omp-conductor 0.15.13 → 0.16.1

package/src/fleet.ts

@@ -26,33 +26,18 @@ import {
 } from "node:fs";
 import { createInterface } from "node:readline";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
-import { formatZonedMinute } from "./availability.ts";
+import { dirname, join, sep } from "node:path";
 import { findProject, loadConfig, stateDir } from "./config.ts";
 import { clearArmChallenge, recordArmChallenge } from "./arm-challenge.ts";
-import { resolveProjectTopicId, sendTelegram } from "./escalate.ts";
-import { planUsageLine, readPlanUsage, sharedUsageSource } from "./usage.ts";
+import { resolveClaimedSessionFile, resolveProjectTopicId, sendTelegram } from "./escalate.ts";
+import { readPlanUsage, sharedUsageSource } from "./usage.ts";
 import { readApprovalSurface, readDaemonProfile } from "./approval-surface.ts";
 import { inspectBriefLayout } from "./brief-upgrade.ts";
 import { dbPath, openStore } from "./store.ts";
 import { renderBriefForProject } from "./setup.ts";
 import type { DaemonStop, ProjectConfig, Store } from "./types.ts";
-import { settlementFlagSummary } from "./diff-flags.ts";
 import { probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
-import { formatDigestBacklog, formatOpenReports } from "./reports.ts";
-import {
-  formatBaseHealth,
-  formatDispatchSummary,
-  formatReleaseGrants,
-  formatSalvagedRuns,
-  isPaused,
-  pauseProvenance,
-  pausedAt,
-  setPaused,
-  statusSnapshot,
-  type StatusSnapshot,
-} from "./daemon.ts";
-import { formatOrchestratorDown } from "./orchestrator-down.ts";
+import { isPaused, setPaused, statusSnapshot } from "./daemon.ts";
 import {
   healthCheck,
   isAlive,
@@ -61,11 +46,19 @@ import {
   runSystemctl,
   stopDaemon,
   type StopResult,
-  type UnitOwnership,
-  SYSTEMD_UNIT,
 } from "./lifecycle.ts";
-import { formatRss, rssBytesFromHealthz } from "./host.ts";
 import type { WorkerPausePhase } from "./worker.ts";
+import {
+  formatFleetStatus,
+  type DaemonProjectHealth,
+  type DispatchLayer,
+  type FleetDaemonProbe,
+  type FleetLayers,
+  type HerdrLayer,
+  type PaneLayer,
+  type TelegramHealth,
+  type TicksLayer,
+} from "./status-render.ts";
 import { fetchRateLimit } from "./tracker/github.ts";
 import {
   LEGACY_ARM_MARKER_DETAIL,
@@ -294,13 +287,22 @@ export interface ArmResult {
 export interface ArmDeps {
   sendChallenge?: (token: string, owner: string, text: string, topicId?: number) => Promise<void>;
   /**
-   * Waits for the challenge to appear as a user turn somewhere under the
-   * session directory. The waiter owns transcript discovery — not the caller —
+   * The orchestrator session file the live omp-telegram claim names for this
+   * project, or undefined when there is no (readable) claim. The default
+   * resolves the claim the same way the send does; tests inject a fixture.
+   * Absent → arm watches the cwd-derived session directory, the pre-claim
+   * behaviour.
+   */
+  claimedSessionFile?: () => string | undefined;
+  /**
+   * Waits for the challenge to appear as a user turn somewhere under the scan
+   * directories. The waiter owns transcript discovery — not the caller —
    * because the reply may land in a session that starts *after* the send, so a
    * path resolved before the challenge went out can be the wrong file by the
-   * time the operator answers (#142).
+   * time the operator answers (#142), and because the claimed session file can
+   * sit in a different directory than the tick cwd implies (#600).
    */
-  waitForUserTurn?: (dir: string, code: string, sentAt: number, timeoutMs: number) => Promise<boolean>;
+  waitForUserTurn?: (dirs: readonly string[], code: string, sentAt: number, timeoutMs: number) => Promise<boolean>;
   now?: () => number;
   sleep?: (ms: number) => Promise<void>;
   timeoutMs?: number;
@@ -339,10 +341,23 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
     );
   }
 
-  const dir = sessionDirForCwd(tick.cwd);
-  if (!existsSync(dir)) {
+  // One bot, one chat, and — once a host runs more than one fleet — more than
+  // one pane that can ask. The challenge names which one, or the operator is
+  // answering a question they cannot attribute.
+  const named = tick.config.project ?? projectName;
+
+  // Resolve the orchestrator's live session file *before* the challenge goes
+  // out — the same claim the send follows (#600). A pane resumed from a
+  // session created elsewhere (herdr pins it to the original transcript)
+  // writes a session file outside the directory the tick cwd implies, and a
+  // cwd-derived scan would poll the one place the reply is guaranteed not to
+  // be. A claim outside the session tree arm scans can never be answered, so
+  // that is a stop, not five minutes of polling.
+  const claimed = deps.claimedSessionFile !== undefined ? deps.claimedSessionFile() : claimedOrchestratorSessionFile(named);
+  const dirs = armSessionScanDirs(tick.cwd, claimed);
+  if (dirs.every((d) => !existsSync(d))) {
     throw new Error(
-      `no orchestrator session directory at ${dir} — ` +
+      `no orchestrator session directory under ${dirs.join(" or ")} — ` +
         `the inbound proof is read from a user turn in a transcript there. Start the pane orchestrator, let it settle, then arm again`,
     );
   }
@@ -354,10 +369,6 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
   const arm = resolveArmState(path, tick.config.project ?? projectName);
   const alreadyArmed = arm.armed;
   const code = makeChallengeCode();
-  // One bot, one chat, and — once a host runs more than one fleet — more than
-  // one pane that can ask. The challenge names which one, or the operator is
-  // answering a question they cannot attribute.
-  const named = tick.config.project ?? projectName;
   const text =
     `Fleet arming check${named === undefined ? "" : ` — project ${named}`}. ` +
     `Reply to this chat with exactly:\n${code}\n` +
@@ -398,25 +409,37 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
 
   const injected = deps.waitForUserTurn;
   const scan: SessionScan = injected
-    ? { seen: await injected(dir, code, sentAt, timeoutMs), scanned: [], ignored: [] }
-    : await waitForChallengeInSessions(dir, code, sentAt, timeoutMs, deps);
+    ? { seen: await injected(dirs, code, sentAt, timeoutMs), scanned: [], ignored: [] }
+    : await waitForChallengeInSessions(dirs, code, sentAt, timeoutMs, deps);
   if (!scan.seen) {
     // The proof missed its window: a lookalike reply must not stay classifiable
     // after arming gave up, so the record is cleared before the failure lands.
     clearArmChallenge(named);
+    // The claimed session file is named before the bridge/token/chat block: a
+    // rotation under the window is visible from this error alone, and on the
+    // host this guard exists for the claimed file is the one that held the
+    // answer (#600).
     const listing = [
-      `session dir: ${dir}`,
+      ...(claimed === undefined
+        ? []
+        : [
+            `claimed orchestrator session file: ${claimed}` +
+              (dirs.includes(dirname(claimed))
+                ? " (watched)"
+                : ` (NOT under any watched dir — a reply there can never be seen)`),
+          ]),
+      `session dir: ${dirs.join(", ")}`,
       ...scan.scanned.map((f) => `  watched: ${f}`),
       ...scan.ignored.map((f) => `  ignored (stale, last written before the challenge): ${f}`),
     ].join("\n");
     throw new Error(
       `arm: the challenge never arrived as a user turn in time — NOT armed.\n` +
-        `Inbound Telegram is not reaching the omp session. Check, in order:\n` +
+        listing +
+        `\nInbound Telegram is not reaching the omp session. Check, in order:\n` +
         `  * is the bridge polling?      attach and run: /telegram status\n` +
         `  * is another process holding this bot token? Telegram allows exactly one\n` +
         `    getUpdates consumer and rejects the second with HTTP 409.\n` +
-        `  * did you reply in the DM with the bot, not another chat?\n` +
-        listing,
+        `  * did you reply in the DM with the bot, not another chat?\n`,
     );
   }
 
@@ -1023,46 +1046,6 @@ function isOmpProcess(proc: ForegroundProc): boolean {
   return false;
 }
 
-// ---------------------------------------------------------------------------
-// layered status
-// ---------------------------------------------------------------------------
-
-export type DispatchLayer = "running" | "paused" | "stopped";
-export type TicksLayer =
-  | "armed"
-  | "disarmed"
-  | "no-heartbeat-config"
-  | "invalid-heartbeat-config"
-  | "ungated";
-export type PaneLayer = "live" | "missing" | "unknown";
-/** `unpinnable`: no tick config, so FLEET_CWD — the only path recovery reads — is unknown. */
-export type RecoveryLayer = "pinned" | "clear" | "unpinnable";
-export type HerdrLayer = "active" | "inactive" | "unknown";
-export type TelegramLayer = "ok" | "degraded" | "down" | "unconfigured" | "unprobed";
-
-export interface TelegramHealth {
-  kind: TelegramLayer;
-  detail?: string;
-}
-
-export interface FleetLayers {
-  dispatch: DispatchLayer;
-  ticks: TicksLayer;
-  ticksDetail?: string;
-  nextTickAt?: string;
-  pane: PaneLayer;
-  paneDetail?: string;
-  recovery: RecoveryLayer;
-  recoveryDetail?: string;
-  herdr: HerdrLayer;
-  herdrDetail?: string;
-  armedPath?: string;
-  tickConfigPath?: string;
-  paneHaltPath?: string;
-  paused: boolean;
-  daemon: { running: boolean; pid?: number; port?: number };
-}
-
 /**
  * The project a bare read means, when the config leaves no doubt.
  *
@@ -1270,50 +1253,6 @@ export function workerPhasesFromHealthz(
 }
 
 
-export function formatCodeGraphHealth(graph: CodeGraphHealth, now = Date.now()): string | undefined {
-  if (!graph.configured) return undefined;
-  const indexed = graph.repos.filter((repo) => repo.index === "present").length;
-  let refresh: string = graph.refresh.result;
-  if (graph.refresh.lastSuccessAt !== undefined) {
-    const ageMs = Math.max(0, now - Date.parse(graph.refresh.lastSuccessAt));
-    refresh = `${graph.refresh.lastSuccessAt} (${Math.max(1, Math.ceil(ageMs / 60_000))}m ago)`;
-  }
-  return [
-    `code graph  ${graph.status}  ${indexed}/${graph.repos.length} repos indexed`,
-    `  indexer   ${graph.prerequisites.indexer}`,
-    `  MCP mount ${graph.prerequisites.mcpMount}`,
-    `  timer     ${graph.timer.enabled} / ${graph.timer.active}`,
-    `  refresh   ${refresh}`,
-    ...graph.reasons.map((reason) => `  - ${reason}`),
-  ].join("\n");
-}
-
-
-/**
- * Project-scoped reading of a living daemon record + `/healthz` body.
- *
- * Board and `status` share this so a host running one daemon for several
- * projects cannot be called healthy for a project it does not serve (#379).
- * A third interpretation convention is forbidden.
- */
-export type DaemonProjectHealth =
-  | { kind: "stopped" }
-  | { kind: "ok" }
-  | { kind: "unreachable" }
-  | { kind: "other-project"; serves?: string };
-
-/**
- * Facts `formatFleetStatus` needs about the living daemon. Pure input — the
- * caller probes; the formatter never shells out (#379).
- */
-export type FleetDaemonProbe = {
-  project: DaemonProjectHealth;
-  /** `/healthz` body when the probe is project-ok (rss / overlays). */
-  body?: string;
-  /** systemd ownership of the living record pid; omit when unprobed. */
-  unit?: UnitOwnership;
-};
-
 /**
  * Decide whether a living record + optional `/healthz` answer serve `project`.
  *
@@ -1372,306 +1311,6 @@ function servedProjectName(payload: object): string | undefined {
   return undefined;
 }
 
-function formatDaemonHealthz(probe: FleetDaemonProbe | undefined): string {
-  if (probe === undefined) return "unprobed";
-  switch (probe.project.kind) {
-    case "stopped":
-      return "stopped";
-    case "ok":
-      return "ok";
-    case "unreachable":
-      return "unreachable — the process is up but not serving";
-    case "other-project":
-      return probe.project.serves === undefined
-        ? "other-project"
-        : `other-project — serves ${probe.project.serves}`;
-  }
-}
-
-/**
- * Unit line for a living record. The bare unit name alone used to imply
- * systemd ownership that was never checked (#379); every branch states the
- * probe result, and `unknown` is never rendered as owned.
- */
-function formatDaemonUnit(unit: UnitOwnership | undefined, recordPid: number): string {
-  if (unit === undefined) return `  unit      ${SYSTEMD_UNIT}  unprobed`;
-  switch (unit.kind) {
-    case "active":
-      if (unit.pid === recordPid) {
-        return `  unit      ${SYSTEMD_UNIT}  systemd-owned`;
-      }
-      // Live unit, different MainPID — the record pid is not systemd's.
-      return `  unit      ${SYSTEMD_UNIT}  unmanaged — MainPID ${unit.pid}`;
-    case "failed":
-      return `  unit      ${SYSTEMD_UNIT}  unmanaged — unit failed`;
-    case "inactive":
-      return `  unit      ${SYSTEMD_UNIT}  inactive`;
-    case "unknown":
-      return `  unit      ${SYSTEMD_UNIT}  unknown — ${unit.reason}`;
-  }
-}
-
-/**
- * The newest daemon stop/restart provenance as status lines (#378).
- *
- * Rendered under the daemon block whether the daemon is down or has since
- * been restarted — the whole point is that the debrief survives the restart.
- * An unattributed record says so explicitly: the external-signal fallback
- * records what the receiving daemon knew (that it was unattributed, when,
- * which projects it served with live counts) rather than guessing a caller.
- */
-function formatLastStop(lastStop: DaemonStop | undefined): string[] {
-  if (lastStop === undefined) return [];
-  const caller = lastStop.unattributed
-    ? "unattributed — no mediated request (external signal)"
-    : `pid ${lastStop.callerPid ?? "?"}` +
-      (lastStop.callerUid === undefined ? "" : ` uid ${lastStop.callerUid}`) +
-      (lastStop.role === undefined ? "" : ` (${lastStop.role})`);
-  return [
-    `  last stop  ${new Date(lastStop.at).toISOString()}  ${lastStop.controlPath}`,
-    `  caller     ${caller}`,
-    `  scope      ${lastStop.scope}${lastStop.project === undefined ? "" : `: ${lastStop.project}`}`,
-    `  affects    ${lastStop.affected.map((a) => `${a.project} (${a.live} live)`).join(", ")}`,
-    `  reason     ${lastStop.reason}`,
-  ];
-}
-
-export function formatFleetStatus(
-  s: StatusSnapshot,
-  layers: FleetLayers,
-  daemon: FleetDaemonProbe | undefined = undefined,
-  telegram: TelegramHealth = { kind: "unprobed" },
-  now = Date.now(),
-  codeGraph: CodeGraphHealth = { configured: false },
-  brief: string | undefined = undefined,
-  decisions: string | undefined = undefined,
-  failureClasses: string | undefined = undefined,
-  workerPhases: ReadonlyMap<number, WorkerPausePhase> = new Map(),
-  intake: string | undefined = undefined,
-  lastStop: DaemonStop | undefined = undefined,
-): string {
-  const tickLine =
-    layers.ticksDetail === undefined
-      ? `ticks     ${layers.ticks}`
-      : `ticks     ${layers.ticks}  (${layers.ticksDetail})`;
-  let nextTickLine: string | undefined;
-  if (layers.nextTickAt !== undefined) {
-    const delta = Date.parse(layers.nextTickAt) - now;
-    const minutes = Math.max(1, Math.ceil(Math.abs(delta) / 60_000));
-    nextTickLine =
-      `next tick ${layers.nextTickAt}  ` +
-      `(${delta >= 0 ? `in ${minutes}m` : `overdue by ${minutes}m`})`;
-  }
-  const paneLine =
-    layers.paneDetail === undefined
-      ? `pane      ${layers.pane}`
-      : `pane      ${layers.pane}  (${layers.paneDetail})`;
-  const recoveryLine =
-    layers.recoveryDetail === undefined
-      ? `recovery  ${layers.recovery}`
-      : `recovery  ${layers.recovery}  (${layers.recoveryDetail})`;
-  const herdrLine =
-    layers.herdrDetail === undefined
-      ? `herdr     ${layers.herdr}`
-      : `herdr     ${layers.herdr}  (${layers.herdrDetail})`;
-  const telegramLine =
-    telegram.detail === undefined
-      ? `telegram  ${telegram.kind}`
-      : `telegram  ${telegram.kind}  (${telegram.detail})`;
-
-  let daemonBlock: string;
-  if (!layers.daemon.running || layers.daemon.pid === undefined) {
-    daemonBlock = "daemon    not running";
-  } else {
-    // Only trust rss from a project-ok body — a foreign payload's bytes are
-    // not this project's daemon facts (#379).
-    const rss =
-      daemon?.project.kind === "ok" ? rssBytesFromHealthz(daemon.body) : undefined;
-    daemonBlock = [
-      "daemon",
-      `  pid       ${layers.daemon.pid}`,
-      `  port      ${layers.daemon.port ?? "?"}`,
-      ...(rss === undefined ? [] : [`  rss       ${formatRss(rss)}`]),
-      `  healthz   ${formatDaemonHealthz(daemon)}`,
-      formatDaemonUnit(daemon?.unit, layers.daemon.pid),
-    ].join("\n");
-  }
-
-  const graphBlock = formatCodeGraphHealth(codeGraph, now);
-
-  // Pause provenance (`pause --reason`, an integrity/spend-cap/upgrade pause,
-  // a halt) answers "who stopped the fleet" without opening a file (#185). An
-  // unparseable sentinel — paused but with no datable line 1 — is itself news:
-  // it means a run admitted before an *unknown* pause cannot prove innocence
-  // (#174), so completion mutations fail closed while release gates remain usable.
-  const dispatchLine =
-    layers.dispatch === "paused"
-      ? (() => {
-          const prov = pauseProvenance(s.project);
-          if (prov !== undefined) {
-            const reason = prov.reason === undefined ? "" : ` — "${prov.reason}"`;
-            return `dispatch  paused (source: ${prov.source}${reason})`;
-          }
-          return isPaused(s.project) && pausedAt(s.project) === undefined
-            ? "dispatch  paused (unparseable sentinel — new work and completion mutations refused; release gates remain available)"
-            : "dispatch  paused";
-        })()
-      : `dispatch  ${layers.dispatch}`;
-
-  return [
-    dispatchLine,
-    tickLine,
-    ...(nextTickLine === undefined ? [] : [nextTickLine]),
-    paneLine,
-    recoveryLine,
-    herdrLine,
-    telegramLine,
-    ...(brief === undefined ? [] : [brief]),
-    ...(decisions === undefined ? [] : [decisions]),
-    ...(failureClasses === undefined ? [] : [failureClasses]),
-    ...(intake === undefined ? [] : [intake]),
-    ...(graphBlock === undefined ? [] : [graphBlock]),
-    daemonBlock,
-    ...formatLastStop(lastStop),
-    "",
-    formatProjectBody(s, workerPhases, now),
-  ].join("\n");
-}
-
-function formatAvailabilityStatus(s: StatusSnapshot): string[] {
-  const availability = s.availability;
-  if (availability === undefined) return [];
-  if (availability.mode === "always") {
-    return ["availability 24-hour interrupts (no weekly window)"];
-  }
-  const mode =
-    availability.nextTransitionAt === undefined || availability.timezone === undefined
-      ? `${availability.mode}; next transition could not be calculated`
-      : `${availability.mode} until ${formatZonedMinute(availability.nextTransitionAt, availability.timezone)}`;
-  const bypass = availability.bypass.length === 0 ? "none" : availability.bypass.join(", ");
-  return [`availability ${mode}; quiet-hours bypass ${bypass}`];
-}
-
-function formatDigestScheduleStatus(s: StatusSnapshot): string[] {
-  const schedule = s.digestSchedule;
-  if (schedule === undefined) return [];
-  if (schedule.mode === "disabled") return ["next digest disabled"];
-  if (schedule.mode === "per-tick") return ["next digest every tick"];
-  if (schedule.mode === "due") return ["next digest due now"];
-  return [
-    schedule.nextAt === undefined
-      ? "next digest could not be calculated"
-      : `next digest ${formatZonedMinute(schedule.nextAt, schedule.timezone)}`,
-  ];
-}
-
-function formatProjectBody(
-  s: StatusSnapshot,
-  workerPhases: ReadonlyMap<number, WorkerPausePhase> = new Map(),
-  now = Date.now(),
-): string {
-  const lines = [
-    `project   ${s.project}${s.paused ? "  (PAUSED)" : ""}`,
-    ...(s.pauseReason === undefined ? [] : [`paused    ${s.pauseReason}`]),
-    `config    ${s.configPath}`,
-    `state     ${s.stateDir}`,
-    // The orchestrator-down degrade row: first-class in the body, present only
-    // while the incident is open, so recovery drops it (#288).
-    ...(s.orchestratorDown === undefined
-      ? []
-      : formatOrchestratorDown(s.orchestratorDown, now)),
-    ...formatAvailabilityStatus(s),
-    ...formatDigestScheduleStatus(s),
-    "",
-    "caps",
-    `  workers            ${s.liveWorkers} / ${s.caps.maxConcurrentWorkers}`,
-    `  issues today       ${s.runsToday}`,
-    s.caps.dailySpendUsd === null
-      ? `  spend today        $${s.spendTodayUsd.toFixed(2)} (no daily cap)`
-      : `  spend today        $${s.spendTodayUsd.toFixed(2)} / $${s.caps.dailySpendUsd.toFixed(2)}`,
-    // Its own row beside the spend row, never folded into it: they are two
-    // independent controls and an operator has to see which one stopped the
-    // fleet (#110).
-    `  plan usage         ${planUsageLine(s.planUsage)}`,
-    // The tracker's API budget, when the renderer could read it. Absent on a
-    // broken `gh`: one missing row, never a broken report (#188). Next to it,
-    // the refusals the tracker actually observed, so a budget that looks
-    // healthy next to every call being refused is still visible (#198).
-    ...(s.github === undefined
-      ? []
-      : [
-          `  github             graphql ${s.github.graphql.remaining}/${s.github.graphql.limit}, core ${s.github.core.remaining}/${s.github.core.limit} (graphql resets ${Math.max(0, Math.round((s.github.graphql.reset * 1000 - Date.now()) / 60_000))}m)` +
-            (s.ghRefusals === undefined || s.ghRefusals.count === 0
-              ? ""
-              : ` — ${s.ghRefusals.count} refusal(s) in last 5m (last ${new Date(s.ghRefusals.latestAt ?? Date.now()).toISOString().slice(11, 19)}Z)`),
-        ]),
-    // The daemon's own observed github traffic today (#198): a separate row
-    // from the polled budget above, so one missing `status` read never hides
-    // the other. `onCall` counts every spawn including ones that end 304, so
-    // `daemon` is spawns and `daemon-304` is the unbilled subset — billed ≈
-    // difference, and the polled budget row stays the authority (#203).
-    `  github calls       daemon ${s.ghCallsToday?.find((c) => c.source === "daemon")?.calls ?? 0} today` +
-      ((s.ghCallsToday?.find((c) => c.source === "daemon-304")?.calls ?? 0) === 0
-        ? ""
-        : ` (${s.ghCallsToday!.find((c) => c.source === "daemon-304")!.calls} free 304s)`),
-    // Label-projection ops the tracker has not applied yet (#201): GitHub is
-    // behind what the store decided, and the operator can see the lag instead
-    // of discovering it as a stale label or a missing one.
-    ...(s.labelOps === undefined
-      ? []
-      : [
-          `  labels             projection ${s.labelOps.pending} pending (oldest ${
-            s.labelOps.oldestAgeMs >= 60_000
-              ? `${Math.round(s.labelOps.oldestAgeMs / 60_000)}m`
-              : `${Math.max(1, Math.round(s.labelOps.oldestAgeMs / 1000))}s`
-          })`,
-        ]),
-    `  new worker turns   ${s.caps.workerMaxTurns}`,
-    ...s.turnOverrides.map(
-      ({ issue, maxTurns }) => `  turn override      #${issue} → ${maxTurns} (next attempt)`,
-    ),
-    `  worker wall clock  ${Math.round(s.caps.workerWallClockMs / 60_000)}m`,
-    `  failed attempts    ${s.caps.maxAttemptsPerIssue}`,
-    `  continuations      ${s.caps.maxContinuationsPerIssue}`,
-    "",
-    ...formatReleaseGrants(s.releaseGrants),
-    "",
-    formatDispatchSummary(s.dispatch),
-    "",
-  ];
-  if (s.activeRuns.length === 0) {
-    lines.push("active runs  (none)");
-  } else {
-    lines.push("active runs");
-    for (const r of s.activeRuns) {
-      const phase = workerPhases.get(r.issue);
-      const state = phase === "pausing" || phase === "paused" ? phase : r.state;
-      lines.push(
-        `  #${r.issue}  ${r.repo}  ${state}  attempt ${r.attempt}  ` +
-          `${r.turns}/${r.maxTurns} turns  ${r.spendUsd.toFixed(2)}  ${r.branch}` +
-          (r.prUrl ? `  ${r.prUrl}` : ""),
-      );
-      // The orchestrator's Duty 1 reads this command, and a flagged run's
-      // escalation is deduplicated after one delivery — so this is where a
-      // flagged PR stays visible for as long as it is still open (#128).
-      const flagged = settlementFlagSummary(r.settlementFlags);
-      if (flagged !== undefined) lines.push(`      ${flagged}`);
-    }
-  }
-  lines.push(...formatBaseHealth(s.baseHealth));
-  lines.push(...formatSalvagedRuns(s.salvagedRuns));
-  lines.push(...formatOpenReports(s.openReports));
-  lines.push(...formatDigestBacklog(s.digestBacklog));
-  if (s.liveWorkers > 0) {
-    lines.push(
-      "",
-      `deploy    ${s.liveWorkers} live worker(s) — restart salvages dirty trees then orphans the rows; ` +
-        `hold and wait for workers 0/${s.caps.maxConcurrentWorkers} when you can drain instead`,
-    );
-  }
-  return lines.join("\n");
-}
-
 export async function renderStatus(projectName?: string): Promise<string> {
   const s = statusSnapshot(projectName);
   const layers = fleetLayers(projectName);
@@ -1716,8 +1355,16 @@ export async function renderStatus(projectName?: string): Promise<string> {
   // project and the uninvolved one must see who stopped it too.
   const store = openStore(dbPath());
   let lastStop: DaemonStop | undefined;
+  let siblings: { project: string; live: number }[] = [];
   try {
     lastStop = store.latestDaemonStop();
+    // Shared-daemon visibility (#545): every configured project other than the
+    // one being viewed, with its live-run count. Read from the same open store
+    // as the provenance above, so a status reader can tell "my fleet is idle"
+    // from "the process I am about to stop is busy".
+    siblings = loadConfig()
+      .projects.filter((p) => p.name !== project.name)
+      .map((p) => ({ project: p.name, live: store.liveRuns(p.name).length }));
   } finally {
     store.close();
   }
@@ -1734,6 +1381,7 @@ export async function renderStatus(projectName?: string): Promise<string> {
     workerPhases,
     intakeStatusLine(project.name),
     lastStop,
+    siblings,
   );
 }
 
@@ -1793,18 +1441,32 @@ function failureClassBlock(projectName: string): string | undefined {
  * the ambiguity this ledger exists to remove. Omitted on any throw — a status
  * that fails to render because the store is mid-migration is worse than one
  * missing a row.
+ *
+ * `decisions N open` counts only rows a human must answer (#459). Watches the
+ * orchestrator set for itself are reported separately — a fleet with three
+ * watches behind GitHub's checks is not a fleet waiting on its operator, and
+ * lumping them in made `decisions 3 open` read as three unanswered questions.
  */
-function decisionStatusLine(projectName: string): string | undefined {
+export function decisionStatusLine(projectName: string): string | undefined {
   const path = dbPath();
   if (!existsSync(path)) return undefined;
   let store: Store | undefined;
   try {
     store = openStore(path);
     const open = store.openDecisions(projectName);
-    if (open.length === 0) return "decisions none open";
-    const oldest = open[0]!;
-    const hours = Math.max(0, Math.round((Date.now() - oldest.askedAt) / 3_600_000));
-    return `decisions ${open.length} open (oldest ${hours}h)`;
+    const questions = open.filter((d) => d.kind !== "watch");
+    const watches = open.filter((d) => d.kind === "watch");
+    if (questions.length === 0 && watches.length === 0) return "decisions none open";
+    let line: string;
+    if (questions.length === 0) {
+      line = "decisions none open";
+    } else {
+      const oldest = questions[0]!;
+      const hours = Math.max(0, Math.round((Date.now() - oldest.askedAt) / 3_600_000));
+      line = `decisions ${questions.length} open (oldest ${hours}h)`;
+    }
+    if (watches.length > 0) line += ` · watches ${watches.length}`;
+    return line;
   } catch {
     return undefined;
   } finally {
@@ -1973,6 +1635,56 @@ export function sessionDirForCwd(cwd: string): string {
   return join(home, ".omp", "agent", "sessions", slug.replaceAll("/", "-"));
 }
 
+/** The session tree arm scans: every transcript under it, whatever the cwd slug. */
+export function sessionsRoot(): string {
+  return join(homedir(), ".omp", "agent", "sessions");
+}
+
+/**
+ * The orchestrator session file omp-telegram's live claim names for this
+ * project — the transcript a resumed/restored pane actually writes, which can
+ * live in a different session directory than the tick cwd implies (#600).
+ * Never throws: no claim, or an unreadable config, means undefined and arm
+ * falls back to the cwd-derived directory.
+ */
+function claimedOrchestratorSessionFile(named: string | undefined): string | undefined {
+  if (named === undefined) return undefined;
+  try {
+    return resolveClaimedSessionFile(findProject(loadConfig(), named));
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * The session directories `arm` watches for the reply — the cwd-derived one
+ * plus, when the live claim's file lives elsewhere, that file's directory.
+ *
+ * The cwd-derived directory is where a *fresh* session started from the tick
+ * cwd writes; the claimed file's directory is where the *restored* pane keeps
+ * writing (herdr pins it to the original transcript). Watching both covers a
+ * resumed session, a rotated one, and a session that starts after the send.
+ *
+ * A claim outside the session tree is a stop, not a slower failure: arm polls
+ * only transcripts under {@link sessionsRoot}, so a claimed file elsewhere can
+ * never satisfy the challenge, and five minutes of polling cannot discover a
+ * file that is not in the search set. The throw names both paths.
+ */
+function armSessionScanDirs(cwd: string, claimed: string | undefined): string[] {
+  const cwdDir = sessionDirForCwd(cwd);
+  if (claimed === undefined) return [cwdDir];
+  const root = sessionsRoot();
+  const claimDir = dirname(claimed);
+  if (claimDir !== root && !claimDir.startsWith(join(root, sep))) {
+    throw new Error(
+      `arm: the orchestrator's claimed session file ${claimed} is outside the session tree arm scans (${root}) — ` +
+        `no transcript there can satisfy the challenge. Resume the pane under ${root}, or start it from ${cwd}; ` +
+        `arm would otherwise poll ${cwdDir} until the timer runs out`,
+    );
+  }
+  return claimDir === cwdDir ? [cwdDir] : [cwdDir, claimDir];
+}
+
 function makeChallengeCode(): string {
   const bytes = new Uint8Array(4);
   crypto.getRandomValues(bytes);
@@ -1999,20 +1711,23 @@ interface SessionScan {
 }
 
 /**
- * Polls the session directory — re-read on every pass, never snapshotted —
+ * Polls the session directories — re-read on every pass, never snapshotted —
  * until the challenge shows up as a user turn or the deadline passes.
  *
  * Discovery lives here because the reply can land in a transcript that does not
  * exist yet when the challenge is sent: a rotated session, or the first one of
- * a pane started right after arming (#142). A waiter handed one path polls a
- * file the answer will never be written to, and arming becomes impossible.
+ * a pane started right after arming (#142). And the scan set can be two
+ * directories when the live claim's session file lives outside the tick-cwd
+ * directory: the restored pane keeps writing the claimed file, so its
+ * directory is watched alongside the cwd-derived one (#600).
  *
  * Files untouched since just before the send are named, not parsed: an append
  * bumps mtime, so a transcript older than the challenge cannot hold the reply,
- * and skipping it keeps a large stale session out of every 5 s pass.
+ * and skipping it keeps a large stale session out of every 5 s pass. A missing
+ * directory is not an error — it can vanish under a rotation and reappear.
  */
 async function waitForChallengeInSessions(
-  dir: string,
+  dirs: readonly string[],
   code: string,
   sentAt: number,
   timeoutMs: number,
@@ -2024,28 +1739,30 @@ async function waitForChallengeInSessions(
   for (;;) {
     const scanned: string[] = [];
     const ignored: string[] = [];
-    let names: string[] = [];
-    try {
-      names = readdirSync(dir);
-    } catch {
-      /* the directory can go away under a rotation; the next pass re-reads it */
-    }
-    for (const name of names.sort()) {
-      if (!name.endsWith(".jsonl")) continue;
-      const path = join(dir, name);
-      let mtimeMs: number;
+    for (const dir of dirs) {
+      let names: string[] = [];
       try {
-        mtimeMs = statSync(path).mtimeMs;
+        names = readdirSync(dir);
       } catch {
-        continue; /* race */
+        /* the directory can go away under a rotation; the next pass re-reads it */
       }
-      const label = `${name} (mtime ${new Date(mtimeMs).toISOString()})`;
-      if (mtimeMs < sentAt - 1_000) {
-        ignored.push(label);
-        continue;
+      for (const name of names.sort()) {
+        if (!name.endsWith(".jsonl")) continue;
+        const path = join(dir, name);
+        let mtimeMs: number;
+        try {
+          mtimeMs = statSync(path).mtimeMs;
+        } catch {
+          continue; /* race */
+        }
+        const label = `${name} (mtime ${new Date(mtimeMs).toISOString()})`;
+        if (mtimeMs < sentAt - 1_000) {
+          ignored.push(label);
+          continue;
+        }
+        scanned.push(label);
+        if (await transcriptHasUserCode(path, code)) return { seen: true, scanned, ignored };
       }
-      scanned.push(label);
-      if (await transcriptHasUserCode(path, code)) return { seen: true, scanned, ignored };
     }
     if (now() >= deadline) return { seen: false, scanned, ignored };
     await sleep(5_000);
@@ -2167,4 +1884,3 @@ function probeOmpPane(
     return { kind: "unknown", reason: err instanceof Error ? err.message : String(err) };
   }
 }
-