omp-conductor 0.15.13 → 0.16.0

package/src/dashboard/server.ts

@@ -28,7 +28,8 @@ import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync }
 import { join } from "node:path";
 import { loadConfig, stateDir } from "../config.ts";
 import { healthCheck, livingDaemon, type DaemonRecord } from "../lifecycle.ts";
-import { classifyDaemonProjectHealth, fleetLayers, type FleetLayers } from "../fleet.ts";
+import { classifyDaemonProjectHealth, fleetLayers } from "../fleet.ts";
+import type { FleetLayers } from "../status-render.ts";
 import { statusSnapshot, type StatusSnapshot } from "../daemon.ts";
 import { boardJson, boardSnapshotOnce } from "../board.ts";
 import { dbPath, openStore } from "../store.ts";

package/src/decisions.ts

@@ -235,15 +235,40 @@ function age(since: number, now: number): string {
  * being a memory question. A row whose condition has come true is flagged, not
  * merely listed — that is the difference between a parked question and one to
  * act on now.
+ *
+ * The two kinds render under their own headings (#459). Only rows a human must
+ * answer — `kind === "question"`, whatever condition they carry — appear under
+ * the operator heading; a watch the orchestrator set for itself goes under the
+ * watch heading with no instruction to resolve it, so a fleet at rest behind
+ * GitHub's checks is never mistaken for a fleet that is waiting on its
+ * operator. A met watch still surfaces to the orchestrator with its note and
+ * the same `[CONDITION MET]` flag a met question gets.
  */
 export function formatDecisionDigest(open: readonly DecisionRecord[], now = Date.now()): string {
-  if (open.length === 0) return "";
-  const lines = [
-    `Open operator decisions (${open.length}) — resolve or withdraw each with omp-conductor decision resolve|withdraw <id>:`,
-  ];
-  for (const d of open) {
-    const flag = d.conditionMetAt === undefined ? "" : " [CONDITION MET — act on this now]";
-    lines.push(`- ${d.id} (${age(d.askedAt, now)}, blocks ${d.blocks ?? "nothing"})${flag}: ${d.question}`);
+  const questions = open.filter((d) => d.kind !== "watch");
+  const watches = open.filter((d) => d.kind === "watch");
+  const lines: string[] = [];
+  if (questions.length > 0) {
+    lines.push(
+      `Open operator decisions (${questions.length}) — resolve or withdraw each with omp-conductor decision resolve|withdraw <id>:`,
+    );
+    for (const d of questions) {
+      lines.push(decisionLine(d, now));
+    }
+  }
+  if (watches.length > 0) {
+    lines.push(
+      `Watches (${watches.length}) — conditions the orchestrator set for itself; no operator action needed:`,
+    );
+    for (const d of watches) {
+      lines.push(decisionLine(d, now));
+    }
   }
   return lines.join("\n");
 }
+
+/** One digest row: id, age, what it blocks, the met flag, and the note. */
+function decisionLine(d: DecisionRecord, now: number): string {
+  const flag = d.conditionMetAt === undefined ? "" : " [CONDITION MET — act on this now]";
+  return `- ${d.id} (${age(d.askedAt, now)}, blocks ${d.blocks ?? "nothing"})${flag}: ${d.question}`;
+}

package/src/depends-on.ts

@@ -0,0 +1,73 @@
+/**
+ * The `Depends-on:` declaration parser (epic #321, slice #419).
+ *
+ * A candidate issue can declare same-repo prerequisites it must not be
+ * dispatched before: `Depends-on: #123` (repeatable, one or more per line).
+ * Admission reads every referenced issue's live tracker state and holds the
+ * candidate while any prerequisite is open, so a worker is never sent at work
+ * whose base is not yet merged.
+ *
+ * The parser is deliberately small and strict, the two halves of the contract:
+ * the *marker* is matched case-insensitively (so `DEPENDS-ON`, `Depends-On`,
+ * `depends-on` all declare), while the *references* are strict bare issue
+ * numbers (`#123`). A marker line that carries no strict reference — an empty
+ * `Depends-on:`, or a bare non-numeric `Depends-on: #abc` — is never a usable
+ * prerequisite, so it is reported as `malformed` for the grooming flag rather
+ * than guessed at, and the declaration it belongs to is ignored.
+ *
+ * Cross-repo references (a qualifying `owner/repo#n` or `repo#n` form) and
+ * graph cycles are later slices (#420/#421) and are deliberately out of scope
+ * here: only plain `#<n>` same-repo forms are resolved.
+ */
+
+export interface DependsOnDecl {
+  /** Referenced prerequisite issue numbers, deduplicated, first-seen order. */
+  readonly refs: readonly number[];
+  /** Marker-bearing lines that carried no strict `#<n>` reference (e.g.
+   *  `Depends-on: #abc`). Bounded to what the body actually said, for the
+   *  grooming flag's detail. */
+  readonly malformed: readonly string[];
+}
+
+/**
+ * How a line is spelled: `depends-on`/`depends on`, optional whitespace, then
+ * a `:` or `=` separator. The marker is matched case-insensitively; the value
+ * (everything after the separator) is what the strict-reference rules apply
+ * to. Anchored at the start of the (trimmed) line so a prose mention of
+ * "Depends-on" mid-sentence is not a declaration.
+ */
+const MARKER = /^depends[-\s]?on\s*[:=]\s*(.*)$/i;
+
+/** A strict reference is a bare `#` followed by digits — no repo qualifier,
+ *  no words. Everything else is not a prerequisite this slice resolves. */
+const REF = /#(\d+)/g;
+
+export function parseDependsOn(body: string): DependsOnDecl {
+  const refs: number[] = [];
+  const seen = new Set<number>();
+  const malformed: string[] = [];
+  for (const raw of body.split("\n")) {
+    const line = raw.trim();
+    if (line === "") continue;
+    const match = MARKER.exec(line);
+    if (match === null) continue;
+    const value = match[1] ?? "";
+    REF.lastIndex = 0;
+    const found = [...value.matchAll(REF)];
+    if (found.length === 0) {
+      // A marker line with no strict reference is a malformed declaration:
+      // never crash, never silently claim — the declaration is ignored and
+      // surfaced for grooming.
+      malformed.push(line);
+      continue;
+    }
+    for (const group of found) {
+      const n = Number(group[1]!);
+      if (Number.isSafeInteger(n) && !seen.has(n)) {
+        seen.add(n);
+        refs.push(n);
+      }
+    }
+  }
+  return { refs, malformed };
+}

package/src/doctor.ts

@@ -25,21 +25,38 @@
  *     (the #399 boundary).
  */
 
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  readdirSync,
+  readFileSync,
+  statSync,
+} from "node:fs";
 import { spawnSync } from "node:child_process";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 import type { Stats } from "node:fs";
 import { Database } from "bun:sqlite";
+import { stringify } from "yaml";
 
-import { configBackupDir, configPath, findProject, loadConfig, resolveCaps, stateDir } from "./config.ts";
+import {
+  configBackupDir,
+  configPath,
+  dbBackupDirFor,
+  findProject,
+  loadConfig,
+  resolveCaps,
+  stateDir,
+} from "./config.ts";
+import { ompSettingsOverlay, sessionRootDir } from "./omp-settings.ts";
 import {
   DEFAULT_HERDR_UNIT,
   probeTelegramHealth,
   resolveHerdrSessionWithBridge,
   telegramStateDir,
-  type TelegramHealth,
 } from "./fleet.ts";
+import type { TelegramHealth } from "./status-render.ts";
 import {
   herdrConductorPluginConfigDir,
   planHostRuntime,
@@ -49,7 +66,7 @@ import {
   totalConfiguredWorkers,
 } from "./setup-host.ts";
 import { checkTokenScopes, type ScopeCheck } from "./setup.ts";
-import { dbPath, LIVE_STATES } from "./store.ts";
+import { DB_SNAPSHOT_STEM, dbPath, LIVE_STATES } from "./store.ts";
 import { telegramReportSend, type ReportSend } from "./reports.ts";
 import { fetchRateLimit, GhError, gh } from "./tracker/github.ts";
 import { repoSlugFor } from "./gitops.ts";
@@ -159,6 +176,14 @@ export interface DoctorDeps {
   uidOf?: (name: string) => number | undefined;
   /** `PRAGMA integrity_check` over the store, read-only. ok=true for "ok". */
   dbIntegrity?: (path: string) => { ok: boolean; detail?: string };
+  /** Whether the configured db-snapshot directory exists and is writable, so a
+   *  snapshot can land. Injected so a test never chmods the host (#399). */
+  snapshotDirState?: (dir: string) => { exists: boolean; writable: boolean };
+  /** Whether the run-session root — where the omp settings overlay is
+   *  materialised at dispatch (#537) — can hold a new `run-<id>` directory. A
+   *  missing `sessions/` parent is not a fault (dispatch's recursive `mkdir`
+   *  creates it), so the writable question falls back to the state dir itself. */
+  sessionRootState?: (root: string) => { exists: boolean; writable: boolean };
   /** The most recent completed runs for one project, newest first, limited. */
   recentRuns?: (project: string, limit: number) => RunSpendRow[];
   /** The bot health probe `status` uses (getMe etc.). */
@@ -286,6 +311,55 @@ function defaultDbIntegrity(path: string): { ok: boolean; detail?: string } {
   }
 }
 
+/**
+ * Whether the configured db-snapshot directory exists and is writable. No
+ * write is performed — the check is stat + access, keeping doctor read-only.
+ * A directory that does not exist reads `writable: false` and lets the probe
+ * report it as "no snapshot yet" rather than inventing one, while a read-only
+ * or non-directory path reads as a genuine unwritable failure.
+ */
+function defaultSnapshotDirState(dir: string): { exists: boolean; writable: boolean } {
+  try {
+    const st = statSync(dir);
+    if (!st.isDirectory()) return { exists: true, writable: false };
+    try {
+      accessSync(dir, constants.W_OK);
+      return { exists: true, writable: true };
+    } catch {
+      return { exists: true, writable: false };
+    }
+  } catch {
+    return { exists: false, writable: false };
+  }
+}
+
+/**
+ * Whether the run-session root can hold a new session directory. No write is
+ * performed — the same stat + access as {@link defaultSnapshotDirState}, which
+ * keeps `doctor` read-only. A missing `sessions/` parent is normal on a fresh
+ * host (dispatch's recursive `mkdir` creates it), so the writable question
+ * falls back to the state dir it would be created under; a state dir that
+ * cannot even be read is a genuine unwritable failure.
+ */
+function defaultSessionRootState(root: string): { exists: boolean; writable: boolean } {
+  const writable = (dir: string): boolean => {
+    try {
+      const st = statSync(dir);
+      if (!st.isDirectory()) return false;
+      accessSync(dir, constants.W_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  try {
+    const st = statSync(root);
+    return { exists: true, writable: st.isDirectory() && writable(root) };
+  } catch {
+    return { exists: false, writable: writable(dirname(root)) };
+  }
+}
+
 /**
  * The most recent completed runs for one project, newest first — read on the
  * same read-only connection the integrity check opens, because the store's own
@@ -419,6 +493,57 @@ function dbProbe(probes: Probes): Finding {
   );
 }
 
+/**
+ * The conductor.db snapshot store (#579): the configured dir is writable so a
+ * snapshot can land, and a snapshot at least as fresh as the store protects
+ * it. The store is the carrier of the verb ledger, the decision rows, the run
+ * rows and the material-event ledger; a store with no restorable copy has no
+ * recovery path, so absence is a warning and an unwritable configured dir a
+ * failure.
+ */
+function dbBackupProbe(probes: Probes, cfg: ConductorConfig | undefined): Finding {
+  const dir = dbBackupDirFor(cfg);
+  const state = probes.snapshotDirState(dir);
+  if (state.exists && !state.writable) {
+    return failFinding(
+      "db-backup",
+      `db backup dir ${dir} is not writable — a conductor.db snapshot cannot land there`,
+      `make ${dir} writable by the conductor account, or set dbBackupDir in config to a writable directory`,
+    );
+  }
+  const snapshots = (() => {
+    try {
+      return readdirSync(dir).filter((name) => name.startsWith(DB_SNAPSHOT_STEM));
+    } catch {
+      return [];
+    }
+  })();
+  const store = probes.stat(dbPath());
+  if (store === undefined) {
+    return snapshots.length === 0
+      ? passFinding("db-backup", "no conductor.db yet — nothing to snapshot")
+      : passFinding("db-backup", `${snapshots.length} conductor.db snapshot(s) present`);
+  }
+  if (snapshots.length === 0) {
+    return warnFinding(
+      "db-backup",
+      "conductor.db has no snapshot — losing it loses the audit trail with no recovery path",
+      "take a conductor.db snapshot (the daemon's cadence files one; restore-db needs one to restore from)",
+    );
+  }
+  const newestMtime = snapshots
+    .map((name) => probes.stat(join(dir, name))?.mtimeMs ?? 0)
+    .reduce((max, m) => Math.max(max, m), 0);
+  if (store.mtimeMs > newestMtime + 60_000) {
+    return warnFinding(
+      "db-backup",
+      `conductor.db is newer than every snapshot (${snapshots.length} file(s)) — the newest writes were never snapshot`,
+      "take a fresh conductor.db snapshot so restore-db has the current state",
+    );
+  }
+  return passFinding("db-backup", `conductor.db snapshot is fresh (${snapshots.length} file(s))`);
+}
+
 /** Every repo the config names: each project's tracker plus routing targets,
  *  as GitHub slugs, deduplicated, in config order. */
 function configuredRepos(cfg: ConductorConfig | undefined): string[] {
@@ -754,6 +879,42 @@ export function isKnownTimezone(tz: string): boolean {
   }
 }
 
+/**
+ * The fleet-owned omp settings overlay (#537): reports the *effective* overlay
+ * every worker session of the project will load — the `ompSettings` map plus
+ * the retry keys derived from `modelFallbacks`, rendered exactly as the
+ * materialiser writes them, never the raw config snippet `setup` would echo —
+ * and turns red when that overlay cannot land. The file is written at dispatch
+ * under `<stateDir>/sessions/run-<id>/`, so doctor cannot prove the write
+ * without writing: it probes the root the materialisation would land in with
+ * the same stat + access the db-backup probe uses, keeping the check
+ * read-only (#287). The session root is a host-wide fact, probed once and
+ * shared across the per-project findings.
+ */
+function ompSettingsProbe(
+  project: ProjectConfig,
+  sessionRoot: { exists: boolean; writable: boolean },
+): Finding {
+  const overlay = ompSettingsOverlay(project);
+  if (overlay === undefined) {
+    return passFinding(
+      "omp-settings",
+      `[${project.name}] no omp settings overlay configured — workers inherit the daemon account's global settings unchanged`,
+    );
+  }
+  if (!sessionRoot.writable) {
+    return failFinding(
+      "omp-settings",
+      `[${project.name}] the omp settings overlay cannot be materialised: ${sessionRootDir()} cannot hold a session directory, so every worker would dispatch without its staged settings`,
+      `make ${sessionRootDir()} writable by the conductor account`,
+    );
+  }
+  return passFinding(
+    "omp-settings",
+    `[${project.name}] worker sessions load this omp settings overlay:\n${stringify(overlay).trimEnd()}`,
+  );
+}
+
 /** The self-identified probe message `--probe-telegram` delivers through the
  *  same report transport a real report would take. */
 function probeMessage(project: string, checkedAt: string): string {
@@ -1076,7 +1237,13 @@ export async function runDoctor(projectName: string | undefined, opts: DoctorDep
   // difference behind a constant count).
   findings.push(backupProbe(probes));
   findings.push(dbProbe(probes));
+  findings.push(dbBackupProbe(probes, cfg));
   findings.push(await ghAuthProbe(probes, configuredRepos(cfg)));
+  // The run-session root is one host-wide fact — where every run's session dir
+  // (and the omp settings overlay inside it) lands — probed once and shared
+  // across the per-project omp-settings findings.
+  const sessionRoot = sessionRootDir();
+  const sessionRootState = probes.sessionRootState(sessionRoot);
   // The collected run sample across the resolved project set, newest-first;
   // spend telemetry is a single host-wide finding, not one per project.
   const spendRows: RunSpendRow[] = [];
@@ -1093,10 +1260,14 @@ export async function runDoctor(projectName: string | undefined, opts: DoctorDep
     findings.push(
       passFinding("herdr-agent-name", projectProblem === undefined ? "no project resolved — nothing to check" : `agent name uncheckable: ${projectProblem}`),
     );
+    findings.push(
+      passFinding("omp-settings", projectProblem === undefined ? "no project resolved — nothing to check" : `omp settings overlay uncheckable: ${projectProblem}`),
+    );
   } else {
     for (const p of projects) {
       findings.push(await labelProbe(probes, p));
       findings.push(herdrAgentNameProbe(probes, p));
+      findings.push(ompSettingsProbe(p, sessionRootState));
     }
   }
   // The installed-unit check is host-global: one shared daemon. Any project
@@ -1149,6 +1320,8 @@ export function defaultProbes(): Probes {
     stat: defaultStat,
     uidOf: defaultUidOf,
     dbIntegrity: defaultDbIntegrity,
+    snapshotDirState: defaultSnapshotDirState,
+    sessionRootState: defaultSessionRootState,
     recentRuns: defaultRecentRuns,
     telegramHealth: (projectName) => probeTelegramHealth(projectName),
     telegramSend: telegramReportSend,

package/src/escalate.ts

@@ -29,8 +29,79 @@ import { heldNoticeId } from "./notices.ts";
 import type { OrchestratorHandle } from "./orchestrator.ts";
 import type { Escalation, ProjectConfig, Store, Tracker } from "./types.ts";
 
-/** Telegram rejects `sendMessage` over 4096 chars; leave room for the marker. */
-const TELEGRAM_TEXT_LIMIT = 4000;
+/**
+ * Telegram rejects `sendMessage` over 4096 characters. Longer text is split
+ * into labelled parts ({@link telegramTextParts}) instead of truncated, so the
+ * tail of a digest or a tier-2 escalation arrives instead of being silently
+ * dropped (#566).
+ */
+export const TELEGRAM_TEXT_LIMIT = 4096;
+
+/**
+ * Width reserved for the `(i/n)` label prepended to every part of a split
+ * message, ported from omp-telegram's `PART_LABEL_RESERVE`. Parts are re-split
+ * against `TELEGRAM_TEXT_LIMIT - TELEGRAM_PART_LABEL_RESERVE` so the label can
+ * never push a part past the wire limit.
+ */
+export const TELEGRAM_PART_LABEL_RESERVE = 16;
+
+/**
+ * Split text into Telegram-sized parts. Ports omp-telegram 0.12.1's
+ * `chunkLabeled` semantics (the plugin this transport bypasses, #566) so a
+ * digest copies the same readability contract that plugin ships:
+ *
+ * - newline-preferred boundaries: a cut prefers the last paragraph break
+ *   (`\n\n`), then line break, then the last space, each only when it lands in
+ *   the second half of the window so parts stay large; an unsplittable run is
+ *   hard-cut rather than dropped.
+ * - numbered labels: when a message takes more than one part, every part is
+ *   prefixed `(i/N)\n` so a reader sees the message continues and knows how
+ *   many parts to expect. Under the label budget, so no part exceeds the limit.
+ * - lossless: a split message reassembles byte-for-byte to its input
+ *   (strip the labels and concatenate). Deliberately *not* ported from
+ *   upstream: fence repair and leading-newline stripping are rendering
+ *   flourishes for markdown-mode sends, and this transport sends plain text
+ *   (`parse_mode` is never set) — both would rewrite bytes the operator never
+ *   wrote.
+ *
+ * Text at or under the limit is returned whole and untouched, so the
+ * single-message path keeps sending byte-identical payloads.
+ */
+export function telegramTextParts(text: string, limit: number = TELEGRAM_TEXT_LIMIT): string[] {
+  if (text.length === 0 || text.length <= limit) return [text];
+  // `splitToLimit` returns at least two pieces here (text is over the limit);
+  // the guard is for future-proofing against a limit rewrite.
+  const parts = splitToLimit(text, Math.max(1, limit));
+  if (parts.length === 1) return parts;
+  // Re-split under the label budget so `(i/N)\n` never pushes a part past the
+  // wire limit.
+  const labelled = splitToLimit(text, Math.max(1, limit - TELEGRAM_PART_LABEL_RESERVE));
+  return labelled.map((part, index) => `(${index + 1}/${labelled.length})\n${part}`);
+}
+
+/**
+ * The base splitter, ported from omp-telegram's `splitToLimit`. Prefers a
+ * paragraph break, then a line break, then a space — each only when it sits in
+ * the second half of the window, so a digest splits on natural boundaries
+ * rather than mid-word. Never drops a byte: the fallback is a hard cut at
+ * `limit`, which split a run with no whitespace in the window in the middle,
+ * and the parts still reassemble to the input.
+ */
+function splitToLimit(text: string, limit: number): string[] {
+  if (text.length <= limit) return [text];
+  const out: string[] = [];
+  let rest = text;
+  while (rest.length > limit) {
+    const para = rest.lastIndexOf("\n\n", limit);
+    const line = rest.lastIndexOf("\n", limit);
+    const space = rest.lastIndexOf(" ", limit);
+    const cut = para > limit / 2 ? para : line > limit / 2 ? line : space > 0 ? space : limit;
+    out.push(rest.slice(0, cut));
+    rest = rest.slice(cut);
+  }
+  out.push(rest);
+  return out;
+}
 
 /**
  * Whether a failed send settles the question of delivery. This distinction is
@@ -471,26 +542,39 @@ export function claimedTelegramTopics(stateDir?: string): ClaimedTopic[] {
  * The one Telegram send in this package. Exported so the report outbox (#123)
  * reuses it rather than forking it: the response handling below is load-bearing
  * and was paid for once already (see the comment on the parse). Resolves with
- * Telegram's own message id when it returns one, and throws on every *known*
- * failure — connection refused, HTTP error, `{"ok":false}` — which is what lets
- * a caller treat a throw as "nobody has this" and a crash as "nobody knows".
+ * Telegram's own message id for every accepted part, in order — one id for a
+ * message under the limit, one per message once a split is needed. Throws on
+ * every *known* failure — connection refused, HTTP error, `{"ok":false}` —
+ * which is what lets a caller treat a throw as "nobody has this" and a crash
+ * as "nobody knows".
+ *
+ * Splitting happens here, at the transport, so every message class that rides
+ * this seam — tier-2 escalations, report parts, fleet pages, operator
+ * messages — is delivered whole: a report's tail is the fleet state and open
+ * items, and a tier-2 escalation's tail may be the question itself (#566).
+ * Parts are sent strictly in order, one `sendMessage` at a time, so they never
+ * interleave with each other.
  *
  * Optional `topicId` pins the message to a forum topic (`message_thread_id`).
- * A definitive missing-thread reject retries once as a flat chat and warns, so a
- * deleted topic degrades instead of silently losing the page (#318).
+ * A definitive missing-thread reject retries once as a flat chat and warns, so
+ * a deleted topic degrades instead of silently losing the page (#318). The
+ * flat retry re-sends the whole split: parts already accepted went into a
+ * thread Telegram has just told us is gone, so nothing is readable there that
+ * a flat resend would duplicate.
  */
 export async function sendTelegram(
   token: string,
   chatId: string,
   text: string,
   opts?: { topicId?: number },
-): Promise<number | undefined> {
+): Promise<number[]> {
   const topicId =
     opts?.topicId !== undefined && Number.isFinite(opts.topicId) && Number.isSafeInteger(opts.topicId)
       ? opts.topicId
       : undefined;
+  const parts = telegramTextParts(text);
   try {
-    return await postTelegramMessage(token, chatId, text, topicId);
+    return await postTelegramParts(token, chatId, parts, topicId);
   } catch (err) {
     if (
       topicId === undefined ||
@@ -503,8 +587,23 @@ export async function sendTelegram(
     warn(
       `escalation.telegramTopicId=${topicId} is stale (${err.message}); retrying flat chat`,
     );
-    return await postTelegramMessage(token, chatId, text, undefined);
+    return await postTelegramParts(token, chatId, parts, undefined);
+  }
+}
+
+/** One part per `sendMessage`, in order, collecting the ids Telegram returns. */
+async function postTelegramParts(
+  token: string,
+  chatId: string,
+  parts: readonly string[],
+  topicId: number | undefined,
+): Promise<number[]> {
+  const ids: number[] = [];
+  for (const part of parts) {
+    const id = await postTelegramMessage(token, chatId, part, topicId);
+    if (id !== undefined) ids.push(id);
   }
+  return ids;
 }
 
 /** Telegram's definitive "that forum topic is gone" answers. */
@@ -521,11 +620,11 @@ async function postTelegramMessage(
   const url = `https://api.telegram.org/bot${token}/sendMessage`;
   const payload: Record<string, unknown> = {
     chat_id: chatId,
-    // ponytail: hard truncation rather than splitting across messages — the
-    // tail of a stack trace is rarely the interesting part. Upgrade path is to
-    // attach the overflow as a file via sendDocument.
-    text:
-      text.length > TELEGRAM_TEXT_LIMIT ? `${text.slice(0, TELEGRAM_TEXT_LIMIT)}\n[truncated]` : text,
+    // `sendTelegram` splits long text into labelled parts above this call, so
+    // the text handed here is always a whole message: a part under the wire
+    // limit, or a message that never needed splitting. Nothing is truncated —
+    // a hard slice here is how the digest lost its tail (#566).
+    text,
     disable_web_page_preview: true,
   };
   if (topicId !== undefined) payload.message_thread_id = topicId;

package/src/failure-class.ts

@@ -157,6 +157,35 @@ export function providerTransientFault(error: { status?: number; message: string
   return error.message.split("\n")[0]?.trim() ?? error.message;
 }
 
+/**
+ * How many in-session provider 429s read as *sustained* rate limiting rather
+ * than a retried blip (#573).
+ *
+ * A single 429 the harness retried and recovered from is noise — counting it
+ * would reclassify every run that ever hit one throttle as a provider fault
+ * and let real failures escape the failed-attempt budget. Only a run that kept
+ * hitting the throttle never gets clear of it, and that is the signature the
+ * classifier needs. Three matches the "three strikes" motif this file already
+ * uses (`DISPATCH_INFRA_MAX_STRIKES`, `PROVIDER_TRANSIENT_MAX_STRIKES`).
+ */
+const SUSTAINED_RATE_LIMIT_COUNT = 3;
+
+/**
+ * Evidence that this run drowned in in-session provider rate limiting, or
+ * `undefined` when it did not.
+ *
+ * Reads the count the worker recorded while the run was live — never a string
+ * match over the transcript, and never `lastError`: omp retried the 429s
+ * internally, so they never surfaced one `lastError`, which is exactly why the
+ * run was previously unclassifiable (#573). 429 is deliberately its own class:
+ * a generic 429 is rate limiting, a 402 is credit, a stream abort is
+ * transient — three failures with three remedies (#220).
+ */
+export function providerCapacityFault(count: number | undefined): string | undefined {
+  if (count === undefined || count < SUSTAINED_RATE_LIMIT_COUNT) return undefined;
+  return `${count} in-session provider rate limits (HTTP 429) — the harness retried and was exhausted`;
+}
+
 /**
  * Evidence that this run never started, or `undefined` when something did happen.
  *
@@ -300,6 +329,24 @@ export function classifyRun(
     }
   }
 
+  // Sustained in-session provider rate limiting: the run drowned in HTTP 429s
+  // the harness retried and never surfaced one as `lastError`, so neither the
+  // credit nor the transient branch sees it and it used to fall through to
+  // `unknown`, spending an implementation attempt on the provider's capacity
+  // (#573). Only the worker-recorded count — above a *sustained* threshold, so
+  // a single retried 429 on an otherwise healthy run stays untouched — reads as
+  // this. Distinct from the two provider classes on purpose and requeued free,
+  // bounded by its own strike cap in the daemon so a permanently throttled
+  // provider escalates instead of looping. Ahead of `neverStarted` for the same
+  // reason as the credit branch: a turn-0 run that immediately drowned in 429s
+  // would otherwise be absorbed by `env-start-failure` and lose its cause.
+  if (run.state === "failed" || run.state === "killed") {
+    const capacity = providerCapacityFault(run.provider429Count);
+    if (capacity !== undefined) {
+      return { cls: "provider-capacity", recovery: "requeue", evidence: capacity };
+    }
+  }
+
   // A run that never started is the most classifiable failure there is, and the
   // least deserving of an implementation attempt: the session did not get as far
   // as reading the issue. See {@link neverStarted} for the two shapes and why the