omp-conductor 0.17.1 → 0.18.1

package/src/setup.ts

@@ -45,6 +45,7 @@ import {
   resolveCaps,
   resolvePolicy,
   resolveReleaseGrants,
+  resolveReview,
   SCOPE_PRESETS,
   stateDir,
 } from "./config.ts";
@@ -57,8 +58,10 @@ import {
   DEFAULT_CAPS,
   DEFAULT_PROJECT_POLICY,
   DEFAULT_REPORT_SCOPE,
+  DEFAULT_REVIEW_POLICY,
   DENIED_RELEASE_GRANTS,
   RELEASE_SHAPES,
+  REVIEW_STRICTNESS,
   WEEKDAYS,
   type ArmProof,
   type BaseFreshness,
@@ -75,6 +78,8 @@ import {
   type ReleaseRequirement,
   type ReportScopeChoice,
   type ReportingPolicy,
+  type ReviewPolicy,
+  type ReviewStrictness,
   type Weekday,
   type WeeklyAvailability,
   type RepoTarget,
@@ -138,7 +143,7 @@ export interface SetupAnswers {
   /** Tracker repo as `owner/repo` — the only spelling `gh` takes without a host. */
   trackerRepo: string;
   queueLabel: string;
-  stateLabels: { inProgress: string; blocked: string; failed: string };
+  stateLabels: { inProgress: string; blocked: string; failed: string; backlog: string };
   routingLabelPrefix: string;
   targetRepos: {
     name: string;
@@ -215,6 +220,13 @@ export interface SetupAnswers {
    * leave it to be defaulted by whichever reader gets there first.
    */
   armProof: ArmProof;
+  /**
+   * How green PRs are reviewed and returned (#678): the strictness level and
+   * the hard ceiling on review rounds per PR lifecycle. Always complete: the
+   * wizard asks about it in the policy area, so an answers object can never
+   * leave it to be defaulted by whichever reader gets there first.
+   */
+  review: ReviewPolicy;
   /**
    * Hand-edited recovery merge authorizations carried through setup unchanged.
    * The wizard never grants one; forgetting them during an unrelated amend
@@ -305,7 +317,12 @@ export interface LabelPlan {
  *  cannot drift apart: one spelling of "ready-for-agent" in the package. */
 export const SETUP_DEFAULTS = {
   queueLabel: "ready-for-agent",
-  stateLabels: { inProgress: "agent:in-progress", blocked: "agent:blocked", failed: "agent:failed" },
+  stateLabels: {
+    inProgress: "agent:in-progress",
+    blocked: "agent:blocked",
+    failed: "agent:failed",
+    backlog: "backlog",
+  },
   routingLabelPrefix: "repo:",
   defaultBranch: "main",
   /** Both authorities start with the human; the wizard asks to move each one. */
@@ -314,6 +331,8 @@ export const SETUP_DEFAULTS = {
   releaseGrants: DENIED_RELEASE_GRANTS,
   /** The strictest reading of the prose these conditions replaced (#129). */
   policy: DEFAULT_PROJECT_POLICY,
+  /** The recommended review strictness and its default ceiling (#678). */
+  review: DEFAULT_REVIEW_POLICY,
   /** The daemon runs its own triage session unless an operator already runs one. */
   orchestratorMode: "embedded",
 } as const;
@@ -405,6 +424,35 @@ export const ARM_PROOF_CHOICES: { readonly [K in ArmProof]: string } = {
   "claim-only": "anyone who can invoke the already-privileged `omp-conductor arm` command can start dispatch once the live claim and poller pass",
 };
 
+/**
+ * What each review strictness blocks, in the operator's words, and the single
+ * canonical phrasing of the three bars (#678).
+ *
+ * Mapped over the closed union for the reason {@link MERGE_DUTY} is: a fourth
+ * level fails to compile here instead of reaching a wizard with no question for
+ * it, an amend row that cannot describe it, and a rendered brief that shows it
+ * blank. Each sentence is self-contained — "Low's bar" would reference prose
+ * the brief may not be rendering — and it is the *same* text the wizard shows
+ * one level at a time and the composed orchestrator brief carries for the
+ * configured level, so the definition an operator chose is the threshold a
+ * session enforces.
+ *
+ * The two consumers read this map rather than their own prose: the setup
+ * dialog explains every level from it, and {@link reviewDuty} renders the
+ * effective one from it. "One canonical implementation, not duplicated prose
+ * branches" is this object.
+ */
+export const REVIEW_STRICTNESS_CHOICES: { readonly [K in ReviewStrictness]: string } = {
+  low: "correctness, security, data-loss or explicit acceptance-criteria failures — anything else stays a review comment",
+  medium:
+    "correctness, security, data-loss or explicit acceptance-criteria failures, plus material maintainability or " +
+    "reliability defects likely to become incidents within six months — anything else stays a review comment",
+  high:
+    "correctness, security, data-loss or explicit acceptance-criteria failures, plus material maintainability or " +
+    "reliability defects likely to become incidents within six months, plus concrete quality defects — never " +
+    "subjective style churn or unbounded refactoring",
+};
+
 export const RELEASE_REQUIREMENT_CHOICES: { readonly [K in ReleaseRequirement]: string } = {
   "runs-settled": "every run of the released repo actually merged, not merely reached a green PR",
   "fleet-runs-settled": "every run in the project actually merged — suite-wide strictness for shapes that consume several repos",
@@ -465,6 +513,34 @@ export const MERGE_DUTY: { readonly [K in ProjectConfig["authority"]["merge"]]:
     "  one is a hard boundary, not a preference.",
 };
 
+/**
+ * Duty 1's review-return contract, worded from `project.review` (#678).
+ *
+ * One canonical implementation rather than prose branches in the template: the
+ * configured level's bar is the same {@link REVIEW_STRICTNESS_CHOICES} text
+ * the setup dialog explains each level with, and the ceiling is the configured
+ * number — so the strictness an operator chose in setup and the threshold this
+ * session enforces cannot diverge. The paragraph names `conductor_pr_review`
+ * (the #677 verb) as the only return path and states the three ceiling
+ * behaviours: leave the PR open, record the unresolved findings, escalate once.
+ */
+export function reviewDuty(p: ProjectConfig): string {
+  const { strictness, maxRounds } = resolveReview(p);
+  return (
+    "\n" +
+    "**Review policy:** before you merge (or settle) a green PR, review it at\n" +
+    `this project's strictness. The level is **${strictness}**: ` +
+    `${REVIEW_STRICTNESS_CHOICES[strictness]}. ` +
+    "`conductor_pr_review` is the verb for findings at or above that bar, and\n" +
+    "for nothing else — anything below it stays a review comment on the PR,\n" +
+    "never a return. Every corrected head gets a fresh review, up to a hard\n" +
+    `ceiling of ${maxRounds} ${maxRounds === 1 ? "round" : "rounds"} per PR lifecycle, visible in ` +
+    "`omp-conductor status` as `review-revision N`. At the ceiling\n" +
+    "`conductor_pr_review` refuses: leave the PR open, record the unresolved\n" +
+    "findings, and escalate once — never a further round."
+  );
+}
+
 /**
  * The Promotion paragraph, worded from `authority.promotion`.
  *
@@ -506,13 +582,15 @@ const POLICY_TEMPLATE_PATH = join(import.meta.dir, "briefs", "policy.md");
 const REQUIRED_SCOPES = ["repo", "project"] as const;
 
 /** GitHub's own palette, so the tracker reads at a glance: green means queued,
- *  blue means moving, amber means waiting on you, red means it gave up, and
- *  purple is routing — the operator's input, the one label the loop never writes. */
+ *  blue means moving, amber means waiting on you, red means it gave up, grey
+ *  means the operator parked it, and purple means routing — the operator's
+ *  input, the label the loop never writes. */
 const LABEL_COLOURS = {
   queue: "0e8a16",
   inProgress: "1d76db",
   blocked: "fbca04",
   failed: "b60205",
+  backlog: "8b949e",
   routing: "6f42c1",
 } as const;
 
@@ -596,14 +674,15 @@ export async function checkTokenScopes(): Promise<ScopeCheck> {
 
 /**
  * Every label setup wants on the tracker, before existence is known: the queue
- * and state labels the loop reads and writes, plus one routing label per routed
- * repo. Pure — the prefix and the repo keys are already answered at this point
- * in the interview — which is what lets a test pin the whole set without `gh`.
+ * and state labels the loop reads and writes, the operator's park label (which
+ * the loop must never write), plus one routing label per routed repo. Pure —
+ * the prefix and the repo keys are already answered at this point in the
+ * interview — which is what lets a test pin the whole set without `gh`.
  *
- * Routing labels are provisioned, never applied: `route()` requires exactly one
- * `<prefix><repo>` label per issue and treats zero or two as unroutable, so a
- * tracker without them can queue nothing. Creating them queues nothing either —
- * applying one, with the queue label, stays the operator's sign-off.
+ * The park label is provisioned like the rest but owned the other way round:
+ * it exists so the operator has a gesture, and the conductor never applies or
+ * removes it (#507). Creating it queues nothing either — applying one, with
+ * the queue label, stays the operator's sign-off.
  */
 export function wantedLabels(a: SetupAnswers): Omit<LabelPlan, "exists">[] {
   return [
@@ -627,6 +706,11 @@ export function wantedLabels(a: SetupAnswers): Omit<LabelPlan, "exists">[] {
       colour: LABEL_COLOURS.failed,
       description: "The conductor gave up on this issue after its retry budget",
     },
+    {
+      name: a.stateLabels.backlog,
+      colour: LABEL_COLOURS.backlog,
+      description: "Parked by the operator — never claimed, only the operator may set or clear it",
+    },
     ...a.targetRepos.map((r) => ({
       name: `${a.routingLabelPrefix}${r.name}`,
       colour: LABEL_COLOURS.routing,
@@ -901,6 +985,10 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
     name: a.projectName,
     tracker: { kind: "github", repo: a.trackerRepo },
     queueLabel: a.queueLabel,
+    // The park label is now an answer like the other three: the wizard offers
+    // it and every answers constructor carries it, so writing the answers as
+    // they stand is the single source — slice 1's hardcoded default bridge is
+    // gone (#507 slice 2).
     stateLabels: { ...a.stateLabels },
     routing: { labelPrefix: a.routingLabelPrefix, repos },
     caps,
@@ -928,6 +1016,10 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
     // policy has a line in the file to point at — and the recovery playbook
     // can read which proof the project opted into (#613).
     arm: { proof: a.armProof },
+    // Written out in full for the same reason as `arm`: the file then carries
+    // the strictness and the ceiling an operator chose, without anyone having
+    // to know a migration rule (#678).
+    review: { ...a.review },
     ...(a.recoveryMerges === undefined
       ? {}
       : { recoveryMerges: a.recoveryMerges.map((entry) => ({ ...entry })) }),
@@ -1018,6 +1110,10 @@ export function defaultAnswers(projectName: string, opts: { added?: boolean } =
     // The strict reading, matching the loader's absent-key default: a project
     // that never answered keeps today's authenticated challenge round-trip.
     armProof: DEFAULT_ARM_PROOF,
+    // First-run default: the recommended strictness and its ceiling, so a
+    // fresh project opens on the answer the issue recommends — and the loader
+    // materialises the same value for a config that has no key at all.
+    review: { ...SETUP_DEFAULTS.review },
     orchestratorMode: SETUP_DEFAULTS.orchestratorMode,
     reportScope: SETUP_DEFAULT_REPORT_SCOPE,
     writeOrchestratorBrief: false,
@@ -1117,6 +1213,10 @@ export function answersFromProject(p: ProjectConfig): SetupAnswers {
     // The loader materialises `arm` complete, so this is the answer the project
     // actually has — never a default guessed at the amend prompt.
     armProof: resolveArmProof(p),
+    // Same reason as `armProof`: the loader materialises `review` complete, so
+    // a re-run preserves the configured strictness and ceiling rather than
+    // opening on a default the operator already answered.
+    review: resolveReview(p),
     orchestratorMode: p.escalation.orchestrator,
     reportScope: reportScopeFromPolicy(p.reporting),
     writeOrchestratorBrief: false,
@@ -1184,6 +1284,7 @@ function briefVarsForProject(p: ProjectConfig): Record<string, string> {
     QUEUE_LABEL: p.queueLabel,
     RELEASES_DEFAULT: RELEASES_DEFAULTS[`${p.authority.merge}/${p.authority.release}`],
     MERGE_DUTY: MERGE_DUTY[p.authority.merge],
+    REVIEW_DUTY: reviewDuty(p),
     PROMOTION_DUTY: PROMOTION_DUTIES[p.authority.promotion ?? DEFAULT_AUTHORITY.promotion],
     POLICY_SOURCE: policySourceLine(p),
   };
@@ -1693,6 +1794,9 @@ export function summarisePlan(
     `  environments ${a.policy.release.environments.join(", ") || "none declared — every deploy target is refused"}`,
   );
 
+  lines.push("", "review", `  strictness     ${a.review.strictness} — ${REVIEW_STRICTNESS_CHOICES[a.review.strictness]}`);
+  lines.push(`  max rounds/PR  ${a.review.maxRounds} — at the ceiling the PR is left open, the findings recorded, and it is escalated once`);
+
   const reporting = project.reporting as ReportingPolicy;
   const briefPath = orchestratorBriefPath(a);
   lines.push(
@@ -1909,16 +2013,18 @@ export const AMEND_AREAS: {
   },
   policy: {
     name: "merge & release preconditions",
-    asks: "the checks, base freshness, draft rule and behind-base action for a merge, then what a release requires and what it ships",
+    asks: "the checks, base freshness, draft rule and behind-base action for a merge, then what a release requires and what it ships — and how green PRs are reviewed, and how many rounds a PR may be returned",
     describe: (p) => {
       const policy = resolvePolicy(p);
+      const review = resolveReview(p);
       // Counted rather than listed: this row is elided at 96 characters, and the
       // full table is in the plan summary the consent screen shows next.
       return (
         `merge: ${policy.merge.requiredChecks.length === 0 ? "every check" : `${policy.merge.requiredChecks.length} check(s)`}, ` +
         `base ${policy.merge.baseFreshness}, drafts ${policy.merge.drafts}, behind → ${policy.merge.whenBehindBase}; ` +
         `release: ${policy.release.requires.length} must-land, ${policy.release.artefacts.length} artefact(s), ` +
-        `${policy.release.environments.length} env(s)`
+        `${policy.release.environments.length} env(s); ` +
+        `review ${review.strictness} ×${review.maxRounds}`
       );
     },
   },

package/src/shell.ts

@@ -0,0 +1,15 @@
+/**
+ * One CLI argument rendered exactly as an operator would type it, for surfaces
+ * that print executable commands.
+ *
+ * A command a surface prints is a command the reader copies, so an argument
+ * that could mean something else is a defect: a project named `odd $fleet`
+ * must not render `--project odd $fleet` (two arguments, and a `$` that the
+ * shell would read). Safe characters pass through unquoted; anything else is
+ * wrapped in single quotes, folding an embedded quote with the standard
+ * `'\''` — the same convention the privileged-step renderer applies to its
+ * printed `sudo …` lines (#810).
+ */
+export function shellQuote(value: string): string {
+  return /^[A-Za-z0-9_@%+=:,./-]+$/.test(value) ? value : `'${value.replaceAll("'", "'\\''")}'`;
+}

package/src/status-render.ts

@@ -22,9 +22,9 @@ import type { DaemonStop } from "./types.ts";
 import { settlementFlagSummary } from "./diff-flags.ts";
 import type { CodeGraphHealth } from "./graph-health.ts";
 import { formatDigestBacklog, formatOpenReports } from "./reports.ts";
-import { formatOrchestratorDown } from "./orchestrator-down.ts";
+import { formatDownDuration, formatOrchestratorDown } from "./orchestrator-down.ts";
 import { planUsageLine } from "./usage.ts";
-import { SYSTEMD_UNIT, type UnitOwnership } from "./lifecycle.ts";
+import { HEALTH_TIMEOUT_MS, SYSTEMD_UNIT, type UnitOwnership } from "./lifecycle.ts";
 import type { WorkerPausePhase } from "./worker.ts";
 import { formatRss, rssBytesFromHealthz } from "./host.ts";
 import {
@@ -32,12 +32,12 @@ import {
   formatDispatchSummary,
   formatFreezes,
   formatReleaseGrants,
-  formatSalvagedRuns,
   isPaused,
   pausedAt,
   pauseProvenance,
   type StatusSnapshot,
 } from "./daemon.ts";
+import { formatQuarantinedRuns, formatSalvagedRuns } from "./settlement.ts";
 
 // layered status
 // ---------------------------------------------------------------------------
@@ -90,6 +90,14 @@ export function formatCodeGraphHealth(graph: CodeGraphHealth, now = Date.now()):
     `code graph  ${graph.status}  ${indexed}/${graph.repos.length} repos indexed`,
     `  indexer   ${graph.prerequisites.indexer}`,
     `  MCP mount ${graph.prerequisites.mcpMount}`,
+    // The runtime half of the mount finding (#726): what dispatched sessions
+    // actually held in their registries. Rendered only when a run recorded
+    // it — "observed" is never claimed without evidence.
+    ...(graph.session.recorded === 0
+      ? []
+      : [
+          `  session   observed in ${graph.session.recorded} run(s): present ${graph.session.present} / absent ${graph.session.absent}`,
+        ]),
     `  timer     ${graph.timer.enabled} / ${graph.timer.active}`,
     `  refresh   ${refresh}`,
     ...graph.reasons.map((reason) => `  - ${reason}`),
@@ -108,6 +116,7 @@ export type DaemonProjectHealth =
   | { kind: "stopped" }
   | { kind: "ok" }
   | { kind: "unreachable" }
+  | { kind: "unresponsive" }
   | { kind: "other-project"; serves?: string };
 
 /**
@@ -122,6 +131,14 @@ export type FleetDaemonProbe = {
   unit?: UnitOwnership;
 };
 
+/**
+ * #685: the healthz timeout is a probe outcome, never a death verdict — the
+ * same discipline the indexer probe uses when it reports `probe timed out`
+ * instead of declaring the indexer missing.
+ */
+const UNRESPONSIVE_HEALTHZ =
+  `unresponsive (healthz timed out after ${HEALTH_TIMEOUT_MS / 1000}s)`;
+
 function formatDaemonHealthz(probe: FleetDaemonProbe | undefined): string {
   if (probe === undefined) return "unprobed";
   switch (probe.project.kind) {
@@ -129,6 +146,8 @@ function formatDaemonHealthz(probe: FleetDaemonProbe | undefined): string {
       return "stopped";
     case "ok":
       return "ok";
+    case "unresponsive":
+      return UNRESPONSIVE_HEALTHZ;
     case "unreachable":
       return "unreachable — the process is up but not serving";
     case "other-project":
@@ -239,8 +258,13 @@ export function formatFleetStatus(
     // not this project's daemon facts (#379).
     const rss =
       daemon?.project.kind === "ok" ? rssBytesFromHealthz(daemon.body) : undefined;
+    // Three states, never two (#685): `not running` is reserved for a pid
+    // that is actually gone, and a timed-out `/healthz` is its own state —
+    // a healthy fleet that answers slowly must not read as stopped.
+    const state =
+      daemon?.project.kind === "unresponsive" ? UNRESPONSIVE_HEALTHZ : "running";
     daemonBlock = [
-      "daemon",
+      `daemon    ${state}`,
       `  pid       ${layers.daemon.pid}`,
       `  port      ${layers.daemon.port ?? "?"}`,
       ...(rss === undefined ? [] : [`  rss       ${formatRss(rss)}`]),
@@ -319,6 +343,31 @@ function formatDigestScheduleStatus(s: StatusSnapshot): string[] {
   ];
 }
 
+/** The reporting row: which categories interrupt the operator's phone, and
+ *  where everything else goes. It reads the snapshot's effective summary —
+ *  the legacy preset name is a label, never the source of truth: an explicit
+ *  policy without `scopePreset` renders truthfully from `interruptOn` and the
+ *  digest cadence, so a routine outcome under `decisions` explains itself as
+ *  digest-only instead of reading like a broken Telegram (#633). */
+function formatReportingStatus(s: StatusSnapshot): string[] {
+  const r = s.reporting;
+  if (r === undefined) return [];
+  const interrupt =
+    r.interruptOn.length === 0 ? "nothing interrupts" : `${r.interruptOn.join(", ")} interrupt`;
+  const label = r.scopePreset === undefined ? "reporting —" : `reporting ${r.scopePreset} —`;
+  let consequence: string;
+  if (r.interruptOn.includes("material")) {
+    consequence = "no outcome waits for the digest";
+  } else if (r.digest.cadence === "daily") {
+    consequence = "material outcomes wait for the daily digest";
+  } else if (r.digest.cadence === "none") {
+    consequence = "material outcomes are held; no digest is configured";
+  } else {
+    consequence = "material outcomes wait for the per-tick digest";
+  }
+  return [`${label} ${interrupt}; ${consequence}`];
+}
+
 /**
  * The shared-daemon visibility row (#545). When the daemon also serves sibling
  * projects, tell the reader how many runs each has live, so they can tell "my
@@ -342,6 +391,14 @@ function formatProjectBody(
   const lines = [
     `project   ${s.project}${s.paused ? "  (PAUSED)" : ""}`,
     ...(s.pauseReason === undefined ? [] : [`paused    ${s.pauseReason}`]),
+    // Structured-exposure half of the drain surface (#484): a plain row for
+    // the renderer, so the active drain is visible in `status` before the
+    // human-wording work of the later #484 child lands.
+    ...(s.drain === undefined
+      ? []
+      : [
+          `drain     active — expires ${new Date(s.drain.expiresAt).toISOString()}, ${s.drain.remainingRuns} run(s) remaining`,
+        ]),
     `config    ${s.configPath}`,
     `state     ${s.stateDir}`,
     ...(siblingLine === undefined ? [] : [siblingLine]),
@@ -350,6 +407,7 @@ function formatProjectBody(
     ...(s.orchestratorDown === undefined
       ? []
       : formatOrchestratorDown(s.orchestratorDown, now)),
+    ...formatReportingStatus(s),
     ...formatAvailabilityStatus(s),
     ...formatDigestScheduleStatus(s),
     "",
@@ -405,6 +463,13 @@ function formatProjectBody(
     `  continuations      ${s.caps.maxContinuationsPerIssue}`,
     "",
     ...formatReleaseGrants(s.releaseGrants),
+    // The effective review policy (#678), read from the same snapshot surface
+    // as the grants: the level is what Duty 1 judges findings against, and the
+    // ceiling is its hard bound — an orchestrator reading `review-revision N`
+    // below has to see both without opening the config.
+    "review",
+    `  strictness       ${s.review.strictness}`,
+    `  max rounds/PR    ${s.review.maxRounds}`,
     "",
     formatDispatchSummary(s.dispatch),
     "",
@@ -419,16 +484,39 @@ function formatProjectBody(
       // a failure and from an ordinary continuation, with the round number
       // from the durable revision row (#692). The live pause overlay still
       // wins: an operator pause is the newer fact about the same session.
+      const paused = phase === "pausing" || phase === "paused";
       const round = s.reviewRounds?.[r.id];
-      const state =
-        phase === "pausing" || phase === "paused"
-          ? phase
-          : round !== undefined
-            ? `review-revision ${round}`
-            : r.state;
+      const state = paused
+        ? phase
+        : round !== undefined
+          ? `review-revision ${round}`
+          : r.state;
+      // Turn rate and cap projection (#730/#767): a stalled run and a fast one
+      // used to render identically as a bare turn count. The rate is the
+      // lifetime average over the elapsed shown — the snapshot carries no
+      // checkpoint from which a recent-interval rate could be derived — so it
+      // is labelled `avg`, and `elapsed` is elapsed since claim, never
+      // "remaining wall clock": a paused worker banks its budget, which the
+      // snapshot cannot know. #767 adds the projection #518 asked for: the
+      // same claim-elapsed rate held forward to the wall-clock budget
+      // (`caps.workerWallClockMs`, rendered in the caps block) as the turn
+      // count the run would reach at that cap — trajectory math over
+      // elapsed-so-far, so reading it against the run's `maxTurns` tells
+      // which cap fires first. A paused run gets neither number, because its
+      // elapsed includes banked pause time and its state already says
+      // `paused`.
+      const elapsedMs = Math.max(0, now - r.startedAt);
+      const progress = paused
+        ? ""
+        : `  ${formatDownDuration(elapsedMs)} elapsed  ${(
+            (r.turns * 60_000) / Math.max(elapsedMs, 1_000)
+          ).toFixed(1)} turns/min avg` +
+          `  projects ${Math.round(
+            (r.turns * s.caps.workerWallClockMs) / Math.max(elapsedMs, 1_000),
+          )} turns at cap`;
       lines.push(
         `  #${r.issue}  ${r.repo}  ${state}  attempt ${r.attempt}  ` +
-          `${r.turns}/${r.maxTurns} turns  ${r.spendUsd.toFixed(2)}  ${r.branch}` +
+          `${r.turns}/${r.maxTurns} turns${progress}  ${r.spendUsd.toFixed(2)}  ${r.branch}` +
           (r.prUrl ? `  ${r.prUrl}` : ""),
       );
       // The orchestrator's Duty 1 reads this command, and a flagged run's
@@ -441,6 +529,7 @@ function formatProjectBody(
   lines.push(...formatBaseHealth(s.baseHealth));
   lines.push(...formatFreezes(s.freezes));
   lines.push(...formatSalvagedRuns(s.salvagedRuns));
+  lines.push(...formatQuarantinedRuns(s.quarantinedRuns));
   lines.push(...formatOpenReports(s.openReports));
   lines.push(...formatDigestBacklog(s.digestBacklog));
   if (s.liveWorkers > 0) {