omp-conductor 0.15.13 → 0.16.1

package/src/dashboard/server.ts

@@ -28,7 +28,8 @@ import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync }
 import { join } from "node:path";
 import { loadConfig, stateDir } from "../config.ts";
 import { healthCheck, livingDaemon, type DaemonRecord } from "../lifecycle.ts";
-import { classifyDaemonProjectHealth, fleetLayers, type FleetLayers } from "../fleet.ts";
+import { classifyDaemonProjectHealth, fleetLayers } from "../fleet.ts";
+import type { FleetLayers } from "../status-render.ts";
 import { statusSnapshot, type StatusSnapshot } from "../daemon.ts";
 import { boardJson, boardSnapshotOnce } from "../board.ts";
 import { dbPath, openStore } from "../store.ts";

package/src/decisions.ts

@@ -235,15 +235,40 @@ function age(since: number, now: number): string {
  * being a memory question. A row whose condition has come true is flagged, not
  * merely listed — that is the difference between a parked question and one to
  * act on now.
+ *
+ * The two kinds render under their own headings (#459). Only rows a human must
+ * answer — `kind === "question"`, whatever condition they carry — appear under
+ * the operator heading; a watch the orchestrator set for itself goes under the
+ * watch heading with no instruction to resolve it, so a fleet at rest behind
+ * GitHub's checks is never mistaken for a fleet that is waiting on its
+ * operator. A met watch still surfaces to the orchestrator with its note and
+ * the same `[CONDITION MET]` flag a met question gets.
  */
 export function formatDecisionDigest(open: readonly DecisionRecord[], now = Date.now()): string {
-  if (open.length === 0) return "";
-  const lines = [
-    `Open operator decisions (${open.length}) — resolve or withdraw each with omp-conductor decision resolve|withdraw <id>:`,
-  ];
-  for (const d of open) {
-    const flag = d.conditionMetAt === undefined ? "" : " [CONDITION MET — act on this now]";
-    lines.push(`- ${d.id} (${age(d.askedAt, now)}, blocks ${d.blocks ?? "nothing"})${flag}: ${d.question}`);
+  const questions = open.filter((d) => d.kind !== "watch");
+  const watches = open.filter((d) => d.kind === "watch");
+  const lines: string[] = [];
+  if (questions.length > 0) {
+    lines.push(
+      `Open operator decisions (${questions.length}) — resolve or withdraw each with omp-conductor decision resolve|withdraw <id>:`,
+    );
+    for (const d of questions) {
+      lines.push(decisionLine(d, now));
+    }
+  }
+  if (watches.length > 0) {
+    lines.push(
+      `Watches (${watches.length}) — conditions the orchestrator set for itself; no operator action needed:`,
+    );
+    for (const d of watches) {
+      lines.push(decisionLine(d, now));
+    }
   }
   return lines.join("\n");
 }
+
+/** One digest row: id, age, what it blocks, the met flag, and the note. */
+function decisionLine(d: DecisionRecord, now: number): string {
+  const flag = d.conditionMetAt === undefined ? "" : " [CONDITION MET — act on this now]";
+  return `- ${d.id} (${age(d.askedAt, now)}, blocks ${d.blocks ?? "nothing"})${flag}: ${d.question}`;
+}

package/src/depends-on.ts

@@ -0,0 +1,122 @@
+/**
+ * The `Depends-on:` declaration parser (epic #321, slices #419/#420).
+ *
+ * A candidate issue can declare prerequisites it must not be dispatched
+ * before: `Depends-on: #123` (a same-repo issue) or `Depends-on:
+ * owner/repo#123` (an issue in a routed repository), repeatable one or more
+ * per line. Admission reads every referenced issue's live tracker state and
+ * holds the candidate while any prerequisite is open, so a worker is never
+ * sent at work whose base is not yet merged.
+ *
+ * The parser is deliberately small and strict, the two halves of the contract:
+ * the *marker* is matched case-insensitively (so `DEPENDS-ON`, `Depends-On`,
+ * `depends-on` all declare), while the *references* are strict — a bare issue
+ * number (`#123`) or a qualifying `owner/repo#123` with exactly two path
+ * segments glued to the number. A marker line that carries no strict
+ * reference — an empty `Depends-on:`, a bare non-numeric `Depends-on: #abc`,
+ * or a slashed-but-unqualified form that is not `owner/repo#n` — is never a
+ * usable prerequisite, so it is reported as `malformed` for the grooming flag
+ * rather than guessed at, and the declaration it belongs to is ignored.
+ *
+ * Graph cycles are a later slice (#421) and stay out of scope here.
+ */
+
+export interface DependsOnDecl {
+  /** Referenced same-repo prerequisite issue numbers, deduplicated,
+   *  first-seen order. */
+  readonly refs: readonly number[];
+  /** Referenced cross-repo prerequisites (`owner/repo#n`), deduplicated,
+   *  first-seen order. Admission resolves these against the fleet's routed
+   *  repositories, never against the candidate's own repo (#420). */
+  readonly crossRefs: readonly DependsOnCrossRef[];
+  /** Marker-bearing lines that carried no strict reference (e.g.
+   *  `Depends-on: #abc`). Bounded to what the body actually said, for the
+   *  grooming flag's detail. */
+  readonly malformed: readonly string[];
+}
+
+/**
+ * A strict cross-repo reference. `repo` is the canonical `owner/repo` spelling
+ * from the body, untouched, so admission can match it by identity against the
+ * fleet's routed repositories rather than by guess.
+ */
+export interface DependsOnCrossRef {
+  readonly repo: string;
+  readonly issue: number;
+}
+
+/**
+ * How a line is spelled: `depends-on`/`depends on`, optional whitespace, then
+ * a `:` or `=` separator. The marker is matched case-insensitively; the value
+ * (everything after the separator) is what the strict-reference rules apply
+ * to. Anchored at the start of the (trimmed) line so a prose mention of
+ * "Depends-on" mid-sentence is not a declaration.
+ */
+const MARKER = /^depends[-\s]?on\s*[:=]\s*(.*)$/i;
+
+/** A strict same-repo reference is a bare `#` followed by digits — no repo
+ *  qualifier, no words. The negative lookbehind means a `#<n>` glued to a
+ *  word (e.g. `web#7` or `issue#5`) is not a bare reference: without the
+ *  `owner/` segment it is neither a valid cross-repo ref nor a valid
+ *  same-repo one, so it is flagged malformed rather than silently resolved in
+ *  the candidate's own repo. */
+const REF = /(?<![A-Za-z0-9._/-])#(\d+)/g;
+
+/**
+ * A strict cross-repo reference is `owner/repo#<n>` — exactly two path
+ * segments (each a GitHub owner/repository charset run) glued to a bare issue
+ * number, no whitespace. Scanned before {@link REF} and blanked out of the
+ * value, so the trailing `#<n>` is never re-read as a *same-repo* reference:
+ * the whole point of the qualified form is that it names a different
+ * repository, and resolving it in the candidate's own repo is the #420 fake.
+ */
+const CROSS_REF = /([A-Za-z0-9][A-Za-z0-9._-]*)\/([A-Za-z0-9][A-Za-z0-9._-]*)#(\d+)/g;
+
+export function parseDependsOn(body: string): DependsOnDecl {
+  const refs: number[] = [];
+  const seen = new Set<number>();
+  const crossRefs: DependsOnCrossRef[] = [];
+  const seenCross = new Set<string>();
+  const malformed: string[] = [];
+  for (const raw of body.split("\n")) {
+    const line = raw.trim();
+    if (line === "") continue;
+    const match = MARKER.exec(line);
+    if (match === null) continue;
+    const value = match[1] ?? "";
+
+    // Cross-repo references first, blanked out of the value so their `#<n>`
+    // cannot also be collected as a same-repo reference below.
+    let lineHadRef = false;
+    const masked = value.replace(CROSS_REF, (whole, owner, name, number) => {
+      const repo = `${owner}/${name}`;
+      const n = Number(number);
+      if (Number.isSafeInteger(n) && !seenCross.has(`${repo}#${n}`)) {
+        seenCross.add(`${repo}#${n}`);
+        crossRefs.push({ repo, issue: n });
+      }
+      lineHadRef = true;
+      return " ".repeat(whole.length);
+    });
+
+    REF.lastIndex = 0;
+    const found = [...masked.matchAll(REF)];
+    for (const group of found) {
+      const n = Number(group[1]!);
+      if (Number.isSafeInteger(n) && !seen.has(n)) {
+        seen.add(n);
+        refs.push(n);
+      }
+      lineHadRef = true;
+    }
+
+    if (!lineHadRef) {
+      // A marker line with no strict reference — same-repo or cross-repo — is
+      // a malformed declaration: never crash, never silently claim — the
+      // declaration is ignored and surfaced for grooming.
+      malformed.push(line);
+      continue;
+    }
+  }
+  return { refs, crossRefs, malformed };
+}

package/src/doctor.ts

@@ -25,21 +25,46 @@
  *     (the #399 boundary).
  */
 
-import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import {
+  accessSync,
+  constants,
+  existsSync,
+  readdirSync,
+  readFileSync,
+  statSync,
+} from "node:fs";
 import { spawnSync } from "node:child_process";
 import { homedir } from "node:os";
-import { join } from "node:path";
+import { dirname, join, sep } from "node:path";
 import type { Stats } from "node:fs";
 import { Database } from "bun:sqlite";
+import { stringify } from "yaml";
 
-import { configBackupDir, configPath, findProject, loadConfig, resolveCaps, stateDir } from "./config.ts";
+import {
+  configBackupDir,
+  configPath,
+  dbBackupDirFor,
+  findProject,
+  loadConfig,
+  resolveCaps,
+  stateDir,
+} from "./config.ts";
+import { ompSettingsOverlay, sessionRootDir } from "./omp-settings.ts";
 import {
   DEFAULT_HERDR_UNIT,
   probeTelegramHealth,
   resolveHerdrSessionWithBridge,
+  sessionsRoot,
+  sessionDirForCwd,
   telegramStateDir,
-  type TelegramHealth,
 } from "./fleet.ts";
+import type { TelegramHealth } from "./status-render.ts";
+import {
+  claimForProject,
+  claimedTelegramTopics,
+  telegramTopicsTidy,
+  type ClaimedTopic,
+} from "./escalate.ts";
 import {
   herdrConductorPluginConfigDir,
   planHostRuntime,
@@ -49,7 +74,7 @@ import {
   totalConfiguredWorkers,
 } from "./setup-host.ts";
 import { checkTokenScopes, type ScopeCheck } from "./setup.ts";
-import { dbPath, LIVE_STATES } from "./store.ts";
+import { DB_SNAPSHOT_STEM, dbPath, LIVE_STATES } from "./store.ts";
 import { telegramReportSend, type ReportSend } from "./reports.ts";
 import { fetchRateLimit, GhError, gh } from "./tracker/github.ts";
 import { repoSlugFor } from "./gitops.ts";
@@ -159,6 +184,14 @@ export interface DoctorDeps {
   uidOf?: (name: string) => number | undefined;
   /** `PRAGMA integrity_check` over the store, read-only. ok=true for "ok". */
   dbIntegrity?: (path: string) => { ok: boolean; detail?: string };
+  /** Whether the configured db-snapshot directory exists and is writable, so a
+   *  snapshot can land. Injected so a test never chmods the host (#399). */
+  snapshotDirState?: (dir: string) => { exists: boolean; writable: boolean };
+  /** Whether the run-session root — where the omp settings overlay is
+   *  materialised at dispatch (#537) — can hold a new `run-<id>` directory. A
+   *  missing `sessions/` parent is not a fault (dispatch's recursive `mkdir`
+   *  creates it), so the writable question falls back to the state dir itself. */
+  sessionRootState?: (root: string) => { exists: boolean; writable: boolean };
   /** The most recent completed runs for one project, newest first, limited. */
   recentRuns?: (project: string, limit: number) => RunSpendRow[];
   /** The bot health probe `status` uses (getMe etc.). */
@@ -179,6 +212,10 @@ export interface DoctorDeps {
   herdrConfig?: () => string | undefined;
   /** The live herdr-conductor plugin `config.env`, or undefined. */
   herdrEnv?: () => string | undefined;
+  /** Live omp-telegram topic claims (threads.json), for the #600 probes. */
+  claimedTopics?: () => ClaimedTopic[];
+  /** Whether the bridge's access.json runs per-session topic tidy on. */
+  topicsTidy?: () => boolean;
   /** The fleet agent name the tick config of one project names, or undefined
    *  when there is no (readable) tick — the expected live herdr pane identity. */
   tickAgentName?: (project: ProjectConfig) => string | undefined;
@@ -286,6 +323,55 @@ function defaultDbIntegrity(path: string): { ok: boolean; detail?: string } {
   }
 }
 
+/**
+ * Whether the configured db-snapshot directory exists and is writable. No
+ * write is performed — the check is stat + access, keeping doctor read-only.
+ * A directory that does not exist reads `writable: false` and lets the probe
+ * report it as "no snapshot yet" rather than inventing one, while a read-only
+ * or non-directory path reads as a genuine unwritable failure.
+ */
+function defaultSnapshotDirState(dir: string): { exists: boolean; writable: boolean } {
+  try {
+    const st = statSync(dir);
+    if (!st.isDirectory()) return { exists: true, writable: false };
+    try {
+      accessSync(dir, constants.W_OK);
+      return { exists: true, writable: true };
+    } catch {
+      return { exists: true, writable: false };
+    }
+  } catch {
+    return { exists: false, writable: false };
+  }
+}
+
+/**
+ * Whether the run-session root can hold a new session directory. No write is
+ * performed — the same stat + access as {@link defaultSnapshotDirState}, which
+ * keeps `doctor` read-only. A missing `sessions/` parent is normal on a fresh
+ * host (dispatch's recursive `mkdir` creates it), so the writable question
+ * falls back to the state dir it would be created under; a state dir that
+ * cannot even be read is a genuine unwritable failure.
+ */
+function defaultSessionRootState(root: string): { exists: boolean; writable: boolean } {
+  const writable = (dir: string): boolean => {
+    try {
+      const st = statSync(dir);
+      if (!st.isDirectory()) return false;
+      accessSync(dir, constants.W_OK);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  try {
+    const st = statSync(root);
+    return { exists: true, writable: st.isDirectory() && writable(root) };
+  } catch {
+    return { exists: false, writable: writable(dirname(root)) };
+  }
+}
+
 /**
  * The most recent completed runs for one project, newest first — read on the
  * same read-only connection the integrity check opens, because the store's own
@@ -419,6 +505,57 @@ function dbProbe(probes: Probes): Finding {
   );
 }
 
+/**
+ * The conductor.db snapshot store (#579): the configured dir is writable so a
+ * snapshot can land, and a snapshot at least as fresh as the store protects
+ * it. The store is the carrier of the verb ledger, the decision rows, the run
+ * rows and the material-event ledger; a store with no restorable copy has no
+ * recovery path, so absence is a warning and an unwritable configured dir a
+ * failure.
+ */
+function dbBackupProbe(probes: Probes, cfg: ConductorConfig | undefined): Finding {
+  const dir = dbBackupDirFor(cfg);
+  const state = probes.snapshotDirState(dir);
+  if (state.exists && !state.writable) {
+    return failFinding(
+      "db-backup",
+      `db backup dir ${dir} is not writable — a conductor.db snapshot cannot land there`,
+      `make ${dir} writable by the conductor account, or set dbBackupDir in config to a writable directory`,
+    );
+  }
+  const snapshots = (() => {
+    try {
+      return readdirSync(dir).filter((name) => name.startsWith(DB_SNAPSHOT_STEM));
+    } catch {
+      return [];
+    }
+  })();
+  const store = probes.stat(dbPath());
+  if (store === undefined) {
+    return snapshots.length === 0
+      ? passFinding("db-backup", "no conductor.db yet — nothing to snapshot")
+      : passFinding("db-backup", `${snapshots.length} conductor.db snapshot(s) present`);
+  }
+  if (snapshots.length === 0) {
+    return warnFinding(
+      "db-backup",
+      "conductor.db has no snapshot — losing it loses the audit trail with no recovery path",
+      "take a conductor.db snapshot (the daemon's cadence files one; restore-db needs one to restore from)",
+    );
+  }
+  const newestMtime = snapshots
+    .map((name) => probes.stat(join(dir, name))?.mtimeMs ?? 0)
+    .reduce((max, m) => Math.max(max, m), 0);
+  if (store.mtimeMs > newestMtime + 60_000) {
+    return warnFinding(
+      "db-backup",
+      `conductor.db is newer than every snapshot (${snapshots.length} file(s)) — the newest writes were never snapshot`,
+      "take a fresh conductor.db snapshot so restore-db has the current state",
+    );
+  }
+  return passFinding("db-backup", `conductor.db snapshot is fresh (${snapshots.length} file(s))`);
+}
+
 /** Every repo the config names: each project's tracker plus routing targets,
  *  as GitHub slugs, deduplicated, in config order. */
 function configuredRepos(cfg: ConductorConfig | undefined): string[] {
@@ -754,6 +891,42 @@ export function isKnownTimezone(tz: string): boolean {
   }
 }
 
+/**
+ * The fleet-owned omp settings overlay (#537): reports the *effective* overlay
+ * every worker session of the project will load — the `ompSettings` map plus
+ * the retry keys derived from `modelFallbacks`, rendered exactly as the
+ * materialiser writes them, never the raw config snippet `setup` would echo —
+ * and turns red when that overlay cannot land. The file is written at dispatch
+ * under `<stateDir>/sessions/run-<id>/`, so doctor cannot prove the write
+ * without writing: it probes the root the materialisation would land in with
+ * the same stat + access the db-backup probe uses, keeping the check
+ * read-only (#287). The session root is a host-wide fact, probed once and
+ * shared across the per-project findings.
+ */
+function ompSettingsProbe(
+  project: ProjectConfig,
+  sessionRoot: { exists: boolean; writable: boolean },
+): Finding {
+  const overlay = ompSettingsOverlay(project);
+  if (overlay === undefined) {
+    return passFinding(
+      "omp-settings",
+      `[${project.name}] no omp settings overlay configured — workers inherit the daemon account's global settings unchanged`,
+    );
+  }
+  if (!sessionRoot.writable) {
+    return failFinding(
+      "omp-settings",
+      `[${project.name}] the omp settings overlay cannot be materialised: ${sessionRootDir()} cannot hold a session directory, so every worker would dispatch without its staged settings`,
+      `make ${sessionRootDir()} writable by the conductor account`,
+    );
+  }
+  return passFinding(
+    "omp-settings",
+    `[${project.name}] worker sessions load this omp settings overlay:\n${stringify(overlay).trimEnd()}`,
+  );
+}
+
 /** The self-identified probe message `--probe-telegram` delivers through the
  *  same report transport a real report would take. */
 function probeMessage(project: string, checkedAt: string): string {
@@ -907,6 +1080,103 @@ function herdrAgentNameProbe(probes: Probes, p: ProjectConfig): Finding {
   );
 }
 
+/**
+ * #600 check — the orchestrator's claimed session file vs the directory arm
+ * scans.
+ *
+ * A pane resumed from a session created elsewhere keeps the original transcript
+ * path (herdr pins the pane to it), so the claimed file can live outside the
+ * session directory the tick cwd implies. arm follows the claim, so the
+ * mismatch alone is handled — but it is exactly the shape of host that once
+ * made arming silently impossible, and an operator reading transcript paths
+ * should not have to rediscover it. A claimed file *outside the session tree*
+ * is worse: arm refuses to arm there (the reply could never be seen), so
+ * doctor fails rather than letting the fleet sit disarmed.
+ */
+function armSessionDirProbe(probes: Probes, p: ProjectConfig): Finding {
+  const claims = probes.claimedTopics();
+  if (claims.length === 0) {
+    return passFinding(
+      "arm-session-dir",
+      `[${p.name}] no live omp-telegram claim — arm scans the tick-cwd session directory`,
+    );
+  }
+  const claim = claimForProject(claims, p.name);
+  if (claim === undefined || claim.sessionFile === undefined) {
+    return passFinding(
+      "arm-session-dir",
+      `[${p.name}] the live claim names no session file — arm scans the tick-cwd session directory`,
+    );
+  }
+  const root = sessionsRoot();
+  const claimDir = dirname(claim.sessionFile);
+  const scanDir = sessionDirForCwd(tickCwdForProject(p));
+  if (claimDir !== root && !claimDir.startsWith(join(root, sep))) {
+    return failFinding(
+      "arm-session-dir",
+      `[${p.name}] the orchestrator's claimed session file ${claim.sessionFile} is outside the session tree arm scans (${root}) — ` +
+        `arm cannot arm while the reply can only land there`,
+      `start the orchestrator pane's session under ${root}, or from the tick cwd ${scanDir}`,
+    );
+  }
+  if (claimDir !== scanDir) {
+    return warnFinding(
+      "arm-session-dir",
+      `[${p.name}] the orchestrator's claimed session file ${claim.sessionFile} lives in ${claimDir}, not the tick-cwd session directory ${scanDir} — ` +
+        `arm follows the claim, so arming works, but this is the resumed-pane shape #600 names`,
+      `optional tidy-up: start the pane's session from the tick cwd so transcript and cwd agree again`,
+    );
+  }
+  return passFinding(
+    "arm-session-dir",
+    `[${p.name}] the orchestrator's claimed session file is inside the session directory arm scans`,
+  );
+}
+
+/**
+ * #600 check — a pinned escalation.telegramTopicId that no live claim carries.
+ *
+ * The wizard pins from the claims at setup time, but the bridge re-claims
+ * topics across restarts and conductor restarts the service itself (#407), so
+ * the pin drifts. On a host with `topicsTidy` on it drifts *structurally*:
+ * every pane exit closes the topic, so a pinned id can never be live again.
+ * There the pin is vestigial — reporting a dead id as the live destination is
+ * the exact false belief this check exists to remove.
+ */
+function topicPinProbe(probes: Probes, p: ProjectConfig): Finding {
+  const pinned = p.escalation.telegramTopicId;
+  if (pinned === undefined) {
+    return passFinding(
+      "topic-pin",
+      `[${p.name}] no pinned topic id — sends follow the live claim or the flat chat`,
+    );
+  }
+  const claims = probes.claimedTopics();
+  if (claims.length === 0) {
+    return passFinding(
+      "topic-pin",
+      `[${p.name}] pinned topic ${pinned} — no live claims to compare (bridge state unreadable, or not a forum host)`,
+    );
+  }
+  if (claims.some((claim) => claim.threadId === pinned)) {
+    return passFinding("topic-pin", `[${p.name}] pinned topic ${pinned} is a live claim`);
+  }
+  if (probes.topicsTidy()) {
+    return warnFinding(
+      "topic-pin",
+      `[${p.name}] pinned topic ${pinned} is not among omp-telegram's live claims, and this host runs topicsTidy — ` +
+        `the pin is vestigial and can never be live again (every pane exit closes its topic)`,
+      `remove escalation.telegramTopicId from ${p.name}'s config (sends already follow the live claim), or turn topicsTidy off`,
+    );
+  }
+  return warnFinding(
+    "topic-pin",
+    `[${p.name}] pinned topic ${pinned} is not among omp-telegram's live claims (${claims.map((c) => c.threadId).join(", ")}) — ` +
+      `sends fall back to the live claim or the flat chat`,
+    `update or remove escalation.telegramTopicId in ${p.name}'s config`,
+  );
+}
+
 /**
  * #541 check 2 — `[session] resume_agents_on_restore` on the live herdr config.
  *
@@ -1076,7 +1346,13 @@ export async function runDoctor(projectName: string | undefined, opts: DoctorDep
   // difference behind a constant count).
   findings.push(backupProbe(probes));
   findings.push(dbProbe(probes));
+  findings.push(dbBackupProbe(probes, cfg));
   findings.push(await ghAuthProbe(probes, configuredRepos(cfg)));
+  // The run-session root is one host-wide fact — where every run's session dir
+  // (and the omp settings overlay inside it) lands — probed once and shared
+  // across the per-project omp-settings findings.
+  const sessionRoot = sessionRootDir();
+  const sessionRootState = probes.sessionRootState(sessionRoot);
   // The collected run sample across the resolved project set, newest-first;
   // spend telemetry is a single host-wide finding, not one per project.
   const spendRows: RunSpendRow[] = [];
@@ -1093,10 +1369,22 @@ export async function runDoctor(projectName: string | undefined, opts: DoctorDep
     findings.push(
       passFinding("herdr-agent-name", projectProblem === undefined ? "no project resolved — nothing to check" : `agent name uncheckable: ${projectProblem}`),
     );
+    findings.push(
+      passFinding("arm-session-dir", projectProblem === undefined ? "no project resolved — nothing to check" : `arm session dir uncheckable: ${projectProblem}`),
+    );
+    findings.push(
+      passFinding("topic-pin", projectProblem === undefined ? "no project resolved — nothing to check" : `topic pin uncheckable: ${projectProblem}`),
+    );
+    findings.push(
+      passFinding("omp-settings", projectProblem === undefined ? "no project resolved — nothing to check" : `omp settings overlay uncheckable: ${projectProblem}`),
+    );
   } else {
     for (const p of projects) {
       findings.push(await labelProbe(probes, p));
       findings.push(herdrAgentNameProbe(probes, p));
+      findings.push(armSessionDirProbe(probes, p));
+      findings.push(topicPinProbe(probes, p));
+      findings.push(ompSettingsProbe(p, sessionRootState));
     }
   }
   // The installed-unit check is host-global: one shared daemon. Any project
@@ -1149,6 +1437,8 @@ export function defaultProbes(): Probes {
     stat: defaultStat,
     uidOf: defaultUidOf,
     dbIntegrity: defaultDbIntegrity,
+    snapshotDirState: defaultSnapshotDirState,
+    sessionRootState: defaultSessionRootState,
     recentRuns: defaultRecentRuns,
     telegramHealth: (projectName) => probeTelegramHealth(projectName),
     telegramSend: telegramReportSend,
@@ -1158,6 +1448,8 @@ export function defaultProbes(): Probes {
     herdrSession: () => resolveHerdrSessionWithBridge(),
     herdrConfig: defaultHerdrConfig,
     herdrEnv: defaultHerdrEnv,
+    claimedTopics: () => claimedTelegramTopics(),
+    topicsTidy: () => telegramTopicsTidy(),
     tickAgentName: (p) => {
       const tick = readTickConfig(tickCwdForProject(p));
       if (tick.kind !== "ok") return undefined;