminated.
+ */
+export const STALE_EXECUTING_MIN_AGE_MS = 90 * 1000;
+export const DOCKER_BACKEND_GONE_GRACE_MS = 2 * 60 * 1000;
+const DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD = 'dockerBackendGoneFirstSeenAt';
+
+export function sessionStartMs(sessionInfo) {
+  const start = sessionInfo?.startTime;
+  if (!start) return null;
+  const date = start instanceof Date ? start : new Date(start);
+  const ms = date.getTime();
+  return Number.isFinite(ms) ? ms : null;
+}
+
+export function isDockerIsolation(sessionInfo, statusResult) {
+  return sessionInfo?.isolationBackend === 'docker' || statusResult?.isolation === 'docker';
+}
+
+function getDockerBackendGoneFirstSeenMs(sessionInfo) {
+  const raw = sessionInfo?.[DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD];
+  if (!raw) return null;
+  const ms = new Date(raw).getTime();
+  return Number.isFinite(ms) ? ms : null;
+}
+
+function clearDockerBackendGoneMarker(sessionInfo, persistSnapshot) {
+  if (!sessionInfo?.[DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD]) return;
+  delete sessionInfo[DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD];
+  persistSnapshot();
+}
+
+/**
+ * Cross-check whether a session that `$ --status` still reports as `executing`
+ * has actually terminated. Issue #1927: start-command's status can get stuck on
+ * `executing` after the process was killed (a lingering shell keeps the screen
+ * session alive, flipping executed→executing), so a SIGKILLed /solve was never
+ * reported. Two independent signals are consulted, strongest first:
+ *
+ *   1. The execution log FOOTER. When start-command wrote "Exit Code: N" the
+ *      command terminated, full stop — regardless of what `--status` claims.
+ *      This is authoritative and catches the dominant lingering-shell case.
+ *   2. Backend LIVENESS. If no footer was written (e.g. the wrapper itself was
+ *      hard-killed) but the backing screen/tmux/docker session is gone, the
+ *      process cannot still be executing. Gated by STALE_EXECUTING_MIN_AGE_MS to
+ *      avoid a just-launched-not-yet-registered race.
+ *
+ * @returns {Promise<{exitCode: number|null, status: string, reason: string}|null>}
+ *   Terminal details when the session is actually dead, else null (still running).
+ */
+export async function resolveStaleExecutingState(sessionName, sessionInfo, statusResult, { verbose, runner, exitFromLog, backendAlive, persistSnapshot }) {
+  // 1. Authoritative: the log footer.
+  const logPath = statusResult?.logPath || sessionInfo?.logPath || null;
+  if (logPath) {
+    const readFooter = exitFromLog || runner.readSessionExitFromLog;
+    const footer = readFooter ? readFooter(logPath, { verbose }) : null;
+    if (footer?.finished) {
+      const status = classifyExitStatus(footer.exitCode) || (footer.exitCode === 0 ? 'executed' : 'failed');
+      return { exitCode: footer.exitCode, status, reason: `log-footer(exit ${footer.exitCode})` };
+    }
+  }
+
+  // 2. Liveness probe, only once the session is old enough to have registered.
+  const startMs = sessionStartMs(sessionInfo);
+  const ageMs = startMs != null ? Date.now() - startMs : Infinity;
+  if (ageMs >= STALE_EXECUTING_MIN_AGE_MS && sessionInfo?.isolationBackend) {
+    const probe = backendAlive || runner.checkBackendSessionAlive;
+    const alive = probe ? await probe(sessionInfo.sessionId || sessionName, sessionInfo.isolationBackend, verbose) : null;
+    // Only `false` (definitively gone) counts as killed; `null` (unknown backend)
+    // is treated as "no signal" so we don't kill on an indeterminate probe.
+    if (alive === false) {
+      if (isDockerIsolation(sessionInfo, statusResult)) {
+        const nowMs = Date.now();
+        const firstSeenMs = getDockerBackendGoneFirstSeenMs(sessionInfo);
+        if (firstSeenMs === null) {
+          sessionInfo[DOCKER_BACKEND_GONE_FIRST_SEEN_FIELD] = new Date(nowMs).toISOString();
+          persistSnapshot();
+          if (verbose) {
+            console.log(`[VERBOSE] Session ${sessionName} docker backend is gone but no terminal status/footer is available yet; deferring killed classification for ${DOCKER_BACKEND_GONE_GRACE_MS}ms`);
+          }
+          return null;
+        }
+        if (nowMs - firstSeenMs < DOCKER_BACKEND_GONE_GRACE_MS) {
+          if (verbose) {
+            console.log(`[VERBOSE] Session ${sessionName} docker backend is still gone; waiting for terminal status/footer before reporting killed`);
+          }
+          return null;
+        }
+      }
+      return { exitCode: null, status: 'killed', reason: 'backend-gone' };
+    }
+    if (alive === true) {
+      clearDockerBackendGoneMarker(sessionInfo, persistSnapshot);
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Issue #2015: `oomKilled` is terminal — the container was killed by the kernel,
+ * so no further polling can change the outcome.
+ */
+export function resolveOomKilledState(sessionName, sessionInfo, statusResult, { verbose, runner, exitFromLog }) {
+  const logPath = statusResult?.logPath || sessionInfo?.logPath || null;
+  let footer = null;
+  if (logPath) {
+    const readFooter = exitFromLog || runner.readSessionExitFromLog;
+    footer = readFooter ? readFooter(logPath, { verbose }) : null;
+  }
+
+  const statusExitCode = normalizeExitCode(statusResult?.exitCode);
+  const footerExitCode = footer?.finished ? normalizeExitCode(footer.exitCode) : null;
+  let exitCode = 137;
+  if (statusExitCode !== null && statusExitCode > 0) {
+    exitCode = statusExitCode;
+  } else if (footerExitCode !== null && footerExitCode > 0) {
+    exitCode = footerExitCode;
+  }
+  const endTime = statusResult?.endTime || footer?.endTime || statusResult?.currentTime || null;
+  const corrected = { ...statusResult, status: 'oom-killed', exitCode, endTime };
+
+  if (verbose) {
+    console.log(`[VERBOSE] Session ${sessionName} status includes oomKilled=true; treating it as terminal oom-killed (exit ${exitCode})`);
+  }
+
+  return { running: false, exitCode, status: 'oom-killed', statusResult: corrected, stale: true };
+}

package/src/solve.finalize.lib.mjs

@@ -1,20 +1,35 @@
 export async function finalizeSolveProcess({ tempDir, argv, limitReached, path, getLogFile, log, closeSentry, logActiveHandles, cleanupTempDirectory, safeExit }) {
-  await cleanupTempDirectory(tempDir, argv, limitReached);
+  const runFinalizationStep = async (label, step) => {
+    try {
+      await step();
+    } catch (error) {
+      const message = error?.message || String(error);
+      try {
+        await log(`⚠️  Finalization step failed (${label}): ${message}`, { level: 'warning' });
+      } catch {
+        console.warn(`⚠️  Finalization step failed (${label}): ${message}`);
+      }
+    }
+  };
 
-  // Show final log file reference so users always know where to find the complete log
-  if (getLogFile()) {
-    const finalLogPath = path.resolve(getLogFile());
-    await log(`\n📁 Complete log file: ${finalLogPath}`);
-  }
+  await runFinalizationStep('temporary directory cleanup', () => cleanupTempDirectory(tempDir, argv, limitReached));
+
+  await runFinalizationStep('final log reference', async () => {
+    // Show final log file reference so users always know where to find the complete log
+    if (getLogFile()) {
+      const finalLogPath = path.resolve(getLogFile());
+      await log(`\n📁 Complete log file: ${finalLogPath}`);
+    }
+  });
 
   // Issue #1346: Flush Sentry events before exit.
   // closeSentry() uses a hard Promise.race deadline so it cannot block indefinitely.
-  await closeSentry();
+  await runFinalizationStep('Sentry close', closeSentry);
 
   // Issue #1431: Log active handles before draining.
   // Always logged to file and console so future hangs are immediately visible in logs.
   // drainHandles() inside safeExit() will unref/close these before process.exit().
-  await logActiveHandles(msg => log(msg));
+  await runFinalizationStep('active handle diagnostics', () => logActiveHandles(msg => log(msg)));
 
   // Issue #1431: safeExit() unrefs handles so the event loop exits naturally, then calls process.exit(0)
   await safeExit(0, 'Process completed');

package/src/solve.mjs

@@ -160,7 +160,7 @@ const cleanupWrapper = async () => {
 };
 const interruptWrapper = createInterruptWrapper({ cleanupContext, checkForUncommittedChanges, shouldAttachLogs, attachLogToGitHub, getLogFile, sanitizeLogContent, $, log });
 initializeExitHandler(getAbsoluteLogPath, log, cleanupWrapper, interruptWrapper, ({ code, reason, failureActionSection }) => notifyIssueAboutPrePullRequestFailure({ code, reason, failureActionSection, argv, globalState: global, $, log, getLogFile, shouldAttachLogs, attachLogToGitHub, sanitizeLogContent, rawCommand }));
-installGlobalExitHandlers();
+installGlobalExitHandlers({ handleProcessErrors: false }); // #2117: solve's richer process-error handlers below must not race a duplicate pair.
 // Issue #1823: Configure the working-session guard. When the experimental
 // --do-not-shutdown-in-the-middle-of-working-session flag is set (hive passes it to every
 // worker), an interrupt received during an AI working session is deferred: solve lets the AI

package/src/work-session-formatting.lib.mjs

@@ -128,7 +128,7 @@ export function appendPullRequestLine(infoBlock, pullRequestUrl, { locale = null
   return [...before, prLine, ...after].join('\n');
 }
 
-export function formatSessionCompletionMessage({ sessionName, sessionInfo, statusResult = null, observedEndTime = new Date(), exitCode = null, infoBlock = '', pullRequestUrl = null, extraSections = [], locale = null } = {}) {
+export function formatSessionCompletionMessage({ sessionName, sessionInfo, statusResult = null, observedEndTime = new Date(), exitCode = null, infoBlock = '', pullRequestUrl = null, pullRequestState = null, extraSections = [], locale = null } = {}) {
   const finalExitCode = getSessionCompletionExitCode({ exitCode, statusResult });
   const outcome = classifySessionOutcome({ exitCode: finalExitCode, status: statusResult?.status || null });
   const { failed, killed, signal } = outcome;
@@ -142,6 +142,7 @@ export function formatSessionCompletionMessage({ sessionName, sessionInfo, statu
   // is an orderly, intentional termination, so surface it as such regardless of
   // which signal actually delivered the kill.
   const stopRequestedByUser = Boolean(sessionInfo?.stopRequestedByUser);
+  const pullRequestMerged = pullRequestState?.merged === true || Boolean(pullRequestState?.mergedAt);
   let statusEmojiOverride = null;
   let statusText;
   if (killed && stopRequestedByUser) {
@@ -158,6 +159,14 @@ export function formatSessionCompletionMessage({ sessionName, sessionInfo, statu
     const exitSuffix = showCode ? ` (exit code: ${finalExitCode})` : '';
     const reason = signal ? signal.reason : 'killed';
     statusText = text(messageLocale, 'telegram.work_session_killed', `Work session ${reason}${exitSuffix}`, { reason, exitCode: finalExitCode ?? '', signal: signal?.signal ?? '', exitSuffix });
+  } else if (failed && pullRequestMerged) {
+    // Issue #2117: the runner's exit code is still authoritative and must not
+    // be hidden, but calling the entire session "failed" contradicts the
+    // externally verified result when its pull request has already merged.
+    // Describe both outcomes so operators know the requested goal completed
+    // and that a later orchestration failure still needs investigation.
+    statusEmojiOverride = '⚠️';
+    statusText = text(messageLocale, 'telegram.work_session_merged_but_failed', `Pull request merged, but the work session exited with code: ${finalExitCode}`, { exitCode: finalExitCode });
   } else if (failed) {
     statusText = text(messageLocale, 'telegram.work_session_failed', `Work session failed (exit code: ${finalExitCode})`, { exitCode: finalExitCode });
   } else {
@@ -183,7 +192,8 @@ export function formatSessionCompletionMessage({ sessionName, sessionInfo, statu
 
   // Issue #594: --show-limits virtual option appends snapshot/delta sections
   // (Markdown code blocks) below the standard completion details.
-  const extras = (Array.isArray(extraSections) ? extraSections : []).filter(Boolean);
+  const mergedWithRunnerFailureSection = failed && !killed && pullRequestMerged ? [`✅ ${text(messageLocale, 'telegram.work_session_merged_success', 'The requested pull request was merged successfully.')}`, `⚠️ ${text(messageLocale, 'telegram.work_session_runner_also_failed', 'The runner also failed; its exit code is preserved for investigation.')}`].join('\n') : null;
+  const extras = [mergedWithRunnerFailureSection, ...(Array.isArray(extraSections) ? extraSections : [])].filter(Boolean);
   if (extras.length > 0) {
     message += `\n\n${extras.join('\n\n')}`;
   }