omp-conductor 0.19.1 → 0.19.3

package/src/companion-view.ts

@@ -0,0 +1,81 @@
+/**
+ * The composed view the recovery companion pane renders (#994).
+ *
+ * Two defects produced this module, and they were one decision:
+ *
+ * - The pane re-forked `watch -c -n 60 '<one-shot>'`, and every 60 seconds the
+ *   foreground-process transition made herdr repaint it — a visible flash. The
+ *   board pane, one long-lived process holding its terminal, never flashed. So
+ *   the fix is a process that persists between renders, which is what
+ *   {@link companionFrame} exists to feed.
+ * - It rendered `decision list` alone, which on this fleet meant a whole pane
+ *   refreshing forever to display `no open decisions` while nine watches, four
+ *   of them `condition:met`, were invisible in it.
+ *
+ * The split is deliberate and this is the only place it is composed: operator
+ * decisions are rare and already interrupt through Telegram when they matter,
+ * while watches are the live state a glanceable pane is *for* — and a met
+ * condition is the one row in either list that wants eyes immediately.
+ *
+ * An empty section is omitted entirely rather than printed with a placeholder.
+ * A pane showing nothing is honest; a pane showing `no open decisions` forever
+ * is the noise the operator objected to.
+ *
+ * `decision list` and `watch list` keep their own contracts untouched — this is
+ * the pane's composition, not those commands' output.
+ */
+
+import type { DecisionRecord } from "./types.ts";
+
+/** The marker that makes an actionable watch findable at a glance. Uppercase
+ *  rather than coloured: the pane inherits whatever palette the terminal has,
+ *  and the flash this module replaced was chased through an ANSI hypothesis. */
+export const MET_MARKER = "[ACT NOW]";
+
+/** The single line shown when neither list has anything. Quiet, and still
+ *  proof the pane is alive rather than blank because something died. */
+export const IDLE_LINE = "nothing open";
+
+/** One row, reduced to what the pane shows. */
+function row(record: DecisionRecord, now: number): string {
+  const ageHours = Math.max(0, Math.round((now - record.askedAt) / 3_600_000));
+  const condition =
+    record.condition === undefined ? "-" : record.conditionMetAt === undefined ? "pending" : "met";
+  const met = condition === "met" ? `${MET_MARKER} ` : "";
+  return `  ${met}${record.id}  ${String(ageHours)}h  blocks:${record.blocks ?? "-"}  condition:${condition}  ${record.question}`;
+}
+
+/**
+ * The frame to draw, as lines.
+ *
+ * Decisions above watches, because only a decision wants an answer. Met
+ * conditions are hoisted to the top of the watch section: the whole reason to
+ * render watches at all is that one of them may be actionable, and a reader who
+ * has to scan nine rows for the one that matters is reading a log, not a board.
+ */
+export function companionFrame(
+  open: readonly DecisionRecord[],
+  now: number = Date.now(),
+): string[] {
+  const decisions = open.filter((d) => d.kind !== "watch");
+  const watches = open.filter((d) => d.kind === "watch");
+  const lines: string[] = [];
+
+  if (decisions.length > 0) {
+    lines.push(`operator decisions (${String(decisions.length)}) — these want an answer`);
+    for (const decision of decisions) lines.push(row(decision, now));
+  }
+
+  if (watches.length > 0) {
+    const met = watches.filter((w) => w.conditionMetAt !== undefined);
+    const pending = watches.filter((w) => w.conditionMetAt === undefined);
+    if (lines.length > 0) lines.push("");
+    lines.push(
+      `watches (${String(watches.length)}) — no answer needed` +
+        (met.length === 0 ? "" : `, ${String(met.length)} to act on now`),
+    );
+    for (const watch of [...met, ...pending]) lines.push(row(watch, now));
+  }
+
+  return lines.length === 0 ? [IDLE_LINE] : lines;
+}

package/src/config-schema.ts

@@ -397,7 +397,13 @@ const projectSchema = z
       })
       .strict(),
     queueLabel: z.string().min(1, "must be a non-empty string — it is the human sign-off gate"),
-    groomBelow: z.unknown().optional(),
+    // The grooming trigger (#988): an integer ≥ 1, or the literal "always" —
+    // groom on demand every tick while ungroomed candidates remain. Unlike the
+    // opaque model selectors below, this field's usable vocabulary is closed,
+    // so the schema states it and a wrong value fails the load with an
+    // authored line instead of silently degrading the fleet's grooming duty
+    // to the default.
+    groomBelow: z.union([z.number().int().min(1), z.literal("always")]).optional(),
     stateLabels: stateLabelsSchema.optional(),
     routing: routingSchema.optional(),
     caps: capsSchema.optional(),

package/src/config.ts

@@ -847,6 +847,9 @@ function clauseFor(rel: readonly PropertyKey[], issue: {
   const pathStr = dottedPath(rel);
   const found = (at?: readonly PropertyKey[]): string => FOUND(rawAt(root, at ?? fullPath));
 
+  if (rel.length === 1 && rel[0] === "groomBelow") {
+    return `groomBelow must be an integer ≥ 1 or the literal "always", found ${found()}`;
+  }
   if (rel.length === 1 && rel[0] === "releasePolicy") {
     return `releasePolicy must be an object mapping release shapes (${RELEASE_SHAPE_LIST}) to ${AUTHORITY_HOLDER_LIST}, or the legacy ${LEGACY_RELEASE_POLICY_LIST}, found ${found()}`;
   }
@@ -1195,11 +1198,11 @@ function finalizeProject(
   const label = `project "${name}"`;
   const trackerRepo = ((p["tracker"] as Raw | undefined)?.["repo"]) as string;
 
+  // The zod union already enforced `integer ≥ 1 | "always"`; this only
+  // narrows the type for the assembled ProjectConfig (#988).
   const rawGroomBelow = p["groomBelow"];
   const groomBelow =
-    typeof rawGroomBelow === "number" && Number.isInteger(rawGroomBelow) && rawGroomBelow >= 1
-      ? rawGroomBelow
-      : undefined;
+    rawGroomBelow === "always" ? "always" : typeof rawGroomBelow === "number" ? rawGroomBelow : undefined;
 
   const rawRouting = p["routing"] as Raw | undefined;
   const rawPrefix = rawRouting?.["labelPrefix"];

package/src/daemon.ts

@@ -38,7 +38,12 @@ import { pendingCodeGraph, probeCodeGraph, type CodeGraphHealth } from "./graph-
 import { graphHint } from "./graph.ts";
 import { hostConstraintsNotice } from "./host.ts";
 import { acquireOnceLease, healthCheck, livingDaemon, probeUnit, SYSTEMD_UNIT } from "./lifecycle.ts";
-import { requestImmediateTick, resolveTickConfigCwd, STALL_MARKER_FILE } from "./orchestrator-tick.ts";
+import {
+  readTickRequestReason,
+  requestImmediateTick,
+  resolveTickConfigCwd,
+  STALL_MARKER_FILE,
+} from "./orchestrator-tick.ts";
 import { SPEND_SAMPLE_ROWS, SPEND_SAMPLE_RUNS, runDoctor } from "./doctor.ts";
 import { judgeSpendTelemetry, type SpendTelemetryVerdict } from "./spend-telemetry.ts";
 import {
@@ -62,6 +67,7 @@ import {
   herdrPaneOmpStarts,
   openWorkerPane,
   reconcileWorkerPanes,
+  PANE_REATTEMPT_MAX,
   releaseOrphanedWorkerPane,
   releaseWorkerPane,
   reportWorkerPaneState,
@@ -1424,11 +1430,20 @@ export interface WorkerControlRegistry {
     runId: string,
     onPhase?: (phase: WorkerPausePhase) => void,
   ): WorkerControlSlot;
-  pause(project: string, issue: number): Promise<WorkerControlResult>;
+  /** `source` names who asked (board/cli/dashboard) — recorded as pause
+   *  provenance so "who paused this and when" is answerable later (#997). */
+  pause(project: string, issue: number, source: string): Promise<WorkerControlResult>;
   resume(project: string, issue: number): WorkerControlResult;
   stop(project: string, issue: number, reason: string): Promise<WorkerControlResult>;
-  /** Live runs whose phase is not `running` — what /healthz and the board show. */
-  snapshot(project: string): { issue: number; runId: string; phase: WorkerPausePhase }[];
+  /** Live runs whose phase is not `running` — what /healthz and the board
+   *  show — each carrying its pause provenance when one was recorded (#997). */
+  snapshot(project: string): {
+    issue: number;
+    runId: string;
+    phase: WorkerPausePhase;
+    source?: string;
+    pausedAtMs?: number;
+  }[];
 }
 
 /** Authoritative controls for sessions owned by this daemon process. */
@@ -1442,6 +1457,8 @@ export function createWorkerControlRegistry(): WorkerControlRegistry {
     stopError?: string;
     finished: PromiseWithResolvers<void>;
     onPhase?: (phase: WorkerPausePhase) => void;
+    /** Who asked for the live pause, and when — cleared on resume (#997). */
+    pausedBy?: { source: string; at: number };
   }
 
   const active = new Map<string, Entry>();
@@ -1476,12 +1493,13 @@ export function createWorkerControlRegistry(): WorkerControlRegistry {
         },
       };
     },
-    async pause(project, issue) {
+    async pause(project, issue, source) {
       const entry = active.get(key(project, issue));
       if (entry?.control === undefined) return { kind: "not-active" };
       try {
         await entry.control.pause();
         const phase = entry.control.phase();
+        entry.pausedBy = { source, at: Date.now() };
         entry.onPhase?.(phase);
         return { kind: "ok", runId: entry.runId, phase };
       } catch (err) {
@@ -1498,6 +1516,7 @@ export function createWorkerControlRegistry(): WorkerControlRegistry {
       try {
         entry.control.resume();
         const phase = entry.control.phase();
+        delete entry.pausedBy;
         entry.onPhase?.(phase);
         return { kind: "ok", runId: entry.runId, phase };
       } catch (err) {
@@ -1533,11 +1552,25 @@ export function createWorkerControlRegistry(): WorkerControlRegistry {
       return { kind: "stopped", runId: entry.runId, reason: entry.stopReason! };
     },
     snapshot(project) {
-      const workers: { issue: number; runId: string; phase: WorkerPausePhase }[] = [];
+      const workers: {
+        issue: number;
+        runId: string;
+        phase: WorkerPausePhase;
+        source?: string;
+        pausedAtMs?: number;
+      }[] = [];
       for (const entry of active.values()) {
         if (entry.project !== project || entry.control === undefined) continue;
         const phase = entry.control.phase();
-        if (phase !== "running") workers.push({ issue: entry.issue, runId: entry.runId, phase });
+        if (phase === "running") continue;
+        workers.push({
+          issue: entry.issue,
+          runId: entry.runId,
+          phase,
+          ...(entry.pausedBy === undefined
+            ? {}
+            : { source: entry.pausedBy.source, pausedAtMs: entry.pausedBy.at }),
+        });
       }
       return workers;
     },
@@ -2804,6 +2837,7 @@ export async function handleIssue(
       log(`#${issue} stopped by operator on attempt ${attempt}: ${result.stoppedReason}`);
     } else if (state === "blocked") {
       swapLabel(store, project.name, issue, inProgress, project.stateLabels.blocked);
+      wakeOrchestratorForBlockedRun(project.name, issue);
       await safeEscalate(d, {
         tier: 1,
         project: project.name,
@@ -3035,8 +3069,27 @@ export async function handleIssue(
  * releasing one whose run is not live; the authoritative child is never
  * signalled, and no pane is ever closed.
  */
+/**
+ * Pane re-establishment attempts spent per run, for this daemon process only
+ * (#998).
+ *
+ * Deliberately in memory rather than on the run row: a restart is exactly the
+ * event that makes another attempt worth making (Herdr came back), so a fresh
+ * process legitimately gets a fresh budget, and giving up never marks a run
+ * permanently unrepresentable. Pruned against the live set on every pass, so it
+ * cannot outgrow the fleet.
+ */
+const paneAttemptsSpent = new Map<string, number>();
+
 function reconcilePanes(d: Deps, project: string, log: (message: string) => void): void {
   const live = d.store.liveRuns(project);
+  const liveKeys = new Set(live.map((run) => `${project}\u0000${run.id}`));
+  for (const key of [...paneAttemptsSpent.keys()]) {
+    if (key.startsWith(`${project}\u0000`) && !liveKeys.has(key)) paneAttemptsSpent.delete(key);
+  }
+  const attempts = new Map(
+    live.map((run) => [run.id, paneAttemptsSpent.get(`${project}\u0000${run.id}`) ?? 0]),
+  );
   const result = reconcileWorkerPanes(
     live.map((run) => ({
       runId: run.id,
@@ -3048,6 +3101,8 @@ function reconcilePanes(d: Deps, project: string, log: (message: string) => void
       ...(run.paneLabel === undefined ? {} : { paneLabel: run.paneLabel }),
       ...(run.sessionFile === undefined ? {} : { sessionFile: run.sessionFile }),
     })),
+    {},
+    attempts,
   );
   if (!result.ok) {
     // An unreadable workspace is not evidence that anything is stale, so nothing
@@ -3068,9 +3123,33 @@ function reconcilePanes(d: Deps, project: string, log: (message: string) => void
         });
         log(`#${runIssue(live, outcome.runId)} herdr pane re-associated as ${outcome.paneId} after a restart`);
         break;
-      case "untracked":
+      case "untracked": {
         d.store.updateRun(outcome.runId, { paneId: null, paneLabel: null, paneUnavailable: outcome.reason });
-        log(`#${runIssue(live, outcome.runId)} has no herdr pane: ${outcome.reason}`);
+        if (outcome.attempted !== true) {
+          // Cost no attempt (no recorded pid): say so every pass, as before.
+          log(`#${runIssue(live, outcome.runId)} has no herdr pane: ${outcome.reason}`);
+          break;
+        }
+        // #998: a terminal refusing to split will refuse the next one too, and
+        // each retry made the pile worse — spend the whole budget at once.
+        const key = `${project}\u0000${outcome.runId}`;
+        const spent = outcome.reason.includes("pane_split_failed")
+          ? PANE_REATTEMPT_MAX
+          : (paneAttemptsSpent.get(key) ?? 0) + 1;
+        paneAttemptsSpent.set(key, spent);
+        // Once per run, at the moment the budget runs out — not once per pass.
+        // Four identical lines a minute for #986 is what made the real cause
+        // (a leaked pane per attempt) hard to see on 2026-08-23.
+        log(
+          spent >= PANE_REATTEMPT_MAX
+            ? `#${runIssue(live, outcome.runId)} has no herdr pane after ${spent} attempt(s), not retrying: ${outcome.reason}`
+            : `#${runIssue(live, outcome.runId)} has no herdr pane (attempt ${spent}/${PANE_REATTEMPT_MAX}): ${outcome.reason}`,
+        );
+        break;
+      }
+      case "attempts-exhausted":
+        // Already reported when the budget ran out; the run keeps working with
+        // no pane, and a later restart gets a fresh budget.
         break;
       case "stale-released":
         log(`released stale herdr pane ${outcome.paneId} (run ${outcome.runId || "unidentified"} is not live)`);
@@ -4128,6 +4207,7 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
       log(`#${issue} review round ${revision.round} stopped by operator: ${result.stoppedReason}`);
     } else if (state === "blocked") {
       swapLabel(store, project.name, issue, inProgress, project.stateLabels.blocked);
+      wakeOrchestratorForBlockedRun(project.name, issue);
       await safeEscalate(d, {
         tier: 1,
         project: project.name,
@@ -5060,6 +5140,53 @@ export function wakeOrchestratorForMetConditions(
 }
 
 
+/**
+ * Wake the orchestrator because a worker stopped to ask a question (#990).
+ *
+ * `question` is the third-largest class in this ledger — 58 of 839 runs — and
+ * every one of them is a parked worker holding a slot until someone reads the
+ * question. Nothing woke the orchestrator for it: the only wake was a decision
+ * condition being met, so on a fleet with a 1800s heartbeat a tier-1 question
+ * whose answer is one comment could sit unread for half an hour.
+ *
+ * Deliberately narrow. Only the blocked path wakes: a failed run, a cap kill
+ * and a clean settle are the next scheduled tick's business, and waking on
+ * every terminal state turns the heartbeat into a busy loop — which would be a
+ * worse fleet than the one that waits.
+ *
+ * Debounced by the marker itself rather than by a counter: an unconsumed
+ * request already asks for exactly the wake this call wants, so three workers
+ * blocking in one pass write one request and the *first* question's number
+ * survives as the reason. Best effort throughout — a marker that cannot be
+ * written is logged, and the settlement it belongs to is never affected.
+ */
+export function wakeOrchestratorForBlockedRun(
+  projectName: string,
+  issue: number,
+  writeLog: (line: string) => void = log,
+): void {
+  const tickCwd = resolveTickConfigCwd(projectName);
+  if (tickCwd === undefined) {
+    writeLog(
+      `#${issue} is blocked but no tick config cwd — the question waits for the next heartbeat`,
+    );
+    return;
+  }
+  const pending = readTickRequestReason(tickCwd);
+  if (pending !== undefined) {
+    writeLog(`#${issue} is blocked; a tick request is already pending (${pending})`);
+    return;
+  }
+  const reason = `tier1-question #${issue}`;
+  if (requestImmediateTick(tickCwd, reason)) {
+    writeLog(`requested immediate tick at ${tickCwd}: ${reason}`);
+  } else {
+    writeLog(
+      `could not write tick request under ${tickCwd}; #${issue}'s question waits for the next heartbeat`,
+    );
+  }
+}
+
 /**
  * The first-tick verification for a fleet-initiated upgrade (#486).
  *
@@ -5803,8 +5930,9 @@ export interface DaemonHealthSnapshot {
   turnOverrides: TurnOverride[];
   dispatch?: DispatchSummary;
   codeGraph?: CodeGraphHealth;
-  /** Live workers in a non-running pause phase; absent/empty = nothing paused. */
-  workers?: { issue: number; runId: string; phase: WorkerPausePhase }[];
+  /** Live workers in a non-running pause phase; absent/empty = nothing paused.
+   *  `source`/`pausedAtMs` carry the pause provenance when one was recorded (#997). */
+  workers?: { issue: number; runId: string; phase: WorkerPausePhase; source?: string; pausedAtMs?: number }[];
   /**
    * The live orchestrator surface, attested by the running daemon (#832):
    * which mode this project's fleet is in, and — when the daemon hosts the
@@ -5961,8 +6089,12 @@ export async function turnLimitResponse(
 export async function workerControlResponse(
   req: Request,
   project: string,
-  store: Pick<Store, "latestRun" | "updateRun">,
+  store: Pick<Store, "latestRun" | "updateRun" | "recordMaterialEvent">,
   registry: WorkerControlRegistry,
+  /** Journal line for every accepted pause/resume — the live half of the
+   *  audit trail #997 asks for; the durable half is the material event. */
+  log: (line: string) => void = () => {},
+  now: () => number = Date.now,
 ): Promise<Response | undefined> {
   const url = new URL(req.url);
   const match = /^\/runs\/(\d+)\/(pause|resume|stop)$/.exec(url.pathname);
@@ -6002,16 +6134,44 @@ export async function workerControlResponse(
       return Response.json({ error: "reason must be at most 500 characters" }, { status: 400 });
     }
   }
+  // Who asked. The board, the CLI and the dashboard each name themselves so a
+  // pause is attributable afterwards (#997); an older caller that sends no
+  // source is recorded as such rather than guessed at.
+  const rawSource = Reflect.get(body, "source");
+  if (rawSource !== undefined && (typeof rawSource !== "string" || rawSource.trim() === "" || rawSource.trim().length > 40)) {
+    return Response.json({ error: "source must be a non-empty string of at most 40 characters when present" }, { status: 400 });
+  }
+  const source = typeof rawSource === "string" ? rawSource.trim() : "unattributed";
 
 
   const issue = Number(match[1]);
   const outcome =
     action === "pause"
-      ? await registry.pause(project, issue)
+      ? await registry.pause(project, issue, source)
       : action === "resume"
         ? registry.resume(project, issue)
         : await registry.stop(project, issue, reason!);
   if (outcome.kind === "ok") {
+    // The transition really happened — write both halves of the audit trail
+    // before answering (#997): one journal line for the live log, one durable
+    // material event the digest ledger keeps after the journal rotates. #986
+    // was parked 14 minutes by an unlogged keypress and nobody could say why.
+    const verb = action === "pause" ? "paused" : "resumed";
+    log(`#${issue} worker ${verb} via ${source} (run ${outcome.runId})`);
+    try {
+      store.recordMaterialEvent({
+        project,
+        category: "worker-control",
+        summary: `#${issue} worker ${verb} via ${source}`,
+        evidence: `run ${outcome.runId}, phase ${outcome.phase}`,
+        occurredAt: now(),
+        recordedAt: now(),
+      });
+    } catch (err) {
+      // The audit must never turn a successful transition into an error
+      // answer, but a swallowed write would be a silent audit gap — log it.
+      log(`#${issue} worker-control audit write failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
     return Response.json({ runId: outcome.runId, phase: outcome.phase });
   }
   if (outcome.kind === "refused") {
@@ -6089,8 +6249,10 @@ export async function workerControlResponse(
 
 export interface DaemonHttpProjectDeps {
   project: string;
-  store: Pick<Store, "latestRun" | "setTurnOverride" | "updateRun">;
+  store: Pick<Store, "latestRun" | "setTurnOverride" | "updateRun" | "recordMaterialEvent">;
   caps: () => Pick<Caps, "workerMaxTurns" | "workerMaxTurnsCeiling">;
+  /** Project-scoped journal line — the live half of the pause audit (#997). */
+  log?: (line: string) => void;
 }
 
 export interface DaemonHttpDeps {
@@ -6163,6 +6325,7 @@ export async function daemonHttpResponse(req: Request, d: DaemonHttpDeps): Promi
     selected.project,
     selected.store,
     d.workerControls,
+    selected.log,
   );
   return workerControl ?? new Response("not found\n", { status: 404 });
 }
@@ -6524,6 +6687,22 @@ export function statusSnapshotFromStore(
     spendTelemetry: judgeSpendTelemetry(
       store.recentSpendSamples?.(p.name, SPEND_SAMPLE_ROWS) ?? [],
       SPEND_SAMPLE_RUNS,
+      {
+        // Config and an already-read status only — this snapshot probes nothing
+        // at render time, which is the property the figure above depends on
+        // (#970). The declaration alone is enough to know a dollar cap cannot
+        // fire; the window name rides along when a configured plan cap has
+        // already resolved one, and `doctor` (which may probe) reads it live.
+        declaredSubscription: (p.requireOauthProviders ?? []).length > 0,
+        ...(planUsage?.window === undefined
+          ? {}
+          : {
+              allowanceWindow:
+                planUsage.window.label === undefined
+                  ? planUsage.window.id
+                  : `${planUsage.window.id} (${planUsage.window.label})`,
+            }),
+      },
     ),
     // Read, never probed: the recorded row is the whole point (#919).
     ...(() => {
@@ -7461,6 +7640,10 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
           project: runtime.d.project.name,
           store,
           caps: () => runtime.d.caps,
+          // The same project prefix the runtime's own journal lines carry, so
+          // a pause audit reads like every other daemon line (#997).
+          log: (line: string) =>
+            log(runtimes.length === 1 ? line : `[${runtime.d.project.name}] ${line}`),
         })),
         turnLimits,
         workerControls,

package/src/dashboard/app.js

@@ -140,7 +140,7 @@ async function runControl(path, body, describe) {
         : JSON.stringify(answer.body);
     showControlResult(
       answer.ok ? `${describe}: ok` : `${describe} refused (${answer.status}): ${detail}`,
-      __omp_shell("answer.ok,")
+      !answer.ok,
     );
   } catch (err) {
     showControlResult(`${describe} failed: ${String(err.message ?? err)}`, true);
@@ -188,7 +188,7 @@ controls.addEventListener("click", (event) => {
   if (reason === null || reason.trim() === "") return;
   if (
     action === "hold" &&
-    __omp_shell("confirmDestructive(")
+    !confirmDestructive(
       "Hold stops new claims AND disarms ticks. Re-arming needs a Telegram challenge answered in the chat. Continue?",
     )
   ) {
@@ -447,7 +447,7 @@ function renderRunControls(issue) {
     const reason = window.prompt(`Reason for stopping #${issue} (recorded in the run's report):`);
     if (reason === null || reason.trim() === "") return;
     if (
-      __omp_shell("confirmDestructive(")
+      !confirmDestructive(
         `Stop #${issue}? This settles the run terminally, salvages its tree and frees the slot. It cannot be resumed.`,
       )
     ) {
@@ -474,7 +474,7 @@ function renderRunControls(issue) {
   );
   button("Unblock --force", "destructive", () => {
     if (
-      __omp_shell("confirmDestructive(")
+      !confirmDestructive(
         `Force-unblock #${issue}? This accepts the loss of uncommitted work in its worktree, which may be the only copy.`,
       )
     ) {

package/src/dashboard/controls.ts

@@ -189,7 +189,7 @@ export async function dashboardWorkerControl(
   body: unknown,
   d: ControlDeps,
 ): Promise<ControlOutcome> {
-  const payload: Record<string, unknown> = { project: d.project.name };
+  const payload: Record<string, unknown> = { project: d.project.name, source: "dashboard" };
   if (action === "stop") {
     const reason = readReason(body);
     if (reason === undefined) {