omp-conductor 0.15.9 → 0.15.11

package/src/escalate.ts

@@ -20,12 +20,12 @@
  * those strings end up in daemon logs and, on the fallback path, in a public
  * issue comment.
  */
-import { createHash } from "node:crypto";
 import { readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
 import { availabilityOpen, interruptDisposition, type InterruptDisposition } from "./availability.ts";
+import { heldNoticeId } from "./notices.ts";
 import type { OrchestratorHandle } from "./orchestrator.ts";
 import type { Escalation, ProjectConfig, Store, Tracker } from "./types.ts";
 
@@ -240,7 +240,7 @@ export function createEscalator(
         }
         if (disposition !== "interrupt") {
           store.addHeldNotice({
-            id: createHash("sha256").update(`held-notice\0${key}`).digest("hex"),
+            id: heldNoticeId(key),
             project: p.name,
             category,
             summary: e.summary,
@@ -350,6 +350,15 @@ export function readTelegramToken(): string | undefined {
   return undefined;
 }
 
+/** One live omp-telegram topic claim, as much of it as conductor reads. */
+export interface ClaimedTopic {
+  threadId: number;
+  /** The bridge's own title for the claim. */
+  name: string;
+  /** The herdr space the claiming pane sits in, when the bridge captured one. */
+  workspaceLabel?: string;
+}
+
 /**
  * The forum topic a project's Telegram actually lives in *now*.
  *
@@ -362,12 +371,19 @@ export function readTelegramToken(): string | undefined {
  *
  * The operator's pin still wins whenever it is live. Only a pin that is
  * *provably* absent from the current claims is replaced, and only by the claim
- * whose name is this project's — so a deliberately separate alerts topic is
- * never hijacked by the pane's own thread. Unreadable bridge state changes
+ * this project can be identified with — so a deliberately separate alerts topic
+ * is never hijacked by the pane's own thread. Unreadable bridge state changes
  * nothing, and #318's stale-topic retry remains the last line of defence.
  *
- * The substitution is logged, naming the project and the claim's name. Never an
- * id: a log line is a place these leak from.
+ * Identity is read from the herdr space first, and only then from the claim's
+ * title. The bridge titles a topic `ownAgentName ?? basename(cwd)`, and both
+ * halves of that fall down on a real multi-project host: the agent-name lookup
+ * is best-effort, and a fleet whose panes live under one state directory gives
+ * every pane the same basename. `workspaceLabel` is the herdr space, which is
+ * one-to-one with the project, so it is the identity that survives a re-claim.
+ *
+ * The substitution is logged, naming the project and which identity answered.
+ * Never an id: a log line is a place these leak from.
  */
 export function resolveProjectTopicId(project: ProjectConfig): number | undefined {
   const pinned = project.escalation.telegramTopicId;
@@ -375,24 +391,42 @@ export function resolveProjectTopicId(project: ProjectConfig): number | undefine
   const claims = claimedTelegramTopics();
   if (claims.length === 0) return pinned;
   if (claims.some((claim) => claim.threadId === pinned)) return pinned;
-  const named = claims.find((claim) => claim.name === project.name);
-  if (named === undefined) return pinned;
+  const bySpace = soleClaim(claims, (claim) => claim.workspaceLabel === project.name);
+  const match = bySpace ?? soleClaim(claims, (claim) => claim.name === project.name);
+  if (match === undefined) return pinned;
   warn(
     `escalation.telegramTopicId for ${project.name} is no longer a claimed topic; ` +
-      `following omp-telegram's current "${named.name}" claim instead`,
+      `following omp-telegram's current "${project.name}" ` +
+      `${bySpace === undefined ? "claim" : "herdr space claim"} instead`,
   );
-  return named.threadId;
+  return match.threadId;
+}
+
+/**
+ * The one claim answering to `predicate`, or nothing when none or several do.
+ *
+ * Ambiguity is not a coin toss: two claims wearing the same identity means the
+ * bridge cannot say which pane belongs to this project, and paging the wrong
+ * project's topic is worse than the flat-chat degrade #318 already handles.
+ */
+function soleClaim(
+  claims: readonly ClaimedTopic[],
+  predicate: (claim: ClaimedTopic) => boolean,
+): ClaimedTopic | undefined {
+  const hits = claims.filter(predicate);
+  return hits.length === 1 ? hits[0] : undefined;
 }
 
 /**
- * omp-telegram's live topic claims: `{ threads: { "<threadId>": { name } } }`.
- * Borrowed exactly as the token is, and tolerant of every shape it might not
- * be — a bridge that has never run a forum pane has no file at all.
+ * omp-telegram's live topic claims, from
+ * `{ threads: { "<threadId>": { name, workspaceLabel } } }`. Borrowed exactly as
+ * the token is, and tolerant of every shape it might not be — a bridge that has
+ * never run a forum pane has no file at all.
  *
  * `stateDir` is passed by the setup wizard, which has already probed for the
  * bridge; send-time callers let it resolve the same way the token does.
  */
-export function claimedTelegramTopics(stateDir?: string): Array<{ threadId: number; name: string }> {
+export function claimedTelegramTopics(stateDir?: string): ClaimedTopic[] {
   const override = stateDir?.trim() ?? process.env.OMP_TELEGRAM_STATE_DIR?.trim();
   const dir = override ? override : join(homedir(), ".omp", "agent", "telegram");
   let raw: unknown;
@@ -404,16 +438,23 @@ export function claimedTelegramTopics(stateDir?: string): Array<{ threadId: numb
   if (typeof raw !== "object" || raw === null || Array.isArray(raw) || !("threads" in raw)) return [];
   const threads = raw.threads;
   if (typeof threads !== "object" || threads === null || Array.isArray(threads)) return [];
-  const out: Array<{ threadId: number; name: string }> = [];
+  const out: ClaimedTopic[] = [];
   for (const [id, entry] of Object.entries(threads)) {
     const threadId = Number(id);
     if (!Number.isFinite(threadId) || !Number.isSafeInteger(threadId)) continue;
     let name = id;
-    if (typeof entry === "object" && entry !== null && "name" in entry) {
-      const candidate = entry.name;
-      if (typeof candidate === "string" && candidate.trim() !== "") name = candidate.trim();
+    let workspaceLabel: string | undefined;
+    if (typeof entry === "object" && entry !== null) {
+      if ("name" in entry) {
+        const candidate = entry.name;
+        if (typeof candidate === "string" && candidate.trim() !== "") name = candidate.trim();
+      }
+      if ("workspaceLabel" in entry) {
+        const candidate = entry.workspaceLabel;
+        if (typeof candidate === "string" && candidate.trim() !== "") workspaceLabel = candidate.trim();
+      }
     }
-    out.push({ threadId, name });
+    out.push(workspaceLabel === undefined ? { threadId, name } : { threadId, name, workspaceLabel });
   }
   return out;
 }

package/src/failure-class.ts

@@ -15,7 +15,7 @@
  * green test per class" possible without a daemon, a tracker or a network.
  */
 
-import type { FailureClass, RecoveryAction, RunRecord } from "./types.ts";
+import type { Caps, FailureClass, RecoveryAction, RunRecord } from "./types.ts";
 
 /** Facts the caller fetched, each only for the rows that need it. */
 export interface ClassifyFacts {
@@ -222,7 +222,11 @@ export function dispatchInfra(
 // front of the thrown message, so a bare /^git / would never match a real row.
 const DISPATCH_GIT_ERROR = /^(?:Error: )?git .+ exited \d+/s;
 
-export function classifyRun(run: RunRecord, facts: ClassifyFacts): Classification {
+export function classifyRun(
+  run: RunRecord,
+  facts: ClassifyFacts,
+  caps?: Pick<Caps, "workerWallClockMs">,
+): Classification {
   const hasArtifacts = run.prUrl !== undefined || run.headSha !== undefined || run.salvageSha !== undefined;
   const providerError =
     facts.sessionError ?? (run.lastError === undefined ? undefined : { message: run.lastError });
@@ -337,7 +341,29 @@ export function classifyRun(run: RunRecord, facts: ClassifyFacts): Classificatio
             evidence: `turns ${run.turns}/${run.maxTurns}, no PR, no commits — $${run.spendUsd.toFixed(2)} spent`,
           };
     }
-    // Below its own ceiling, so nothing this worker did ended it: a daemon
+    // A run killed at the wall-clock cap is a cap kill too, even though its
+    // turns ceiling never tripped — the harness would have kept burning a
+    // worker slot until the ticks ran out (#490). The same split as the turns
+    // path: artifacts mean the next attempt resumes from real work; nothing to
+    // show means a human re-scopes, naming the time and spend consumed.
+    const wallClockCap = caps?.workerWallClockMs;
+    const wallClockElapsed =
+      run.endedAt === undefined ? undefined : run.endedAt - run.startedAt;
+    if (wallClockCap !== undefined && wallClockElapsed !== undefined && wallClockElapsed >= wallClockCap) {
+      const clock = `${Math.round(wallClockElapsed / 60_000)}m of ${Math.round(wallClockCap / 60_000)}m`;
+      return hasArtifacts
+        ? {
+            cls: "wall-clock-cap-progress",
+            recovery: "continue",
+            evidence: `wall clock ${clock} with work to continue from (${run.prUrl ?? run.salvageSha ?? run.headSha})`,
+          }
+        : {
+            cls: "wall-clock-cap-spinning",
+            recovery: "escalate",
+            evidence: `wall clock ${clock}, no PR, no commits — $${run.spendUsd.toFixed(2)} spent`,
+          };
+    }
+    // Below its own ceilings, so nothing this worker did ended it: a daemon
     // restart, a drain, an operator. Costs no budget and needs no human.
     return {
       cls: "admin-kill",

package/src/fleet.ts

@@ -29,6 +29,7 @@ import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { formatZonedMinute } from "./availability.ts";
 import { findProject, loadConfig, stateDir } from "./config.ts";
+import { clearArmChallenge, recordArmChallenge } from "./arm-challenge.ts";
 import { resolveProjectTopicId, sendTelegram } from "./escalate.ts";
 import { planUsageLine, readPlanUsage, sharedUsageSource } from "./usage.ts";
 import { readApprovalSurface, readDaemonProfile } from "./approval-surface.ts";
@@ -250,6 +251,18 @@ function armGate(projectName?: string): { path: string; named?: string } {
   return named === undefined ? { path } : { path, named };
 }
 
+/**
+ * This project's current tick-arm verdict — the marker the heartbeat reads,
+ * returned with the path that carries it so a verb can report what actually
+ * remains. Read-only: the same decision `disarm` takes, so control and status
+ * about one fleet cannot disagree (a verb telling the operator to re-arm a
+ * fleet that is already armed is the defect #375 removes).
+ */
+export function armState(projectName?: string): { path: string; armed: boolean } {
+  const { path, named } = armGate(projectName);
+  return { path, armed: resolveArmState(path, named).armed };
+}
+
 /**
  * Clears the arm gate for this project — and `wasArmed` is the gate the
  * heartbeat reads, not merely one file's presence.
@@ -362,23 +375,34 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
   }
 
   const send = deps.sendChallenge ?? sendTelegramMessage;
+  const timeoutMs = deps.timeoutMs ?? ARM_CHALLENGE_TIMEOUT_MS;
   // Read before the send, not after: a transcript untouched since this instant
   // cannot contain the reply, and that is what the waiter filters on.
   const sentAt = (deps.now ?? Date.now)();
+  // The orchestrator must be able to classify the reply as an *active* arming
+  // proof for as long as this handshake is live, so the authenticated record
+  // (hash + expiry, never the code) is written before the challenge goes out
+  // and cleared the moment this end settles (#415).
+  recordArmChallenge(named, code, sentAt + timeoutMs);
   try {
     await send(token, channel.owner, text, topicId);
   } catch (err) {
+    // The challenge never went out, so it must not linger as a classifiable
+    // proof either.
+    clearArmChallenge(named);
     throw new Error(
       `arm: outbound sendMessage failed — NOT armed: ${err instanceof Error ? err.message : String(err)}`,
     );
   }
 
-  const timeoutMs = deps.timeoutMs ?? ARM_CHALLENGE_TIMEOUT_MS;
   const injected = deps.waitForUserTurn;
   const scan: SessionScan = injected
     ? { seen: await injected(dir, code, sentAt, timeoutMs), scanned: [], ignored: [] }
     : await waitForChallengeInSessions(dir, code, sentAt, timeoutMs, deps);
   if (!scan.seen) {
+    // The proof missed its window: a lookalike reply must not stay classifiable
+    // after arming gave up, so the record is cleared before the failure lands.
+    clearArmChallenge(named);
     const listing = [
       `session dir: ${dir}`,
       ...scan.scanned.map((f) => `  watched: ${f}`),
@@ -402,6 +426,10 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
   // marker that re-arms the fleet, and turn into a meaningless legacy warning
   // the moment a second project is configured.
   if (arm.legacy === "honoured") rmSync(legacyArmedMarkerPath(), { force: true });
+  // The transcript proof landed and this project is armed: the record has done
+  // its job. A stale record would also keep a later unsolicited lookalike alive
+  // longer than the fresh challenge it was cut for.
+  clearArmChallenge(named);
   return { path, alreadyArmed, owner: channel.owner, challenge: code };
 }
 
@@ -1393,6 +1421,7 @@ export function formatFleetStatus(
   decisions: string | undefined = undefined,
   failureClasses: string | undefined = undefined,
   workerPhases: ReadonlyMap<number, WorkerPausePhase> = new Map(),
+  intake: string | undefined = undefined,
 ): string {
   const tickLine =
     layers.ticksDetail === undefined
@@ -1473,6 +1502,7 @@ export function formatFleetStatus(
     ...(brief === undefined ? [] : [brief]),
     ...(decisions === undefined ? [] : [decisions]),
     ...(failureClasses === undefined ? [] : [failureClasses]),
+    ...(intake === undefined ? [] : [intake]),
     ...(graphBlock === undefined ? [] : [graphBlock]),
     daemonBlock,
     "",
@@ -1656,6 +1686,7 @@ export async function renderStatus(projectName?: string): Promise<string> {
     decisionStatusLine(project.name),
     failureClassBlock(project.name),
     workerPhases,
+    intakeStatusLine(project.name),
   );
 }
 
@@ -1734,6 +1765,32 @@ function decisionStatusLine(projectName: string): string | undefined {
   }
 }
 
+/**
+ * One line naming how many raw ideas are still pending (#299), or nothing when
+ * there are none.
+ *
+ * Deliberately absent at zero, unlike the decision line: an empty intake is the
+ * common state of a healthy fleet, and a row that prints "0 pending" every
+ * status would be permanent noise. Only a nonzero backlog is news, exactly like
+ * {@link failureClassBlock}. Omitted on any throw, like the other optional rows.
+ * Exported so the conditional is testable against a real store.
+ */
+export function intakeStatusLine(projectName: string): string | undefined {
+  const path = dbPath();
+  if (!existsSync(path)) return undefined;
+  let store: Store | undefined;
+  try {
+    store = openStore(path);
+    const pending = store.pendingIntake(projectName);
+    if (pending.length === 0) return undefined;
+    return `intake    ${pending.length} pending idea(s) — omp-conductor intake list`;
+  } catch {
+    return undefined;
+  } finally {
+    store?.close();
+  }
+}
+
 // ---------------------------------------------------------------------------
 // arm proof helpers
 // ---------------------------------------------------------------------------

package/src/graph-health.ts

@@ -264,7 +264,7 @@ export async function probeCodeGraph(
   const repos: CodeGraphRepoHealth[] = configured.map((repo) => {
     const clone: CheckState = deps.exists(repo.graphProject) ? "present" : "missing";
     const index: CheckState = roots === undefined ? "unknown" : roots.has(repo.graphProject) ? "present" : "missing";
-    if (clone === "missing") reasons.push(`${repo.name}: configured clone is missing`);
+    if (clone === "missing") reasons.push(`${repo.name}: no code-graph clone at ${repo.graphProject}; run \`omp-conductor setup graph\``);
     if (index === "missing") reasons.push(`${repo.name}: no indexed project exactly matches ${repo.graphProject}`);
     return { name: repo.name, path: repo.graphProject, clone, index };
   });

package/src/label-projection.ts

@@ -90,4 +90,4 @@ export async function projectLabels(
     if (!progressed) break;
   }
   return { applied, deferred };
-}
+}

package/src/lifecycle.ts

@@ -66,6 +66,18 @@ const LOG_TAIL_BYTES = 4_096;
 export function runtimeDir(): string {
   const override = process.env["OMP_CONDUCTOR_RUNTIME_DIR"];
   if (override !== undefined && override.length > 0) return override;
+  if (process.env["NODE_ENV"] === "test") {
+    // A test process must never read the host-global runtime dir: doing so
+    // names the real installed daemon's pid, and a test `stop` that inherits
+    // that record would signal — and stop — production's own unit (#399).
+    // Fail closed: a lifecycle test that omitted OMP_CONDUCTOR_RUNTIME_DIR
+    // (the runtime half of the test lifecycle seam) gets a loud error rather
+    // than a silent read of the operator's pidfile.
+    throw new Error(
+      "OMP_CONDUCTOR_RUNTIME_DIR must be set under NODE_ENV=test — " +
+        "refusing to read the host runtime directory (~/.omp/run/daemons/omp-conductor) from a test process",
+    );
+  }
   return join(homedir(), ".omp", "run", "daemons", "omp-conductor");
 }
 
@@ -178,6 +190,152 @@ export function livingDaemon(): DaemonRecord | undefined {
   return undefined;
 }
 
+/**
+ * The `daemon --once` lease file, one per process. Created `O_EXCL` so two
+ * simultaneous `--once` runs cannot both win ownership, and it names the
+ * holder's pid so a stale file (holder died) is removable rather than a
+ * permanent lock.
+ *
+ * The pidfile (`daemon.json`) is what makes this process *visible* as the owner
+ * for the duration of the tick (`status`, `worker stop`, a concurrent `daemon`
+ * start, orphan reconciliation all probe it); the lease file is what makes
+ * ownership *exclusive* — it is the thing that lets two simultaneous `--once`
+ * processes serialise, which the pidfile alone cannot (each would just
+ * overwrite it). They are deliberately two files: the lease is never the
+ * daemon record, so a short-lived drill can never impersonate or clear the
+ * managed daemon's record by virtue of holding a lock.
+ */
+function onceLeasePath(): string {
+  return join(runtimeDir(), "once.lock");
+}
+
+interface OnceLeaseHolder {
+  pid: number;
+  startedAt: number;
+}
+
+/** Parses the lease file; garbage is the same answer as absence — "not held". */
+function readOnceLeaseHolder(): OnceLeaseHolder | undefined {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(readFileSync(onceLeasePath(), "utf8"));
+  } catch {
+    return undefined;
+  }
+  if (parsed === null || typeof parsed !== "object") return undefined;
+  const pid = Reflect.get(parsed, "pid");
+  const startedAt = Reflect.get(parsed, "startedAt");
+  if (typeof pid !== "number" || !Number.isInteger(pid) || pid <= 1) return undefined;
+  if (typeof startedAt !== "number" || !Number.isFinite(startedAt)) return undefined;
+  return { pid, startedAt };
+}
+
+/** Bounded attempts to clear a stale lease and re-acquire it. */
+const ONCE_LEASE_RETRIES = 3;
+
+/** A once tick has no log file of its own; the record's field is informational. */
+const ONCE_RECORD_LOG = "<once tick — no daemon log>";
+
+export interface OnceLease {
+  /** The owned record that makes this process the visible daemon for the tick. */
+  record: DaemonRecord;
+  /**
+   * Drops exclusivity — but only while it is still ours. A manager that
+   * claimed the record mid-tick must be left alone: clearing it would clear
+   * somebody else's daemon.
+   */
+  release(): void;
+}
+
+export type OnceLeaseAcquire = { ok: true; lease: OnceLease } | { ok: false; pid: number };
+
+/**
+ * Acquires the exclusive daemon/state ownership a `--once` tick must hold for
+ * its whole lifecycle (#431). A drill is still a dispatcher — it settles rows,
+ * projects labels, admits and launches workers — so it takes the same
+ * ownership the long-running dispatcher holds via the pidfile, and refuses
+ * (having done nothing) while a live daemon owns the record or another live
+ * `--once` holds the lease.
+ *
+ * Returns `{ ok: false, pid }` — having performed no mutation — when another
+ * live process owns the project/state. A stale lease and a stale record whose
+ * holder died are cleared and retried. On success the process both holds the
+ * exclusive lease file and has published itself as the daemon owner, so every
+ * ownership probe (`livingDaemon`, a `daemon` start, a second `--once`) sees
+ * this process for the whole tick.
+ */
+export function acquireOnceLease(
+  o: { port?: number; project?: string; logFile?: string } = {},
+): OnceLeaseAcquire {
+  // A live dispatcher already owns the shared record. Never run beside it.
+  const daemon = livingDaemon();
+  if (daemon !== undefined && daemon.pid !== process.pid) {
+    return { ok: false, pid: daemon.pid };
+  }
+
+  const dir = ensureRuntimeDir();
+  const path = onceLeasePath();
+
+  for (let attempt = 0; attempt < ONCE_LEASE_RETRIES; attempt++) {
+    let created = false;
+    try {
+      const fd = openSync(path, "wx", 0o600);
+      writeFileSync(fd, `${JSON.stringify({ pid: process.pid, startedAt: Date.now() })}\n`);
+      closeSync(fd);
+      created = true;
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException).code !== "EEXIST") throw err;
+      const holder = readOnceLeaseHolder();
+      if (holder !== undefined && isAlive(holder.pid)) {
+        // A live holder — another `--once` (or a process still finishing one).
+        return { ok: false, pid: holder.pid };
+      }
+      // Stale or unreadable holder: clear it and try once more.
+      rmSync(path, { force: true });
+      continue;
+    }
+    if (!created) continue;
+
+    const record: DaemonRecord = {
+      pid: process.pid,
+      port: o.port ?? DEFAULT_PORT,
+      startedAt: Date.now(),
+      logFile: o.logFile ?? ONCE_RECORD_LOG,
+      ...(o.project === undefined ? {} : { project: o.project }),
+    };
+    try {
+      writeRecord(record);
+    } catch (err) {
+      rmSync(path, { force: true });
+      throw err;
+    }
+
+    // Confirm we still own the shared record: a manager may have claimed it in
+    // the instant between our lease create and our record write.
+    const current = readRecord();
+    if (current !== undefined && current.pid === process.pid) {
+      return {
+        ok: true,
+        lease: {
+          record,
+          release: () => {
+            const owned = readRecord();
+            if (owned !== undefined && owned.pid === process.pid) clearRecord();
+            const holder = readOnceLeaseHolder();
+            if (holder !== undefined && holder.pid === process.pid) {
+              rmSync(path, { force: true });
+            }
+          },
+        },
+      };
+    }
+    rmSync(path, { force: true });
+    return { ok: false, pid: current?.pid ?? process.pid };
+  }
+
+  throw new Error("could not acquire the daemon lease — a stale holder kept reappearing");
+}
+
 /**
  * Probes the daemon's own health endpoint. Never throws: a refused connection,
  * a DNS-less host, a hung socket and a 500 are all just "not healthy", and the
@@ -892,8 +1050,17 @@ async function terminate(pid: number, timeoutMs: number): Promise<boolean> {
   return !isAlive(pid);
 }
 
-/** Sends a signal, treating "already gone" as success. Returns false if the send failed. */
-function signal(pid: number, sig: NodeJS.Signals): boolean {
+/** Whether a raw signal should be delivered to a pid. */
+export type SignalFn = (pid: number, sig: NodeJS.Signals) => boolean;
+
+/**
+ * The default signal sender. Production reaches the real `kill`. Under
+ * NODE_ENV=test it dispatches to the fail-closed refusal instead: a test
+ * process must never signal a pid it did not explicitly authorise, and the
+ * default authorises nothing (#399).
+ */
+function defaultSignal(pid: number, sig: NodeJS.Signals): boolean {
+  if (process.env["NODE_ENV"] === "test") return testSignal(pid, sig);
   try {
     process.kill(pid, sig);
     return true;
@@ -902,6 +1069,35 @@ function signal(pid: number, sig: NodeJS.Signals): boolean {
   }
 }
 
+/**
+ * Child-process CLI tests cannot inject {@link setSignalForTest}. Under
+ * NODE_ENV=test they therefore get a refusal: a test process may only signal
+ * a pid its own code explicitly authorised, and a child has authorised none.
+ * Without this, a child `stop` that reads the operator's real daemon.json
+ * (an *inherited* runtime record) would SIGTERM the installed daemon — the
+ * #399 incident.
+ */
+function testSignal(_pid: number, _sig: NodeJS.Signals): boolean {
+  return false;
+}
+
+let signalFn: SignalFn = defaultSignal;
+
+/**
+ * Test-only: replace the raw signal sender. Pass `undefined` to restore.
+ * A test that intentionally spawned a helper may authorise signals to exactly
+ * that helper pid; every other pid is refused. Ownership is never inferred
+ * from writing a record — a pidfile fixture authorises nothing (#399).
+ */
+export function setSignalForTest(fn: SignalFn | undefined): void {
+  signalFn = fn ?? defaultSignal;
+}
+
+/** Sends a signal, treating "already gone" as success. Returns false if the send failed. */
+function signal(pid: number, sig: NodeJS.Signals): boolean {
+  return signalFn(pid, sig);
+}
+
 /**
  * The tail of the daemon log, formatted for an error message. Reads the last
  * few KB by offset rather than the whole file, because the log is append-only

package/src/notices.ts

@@ -0,0 +1,9 @@
+import { createHash } from "node:crypto";
+
+/** The deterministic primary id of a held notice derived from its escalation
+ * key. Sha256 of the key — 64 hex characters, a shape the digest handoff
+ * accepts verbatim — keeps the re-derived notice from a later poll idempotent
+ * against `ON CONFLICT(id) DO NOTHING` while remaining a real ledger row id. */
+export function heldNoticeId(key: string): string {
+  return createHash("sha256").update(`held-notice\0${key}`).digest("hex");
+}

package/src/omp.ts

@@ -739,6 +739,8 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
             tool: message.tool,
             reason: message.reason,
             args: message.args,
+            ...(message.matched === undefined ? {} : { matched: message.matched }),
+            ...(message.invocation === undefined ? {} : { invocation: message.invocation }),
           });
           break;
       }