omp-conductor 0.17.1 → 0.18.1

package/src/briefs/worker.md

@@ -47,7 +47,7 @@ files are canonical; your priors are not.
 
 {{ACCEPTANCE_CRITERIA}}
 
-{{ISSUE_COMMENTS}}## How to work
+{{ISSUE_COMMENTS}}{{FILE_LANE}}{{MODEL}}## How to work
 
 1. **Understand before editing — and ask the graph before you grep.** Your turns
    are mostly spent finding code, not writing it, and running out of turns
@@ -76,6 +76,18 @@ files are canonical; your priors are not.
    genuinely cannot be done small, stop and escalate rather than ballooning.
 5. **Fix the root cause, never the symptom.** Do not suppress a warning, delete an
    assertion, or special-case an input to make a check pass.
+6. **Prefer the structured edit tool for file changes, and the structured
+   search tool over shelling out.** A structured edit is one call: anchored and
+   verified, and a stale anchor fails loudly instead of silently editing the
+   wrong line. The shell equivalent is three or four — compose the script,
+   escape it correctly, run it, then read the file back to confirm it did what
+   was intended — and a mis-escaped `sed -i` pattern silently edits nothing or
+   the wrong line. So do not hand-roll edits through `sed -i`, `python3`
+   heredocs, `node -e` or shell redirection except where no structured tool can
+   express the change (a binary file, a generated artefact). The same holds for
+   finding code: use the structured search tool rather than shelling out to
+   grep, for the same reason the graph line exists — it is cheaper per call and
+   its output is already scoped.
 
 ## Tests — read this carefully
 
@@ -99,6 +111,7 @@ These are the exact gates for `{{REPO}}`:
 {{GATES}}
 
 {{SHARED_HOST_NOTICE}}
+{{HOST_CONSTRAINTS}}
 
 Run every one of them, from the directory listed, over the **whole tree** — not
 just the directory you edited. Linting only the source dir is how an error in a
@@ -210,24 +223,29 @@ Escalating is a successful outcome. Guessing is not.
 
 ## Your final report
 
-End with exactly these seven lines, evidence only — no narration:
-
-```
-issue:   {{TRACKER_REPO}}#{{ISSUE_NUMBER}}
-pr:      <url or "none">
-head:    <40-character head SHA or "none">
-state:   pushed-green | blocked | failed
-gates:   <exact commands run and their results>
-changed: <the settlement derives this from the PR diff — omit the line>
-next:    <nothing | the specific decision needed>
+End your run by yielding the settlement through the `yield` tool — one
+structured call, and the schema is the contract: the harness showed it to you
+at session start. The expected shape:
+
+```json
+{
+  "status": "green",
+  "prUrl": "https://github.com/.../pull/N",
+  "headSha": "<the 40-char head you watched go green>",
+  "summary": "What you changed and why — the narrative a reviewer reads.",
+  "proof": ["bun test omp/src/worker.test.ts"]
+}
 ```
 
-The `changed:` line is not yours to write from memory: the settlement replaces
-it with the actual file list from the PR's diff. Omit it, or write it wrongly —
-the settled report carries the diff's list either way. The narrative in your
-report (what you changed and why, above these lines) is the part only you can
-write, and it is the part a reviewer reads.
-
-Never report success you have not observed. "Should pass CI" is not a state, and
-`pushed-green` means you watched the checks go green — not that you expect them
+Call it as `yield({ result: { data: <the object> } })` with no `type` — the
+usual terminal yield. `status: "green"` means you pushed and **watched the
+checks go green**, and it requires both `prUrl` and `headSha`. Use `blocked`
+(with `blockers`) when a decision or credential is missing, `failed` when the
+run could not complete. The dispatcher renders your yielded settlement into
+the stored report, so `summary` is what a reviewer reads and `proof` is the
+evidence; the `changed:` file list is derived from the PR's own diff, never
+written by you.
+
+Never report success you have not observed. "Should pass CI" is not a state,
+and `green` means you watched the checks go green — not that you expect them
 to.

package/src/cli.ts

@@ -18,6 +18,7 @@ import { dashboardCommand } from "./commands/dashboard.ts";
 import { decisionCommand } from "./commands/decision.ts";
 import { disarmCommand } from "./commands/disarm.ts";
 import { doctorCommand } from "./commands/doctor.ts";
+import { drainCommand } from "./commands/drain.ts";
 import { eventCommand } from "./commands/event.ts";
 import { extendCommand } from "./commands/extend.ts";
 import { frictionCommand } from "./commands/friction.ts";
@@ -178,6 +179,7 @@ export function commandHandlers(ctx: CommandContext): Record<string, CommandHand
     board: () => boardCommand(ctx),
     dashboard: () => dashboardCommand(ctx),
     hold: () => holdCommand(ctx),
+    drain: () => drainCommand(ctx),
     arm: () => armCommand(ctx),
     disarm: () => disarmCommand(ctx),
     tail: () => tailCommand(ctx),

package/src/command-help.ts

@@ -87,6 +87,17 @@ export const COMMAND_DETAILS = `  setup    interview, then write config.json, th
   hold     soft stop: pause claiming AND disarm ticks. Daemon and pane stay up.
            This is "stop the conductor overnight" without killing processes.
            Use --all to target every configured project.
+  drain    start, inspect, or cancel the project's self-expiring admission
+           drain — the durable, bounded alternative to queue-label churn
+           before a release. New claims pause while active runs settle, and
+           admission resumes at the absolute deadline on its own, even if the
+           orchestrator dies. start takes --until (an ISO instant or a
+           relative duration such as 90s/45m/2h/1d, always bounded and in the
+           future) and an optional --reason; status reports the active drain's
+           creation time, expiry, reason and remaining active runs; cancel
+           removes it and is idempotent. The drain never touches the pause
+           sentinel, the arm marker, or any queue label — it is a file record,
+           not a timer or a hold.
   arm      proof-gated: send a Telegram challenge and write the arm marker only
            after your reply appears as a user turn in the orchestrator transcript.
            Never auto-armed by resume/hold. Use --all for every project.
@@ -168,9 +179,16 @@ export const COMMAND_DETAILS = `  setup    interview, then write config.json, th
            condition the daemon checks for you; a met watch wakes the next tick
            with its note, exactly as a met question does, but it is listed under
            its own heading and never under "Open operator decisions", and it has
-           no seven-day expiry. \`watch list\` shows open watches.
+           no seven-day expiry. \`watch list\` shows open watches; \`watch
+           withdraw <id>\` ends one with a recorded reason — the verb that
+           creates a watch is the verb that ends it (watches are decision rows,
+           so \`decision withdraw <id>\` also works). A watch whose PR condition
+           can no longer be observed — the PR merged or closed before the
+           condition was seen — is withdrawn by the daemon itself with the
+           reason recorded.
              watch add --note TEXT [--blocks TEXT] [--resolves-when COND]
              watch list
+             watch withdraw <id> [--reason TEXT]
   intake   keep a raw idea durably before it becomes anything: record it now
            with \`omp-conductor intake "<text>"\`, list what is still pending,
            dismiss what turned out to be nothing. Backed by the sqlite store,

package/src/command-manifest.ts

@@ -205,6 +205,27 @@ export const COMMAND_MANIFEST: readonly CommandManifestEntry[] = [
     usage: ["hold [--keep-ticks] [--project NAME | --all]"],
     flags: [toggle("--keep-ticks", "pause claims without disarming ticks"), project(), all()],
   },
+  {
+    name: "drain",
+    description: "start, inspect, or cancel the project's self-expiring admission drain",
+    scope: "project",
+    usage: [
+      "drain start --until ISO|DURATION [--reason TEXT] [--project NAME]",
+      "drain status [--project NAME]",
+      "drain cancel [--project NAME]",
+    ],
+    subcommands: [
+      { name: "start", description: "record a bounded drain intent" },
+      { name: "status", description: "report the drain and its remaining active runs" },
+      { name: "cancel", description: "remove the project's drain" },
+    ],
+    flags: [
+      value("--until", "absolute ISO instant or relative duration (90s, 45m, 2h, 1d)"),
+      value("--reason", "purpose, persisted on the drain record"),
+      project(),
+    ],
+    positionals: [{ name: "action" }],
+  },
   {
     name: "arm",
     description: "prove Telegram delivery and arm scheduled ticks",
@@ -390,24 +411,27 @@ export const COMMAND_MANIFEST: readonly CommandManifestEntry[] = [
   },
   {
     name: "watch",
-    description: "record or list orchestrator-only conditions and carry notes",
+    description: "record, list, or withdraw orchestrator-only conditions and carry notes",
     scope: "project",
     usage: [
       "watch add --note TEXT [--blocks TEXT] [--resolves-when COND] [--project NAME]",
       "watch list [--project NAME] [--json]",
+      "watch withdraw <id> [--reason TEXT] [--project NAME]",
     ],
     subcommands: [
       { name: "add", description: "record a watch" },
       { name: "list", description: "list open watches" },
+      { name: "withdraw", description: "withdraw an obsolete watch" },
     ],
     flags: [
       value("--note", "note carried when the watch resolves"),
       value("--blocks", "what the watch blocks"),
       value("--resolves-when", "automatic resolution condition"),
+      value("--reason", "withdrawal reason"),
       toggle("--json", "print watch list as stable JSON"),
       project(),
     ],
-    positionals: [{ name: "action" }],
+    positionals: [{ name: "action" }, { name: "id" }],
   },
   {
     name: "intake",
@@ -472,6 +496,7 @@ export function renderUsage(manifest: readonly CommandManifestEntry[] = COMMAND_
     ...details,
     "recipes:",
     "  hold              no claims, no tick sends (inspectable)",
+    "  drain start       bounded release window, self-expiring (no hold)",
     "  stop              hold + stop dispatch daemon",
     "  stop --pane       stop + pin conductor-pane recovery off",
     "  resume            clear pause and pane pin (ticks stay disarmed)",

package/src/commands/context.ts

@@ -82,6 +82,7 @@ export const COMMAND_SCOPES: Readonly<Record<string, CommandScope>> = {
   // project — exactly one project; findProject demands --project when several
   "brief-upgrade": "project",
   decision: "project",
+  drain: "project",
   event: "project",
   extend: "project",
   friction: "project",

package/src/commands/drain.ts

@@ -0,0 +1,176 @@
+/**
+ * `drain` — start, inspect, or cancel the project's self-expiring admission fence (#484).
+ *
+ * The bounded drain state machine landed in #776 (`createDrain`/`readDrain`/
+ * `cancelDrain` on daemon.ts, re-exported from fleet.ts); this verb is the
+ * operator surface over it. A drain is the release-window sibling of `hold`:
+ * the same admission boundary — settlement above it, nothing claimed below —
+ * but recorded with an absolute deadline, so admission resumes on its own even
+ * if the orchestrator dies. The only state it touches is the project's drain
+ * record: never the pause sentinel, the arm marker, or any queue label.
+ */
+
+import type { CommandContext } from "./context.ts";
+import { findProject, loadConfig } from "../config.ts";
+import { statusSnapshot } from "../daemon.ts";
+import { cancelDrain, createDrain, readDrain } from "../fleet.ts";
+import { dim, ok } from "../ui/style.ts";
+
+const DRAIN_USAGE = `omp-conductor drain — start, inspect, or cancel the project's admission drain.
+
+usage:
+  omp-conductor drain start --until ISO|DURATION [--reason TEXT] [--project NAME]
+  omp-conductor drain status [--project NAME]
+  omp-conductor drain cancel [--project NAME]
+
+A drain is a durable, self-expiring admission fence: new claims pause while
+existing runs settle, and admission resumes automatically at the absolute
+deadline — even if the orchestrator crashes. start replaces any prior drain of
+the project; --until takes an ISO instant or a relative duration (90s, 45m,
+2h, 1d) that must be bounded and in the future. status reports the active
+drain's creation time, absolute expiry, reason, and remaining active runs.
+cancel removes the project's drain and is idempotent. A drain never touches
+the pause sentinel, the arm marker, or any queue label — it is the file record
+that expires on its own.`;
+
+/** The flags each drain subcommand accepts, after the subcommand itself. */
+const DRAIN_FLAGS: Readonly<Record<string, readonly string[]>> = {
+  start: ["--project", "--until", "--reason"],
+  status: ["--project"],
+  cancel: ["--project"],
+};
+
+/** Relative durations accepted by `drain start --until`. */
+const DURATION_RE = /^(\d+)([smhd])$/;
+const DURATION_UNIT_MS: Readonly<Record<string, number>> = {
+  s: 1_000,
+  m: 60_000,
+  h: 3_600_000,
+  d: 86_400_000,
+};
+
+/**
+ * `--until` value → epoch-ms deadline, or undefined when the input is not a
+ * bounded expiry. A duration is relative to now; an ISO instant is absolute.
+ * Both forms must land on a finite safe-integer timestamp — the same bound
+ * `createDrain` persists as an absolute ISO instant, so a value beyond the
+ * Date range (e.g. 99999999999999999999d) is refused here instead of blowing
+ * up inside the record write. The absolute form must look like a calendar
+ * date: a bare number such as `3000` parses as a year in some engines, and an
+ * operator typing that almost certainly meant a duration.
+ */
+function parseExpiry(raw: string, now: number): number | undefined {
+  const duration = DURATION_RE.exec(raw);
+  if (duration !== null) {
+    const expiresAt = now + Number.parseInt(duration[1]!, 10) * DURATION_UNIT_MS[duration[2]!]!;
+    return Number.isSafeInteger(expiresAt) ? expiresAt : undefined;
+  }
+  if (!/^\d{4}-\d{2}-\d{2}/.test(raw)) return undefined;
+  const absolute = Date.parse(raw);
+  return Number.isSafeInteger(absolute) ? absolute : undefined;
+}
+
+/**
+ * Rejects trailing tokens a drain subcommand does not declare, so a typo'd
+ * flag cannot be silently ignored — the same exit-2 scan `intake` and `stats`
+ * run. Both `--flag VALUE` and `--flag=VALUE` are accepted, matching the
+ * shared `flag()` parser.
+ */
+function assertKnownArgs(ctx: CommandContext, sub: string): void {
+  const allowed = DRAIN_FLAGS[sub] ?? [];
+  for (let i = 2; i < ctx.argv.length; i++) {
+    const token = ctx.argv[i];
+    if (token === undefined) continue;
+    const eq = token.startsWith("--") ? token.indexOf("=") : -1;
+    const name = eq < 0 ? token : token.slice(0, eq);
+    if (allowed.includes(name)) {
+      if (eq < 0) i += 1; // consume the flag's value token
+      continue;
+    }
+    process.stderr.write(`omp-conductor: drain ${sub}: unexpected argument "${token}"\n`);
+    process.exit(2);
+  }
+}
+
+export async function drainCommand(ctx: CommandContext): Promise<void> {
+  const sub = ctx.argv[1];
+  if (sub === "--help" || sub === "-h") {
+    process.stdout.write(DRAIN_USAGE);
+    return;
+  }
+  if (sub !== "start" && sub !== "status" && sub !== "cancel") {
+    process.stderr.write("omp-conductor: drain needs start, status, or cancel\n");
+    process.exit(2);
+  }
+  assertKnownArgs(ctx, sub);
+  const project = findProject(loadConfig(), ctx.projectFlag);
+
+  if (sub === "start") {
+    const rawUntil = ctx.flag("until");
+    if (rawUntil === undefined || rawUntil.length === 0) {
+      process.stderr.write(
+        "omp-conductor: drain start needs --until with an ISO instant or a duration (90s, 45m, 2h, 1d)\n",
+      );
+      process.exit(2);
+    }
+    const now = Date.now();
+    const expiresAt = parseExpiry(rawUntil, now);
+    if (expiresAt === undefined) {
+      process.stderr.write(
+        `omp-conductor: drain start: "${rawUntil}" is not a bounded expiry — ` +
+          "use an ISO instant (e.g. 2026-08-20T10:00:00Z) or a duration (90s, 45m, 2h, 1d)\n",
+      );
+      process.exit(2);
+    }
+    if (expiresAt <= now) {
+      process.stderr.write(`omp-conductor: drain start: --until "${rawUntil}" must be in the future\n`);
+      process.exit(2);
+    }
+    const rawReason = ctx.flag("reason")?.trim().replace(/\s+/g, " ");
+    if (rawReason !== undefined && (rawReason === "" || rawReason.length > 500)) {
+      process.stderr.write("omp-conductor: drain start --reason needs 1-500 characters\n");
+      process.exit(2);
+    }
+    createDrain(project.name, {
+      expiresAt,
+      ...(rawReason === undefined ? {} : { reason: rawReason }),
+    });
+    process.stdout.write(
+      ok(
+        `drain started for ${project.name} — claiming paused until ${new Date(expiresAt).toISOString()}` +
+          (rawReason === undefined ? "" : ` (${rawReason})`),
+      ) + "\n",
+    );
+    process.stdout.write(
+      dim(
+        "the drain is a durable record: it survives crashes and resumes admission at the deadline on its own",
+      ) + "\n",
+    );
+    return;
+  }
+
+  if (sub === "status") {
+    const drain = statusSnapshot(project.name).drain;
+    if (drain === undefined) {
+      process.stdout.write(`drain: ${project.name} inactive — admission is open\n`);
+      return;
+    }
+    const lines = [
+      `drain: ${project.name} active`,
+      `  since       ${new Date(drain.since).toISOString()}`,
+      `  expires at  ${new Date(drain.expiresAt).toISOString()}`,
+      ...(drain.reason === undefined ? [] : [`  reason      ${drain.reason}`]),
+      `  remaining   ${drain.remainingRuns} active run${drain.remainingRuns === 1 ? "" : "s"}`,
+    ];
+    process.stdout.write(`${lines.join("\n")}\n`);
+    return;
+  }
+
+  const had = readDrain(project.name);
+  cancelDrain(project.name);
+  process.stdout.write(
+    had.kind === "active"
+      ? ok(`drain cancelled for ${project.name} — admission resumes on the next dispatch pass`) + "\n"
+      : `drain: ${project.name} had no active drain — nothing to cancel\n`,
+  );
+}

package/src/commands/extend.ts

@@ -2,25 +2,21 @@
  * `extend` — raise a live run's turn ceiling, or set a bounded one-shot ceiling after a failed, killed, orphaned or blocked run.
  *
  * Moved out of cli.ts's switch by the per-verb module split (#462);
- * only the case wrapper, the injected `ctx` lookups and the imports
- * changed from the original bodies.
+ * the daemon discovery resolves through {@link requireDaemonControl}, the
+ * same run-control target `worker` uses, so a live systemd-run daemon
+ * stays reachable when its pidfile is missing (#811) and the refusal
+ * answers cannot drift between the two verbs.
  */
 
 import type { CommandContext } from "./context.ts";
 import { findProject, loadConfig } from "../config.ts";
-import { livingDaemon } from "../lifecycle.ts";
+import { requireDaemonControl } from "../lifecycle.ts";
 
 export async function extendCommand(ctx: CommandContext): Promise<void> {
 const issue = ctx.issueArg("extend", ctx.argv[1]);
 const maxTurns = ctx.turnsFlag();
 const project = findProject(loadConfig(), ctx.projectFlag);
-const daemon = livingDaemon();
-if (daemon === undefined) throw new Error("daemon is not running");
-if (daemon.project !== undefined && daemon.project !== project.name) {
-  throw new Error(
-    `daemon serves project "${daemon.project}", not requested project "${project.name}"`,
-  );
-}
+const daemon = await requireDaemonControl(project.name);
 const response = await fetch(
   `http://127.0.0.1:${daemon.port}/runs/${issue}/turn-limit`,
   {

package/src/commands/status.ts

@@ -47,7 +47,6 @@ function styleStatus(text: string): string {
     .map((line) => {
       if (
         line === "caps" ||
-        line === "daemon" ||
         line === "active runs" ||
         line === "active runs  (none)" ||
         line.startsWith("project   ")
@@ -56,6 +55,11 @@ function styleStatus(text: string): string {
       if (line.includes("STALLED")) return fail(line);
       if (/^(dispatch|ticks|pane|herdr|telegram|  healthz)\s+.*\b(running|healthy|ok)\b/.test(line))
         return ok(line);
+      // The daemon headline carries its own three states (#685): green while
+      // serving, amber when the probe timed out or the pid is gone — a bare
+      // `daemon` heading line no longer exists to style.
+      if (/^daemon\s+.*\b(not running|unresponsive)\b/.test(line)) return warn(line);
+      if (/^daemon\s+running\b/.test(line)) return ok(line);
       if (/^(dispatch|ticks|daemon)\s+.*\b(paused|stopped|not running|overdue)\b/.test(line))
         return warn(line);
       return line;

package/src/commands/watch.ts

@@ -10,19 +10,82 @@
  * next tick should read, neither of which ever needs an operator answer. It is
  * distinguished durably by its `kind`, never by whether it carries a
  * condition — a real question may carry one too.
+ *
+ * Watches are decision rows with `kind === "watch"`, so `watch withdraw`
+ * delegates to the same store resolution `decision withdraw` uses rather than
+ * inventing a second mechanism: both verbs write the same durable terminal
+ * state with a recorded reason, and a watch id remains acceptable to `decision
+ * withdraw` for anyone who learned that vocabulary first (#664).
  */
 
 import type { CommandContext } from "./context.ts";
 import { findProject, loadConfig } from "../config.ts";
 import { CONDITION_FORMS, parseCondition } from "../decisions.ts";
+import { shellQuote } from "../shell.ts";
 import { dbPath, openStore } from "../store.ts";
 
+const WATCH_USAGE = `omp-conductor watch — set a condition or carry note for the orchestrator itself.
+
+usage:
+  omp-conductor watch add --note TEXT [--blocks TEXT] [--resolves-when COND] [--project NAME]
+  omp-conductor watch list [--project NAME] [--json]
+  omp-conductor watch withdraw <id> [--reason TEXT] [--project NAME]
+
+add records a row the daemon checks for you and the next tick reads, with no
+operator answer needed. list shows open watches, oldest first. withdraw ends
+one with a recorded reason — the verb that creates a watch is the verb that
+ends it. A watch whose PR condition can no longer be observed (the PR merged
+or closed first) is withdrawn by the daemon itself.`;
+
+/** The flags each watch subcommand accepts, after the subcommand itself.
+ *  `add`'s positional note and `withdraw`'s positional id are validated by
+ *  the branches below, not through this table. */
+const WATCH_FLAGS: Readonly<Record<string, readonly string[]>> = {
+  add: ["--blocks", "--note", "--project", "--resolves-when"],
+  list: ["--json", "--project"],
+  withdraw: ["--project", "--reason"],
+};
+
+/** Flags that take no value — `list --json` must not consume the token after it. */
+const WATCH_BOOL_FLAGS: Readonly<Record<string, true>> = { "--json": true };
+
+/**
+ * Rejects any token after the subcommand that its surface does not declare,
+ * so a typo'd flag can never be silently ignored — the defect where
+ * `--condition` created a watch with no condition at all. Both `--flag VALUE`
+ * and `--flag=VALUE` are accepted, matching the shared `flag()` parser; a
+ * value flag consumes the next token, a `--flag=VALUE` form or a boolean flag
+ * never does. The same exit-2 scan `drain` and `stats` run (#462).
+ */
+function assertKnownWatchArgs(ctx: CommandContext, sub: string, from: number): void {
+  const allowed = WATCH_FLAGS[sub] ?? [];
+  for (let i = from; i < ctx.argv.length; i++) {
+    const token = ctx.argv[i];
+    if (token === undefined) continue;
+    const eq = token.startsWith("--") ? token.indexOf("=") : -1;
+    const name = eq < 0 ? token : token.slice(0, eq);
+    if (allowed.includes(name)) {
+      if (eq < 0 && WATCH_BOOL_FLAGS[name] !== true) i += 1; // consume the flag's value token
+      continue;
+    }
+    process.stderr.write(
+      `omp-conductor: watch ${sub}: unexpected argument "${token}" (known: ${allowed.join(" ")}) — nothing was recorded\n`,
+    );
+    process.exit(2);
+  }
+}
+
 export async function watchCommand(ctx: CommandContext): Promise<void> {
   const sub = ctx.argv[1];
+  if (sub === "--help" || sub === "-h") {
+    process.stdout.write(WATCH_USAGE);
+    return;
+  }
   const project = findProject(loadConfig(), ctx.projectFlag);
   const store = openStore(dbPath());
   try {
     if (sub === "add") {
+      assertKnownWatchArgs(ctx, "add", 2);
       const note = ctx.flag("note")?.trim();
       if (note === undefined || note.length === 0 || note.startsWith("--")) {
         process.stderr.write("omp-conductor: watch add needs --note with what the next tick should know\n");
@@ -45,11 +108,17 @@ export async function watchCommand(ctx: CommandContext): Promise<void> {
         at: Date.now(),
       });
       const wake = condition === undefined ? "read by the next tick" : "the daemon wakes the next tick when it is met";
-      process.stdout.write(`watch ${watch.id} added — ${wake} (no operator answer needed)\n`);
+      // The verb that ends the row names the project it was created in: this
+      // command is copied, and on a host with several projects the bare form is
+      // ambiguous (#810).
+      process.stdout.write(
+        `watch ${watch.id} added — ${wake} (no operator answer needed); end with: omp-conductor watch withdraw ${watch.id} --project ${shellQuote(project.name)}\n`,
+      );
       return;
     }
 
     if (sub === "list" || sub === undefined) {
+      assertKnownWatchArgs(ctx, "list", 2);
       const open = store.openDecisions(project.name).filter((d) => d.kind === "watch");
       const now = Date.now();
       const watches = open.map((d) => ({
@@ -70,14 +139,52 @@ export async function watchCommand(ctx: CommandContext): Promise<void> {
       for (const watch of watches) {
         process.stdout.write(
           `${watch.id}  ${watch.ageHours}h  blocks:${watch.blocks ?? "-"}  ` +
-            `condition:${watch.condition ?? "-"}  ${watch.note}\n`,
+            // The listing already resolved the project, so the cleanup command
+            // it displays must carry it: an operator copying a command from
+            // this output should get one that runs as written (#810).
+            `condition:${watch.condition ?? "-"}  ${watch.note}  (end: omp-conductor watch withdraw ${watch.id} --project ${shellQuote(project.name)})\n`,
+        );
+      }
+      return;
+    }
+
+    if (sub === "withdraw") {
+      assertKnownWatchArgs(ctx, "withdraw", 3);
+      const id = ctx.argv[2];
+      if (id === undefined || id.startsWith("--")) {
+        process.stderr.write("omp-conductor: watch withdraw needs the watch id\n");
+        process.exit(2);
+      }
+      const row = store.decision(id);
+      if (row !== undefined && row.kind !== "watch") {
+        // The same underlying row, but a question answers to a human: the
+        // watch verb must not silently close an operator decision.
+        process.stderr.write(
+          `omp-conductor: watch withdraw targets watches — ${id} is an operator decision; use decision withdraw\n`,
+        );
+        process.exit(2);
+      }
+      const reason = ctx.flag("reason")?.trim();
+      const ok = store.resolveDecision(
+        id,
+        "withdrawn",
+        reason === undefined || reason.length === 0 ? "withdrawn" : reason,
+        Date.now(),
+      );
+      if (!ok) {
+        // A watch that is not open is a different mistake from an id that
+        // never existed, and the operator can only act on one of them.
+        process.stderr.write(
+          `omp-conductor: no open watch ${id} for ${project.name} — it was already withdrawn, or the id is wrong\n`,
         );
+        process.exit(1);
       }
+      process.stdout.write(`watch ${id} withdrawn\n`);
       return;
     }
 
     process.stderr.write(
-      `omp-conductor: unknown watch subcommand "${sub}" — expected add or list\n`,
+      `omp-conductor: unknown watch subcommand "${sub}" — expected add, list or withdraw\n`,
     );
     process.exit(2);
   } finally {

package/src/commands/worker.ts

@@ -2,13 +2,13 @@
  * `worker` — pause/resume/stop one live worker session through the daemon's run-control HTTP endpoints.
  *
  * Moved out of cli.ts's switch by the per-verb module split (#462);
- * only the case wrapper, the injected `ctx` lookups and the imports
- * changed from the original bodies.
+ * the daemon discovery resolves through {@link requireDaemonControl} so a
+ * live systemd-run daemon stays reachable when its pidfile is missing (#811).
  */
 
 import type { CommandContext } from "./context.ts";
 import { findProject, loadConfig } from "../config.ts";
-import { livingDaemon } from "../lifecycle.ts";
+import { requireDaemonControl } from "../lifecycle.ts";
 
 export async function workerCommand(ctx: CommandContext): Promise<void> {
 const sub = ctx.argv[1];
@@ -28,13 +28,12 @@ if (sub === "stop" && (reason === undefined || reason === "" || reason.length >
   process.exit(2);
 }
 const project = findProject(loadConfig(), ctx.projectFlag);
-const daemon = livingDaemon();
-if (daemon === undefined) throw new Error("daemon is not running");
-if (daemon.project !== undefined && daemon.project !== project.name) {
-  throw new Error(
-    `daemon serves project "${daemon.project}", not requested project "${project.name}"`,
-  );
-}
+// The pidfile is authoritative when it names a live process; a missing or
+// stale record falls back to the systemd unit, proved through its own
+// /healthz answer, so a live unit-owned daemon is never reported stopped
+// because the runtime directory was wiped (#811). The refusal chain is
+// shared with `extend` through requireDaemonControl.
+const daemon = await requireDaemonControl(project.name);
 const response = await fetch(
   `http://127.0.0.1:${daemon.port}/runs/${issue}/${sub}`,
   {