omp-conductor 0.15.0 → 0.15.2

package/README.md

@@ -583,12 +583,13 @@ Two words, and one of them takes a flag:
 | Verb | Claiming | Tick sends | Dispatch daemon | Conductor pane |
 | --- | --- | --- | --- | --- |
 | `hold` | paused | disarmed | left running | left running |
+| `hold --keep-ticks` | paused | **left armed** | left running | left running |
 | `stop` | paused | disarmed | stopped (systemctl-aware) | left running |
 | `stop --pane` | paused | disarmed | stopped | stopped + recovery pinned off |
 
 `resume` clears pause **and** any `stop --pane` recovery pin, and **never re-arms**. `arm` is proof-gated: it sends a Telegram challenge and writes the arm marker only after your reply appears as a *user* turn in the orchestrator transcript. `stop --pane` targets the configured conductor agent only — it does **not** run `systemctl stop herdr-fleet`. To bounce the daemon without stopping the fleet, use `restart`.
 
-**Removed in 0.15.0**, each exiting `2` with a pointer: `halt` (now `stop`), `pause` (use `hold`), `release-pane` (now part of `resume`), and `graph-setup` (now [`setup graph`](#code-graph-discovery)). Dropping `pause` means the CLI no longer offers "stop claiming but keep ticking" — the state still exists internally (`upgrade` passes through it while draining), but as an operator verb the model is now three words instead of five.
+**Removed in 0.15.0**, each exiting `2` with a pointer: `halt` (now `stop`), `pause` (use `hold`), `release-pane` (now part of `resume`), and `graph-setup` (now [`setup graph`](#code-graph-discovery)). Dropping `pause` cost one real capability, "stop claiming but keep ticking", which is now `hold --keep-ticks` rather than a fifth verb. It matters because disarming is the expensive half of a hold: re-arming sends a Telegram challenge and blocks until you answer it in the chat, so stopping claims for ten minutes otherwise costs a manual round trip to get the heartbeat back — while the workers a hold deliberately leaves running have nothing shepherding them.
 
 `status` prints a layered header (`dispatch` / `ticks` / next tick time / `pane` / `recovery` / `herdr` / `telegram` / `daemon`) so a paused fleet cannot hide an armed orchestrator still spending turns. The Telegram line calls the official `getMe` endpoint to prove the token and API are usable without sending a message, then separately reports whether the inbound bridge is configured.
 
@@ -2036,7 +2037,7 @@ writes this file for external orchestration. A manual configuration has this for
 | `intervalSeconds` | yes | — | Whole seconds between ticks, minimum `60`. A tick costs a full turn of a frontier model, so a sub-minute period is refused rather than obeyed. |
 | `project` | no | the only configured project | Which conductor project this fleet session ticks for. `setup host` stamps it, one tick config per fleet cwd, and it is what lets a host with several configured projects resolve *this* fleet's brief, reporting policy, digest ledger and release grants. Omitting it is the pre-multi-project spelling: correct on a single-project host, and on a host with two or more it degrades every tick to the default reporting scope with no release grants — `status` and the tick log then name the one fix (`re-run omp-conductor setup host`). A name no configured project has degrades the same way. |
 | `budgetSeconds` | no | `600` | Seconds a turn may run before the tick guard refuses its remaining tool calls (#189), and before a queued operator message preempts them. An integer ≥ 60; anything else degrades to the default. |
-| `armedFile` | no | none — the gate passes | Path to the arm marker. A tick does nothing while the file is missing. Relative paths resolve against the session cwd, so `state/armed` means `<cwd>/state/armed`. `setup host` writes `<state dir>/armed-<project>`, one marker per project, so `arm --project A` cannot arm B. A value it did not generate is left alone as your own choice. |
+| `armedFile` | no | none — the gate passes | Path to the arm marker. A tick does nothing while the file is missing. **Re-read from disk on every tick**, so a `setup host` restamp onto `armed-<project>` binds on the next heartbeat instead of leaving a live pane watching the path it captured at session start. Relative paths resolve against the session cwd, so `state/armed` means `<cwd>/state/armed`. `setup host` writes `<state dir>/armed-<project>`, one marker per project, so `arm --project A` cannot arm B. A value it did not generate is left alone as your own choice. |
 | `accessFile` | no | none — the gate passes | Path to the Telegram bridge's `access.json`. Every tick re-reads it and requires `enabled: true` with exactly one entry in `allowFrom`. Relative paths resolve against the session cwd. **Configure this on any fleet deploy** — see below. |
 | `message` | no | `Tick <ISO timestamp>: re-read <workspaceRoot>/ORCHESTRATOR.md from disk, then run your standing loop from it.`, then the reporting-policy line, delivery rule, and mechanical availability state | When set, this text replaces the ordinary reporting-policy line and delivery rule, but the runtime-owned availability state is still appended: a custom prompt cannot infer whether the operator may be interrupted. Re-read from disk on **every** tick, so rewording it binds the next heartbeat instead of waiting for a session restart; a re-read that fails — caught mid-edit, removed, or invalid — keeps the value read at session start rather than stopping the heartbeat. `intervalSeconds` is *not* re-read: rescheduling a live timer still needs a restart. The default *orders* the session to re-read its brief, naming the path resolved from the project's `workspaceRoot`, because a standing prompt drifts out of a long-lived session's context while the file on disk does not. |
 | `agentName` | no | the project name, else `fleet` | The herdr agent name the orchestrator's pane is registered under. Under herdr this is the whole of the identity check below. `setup host` writes the project name, so two fleets in one herdr session are distinguishable; when no tick config names one, the fallback matches `AGENT_NAME=${AGENT_NAME:-fleet}` in the recovery plugin's `recover.sh`, so both halves key on one name. Rename the agent and set this to match. |
@@ -2085,6 +2086,12 @@ line — the heartbeat fails closed and says so rather than letting two fleets b
 answer to `fleet`. Set `agentName` explicitly if you would rather keep the old
 name; a value that is not the shared default is never rewritten.
 
+The marker itself needs no restart: `armedFile` is re-read from disk every tick, so
+the restamped path binds on the next heartbeat. Before 0.15.2 it was read once at
+session start, and a restamp under a live pane left that pane watching a path the
+restamp had just replaced — `status` reported `armed` from the file while the
+heartbeat skipped silently as "not armed", which writes no stall marker.
+
 Recovery is fail-closed across that window. A restamped `agentName` moves the
 recovery plugin's own state files to per-agent paths that do not exist yet, and
 the live pane is still saved under `fleet`, so the snapshot offers no candidate
@@ -2295,7 +2302,7 @@ omp-conductor upgrade [--to VERSION] [--project NAME]
 omp-conductor status [--project NAME]
 omp-conductor ledger [--issue N] [--limit N] [--project NAME]
 omp-conductor board [--project NAME]
-omp-conductor hold [--project NAME]
+omp-conductor hold [--keep-ticks] [--project NAME]
 omp-conductor stop [--pane] [--project NAME]
 omp-conductor arm [--project NAME]
 omp-conductor disarm [--project NAME]
@@ -2331,7 +2338,7 @@ omp-conductor help
 | `status [--project NAME]` | Layered fleet report first: `dispatch` / `ticks` / next scheduled tick / `pane` / `recovery` / `herdr` / `telegram` / `brief` / `decisions` / optional `failure classes` and `code graph` / `daemon`, then the project body. The project body includes the latest completed dispatch timestamp, ready/routed/admitted counts, bounded hold groups, and the GitHub API budget (`graphql` / `core` remaining and reset, in the caps block); API failures are marked `DEGRADED` so queue starvation cannot look idle. Active-run lines overlay cooperative worker `paused`/`pausing` from `/healthz` without changing SQLite `running` state or the live worker count. The next tick comes from the live heartbeat process, not a guess from log timestamps. Telegram health uses `getMe` to prove API authentication without sending a message and reports inbound bridge configuration separately. Configured graphs report prerequisites, indexed repos, timer state, and refresh freshness without blocking dispatch. A `reports` block lists everything the outbox has not delivered, with its age, and prints `pending` (nobody has it) differently from `SENDING` (outcome unknown, it may already have arrived) — see [Report delivery](#report-delivery-the-outbox). The daemon block includes `rss` from `/healthz`; live workers add a busy-deploy warning. A `.conductor-stalled` marker adds an `orchestrator STALLED since …` line. |
 | `ledger [--issue N] [--limit N]` | The action audit: every [mediated-verb](#the-mediated-verbs-126) mutation and every next-attempt turn budget. Verb entries include the arguments, decision, named refusal, and resulting SHA. Turn-budget entries remain after an override is replaced or consumed. Reads (`conductor_pr_status`) are absent so polling cannot bury the signal. `--issue` narrows both histories; `--limit` defaults to 50. Recent verb refusals and pending turn overrides also appear in `status`. |
 | `board [--project NAME]` | Live keyboard-driven kanban over the same SQLite and `/healthz` truth as `status`, plus the tracker's current labels: Queue, Claimed, Running, Green, Blocked, Failed, Orphaned, the last 24 hours of Merged and Settled, and Parked (an issue the tracker has not confirmed closed — still open, or a label read that failed — so nothing dispatches it until a human labels it). Columns are mutually exclusive and describe current state, not the newest run row, so a requeued issue is queued rather than failed and a closed issue is neither. Refreshes run/spend/turn values every second, and health plus the label read every ten seconds. `Enter` follows the selected transcript in place; `u` invokes the existing unblock workflow on a Blocked, Failed, or Orphaned card; `i` / `p` open the issue / PR; `r` refreshes health; `?` shows all keys. Requires an interactive terminal of at least 50×20. |
-| `hold [--project NAME]` | Soft stop: pause claiming **and** disarm ticks. Daemon and pane stay up. Prefer this when the intent is "stop the conductor" without killing processes. See [Stop the conductor](#stop-the-conductor-hold--stop). |
+| `hold [--keep-ticks] [--project NAME]` | Soft stop: pause claiming **and** disarm ticks. Daemon and pane stay up. Prefer this when the intent is "stop the conductor" without killing processes. `--keep-ticks` pauses claiming but leaves the arm marker, so the heartbeat keeps reporting and `resume` alone restores the fleet — no fresh arm challenge. See [Stop the conductor](#stop-the-conductor-hold--stop). |
 | `stop [--pane] [--project NAME]` | Stop the conductor: pause claiming, disarm ticks, then stop the dispatch daemon (systemctl-aware). Pane stays up unless `--pane` is passed. `stop --pane` also pins herdr-conductor recovery off for the conductor agent only — it does **not** stop `herdr-fleet.service` or any other herdr session. Fail-closed: exits nonzero unless the agent is proven gone. To bounce the daemon without stopping the fleet, use `restart`. |
 | `arm [--project NAME]` | Proof-gated: send a Telegram challenge and write this project's arm marker only after your reply appears as a user turn in the orchestrator transcript. The challenge names the project, so a host running two fleets is not ambiguous. Never auto-armed by `resume` / `hold`. |
 | `disarm [--project NAME]` | Remove this project's arm marker so its ticks skip; another project's ticks keep running. Also clears a pre-per-project shared `armed` marker while that marker is still what holds this fleet's gate open — otherwise the disarm would not disarm. Processes untouched. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.15.0",
+  "version": "0.15.2",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/cli.ts

@@ -105,7 +105,7 @@ usage:
   omp-conductor board [--project NAME] [--json]
   omp-conductor status [--project NAME]
   omp-conductor ledger [--issue N] [--limit N] [--project NAME]
-  omp-conductor hold [--project NAME | --all]
+  omp-conductor hold [--keep-ticks] [--project NAME | --all]
   omp-conductor arm [--project NAME | --all]
   omp-conductor disarm [--project NAME | --all]
   omp-conductor tail <issue> [--project NAME]
@@ -638,11 +638,18 @@ try {
     // `restart`, which is what the removed kill-only `stop` was reached for.
     case "stop": {
       const withPane = argv.includes("--pane");
-      const targets = targetProjects().map((project) => ({
-        project,
-        hold: hold(project.name, "halt"),
-        pin: withPane ? pinPaneHalt(project.name).path : undefined,
-      }));
+      const targets = targetProjects().map((project) => {
+        // `stop` takes the fleet down, so it always disarms — `--keep-ticks` is a
+        // `hold` affordance. Assert the invariant instead of printing a path that
+        // might not exist.
+        const held = hold(project.name, "halt");
+        if (held.disarmed === undefined) throw new Error("stop must disarm ticks");
+        return {
+          project,
+          hold: { ...held, disarmed: held.disarmed },
+          pin: withPane ? pinPaneHalt(project.name).path : undefined,
+        };
+      });
       const stop = await stopDaemon();
       const stopLine =
         stop.kind === "not-running"
@@ -820,14 +827,17 @@ try {
     }
 
     case "hold": {
+      const keepTicks = argv.includes("--keep-ticks");
       for (const project of targetProjects()) {
-        const r = hold(project.name);
+        const r = hold(project.name, "hold", keepTicks ? { keepTicks: true } : {});
         process.stdout.write(
           `held — claiming paused` +
             `${r.wasPaused ? " (already paused)" : ""}` +
-            `; ticks disarmed at ${r.disarmed.path}` +
-            `${r.disarmed.wasArmed ? "" : " (was already disarmed)"}\n` +
-            `daemon and pane left running; stop to stop the daemon too\n`,
+            (r.disarmed === undefined
+              ? "; ticks left armed — resume restores the fleet with no new arm challenge"
+              : `; ticks disarmed at ${r.disarmed.path}` +
+                `${r.disarmed.wasArmed ? "" : " (was already disarmed)"}`) +
+            `\ndaemon and pane left running; stop to stop the daemon too\n`,
         );
       }
       break;

package/src/fleet.ts

@@ -403,11 +403,13 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
 
 export interface HoldResult {
   wasPaused: boolean;
-  disarmed: { path: string; wasArmed: boolean };
+  /** Absent when the caller kept the heartbeat armed. */
+  disarmed?: { path: string; wasArmed: boolean };
 }
 
 export interface HaltResult {
-  hold: HoldResult;
+  /** `stop` always disarms, so callers can print the marker path unconditionally. */
+  hold: HoldResult & { disarmed: NonNullable<HoldResult["disarmed"]> };
   stop: StopResult;
 }
 
@@ -423,9 +425,26 @@ export interface HaltWithPaneResult extends HaltResult {
   pane: PaneStopResult;
 }
 
-export function hold(projectName?: string, source: string = "hold"): HoldResult {
+/**
+ * Stop claiming, leave the daemon and pane up.
+ *
+ * `keepTicks` is the old `pause` shape, and it is not a nicety: disarming is the
+ * expensive half of a hold. Re-arming sends a Telegram challenge and blocks on the
+ * operator answering it in the chat, so an operator who only wanted to stop new
+ * claims for ten minutes pays a manual round trip to get the heartbeat back — and
+ * meanwhile nothing shepherds the workers already in flight, which a hold
+ * deliberately leaves running. Keeping the marker means `resume` alone restores
+ * the fleet. The tick never consults the pause sentinel, so a held fleet with
+ * armed ticks keeps reporting while it claims nothing.
+ */
+export function hold(
+  projectName?: string,
+  source: string = "hold",
+  opts: { keepTicks?: boolean } = {},
+): HoldResult {
   const wasPaused = isPaused(projectName);
   setPaused(true, { source }, projectName);
+  if (opts.keepTicks === true) return { wasPaused };
   return { wasPaused, disarmed: disarmTicks(projectName) };
 }
 
@@ -435,8 +454,12 @@ export function releaseHold(projectName?: string): void {
 
 export async function halt(projectName?: string): Promise<HaltResult> {
   const held = hold(projectName, "halt");
+  // `keepTicks` is a `hold` affordance: taking the fleet down always disarms, and
+  // callers print the marker path. Assert the invariant rather than defaulting a
+  // path we would then print as fact.
+  if (held.disarmed === undefined) throw new Error("stop must disarm ticks");
   const stop = await stopDaemon();
-  return { hold: held, stop };
+  return { hold: { ...held, disarmed: held.disarmed }, stop };
 }
 
 /**
@@ -1021,9 +1044,29 @@ export interface FleetLayers {
   daemon: { running: boolean; pid?: number; port?: number };
 }
 
+/**
+ * The project a bare read means, when the config leaves no doubt.
+ *
+ * The lifecycle verbs resolve their target before writing, so `hold` on a
+ * single-project host writes `paused-<name>`. A status read that passed
+ * `undefined` straight through saw only the legacy global sentinel and reported
+ * `dispatch running` for a fleet the operator had just held — control and status
+ * disagreeing about the same fleet, which is the one thing this surface exists to
+ * settle. A host with several projects and no name keeps the legacy-only read:
+ * guessing which project a bare `status` meant is what {@link findProject}
+ * refuses to do.
+ */
+function bareReadProject(): string | undefined {
+  try {
+    return findProject(loadConfig()).name;
+  } catch {
+    return undefined;
+  }
+}
+
 export function fleetLayers(projectName?: string): FleetLayers {
   const rec = livingDaemon();
-  const paused = isPaused(projectName);
+  const paused = isPaused(projectName ?? bareReadProject());
   const dispatch: DispatchLayer = rec === undefined ? "stopped" : paused ? "paused" : "running";
 
   const tick = resolveTickConfig(projectName);

package/src/orchestrator-tick.ts

@@ -1462,6 +1462,35 @@ function currentMessage(cwd: string, startup: TickConfig): string | undefined {
   return reread.kind === "ok" ? reread.config.message : startup.message;
 }
 
+/**
+ * The tick config fields honoured live, as they are on disk *now*, same contract as
+ * {@link currentMessage}: a successful re-read owns the answer, a failed one
+ * keeps the startup value.
+ *
+ * `setup host` restamps `armedFile` and `project` under a live pane — that is
+ * how a fleet moves onto its per-project arm marker (#317). Reading the path
+ * captured at session start instead meant the restamp silently killed the
+ * heartbeat: `status` reads the file and reports `armed`, while the tick kept
+ * checking the path the restamp had just replaced, skipped as "not armed" —
+ * a reason that deliberately writes no stall marker — and the fleet stopped
+ * ticking until somebody noticed and restarted the pane.
+ *
+ * `intervalSeconds` stays startup-only: rescheduling a live managed timer is a
+ * different change and still needs a restart.
+ */
+function currentConfig(
+  cwd: string,
+  startup: TickConfig,
+): { armedFile?: string; accessFile?: string; project?: string } {
+  const reread = readTickConfig(cwd);
+  const live = reread.kind === "ok" ? reread.config : startup;
+  return {
+    ...(live.armedFile === undefined ? {} : { armedFile: live.armedFile }),
+    ...(live.accessFile === undefined ? {} : { accessFile: live.accessFile }),
+    ...(live.project === undefined ? {} : { project: live.project }),
+  };
+}
+
 /**
  * Marker writes are best-effort by construction. This runs inside the loop
  * whose whole job is to keep prompting a session; a read-only filesystem, a
@@ -1518,7 +1547,15 @@ export function requestImmediateTick(cwd: string, reason: string): boolean {
 }
 
 /** First non-empty token after the optional ISO stamp on a poke line. */
-export function readTickRequestReason(cwd: string): string | undefined {
+/**
+ * The poke's first line verbatim, which is its identity.
+ *
+ * Both writers stamp an ISO timestamp (`${iso} ${reason}`), so two distinct
+ * requests never share a line and a request that is still sitting there
+ * unconsumed always does. That is what lets the mid-interval poll act once per
+ * request instead of once per poll.
+ */
+function readTickRequestLine(cwd: string): string | undefined {
   const path = join(cwd, TICK_REQUESTED_FILE);
   if (!existsSync(path)) return undefined;
   let raw: string;
@@ -1528,7 +1565,12 @@ export function readTickRequestReason(cwd: string): string | undefined {
     return undefined;
   }
   const line = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
-  if (line.length === 0) return undefined;
+  return line.length === 0 ? undefined : line;
+}
+
+export function readTickRequestReason(cwd: string): string | undefined {
+  const line = readTickRequestLine(cwd);
+  if (line === undefined) return undefined;
   const parts = line.split(/\s+/);
   if (parts.length === 0) return undefined;
   // recover.sh writes `${iso} recover`; a bare reason is also accepted.
@@ -1824,7 +1866,8 @@ interface TickSession {
  * otherwise emit a notification every interval, forever.
  */
 function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSession): void {
-  const arm = config.armedFile === undefined ? undefined : resolveArmState(config.armedFile, config.project);
+  const live = currentConfig(ctx.cwd, config);
+  const arm = live.armedFile === undefined ? undefined : resolveArmState(live.armedFile, live.project);
   if (arm?.legacy === "stranded" && !session.legacyArmLogged) {
     session.legacyArmLogged = true;
     pi.logger.error(
@@ -1833,7 +1876,7 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
   }
   const decision = tickDecision({
     armed: arm === undefined || arm.armed,
-    channelOk: config.accessFile === undefined || channelIsUp(config.accessFile),
+    channelOk: live.accessFile === undefined || channelIsUp(live.accessFile),
     hasPending: ctx.hasPendingMessages(),
   });
 
@@ -1859,9 +1902,9 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
 
   // Floor refresh is independent of which prompt we send: a custom message still
   // expects ORCHESTRATOR.md / AGENTS.md to track the installed package.
-  refreshComposedBriefBestEffort(config.project);
+  refreshComposedBriefBestEffort(live.project);
 
-  const scope = resolveTickScope(config.project);
+  const scope = resolveTickScope(live.project);
   // The transport contract, read once from the same file at the same moment so
   // the approval line, the delivery rule and the narration line cannot disagree
   // (#169, #179). No access file means no fleet channel to judge; a session
@@ -1869,10 +1912,10 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
   // fail toward "not delivered" — the durable outbox instruction — rather than
   // asserting a delivery the bridge cannot make.
   const approval =
-    config.accessFile === undefined
+    live.accessFile === undefined
       ? undefined
       : session.bridgeTokenAtStart
-        ? readApprovalSurface(config.accessFile)
+        ? readApprovalSurface(live.accessFile)
         : ({
             kind: "missing",
             reason:
@@ -1881,9 +1924,9 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
               "now — run `/telegram on` in this session, or restart it, to rebind the bridge",
           } as const);
   const profile =
-    config.accessFile === undefined || !session.bridgeTokenAtStart
+    live.accessFile === undefined || !session.bridgeTokenAtStart
       ? undefined
-      : readDaemonProfile(config.accessFile);
+      : readDaemonProfile(live.accessFile);
 
   // A configured message owns the ordinary reporting and delivery clauses.
   // Mechanical evidence is different: release-policy drift and repeated
@@ -2181,8 +2224,28 @@ function armTickHeartbeat(pi: TickApi, ctx: TickContext, config: TickConfig, ses
   // interval cannot arm a second timer faster than the primary.
   const pollMs = Math.min(TICK_REQUEST_POLL_MS, config.intervalSeconds * 1000);
   if (pollMs < config.intervalSeconds * 1000) {
+    // One attempt per request, not one per poll. `clearTickRequest` only fires
+    // on a successful send, so a request the gates refuse — disarmed fleet,
+    // bridge down — stays on disk by design. Acting on it every poll turned that
+    // into a 10s hot loop that re-entered `tick()` forever and kept rewriting the
+    // runtime status. Remembering the line we already tried leaves the fixed
+    // heartbeat as the fallback for that request, and still wakes promptly for
+    // the next distinct one.
+    let attempted: string | undefined;
     ctx.setInterval(() => {
-      if (!existsSync(join(ctx.cwd, TICK_REQUESTED_FILE))) return;
+      const line = readTickRequestLine(ctx.cwd);
+      if (line === undefined) {
+        // Cleared: a send landed, or an operator removed it. Re-arm for the next.
+        attempted = undefined;
+        return;
+      }
+      // A live turn owns the session. Coalesce by leaving the request on disk and
+      // trying again next poll — without re-entering `tick()`, which would drive
+      // the pending-skip counter at poll cadence and forge a stall diagnosis in
+      // seconds when STALL_TICKS is calibrated for heartbeat intervals.
+      if (ctx.hasPendingMessages()) return;
+      if (line === attempted) return;
+      attempted = line;
       const reason = readTickRequestReason(ctx.cwd) ?? "wake";
       pi.logger.info(
         `[omp-conductor] tick requested by ${reason} — firing without waiting for the interval`,

package/src/setup-host.ts

@@ -72,6 +72,21 @@ function systemdQuote(value: string): string {
   return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("%", "%%")}"`;
 }
 
+/**
+ * A bare path for the settings that take exactly one, never a quoted word list.
+ *
+ * `Environment=` and `ExecStart=` unquote their values, so {@link systemdQuote}
+ * is right there. `WorkingDirectory=` does not: systemd reads the whole value as
+ * the path, so a quoted one fails `systemd-analyze verify` with "path is not
+ * absolute" and the unit refuses to start — a landmine that only fires on the
+ * next restart, because the running daemon keeps the unit it started with.
+ * Spaces need no quoting here; `%` still does, or it reads as a specifier.
+ */
+function systemdPath(value: string): string {
+  if (/\r|\n/.test(value)) throw new Error("systemd values cannot contain newlines");
+  return value.replaceAll("%", "%%");
+}
+
 function shellQuote(value: string): string {
   return `'${value.replaceAll("'", "'\\''")}'`;
 }
@@ -268,7 +283,7 @@ export function renderDaemonService(runtime: ServiceRuntime, totalWorkers: numbe
     `Environment=${systemdQuote(`PATH=${runtime.path}`)}`,
     `Environment=${systemdQuote(`OMP_CONDUCTOR_HOME=${runtime.conductorHome}`)}`,
     `Environment=${systemdQuote(`OMP_TELEGRAM_STATE_DIR=${runtime.telegramStateDir}`)}`,
-    `WorkingDirectory=${systemdQuote(stateDir())}`,
+    `WorkingDirectory=${systemdPath(stateDir())}`,
     `ExecStart=${command.map(systemdQuote).join(" ")}`,
     "Restart=on-failure",
     "SuccessExitStatus=0 143",