omp-conductor 0.15.13 → 0.16.0

package/src/fleet.ts

@@ -27,32 +27,17 @@ import {
 import { createInterface } from "node:readline";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
-import { formatZonedMinute } from "./availability.ts";
 import { findProject, loadConfig, stateDir } from "./config.ts";
 import { clearArmChallenge, recordArmChallenge } from "./arm-challenge.ts";
 import { resolveProjectTopicId, sendTelegram } from "./escalate.ts";
-import { planUsageLine, readPlanUsage, sharedUsageSource } from "./usage.ts";
+import { readPlanUsage, sharedUsageSource } from "./usage.ts";
 import { readApprovalSurface, readDaemonProfile } from "./approval-surface.ts";
 import { inspectBriefLayout } from "./brief-upgrade.ts";
 import { dbPath, openStore } from "./store.ts";
 import { renderBriefForProject } from "./setup.ts";
 import type { DaemonStop, ProjectConfig, Store } from "./types.ts";
-import { settlementFlagSummary } from "./diff-flags.ts";
 import { probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
-import { formatDigestBacklog, formatOpenReports } from "./reports.ts";
-import {
-  formatBaseHealth,
-  formatDispatchSummary,
-  formatReleaseGrants,
-  formatSalvagedRuns,
-  isPaused,
-  pauseProvenance,
-  pausedAt,
-  setPaused,
-  statusSnapshot,
-  type StatusSnapshot,
-} from "./daemon.ts";
-import { formatOrchestratorDown } from "./orchestrator-down.ts";
+import { isPaused, setPaused, statusSnapshot } from "./daemon.ts";
 import {
   healthCheck,
   isAlive,
@@ -61,11 +46,19 @@ import {
   runSystemctl,
   stopDaemon,
   type StopResult,
-  type UnitOwnership,
-  SYSTEMD_UNIT,
 } from "./lifecycle.ts";
-import { formatRss, rssBytesFromHealthz } from "./host.ts";
 import type { WorkerPausePhase } from "./worker.ts";
+import {
+  formatFleetStatus,
+  type DaemonProjectHealth,
+  type DispatchLayer,
+  type FleetDaemonProbe,
+  type FleetLayers,
+  type HerdrLayer,
+  type PaneLayer,
+  type TelegramHealth,
+  type TicksLayer,
+} from "./status-render.ts";
 import { fetchRateLimit } from "./tracker/github.ts";
 import {
   LEGACY_ARM_MARKER_DETAIL,
@@ -1023,46 +1016,6 @@ function isOmpProcess(proc: ForegroundProc): boolean {
   return false;
 }
 
-// ---------------------------------------------------------------------------
-// layered status
-// ---------------------------------------------------------------------------
-
-export type DispatchLayer = "running" | "paused" | "stopped";
-export type TicksLayer =
-  | "armed"
-  | "disarmed"
-  | "no-heartbeat-config"
-  | "invalid-heartbeat-config"
-  | "ungated";
-export type PaneLayer = "live" | "missing" | "unknown";
-/** `unpinnable`: no tick config, so FLEET_CWD — the only path recovery reads — is unknown. */
-export type RecoveryLayer = "pinned" | "clear" | "unpinnable";
-export type HerdrLayer = "active" | "inactive" | "unknown";
-export type TelegramLayer = "ok" | "degraded" | "down" | "unconfigured" | "unprobed";
-
-export interface TelegramHealth {
-  kind: TelegramLayer;
-  detail?: string;
-}
-
-export interface FleetLayers {
-  dispatch: DispatchLayer;
-  ticks: TicksLayer;
-  ticksDetail?: string;
-  nextTickAt?: string;
-  pane: PaneLayer;
-  paneDetail?: string;
-  recovery: RecoveryLayer;
-  recoveryDetail?: string;
-  herdr: HerdrLayer;
-  herdrDetail?: string;
-  armedPath?: string;
-  tickConfigPath?: string;
-  paneHaltPath?: string;
-  paused: boolean;
-  daemon: { running: boolean; pid?: number; port?: number };
-}
-
 /**
  * The project a bare read means, when the config leaves no doubt.
  *
@@ -1270,50 +1223,6 @@ export function workerPhasesFromHealthz(
 }
 
 
-export function formatCodeGraphHealth(graph: CodeGraphHealth, now = Date.now()): string | undefined {
-  if (!graph.configured) return undefined;
-  const indexed = graph.repos.filter((repo) => repo.index === "present").length;
-  let refresh: string = graph.refresh.result;
-  if (graph.refresh.lastSuccessAt !== undefined) {
-    const ageMs = Math.max(0, now - Date.parse(graph.refresh.lastSuccessAt));
-    refresh = `${graph.refresh.lastSuccessAt} (${Math.max(1, Math.ceil(ageMs / 60_000))}m ago)`;
-  }
-  return [
-    `code graph  ${graph.status}  ${indexed}/${graph.repos.length} repos indexed`,
-    `  indexer   ${graph.prerequisites.indexer}`,
-    `  MCP mount ${graph.prerequisites.mcpMount}`,
-    `  timer     ${graph.timer.enabled} / ${graph.timer.active}`,
-    `  refresh   ${refresh}`,
-    ...graph.reasons.map((reason) => `  - ${reason}`),
-  ].join("\n");
-}
-
-
-/**
- * Project-scoped reading of a living daemon record + `/healthz` body.
- *
- * Board and `status` share this so a host running one daemon for several
- * projects cannot be called healthy for a project it does not serve (#379).
- * A third interpretation convention is forbidden.
- */
-export type DaemonProjectHealth =
-  | { kind: "stopped" }
-  | { kind: "ok" }
-  | { kind: "unreachable" }
-  | { kind: "other-project"; serves?: string };
-
-/**
- * Facts `formatFleetStatus` needs about the living daemon. Pure input — the
- * caller probes; the formatter never shells out (#379).
- */
-export type FleetDaemonProbe = {
-  project: DaemonProjectHealth;
-  /** `/healthz` body when the probe is project-ok (rss / overlays). */
-  body?: string;
-  /** systemd ownership of the living record pid; omit when unprobed. */
-  unit?: UnitOwnership;
-};
-
 /**
  * Decide whether a living record + optional `/healthz` answer serve `project`.
  *
@@ -1372,306 +1281,6 @@ function servedProjectName(payload: object): string | undefined {
   return undefined;
 }
 
-function formatDaemonHealthz(probe: FleetDaemonProbe | undefined): string {
-  if (probe === undefined) return "unprobed";
-  switch (probe.project.kind) {
-    case "stopped":
-      return "stopped";
-    case "ok":
-      return "ok";
-    case "unreachable":
-      return "unreachable — the process is up but not serving";
-    case "other-project":
-      return probe.project.serves === undefined
-        ? "other-project"
-        : `other-project — serves ${probe.project.serves}`;
-  }
-}
-
-/**
- * Unit line for a living record. The bare unit name alone used to imply
- * systemd ownership that was never checked (#379); every branch states the
- * probe result, and `unknown` is never rendered as owned.
- */
-function formatDaemonUnit(unit: UnitOwnership | undefined, recordPid: number): string {
-  if (unit === undefined) return `  unit      ${SYSTEMD_UNIT}  unprobed`;
-  switch (unit.kind) {
-    case "active":
-      if (unit.pid === recordPid) {
-        return `  unit      ${SYSTEMD_UNIT}  systemd-owned`;
-      }
-      // Live unit, different MainPID — the record pid is not systemd's.
-      return `  unit      ${SYSTEMD_UNIT}  unmanaged — MainPID ${unit.pid}`;
-    case "failed":
-      return `  unit      ${SYSTEMD_UNIT}  unmanaged — unit failed`;
-    case "inactive":
-      return `  unit      ${SYSTEMD_UNIT}  inactive`;
-    case "unknown":
-      return `  unit      ${SYSTEMD_UNIT}  unknown — ${unit.reason}`;
-  }
-}
-
-/**
- * The newest daemon stop/restart provenance as status lines (#378).
- *
- * Rendered under the daemon block whether the daemon is down or has since
- * been restarted — the whole point is that the debrief survives the restart.
- * An unattributed record says so explicitly: the external-signal fallback
- * records what the receiving daemon knew (that it was unattributed, when,
- * which projects it served with live counts) rather than guessing a caller.
- */
-function formatLastStop(lastStop: DaemonStop | undefined): string[] {
-  if (lastStop === undefined) return [];
-  const caller = lastStop.unattributed
-    ? "unattributed — no mediated request (external signal)"
-    : `pid ${lastStop.callerPid ?? "?"}` +
-      (lastStop.callerUid === undefined ? "" : ` uid ${lastStop.callerUid}`) +
-      (lastStop.role === undefined ? "" : ` (${lastStop.role})`);
-  return [
-    `  last stop  ${new Date(lastStop.at).toISOString()}  ${lastStop.controlPath}`,
-    `  caller     ${caller}`,
-    `  scope      ${lastStop.scope}${lastStop.project === undefined ? "" : `: ${lastStop.project}`}`,
-    `  affects    ${lastStop.affected.map((a) => `${a.project} (${a.live} live)`).join(", ")}`,
-    `  reason     ${lastStop.reason}`,
-  ];
-}
-
-export function formatFleetStatus(
-  s: StatusSnapshot,
-  layers: FleetLayers,
-  daemon: FleetDaemonProbe | undefined = undefined,
-  telegram: TelegramHealth = { kind: "unprobed" },
-  now = Date.now(),
-  codeGraph: CodeGraphHealth = { configured: false },
-  brief: string | undefined = undefined,
-  decisions: string | undefined = undefined,
-  failureClasses: string | undefined = undefined,
-  workerPhases: ReadonlyMap<number, WorkerPausePhase> = new Map(),
-  intake: string | undefined = undefined,
-  lastStop: DaemonStop | undefined = undefined,
-): string {
-  const tickLine =
-    layers.ticksDetail === undefined
-      ? `ticks     ${layers.ticks}`
-      : `ticks     ${layers.ticks}  (${layers.ticksDetail})`;
-  let nextTickLine: string | undefined;
-  if (layers.nextTickAt !== undefined) {
-    const delta = Date.parse(layers.nextTickAt) - now;
-    const minutes = Math.max(1, Math.ceil(Math.abs(delta) / 60_000));
-    nextTickLine =
-      `next tick ${layers.nextTickAt}  ` +
-      `(${delta >= 0 ? `in ${minutes}m` : `overdue by ${minutes}m`})`;
-  }
-  const paneLine =
-    layers.paneDetail === undefined
-      ? `pane      ${layers.pane}`
-      : `pane      ${layers.pane}  (${layers.paneDetail})`;
-  const recoveryLine =
-    layers.recoveryDetail === undefined
-      ? `recovery  ${layers.recovery}`
-      : `recovery  ${layers.recovery}  (${layers.recoveryDetail})`;
-  const herdrLine =
-    layers.herdrDetail === undefined
-      ? `herdr     ${layers.herdr}`
-      : `herdr     ${layers.herdr}  (${layers.herdrDetail})`;
-  const telegramLine =
-    telegram.detail === undefined
-      ? `telegram  ${telegram.kind}`
-      : `telegram  ${telegram.kind}  (${telegram.detail})`;
-
-  let daemonBlock: string;
-  if (!layers.daemon.running || layers.daemon.pid === undefined) {
-    daemonBlock = "daemon    not running";
-  } else {
-    // Only trust rss from a project-ok body — a foreign payload's bytes are
-    // not this project's daemon facts (#379).
-    const rss =
-      daemon?.project.kind === "ok" ? rssBytesFromHealthz(daemon.body) : undefined;
-    daemonBlock = [
-      "daemon",
-      `  pid       ${layers.daemon.pid}`,
-      `  port      ${layers.daemon.port ?? "?"}`,
-      ...(rss === undefined ? [] : [`  rss       ${formatRss(rss)}`]),
-      `  healthz   ${formatDaemonHealthz(daemon)}`,
-      formatDaemonUnit(daemon?.unit, layers.daemon.pid),
-    ].join("\n");
-  }
-
-  const graphBlock = formatCodeGraphHealth(codeGraph, now);
-
-  // Pause provenance (`pause --reason`, an integrity/spend-cap/upgrade pause,
-  // a halt) answers "who stopped the fleet" without opening a file (#185). An
-  // unparseable sentinel — paused but with no datable line 1 — is itself news:
-  // it means a run admitted before an *unknown* pause cannot prove innocence
-  // (#174), so completion mutations fail closed while release gates remain usable.
-  const dispatchLine =
-    layers.dispatch === "paused"
-      ? (() => {
-          const prov = pauseProvenance(s.project);
-          if (prov !== undefined) {
-            const reason = prov.reason === undefined ? "" : ` — "${prov.reason}"`;
-            return `dispatch  paused (source: ${prov.source}${reason})`;
-          }
-          return isPaused(s.project) && pausedAt(s.project) === undefined
-            ? "dispatch  paused (unparseable sentinel — new work and completion mutations refused; release gates remain available)"
-            : "dispatch  paused";
-        })()
-      : `dispatch  ${layers.dispatch}`;
-
-  return [
-    dispatchLine,
-    tickLine,
-    ...(nextTickLine === undefined ? [] : [nextTickLine]),
-    paneLine,
-    recoveryLine,
-    herdrLine,
-    telegramLine,
-    ...(brief === undefined ? [] : [brief]),
-    ...(decisions === undefined ? [] : [decisions]),
-    ...(failureClasses === undefined ? [] : [failureClasses]),
-    ...(intake === undefined ? [] : [intake]),
-    ...(graphBlock === undefined ? [] : [graphBlock]),
-    daemonBlock,
-    ...formatLastStop(lastStop),
-    "",
-    formatProjectBody(s, workerPhases, now),
-  ].join("\n");
-}
-
-function formatAvailabilityStatus(s: StatusSnapshot): string[] {
-  const availability = s.availability;
-  if (availability === undefined) return [];
-  if (availability.mode === "always") {
-    return ["availability 24-hour interrupts (no weekly window)"];
-  }
-  const mode =
-    availability.nextTransitionAt === undefined || availability.timezone === undefined
-      ? `${availability.mode}; next transition could not be calculated`
-      : `${availability.mode} until ${formatZonedMinute(availability.nextTransitionAt, availability.timezone)}`;
-  const bypass = availability.bypass.length === 0 ? "none" : availability.bypass.join(", ");
-  return [`availability ${mode}; quiet-hours bypass ${bypass}`];
-}
-
-function formatDigestScheduleStatus(s: StatusSnapshot): string[] {
-  const schedule = s.digestSchedule;
-  if (schedule === undefined) return [];
-  if (schedule.mode === "disabled") return ["next digest disabled"];
-  if (schedule.mode === "per-tick") return ["next digest every tick"];
-  if (schedule.mode === "due") return ["next digest due now"];
-  return [
-    schedule.nextAt === undefined
-      ? "next digest could not be calculated"
-      : `next digest ${formatZonedMinute(schedule.nextAt, schedule.timezone)}`,
-  ];
-}
-
-function formatProjectBody(
-  s: StatusSnapshot,
-  workerPhases: ReadonlyMap<number, WorkerPausePhase> = new Map(),
-  now = Date.now(),
-): string {
-  const lines = [
-    `project   ${s.project}${s.paused ? "  (PAUSED)" : ""}`,
-    ...(s.pauseReason === undefined ? [] : [`paused    ${s.pauseReason}`]),
-    `config    ${s.configPath}`,
-    `state     ${s.stateDir}`,
-    // The orchestrator-down degrade row: first-class in the body, present only
-    // while the incident is open, so recovery drops it (#288).
-    ...(s.orchestratorDown === undefined
-      ? []
-      : formatOrchestratorDown(s.orchestratorDown, now)),
-    ...formatAvailabilityStatus(s),
-    ...formatDigestScheduleStatus(s),
-    "",
-    "caps",
-    `  workers            ${s.liveWorkers} / ${s.caps.maxConcurrentWorkers}`,
-    `  issues today       ${s.runsToday}`,
-    s.caps.dailySpendUsd === null
-      ? `  spend today        $${s.spendTodayUsd.toFixed(2)} (no daily cap)`
-      : `  spend today        $${s.spendTodayUsd.toFixed(2)} / $${s.caps.dailySpendUsd.toFixed(2)}`,
-    // Its own row beside the spend row, never folded into it: they are two
-    // independent controls and an operator has to see which one stopped the
-    // fleet (#110).
-    `  plan usage         ${planUsageLine(s.planUsage)}`,
-    // The tracker's API budget, when the renderer could read it. Absent on a
-    // broken `gh`: one missing row, never a broken report (#188). Next to it,
-    // the refusals the tracker actually observed, so a budget that looks
-    // healthy next to every call being refused is still visible (#198).
-    ...(s.github === undefined
-      ? []
-      : [
-          `  github             graphql ${s.github.graphql.remaining}/${s.github.graphql.limit}, core ${s.github.core.remaining}/${s.github.core.limit} (graphql resets ${Math.max(0, Math.round((s.github.graphql.reset * 1000 - Date.now()) / 60_000))}m)` +
-            (s.ghRefusals === undefined || s.ghRefusals.count === 0
-              ? ""
-              : ` — ${s.ghRefusals.count} refusal(s) in last 5m (last ${new Date(s.ghRefusals.latestAt ?? Date.now()).toISOString().slice(11, 19)}Z)`),
-        ]),
-    // The daemon's own observed github traffic today (#198): a separate row
-    // from the polled budget above, so one missing `status` read never hides
-    // the other. `onCall` counts every spawn including ones that end 304, so
-    // `daemon` is spawns and `daemon-304` is the unbilled subset — billed ≈
-    // difference, and the polled budget row stays the authority (#203).
-    `  github calls       daemon ${s.ghCallsToday?.find((c) => c.source === "daemon")?.calls ?? 0} today` +
-      ((s.ghCallsToday?.find((c) => c.source === "daemon-304")?.calls ?? 0) === 0
-        ? ""
-        : ` (${s.ghCallsToday!.find((c) => c.source === "daemon-304")!.calls} free 304s)`),
-    // Label-projection ops the tracker has not applied yet (#201): GitHub is
-    // behind what the store decided, and the operator can see the lag instead
-    // of discovering it as a stale label or a missing one.
-    ...(s.labelOps === undefined
-      ? []
-      : [
-          `  labels             projection ${s.labelOps.pending} pending (oldest ${
-            s.labelOps.oldestAgeMs >= 60_000
-              ? `${Math.round(s.labelOps.oldestAgeMs / 60_000)}m`
-              : `${Math.max(1, Math.round(s.labelOps.oldestAgeMs / 1000))}s`
-          })`,
-        ]),
-    `  new worker turns   ${s.caps.workerMaxTurns}`,
-    ...s.turnOverrides.map(
-      ({ issue, maxTurns }) => `  turn override      #${issue} → ${maxTurns} (next attempt)`,
-    ),
-    `  worker wall clock  ${Math.round(s.caps.workerWallClockMs / 60_000)}m`,
-    `  failed attempts    ${s.caps.maxAttemptsPerIssue}`,
-    `  continuations      ${s.caps.maxContinuationsPerIssue}`,
-    "",
-    ...formatReleaseGrants(s.releaseGrants),
-    "",
-    formatDispatchSummary(s.dispatch),
-    "",
-  ];
-  if (s.activeRuns.length === 0) {
-    lines.push("active runs  (none)");
-  } else {
-    lines.push("active runs");
-    for (const r of s.activeRuns) {
-      const phase = workerPhases.get(r.issue);
-      const state = phase === "pausing" || phase === "paused" ? phase : r.state;
-      lines.push(
-        `  #${r.issue}  ${r.repo}  ${state}  attempt ${r.attempt}  ` +
-          `${r.turns}/${r.maxTurns} turns  ${r.spendUsd.toFixed(2)}  ${r.branch}` +
-          (r.prUrl ? `  ${r.prUrl}` : ""),
-      );
-      // The orchestrator's Duty 1 reads this command, and a flagged run's
-      // escalation is deduplicated after one delivery — so this is where a
-      // flagged PR stays visible for as long as it is still open (#128).
-      const flagged = settlementFlagSummary(r.settlementFlags);
-      if (flagged !== undefined) lines.push(`      ${flagged}`);
-    }
-  }
-  lines.push(...formatBaseHealth(s.baseHealth));
-  lines.push(...formatSalvagedRuns(s.salvagedRuns));
-  lines.push(...formatOpenReports(s.openReports));
-  lines.push(...formatDigestBacklog(s.digestBacklog));
-  if (s.liveWorkers > 0) {
-    lines.push(
-      "",
-      `deploy    ${s.liveWorkers} live worker(s) — restart salvages dirty trees then orphans the rows; ` +
-        `hold and wait for workers 0/${s.caps.maxConcurrentWorkers} when you can drain instead`,
-    );
-  }
-  return lines.join("\n");
-}
-
 export async function renderStatus(projectName?: string): Promise<string> {
   const s = statusSnapshot(projectName);
   const layers = fleetLayers(projectName);
@@ -1716,8 +1325,16 @@ export async function renderStatus(projectName?: string): Promise<string> {
   // project and the uninvolved one must see who stopped it too.
   const store = openStore(dbPath());
   let lastStop: DaemonStop | undefined;
+  let siblings: { project: string; live: number }[] = [];
   try {
     lastStop = store.latestDaemonStop();
+    // Shared-daemon visibility (#545): every configured project other than the
+    // one being viewed, with its live-run count. Read from the same open store
+    // as the provenance above, so a status reader can tell "my fleet is idle"
+    // from "the process I am about to stop is busy".
+    siblings = loadConfig()
+      .projects.filter((p) => p.name !== project.name)
+      .map((p) => ({ project: p.name, live: store.liveRuns(p.name).length }));
   } finally {
     store.close();
   }
@@ -1734,6 +1351,7 @@ export async function renderStatus(projectName?: string): Promise<string> {
     workerPhases,
     intakeStatusLine(project.name),
     lastStop,
+    siblings,
   );
 }
 
@@ -1793,18 +1411,32 @@ function failureClassBlock(projectName: string): string | undefined {
  * the ambiguity this ledger exists to remove. Omitted on any throw — a status
  * that fails to render because the store is mid-migration is worse than one
  * missing a row.
+ *
+ * `decisions N open` counts only rows a human must answer (#459). Watches the
+ * orchestrator set for itself are reported separately — a fleet with three
+ * watches behind GitHub's checks is not a fleet waiting on its operator, and
+ * lumping them in made `decisions 3 open` read as three unanswered questions.
  */
-function decisionStatusLine(projectName: string): string | undefined {
+export function decisionStatusLine(projectName: string): string | undefined {
   const path = dbPath();
   if (!existsSync(path)) return undefined;
   let store: Store | undefined;
   try {
     store = openStore(path);
     const open = store.openDecisions(projectName);
-    if (open.length === 0) return "decisions none open";
-    const oldest = open[0]!;
-    const hours = Math.max(0, Math.round((Date.now() - oldest.askedAt) / 3_600_000));
-    return `decisions ${open.length} open (oldest ${hours}h)`;
+    const questions = open.filter((d) => d.kind !== "watch");
+    const watches = open.filter((d) => d.kind === "watch");
+    if (questions.length === 0 && watches.length === 0) return "decisions none open";
+    let line: string;
+    if (questions.length === 0) {
+      line = "decisions none open";
+    } else {
+      const oldest = questions[0]!;
+      const hours = Math.max(0, Math.round((Date.now() - oldest.askedAt) / 3_600_000));
+      line = `decisions ${questions.length} open (oldest ${hours}h)`;
+    }
+    if (watches.length > 0) line += ` · watches ${watches.length}`;
+    return line;
   } catch {
     return undefined;
   } finally {
@@ -2167,4 +1799,3 @@ function probeOmpPane(
     return { kind: "unknown", reason: err instanceof Error ? err.message : String(err) };
   }
 }
-

package/src/gitops.ts

@@ -96,10 +96,95 @@ export function scrubUserinfo(text: string): string {
   return text.replace(URL_USERINFO, "$1***@");
 }
 
-function mirrorPath(project: Pick<ProjectConfig, "mirrorRoot">, repo: RepoTarget): string {
+export function mirrorPath(project: Pick<ProjectConfig, "mirrorRoot">, repo: RepoTarget): string {
   return join(project.mirrorRoot, `${repo.name}.git`);
 }
 
+/**
+ * Everything the file-lane interlock (#555) needs to read one active run's lane.
+ *
+ * The dispatcher may read worktrees — this is squarely its job, and the issue
+ * is explicit that the orchestrator must not be the one guessing file lanes
+ * from another run's tree. A live run advertises its lane from its own worktree
+ * (`git status --porcelain` plus `git diff --name-only <base>...HEAD`, exactly
+ * the two commands the continuation brief already hands every worker), which is
+ * the truth rather than the run's issue body — the incident this interlock
+ * exists for was an issue *saying* one set of files while its tree wrote
+ * another. A worker-finished run (`pushed-pending` / `pushed-green`) no longer
+ * has a worktree, but its open PR still reaches for base's files, so its lane
+ * is read from the retained branch in the mirror instead.
+ */
+export interface RunLaneInput {
+  /** Conductor-created worktree path; `""` when the run has no live checkout. */
+  worktree: string;
+  /** Tracking ref of the base branch to diff against, e.g. `refs/remotes/origin/main`. */
+  baseRef: string;
+  /** The run's branch ref in the mirror (e.g. `refs/heads/feat-x`), for a
+   *  worker-finished run whose worktree has been removed. */
+  branchRef?: string;
+  /** The repo's bare mirror directory, for the branch-diff read. */
+  mirror?: string;
+}
+
+/**
+ * The set of file paths one active run has touched relative to base, deduped
+ * and sorted. Persistable but advisory: the admitting gate treats an unreadable
+ * or absent lane as "no overlap" (fail open), so no probe bug can refuse a
+ * well-formed issue.
+ */
+export type RunLaneProbe = (input: RunLaneInput) => Promise<string[]>;
+
+/** The real one, reading the run's own worktree and/or the mirror branch. */
+export async function probeRunLane(
+  input: RunLaneInput,
+  exec: Exec = spawnCaptured,
+): Promise<string[]> {
+  const files = new Set<string>();
+  const add = (raw: string): void => {
+    for (const line of raw.split("\n")) {
+      const path = line.trim();
+      if (path !== "") files.add(path);
+    }
+  };
+  if (input.worktree !== "") {
+    const status = await exec(["git", "-C", input.worktree, "status", "--porcelain"], {});
+    if (status.code === 0) {
+      for (const path of parsePorcelain(status.stdout)) files.add(path);
+    }
+    const diff = await exec(
+      ["git", "-C", input.worktree, "diff", "--name-only", `${input.baseRef}...HEAD`],
+      {},
+    );
+    if (diff.code === 0) add(diff.stdout);
+  }
+  if (input.branchRef !== undefined && input.mirror !== undefined && input.mirror !== "") {
+    const diff = await exec(
+      ["git", "--git-dir", input.mirror, "diff", "--name-only", `${input.baseRef}...${input.branchRef}`],
+      {},
+    );
+    if (diff.code === 0) add(diff.stdout);
+  }
+  return [...files].sort();
+}
+
+/**
+ * Parse `git status --porcelain` output into the paths it names. A rename or
+ * copy is reported as `XY old -> new`, and the *new* path is the one that
+ * occupies the lane (it is the path the other run's future writes would
+ * collide with), so the arrow form keeps only its target.
+ */
+function parsePorcelain(stdout: string): string[] {
+  const out = new Set<string>();
+  for (const raw of stdout.split("\n")) {
+    if (raw.length < 3) continue;
+    let rest = raw.slice(2).trim();
+    const arrow = rest.indexOf(" -> ");
+    if (arrow !== -1) rest = rest.slice(arrow + 4).trim();
+    if (rest !== "") out.add(rest);
+  }
+  return [...out];
+}
+
 /** GitHub slug parsed off the clone URL, falling back to the routing name. */
 export function repoSlugFor(repo: RepoTarget): string {
   const m = /(?:[:/])([^/:]+\/[^/]+?)(?:\.git)?$/.exec(repo.cloneUrl);

package/src/log.ts

@@ -0,0 +1,40 @@
+/**
+ * Shared daemon logging and best-effort escalation delivery.
+ *
+ * Split out of `daemon.ts` so the extracted admission module (and any future
+ * extracted concern) can log and escalate without importing the composition
+ * root back — which would be the circular-import failure mode the daemon split
+ * (#571) exists to rule out. `daemon.ts` composes; the leaf modules talk only
+ * to other leaves.
+ */
+
+import { escalationIssueRef } from "./escalate.ts";
+import type { Escalation } from "./types.ts";
+
+/** One timestamped line to stderr — the daemon's canonical log sink. */
+export function log(msg: string): void {
+  process.stderr.write(`[conductor ${new Date().toISOString()}] ${msg}\n`);
+}
+
+/** A stable one-line rendering of an unknown thrown value. */
+export function errText(e: unknown): string {
+  return e instanceof Error ? (e.stack ?? e.message) : String(e);
+}
+
+/**
+ * Best-effort escalation delivery: never let a failed page take down the
+ * pass, and say in the log that it failed. Structural `escalate` only — the
+ * caller's full dep object satisfies it without importing anything back.
+ */
+export async function safeEscalate(
+  d: { escalate(e: Escalation): Promise<void> },
+  e: Escalation,
+): Promise<boolean> {
+  try {
+    await d.escalate(e);
+    return true;
+  } catch (err) {
+    log(`escalation for ${escalationIssueRef(e.issue)} could not be delivered: ${errText(err)}`);
+    return false;
+  }
+}