omp-conductor 0.15.11 → 0.15.13

package/src/doctor.ts

@@ -27,18 +27,38 @@
 
 import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";
+import { homedir } from "node:os";
 import { join } from "node:path";
 import type { Stats } from "node:fs";
 import { Database } from "bun:sqlite";
 
 import { configBackupDir, configPath, findProject, loadConfig, resolveCaps, stateDir } from "./config.ts";
-import { DEFAULT_HERDR_UNIT, probeTelegramHealth, telegramStateDir, type TelegramHealth } from "./fleet.ts";
-import { planHostRuntime, STAGED_SERVICE_NAME, SYSTEMD_UNIT_DIR, totalConfiguredWorkers } from "./setup-host.ts";
+import {
+  DEFAULT_HERDR_UNIT,
+  probeTelegramHealth,
+  resolveHerdrSessionWithBridge,
+  telegramStateDir,
+  type TelegramHealth,
+} from "./fleet.ts";
+import {
+  herdrConductorPluginConfigDir,
+  planHostRuntime,
+  STAGED_SERVICE_NAME,
+  SYSTEMD_UNIT_DIR,
+  tickCwdForProject,
+  totalConfiguredWorkers,
+} from "./setup-host.ts";
 import { checkTokenScopes, type ScopeCheck } from "./setup.ts";
 import { dbPath, LIVE_STATES } from "./store.ts";
 import { telegramReportSend, type ReportSend } from "./reports.ts";
 import { fetchRateLimit, GhError, gh } from "./tracker/github.ts";
 import { repoSlugFor } from "./gitops.ts";
+import {
+  DEFAULT_FLEET_AGENT_NAME,
+  parseHerdrAgents,
+  readTickConfig,
+  type HerdrAgentList,
+} from "./orchestrator-tick.ts";
 import type { ConductorConfig, ProjectConfig, RepoTarget, RunState } from "./types.ts";
 
 /**
@@ -148,6 +168,20 @@ export interface DoctorDeps {
   telegramSend?: (project: ProjectConfig) => ReportSend;
   /** The canonical units to compare the installed units against. */
   canonicalUnits?: (project: ProjectConfig, cfg: ConductorConfig) => CanonicalUnits;
+  /** Whether herdr is installed on this host (a `herdr` on PATH). */
+  herdrInstalled?: () => boolean;
+  /** Live `herdr --session <s> agent list`, parsed through the tick's own
+   *  parser (the same "one JSON line on stdout" contract recover.sh reads). */
+  herdrAgents?: (session: string) => HerdrAgentList;
+  /** The fleet session name, for the rename fix line. */
+  herdrSession?: () => string;
+  /** The live herdr config at `~/.config/herdr/config.toml`, or undefined. */
+  herdrConfig?: () => string | undefined;
+  /** The live herdr-conductor plugin `config.env`, or undefined. */
+  herdrEnv?: () => string | undefined;
+  /** The fleet agent name the tick config of one project names, or undefined
+   *  when there is no (readable) tick — the expected live herdr pane identity. */
+  tickAgentName?: (project: ProjectConfig) => string | undefined;
   /** Clock, so a run is deterministic in tests. */
   now?: () => number;
   /** The one opt-in side effect: send one self-identified Telegram probe. */
@@ -462,7 +496,7 @@ async function labelProbe(probes: Probes, project: ProjectConfig): Promise<Findi
   if (!read.ok) {
     return failFinding(
       "labels",
-      `cannot read the labels of ${project.tracker.repo}${read.detail === undefined ? "" : ` (${read.detail})`}`,
+      `[${project.name}] cannot read the labels of ${project.tracker.repo}${read.detail === undefined ? "" : ` (${read.detail})`}`,
       "check `gh` can list that repo's labels — the daemon reads them the same way",
     );
   }
@@ -474,7 +508,7 @@ async function labelProbe(probes: Probes, project: ProjectConfig): Promise<Findi
   }
   const missing = wanted.filter((w) => !present.has(w.name));
   if (missing.length === 0) {
-    return passFinding("labels", `${wanted.length} configured label(s) on ${project.tracker.repo} match exactly`);
+    return passFinding("labels", `[${project.name}] ${wanted.length} configured label(s) on ${project.tracker.repo} match exactly`);
   }
   const detail = missing.map((m) => {
     const near = nearByName.get(norm(m.name));
@@ -486,17 +520,60 @@ async function labelProbe(probes: Probes, project: ProjectConfig): Promise<Findi
   });
   return failFinding(
     "labels",
-    `${detail.join("; ")} — ${INCIDENTS.labels}`,
+    `[${project.name}] ${detail.join("; ")} — ${INCIDENTS.labels}`,
     allNearMisses
       ? "fix the label case/format in the tracker repo (or change the config to the actual spelling)"
       : "create the missing label(s) in the tracker repo (`gh label create`, or re-run `omp-conductor setup`)",
   );
 }
 
-/** Line-level drift between an installed unit and the canonical render. */
+/**
+ * A unit line whose canonical value is a property of the *rendering process*,
+ * not the deployment. The herdr unit's `Environment="SHELL=…"` carries the
+ * account's login shell as it resolved in the process that staged it (#463 —
+ * the pane-shell pin that keeps panes off dash). Doctor cannot re-derive that
+ * value: in a non-login/tick context `userInfo().shell` resolves to nothing and
+ * renders `SHELL=unknown`, while the unit that was actually staged carries
+ * `SHELL=/bin/bash`. Comparing against a value that answers to "whoever asked"
+ * can never pass, so it is excluded from the drift comparison and reported as
+ * not-comparable, never as drift (#511).
+ */
+const PROCESS_DERIVED_UNIT_LINE = /^Environment="SHELL=/;
+
+/**
+ * Whether a canonical unit's pane-shell value could not be resolved — the
+ * `SHELL=` pin rendered when the invoking process has no login shell (an empty
+ * value, or the literal `unknown` userInfo returns in a non-login context).
+ * Excluded from the drift comparison, such a value is reported as
+ * not-comparable rather than implied to match (#511).
+ */
+function unresolvableShell(unit: string): boolean {
+  const line = unit
+    .split("\n")
+    .map((l) => l.trim())
+    .find((l) => PROCESS_DERIVED_UNIT_LINE.test(l));
+  if (line === undefined) return false;
+  const value = /^Environment="SHELL=(.*)"$/.exec(line)?.[1] ?? "";
+  return value === "" || value === "unknown";
+}
+
+/**
+ * Line-level drift between an installed unit and the canonical render, ignoring
+ * lines whose canonical value is not re-derivable by doctor (the
+ * {@link PROCESS_DERIVED_UNIT_LINE} pane-shell pin). The pane shell is host
+ * state resolved at staging time, so a rendered value doctor cannot reproduce
+ * is excluded from both sides rather than reported as a difference — an
+ * unresolvable canonical is "cannot compare", never drift (#511).
+ */
 export function unitDrift(installed: string, canonical: string): { differences: string[] } {
-  const want = canonical.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
-  const have = installed.split("\n").map((l) => l.trim()).filter((l) => l.length > 0);
+  const want = canonical
+    .split("\n")
+    .map((l) => l.trim())
+    .filter((l) => l.length > 0 && !PROCESS_DERIVED_UNIT_LINE.test(l));
+  const have = installed
+    .split("\n")
+    .map((l) => l.trim())
+    .filter((l) => l.length > 0 && !PROCESS_DERIVED_UNIT_LINE.test(l));
   const wantSet = new Set(want);
   const haveSet = new Set(have);
   const differences = [
@@ -516,8 +593,9 @@ function driftLines(name: string, installed: string, canonical: string): string[
 
 /**
  * Installed unit vs the canonical staged rendering: any drift in User=,
- * Environment, WorkingDirectory, ExecStart, Restart/SuccessExitStatus, or
- * memory lines is the unit-drift class that once killed workers at turn 0.
+ * Environment (save the process-derived pane shell, which is not comparable),
+ * WorkingDirectory, ExecStart, Restart/SuccessExitStatus, or memory lines is
+ * the unit-drift class that once killed workers at turn 0.
  */
 function unitProbe(probes: Probes, project: ProjectConfig | undefined, cfg: ConductorConfig | undefined): Finding {
   if (!probes.hasSystemd()) return passFinding("systemd-unit", "no systemd directory on this host — nothing to check");
@@ -530,16 +608,21 @@ function unitProbe(probes: Probes, project: ProjectConfig | undefined, cfg: Cond
     return warnFinding("systemd-unit", `${STAGED_SERVICE_NAME} is not installed`, "install it: run `omp-conductor setup host` from the fleet account");
   }
   const problems = driftLines(STAGED_SERVICE_NAME, installedDaemon, canonical.daemon);
+  const uncomparable: string[] = [];
   if (canonical.herdr !== undefined) {
     const installedHerdr = probes.readUnit(join(SYSTEMD_UNIT_DIR, DEFAULT_HERDR_UNIT));
     if (installedHerdr === undefined) {
       problems.push(`${DEFAULT_HERDR_UNIT} is not installed (the staged plan provisions it)`);
     } else {
+      if (unresolvableShell(canonical.herdr)) {
+        uncomparable.push("the pane-shell SHELL value is not comparable (it resolves from this process, not the deployment)");
+      }
       problems.push(...driftLines(DEFAULT_HERDR_UNIT, installedHerdr, canonical.herdr));
     }
   }
   if (problems.length === 0) {
-    return passFinding("systemd-unit", "installed units match the staged render");
+    const note = uncomparable.length === 0 ? "" : ` — ${uncomparable.join("; ")}`;
+    return passFinding("systemd-unit", `installed units match the staged render${note}`);
   }
   return failFinding(
     "systemd-unit",
@@ -548,6 +631,46 @@ function unitProbe(probes: Probes, project: ProjectConfig | undefined, cfg: Cond
   );
 }
 
+/** The `OnFailure=` targets an installed unit names, each a systemd unit file. */
+function onFailureTargets(unitText: string): string[] {
+  return (unitText.match(/^OnFailure=(.*)$/gm) ?? []).flatMap((line) =>
+    line.slice("OnFailure=".length).trim().split(/\s+/).filter(Boolean),
+  );
+}
+
+/**
+ * Every `OnFailure=` target an installed fleet unit names must itself be
+ * installed. The fleet units carry the line from day one (#485); the failure
+ * this check exists for is the line present while the recovery oneshot it
+ * names is not installed — so systemd silently refuses to enqueue the job and
+ * a failed unit never recovers (#509).
+ */
+function recoveryProbe(probes: Probes): Finding {
+  if (!probes.hasSystemd()) return passFinding("systemd-recovery", "no systemd directory on this host — nothing to check");
+  const problems: string[] = [];
+  const fleetUnits: readonly [string, string][] = [
+    [STAGED_SERVICE_NAME, join(SYSTEMD_UNIT_DIR, STAGED_SERVICE_NAME)],
+    [DEFAULT_HERDR_UNIT, join(SYSTEMD_UNIT_DIR, DEFAULT_HERDR_UNIT)],
+  ];
+  for (const [name, path] of fleetUnits) {
+    const text = probes.readUnit(path);
+    if (text === undefined) continue; // not installed — the unit/ownership probes name it
+    for (const target of onFailureTargets(text)) {
+      if (probes.readUnit(join(SYSTEMD_UNIT_DIR, target)) === undefined) {
+        problems.push(`${name} names OnFailure=${target}, which is not installed`);
+      }
+    }
+  }
+  if (problems.length === 0) {
+    return passFinding("systemd-recovery", "every OnFailure= target names an installed unit");
+  }
+  return failFinding(
+    "systemd-recovery",
+    `${problems.join("; ")} — systemd cannot enqueue the recovery a failed fleet unit needs (#485/#509)`,
+    "install the recovery unit and playbook: run `omp-conductor setup host` from the fleet account",
+  );
+}
+
 function installedUnitUser(probes: Probes): string | undefined {
   const unit = probes.readUnit(join(SYSTEMD_UNIT_DIR, STAGED_SERVICE_NAME));
   if (unit === undefined) return undefined;
@@ -609,13 +732,13 @@ function timezoneProbe(project: ProjectConfig | undefined): Finding {
     return passFinding(
       "reporting-timezone",
       configured.length === 0
-        ? "no reporting timezone configured"
-        : `reporting timezone(s) valid: ${configured.map(([, tz]) => `"${tz}"`).join(", ")}`,
+        ? `[${project.name}] no reporting timezone configured`
+        : `[${project.name}] reporting timezone(s) valid: ${configured.map(([, tz]) => `"${tz}"`).join(", ")}`,
     );
   }
   return failFinding(
     "reporting-timezone",
-    `${bad.map(([label, tz]) => `${label}: "${tz}" is not a known IANA timezone`).join("; ")} — an invalid zone silently skips the availability window and the daily digest`,
+    `[${project.name}] ${bad.map(([label, tz]) => `${label}: "${tz}" is not a known IANA timezone`).join("; ")} — an invalid zone silently skips the availability window and the daily digest`,
     "set a valid IANA timezone (e.g. Europe/London) in reporting.availability or reporting.digest",
   );
 }
@@ -651,11 +774,11 @@ async function telegramProbe(probes: Probes, project: ProjectConfig | undefined,
   if (project === undefined) return passFinding("telegram", "no project resolved — nothing to check");
   const chatId = (project.escalation.telegramChatId ?? "").trim();
   if (chatId === "") {
-    return passFinding("telegram", "no escalation.telegramChatId configured — nothing to probe");
+    return passFinding("telegram", `[${project.name}] no escalation.telegramChatId configured — nothing to probe`);
   }
   const health = await probes.telegramHealth(project.name);
   const failures: string[] = [];
-  const notes: string[] = [];
+  const notes: string[] = [`[${project.name}]`];
   if (health.kind === "down") failures.push(`bot health: down (${health.detail ?? "getMe failed"})`);
   else if (health.kind === "unconfigured") notes.push(`bot health: unconfigured (${health.detail ?? "no token"})`);
   else if (health.kind === "degraded") notes.push(`bot health: degraded (${health.detail ?? ""})`);
@@ -678,7 +801,7 @@ async function telegramProbe(probes: Probes, project: ProjectConfig | undefined,
   }
   return failFinding(
     "telegram",
-    failures.join("; "),
+    `[${project.name}] ${failures.join("; ")}`,
     "fix the bot token / omp-telegram install; `doctor --probe-telegram` proves delivery end to end",
   );
 }
@@ -701,12 +824,201 @@ function spendProbe(rows: RunSpendRow[], limit: number): Finding {
   return passFinding("spend-telemetry", `spend observed on the last ${window.length} completed runs ($${total.toFixed(2)} total)`);
 }
 
-// ------------------------------------------------------------- composition
+/** Live `herdr --session <session> agent list` through the project's own
+ *  parser — the published "one JSON line on stdout" interface, never the
+ *  socket. Same bound as the tick's own query so a hung herdr cannot hang
+ *  doctor. */
+function defaultHerdrAgents(session: string): HerdrAgentList {
+  try {
+    const run = spawnSync("herdr", ["--session", session, "agent", "list"], {
+      encoding: "utf8",
+      timeout: 3000,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (run.error !== undefined) return { kind: "unavailable", problem: run.error.message };
+    if (run.status !== 0) {
+      return {
+        kind: "unavailable",
+        problem: `herdr agent list exited ${String(run.status)}: ${(run.stderr ?? "").trim().split("\n")[0] ?? ""}`,
+      };
+    }
+    return parseHerdrAgents(run.stdout ?? "");
+  } catch (err) {
+    return { kind: "unavailable", problem: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+/** Live herdr config, defaulting to the fleet account's own path. */
+function defaultHerdrConfig(): string | undefined {
+  try {
+    return readFileSync(join(homedir(), ".config", "herdr", "config.toml"), "utf8");
+  } catch {
+    return undefined;
+  }
+}
+
+/** Live herdr-conductor plugin `config.env`, same path setup provisions. */
+function defaultHerdrEnv(): string | undefined {
+  try {
+    return readFileSync(join(herdrConductorPluginConfigDir(homedir()), "config.env"), "utf8");
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * #541 check 1 — live herdr agent name equals the tick config's agentName.
+ *
+ * The paneOwnership decline the fleet actually hit names the exact fix (`herdr
+ * agent rename <pane> <name>`); doctor checks the same premise the tick does
+ * (is a pane registered under the configured agent name?) and reports drift
+ * with the one-line remedy.
+ */
+function herdrAgentNameProbe(probes: Probes, p: ProjectConfig): Finding {
+  if (!probes.herdrInstalled()) {
+    return passFinding("herdr-agent-name", `[${p.name}] herdr not installed — nothing to check`);
+  }
+  const want = probes.tickAgentName(p);
+  if (want === undefined) {
+    return passFinding("herdr-agent-name", `[${p.name}] no readable tick config — nothing to check`);
+  }
+  const session = probes.herdrSession();
+  const agents = probes.herdrAgents(session);
+  if (agents.kind !== "ok") {
+    return failFinding(
+      "herdr-agent-name",
+      `[${p.name}] could not read the live herdr agent list (${agents.problem}) — cannot verify the fleet agent name`,
+      `restore the herdr session (check \`herdr status\`), then re-run doctor`,
+    );
+  }
+  const holders = agents.agents.filter((a) => a.name === want);
+  if (holders.length > 0) {
+    return passFinding("herdr-agent-name", `[${p.name}] live pane(s) ${holders.map((a) => a.paneId).join(", ")} are agent "${want}"`);
+  }
+  // Drift: no pane carries the configured identity. Exactly one pane pinned to
+  // the shared default is the safe candidate from the decline turnover — name
+  // it when unambiguous, else give the generic command.
+  const stale = agents.agents.filter((a) => a.name === DEFAULT_FLEET_AGENT_NAME);
+  const pane = stale.length === 1 ? stale[0]!.paneId : "<pane>";
+  return failFinding(
+    "herdr-agent-name",
+    `[${p.name}] no live pane is agent "${want}" — every tick will be declined until the fleet pane carries this name (the 2026-08-15 restamp class)`,
+    `herdr --session ${session} agent rename ${pane} ${want}`,
+  );
+}
+
+/**
+ * #541 check 2 — `[session] resume_agents_on_restore` on the live herdr config.
+ *
+ * herdr's own README: the default `true` leaves a restored omp pane with a
+ * deferred resume plan and no live terminal, which is the configuration that
+ * pages instead of recovering. Absent ~ the unrecoverable default; an explicit
+ * `true` is a deliberate (desktop) choice and only warned.
+ */
+function herdrResumeProbe(probes: Probes): Finding {
+  if (!probes.herdrInstalled()) {
+    return passFinding("herdr-resume", "herdr not installed — nothing to check");
+  }
+  const live = probes.herdrConfig();
+  if (live === undefined) {
+    return failFinding(
+      "herdr-resume",
+      "no herdr config at " + join(homedir(), ".config", "herdr", "config.toml") + " — a restored omp pane gets no live terminal (herdr's own README)",
+      "run \`omp-conductor setup host\` from the fleet account (writes [session] resume_agents_on_restore = false), or add it by hand",
+    );
+  }
+  let parsed: { session?: { resume_agents_on_restore?: unknown } };
+  try {
+    parsed = Bun.TOML.parse(live) as { session?: { resume_agents_on_restore?: unknown } };
+  } catch (err) {
+    return failFinding(
+      "herdr-resume",
+      `the live herdr config does not parse (${err instanceof Error ? err.message : String(err)}) — herdr itself refuses it`,
+      "run `herdr config check` to name the line, fix, then re-run doctor",
+    );
+  }
+  const value = parsed.session?.resume_agents_on_restore;
+  if (value === false) {
+    return passFinding("herdr-resume", "resume_agents_on_restore is false — restored panes come up as shells, not deferred plans");
+  }
+  if (value === true) {
+    return warnFinding(
+      "herdr-resume",
+      "resume_agents_on_restore is explicitly true — possibly a deliberate desktop config, but a headless fleet restores panes with no live terminal",
+      "set it to false for a headless host ([session] resume_agents_on_restore = false), or run `omp-conductor setup host`",
+    );
+  }
+  return failFinding(
+    "herdr-resume",
+    "resume_agents_on_restore is absent — herdr defaults it to true, the configuration its own README calls unrecoverable",
+    "run `omp-conductor setup host` from the fleet account (writes the key), or add [session] resume_agents_on_restore = false by hand",
+  );
+}
+
+/**
+ * #541 check 3 — herdr-conductor `config.env` FLEET_CWDS vs the configured
+ * projects. Absent, a virgin host recovers against legacy `/root/fleet` paths
+ * that do not exist: recovery still runs, only the page silently goes nowhere.
+ */
+function herdrEnvProbe(probes: Probes, cfg: ConductorConfig | undefined): Finding {
+  if (!probes.herdrInstalled()) {
+    return passFinding("herdr-config-env", "herdr not installed — nothing to check");
+  }
+  if (cfg === undefined) {
+    return passFinding("herdr-config-env", "config unreadable — nothing to compare");
+  }
+  const live = probes.herdrEnv();
+  if (live === undefined) {
+    return failFinding(
+      "herdr-config-env",
+      "no herdr-conductor config.env — recovery falls back to legacy /root-based single-tenant paths this host does not use, so pages silently skip",
+      "run `omp-conductor setup host` from the fleet account (writes config.env)",
+    );
+  }
+  const expected = new Set(cfg.projects.map((p) => tickCwdForProject(p)));
+  const actual = parseFleetCwds(live);
+  const coherent =
+    actual !== undefined && actual.size === expected.size && [...actual].every((cwd) => expected.has(cwd));
+  if (coherent) {
+    return passFinding("herdr-config-env", `config.env FLEET_CWDS matches the configured fleets (${[...expected].join(":")})`);
+  }
+  return failFinding(
+    "herdr-config-env",
+    `config.env FLEET_CWDS (${actual === undefined ? "unset" : [...actual].join(":")}) does not match the configured fleets (${[...expected].join(":")})`,
+    "re-run `omp-conductor setup host`, which derives FLEET_CWDS from the configured projects",
+  );
+}
+
+/** FLEET_CWDS (colon- or space-separated, per recover.sh) or undefined. */
+function parseFleetCwds(text: string): Set<string> | undefined {
+  const value = parseEnvKey(text, "FLEET_CWDS");
+  if (value !== undefined) {
+    return new Set(value.split(/[\s:]+/).filter((w) => w.length > 0));
+  }
+  // Legacy single-fleet form, the same fallback recover.sh applies.
+  const legacy = parseEnvKey(text, "FLEET_CWD");
+  return legacy === undefined ? undefined : new Set([legacy]);
+}
+
+/** The first unquoted-or-quoted `KEY=value` on its own line, comments ignored. */
+function parseEnvKey(text: string, key: string): string | undefined {
+  for (const line of text.split("\n")) {
+    const match = new RegExp(`^[ \\t]*${key}[ \\t]*=[ \\t]*"?([^"\\n]*)"?[ \\t]*$`).exec(line);
+    if (match !== null) return match[1];
+  }
+  return undefined;
+}
 
 /**
  * Run every probe and assemble the stable report.
  *
- * @param projectName the `--project NAME` value (undefined on single-project hosts)
+ * Host-wide facts (config backup, store integrity, gh auth, systemd units,
+ * ownership, spend telemetry) are probed once; the per-project facts (labels,
+ * reporting timezone, telegram) are probed for every resolved project, each
+ * named (#530).
+ *
+ * @param projectName the `--project NAME` value; undefined checks every
+ *        configured project
  * @param opts injected seams; every probe defaults to the production wiring
  */
 export async function runDoctor(projectName: string | undefined, opts: DoctorDeps = {}): Promise<DoctorReport> {
@@ -722,42 +1034,89 @@ export async function runDoctor(projectName: string | undefined, opts: DoctorDep
     configProblem = messageOf(err);
   }
 
-  let project: ProjectConfig | undefined;
+  // Resolve the project set: the named project when `--project NAME` is given,
+  // otherwise *(every)* configured project. Doctor is fleet-scoped and covers
+  // the whole host, so a no-name run checks every project's per-project facts
+  // once each, not the first one and not nothing (#530).
+  let projects: ProjectConfig[] = [];
   let projectProblem: string | undefined;
   if (cfg !== undefined) {
-    try {
-      project = findProject(cfg, projectName);
-    } catch (err) {
-      projectProblem = messageOf(err);
+    if (projectName !== undefined) {
+      try {
+        projects = [findProject(cfg, projectName)];
+      } catch (err) {
+        projectProblem = messageOf(err);
+      }
+    } else {
+      projects = cfg.projects;
     }
   }
 
   const findings: Finding[] = [];
   findings.push(configProbe(configProblem));
-  findings.push(
-    cfg === undefined
-      ? passFinding("project", "config unreadable — no project to resolve")
-      : project === undefined
-        ? failFinding(
-            "project",
-            `no project resolved: ${projectProblem ?? "unknown error"}`,
-            "pass --project NAME (doctor checks one project per run)",
-          )
-        : passFinding("project", project.name),
-  );
+  if (cfg === undefined) {
+    findings.push(passFinding("project", "config unreadable — no project to resolve"));
+  } else if (projectProblem !== undefined) {
+    findings.push(
+      failFinding(
+        "project",
+        `no project resolved: ${projectProblem}`,
+        "pass --project NAME (doctor checks the named project; with no name it checks every configured project)",
+      ),
+    );
+  } else if (projects.length === 1) {
+    findings.push(passFinding("project", projects[0]!.name));
+  } else {
+    findings.push(passFinding("project", `${projects.map((p) => p.name).join(", ")} (${projects.length} projects)`));
+  }
+
+  // Host-wide facts, probed once per run — never once per project (the daemon
+  // unit, the store and the token are shared across projects, so re-probing
+  // them per project and deduping the output would hide a real per-project
+  // difference behind a constant count).
   findings.push(backupProbe(probes));
   findings.push(dbProbe(probes));
   findings.push(await ghAuthProbe(probes, configuredRepos(cfg)));
-  findings.push(
-    project === undefined
-      ? passFinding("labels", projectProblem === undefined ? "no project resolved — nothing to check" : `labels uncheckable: ${projectProblem}`)
-      : await labelProbe(probes, project),
-  );
-  findings.push(unitProbe(probes, project, cfg));
+  // The collected run sample across the resolved project set, newest-first;
+  // spend telemetry is a single host-wide finding, not one per project.
+  const spendRows: RunSpendRow[] = [];
+  for (const p of projects) spendRows.push(...probes.recentRuns(p.name, SPEND_SAMPLE_RUNS));
+
+  // Per-project probes run for every resolved project, each named in its
+  // finding so a multi-project run stays legible. When nothing resolved
+  // (config unreadable, or --project named an unknown project), a no-op pass
+  // keeps the stable report shape rather than silently dropping the row.
+  if (projects.length === 0) {
+    findings.push(
+      passFinding("labels", projectProblem === undefined ? "no project resolved — nothing to check" : `labels uncheckable: ${projectProblem}`),
+    );
+    findings.push(
+      passFinding("herdr-agent-name", projectProblem === undefined ? "no project resolved — nothing to check" : `agent name uncheckable: ${projectProblem}`),
+    );
+  } else {
+    for (const p of projects) {
+      findings.push(await labelProbe(probes, p));
+      findings.push(herdrAgentNameProbe(probes, p));
+    }
+  }
+  // The installed-unit check is host-global: one shared daemon. Any project
+  // renders the same canonical units (the daemon/units carry no project), so
+  // the first one stands in for the rendering seam.
+  findings.push(unitProbe(probes, projects[0], cfg));
+  findings.push(recoveryProbe(probes));
   findings.push(ownershipProbe(probes));
-  findings.push(timezoneProbe(project));
-  findings.push(await telegramProbe(probes, project, checkedAt));
-  findings.push(spendProbe(project === undefined ? [] : probes.recentRuns(project.name, SPEND_SAMPLE_RUNS), SPEND_SAMPLE_RUNS));
+  // #541 seam checks, host-global: the live herdr config and the plugin's
+  // config.env are single files on the host, not per-project facts.
+  findings.push(herdrResumeProbe(probes));
+  findings.push(herdrEnvProbe(probes, cfg));
+  if (projects.length === 0) {
+    findings.push(timezoneProbe(undefined));
+    findings.push(await telegramProbe(probes, undefined, checkedAt));
+  } else {
+    for (const p of projects) findings.push(timezoneProbe(p));
+    for (const p of projects) findings.push(await telegramProbe(probes, p, checkedAt));
+  }
+  findings.push(spendProbe(spendRows, SPEND_SAMPLE_RUNS));
 
   const status: ReportStatus = findings.some((f) => f.status === "fail")
     ? "fail"
@@ -765,7 +1124,12 @@ export async function runDoctor(projectName: string | undefined, opts: DoctorDep
       ? "warn"
       : "pass";
   return {
-    project: project === undefined ? projectName ?? "(none resolved)" : project.name,
+    project:
+      projects.length === 0
+        ? projectName ?? "(none resolved)"
+        : projects.length === 1
+          ? projects[0]!.name
+          : projects.map((p) => p.name).join(", "),
     checkedAt: checkedAtIso,
     status,
     findings,
@@ -789,6 +1153,16 @@ export function defaultProbes(): Probes {
     telegramHealth: (projectName) => probeTelegramHealth(projectName),
     telegramSend: telegramReportSend,
     canonicalUnits: defaultCanonicalUnits,
+    herdrInstalled: () => Bun.which("herdr") !== null,
+    herdrAgents: defaultHerdrAgents,
+    herdrSession: () => resolveHerdrSessionWithBridge(),
+    herdrConfig: defaultHerdrConfig,
+    herdrEnv: defaultHerdrEnv,
+    tickAgentName: (p) => {
+      const tick = readTickConfig(tickCwdForProject(p));
+      if (tick.kind !== "ok") return undefined;
+      return tick.config.agentName ?? DEFAULT_FLEET_AGENT_NAME;
+    },
     now: Date.now,
     probeTelegram: false,
   };

package/src/escalate.ts

@@ -144,6 +144,7 @@ export function createEscalator(
   orchestrator?: OrchestratorHandle,
   now: () => number = Date.now,
   deliveryAllowed: () => boolean = () => true,
+  onTier1Diverted?: (e: Escalation) => void,
 ): Escalator {
   const currentProject = typeof source === "function" ? source : (): ProjectConfig => source;
   return {
@@ -278,6 +279,13 @@ export function createEscalator(
       // Tier 1 lands here with no orchestrator, or with one that would not take
       // the injection; tier 2 lands here when omp-telegram is not installed or
       // the project never configured a chat id.
+      //
+      // A tier-1 event reaching this point was diverted from the orchestrator to
+      // an issue comment. That is the exact condition the down incident counts:
+      // the daemon hooks this to accumulate the orchestrator-down incident's
+      // diverted tally (a reader that owns its own dedupe and no-ops for a
+      // healthy or external orchestrator).
+      if (e.tier === 1) onTier1Diverted?.(e);
       if (!p.escalation.fallbackToIssueComment) {
         throw new Error(
           `no escalation transport configured for project "${p.name}": tier ${e.tier} ` +