omp-conductor 0.14.0 → 0.15.0

package/src/escalate.ts

@@ -269,7 +269,7 @@ export function createEscalator(
           // the tick re-raises it. A *report* has no such source — it exists
           // once, in the model's head, and nothing regenerates it — which is
           // why that one needed a ledger and this one does not.
-          await sendTelegram(token, chatId, text);
+          await sendTelegram(token, chatId, text, { topicId: p.escalation.telegramTopicId });
           store.markNotified(key);
           return;
         }
@@ -357,14 +357,52 @@ export function readTelegramToken(): string | undefined {
  * Telegram's own message id when it returns one, and throws on every *known*
  * failure — connection refused, HTTP error, `{"ok":false}` — which is what lets
  * a caller treat a throw as "nobody has this" and a crash as "nobody knows".
+ *
+ * Optional `topicId` pins the message to a forum topic (`message_thread_id`).
+ * A definitive missing-thread reject retries once as a flat chat and warns, so a
+ * deleted topic degrades instead of silently losing the page (#318).
  */
 export async function sendTelegram(
   token: string,
   chatId: string,
   text: string,
+  opts?: { topicId?: number },
+): Promise<number | undefined> {
+  const topicId =
+    opts?.topicId !== undefined && Number.isFinite(opts.topicId) && Number.isSafeInteger(opts.topicId)
+      ? opts.topicId
+      : undefined;
+  try {
+    return await postTelegramMessage(token, chatId, text, topicId);
+  } catch (err) {
+    if (
+      topicId === undefined ||
+      !(err instanceof TelegramSendError) ||
+      err.outcome !== "definitive" ||
+      !isMissingTelegramThread(err.message)
+    ) {
+      throw err;
+    }
+    warn(
+      `escalation.telegramTopicId=${topicId} is stale (${err.message}); retrying flat chat`,
+    );
+    return await postTelegramMessage(token, chatId, text, undefined);
+  }
+}
+
+/** Telegram's definitive "that forum topic is gone" answers. */
+function isMissingTelegramThread(diagnostic: string): boolean {
+  return /message thread not found|topic_id_invalid/i.test(diagnostic);
+}
+
+async function postTelegramMessage(
+  token: string,
+  chatId: string,
+  text: string,
+  topicId: number | undefined,
 ): Promise<number | undefined> {
   const url = `https://api.telegram.org/bot${token}/sendMessage`;
-  const body = JSON.stringify({
+  const payload: Record<string, unknown> = {
     chat_id: chatId,
     // ponytail: hard truncation rather than splitting across messages — the
     // tail of a stack trace is rarely the interesting part. Upgrade path is to
@@ -372,7 +410,9 @@ export async function sendTelegram(
     text:
       text.length > TELEGRAM_TEXT_LIMIT ? `${text.slice(0, TELEGRAM_TEXT_LIMIT)}\n[truncated]` : text,
     disable_web_page_preview: true,
-  });
+  };
+  if (topicId !== undefined) payload.message_thread_id = topicId;
+  const body = JSON.stringify(payload);
 
   let res: Response;
   try {

package/src/fleet.ts

@@ -10,7 +10,7 @@
  *                   never systemctl stop herdr-fleet
  * - arm / disarm  — first-class armed marker (arm is inbound Telegram proof)
  * - releaseHold   — clear pause only; never re-arms
- * - release-pane  — clear the halt --pane recovery pin
+ * - resume        — clear pause and the stop --pane recovery pin
  */
 
 import { spawnSync } from "node:child_process";
@@ -29,6 +29,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { formatZonedMinute } from "./availability.ts";
 import { findProject, loadConfig, stateDir } from "./config.ts";
+import { sendTelegram } from "./escalate.ts";
 import { planUsageLine, readPlanUsage, sharedUsageSource } from "./usage.ts";
 import { readApprovalSurface, readDaemonProfile } from "./approval-surface.ts";
 import { inspectBriefLayout } from "./brief-upgrade.ts";
@@ -59,11 +60,16 @@ import {
   SYSTEMD_UNIT,
 } from "./lifecycle.ts";
 import { formatRss, rssBytesFromHealthz } from "./host.ts";
+import type { WorkerPausePhase } from "./worker.ts";
 import { fetchRateLimit } from "./tracker/github.ts";
 import {
+  LEGACY_ARM_MARKER_DETAIL,
+  legacyArmedMarkerPath,
   readTickConfig,
   readTickRuntimeStatus,
+  resolveArmState,
   TICK_CONFIG_FILE,
+  tickConfigMatchesProject,
   type TickConfig,
   type TickConfigResult,
 } from "./orchestrator-tick.ts";
@@ -71,6 +77,14 @@ import {
 export const PANE_HALT_FILE = ".conductor-pane-halted";
 export const DEFAULT_HERDR_UNIT = "herdr-fleet.service";
 
+/**
+ * Default Herdr session name for conductor fleets. Renamed from `fleet` in
+ * #320; `HERDR_SESSION` still wins when set. Legacy hosts that still run a
+ * session named `fleet` are bridged for one release by
+ * {@link resolveHerdrSession}.
+ */
+export const DEFAULT_HERDR_SESSION = "conductor";
+
 /**
  * Agent name assumed when no tick config names one. Mirrors
  * `herdr-conductor`'s own `AGENT_NAME=${AGENT_NAME:-fleet}` default — a
@@ -80,6 +94,89 @@ export const DEFAULT_HERDR_UNIT = "herdr-fleet.service";
 export const DEFAULT_FLEET_AGENT_NAME = "fleet";
 export const ARM_CHALLENGE_TIMEOUT_MS = 300_000;
 
+
+/** Pre-#320 session name. Bridged for one release when `conductor` is empty. */
+const LEGACY_HERDR_SESSION = "fleet";
+
+export const LEGACY_HERDR_SESSION_HINT =
+  'herdr session "fleet" found — rename it to "conductor" or set HERDR_SESSION=fleet (remove this bridge next minor)';
+
+let legacyHerdrSessionHintPrinted = false;
+
+function noteLegacyHerdrSession(log?: (message: string) => void): void {
+  if (legacyHerdrSessionHintPrinted) return;
+  legacyHerdrSessionHintPrinted = true;
+  if (log) log(LEGACY_HERDR_SESSION_HINT);
+  else console.warn(LEGACY_HERDR_SESSION_HINT);
+}
+
+/** Reset the once-per-process rename hint (tests). */
+export function resetLegacyHerdrSessionHintForTests(): void {
+  legacyHerdrSessionHintPrinted = false;
+}
+
+/**
+ * Resolve the Herdr session name. `HERDR_SESSION` is always authoritative.
+ * When unset, default to {@link DEFAULT_HERDR_SESSION}. The one-release bridge
+ * that prefers a populated legacy `fleet` session lives in
+ * {@link resolveHerdrSessionWithBridge} — call that at probe sites.
+ */
+export function resolveHerdrSession(env: NodeJS.ProcessEnv = process.env): string {
+  const explicit = env["HERDR_SESSION"];
+  if (explicit !== undefined && explicit.length > 0) return explicit;
+  return DEFAULT_HERDR_SESSION;
+}
+
+function herdrAgentListRaw(
+  session: string,
+  bin: string,
+  env: NodeJS.ProcessEnv,
+): { ok: true; agents: HerdrAgent[] } | { ok: false } {
+  const res = spawnSync(bin, ["--session", session, "agent", "list"], {
+    encoding: "utf8",
+    timeout: 8_000,
+    env,
+  });
+  if (res.error || res.status !== 0) return { ok: false };
+  try {
+    return { ok: true, agents: parseHerdrAgentList(res.stdout ?? "") };
+  } catch {
+    return { ok: false };
+  }
+}
+
+/**
+ * One-release bridge (#320): when `HERDR_SESSION` is unset, a `conductor`
+ * session with no agents while a `fleet` session answers → use `fleet` and
+ * print the rename hint once. Remove next minor.
+ */
+export function resolveHerdrSessionWithBridge(opts: {
+  env?: NodeJS.ProcessEnv;
+  herdrBin?: string;
+  log?: (message: string) => void;
+} = {}): string {
+  const env = opts.env ?? process.env;
+  const explicit = env["HERDR_SESSION"];
+  if (explicit !== undefined && explicit.length > 0) return explicit;
+
+  const bin = opts.herdrBin ?? "herdr";
+  const primary = herdrAgentListRaw(DEFAULT_HERDR_SESSION, bin, env);
+  if (primary.ok && primary.agents.length > 0) return DEFAULT_HERDR_SESSION;
+
+  const legacy = herdrAgentListRaw(LEGACY_HERDR_SESSION, bin, env);
+  if (legacy.ok && legacy.agents.length > 0) {
+    noteLegacyHerdrSession(opts.log);
+    return LEGACY_HERDR_SESSION;
+  }
+  // conductor answered (even empty) wins over a dead legacy session.
+  if (primary.ok) return DEFAULT_HERDR_SESSION;
+  if (legacy.ok) {
+    noteLegacyHerdrSession(opts.log);
+    return LEGACY_HERDR_SESSION;
+  }
+  return DEFAULT_HERDR_SESSION;
+}
+
 export function telegramStateDir(): string {
   const override = process.env["OMP_TELEGRAM_STATE_DIR"];
   if (override !== undefined && override.length > 0) return override;
@@ -104,25 +201,69 @@ export type ResolvedTick =
   | { kind: "invalid"; path: string; cwd: string; problem: string }
   | { kind: "ok"; path: string; cwd: string; config: TickConfig };
 
+/**
+ * The tick config that belongs to this project, skipping any that names another
+ * one. The search roots overlap between projects — `stateDir()` and the shared
+ * parent of two fleet cwds are read for every one of them — so a stamped config
+ * sitting in a shared root would otherwise answer for whichever project asked
+ * first. An unstamped (pre-multi-project) config still matches anything, which
+ * is what keeps a single-project fleet on the file it already has.
+ */
 export function resolveTickConfig(projectName?: string): ResolvedTick {
   for (const cwd of tickConfigSearchRoots(projectName)) {
     const r: TickConfigResult = readTickConfig(cwd);
-    if (r.kind === "ok") return { kind: "ok", path: r.path, cwd, config: r.config };
+    if (r.kind === "ok") {
+      if (!tickConfigMatchesProject(r.config, projectName)) continue;
+      return { kind: "ok", path: r.path, cwd, config: r.config };
+    }
     if (r.kind === "invalid") return { kind: "invalid", path: r.path, cwd, problem: r.problem };
   }
   return { kind: "absent" };
 }
 
+/**
+ * Where this project's arm marker lives. The per-project fallback is the point:
+ * one shared `<stateDir>/armed` meant arming any project armed all of them. The
+ * bare name survives only for the un-named single-project call, which is the
+ * pre-multi-project spelling.
+ */
 export function armedMarkerPath(projectName?: string): string {
+  return armGate(projectName).path;
+}
+
+/**
+ * This project's arm marker together with the project name that identifies it —
+ * the pair every arm decision needs, from one tick-config read. `named` prefers
+ * the stamped {@link TickConfig.project} over the caller's `--project`, because
+ * the stamp is what the marker was generated from.
+ */
+function armGate(projectName?: string): { path: string; named?: string } {
   const tick = resolveTickConfig(projectName);
-  if (tick.kind === "ok" && tick.config.armedFile !== undefined) return tick.config.armedFile;
-  return join(stateDir(), "armed");
+  const configured = tick.kind === "ok" ? tick.config : undefined;
+  const named = configured?.project ?? projectName;
+  const path =
+    configured?.armedFile ??
+    (projectName === undefined ? legacyArmedMarkerPath() : join(stateDir(), `armed-${projectName}`));
+  return named === undefined ? { path } : { path, named };
 }
 
+/**
+ * Clears the arm gate for this project — and `wasArmed` is the gate the
+ * heartbeat reads, not merely one file's presence.
+ *
+ * The second removal is the whole reason this is not a one-line `rmSync`. While
+ * the shared pre-per-project marker is still honoured (single-project host, an
+ * `armedFile` just restamped to `armed-<name>`), it holds the gate open as soon
+ * as this project's own marker is gone — so a disarm that removed only the
+ * per-project file would leave the fleet ticking, which is exactly what `hold`
+ * exists to prevent. A *stranded* shared marker arms nothing, so it is not this
+ * command's to remove.
+ */
 export function disarmTicks(projectName?: string): { path: string; wasArmed: boolean } {
-  const path = armedMarkerPath(projectName);
-  const wasArmed = existsSync(path);
+  const { path, named } = armGate(projectName);
+  const wasArmed = resolveArmState(path, named).armed;
   rmSync(path, { force: true });
+  if (resolveArmState(path, named).legacy === "honoured") rmSync(legacyArmedMarkerPath(), { force: true });
   return { path, wasArmed };
 }
 
@@ -134,7 +275,7 @@ export interface ArmResult {
 }
 
 export interface ArmDeps {
-  sendChallenge?: (token: string, owner: string, text: string) => Promise<void>;
+  sendChallenge?: (token: string, owner: string, text: string, topicId?: number) => Promise<void>;
   /**
    * Waits for the challenge to appear as a user turn somewhere under the
    * session directory. The waiter owns transcript discovery — not the caller —
@@ -190,18 +331,38 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
   }
 
   const path = tick.config.armedFile;
-  const alreadyArmed = existsSync(path);
+  // The gate as the heartbeat reads it, so "replaced previous marker" is not a
+  // lie about a fleet the shared marker was arming, and so the write below knows
+  // whether it is superseding that marker.
+  const arm = resolveArmState(path, tick.config.project ?? projectName);
+  const alreadyArmed = arm.armed;
   const code = makeChallengeCode();
+  // One bot, one chat, and — once a host runs more than one fleet — more than
+  // one pane that can ask. The challenge names which one, or the operator is
+  // answering a question they cannot attribute.
+  const named = tick.config.project ?? projectName;
   const text =
-    `Fleet arming check. Reply to this chat with exactly:\n${code}\n` +
+    `Fleet arming check${named === undefined ? "" : ` — project ${named}`}. ` +
+    `Reply to this chat with exactly:\n${code}\n` +
     `Nothing will be dispatched until that reply is seen in the orchestrator session.`;
 
+  // Prefer the project's configured forum topic so arm challenges land where
+  // escalations already do (#318). Missing project config keeps flat-chat 0.13.
+  let topicId: number | undefined;
+  if (named !== undefined) {
+    try {
+      topicId = findProject(loadConfig(), named).escalation.telegramTopicId;
+    } catch {
+      /* no project config */
+    }
+  }
+
   const send = deps.sendChallenge ?? sendTelegramMessage;
   // Read before the send, not after: a transcript untouched since this instant
   // cannot contain the reply, and that is what the waiter filters on.
   const sentAt = (deps.now ?? Date.now)();
   try {
-    await send(token, channel.owner, text);
+    await send(token, channel.owner, text, topicId);
   } catch (err) {
     throw new Error(
       `arm: outbound sendMessage failed — NOT armed: ${err instanceof Error ? err.message : String(err)}`,
@@ -232,6 +393,11 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
 
   mkdirSync(dirname(path), { recursive: true });
   writeFileSync(path, `armed ${new Date().toISOString()} owner=${channel.owner}\n`, { mode: 0o600 });
+  // This project now has its own marker, so the shared one it was borrowing has
+  // done its last job. Left in place it would survive the next `disarm` as a
+  // marker that re-arms the fleet, and turn into a meaningless legacy warning
+  // the moment a second project is configured.
+  if (arm.legacy === "honoured") rmSync(legacyArmedMarkerPath(), { force: true });
   return { path, alreadyArmed, owner: channel.owner, challenge: code };
 }
 
@@ -258,13 +424,13 @@ export interface HaltWithPaneResult extends HaltResult {
 }
 
 export function hold(projectName?: string, source: string = "hold"): HoldResult {
-  const wasPaused = isPaused();
-  setPaused(true, { source });
+  const wasPaused = isPaused(projectName);
+  setPaused(true, { source }, projectName);
   return { wasPaused, disarmed: disarmTicks(projectName) };
 }
 
-export function releaseHold(): void {
-  setPaused(false);
+export function releaseHold(projectName?: string): void {
+  setPaused(false, undefined, projectName);
 }
 
 export async function halt(projectName?: string): Promise<HaltResult> {
@@ -312,11 +478,11 @@ export function resolvePaneHaltPath(projectName?: string): ResolvedPaneHalt {
 export function paneHaltPath(projectName?: string): string {
   const resolved = resolvePaneHaltPath(projectName);
   if (resolved.kind === "unresolved") {
-    // Verb-neutral: this is also the `release-pane` path.
+    // Verb-neutral: this is also `resume`'s pin-clearing path.
     throw new Error(
       `cannot locate the pane recovery pin — ${resolved.reason}. ` +
         `Drop a tick config beside the pane, or stop the agent by hand; ` +
-        `\`halt\` without \`--pane\` still stops the dispatch daemon.`,
+        `\`stop\` without \`--pane\` still stops the dispatch daemon.`,
     );
   }
   return resolved.path;
@@ -328,9 +494,9 @@ export function pinPaneHalt(projectName?: string): { path: string } {
   writeFileSync(
     path,
     [
-      `# Written by omp-conductor halt --pane at ${new Date().toISOString()}`,
+      `# Written by omp-conductor stop --pane at ${new Date().toISOString()}`,
       `# herdr-conductor recover.sh must not resume the fleet agent while this file exists.`,
-      `# Clear with: omp-conductor release-pane  (or rm this file)`,
+      `# Clear with: omp-conductor resume  (or rm this file)`,
       "",
     ].join("\n"),
     { mode: 0o600 },
@@ -338,6 +504,23 @@ export function pinPaneHalt(projectName?: string): { path: string } {
   return { path };
 }
 
+/**
+ * Clears the pin when its location is known, and reports plainly when it is not.
+ *
+ * Distinct from {@link clearPaneHalt}, which refuses an unresolvable location
+ * because pinning somewhere recovery never reads is worse than failing. `resume`
+ * needs the softer answer: it folds in the pin clear, and an operator resuming a
+ * fleet from a host with no tick config has no pin to clear rather than an error
+ * to work around.
+ */
+export function clearPaneHaltIfResolvable(projectName?: string): { path?: string; wasHalted: boolean } {
+  const resolved = resolvePaneHaltPath(projectName);
+  if (resolved.kind !== "ok") return { wasHalted: false };
+  const wasHalted = existsSync(resolved.path);
+  rmSync(resolved.path, { force: true });
+  return { path: resolved.path, wasHalted };
+}
+
 export function clearPaneHalt(projectName?: string): { path: string; wasHalted: boolean } {
   const path = paneHaltPath(projectName);
   const wasHalted = existsSync(path);
@@ -656,7 +839,9 @@ export async function stopConductorPane(
 
 async function herdrAgentList(deps: PaneStopDeps): Promise<HerdrAgent[]> {
   const bin = deps.herdrBin ?? "herdr";
-  const session = deps.herdrSession ?? process.env["HERDR_SESSION"] ?? "fleet";
+  const session =
+    deps.herdrSession ??
+    resolveHerdrSessionWithBridge({ env: process.env, herdrBin: bin });
   const res = spawnSync(bin, ["--session", session, "agent", "list"], {
     encoding: "utf8",
     timeout: 8_000,
@@ -730,7 +915,9 @@ export function parseHerdrAgentList(rawOutput: string): HerdrAgent[] {
 
 async function herdrOmpForegroundPids(paneId: string, deps: PaneStopDeps): Promise<number[]> {
   const bin = deps.herdrBin ?? "herdr";
-  const session = deps.herdrSession ?? process.env["HERDR_SESSION"] ?? "fleet";
+  const session =
+    deps.herdrSession ??
+    resolveHerdrSessionWithBridge({ env: process.env, herdrBin: bin });
   const res = spawnSync(bin, ["--session", session, "pane", "process-info", "--pane", paneId], {
     encoding: "utf8",
     timeout: 8_000,
@@ -836,7 +1023,7 @@ export interface FleetLayers {
 
 export function fleetLayers(projectName?: string): FleetLayers {
   const rec = livingDaemon();
-  const paused = isPaused();
+  const paused = isPaused(projectName);
   const dispatch: DispatchLayer = rec === undefined ? "stopped" : paused ? "paused" : "running";
 
   const tick = resolveTickConfig(projectName);
@@ -857,12 +1044,21 @@ export function fleetLayers(projectName?: string): FleetLayers {
     if (tick.config.armedFile === undefined) {
       ticks = "ungated";
       ticksDetail = "no armedFile in tick config — heartbeat sends without an arm marker";
-    } else if (existsSync(tick.config.armedFile)) {
-      ticks = "armed";
-      ticksDetail = tick.config.armedFile;
     } else {
-      ticks = "disarmed";
-      ticksDetail = tick.config.armedFile;
+      // The same decision the heartbeat itself makes, so status can never claim
+      // armed while the tick skips (or the reverse) — including the two shared
+      // marker cases: honoured through an upgrade on a single-project host,
+      // stranded once a second project exists.
+      const arm = resolveArmState(tick.config.armedFile, tick.config.project ?? projectName);
+      ticks = arm.armed ? "armed" : "disarmed";
+      ticksDetail =
+        arm.legacy === undefined
+          ? tick.config.armedFile
+          : `${tick.config.armedFile} — ${legacyArmedMarkerPath()}: ${
+              arm.legacy === "honoured"
+                ? "legacy global arm marker still honoured; re-arm this project to replace it"
+                : LEGACY_ARM_MARKER_DETAIL
+            }`;
     }
     const runtime = readTickRuntimeStatus(tick.cwd);
     if (runtime !== undefined && isAlive(runtime.pid)) nextTickAt = runtime.nextTickAt;
@@ -916,8 +1112,27 @@ export function codeGraphFromHealthz(body: string | undefined, project: string):
   if (body === undefined) return undefined;
   try {
     const parsed = JSON.parse(body) as Record<string, unknown>;
-    if (parsed["project"] !== project) return undefined;
-    const graph = parsed["codeGraph"];
+    let block: Record<string, unknown> | undefined;
+    if (parsed["project"] === project) {
+      block = parsed;
+    } else {
+      const projects = parsed["projects"];
+      if (Array.isArray(projects)) {
+        for (const entry of projects) {
+          if (
+            entry !== null &&
+            typeof entry === "object" &&
+            !Array.isArray(entry) &&
+            (entry as Record<string, unknown>)["project"] === project
+          ) {
+            block = entry as Record<string, unknown>;
+            break;
+          }
+        }
+      }
+    }
+    if (block === undefined) return undefined;
+    const graph = block["codeGraph"];
     if (graph === null || typeof graph !== "object" || Array.isArray(graph)) return undefined;
     const value = graph as Record<string, unknown>;
     if (value["configured"] === false) return { configured: false };
@@ -942,6 +1157,57 @@ export function codeGraphFromHealthz(body: string | undefined, project: string):
   }
 }
 
+
+/** Live worker pause phases from a daemon `/healthz` body for one project. */
+export function workerPhasesFromHealthz(
+  body: string | undefined,
+  project: string,
+): ReadonlyMap<number, WorkerPausePhase> {
+  const phases = new Map<number, WorkerPausePhase>();
+  if (body === undefined) return phases;
+  try {
+    const payload = JSON.parse(body) as unknown;
+    if (payload === null || typeof payload !== "object") return phases;
+    let block: object | undefined;
+    if (Reflect.get(payload, "project") === project) {
+      block = payload;
+    } else {
+      const projects = Reflect.get(payload, "projects");
+      if (Array.isArray(projects)) {
+        for (const entry of projects) {
+          if (
+            entry !== null &&
+            typeof entry === "object" &&
+            Reflect.get(entry, "project") === project
+          ) {
+            block = entry;
+            break;
+          }
+        }
+      }
+    }
+    if (block === undefined) return phases;
+    const workers = Reflect.get(block, "workers");
+    if (!Array.isArray(workers)) return phases;
+    for (const worker of workers) {
+      if (worker === null || typeof worker !== "object") continue;
+      const issue = Reflect.get(worker, "issue");
+      const phase = Reflect.get(worker, "phase");
+      if (
+        Number.isSafeInteger(issue) &&
+        (issue as number) > 0 &&
+        (phase === "pausing" || phase === "paused")
+      ) {
+        phases.set(issue as number, phase);
+      }
+    }
+  } catch {
+    // An unreadable health body means no trustworthy pause phase.
+  }
+  return phases;
+}
+
+
 export function formatCodeGraphHealth(graph: CodeGraphHealth, now = Date.now()): string | undefined {
   if (!graph.configured) return undefined;
   const indexed = graph.repos.filter((repo) => repo.index === "present").length;
@@ -971,6 +1237,7 @@ export function formatFleetStatus(
   brief: string | undefined = undefined,
   decisions: string | undefined = undefined,
   failureClasses: string | undefined = undefined,
+  workerPhases: ReadonlyMap<number, WorkerPausePhase> = new Map(),
 ): string {
   const tickLine =
     layers.ticksDetail === undefined
@@ -1032,12 +1299,12 @@ export function formatFleetStatus(
   const dispatchLine =
     layers.dispatch === "paused"
       ? (() => {
-          const prov = pauseProvenance();
+          const prov = pauseProvenance(s.project);
           if (prov !== undefined) {
             const reason = prov.reason === undefined ? "" : ` — "${prov.reason}"`;
             return `dispatch  paused (source: ${prov.source}${reason})`;
           }
-          return isPaused() && pausedAt() === undefined
+          return isPaused(s.project) && pausedAt(s.project) === undefined
             ? "dispatch  paused (unparseable sentinel — new work and completion mutations refused; release gates remain available)"
             : "dispatch  paused";
         })()
@@ -1057,7 +1324,7 @@ export function formatFleetStatus(
     ...(graphBlock === undefined ? [] : [graphBlock]),
     daemonBlock,
     "",
-    formatProjectBody(s),
+    formatProjectBody(s, workerPhases),
   ].join("\n");
 }
 
@@ -1088,7 +1355,10 @@ function formatDigestScheduleStatus(s: StatusSnapshot): string[] {
   ];
 }
 
-function formatProjectBody(s: StatusSnapshot): string {
+function formatProjectBody(
+  s: StatusSnapshot,
+  workerPhases: ReadonlyMap<number, WorkerPausePhase> = new Map(),
+): string {
   const lines = [
     `project   ${s.project}${s.paused ? "  (PAUSED)" : ""}`,
     ...(s.pauseReason === undefined ? [] : [`paused    ${s.pauseReason}`]),
@@ -1158,9 +1428,11 @@ function formatProjectBody(s: StatusSnapshot): string {
   } else {
     lines.push("active runs");
     for (const r of s.activeRuns) {
+      const phase = workerPhases.get(r.issue);
+      const state = phase === "pausing" || phase === "paused" ? phase : r.state;
       lines.push(
-        `  #${r.issue}  ${r.repo}  ${r.state}  attempt ${r.attempt}  ` +
-          `${r.turns}/${r.maxTurns} turns  $${r.spendUsd.toFixed(2)}  ${r.branch}` +
+        `  #${r.issue}  ${r.repo}  ${state}  attempt ${r.attempt}  ` +
+          `${r.turns}/${r.maxTurns} turns  ${r.spendUsd.toFixed(2)}  ${r.branch}` +
           (r.prUrl ? `  ${r.prUrl}` : ""),
       );
       // The orchestrator's Duty 1 reads this command, and a flagged run's
@@ -1203,6 +1475,7 @@ export async function renderStatus(projectName?: string): Promise<string> {
   ]);
   const cached = codeGraphFromHealthz(health?.body, project.name);
   const codeGraph = cached ?? (await probeCodeGraph(project));
+  const workerPhases = workerPhasesFromHealthz(health?.body, project.name);
   return formatFleetStatus(
     { ...s, planUsage, github },
     layers,
@@ -1213,6 +1486,7 @@ export async function renderStatus(projectName?: string): Promise<string> {
     briefStatusLine(project),
     decisionStatusLine(project.name),
     failureClassBlock(project.name),
+    workerPhases,
   );
 }
 
@@ -1433,14 +1707,14 @@ function makeChallengeCode(): string {
   return `FLEET-${hex}`;
 }
 
-async function sendTelegramMessage(token: string, owner: string, text: string): Promise<void> {
-  const url = `https://api.telegram.org/bot${token}/sendMessage`;
-  const body = new URLSearchParams({ chat_id: owner, text });
-  const res = await fetch(url, { method: "POST", body, signal: AbortSignal.timeout(20_000) });
-  const json = (await res.json()) as { ok?: boolean; description?: string };
-  if (!res.ok || json.ok !== true) {
-    throw new Error(json.description ?? `HTTP ${res.status}`);
-  }
+async function sendTelegramMessage(
+  token: string,
+  owner: string,
+  text: string,
+  topicId?: number,
+): Promise<void> {
+  // Shared transport: stale-topic retry + message_thread_id live in one place.
+  await sendTelegram(token, owner, text, { topicId });
 }
 
 interface SessionScan {
@@ -1607,7 +1881,7 @@ function probeOmpPane(
   }
   const agentName =
     tick.kind === "ok" ? (tick.config.agentName ?? DEFAULT_FLEET_AGENT_NAME) : DEFAULT_FLEET_AGENT_NAME;
-  const session = process.env["HERDR_SESSION"] ?? "fleet";
+  const session = resolveHerdrSessionWithBridge({ env: process.env });
   try {
     const res = spawnSync("herdr", ["--session", session, "agent", "list"], {
       encoding: "utf8",

package/src/generate-schema.ts

@@ -0,0 +1,21 @@
+/**
+ * Regenerator for `schema/config.schema.json`.
+ *
+ * Run via `bun run schema` from the package root. Writes the draft 2020-12 JSON
+ * Schema rendering of `ConfigSchema` (see `config-schema.ts`) to
+ * `schema/config.schema.json`, which ships in the package so editors can
+ * validate a hand-written config. The `config.test.ts` freshness lock fails
+ * when a committed schema drifts from what this script produces.
+ */
+
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { configJsonSchema } from "./config-schema.ts";
+
+const packageDir = join(dirname(fileURLToPath(import.meta.url)), "..");
+const schemaDir = join(packageDir, "schema");
+mkdirSync(schemaDir, { recursive: true });
+const out = join(schemaDir, "config.schema.json");
+writeFileSync(out, `${JSON.stringify(configJsonSchema(), null, 2)}\n`);
+console.log(`wrote ${out}`);