omp-conductor 0.17.0 → 0.17.1

package/src/verbs/server.ts

@@ -54,6 +54,7 @@ import type {
   ReleaseRequirement,
   ReleaseShape,
   RepoTarget,
+  ReviewReason,
   RunRecord,
   Store,
   Tracker,
@@ -167,7 +168,6 @@ export interface VerbActions {
     fields: { title?: string; body?: string },
   ): Promise<{ ok: true } | { ok: false; stderr: string }>;
   mergePr(prUrl: string, headSha: string): Promise<ActionOutcome>;
-  setLabel(issue: number, label: string, action: "add" | "remove"): Promise<ActionOutcome>;
   release(execution: ReleaseExecution): Promise<ActionOutcome>;
   /**
    * Request the fleet upgrade itself to `version`: refuse when npm does not
@@ -298,6 +298,12 @@ export interface ReleaseFacts {
    * must wait on a process; these clear by themselves on the next sweep.
    */
   unconfirmedMerges?: number;
+  /**
+   * The unsettled runs themselves, routed-repo and issue each, so the refusal
+   * names what is blocking instead of a bare count (#603). Absent when the
+   * caller could not gather them (the plain wording is used then).
+   */
+  blockingRuns?: { repo: string; issue: number }[];
   /** Queue depth, or `undefined` when the tracker could not be read. */
   queueDepth: number | undefined;
   /** Current live-head workflow verdict for the released routed repository. */
@@ -311,7 +317,7 @@ export function releaseRequirementRefusal(
   facts: ReleaseFacts,
 ): string | undefined {
   for (const requirement of requires) {
-    if (requirement === "runs-settled" && facts.unsettledRuns > 0) {
+    if ((requirement === "runs-settled" || requirement === "fleet-runs-settled") && facts.unsettledRuns > 0) {
       // The same blocker reads differently depending on WHY the row is still
       // active: a live worker is the operator's wait, an unconfirmed merge or
       // an unrecorded sweep clears by itself on the next settle pass. The
@@ -328,9 +334,16 @@ export function releaseRequirementRefusal(
       if (open > 0) parts.push(`${open} pull request(s) still open`);
       if (unconfirmed > 0) parts.push(`${unconfirmed} run(s) whose PR merge the settle sweep has not yet recorded`);
       if (remaining > 0) parts.push(`${remaining} run(s) with no merged PR (closed or none yet)`);
+      // Name the runs behind the count so the operator can see at a glance
+      // whether this is the release's own work or someone else's (#603).
+      const blocking =
+        facts.blockingRuns === undefined || facts.blockingRuns.length === 0
+          ? ""
+          : ` — blocking: ${facts.blockingRuns.map((r) => `${r.repo} #${r.issue}`).join(", ")}`;
       return (
-        `policy.release.requires includes runs-settled and ${facts.unsettledRuns} run(s) have not settled` +
-        (parts.length === 0 ? "" : ` — ${parts.join("; ")}`)
+        `policy.release.requires includes ${requirement} and ${facts.unsettledRuns} run(s) have not settled` +
+        (parts.length === 0 ? "" : ` — ${parts.join("; ")}`) +
+        blocking
       );
     }
     if (requirement === "no-open-prs" && facts.openPrs > 0) {
@@ -505,6 +518,7 @@ async function decide(deps: VerbDeps, channel: VerbChannel, raw: unknown): Promi
     (verb === "conductor_pr_merge" ||
       verb === "conductor_pr_update_branch" ||
       verb === "conductor_pr_update" ||
+      verb === "conductor_pr_review" ||
       verb === "conductor_label");
   const stopped =
     spec.mutating && verb !== "conductor_release" && verb !== "conductor_install" && !orchestratorCompletion
@@ -540,6 +554,8 @@ async function decide(deps: VerbDeps, channel: VerbChannel, raw: unknown): Promi
       return releaseVerb(deps, project, channel, args, refuse, allow);
     case "conductor_install":
       return installVerb(deps, project, channel, args, refuse, allow);
+    case "conductor_pr_review":
+      return prReviewVerb(deps, project, channel, args, refuse, allow);
     case "conductor_pr_status":
       return prStatusVerb(deps, project, channel, args, refuse, allow);
   }
@@ -797,7 +813,15 @@ async function prUpdateBranchVerb(
   if (!outcome.ok) {
     return refuse("action-failed", `refused: gh could not update the branch:\n${outcome.stderr}`, target?.issue);
   }
-  return allow(`updated ${prUrl} with its base branch. Re-check its checks before merging.`, outcome.sha, target?.issue);
+  // The REST endpoint answers 202 Accepted: the refresh runs asynchronously, so
+  // this call produces no head SHA and the reply/ledger must not claim one —
+  // the head the action observed is the pre-update guard head, never a result
+  // (#655 review). The caller re-reads PR and check state before merging.
+  return allow(
+    `requested a base-branch update of ${prUrl} from its observed head; PR and check state must be re-read before merging.`,
+    undefined,
+    target?.issue,
+  );
 }
 
 async function prMergeVerb(
@@ -1064,9 +1088,21 @@ async function labelVerb(
   }
 
   const action = args["action"] === "remove" ? "remove" : "add";
-  const outcome = await deps.actions.setLabel(ref.issue, label, action);
-  if (!outcome.ok) {
-    return refuse("action-failed", `refused: the tracker rejected the label change:\n${outcome.stderr}`, ref.issue);
+  // The queue label is the fleet's lock, so it must not ride the GraphQL
+  // surface a provider outage just broke: `gh issue edit` is a GraphQL
+  // mutation in gh 2.86, and #642 comment 4 measured a label withdrawal
+  // refused by a GraphQL 503 leaving two overlapping issues claimable. The
+  // tracker's label methods are core REST with noop classification for the
+  // already-holding end state — the guarded path.
+  try {
+    if (action === "add") {
+      await deps.tracker.addLabel(ref.issue, label);
+    } else {
+      await deps.tracker.removeLabel(ref.issue, label);
+    }
+  } catch (err) {
+    const why = err instanceof Error ? err.message : String(err);
+    return refuse("action-failed", `refused: the tracker rejected the label change:\n${why}`, ref.issue);
   }
   return allow(`${action === "add" ? "added" : "removed"} ${label} on #${ref.issue}.`, undefined, ref.issue);
 }
@@ -1151,22 +1187,36 @@ async function releaseVerb(
   // this release by holding. Fail-closed stays fail-closed: a row whose PR
   // state cannot be read is still unsettled, and an unknown PR is still
   // treated as open.
+  //
+  // The run facts are scoped to the released repo (#603): a run in another
+  // routed repo cannot invalidate a tag on this one, so it must not gate this
+  // release. A genuinely suite-wide shape — a pin or manifest that consumes
+  // several repos — opts back into project-wide strictness through the named
+  // `fleet-runs-settled` requirement, which widens the scope to every active
+  // run. `no-open-prs` shares the scope: the branch being released is this
+  // repo's, so an open PR elsewhere is not "against" it either.
+  const fleetWide = policy.release.requires.includes("fleet-runs-settled");
   const wantsRunFacts =
     policy.release.requires.includes("runs-settled") ||
+    fleetWide ||
     policy.release.requires.includes("no-open-prs");
-  let unsettledRuns = active.length;
-  let openPrs = active.filter((r) => r.prUrl !== undefined).length;
+  const scoped = fleetWide ? active : active.filter((r) => r.repo === repoName);
+  let unsettledRuns = scoped.length;
+  let openPrs = scoped.filter((r) => r.prUrl !== undefined).length;
   let liveWorkers: number | undefined;
   let unconfirmedMerges: number | undefined;
+  let blockingRuns: { repo: string; issue: number }[] | undefined;
   if (wantsRunFacts) {
     let unsettled = 0;
     let open = 0;
     let live = 0;
     let unconfirmed = 0;
-    for (const run of active) {
+    const blocking: { repo: string; issue: number }[] = [];
+    for (const run of scoped) {
       if (run.state === "claimed" || run.state === "running") {
         unsettled += 1;
         live += 1;
+        blocking.push({ repo: run.repo, issue: run.issue });
         // A live worker's PR is not yet confirmable; count it as open, the
         // same fail-closed answer the old row-count gave it.
         if (run.prUrl !== undefined) open += 1;
@@ -1175,6 +1225,7 @@ async function releaseVerb(
       // pushed-pending / pushed-green: the worker is finished; the PR decides.
       if (run.prUrl === undefined) {
         unsettled += 1; // nothing to read; the sweep cannot settle it either
+        blocking.push({ repo: run.repo, issue: run.issue });
         continue;
       }
       let pr: PrState | undefined;
@@ -1185,6 +1236,7 @@ async function releaseVerb(
       }
       if (pr === "merged") continue; // settled in fact; not an open PR
       unsettled += 1;
+      blocking.push({ repo: run.repo, issue: run.issue });
       if (pr === "open") open += 1;
       else if (pr === undefined) {
         // Cannot confirm the merge (or its absence): fail closed, and count
@@ -1200,12 +1252,14 @@ async function releaseVerb(
     openPrs = open;
     liveWorkers = live;
     unconfirmedMerges = unconfirmed;
+    blockingRuns = blocking;
   }
   const unmet = releaseRequirementRefusal(policy.release.requires, {
     unsettledRuns,
     openPrs,
     ...(liveWorkers === undefined ? {} : { liveWorkers }),
     ...(unconfirmedMerges === undefined ? {} : { unconfirmedMerges }),
+    ...(blockingRuns === undefined ? {} : { blockingRuns }),
     queueDepth,
     ...(health === undefined ? {} : { baseCheck: health.verdict }),
     ...(health?.verdict === "red" && health.detail !== undefined
@@ -1509,6 +1563,153 @@ async function prUpdateVerb(
   return allow(`updated ${prUrl}.`, undefined, issue);
 }
 
+/**
+ * Return one green, run-owned pull request to its worker with blocking
+ * findings (#677): the transport that replaces the manual close-PR →
+ * comment-on-issue → unblock → continuation dance.
+ *
+ * Everything is recorded durably BEFORE anything is woken: the findings, the
+ * exact reviewed head, the round number, and the target run/session. The wake
+ * itself is the daemon's next dispatch pass (the verb has no handle on the
+ * worker machinery, and the CLI path must behave exactly like the embedded
+ * one), and the run row is reused — same branch, same PR, same attempt, same
+ * session directory — so a revision round never creates a new attempt and
+ * never touches the failed-attempt or continuation budgets.
+ *
+ * The duplicate in-flight guard has two halves: while a revision is queued
+ * but not yet dispatched, the pending `review_revisions` row refuses the
+ * second request atomically inside `claimReviewRevision`; once dispatched,
+ * the run row itself is `running` (claimed from `pushed-green` by the
+ * dispatch pass), which this verb refuses by name.
+ */
+async function prReviewVerb(
+  deps: VerbDeps,
+  project: ProjectConfig,
+  channel: VerbChannel,
+  args: Record<string, unknown>,
+  refuse: Refuse,
+  allow: Allow,
+): Promise<Verdict> {
+  const prUrl = String(args["prUrl"]);
+  const headSha = String(args["headSha"]);
+  const findings = String(args["findings"]);
+  const reason = String(args["reason"]) as ReviewReason;
+
+  // The run whose pushed-green row owns the PR — same resolution as merge: the
+  // newest attempt that recorded this PR within the recent-history window. A
+  // PR no run of this project opened (or one outside the routed repos) cannot
+  // be returned to a worker this project can resume.
+  const target = runForPr(deps, project.name, prUrl);
+  if (target === undefined) {
+    return refuse(
+      "pr-not-this-run",
+      `refused: ${prUrl} is not a pull request any run in ${project.name} opened. ` +
+        "A review revision acts on a run-owned PR only.",
+    );
+  }
+  if (!prInProjectRouting(project, prUrl)) {
+    return refuse(
+      "pr-not-this-run",
+      `refused: ${prUrl} is not in ${project.name}'s routed repositories ` +
+        `(${Object.values(project.routing.repos).map(repoSlugFor).join(", ") || "none"}).`,
+      target.issue,
+    );
+  }
+  const issue = target.issue;
+
+  if (findings.trim() === "") {
+    return refuse(
+      "malformed-argument",
+      "refused: conductor_pr_review needs a non-empty findings string — an empty revision returns the worker nothing to fix.",
+      issue,
+    );
+  }
+
+  // The revisable state is a settled green run. Any other state is a worker in
+  // flight (the original run or an earlier revision) or a run whose PR no
+  // longer waits on revision — the detail names the state field that produced
+  // the refusal.
+  if (target.state !== "pushed-green") {
+    const live = target.state === "running" || target.state === "claimed";
+    return refuse(
+      "review-in-flight",
+      `refused: run ${target.id} is ${target.state}, not pushed-green — ${
+        live
+          ? `a worker (the original run or an earlier revision) is still live on ${prUrl}; wait for it to settle before returning it.`
+          : `a review revision starts from a settled green run, and this one is ${target.state}.`
+      }`,
+      issue,
+    );
+  }
+
+  const paused = orchestratorPauseRefusal(deps, channel, target, refuse);
+  if (paused !== undefined) return paused;
+
+  // Exact-head, re-read at request time: the orchestrator reviewed a specific
+  // head, and a PR that moved since is not the thing it reviewed. Same verdict
+  // the merge gate uses, so "green at headSha" here is the same fact the merge
+  // would have required.
+  let verification: PrVerification | undefined;
+  try {
+    verification = await deps.tracker.verifyPr(prUrl, headSha);
+  } catch (err) {
+    const why = err instanceof Error ? err.message : String(err);
+    return refuse(
+      "head-unresolvable",
+      `refused: the live head of ${prUrl} could not be read (${why}).`,
+      issue,
+    );
+  }
+  if (verification === undefined) {
+    return refuse(
+      "head-unresolvable",
+      `refused: the live head of ${prUrl} could not be resolved. Refusing rather than returning a PR you did not re-read.`,
+      issue,
+    );
+  }
+  if (verification.status !== "green") {
+    const stale = verification.status === "failed" && isHeadMismatch(verification.reason);
+    return refuse(
+      stale ? "head-stale" : "checks-not-green",
+      stale
+        ? `refused: ${verification.reason}. You reviewed ${headSha}; that is not what is on the branch now. Re-read the head and re-review.`
+        : `refused: ${prUrl} is not green at ${headSha} — ${verification.reason}. A revision is returned to a green PR only.`,
+      issue,
+    );
+  }
+
+  // Durable, and refused atomically against a concurrent duplicate: the row is
+  // persisted before any wake, and a second request for the same run bumps
+  // into the pending row rather than racing it.
+  const round = deps.store.latestReviewRound(project.name, target.id) + 1;
+  const recorded = deps.store.createReviewRevision({
+    project: project.name,
+    runId: target.id,
+    issue,
+    prUrl,
+    headSha,
+    findings,
+    round,
+    reason,
+    ...(target.sessionFile === undefined ? {} : { sessionFile: target.sessionFile }),
+    requestedAt: deps.now(),
+  });
+  if (recorded === undefined) {
+    return refuse(
+      "review-in-flight",
+      `refused: a review revision is already pending for ${prUrl} (run ${target.id}); exactly one revision is in flight per PR.`,
+      issue,
+    );
+  }
+
+  return allow(
+    `recorded review round ${round} for ${prUrl} at ${headSha}; the daemon will resume run ${target.id}'s session` +
+      `${target.sessionFile === undefined ? "" : ` (${target.sessionFile})`} on its next dispatch pass.`,
+    undefined,
+    issue,
+  );
+}
+
 // ------------------------------------------------------------------ the listener
 
 export interface VerbListener {

package/src/worker.ts

@@ -74,6 +74,32 @@ export const ORPHAN_RESUME_PROMPT =
   "then continue exactly where you left off: re-check the outcome of your last action before repeating it, and keep " +
   "working your original brief to the same report contract.";
 
+/**
+ * What a review-revision worker is told instead of re-sending its brief (#677).
+ *
+ * Same rule as {@link ORPHAN_RESUME_PROMPT}: the original brief is already in
+ * the resumed transcript, and re-sending it is how a resumed worker re-does
+ * work it already did. What makes this a revision rather than a resume is the
+ * deliverable contract: the PR stays open, the branch stays the run's own, and
+ * the session ends only when the same final-report shape says the revised head
+ * is green. One literal so tests can pin it.
+ */
+export const REVIEW_REVISION_PROMPT =
+  "The orchestrator reviewed your green pull request and found blocking findings. Continue this same session " +
+  "on this same run: same branch, same pull request — do not close or reopen it, and do not open another. " +
+  "Address exactly the findings below, push with conductor_push, verify the checks with conductor_pr_status, " +
+  "and finish with the same final-report contract as before (state: pushed-green, pr:, head:). " +
+  "Your original brief is already in this transcript; redo only what the findings implicate.";
+
+/**
+ * The full opening prompt for one review revision round: the pinned continuation
+ * text plus the orchestrator's findings verbatim. Exported so a unit test can
+ * pin the exact handoff without standing up a session.
+ */
+export function renderReviewRevisionPrompt(findings: string, round: number): string {
+  return `${REVIEW_REVISION_PROMPT}\n\nReview round ${round} — blocking findings:\n\n${findings}`;
+}
+
 export interface WorkerOpts {
   brief: string;
   cwd: string;

package/systemd/omp-conductor-recover.sh

@@ -84,6 +84,10 @@ JOURNAL_LINES=${RECOVER_JOURNAL_LINES:-200}
 VERIFY_POLL_S=${RECOVER_VERIFY_POLL_S:-2}
 VERIFY_TRIES=${RECOVER_VERIFY_TRIES:-10}
 PROJECT=${RECOVER_PROJECT:-}
+# The bound on the post-restore re-arm. `arm` with a claim-only proof performs
+# no Telegram send or wait, so it completes in milliseconds; the timeout exists
+# so a misbehaving conductor can never hang this bounded playbook (#613).
+ARM_TIMEOUT_S=${RECOVER_ARM_TIMEOUT_S:-30}
 
 # --------------------------------------------------------------------------
 # output
@@ -298,6 +302,55 @@ choose_action() { # <failed-unit>
   printf 'NONE|\n'
 }
 
+# --------------------------------------------------------------------------
+# re-arm — the one follow-on after a successful restoration (#613)
+# --------------------------------------------------------------------------
+
+# Whether the scoped project opted into claim-only arming. The unit renders
+# RECOVER_PROJECT only for an unambiguous single-project host (#510/#530), and
+# "proof" is a value unique to the project's "arm" block, so two exact-key
+# greps decide it on the machine-written config. Any unreadable, hand-formatted
+# or legacy shape (no "arm" key at all) reads as challenge — the explicit human
+# gate — which is the fail-safe direction: recovery never arms a project that
+# did not opt into claim-only.
+project_arms_claim_only() { # <config-path>
+  local path=${1:-$CONFIG_PATH}
+  [[ -f $path ]] || return 1
+  grep -qE '"arm"[[:space:]]*:' "$path" || return 1
+  grep -qE '"proof"[[:space:]]*:[[:space:]]*"claim-only"' "$path"
+}
+
+# Re-arm the scoped project through the ordinary `arm` path, unattended only
+# when the project opted into claim-only proof: that proof performs no Telegram
+# send or wait, so the command completes headless. A challenge project is never
+# poked — its gate is a human answering the challenge — and the caller's
+# escalation says so plainly instead. Prints exactly one outcome line (the
+# progress line goes to stderr, so the captured return value is the outcome).
+rearm_if_claim_only() {
+  if [[ -z $PROJECT ]]; then
+    printf 'no scoped project (RECOVER_PROJECT unset) — nothing to re-arm\n'
+    return 0
+  fi
+  if ! project_arms_claim_only "$CONFIG_PATH"; then
+    printf 'project %s keeps the challenge proof — arming stays an explicit human gate\n' "$PROJECT"
+    return 0
+  fi
+  log "re-arming $PROJECT via the ordinary arm path (claim-only proof)"
+  if dry_run; then
+    printf 'dry run: would run %s arm --project %s (claim-only, bounded by %ss)\n' "$CONDUCTOR" "$PROJECT" "$ARM_TIMEOUT_S"
+    return 0
+  fi
+  local out code
+  out=$(timeout "$ARM_TIMEOUT_S" "$CONDUCTOR" arm --project "$PROJECT" 2>&1)
+  code=$?
+  if (( code == 0 )); then
+    printf 're-armed %s via the claim-only proof\n' "$PROJECT"
+    return 0
+  fi
+  printf 're-arm of %s failed (exit %s): %s\n' "$PROJECT" "$code" "$out"
+  return 0
+}
+
 # --------------------------------------------------------------------------
 # main
 # --------------------------------------------------------------------------
@@ -318,6 +371,13 @@ run_recovery() {
       IFS='|' read -r action_name action_arg <<<"$(choose_action "$failed")"
       say "plan: failed unit $failed; action: $action_name"
     fi
+    if [[ -z $PROJECT ]]; then
+      say "plan: re-arm — none (RECOVER_PROJECT unset)"
+    elif project_arms_claim_only "$CONFIG_PATH"; then
+      say "plan: re-arm — $CONDUCTOR arm --project $PROJECT (claim-only proof, bounded by ${ARM_TIMEOUT_S}s)"
+    else
+      say "plan: re-arm — none ($PROJECT keeps the challenge proof; arming is an explicit human gate)"
+    fi
     say "plan: escalation — $(escalation_text "$failed" "${action_name:-none}" "dry run" "DRY-RUN")"
     return 0
   fi
@@ -411,6 +471,19 @@ run_recovery() {
     bump_failed_attempts
   fi
 
+  # The one follow-on a verified restoration earns (#613): re-arm the scoped
+  # project through the ordinary `arm` command. Claim-only completes headless;
+  # a challenge project stays an explicit human gate and the escalation below
+  # says so plainly. Only after `verify` passed — writing an arm marker for a
+  # fleet that is still down is the improvisation this playbook never does.
+  local rearm_line="not attempted (recovery did not verify the fleet restored)"
+  if (( ok == 0 )); then
+    rearm_line=$(rearm_if_claim_only)
+  fi
+  say "re-arm: $rearm_line"
+  append_evidence "$ev" "re-arm: $rearm_line"
+  outcome="$outcome; re-arm: $rearm_line"
+
   if escalate "$failed" "$action_name" "$outcome" "$ev"; then
     if (( ok == 0 )); then
       return 0

package/systemd/recover-unit-test.sh

@@ -97,6 +97,9 @@ case "$1" in
   --version)
     echo "0.15.11"
     ;;
+  arm)
+    echo "armed demo via fixture"
+    ;;
   report)
     echo "report 485-abc queued for demo (tier2)"
     ;;
@@ -147,6 +150,12 @@ marker() { # <case-dir> -> attempts count or 0
   fi
 }
 
+# The minimal machine-written config shape the re-arm decision greps: the arm
+# block with the chosen proof, as `saveConfig` would write it.
+write_project_config() { # <case-dir> <proof>
+  printf '{\n  "version": 2,\n  "projects": [\n    { "name": "demo", "arm": { "proof": "%s" } }\n  ]\n}\n' "$2" >"$1/state/config.json"
+}
+
 run_recover() { # <case-dir> [env assignments…]
   local d="$1"
   shift
@@ -300,6 +309,58 @@ check 'ROLLBACK escalates as well' \
 check 'the pre-upgrade snapshot survives the rollback for the operator' \
   '{"preUpgrade":true}' "$(cat "$d/state/backups/config"/config.json.pre-upgrade-*)"
 
+# ---------------------------------------------------------------------------
+# case — the post-restore re-arm (#613): a verified restoration re-arms a
+# claim-only project through the ordinary arm command; a challenge project is
+# never poked and the escalation says the human gate is explicit.
+# ---------------------------------------------------------------------------
+
+d=$(newcase rearm-claim-only)
+write_project_config "$d" claim-only
+unit_state "$d" herdr-fleet.service failed
+unit_state "$d" omp-conductor.service active
+code=$(run_with_heal "$d" herdr-fleet.service)
+check 'claim-only re-arm exits 0 when the unit heals' '0' "$code"
+check 'claim-only recovery re-arms via the ordinary arm path' \
+  'omp-conductor arm --project demo' "$(grep '^omp-conductor arm' "$d/calls")"
+check 'the escalation names the claim-only re-arm' \
+  're-armed demo via the claim-only proof' "$(grep '^omp-conductor report' "$d/calls" | head -n 1)"
+check 'the evidence bundle records the re-arm' \
+  're-arm: re-armed demo via the claim-only proof' "$(cat "$d/state/recovery"/evidence-*)"
+
+d=$(newcase rearm-challenge)
+write_project_config "$d" challenge
+unit_state "$d" herdr-fleet.service failed
+unit_state "$d" omp-conductor.service active
+code=$(run_with_heal "$d" herdr-fleet.service)
+check 'a challenge project exits 0 when the unit heals' '0' "$code"
+check 'a challenge project is never poked with arm' \
+  '' "$(grep '^omp-conductor arm' "$d/calls" || true)"
+check 'the escalation says the challenge gate is explicit' \
+  'arming stays an explicit human gate' "$(grep '^omp-conductor report' "$d/calls" | head -n 1)"
+
+# A project whose config predates the key reads as challenge: no "arm" block.
+d=$(newcase rearm-legacy-config)
+unit_state "$d" herdr-fleet.service failed
+unit_state "$d" omp-conductor.service active
+code=$(run_with_heal "$d" herdr-fleet.service)
+check 'a legacy config without arm.proof is never poked with arm' \
+  '' "$(grep '^omp-conductor arm' "$d/calls" || true)"
+check 'a legacy config keeps the human gate in the escalation' \
+  'arming stays an explicit human gate' "$(grep '^omp-conductor report' "$d/calls" | head -n 1)"
+
+# RESTART_PEER never verifies a restoration, so even a claim-only project must
+# not be re-armed while the daemon is still down.
+d=$(newcase rearm-unverified)
+write_project_config "$d" claim-only
+unit_state "$d" omp-conductor.service failed
+unit_state "$d" herdr-fleet.service active
+code=$(run_recover "$d")
+check 'an unverified recovery never re-arms' \
+  're-arm: not attempted' "$(grep 're-arm:' "$d/out" | head -n 1)"
+check 'an unverified recovery calls no arm' \
+  '' "$(grep '^omp-conductor arm' "$d/calls" || true)"
+
 # ---------------------------------------------------------------------------
 # case RESTART_PEER and the bound: attempts cap at two, then escalate-only.
 # A daemon crash with no upgrade evidence must never get a blind daemon start.