omp-conductor 0.15.12 → 0.16.0

package/src/dashboard/server.ts

@@ -28,7 +28,8 @@ import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync }
 import { join } from "node:path";
 import { loadConfig, stateDir } from "../config.ts";
 import { healthCheck, livingDaemon, type DaemonRecord } from "../lifecycle.ts";
-import { classifyDaemonProjectHealth, fleetLayers, type FleetLayers } from "../fleet.ts";
+import { classifyDaemonProjectHealth, fleetLayers } from "../fleet.ts";
+import type { FleetLayers } from "../status-render.ts";
 import { statusSnapshot, type StatusSnapshot } from "../daemon.ts";
 import { boardJson, boardSnapshotOnce } from "../board.ts";
 import { dbPath, openStore } from "../store.ts";

package/src/decisions.ts

@@ -235,15 +235,40 @@ function age(since: number, now: number): string {
  * being a memory question. A row whose condition has come true is flagged, not
  * merely listed — that is the difference between a parked question and one to
  * act on now.
+ *
+ * The two kinds render under their own headings (#459). Only rows a human must
+ * answer — `kind === "question"`, whatever condition they carry — appear under
+ * the operator heading; a watch the orchestrator set for itself goes under the
+ * watch heading with no instruction to resolve it, so a fleet at rest behind
+ * GitHub's checks is never mistaken for a fleet that is waiting on its
+ * operator. A met watch still surfaces to the orchestrator with its note and
+ * the same `[CONDITION MET]` flag a met question gets.
  */
 export function formatDecisionDigest(open: readonly DecisionRecord[], now = Date.now()): string {
-  if (open.length === 0) return "";
-  const lines = [
-    `Open operator decisions (${open.length}) — resolve or withdraw each with omp-conductor decision resolve|withdraw <id>:`,
-  ];
-  for (const d of open) {
-    const flag = d.conditionMetAt === undefined ? "" : " [CONDITION MET — act on this now]";
-    lines.push(`- ${d.id} (${age(d.askedAt, now)}, blocks ${d.blocks ?? "nothing"})${flag}: ${d.question}`);
+  const questions = open.filter((d) => d.kind !== "watch");
+  const watches = open.filter((d) => d.kind === "watch");
+  const lines: string[] = [];
+  if (questions.length > 0) {
+    lines.push(
+      `Open operator decisions (${questions.length}) — resolve or withdraw each with omp-conductor decision resolve|withdraw <id>:`,
+    );
+    for (const d of questions) {
+      lines.push(decisionLine(d, now));
+    }
+  }
+  if (watches.length > 0) {
+    lines.push(
+      `Watches (${watches.length}) — conditions the orchestrator set for itself; no operator action needed:`,
+    );
+    for (const d of watches) {
+      lines.push(decisionLine(d, now));
+    }
   }
   return lines.join("\n");
 }
+
+/** One digest row: id, age, what it blocks, the met flag, and the note. */
+function decisionLine(d: DecisionRecord, now: number): string {
+  const flag = d.conditionMetAt === undefined ? "" : " [CONDITION MET — act on this now]";
+  return `- ${d.id} (${age(d.askedAt, now)}, blocks ${d.blocks ?? "nothing"})${flag}: ${d.question}`;
+}

package/src/depends-on.ts

@@ -0,0 +1,73 @@
+/**
+ * The `Depends-on:` declaration parser (epic #321, slice #419).
+ *
+ * A candidate issue can declare same-repo prerequisites it must not be
+ * dispatched before: `Depends-on: #123` (repeatable, one or more per line).
+ * Admission reads every referenced issue's live tracker state and holds the
+ * candidate while any prerequisite is open, so a worker is never sent at work
+ * whose base is not yet merged.
+ *
+ * The parser is deliberately small and strict, the two halves of the contract:
+ * the *marker* is matched case-insensitively (so `DEPENDS-ON`, `Depends-On`,
+ * `depends-on` all declare), while the *references* are strict bare issue
+ * numbers (`#123`). A marker line that carries no strict reference — an empty
+ * `Depends-on:`, or a bare non-numeric `Depends-on: #abc` — is never a usable
+ * prerequisite, so it is reported as `malformed` for the grooming flag rather
+ * than guessed at, and the declaration it belongs to is ignored.
+ *
+ * Cross-repo references (a qualifying `owner/repo#n` or `repo#n` form) and
+ * graph cycles are later slices (#420/#421) and are deliberately out of scope
+ * here: only plain `#<n>` same-repo forms are resolved.
+ */
+
+export interface DependsOnDecl {
+  /** Referenced prerequisite issue numbers, deduplicated, first-seen order. */
+  readonly refs: readonly number[];
+  /** Marker-bearing lines that carried no strict `#<n>` reference (e.g.
+   *  `Depends-on: #abc`). Bounded to what the body actually said, for the
+   *  grooming flag's detail. */
+  readonly malformed: readonly string[];
+}
+
+/**
+ * How a line is spelled: `depends-on`/`depends on`, optional whitespace, then
+ * a `:` or `=` separator. The marker is matched case-insensitively; the value
+ * (everything after the separator) is what the strict-reference rules apply
+ * to. Anchored at the start of the (trimmed) line so a prose mention of
+ * "Depends-on" mid-sentence is not a declaration.
+ */
+const MARKER = /^depends[-\s]?on\s*[:=]\s*(.*)$/i;
+
+/** A strict reference is a bare `#` followed by digits — no repo qualifier,
+ *  no words. Everything else is not a prerequisite this slice resolves. */
+const REF = /#(\d+)/g;
+
+export function parseDependsOn(body: string): DependsOnDecl {
+  const refs: number[] = [];
+  const seen = new Set<number>();
+  const malformed: string[] = [];
+  for (const raw of body.split("\n")) {
+    const line = raw.trim();
+    if (line === "") continue;
+    const match = MARKER.exec(line);
+    if (match === null) continue;
+    const value = match[1] ?? "";
+    REF.lastIndex = 0;
+    const found = [...value.matchAll(REF)];
+    if (found.length === 0) {
+      // A marker line with no strict reference is a malformed declaration:
+      // never crash, never silently claim — the declaration is ignored and
+      // surfaced for grooming.
+      malformed.push(line);
+      continue;
+    }
+    for (const group of found) {
+      const n = Number(group[1]!);
+      if (Number.isSafeInteger(n) && !seen.has(n)) {
+        seen.add(n);
+        refs.push(n);
+      }
+    }
+  }
+  return { refs, malformed };
+}

package/src/doctor.ts

@@ -25,20 +25,57 @@
  *     (the #399 boundary).
  */
 
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  readdirSync,
+  readFileSync,
+  statSync,
+} from "node:fs";
 import { spawnSync } from "node:child_process";
-import { join } from "node:path";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
 import type { Stats } from "node:fs";
 import { Database } from "bun:sqlite";
+import { stringify } from "yaml";
 
-import { configBackupDir, configPath, findProject, loadConfig, resolveCaps, stateDir } from "./config.ts";
-import { DEFAULT_HERDR_UNIT, probeTelegramHealth, telegramStateDir, type TelegramHealth } from "./fleet.ts";
-import { planHostRuntime, STAGED_SERVICE_NAME, SYSTEMD_UNIT_DIR, totalConfiguredWorkers } from "./setup-host.ts";
+import {
+  configBackupDir,
+  configPath,
+  dbBackupDirFor,
+  findProject,
+  loadConfig,
+  resolveCaps,
+  stateDir,
+} from "./config.ts";
+import { ompSettingsOverlay, sessionRootDir } from "./omp-settings.ts";
+import {
+  DEFAULT_HERDR_UNIT,
+  probeTelegramHealth,
+  resolveHerdrSessionWithBridge,
+  telegramStateDir,
+} from "./fleet.ts";
+import type { TelegramHealth } from "./status-render.ts";
+import {
+  herdrConductorPluginConfigDir,
+  planHostRuntime,
+  STAGED_SERVICE_NAME,
+  SYSTEMD_UNIT_DIR,
+  tickCwdForProject,
+  totalConfiguredWorkers,
+} from "./setup-host.ts";
 import { checkTokenScopes, type ScopeCheck } from "./setup.ts";
-import { dbPath, LIVE_STATES } from "./store.ts";
+import { DB_SNAPSHOT_STEM, dbPath, LIVE_STATES } from "./store.ts";
 import { telegramReportSend, type ReportSend } from "./reports.ts";
 import { fetchRateLimit, GhError, gh } from "./tracker/github.ts";
 import { repoSlugFor } from "./gitops.ts";
+import {
+  DEFAULT_FLEET_AGENT_NAME,
+  parseHerdrAgents,
+  readTickConfig,
+  type HerdrAgentList,
+} from "./orchestrator-tick.ts";
 import type { ConductorConfig, ProjectConfig, RepoTarget, RunState } from "./types.ts";
 
 /**
@@ -139,6 +176,14 @@ export interface DoctorDeps {
   uidOf?: (name: string) => number | undefined;
   /** `PRAGMA integrity_check` over the store, read-only. ok=true for "ok". */
   dbIntegrity?: (path: string) => { ok: boolean; detail?: string };
+  /** Whether the configured db-snapshot directory exists and is writable, so a
+   *  snapshot can land. Injected so a test never chmods the host (#399). */
+  snapshotDirState?: (dir: string) => { exists: boolean; writable: boolean };
+  /** Whether the run-session root — where the omp settings overlay is
+   *  materialised at dispatch (#537) — can hold a new `run-<id>` directory. A
+   *  missing `sessions/` parent is not a fault (dispatch's recursive `mkdir`
+   *  creates it), so the writable question falls back to the state dir itself. */
+  sessionRootState?: (root: string) => { exists: boolean; writable: boolean };
   /** The most recent completed runs for one project, newest first, limited. */
   recentRuns?: (project: string, limit: number) => RunSpendRow[];
   /** The bot health probe `status` uses (getMe etc.). */
@@ -148,6 +193,20 @@ export interface DoctorDeps {
   telegramSend?: (project: ProjectConfig) => ReportSend;
   /** The canonical units to compare the installed units against. */
   canonicalUnits?: (project: ProjectConfig, cfg: ConductorConfig) => CanonicalUnits;
+  /** Whether herdr is installed on this host (a `herdr` on PATH). */
+  herdrInstalled?: () => boolean;
+  /** Live `herdr --session <s> agent list`, parsed through the tick's own
+   *  parser (the same "one JSON line on stdout" contract recover.sh reads). */
+  herdrAgents?: (session: string) => HerdrAgentList;
+  /** The fleet session name, for the rename fix line. */
+  herdrSession?: () => string;
+  /** The live herdr config at `~/.config/herdr/config.toml`, or undefined. */
+  herdrConfig?: () => string | undefined;
+  /** The live herdr-conductor plugin `config.env`, or undefined. */
+  herdrEnv?: () => string | undefined;
+  /** The fleet agent name the tick config of one project names, or undefined
+   *  when there is no (readable) tick — the expected live herdr pane identity. */
+  tickAgentName?: (project: ProjectConfig) => string | undefined;
   /** Clock, so a run is deterministic in tests. */
   now?: () => number;
   /** The one opt-in side effect: send one self-identified Telegram probe. */
@@ -252,6 +311,55 @@ function defaultDbIntegrity(path: string): { ok: boolean; detail?: string } {
   }
 }
 
+/**
+ * Whether the configured db-snapshot directory exists and is writable. No
+ * write is performed — the check is stat + access, keeping doctor read-only.
+ * A directory that does not exist reads `writable: false` and lets the probe
+ * report it as "no snapshot yet" rather than inventing one, while a read-only
+ * or non-directory path reads as a genuine unwritable failure.
+ */
+function defaultSnapshotDirState(dir: string): { exists: boolean; writable: boolean } {
+  try {
+    const st = statSync(dir);
+    if (!st.isDirectory()) return { exists: true, writable: false };
+    try {
+      accessSync(dir, constants.W_OK);
+      return { exists: true, writable: true };
+    } catch {
+      return { exists: true, writable: false };
+    }
+  } catch {
+    return { exists: false, writable: false };
+  }
+}
+
+/**
+ * Whether the run-session root can hold a new session directory. No write is
+ * performed — the same stat + access as {@link defaultSnapshotDirState}, which
+ * keeps `doctor` read-only. A missing `sessions/` parent is normal on a fresh
+ * host (dispatch's recursive `mkdir` creates it), so the writable question
+ * falls back to the state dir it would be created under; a state dir that
+ * cannot even be read is a genuine unwritable failure.
+ */
+function defaultSessionRootState(root: string): { exists: boolean; writable: boolean } {
+  const writable = (dir: string): boolean => {
+    try {
+      const st = statSync(dir);
+      if (!st.isDirectory()) return false;
+      accessSync(dir, constants.W_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  try {
+    const st = statSync(root);
+    return { exists: true, writable: st.isDirectory() && writable(root) };
+  } catch {
+    return { exists: false, writable: writable(dirname(root)) };
+  }
+}
+
 /**
  * The most recent completed runs for one project, newest first — read on the
  * same read-only connection the integrity check opens, because the store's own
@@ -385,6 +493,57 @@ function dbProbe(probes: Probes): Finding {
   );
 }
 
+/**
+ * The conductor.db snapshot store (#579): the configured dir is writable so a
+ * snapshot can land, and a snapshot at least as fresh as the store protects
+ * it. The store is the carrier of the verb ledger, the decision rows, the run
+ * rows and the material-event ledger; a store with no restorable copy has no
+ * recovery path, so absence is a warning and an unwritable configured dir a
+ * failure.
+ */
+function dbBackupProbe(probes: Probes, cfg: ConductorConfig | undefined): Finding {
+  const dir = dbBackupDirFor(cfg);
+  const state = probes.snapshotDirState(dir);
+  if (state.exists && !state.writable) {
+    return failFinding(
+      "db-backup",
+      `db backup dir ${dir} is not writable — a conductor.db snapshot cannot land there`,
+      `make ${dir} writable by the conductor account, or set dbBackupDir in config to a writable directory`,
+    );
+  }
+  const snapshots = (() => {
+    try {
+      return readdirSync(dir).filter((name) => name.startsWith(DB_SNAPSHOT_STEM));
+    } catch {
+      return [];
+    }
+  })();
+  const store = probes.stat(dbPath());
+  if (store === undefined) {
+    return snapshots.length === 0
+      ? passFinding("db-backup", "no conductor.db yet — nothing to snapshot")
+      : passFinding("db-backup", `${snapshots.length} conductor.db snapshot(s) present`);
+  }
+  if (snapshots.length === 0) {
+    return warnFinding(
+      "db-backup",
+      "conductor.db has no snapshot — losing it loses the audit trail with no recovery path",
+      "take a conductor.db snapshot (the daemon's cadence files one; restore-db needs one to restore from)",
+    );
+  }
+  const newestMtime = snapshots
+    .map((name) => probes.stat(join(dir, name))?.mtimeMs ?? 0)
+    .reduce((max, m) => Math.max(max, m), 0);
+  if (store.mtimeMs > newestMtime + 60_000) {
+    return warnFinding(
+      "db-backup",
+      `conductor.db is newer than every snapshot (${snapshots.length} file(s)) — the newest writes were never snapshot`,
+      "take a fresh conductor.db snapshot so restore-db has the current state",
+    );
+  }
+  return passFinding("db-backup", `conductor.db snapshot is fresh (${snapshots.length} file(s))`);
+}
+
 /** Every repo the config names: each project's tracker plus routing targets,
  *  as GitHub slugs, deduplicated, in config order. */
 function configuredRepos(cfg: ConductorConfig | undefined): string[] {
@@ -720,6 +879,42 @@ export function isKnownTimezone(tz: string): boolean {
   }
 }
 
+/**
+ * The fleet-owned omp settings overlay (#537): reports the *effective* overlay
+ * every worker session of the project will load — the `ompSettings` map plus
+ * the retry keys derived from `modelFallbacks`, rendered exactly as the
+ * materialiser writes them, never the raw config snippet `setup` would echo —
+ * and turns red when that overlay cannot land. The file is written at dispatch
+ * under `<stateDir>/sessions/run-<id>/`, so doctor cannot prove the write
+ * without writing: it probes the root the materialisation would land in with
+ * the same stat + access the db-backup probe uses, keeping the check
+ * read-only (#287). The session root is a host-wide fact, probed once and
+ * shared across the per-project findings.
+ */
+function ompSettingsProbe(
+  project: ProjectConfig,
+  sessionRoot: { exists: boolean; writable: boolean },
+): Finding {
+  const overlay = ompSettingsOverlay(project);
+  if (overlay === undefined) {
+    return passFinding(
+      "omp-settings",
+      `[${project.name}] no omp settings overlay configured — workers inherit the daemon account's global settings unchanged`,
+    );
+  }
+  if (!sessionRoot.writable) {
+    return failFinding(
+      "omp-settings",
+      `[${project.name}] the omp settings overlay cannot be materialised: ${sessionRootDir()} cannot hold a session directory, so every worker would dispatch without its staged settings`,
+      `make ${sessionRootDir()} writable by the conductor account`,
+    );
+  }
+  return passFinding(
+    "omp-settings",
+    `[${project.name}] worker sessions load this omp settings overlay:\n${stringify(overlay).trimEnd()}`,
+  );
+}
+
 /** The self-identified probe message `--probe-telegram` delivers through the
  *  same report transport a real report would take. */
 function probeMessage(project: string, checkedAt: string): string {
@@ -790,7 +985,190 @@ function spendProbe(rows: RunSpendRow[], limit: number): Finding {
   return passFinding("spend-telemetry", `spend observed on the last ${window.length} completed runs ($${total.toFixed(2)} total)`);
 }
 
-// ------------------------------------------------------------- composition
+/** Live `herdr --session <session> agent list` through the project's own
+ *  parser — the published "one JSON line on stdout" interface, never the
+ *  socket. Same bound as the tick's own query so a hung herdr cannot hang
+ *  doctor. */
+function defaultHerdrAgents(session: string): HerdrAgentList {
+  try {
+    const run = spawnSync("herdr", ["--session", session, "agent", "list"], {
+      encoding: "utf8",
+      timeout: 3000,
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    if (run.error !== undefined) return { kind: "unavailable", problem: run.error.message };
+    if (run.status !== 0) {
+      return {
+        kind: "unavailable",
+        problem: `herdr agent list exited ${String(run.status)}: ${(run.stderr ?? "").trim().split("\n")[0] ?? ""}`,
+      };
+    }
+    return parseHerdrAgents(run.stdout ?? "");
+  } catch (err) {
+    return { kind: "unavailable", problem: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+/** Live herdr config, defaulting to the fleet account's own path. */
+function defaultHerdrConfig(): string | undefined {
+  try {
+    return readFileSync(join(homedir(), ".config", "herdr", "config.toml"), "utf8");
+  } catch {
+    return undefined;
+  }
+}
+
+/** Live herdr-conductor plugin `config.env`, same path setup provisions. */
+function defaultHerdrEnv(): string | undefined {
+  try {
+    return readFileSync(join(herdrConductorPluginConfigDir(homedir()), "config.env"), "utf8");
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * #541 check 1 — live herdr agent name equals the tick config's agentName.
+ *
+ * The paneOwnership decline the fleet actually hit names the exact fix (`herdr
+ * agent rename <pane> <name>`); doctor checks the same premise the tick does
+ * (is a pane registered under the configured agent name?) and reports drift
+ * with the one-line remedy.
+ */
+function herdrAgentNameProbe(probes: Probes, p: ProjectConfig): Finding {
+  if (!probes.herdrInstalled()) {
+    return passFinding("herdr-agent-name", `[${p.name}] herdr not installed — nothing to check`);
+  }
+  const want = probes.tickAgentName(p);
+  if (want === undefined) {
+    return passFinding("herdr-agent-name", `[${p.name}] no readable tick config — nothing to check`);
+  }
+  const session = probes.herdrSession();
+  const agents = probes.herdrAgents(session);
+  if (agents.kind !== "ok") {
+    return failFinding(
+      "herdr-agent-name",
+      `[${p.name}] could not read the live herdr agent list (${agents.problem}) — cannot verify the fleet agent name`,
+      `restore the herdr session (check \`herdr status\`), then re-run doctor`,
+    );
+  }
+  const holders = agents.agents.filter((a) => a.name === want);
+  if (holders.length > 0) {
+    return passFinding("herdr-agent-name", `[${p.name}] live pane(s) ${holders.map((a) => a.paneId).join(", ")} are agent "${want}"`);
+  }
+  // Drift: no pane carries the configured identity. Exactly one pane pinned to
+  // the shared default is the safe candidate from the decline turnover — name
+  // it when unambiguous, else give the generic command.
+  const stale = agents.agents.filter((a) => a.name === DEFAULT_FLEET_AGENT_NAME);
+  const pane = stale.length === 1 ? stale[0]!.paneId : "<pane>";
+  return failFinding(
+    "herdr-agent-name",
+    `[${p.name}] no live pane is agent "${want}" — every tick will be declined until the fleet pane carries this name (the 2026-08-15 restamp class)`,
+    `herdr --session ${session} agent rename ${pane} ${want}`,
+  );
+}
+
+/**
+ * #541 check 2 — `[session] resume_agents_on_restore` on the live herdr config.
+ *
+ * herdr's own README: the default `true` leaves a restored omp pane with a
+ * deferred resume plan and no live terminal, which is the configuration that
+ * pages instead of recovering. Absent ~ the unrecoverable default; an explicit
+ * `true` is a deliberate (desktop) choice and only warned.
+ */
+function herdrResumeProbe(probes: Probes): Finding {
+  if (!probes.herdrInstalled()) {
+    return passFinding("herdr-resume", "herdr not installed — nothing to check");
+  }
+  const live = probes.herdrConfig();
+  if (live === undefined) {
+    return failFinding(
+      "herdr-resume",
+      "no herdr config at " + join(homedir(), ".config", "herdr", "config.toml") + " — a restored omp pane gets no live terminal (herdr's own README)",
+      "run \`omp-conductor setup host\` from the fleet account (writes [session] resume_agents_on_restore = false), or add it by hand",
+    );
+  }
+  let parsed: { session?: { resume_agents_on_restore?: unknown } };
+  try {
+    parsed = Bun.TOML.parse(live) as { session?: { resume_agents_on_restore?: unknown } };
+  } catch (err) {
+    return failFinding(
+      "herdr-resume",
+      `the live herdr config does not parse (${err instanceof Error ? err.message : String(err)}) — herdr itself refuses it`,
+      "run `herdr config check` to name the line, fix, then re-run doctor",
+    );
+  }
+  const value = parsed.session?.resume_agents_on_restore;
+  if (value === false) {
+    return passFinding("herdr-resume", "resume_agents_on_restore is false — restored panes come up as shells, not deferred plans");
+  }
+  if (value === true) {
+    return warnFinding(
+      "herdr-resume",
+      "resume_agents_on_restore is explicitly true — possibly a deliberate desktop config, but a headless fleet restores panes with no live terminal",
+      "set it to false for a headless host ([session] resume_agents_on_restore = false), or run `omp-conductor setup host`",
+    );
+  }
+  return failFinding(
+    "herdr-resume",
+    "resume_agents_on_restore is absent — herdr defaults it to true, the configuration its own README calls unrecoverable",
+    "run `omp-conductor setup host` from the fleet account (writes the key), or add [session] resume_agents_on_restore = false by hand",
+  );
+}
+
+/**
+ * #541 check 3 — herdr-conductor `config.env` FLEET_CWDS vs the configured
+ * projects. Absent, a virgin host recovers against legacy `/root/fleet` paths
+ * that do not exist: recovery still runs, only the page silently goes nowhere.
+ */
+function herdrEnvProbe(probes: Probes, cfg: ConductorConfig | undefined): Finding {
+  if (!probes.herdrInstalled()) {
+    return passFinding("herdr-config-env", "herdr not installed — nothing to check");
+  }
+  if (cfg === undefined) {
+    return passFinding("herdr-config-env", "config unreadable — nothing to compare");
+  }
+  const live = probes.herdrEnv();
+  if (live === undefined) {
+    return failFinding(
+      "herdr-config-env",
+      "no herdr-conductor config.env — recovery falls back to legacy /root-based single-tenant paths this host does not use, so pages silently skip",
+      "run `omp-conductor setup host` from the fleet account (writes config.env)",
+    );
+  }
+  const expected = new Set(cfg.projects.map((p) => tickCwdForProject(p)));
+  const actual = parseFleetCwds(live);
+  const coherent =
+    actual !== undefined && actual.size === expected.size && [...actual].every((cwd) => expected.has(cwd));
+  if (coherent) {
+    return passFinding("herdr-config-env", `config.env FLEET_CWDS matches the configured fleets (${[...expected].join(":")})`);
+  }
+  return failFinding(
+    "herdr-config-env",
+    `config.env FLEET_CWDS (${actual === undefined ? "unset" : [...actual].join(":")}) does not match the configured fleets (${[...expected].join(":")})`,
+    "re-run `omp-conductor setup host`, which derives FLEET_CWDS from the configured projects",
+  );
+}
+
+/** FLEET_CWDS (colon- or space-separated, per recover.sh) or undefined. */
+function parseFleetCwds(text: string): Set<string> | undefined {
+  const value = parseEnvKey(text, "FLEET_CWDS");
+  if (value !== undefined) {
+    return new Set(value.split(/[\s:]+/).filter((w) => w.length > 0));
+  }
+  // Legacy single-fleet form, the same fallback recover.sh applies.
+  const legacy = parseEnvKey(text, "FLEET_CWD");
+  return legacy === undefined ? undefined : new Set([legacy]);
+}
+
+/** The first unquoted-or-quoted `KEY=value` on its own line, comments ignored. */
+function parseEnvKey(text: string, key: string): string | undefined {
+  for (const line of text.split("\n")) {
+    const match = new RegExp(`^[ \\t]*${key}[ \\t]*=[ \\t]*"?([^"\\n]*)"?[ \\t]*$`).exec(line);
+    if (match !== null) return match[1];
+  }
+  return undefined;
+}
 
 /**
  * Run every probe and assemble the stable report.
@@ -859,7 +1237,13 @@ export async function runDoctor(projectName: string | undefined, opts: DoctorDep
   // difference behind a constant count).
   findings.push(backupProbe(probes));
   findings.push(dbProbe(probes));
+  findings.push(dbBackupProbe(probes, cfg));
   findings.push(await ghAuthProbe(probes, configuredRepos(cfg)));
+  // The run-session root is one host-wide fact — where every run's session dir
+  // (and the omp settings overlay inside it) lands — probed once and shared
+  // across the per-project omp-settings findings.
+  const sessionRoot = sessionRootDir();
+  const sessionRootState = probes.sessionRootState(sessionRoot);
   // The collected run sample across the resolved project set, newest-first;
   // spend telemetry is a single host-wide finding, not one per project.
   const spendRows: RunSpendRow[] = [];
@@ -873,8 +1257,18 @@ export async function runDoctor(projectName: string | undefined, opts: DoctorDep
     findings.push(
       passFinding("labels", projectProblem === undefined ? "no project resolved — nothing to check" : `labels uncheckable: ${projectProblem}`),
     );
+    findings.push(
+      passFinding("herdr-agent-name", projectProblem === undefined ? "no project resolved — nothing to check" : `agent name uncheckable: ${projectProblem}`),
+    );
+    findings.push(
+      passFinding("omp-settings", projectProblem === undefined ? "no project resolved — nothing to check" : `omp settings overlay uncheckable: ${projectProblem}`),
+    );
   } else {
-    for (const p of projects) findings.push(await labelProbe(probes, p));
+    for (const p of projects) {
+      findings.push(await labelProbe(probes, p));
+      findings.push(herdrAgentNameProbe(probes, p));
+      findings.push(ompSettingsProbe(p, sessionRootState));
+    }
   }
   // The installed-unit check is host-global: one shared daemon. Any project
   // renders the same canonical units (the daemon/units carry no project), so
@@ -882,6 +1276,10 @@ export async function runDoctor(projectName: string | undefined, opts: DoctorDep
   findings.push(unitProbe(probes, projects[0], cfg));
   findings.push(recoveryProbe(probes));
   findings.push(ownershipProbe(probes));
+  // #541 seam checks, host-global: the live herdr config and the plugin's
+  // config.env are single files on the host, not per-project facts.
+  findings.push(herdrResumeProbe(probes));
+  findings.push(herdrEnvProbe(probes, cfg));
   if (projects.length === 0) {
     findings.push(timezoneProbe(undefined));
     findings.push(await telegramProbe(probes, undefined, checkedAt));
@@ -922,10 +1320,22 @@ export function defaultProbes(): Probes {
     stat: defaultStat,
     uidOf: defaultUidOf,
     dbIntegrity: defaultDbIntegrity,
+    snapshotDirState: defaultSnapshotDirState,
+    sessionRootState: defaultSessionRootState,
     recentRuns: defaultRecentRuns,
     telegramHealth: (projectName) => probeTelegramHealth(projectName),
     telegramSend: telegramReportSend,
     canonicalUnits: defaultCanonicalUnits,
+    herdrInstalled: () => Bun.which("herdr") !== null,
+    herdrAgents: defaultHerdrAgents,
+    herdrSession: () => resolveHerdrSessionWithBridge(),
+    herdrConfig: defaultHerdrConfig,
+    herdrEnv: defaultHerdrEnv,
+    tickAgentName: (p) => {
+      const tick = readTickConfig(tickCwdForProject(p));
+      if (tick.kind !== "ok") return undefined;
+      return tick.config.agentName ?? DEFAULT_FLEET_AGENT_NAME;
+    },
     now: Date.now,
     probeTelegram: false,
   };