@quickchatai/quickreview 1.2.0 → 1.3.2

package/schemas/review-result.v1.json

@@ -137,6 +137,10 @@
     "post": {
       "$ref": "#/$defs/post"
     },
+    "post_ready": {
+      "type": "string",
+      "description": "A finished PR review that was not posted: the file it is kept in, which a host that asks the person later posts through the gate exactly as `--to pr` would have."
+    },
     "run_id": {
       "type": "string",
       "description": "A detached run's id (start, status, stop)."
@@ -149,6 +153,14 @@
       "type": "string",
       "description": "What a detached run reviews."
     },
+    "started_at": {
+      "type": "number",
+      "description": "When a detached run was started, ms since the epoch."
+    },
+    "ended_at": {
+      "type": "number",
+      "description": "When a detached run ended (its exit or its stop), ms since the epoch; absent while it runs."
+    },
     "elapsed_s": {
       "type": "integer",
       "minimum": 0
@@ -165,6 +177,50 @@
           "items": {
             "type": "string"
           }
+        },
+        "live": {
+          "type": "object",
+          "description": "The running round's live log, projected: what the parent and each lens are doing now.",
+          "properties": {
+            "round": { "type": "integer", "minimum": 1 },
+            "parent_status": { "enum": ["active", "settled"] },
+            "last_activity": { "type": "string" },
+            "updated_at": { "type": "string" },
+            "active_tool": { "type": "string" },
+            "agents": {
+              "type": "array",
+              "items": {
+                "type": "object",
+                "required": ["agent", "status", "duration_ms", "tool_count"],
+                "properties": {
+                  "agent": { "type": "string" },
+                  "status": { "enum": ["running", "completed", "failed"] },
+                  "duration_ms": {
+                    "type": "number",
+                    "minimum": 0,
+                    "description": "The lens's time so far; a running lens's counts from its start between updates."
+                  },
+                  "tool_count": {
+                    "type": "number",
+                    "minimum": 0,
+                    "description": "Tool calls the lens has started; a finished lens keeps its final count."
+                  },
+                  "current_tool": {
+                    "type": "string",
+                    "description": "The running (or last) tool, as `<tool>: <args>` or the bare name."
+                  },
+                  "current_target": {
+                    "type": "string",
+                    "description": "While the lens runs: the path its current tool works on, when it names one."
+                  },
+                  "line": {
+                    "type": "string",
+                    "description": "The lens as one line a person reads: `security · read src/x.ts · 7 tools · 0:41`."
+                  }
+                }
+              }
+            }
+          }
         }
       }
     },
@@ -234,6 +290,10 @@
             "kind": {
               "enum": ["pr", "branch", "uncommitted", "diff"],
               "description": "What is reviewed: a pull request, the current branch against its base, the uncommitted working tree, or a unified diff handed in (`--diff`). Only a pr target can be posted."
+            },
+            "uncommitted": {
+              "const": true,
+              "description": "A branch target reviewed together with the working tree's uncommitted edits, as one review. Absent otherwise."
             }
           }
         },

package/scripts/deploy.sh

@@ -46,9 +46,10 @@
 #                      cloudflared when the inventory enables it), the
 #                      containers, the image stamp, the pi settings and the
 #                      reviewer stub, and the state/status.json heartbeat the
-#                      status collector reads. It also warns 14 days before the
-#                      VM's ghcr pull token expires (the expiry that
-#                      scripts/vm-ghcr-login.sh recorded).
+#                      status collector reads. It also warns 14 days before a
+#                      private mirror's ghcr pull token expires (the expiry
+#                      that scripts/vm-ghcr-login.sh recorded; the public
+#                      release images need no login, so no record).
 #
 # `sync`, `dev` and `rebuild` are gone (the on-VM rsync and build are deleted):
 # they refuse with a pointer to `release`. A pre-release fix is a release.
@@ -1083,8 +1084,9 @@ release_problem() {
   fi
 }
 
-# The VM's ghcr pull token expires (1 year, by ruling), and a lapsed one fails
-# the updater's pull. scripts/vm-ghcr-login.sh records the expiry on this
+# The release images are public and pull with no login. A private mirror's
+# ghcr pull token expires (1 year, by ruling), and a lapsed one fails the
+# updater's pull. scripts/vm-ghcr-login.sh records the expiry on this
 # controller; release and verify read it back. Within GHCR_WARN_DAYS of it
 # (or past it) the plan line starts with WARNING. Warn only, never a refusal.
 GHCR_WARN_DAYS=14
@@ -1095,7 +1097,7 @@ ghcr_expiry_status() {
   local file iso epoch now days
   file="$(qcr_ghcr_expiry_file 2>/dev/null)" || file=""
   if [[ -z "$file" || ! -s "$file" ]]; then
-    GHCR_EXPIRY_LINE="no recorded expiry for the VM's ghcr pull token (scripts/vm-ghcr-login.sh records it when the owner logs the VM in)"
+    GHCR_EXPIRY_LINE="no ghcr login recorded: the release images are public and pull without one (a private mirror logs the VM in with scripts/vm-ghcr-login.sh, which records its expiry)"
     return 0
   fi
   iso="$(head -1 "$file" | tr -d '[:space:]')"

package/scripts/qcr-host.sh

@@ -12,7 +12,10 @@
 #                        `stop` find it by label. `stop` sends `docker stop -t
 #                        <grace>`, then `docker kill`: the container is the
 #                        hard-kill backstop for a driver whose loop is frozen.
-#   qcr                  a bare qcr opens the operator TUI (tui mode)
+#   qcr                  a bare qcr (or `qcr home`) opens the home: the image's
+#                        pi with the plugin and its panel (home mode)
+#   qcr tui              the operator TUI (tui mode), the one verb that starts
+#                        the companion
 #   qcr login [provider] pi's own /login, stored in the qcr-login volume
 #   qcr update [version] pull a newer image and repin this file
 #
@@ -21,8 +24,8 @@
 #   a worktree's common git dir              at its own path     read-only
 #   the qcr-state volume                     /opt/qcr/state      read-write
 #   the qcr-login volume                     /qcr-login          read-only
-#                                            (only `login` mounts it read-write,
-#                                            at pi's agent dir; its files are in
+#                                            (only `login` and the home mount it
+#                                            read-write, at pi's agent dir; its files are in
 #                                            group 4747, which every call joins,
 #                                            so a uid change never loses the login)
 #   ~/.config/qcr/profiles                   /qcr-config/profiles read-only
@@ -219,11 +222,20 @@ split=1
 drop=0
 gh=1
 case "$verb" in
+  # The home is the person's own pi, as `qcr` from npm opens it: pi's agent
+  # dir on the login volume, read-write (its device login lands there), its
+  # config and sessions on the state volume, and the GitHub token for its `gh`.
   '')
-    mode=tui
+    mode=home
     tty=1
     split=0
     ;;
+  home)
+    mode=home
+    tty=1
+    split=0
+    drop=1
+    ;;
   tui)
     mode=tui
     tty=1
@@ -555,7 +567,8 @@ fi
 # ---- the GitHub token (GITHUB_TOKEN, GH_TOKEN, gh; no App on a laptop) -----
 
 # The claim call only reads git: it needs no token, and a token file is read once.
-if [ "$split" = 1 ] && [ "$gh" = 1 ] && [ "$phase" != claim ]; then
+# The home is handed it too: its `gh` lists and opens the pull requests.
+if { [ "$split" = 1 ] || [ "$mode" = home ]; } && [ "$gh" = 1 ] && [ "$phase" != claim ]; then
   token="${GITHUB_TOKEN:-}"
   [ -n "$token" ] || token="${GH_TOKEN:-}"
   if [ -z "$token" ] && command -v gh >/dev/null 2>&1; then
@@ -603,6 +616,16 @@ if [ "$mode" = login ]; then
   # pi's own /login, written to the login volume: the only read-write mount of
   # it. A login needs no repo, no state and no profiles.
   set -- "$@" --mount "type=volume,src=qcr-login,dst=/home/qcr/.pi/agent"
+elif [ "$mode" = home ]; then
+  # The home works on a GitHub repository, not on the directory you stand in:
+  # no repo mount. pi's agent dir is the login volume, read-write, as login's
+  # is. Its state home, sessions and config.toml (the repository it picks,
+  # which it writes) live on the state volume, so they persist and stay
+  # writable; the install home is never mounted.
+  set -- "$@" --mount "type=volume,src=qcr-login,dst=/home/qcr/.pi/agent"
+  set -- "$@" --mount "type=volume,src=qcr-state,dst=/opt/qcr/state"
+  set -- "$@" -e QCR_STATE_HOME=/opt/qcr/state/home
+  set -- "$@" -e QCR_CONFIG=/opt/qcr/state/home/config.toml
 else
   # The repo, read-only; a worktree's common git dir at its own path.
   set -- "$@" --mount "type=bind,src=$root,dst=/repo,readonly" -w "/repo$rel"

package/scripts/vm-ghcr-login.sh

@@ -1,7 +1,10 @@
 #!/usr/bin/env bash
-# vm-ghcr-login.sh — log the review VM in to ghcr.io, so it can pull the
-# release images. Run by the owner, on the controller. Idempotent: running it
-# again replaces the login and the recorded expiry.
+# vm-ghcr-login.sh — log the review VM in to ghcr.io, so it can pull images
+# that are not public: a private mirror named by QC_RELEASE_IMAGE and
+# QC_RELEASE_MEMORY_IMAGE. The release images are public and pull with no
+# login, so a VM on them needs none of this. Run by the owner, on the
+# controller. Idempotent: running it again replaces the login and the recorded
+# expiry.
 #
 # The credential is a CLASSIC personal access token, scoped read:packages and
 # nothing else (the one carve-out from the App-only credential rule, for the
@@ -26,7 +29,7 @@
 #   scripts/vm-ghcr-login.sh --version X.Y.Z [--vm HOST] [--login USER] [--token-file FILE]
 #   pbpaste | scripts/vm-ghcr-login.sh --version X.Y.Z      # token on stdin
 #
-#   --version      a published release version; both images must exist at it
+#   --version      a published version; both images must exist at it
 #   --vm           ssh target (default: $QC_VM_HOST, else the inventory's first host)
 #   --login        the GitHub login to store (default: the token's own; if given
 #                  it must be the token's)

package/src/archive/restore.ts

@@ -32,13 +32,7 @@ import { readdir } from "node:fs/promises";
 import { join, relative } from "node:path";
 import type { StateStore } from "../state.js";
 import { yieldToLoop } from "@quickchatai/pi-quickreview/src/yieldloop.js";
-import {
-  archiveStamp,
-  bundlePassOf,
-  freshPassId,
-  identityFields,
-  sameRecorded,
-} from "./archivewrite.js";
+import { archiveStamp, bundlePassOf, freshPassId, identityFields } from "./archivewrite.js";
 import { readBundleRecords } from "./bundle.js";
 import { sameIdentity } from "./fsutil.js";
 import {
@@ -182,20 +176,23 @@ export async function restorePr(
         const steady = sameIdentity(live, after);
         if (steady && d.bytes === r.bytes && d.sha256 === r.sha256) {
           out.present += 1;
-          // Its identity is recorded unless it is the one the archive record
-          // already holds (a source that was never unlinked). A file an
-          // earlier restore pass put back — one that died before its entry
-          // was written — has a NEW inode: unrecorded, a re-archive after a
-          // re-close would not know it and would compress the same bytes
-          // again under `.v2`, instead of reusing the archived copy.
-          if (!sameRecorded(r, live))
-            restored.push({
-              source: r.source,
-              archive: r.archive,
-              sha256: r.sha256,
-              ...identityFields(live),
-              present: true,
-            });
+          // Its identity is recorded, always. A file an earlier restore pass
+          // put back — one that died before its entry was written — is
+          // unknown to the manifest otherwise, and a re-archive after a
+          // re-close would compress the same bytes again under `.v2` instead
+          // of reusing the archived copy. Its identity is no sign of whether
+          // it was ever unlinked: the filesystem hands a freed inode number
+          // back, and the restore gave the file its original size and mtime,
+          // so a file put back can carry exactly the identity the archive
+          // record holds. Recording a source that was never unlinked costs
+          // one `reused` entry at the re-archive, nothing more.
+          restored.push({
+            source: r.source,
+            archive: r.archive,
+            sha256: r.sha256,
+            ...identityFields(live),
+            present: true,
+          });
         } else out.liveDiffers.push(r.source);
         continue;
       }

package/src/botworker.ts

@@ -439,7 +439,14 @@ export async function runBotWorker(args: WorkerArgs, deps: WorkerDeps): Promise<
     // The login: borrowed, blanked, and checked against this worker's own cap.
     let auth: EngineAuth;
     try {
-      auth = engineCredentials({ srcDir: spec.agent_dir, needMs: spec.wall_clock_ms, now });
+      auth = engineCredentials({
+        srcDir: spec.login_dir ?? spec.agent_dir,
+        needMs: spec.wall_clock_ms,
+        now,
+        // a shared pi home holds the person's other logins too: only the
+        // review's providers are admitted
+        ...(spec.providers !== undefined ? { providers: spec.providers } : {}),
+      });
     } catch (e) {
       if (e instanceof AuthError) throw new Stop(EXIT.auth, e.message);
       throw e;
@@ -461,7 +468,11 @@ export async function runBotWorker(args: WorkerArgs, deps: WorkerDeps): Promise<
         ownsProcess: true,
         homeDir: homedir(),
         ...(ids !== null && !("refused" in ids) ? { toolUid: ids } : {}),
-        fenceDirs: [...loginSourceDirs(env), ...credentialPaths(env, spec.env)],
+        fenceDirs: [
+          ...loginSourceDirs(env),
+          ...(spec.login_dir ? [spec.login_dir] : []),
+          ...credentialPaths(env, spec.env),
+        ],
         credentials: auth.credentials,
         settings: agentDirSettings(spec.agent_dir),
       });

package/src/channelfs.ts

@@ -1,26 +1,3 @@
-// The file I/O of the scan's TUI↔companion records and channel files (the
-// run record, the findings store, the stop and stage-2 start requests and
-// their answers). A dependency-free leaf, so the two setup leaves the TUI
-// imports (scanreport.ts, stage2request.ts) share it without reaching each
-// other at runtime.
-import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { dirname } from "node:path";
-
-/** A file's text, or null when it is ABSENT — any other failure throws, so a
- * reader can tell "not written yet" from "cannot be read". */
-export function readTextIfPresent(path: string): string | null {
-  try {
-    return readFileSync(path, "utf8");
-  } catch (err) {
-    if ((err as NodeJS.ErrnoException).code === "ENOENT") return null;
-    throw err;
-  }
-}
-
-/** tmp+rename: a reader never sees a half-written file. */
-export function writeAtomic(path: string, text: string): void {
-  mkdirSync(dirname(path), { recursive: true });
-  const tmp = `${path}.${process.pid}.tmp`;
-  writeFileSync(tmp, text);
-  renameSync(tmp, path);
-}
+// Moved to the plugin (packages/pi-plugin/src/scan/channelfs.ts): this name
+// stays for the app's importers.
+export * from "@quickchatai/pi-quickreview/src/scan/channelfs.js";

package/src/cli.ts

@@ -531,6 +531,8 @@ function drainHolderLine(snapshot: StatusSnapshot): string {
 /** What lifts the drain that stands. A snapshot with no hold marker comes from
  * a daemon that does not report holds: whether its boot lifts it is unknown. */
 function drainLiftLine(snapshot: StatusSnapshot): string {
+  if (snapshot.draining_reason && snapshot.draining_until && snapshot.draining_hold !== true)
+    return `lifts itself at ${snapshot.draining_until} and retries; qcr drain off to lift now`;
   if (snapshot.draining_hold === true || snapshot.draining_reason)
     return "only qcr drain off lifts it — no boot does";
   if (snapshot.draining_hold === undefined)
@@ -1857,55 +1859,6 @@ export async function cmdSetup(rest: string[]): Promise<number> {
   return 0;
 }
 
-/** `qcr onboard` — the guided setup wizard: pi at the pinned
- * version via npx (works from a bare clone; pi stays a non-dependency), the
- * onboarding prompt + extension + a restricted tool set, then the TUI handoff
- * when the checklist verifies complete. Resumable: run it again after a crash
- * and completed steps are re-verified, not repeated. */
-export async function cmdOnboard(): Promise<number> {
-  const { piPinFromPackageJson, onboardingSessionDir, runOnboard } =
-    await import("./onboard/launch.js");
-  const { checklistComplete } = await import("./onboard/engine.js");
-  const { spawn } = await import("node:child_process");
-  const root = sandboxRoot();
-  // Pin source: config.toml [pi] when it loads; package.json's "qcrPi" block on a
-  // bare clone (config.toml is written later, BY onboarding). Same pinned
-  // version by the rule-7 mirror discipline.
-  let pin: { package: string; version: string } | null = null;
-  try {
-    const { package: pkg, version } = loadConfig().pi;
-    pin = { package: pkg, version };
-  } catch {
-    pin = piPinFromPackageJson(root);
-  }
-  if (!pin)
-    throw new Error(
-      'onboard: pi pin not found (need config.toml [pi] or the package.json "qcrPi" block)',
-    );
-  mkdirSync(onboardingSessionDir(root), { recursive: true });
-  const run = (cmd: string, args: string[]): Promise<number> =>
-    new Promise((resolvePromise) => {
-      const child = spawn(cmd, args, {
-        stdio: "inherit",
-        cwd: root,
-        env: { ...process.env, QCR_ROOT: root },
-      });
-      child.on("error", (err) => {
-        console.error(`onboard: ${cmd} failed to start: ${err.message}`);
-        resolvePromise(1);
-      });
-      child.on("close", (code) => resolvePromise(code ?? 1));
-    });
-  return runOnboard({
-    pin,
-    root,
-    spawn: run,
-    isComplete: () => checklistComplete(join(root, "state")),
-    log: (line) => console.log(line),
-    cliPath: join(root, "dist", "src", "cli.js"),
-  });
-}
-
 export const ARCHIVE_USAGE =
   "usage: qcr archive status [--plan] [--json] | qcr archive run | qcr archive restore <pr> | " +
   "qcr archive extract <pr> --to <dir>";
@@ -2154,6 +2107,16 @@ export async function main(rawArgv: string[]): Promise<void> {
       const { runTui } = await import("./tui/index.js");
       return runTui(rest);
     }
+    case "home": {
+      // the home (src/home/launch.ts): the bin routes a bare `qcr` here too
+      // (src/qcrbin.ts); the image's home mode reaches it through this verb
+      if (rest.length > 0) throw new Error("usage: qcr home");
+      const { homeRunDeps, runHome } = await import("./home/launch.js");
+      // the token taken at startup, when the wrapper handed one over
+      const githubToken = takeHandoffToken();
+      process.exitCode = runHome({ ...homeRunDeps(sandboxRoot()), githubToken: () => githubToken });
+      return;
+    }
     case "companion":
       if (rest.length !== 1) throw new Error("usage: qcr companion <up|down|status|rebuild|plan>");
       return cmdCompanion(rest[0]);
@@ -2161,10 +2124,6 @@ export async function main(rawArgv: string[]): Promise<void> {
       process.exitCode = await cmdMemory(rest);
       return;
     }
-    case "onboard": {
-      process.exitCode = await cmdOnboard();
-      return;
-    }
     case "setup": {
       process.exitCode = await cmdSetup(rest);
       return;
@@ -2273,7 +2232,7 @@ export async function main(rawArgv: string[]): Promise<void> {
     }
     default:
       console.log(
-        "usage: qcr <version|config check [--config-home <dir>]|onboard|setup [validate [<profile>]|commit]|status|spend|today|why <n>|metrics [--pr <n>]|events|takeover <n>|debug-round <n>|release <n>|tui [pr|overseer]|drain <on [--hold]|off>|pause-pr <pr> [--reason <text>]|resume-pr <pr>|review-now <pr>|github-token sync [--gh <path>] [--secrets-dir <dir>]|message <pr> [--may-post] <text...>|archive <status [--plan]|run|restore <pr>|extract <pr> --to <dir>>|install <where|migrate>|" +
+        "usage: qcr <version|config check [--config-home <dir>]|home|setup [validate [<profile>]|commit]|status|spend|today|why <n>|metrics [--pr <n>]|events|takeover <n>|debug-round <n>|release <n>|tui [pr|overseer]|drain <on [--hold]|off>|pause-pr <pr> [--reason <text>]|resume-pr <pr>|review-now <pr>|github-token sync [--gh <path>] [--secrets-dir <dir>]|message <pr> [--may-post] <text...>|archive <status [--plan]|run|restore <pr>|extract <pr> --to <dir>>|install <where|migrate>|" +
           "companion <up|down|status|rebuild>|review [start|status|stop|branch|--uncommitted|--diff FILE|-|<PR number|URL>] [--repo OWNER/NAME] [--base REF] [--preview] [--key K] [--limit USD] [--json]|live [RUN_ID|DIR] [--lens ID] [--round N] [--follow] [--json]|open [RUN_ID|DIR|FILE.jsonl|scan[:RUN]|pr N [--round R]] [--lens ID] [--write] [--print]|scan <preview|start|status|stop|findings|matches|match|suggestions|stage2 propose|stage2 start|dismiss|units show|units propose|units adjust|units save|login|doctor|rebuild>|memory reembed [--user <name>]|memory relayout [--plan|--apply]|backfill [--dry-run] [--limit <n>]|history <digest|pull>|outcomes [--days <n>] [--capture [--read-github]]|lessons [mine|shadow-report [--days <n>]|off|on|suppress <id>|unsuppress <id>]|checklist|compare <pr...>|" +
           "regression [--set <path>] [--clone <path>] [--change <name>] [--limit <n>] [--out <path>]>",
       );

package/src/config.ts

@@ -1158,6 +1158,43 @@ export interface Config extends CoreConfig {
   /** The bot login's single refresher (`src/loginrefresh/`). Optional
    * in the file; off unless the cutover's config turns it on. */
   login_refresh: LoginRefreshConfig;
+  /** The home, the app's own pi a bare `qcr` opens (src/home/launch.ts).
+   * Optional in the file and here, so hand-rolled configs keep compiling;
+   * the parser fills every key. */
+  home?: HomeConfig;
+}
+
+/** Which tools the home's model may call: `reviewer` is the plugin's tools,
+ * the home's own `home_*` tools and pi's read tools; `full` is all of pi's. */
+export type HomeToolSet = "reviewer" | "full";
+
+/** `[home]`: the home a bare `qcr` opens (src/home/launch.ts reads it). */
+export interface HomeConfig {
+  /** The chat's model, `provider/id`. The panel's login line counts only
+   * this model's provider as signed in. */
+  model: string;
+  tools: HomeToolSet;
+}
+
+export const HOME_DEFAULTS: Readonly<HomeConfig> = {
+  model: "openai-codex/gpt-6.1-sol",
+  tools: "reviewer",
+};
+
+/** `[home]`, every key defaulted; a value of the wrong kind is refused. */
+export function parseHomeSection(raw: unknown): HomeConfig {
+  const t = (raw ?? {}) as Record<string, unknown>;
+  const model = t["model"] ?? HOME_DEFAULTS.model;
+  if (typeof model !== "string" || !/^[^/\s]+\/\S+$/.test(model))
+    throw new Error(
+      `config.toml [home]: model must be "provider/id" (got ${JSON.stringify(model)})`,
+    );
+  const tools = t["tools"] ?? HOME_DEFAULTS.tools;
+  if (tools !== "reviewer" && tools !== "full")
+    throw new Error(
+      `config.toml [home]: tools must be "reviewer" or "full" (got ${JSON.stringify(tools)})`,
+    );
+  return { model, tools };
 }
 
 /**
@@ -1822,6 +1859,7 @@ export function parseConfig(toml: string): Config {
       (raw.login_refresh ?? {}) as Record<string, unknown>,
       Number((req(raw, "daemon") as { round_deadline_min?: number }).round_deadline_min ?? 75),
     ),
+    home: parseHomeSection(raw.home),
   };
   validateReviewSection(cfg);
   foldLegacyOwnerSlackId(raw, cfg.owner);

package/src/daemon.ts

@@ -832,6 +832,8 @@ export function createDaemon(deps: DaemonDeps = {}): Daemon {
 
   /** The open PRs the last listing reconcile pass saw (status.json `open_prs`). */
   let openPrs: OpenPrsSnapshot | undefined;
+  /** The last reconcile pass (status.json `poll`): null until one has ended. */
+  let lastPoll: { at: string; ok: boolean; error?: string } | null = null;
   let firstReconcileSeen = false;
   let firstHealthyReconcileAt: Date | null = null;
   // Deploy-window drain auto-lift: only the boot's first reconcile pass may
@@ -888,6 +890,7 @@ export function createDaemon(deps: DaemonDeps = {}): Daemon {
     const bootFirstPass = !firstReconcileSeen;
     firstReconcileSeen = true;
     let completed = false;
+    let thrown: unknown = undefined;
     await guard("reconcile", async () => {
       const report = await reconcileOnce({
         cfg,
@@ -914,7 +917,15 @@ export function createDaemon(deps: DaemonDeps = {}): Daemon {
         // sweep reads session transcripts and is not needed for that, so it
         // starts on the next pass to keep the boot pass short.
         receiptSweep: !bootFirstPass,
+      }).catch((err: unknown) => {
+        thrown = err;
+        throw err;
       });
+      lastPoll = {
+        at: report.ran_at,
+        ok: report.errors.length === 0,
+        ...(report.errors[0] !== undefined ? { error: report.errors[0] } : {}),
+      };
       // The board's "review a PR" list: kept from the last pass that listed.
       if (report.open_list) openPrs = { listed_at: report.ran_at, prs: report.open_list };
       log(
@@ -943,8 +954,10 @@ export function createDaemon(deps: DaemonDeps = {}): Daemon {
       } else if (bootFirstPass && standing.draining && standing.reason !== null) {
         // A drain a system set for a reason (the worker crash-loop breaker,
         // `worker_failures`) is not a deploy window: a restart does not clear what
-        // made it. Only an explicit `drain off` does.
-        log(`drain stands — held for ${standing.reason}; only an explicit drain off lifts it`);
+        // made it. It lapses at its own expiry, or an explicit `drain off` lifts it.
+        log(
+          `drain stands — held for ${standing.reason}; ${standing.expires_at ? `it lifts itself at ${standing.expires_at}, or` : "only"} an explicit drain off lifts it`,
+        );
       } else if (bootFirstPass && report.errors.length === 0 && standing.draining) {
         // The operator's lift: this is the deploy flow's drain completing, so
         // it clears whatever hold stands — a session's included.
@@ -957,14 +970,25 @@ export function createDaemon(deps: DaemonDeps = {}): Daemon {
       }
       completed = true;
     });
+    if (thrown !== undefined)
+      lastPoll = {
+        at: (deps.now ? deps.now() : new Date()).toISOString(),
+        ok: false,
+        error: `the reconcile pass failed: ${thrown instanceof Error ? thrown.message : JSON.stringify(thrown)}`,
+      };
+    // The poll's outcome reaches status.json now, not at the next heartbeat:
+    // "working" is judged on it.
+    writeStatus();
     return completed;
   };
 
   const pump = async (): Promise<void> => {
     await guard("dispatch", async () => {
       // Session levers that lapsed since the last tick leave the ledger here;
-      // the readers below already treat them as gone.
-      sweepExpiredLevers(store, (line) => log(line));
+      // the readers below already treat them as gone. A drain that lapsed (a
+      // session's, or the worker breaker's healing itself) dropped thread
+      // replies as any drain does: sweep them as a lift would.
+      if (sweepExpiredLevers(store, (line) => log(line)).drain) threadDecisions.requestSweep();
       const orders = await dispatchOnce({
         cfg,
         store,
@@ -1122,6 +1146,12 @@ export function createDaemon(deps: DaemonDeps = {}): Daemon {
             };
         }
       if (openPrs) snapshot.open_prs = openPrs;
+      snapshot.poll = {
+        last_at: lastPoll?.at ?? null,
+        ok: lastPoll?.ok ?? null,
+        ...(lastPoll?.error !== undefined ? { error: lastPoll.error } : {}),
+        interval_s: cfg.daemon.poll_interval_s,
+      };
       if (deps.runHost) snapshot.run_host = deps.runHost;
       writeStatusJson(stateDir, snapshot);
     } catch (err) {

package/src/debuground.ts

@@ -123,6 +123,8 @@ export interface DebugRoundSpec {
   cwd: string;
   /** The login's owner dir: read-only, borrowed from. */
   agent_dir: string;
+  /** The login's dir when it is not `agent_dir` (the worker spec's). */
+  login_dir?: string;
   /** Where the pi's own agent dir (the blanked login copy) is made. */
   borrow_dir: string;
   /** The window the borrowed login must outlast. */
@@ -603,6 +605,7 @@ export class DebugRoundManager {
       root: spec.root,
       cwd: spec.cwd,
       agent_dir: spec.agent_dir,
+      ...(spec.login_dir !== undefined ? { login_dir: spec.login_dir } : {}),
       borrow_dir: borrow,
       idle_ms: this.idleMs,
       ...(file !== undefined ? { session_file: file } : {}),

package/src/debugroundpi.ts

@@ -83,6 +83,7 @@ export function readDebugSpec(file: string): DebugRoundSpec {
     raw.session !== debugSession(raw.pr) ||
     typeof raw.command_id !== "string" ||
     typeof raw.agent_dir !== "string" ||
+    (raw.login_dir !== undefined && typeof raw.login_dir !== "string") ||
     typeof raw.borrow_dir !== "string" ||
     typeof raw.session_dir !== "string" ||
     typeof raw.model !== "string" ||