omp-conductor 0.18.1 → 0.18.2

package/src/orchestrator-tick.ts

@@ -114,6 +114,7 @@ import {
   type AskResult,
 } from "./ask.ts";
 import { deliverOperatorMessage } from "./reports.ts";
+import { effectiveLabels } from "./routing.ts";
 import { readTelegramToken, resolveProjectTopicId, telegramStateDir } from "./escalate.ts";
 import type { FailureClass, RecoveryAction, RunRecord } from "./types.ts";
 import { dbPath, openStore } from "./store.ts";
@@ -125,7 +126,7 @@ import {
   TO_SPEC_SCHEMA,
 } from "./to-spec.ts";
 import { heldNoticeId } from "./notices.ts";
-import { isActiveArmProof } from "./arm-challenge.ts";
+import { acknowledgeArmReply } from "./arm-challenge.ts";
 
 /** The activation file. Absent means "this is not an orchestrator session". */
 export const TICK_CONFIG_FILE = ".conductor-tick.json";
@@ -639,6 +640,21 @@ function groomingVerdictCounts(records: readonly GroomingRecord[]): string {
   return [...counts.entries()].map(([verdict, count]) => `${verdict} ${count}`).join(", ");
 }
 
+/**
+ * The queue-label inventory read fresh from the tracker on one tick, with the
+ * pending label ops applied exactly as the dispatch pass judges eligibility
+ * (#848). Queue verdicts in the present tense ("empty", "running low") are
+ * only ever drawn from this observation; a dispatch summary alone is dated
+ * history and must never be rendered as the live queue.
+ */
+export interface QueueObservation {
+  /** Open issues carrying the queue label under the *effective* label set —
+   *  the count dispatch would route against on its next pass. */
+  queued: number;
+  /** The instant the tracker observation was made, epoch ms. */
+  observedAt: number;
+}
+
 /**
  * One line telling the orchestrator the routable queue is running dry (#181),
  * or `undefined` when healthy — no dispatch recorded yet, or the routable count
@@ -651,6 +667,12 @@ function groomingVerdictCounts(records: readonly GroomingRecord[]): string {
  * so it is told apart from the mechanical holds: it says "a batch is running",
  * not "the lane cannot move", and counts neither as claimable nor as
  * known-blocked.
+ *
+ * `queue` is the tracker observation the caller made THIS tick (#848). When
+ * present, the queue verdict reads in the present tense from that inventory,
+ * and dispatch-derived counts are only ever dated context. When absent the
+ * tracker could not be read, and this never asserts that the queue is empty:
+ * the dispatch row is rendered explicitly as-of instead.
  */
 export function queueDigestLine(
   summary: DispatchSummary | undefined,
@@ -658,10 +680,30 @@ export function queueDigestLine(
   labelPrefix: string,
   groomBelow: number,
   grooming: readonly GroomingRecord[] = [],
+  queue: QueueObservation | undefined = undefined,
 ): string | undefined {
   if (summary === undefined) return undefined;
+  if (queue !== undefined) {
+    return liveQueueDigestLine(summary, queue, queueLabel, labelPrefix, groomBelow, grooming);
+  }
+  return datedQueueDigestLine(summary, queueLabel, labelPrefix, groomBelow, grooming);
+}
+
+/** The dated rendering: the last dispatch row is the only evidence, so every
+ *  count carries its snapshot date and nothing is asserted as current. */
+function datedQueueDigestLine(
+  summary: DispatchSummary,
+  queueLabel: string,
+  labelPrefix: string,
+  groomBelow: number,
+  grooming: readonly GroomingRecord[],
+): string | undefined {
+  const dated = new Date(summary.completedAt).toISOString();
   if (summary.ready === 0) {
-    return `Queue: empty — nothing carries "${queueLabel}". Groom the backlog (Duty 2): promote or file the next issues, or say in this tick's report why there is nothing to do.`;
+    if (summary.paused === true) {
+      return `Queue: unchecked — the last pass (${dated}) was a hold that counted no queue and admitted nothing; the tracker could not be re-read this tick, so the live queue is NOT claimed empty. Groom only after a fresh read.`;
+    }
+    return `Queue: empty (as of the last dispatch, ${dated}) — nobody carried "${queueLabel}" on that count, and the live tracker was not re-read this tick, so this is a snapshot, not a present-tense claim. Groom the backlog (Duty 2) once a fresh read confirms it.`;
   }
   if (summary.routed === 0) {
     // `ready` counts claimed (in-flight) issues too; route() drops those with a
@@ -678,7 +720,7 @@ export function queueDigestLine(
     const staleLifecycle = summary.holds
       .filter((h) => h.reason === "stale-lifecycle")
       .reduce((n, h) => n + h.count, 0);
-    let line = `Queue: ${summary.ready} ready, 0 spare — ${claimed} in flight`;
+    let line = `As of the last dispatch (${dated}): Queue: ${summary.ready} ready, 0 spare — ${claimed} in flight`;
     if (unroutable > 0) {
       line += `, ${unroutable} unroutable (each unroutable issue needs exactly one "${labelPrefix}<repo>" label)`;
     }
@@ -693,6 +735,94 @@ export function queueDigestLine(
     return line;
   }
   if (summary.routed >= groomBelow) return undefined;
+  return lowQueueTail(summary, groomBelow, grooming, `As of the last dispatch (${dated}): Queue: `);
+}
+
+/** The live rendering: the tracker observation is the queue label inventory,
+ *  the dispatch summary supplies the claimability reading, and the shared
+ *  low-queue diagnostics are composed underneath (#848 review 2). The raw
+ *  carrier count appears only as a present-tense inventory fact — never as
+ *  the grooming threshold, which must be claimability (`summary.routed`, the
+ *  same count the to-spec offer gates on), or parked/in-flight/state-labelled
+ *  carriers would silence a queue that dispatch cannot move. */
+function liveQueueDigestLine(
+  summary: DispatchSummary,
+  queue: QueueObservation,
+  queueLabel: string,
+  labelPrefix: string,
+  groomBelow: number,
+  grooming: readonly GroomingRecord[],
+): string | undefined {
+  const queued = queue.queued;
+  const observed = new Date(queue.observedAt).toISOString();
+  // The present-tense empty verdict is the tracker's own word: nothing open
+  // carries the queue label right now. No dispatch snapshot may produce a
+  // live "empty" claim — that is the whole defect (#848).
+  if (queued === 0) {
+    return (
+      `Queue: empty — nothing open carries "${queueLabel}" right now (tracker ${observed}). ` +
+      "Groom the backlog (Duty 2): promote or file the next issues, or say in this tick's report " +
+      "why there is nothing to do."
+    );
+  }
+  // The grooming threshold is claimability — summary.routed — never raw
+  // carrier volume. Four in-flight/parked/unroutable carriers must not
+  // suppress the low-claimable signal, because the to-spec offer gates on
+  // the very same routed count and the two would split.
+  if (summary.routed >= groomBelow) return undefined;
+  const dated = new Date(summary.completedAt).toISOString();
+  const inventory = `Queue: ${queued} open issue${queued === 1 ? "" : "s"} carry "${queueLabel}" right now (tracker ${observed}); `;
+  if (summary.routed === 0) {
+    // Dispatch's own claimability read: `ready` counts claimed (in-flight)
+    // issues too, so "0 routable" must not blanket-blame missing `repo:`
+    // labels (#228), and a residual lifecycle label is Duty 1 reconciliation
+    // work, not spare depth (#611).
+    if (summary.paused === true) {
+      return (
+        inventory +
+        `the last dispatch (${dated}) was a hold that admitted nothing — the queued issues above are the work that resumes when claiming reopens.`
+      );
+    }
+    const claimed = summary.claimed ?? 0;
+    let line = inventory + `at the last dispatch (${dated}) ${summary.ready} ready, 0 spare — ${claimed} in flight`;
+    const unroutable = summary.holds
+      .filter((h) => h.reason.startsWith("unroutable:"))
+      .reduce((n, h) => n + h.count, 0);
+    const staleLifecycle = summary.holds
+      .filter((h) => h.reason === "stale-lifecycle")
+      .reduce((n, h) => n + h.count, 0);
+    if (unroutable > 0) {
+      line += `, ${unroutable} unroutable (each unroutable issue needs exactly one "${labelPrefix}<repo>" label)`;
+    }
+    if (staleLifecycle > 0) {
+      line += `, ${staleLifecycle} with a residual lifecycle label (Duty 1: newest run terminal — reconcile the stale agent:in-progress/blocked/failed state)`;
+    }
+    if (unroutable === 0 && staleLifecycle === 0) {
+      line += `. Spare depth is what dispatch can actually claim: groom the backlog (Duty 2) before the live runs settle.`;
+    } else {
+      line += ".";
+    }
+    return line;
+  }
+  // routed > 0 below the trigger: the live inventory leads, then the same
+  // low-queue diagnostics the dated path ships — the claimable/known-blocked
+  // split, in-flight to-spec batches, the considered backlog and this pass's
+  // holds (#735, #777, #679) — so a tracker read never hides them.
+  return inventory + lowQueueTail(summary, groomBelow, grooming, "");
+}
+
+/** The shared low-queue diagnostic tail (#735/#777/#679): the routable-count →
+ *  claimable/known-blocked split, in-flight to-spec batches, the considered
+ *  backlog and this pass's holds. `lead` is the sentence opener the caller
+ *  chooses — the dated path opens with the dispatch timestamp and "Queue:",
+ *  the live path with its tracker inventory (#848 review 2). Sharing one tail
+ *  means a tracker read can never hide these distinctions. */
+function lowQueueTail(
+  summary: DispatchSummary,
+  groomBelow: number,
+  grooming: readonly GroomingRecord[],
+  lead: string,
+): string {
   // The durable per-issue verdicts, not this pass's one-shot hold groups: a
   // lane-blocked runway must read as "cannot move" even after a restart, and
   // the orchestrator's own prior verdicts (#679) must not be re-derived.
@@ -708,22 +838,22 @@ export function queueDigestLine(
   const claimable = Math.max(0, summary.routed - knownBlocked.length);
   const inFlightNames = inFlight.map((r) => `#${r.issue}`).join(", ");
   const busy = inFlight.length === 0 ? "" : `, ${inFlight.length} in a to-spec batch (${inFlightNames})`;
-  let line: string;
+  let tail: string;
   if (knownBlocked.length > 0 && claimable === 0) {
-    line =
-      `Queue: running low — ${summary.routed} routable candidate(s), all known-blocked ` +
+    tail =
+      `${lead}running low — ${summary.routed} routable candidate(s), all known-blocked ` +
       `(${groomingGroupCounts(knownBlocked)})${busy} — no grooming moves them; the holds clear by themselves` +
       `${inFlight.length === 0 ? "" : " and the to-spec batch's results land when it settles"}.`;
   } else if (knownBlocked.length > 0 || inFlight.length > 0) {
-    line =
-      `Queue: running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}: ` +
+    tail =
+      `${lead}running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}: ` +
       `${claimable} claimable, ${knownBlocked.length} known-blocked (${groomingGroupCounts(knownBlocked)})` +
       `${busy} — groom only the claimable.`;
   } else {
-    line = `Queue: running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}.`;
+    tail = `${lead}running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}.`;
   }
   if (considered.length > 0) {
-    line +=
+    tail +=
       ` Backlog already-considered: ${considered.length} (${groomingVerdictCounts(considered)}) — ` +
       `promote the promotable or groom new issues, never re-groom these.`;
   }
@@ -734,9 +864,9 @@ export function queueDigestLine(
         return `${h.reason} ${h.count}${first === undefined ? "" : ` (${first})`}`;
       })
       .join(", ");
-    line += ` All held: ${held}.`;
+    tail += ` All held: ${held}.`;
   }
-  return line;
+  return tail;
 }
 
 // ================================================================ to-spec
@@ -1094,21 +1224,28 @@ export async function offerToSpecLaunch(input: {
   active: readonly { issue: number }[];
   project: ProjectConfig;
   trackerSeam: ToSpecTrackerSeam | undefined;
+  /** An open-issue snapshot this tick already read from the tracker. Shared
+   *  with the queue digest so one tick cannot describe two queues (#848);
+   *  absent when that read failed, in which case the launch retries its own
+   *  read and fails closed on the same terms as before. */
+  issues?: readonly ReadyIssue[];
   now: number;
 }): Promise<ToSpecLaunchBlock | undefined> {
   if (input.summary === undefined) return undefined;
   if (input.summary.routed >= input.groomBelow) return undefined;
   const seam = input.trackerSeam;
   if (seam === undefined) return undefined;
-  let issues: ReadyIssue[];
-  try {
-    issues = await seam.listOpenIssues(input.project);
-  } catch {
-    // No authoritative snapshot, no launch: a batch offered without one would
-    // make the model the selector, which is exactly the defect this slice
-    // removes. The queue digest still names the grooming duty; the next tick
-    // retries the read.
-    return undefined;
+  let issues = input.issues;
+  if (issues === undefined) {
+    try {
+      issues = await seam.listOpenIssues(input.project);
+    } catch {
+      // No authoritative snapshot, no launch: a batch offered without one would
+      // make the model the selector, which is exactly the defect this slice
+      // removes. The queue digest still names the grooming duty; the next tick
+      // retries the read.
+      return undefined;
+    }
   }
   const views = toSpecPoolFromSnapshot(issues, input.project);
   const groomingByIssue = new Map(input.grooming.map((row) => [row.issue, row]));
@@ -3224,12 +3361,59 @@ async function tick(
           // so the resolved name is in hand and an un-named lookup would refuse
           // to guess on a host with a second project.
           const project = findProject(loadConfig(), scope.projectName);
+          const groomBelow = project.groomBelow ?? DEFAULT_GROOM_BELOW;
+          const dispatch = frictionStore.latestDispatch(scope.projectName);
+          const grooming = store.groomingVerdicts(projectName);
+          // #848: "the queue is empty / running dry" is the tracker's word, not
+          // the last dispatch pass's echo. One open-issue snapshot per tick,
+          // read live through the same authoritative tracker surface the
+          // to-spec launch uses, overlaid with the label_ops projection
+          // exactly as the dispatch pass judges eligibility — so a promotion,
+          // unblock or projection write after the last dispatch pass is
+          // visible on the very next tick even while a drain holds claiming.
+          // The digest consumes the overlay as the live inventory; the to-spec
+          // offer shares the same raw snapshot so one tick cannot describe two
+          // queues. If the tracker read fails, the digest falls back to
+          // explicitly dated wording (never a present-tense empty claim),
+          // and the offer retries its own read exactly as it did before.
+          //
+          // The read is made only for dispatch rows the digest could render:
+          // a healthy row (routed at/above the grooming threshold) emits no
+          // queue line at all, so no freshness check is spent on it and no
+          // stale claim can leak from it. A zero-ready row (or any row below
+          // the trigger) is exactly where the old wording lied, so every such
+          // tick reads the live queue.
+          const needsQueueRead =
+            dispatch !== undefined &&
+            (dispatch.ready === 0 || dispatch.routed === 0 || dispatch.routed < groomBelow);
+          let queueObservation: QueueObservation | undefined;
+          let openSnapshot: readonly ReadyIssue[] | undefined;
+          if (toSpecTrackerSeam !== undefined && needsQueueRead) {
+            try {
+              const open = await toSpecTrackerSeam.listOpenIssues(project);
+              openSnapshot = open;
+              const effective = open.map((issue) => {
+                const pending = store.pendingLabelOpsFor(projectName, issue.number);
+                return pending.length === 0
+                  ? issue
+                  : { ...issue, labels: effectiveLabels(issue.labels, pending) };
+              });
+              queueObservation = {
+                queued: effective.filter((issue) => issue.labels.includes(project.queueLabel)).length,
+                observedAt: now,
+              };
+            } catch {
+              // No current-queue evidence this tick: the digest below renders
+              // the dispatch row as dated history instead of claiming empty.
+            }
+          }
           const queue = queueDigestLine(
-            frictionStore.latestDispatch(scope.projectName),
+            dispatch,
             project.queueLabel,
             project.routing.labelPrefix,
-            project.groomBelow ?? DEFAULT_GROOM_BELOW,
-            store.groomingVerdicts(projectName),
+            groomBelow,
+            grooming,
+            queueObservation,
           );
           if (queue !== undefined) content = `${content}\n${queue}`;
           // #777: the mechanical to-spec launch boundary. The queue digest is
@@ -3244,10 +3428,11 @@ async function tick(
           // Every tick owns its authorization fresh — the clears above ran
           // before the reads, so the offer below can only mint for THIS tick.
           const launch = await offerToSpecLaunch({
-            summary: frictionStore.latestDispatch(scope.projectName),
-            groomBelow: project.groomBelow ?? DEFAULT_GROOM_BELOW,
-            grooming: store.groomingVerdicts(projectName),
+            summary: dispatch,
+            groomBelow,
+            grooming,
             active: store.activeRuns(projectName),
+            issues: openSnapshot,
             project,
             trackerSeam: toSpecTrackerSeam,
             now,
@@ -4033,22 +4218,25 @@ export default function orchestratorTickExtension(
         }
         return;
       }
-      // The reply to an arming challenge lands here as an ordinary user turn. It
-      // must reach the transcript exactly as sent — the host's transcript scan
-      // (`armTicks`) is the backend proof, so it is left untouched — while the
-      // model gets a trusted, machine-readable steer about it, so it stops
-      // ad-libbing pairing-safety prose at a bare `FLEET-…` token (conductor
-      // #415). The classification derives from persisted authenticated
-      // pending-challenge state (hash + expiry, keyed by this project), never
-      // from the `FLEET-` prefix, so an unsolicited lookalike that matches no
-      // active challenge stays inert.
+      // The reply to an arming challenge lands here as an ordinary user turn.
+      // This adapter — not the model, and not any transcript scan — is the
+      // sole producer of the arming acknowledgement: it classifies the turn
+      // against persisted authenticated challenge state and, on a match,
+      // atomically records the challenge-id-specific acknowledgement the
+      // host-side `arm` waits on (conductor #614), all before normal model
+      // handling. The classification derives from the pending challenge (hash
+      // + expiry, keyed by this project), never from the `FLEET-` prefix, so
+      // an unsolicited lookalike that matches no active challenge stays inert
+      // and model behaviour cannot determine whether the host becomes armed.
+      // The turn itself still reaches the transcript exactly as sent, with the
+      // same trusted machine-readable steer as before (#415).
       if (message.role === "user" && message.synthetic !== true && message.attribution !== "agent") {
         const replyText =
           message.content
             ?.filter((part) => part.type === "text" && typeof part.text === "string")
             .map((part) => part.text as string)
             .join(" ") ?? "";
-        const proof = isActiveArmProof(configuredProject, replyText, Date.now());
+        const proof = acknowledgeArmReply(configuredProject, replyText, Date.now());
         if (session.activeLocalTick !== undefined) {
           session.activeLocalTick.humanWaiting = true;
           if (proof) session.activeLocalTick.armingProof = true;

package/src/session-host.ts

@@ -21,7 +21,6 @@
 
 import { connect } from "node:net";
 
-import { identityMismatch } from "./host.ts";
 import { createLocalSession, disposeSession, type AgentSessionLike } from "./omp.ts";
 import type { GraphToolsObservation } from "./types.ts";
 import type { GateShape, ReleaseBlockContext } from "./release-policy.ts";
@@ -36,16 +35,6 @@ export interface SessionHostSpec {
   socket: string;
   cwd: string;
   role: SessionRole;
-  /**
-   * The kernel identity this session was launched under (#798): the uid/gid
-   * setpriv dropped to before this process started. The child asserts
-   * `process.getuid()/getgid()` against it as its first act, and refuses to
-   * build a session when they differ — a worker session whose kernel identity
-   * is not the one its parent established must not run worker code. Absent,
-   * the session runs as the daemon's own uid, which is what every
-   * non-worker surface (orchestrator, tests) wants.
-   */
-  identity?: { uid: number; gid: number };
   sessionDir?: string;
   model?: string;
   resume?: boolean;
@@ -213,43 +202,20 @@ export interface SessionHostDeps {
  * peer dependency still reads as a deployment mistake rather than as an
  * unexplained child exit.
  *
- * Returns `false` when the session refused to start because the identity it
- * was launched for does not match the kernel identity this process actually
- * runs under — that refusal is the fail-closed arm of the worker boundary,
- * and the caller turns it into a non-zero exit so nothing downstream can read
- * it as a clean session.
+ * Always resolves `true` now that the worker-identity refusal is gone (#894):
+ * the boolean return survives so the entry point's exit-code contract keeps
+ * its shape for any wrapper that learned it.
  */
 export async function runSessionHost(
   spec: SessionHostSpec,
   deps: SessionHostDeps = { createSession: createLocalSession },
 ): Promise<boolean> {
-
   const socket = connect(spec.socket);
   socket.setNoDelay(true);
   const send = (message: HostToParent): void => {
     if (!socket.writableEnded) socket.write(encodeFrame(message));
   };
 
-  // The kernel identity check comes as early as there is a socket to report
-  // over and before the harness (`createSession`) has run a single byte of
-  // worker-controlled code. A child whose uid/gid are not the ones its parent
-  // launched it for proves the boundary did not hold — the daemon would be
-  // supervising a session that is not what it thinks it is.
-  const violation = identityMismatch(spec.identity);
-  if (violation !== undefined) {
-    send({ t: "start-error", message: violation });
-    // The frame must reach the parent before this process exits: `process.exit`
-    // does not flush the socket, and a parent that only observes the exit used
-    // to report a bare exit code instead of the child's own words. The parent
-    // resolves the run as failed with no live child — fail closed.
-    await new Promise<void>((resolve) => {
-      socket.once("finish", () => resolve());
-      socket.once("error", () => resolve());
-      socket.end();
-    });
-    return false;
-  }
-
   const { promise: connected, resolve: onConnect, reject: onConnectFail } = Promise.withResolvers<void>();
   socket.once("connect", () => {
     onConnect();
@@ -422,9 +388,8 @@ if (import.meta.main) {
   // spec that will not parse fails loudly here rather than as a silent hang.
   const spec = specFromArgv(process.argv);
   const started = await runSessionHost(spec);
-  // A refused start — the launched identity did not match this process's
-  // kernel identity — exits 91 (the same code the rejected cgroup-boundary
-  // launcher used) so an operator reading `ps` or the exit status sees a
-  // boundary refusal, never a clean exit.
+  // 91 was the worker-identity boundary refusal; the code stays reserved (and
+  // unreachable — runSessionHost always resolves true since #894) so nothing
+  // that learned to read it can mistake a future refusal for a clean exit.
   process.exit(started ? 0 : 91);
 }

package/src/setup-host.ts

@@ -13,7 +13,6 @@ import {
 } from "./fleet.ts";
 import {
   harnessBindingProblem,
-  workerHarnessImportProblem,
   WORKER_ACCOUNT,
   WORKER_HARNESS_DIR,
   WORKER_HARNESS_NODE_MODULES,
@@ -48,6 +47,16 @@ export const DEFAULT_TICK_INTERVAL_SECONDS = 900;
 export const STAGED_SERVICE_NAME = "omp-conductor.service";
 export const SYSTEMD_UNIT_DIR = "/etc/systemd/system";
 
+/**
+ * The system directories every rendered service PATH ends with, in systemd's
+ * own default order: git, gh and the other tools the fleet spawns by name
+ * live here on every target host. The service PATH as a whole is canonical
+ * (#879) — these directories plus the resolved fleet-binary directories — so
+ * `setup host` stages and `doctor` compares one value, whichever process
+ * renders it and whatever the invoking shell happened to carry.
+ */
+export const SERVICE_SYSTEM_PATH = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin";
+
 /**
  * The one recovery unit every fleet unit's `OnFailure=` points at (#485).
  *
@@ -476,9 +485,18 @@ export function defaultServiceRuntime(
   const globalCli = Bun.which("omp-conductor");
   const herdr = Bun.which("herdr");
   const loginShell = userInfo().shell;
-  const pathParts = [dirname(bun), ...(process.env["PATH"] ?? "").split(":")].filter(
-    (value, index, all) => value.length > 0 && all.indexOf(value) === index,
-  );
+  // #879: the staged PATH is a canonical host-runtime value — the directories
+  // of the binaries this runtime resolved plus SERVICE_SYSTEM_PATH — never the
+  // invoking shell's PATH. Caller entries (/root/bin, /opt/puppetlabs/bin, …)
+  // once leaked into the staged units, so `doctor` re-deriving the render in
+  // its own process reported PATH drift against byte-identical installs, and
+  // rerunning setup reproduced the finding its own fix text prescribes away.
+  const pathParts = [
+    dirname(bun),
+    ...(globalCli === null ? [] : [dirname(globalCli)]),
+    ...(herdr === null ? [] : [dirname(herdr)]),
+    ...SERVICE_SYSTEM_PATH.split(":"),
+  ].filter((value, index, all) => value.length > 0 && all.indexOf(value) === index);
   return {
     username: userInfo().username,
     home,
@@ -1592,12 +1610,11 @@ export function defaultIdentityProbes(runtime: { home: string; bun?: string }):
     workerGhConfigCurrent: existsSync(join(WORKER_HOME_DIR, ".config", "gh", "hosts.yml")),
     gitconfigPresent: existsSync(join(runtime.home, ".gitconfig")),
     workerGitconfigCurrent: existsSync(join(WORKER_HOME_DIR, ".gitconfig")),
-    // Setup currentness is the effective import contract, not just mount
-    // metadata: after the inode check passes, execute the same anchored loader
-    // with --no-install through the real HOME/setpriv transition. A mounted
-    // tree whose Bun resolution still reaches the worker cache is pending.
-    harnessProblem: () =>
-      harnessBindingProblem() ?? workerHarnessImportProblem({ bun: runtime.bun ?? process.execPath }),
+    // Setup currentness is the binding's inode identity (#828). The old
+    // second half — executing the loader through the worker HOME/setpriv
+    // transition — retired with the runtime identity (#894): sessions launch
+    // under the fleet account, so there is no transition left to probe.
+    harnessProblem: () => harnessBindingProblem(),
     // The bound tree's reach (#828 review), hardened to the directory's whole
     // shape (#831): the verdict is a live ownership/access check read fresh on
     // every planning run — root-owned, group the worker's live primary gid,