omp-conductor 0.19.1 → 0.19.3

package/src/orchestrator-tick.ts

@@ -84,6 +84,7 @@ import {
   type FrictionSignal,
   type GroomingRecord,
   type HeldNotice,
+  type GroomTrigger,
   type InterruptCategory,
   type IntakeItem,
   type IssueState,
@@ -136,7 +137,7 @@ import {
   type ToSpecResult,
 } from "./to-spec.ts";
 import { heldNoticeId } from "./notices.ts";
-import { acknowledgeArmReply } from "./arm-challenge.ts";
+import { classifyArmReply } from "./arm-challenge.ts";
 
 /** The activation file. Absent means "this is not an orchestrator session". */
 export const TICK_CONFIG_FILE = ".conductor-tick.json";
@@ -154,6 +155,29 @@ export const TICK_CUSTOM_TYPE = "omp-conductor.tick";
  */
 export const ARM_PROOF_CUSTOM_TYPE = "omp-conductor.arm-proof";
 
+/**
+ * The type carried by an answer to a code that was **not** a proof (#991).
+ *
+ * Deliberately not {@link ARM_PROOF_CUSTOM_TYPE}: that type means "an arming
+ * proof landed", and the availability gate and every reader that filters on it
+ * would otherwise see a refusal as a proof. A refusal is the opposite fact.
+ */
+export const ARM_REPLY_CUSTOM_TYPE = "omp-conductor.arm-reply";
+
+/**
+ * What the operator is told when their code arrived too late (#991).
+ *
+ * Never the token, and never a hint about any other project: an expired record
+ * is the one thing this session can state about a code it could not accept.
+ */
+export const ARM_EXPIRED_REPLY_TEXT =
+  "That arming code has expired — nothing was armed. Run `omp-conductor arm` again for a fresh code.";
+
+/** What the operator is told when the code matches nothing here (#991). Worded
+ *  so it cannot be read as a statement about another project's ceremony. */
+export const ARM_UNKNOWN_REPLY_TEXT =
+  "No arming is in progress here, so that code was not accepted. Run `omp-conductor arm` to start one.";
+
 /** The model-ready wording for {@link ARM_PROOF_CUSTOM_TYPE}. Kept fixed so the
  *  orchestrator's handling of an arming proof is deterministic, whichever
  *  challenge it was cut for. */
@@ -218,6 +242,19 @@ const PENDING_MESSAGE_GRACE_MS = 60_000;
 /** Routable candidates below which the queue digest tells the orchestrator to groom (#181). */
 const DEFAULT_GROOM_BELOW = 4;
 
+/**
+ * Whether the count-based half of the grooming duty fires for one dispatch
+ * row's routable count (#988): below a numeric threshold as always, while
+ * `"always"` leaves this gate open on purpose — the selectors then answer
+ * "is anything left to groom?" from candidate state (ungroomed, unrefused,
+ * unparked), and the launch block or no-batch line renders the truthful
+ * finding either way. Never substitute a large number for `"always"`: a big
+ * queue must not silence the duty.
+ */
+function groomingDue(routed: number, groomBelow: GroomTrigger): boolean {
+  return groomBelow === "always" || routed < groomBelow;
+}
+
 /**
  * Written by herdr-conductor `recover.sh` *before* `agent start`, and by the
  * dispatch daemon when a watched decision condition transitions false→true
@@ -668,7 +705,9 @@ export interface QueueObservation {
 /**
  * One line telling the orchestrator the routable queue is running dry (#181),
  * or `undefined` when healthy — no dispatch recorded yet, or the routable count
- * is at/above the grooming trigger. `grooming` is the durable per-issue verdict
+ * at/above a numeric grooming trigger (`"always"` renders on every dispatched
+ * tick, #988, stating what remains ungroomed instead of a threshold). `grooming`
+ * is the durable per-issue verdict
  * table (#735): `blocked` rows are admission's lane/dependency holds, so the
  * line tells claimable candidates apart from a runway that cannot move —
  * instead of inviting Duty 2 to groom work whose last pass held it, which is
@@ -688,7 +727,7 @@ export function queueDigestLine(
   summary: DispatchSummary | undefined,
   queueLabel: string,
   labelPrefix: string,
-  groomBelow: number,
+  groomBelow: GroomTrigger,
   grooming: readonly GroomingRecord[] = [],
   queue: QueueObservation | undefined = undefined,
   /** Observation time for the durability of the grooming rows this line
@@ -710,7 +749,7 @@ function datedQueueDigestLine(
   summary: DispatchSummary,
   queueLabel: string,
   labelPrefix: string,
-  groomBelow: number,
+  groomBelow: GroomTrigger,
   grooming: readonly GroomingRecord[],
   now: number,
 ): string | undefined {
@@ -750,7 +789,7 @@ function datedQueueDigestLine(
     }
     return line;
   }
-  if (summary.routed >= groomBelow) return undefined;
+  if (!groomingDue(summary.routed, groomBelow)) return undefined;
   return lowQueueTail(summary, groomBelow, grooming, `As of the last dispatch (${dated}): Queue: `, now);
 }
 
@@ -766,7 +805,7 @@ function liveQueueDigestLine(
   queue: QueueObservation,
   queueLabel: string,
   labelPrefix: string,
-  groomBelow: number,
+  groomBelow: GroomTrigger,
   grooming: readonly GroomingRecord[],
   now: number,
 ): string | undefined {
@@ -786,7 +825,7 @@ function liveQueueDigestLine(
   // carrier volume. Four in-flight/parked/unroutable carriers must not
   // suppress the low-claimable signal, because the to-spec offer gates on
   // the very same routed count and the two would split.
-  if (summary.routed >= groomBelow) return undefined;
+  if (!groomingDue(summary.routed, groomBelow)) return undefined;
   const dated = new Date(summary.completedAt).toISOString();
   const inventory = `Queue: ${queued} open issue${queued === 1 ? "" : "s"} carry "${queueLabel}" right now (tracker ${observed}); `;
   if (summary.routed === 0) {
@@ -836,7 +875,7 @@ function liveQueueDigestLine(
  *  means a tracker read can never hide these distinctions. */
 function lowQueueTail(
   summary: DispatchSummary,
-  groomBelow: number,
+  groomBelow: GroomTrigger,
   grooming: readonly GroomingRecord[],
   lead: string,
   /** The clock the durability of each verdict is judged against — the same
@@ -866,9 +905,19 @@ function lowQueueTail(
       `${inFlight.length === 0 ? "" : " and the to-spec batch's results land when it settles"}.`;
   } else if (knownBlocked.length > 0 || inFlight.length > 0) {
     tail =
-      `${lead}running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}: ` +
-      `${claimable} claimable, ${knownBlocked.length} known-blocked (${groomingGroupCounts(knownBlocked)})` +
-      `${busy} — groom only the claimable.`;
+      groomBelow === "always"
+        ? `${lead}grooming runs every tick ("always") — ${summary.routed} routable candidate(s): ` +
+          `${claimable} claimable, ${knownBlocked.length} known-blocked (${groomingGroupCounts(knownBlocked)})` +
+          `${busy} — groom the claimable while any remain ungroomed.`
+        : `${lead}running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}: ` +
+          `${claimable} claimable, ${knownBlocked.length} known-blocked (${groomingGroupCounts(knownBlocked)})` +
+          `${busy} — groom only the claimable.`;
+  } else if (groomBelow === "always") {
+    // No numeric trigger exists to be "below", so the tail states the actual
+    // condition and what remains ungroomed (#988) instead of inventing one.
+    tail =
+      `${lead}grooming runs every tick ("always") — ${summary.routed} routable candidate(s); ` +
+      "groom while ungroomed, unrefused, unparked candidates remain.";
   } else {
     tail = `${lead}running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}.`;
   }
@@ -1158,7 +1207,8 @@ export function toSpecCandidateExclusion(
 /**
  * The mechanical half of Duty 2's launch: deterministic, bounded selection of
  * the eligible candidates, smallest issue numbers first, never more than
- * {@link TO_SPEC_BATCH_MAX} per batch, nothing at/above the grooming trigger,
+ * {@link TO_SPEC_BATCH_MAX} per batch, nothing at/above a numeric grooming
+ * trigger (`"always"` opens that gate and lets candidate state decide, #988),
  * nothing before the first dispatch summary exists (queue health unknown —
  * the same gate the queue digest uses). Parked and parent views are honored
  * when the caller supplies them.
@@ -1172,13 +1222,13 @@ export function toSpecCandidateExclusion(
 export function selectToSpecBatch(input: {
   candidates: readonly ToSpecCandidateView[];
   summary: DispatchSummary | undefined;
-  groomBelow: number;
+  groomBelow: GroomTrigger;
   grooming: readonly GroomingRecord[];
   active: readonly { issue: number }[];
   now: number;
 }): ToSpecCandidateView[] {
   if (input.summary === undefined) return [];
-  if (input.summary.routed >= input.groomBelow) return [];
+  if (!groomingDue(input.summary.routed, input.groomBelow)) return [];
   const groomingByIssue = new Map(input.grooming.map((row) => [row.issue, row]));
   const activeIssues = new Set(input.active.map((run) => run.issue));
   const selected: ToSpecCandidateView[] = [];
@@ -1295,8 +1345,9 @@ function toSpecPoolFromSnapshot(
  * exclusion, ending in the token + block + allowlist, or `undefined` when no
  * batch may launch. All of the following yield `undefined`:
  *
- *  - no dispatch row yet, or the routable queue is at/above the grooming
- *    trigger (the same gate the queue digest uses);
+ *  - no dispatch row yet, or the routable queue is at/above a numeric
+ *    grooming trigger (`"always"` opens that gate; candidate state decides,
+ *    #988 — the same gate the queue digest uses);
  *  - no tracker seam (the snapshot is unavailable);
  *  - the snapshot cannot be read — the launch fails closed rather than
  *    trusting the model to self-filter parked/parent/epic candidates;
@@ -1311,7 +1362,7 @@ function toSpecPoolFromSnapshot(
  */
 export async function offerToSpecLaunch(input: {
   summary: DispatchSummary | undefined;
-  groomBelow: number;
+  groomBelow: GroomTrigger;
   grooming: readonly GroomingRecord[];
   active: readonly { issue: number }[];
   project: ProjectConfig;
@@ -1324,7 +1375,7 @@ export async function offerToSpecLaunch(input: {
   now: number;
 }): Promise<ToSpecLaunchBlock | undefined> {
   if (input.summary === undefined) return undefined;
-  if (input.summary.routed >= input.groomBelow) return undefined;
+  if (!groomingDue(input.summary.routed, input.groomBelow)) return undefined;
   const seam = input.trackerSeam;
   if (seam === undefined) return undefined;
   let issues = input.issues;
@@ -1391,7 +1442,7 @@ export async function offerToSpecLaunch(input: {
 
 /**
  * The per-tick launch block. Present exactly when a batch may be launched:
- * the queue is below the grooming trigger (`summary.routed < groomBelow`),
+ * the grooming duty is due (below a numeric trigger, or `"always"` — #988),
  * a dispatch row exists, and the mechanical selection produced at least one
  * candidate. The block names the selected candidates as the ONLY batch this
  * tick authorizes and lists every store-proven exclusion the selection
@@ -1399,7 +1450,7 @@ export async function offerToSpecLaunch(input: {
  */
 export function toSpecLaunchBlock(input: {
   summary: DispatchSummary | undefined;
-  groomBelow: number;
+  groomBelow: GroomTrigger;
   grooming: readonly GroomingRecord[];
   active: readonly { issue: number }[];
   tracker: string;
@@ -1411,7 +1462,7 @@ export function toSpecLaunchBlock(input: {
   now: number;
 }): ToSpecLaunchBlock | undefined {
   if (input.summary === undefined) return undefined;
-  if (input.summary.routed >= input.groomBelow) return undefined;
+  if (!groomingDue(input.summary.routed, input.groomBelow)) return undefined;
   if (input.selected.length === 0) return undefined;
   const exclusions: ToSpecLaunchExclusions = {
     groomed: [],
@@ -1454,10 +1505,18 @@ export function toSpecLaunchBlock(input: {
     title: candidate.title,
   }));
   const candidates = items.map((item) => `- #${item.issue} (${item.routing}) — ${item.title}`).join("\n");
+  // The opening sentence names the condition that authorized this batch:
+  // below a numeric trigger as before, or the always-on mode in its own
+  // words (#988) — never a threshold the configuration does not have.
+  const trigger =
+    input.groomBelow === "always"
+      ? `Grooming is configured \`groomBelow: "always"\` — Duty 2 grooms every tick while ungroomed candidates remain ` +
+        `(${input.summary.routed} routable right now). `
+      : `The routable queue is below the grooming trigger of ${input.groomBelow} (${input.summary.routed} routable). `;
   const lines = [
     `## Bounded to-spec grooming batch (${TO_SPEC_BATCH_MARKER}, #777)`,
     "",
-    `The routable queue is below the grooming trigger of ${input.groomBelow} (${input.summary.routed} routable). ` +
+    trigger +
       "Duty 2's finding is now a strict contract: launch EXACTLY ONE native `task` batch this turn with the " +
       `\`${TO_SPEC_AGENT}\` agent — never a second batch, never an improvised scout.`,
     "",
@@ -1503,19 +1562,20 @@ export function toSpecLaunchBlock(input: {
  * not run". Every count comes from the same predicates the selection and the
  * `tool_call` gate apply (#887).
  *
- * `undefined` when no dispatch row exists or the queue is at/above the
- * grooming trigger — the same gate the offer itself uses, so this line and a
- * launch block are mutually exclusive.
+ * `undefined` when no dispatch row exists or the queue is at/above a numeric
+ * grooming trigger (`"always"` opens that gate; candidate state decides, #988)
+ * — the same gate the offer itself uses, so this line and a launch block are
+ * mutually exclusive.
  */
 export function toSpecNoBatchLine(input: {
   summary: DispatchSummary | undefined;
-  groomBelow: number;
+  groomBelow: GroomTrigger;
   grooming: readonly GroomingRecord[];
   active: readonly { issue: number }[];
   now: number;
 }): string | undefined {
   if (input.summary === undefined) return undefined;
-  if (input.summary.routed >= input.groomBelow) return undefined;
+  if (!groomingDue(input.summary.routed, input.groomBelow)) return undefined;
   let durable = 0;
   let refused = 0;
   let inFlight = 0;
@@ -3555,14 +3615,16 @@ async function tick(
           // and the offer retries its own read exactly as it did before.
           //
           // The read is made only for dispatch rows the digest could render:
-          // a healthy row (routed at/above the grooming threshold) emits no
-          // queue line at all, so no freshness check is spent on it and no
-          // stale claim can leak from it. A zero-ready row (or any row below
-          // the trigger) is exactly where the old wording lied, so every such
-          // tick reads the live queue.
+          // a healthy row (routed at/above a numeric grooming threshold)
+          // emits no queue line at all, so no freshness check is spent on it
+          // and no stale claim can leak from it. A zero-ready row (or any row
+          // below the trigger) is exactly where the old wording lied, so every
+          // such tick reads the live queue. Under `groomBelow: "always"`
+          // (#988) the duty never clears on volume, so every dispatch row
+          // reads the queue and the selectors judge candidate state.
           const needsQueueRead =
             dispatch !== undefined &&
-            (dispatch.ready === 0 || dispatch.routed === 0 || dispatch.routed < groomBelow);
+            (dispatch.ready === 0 || dispatch.routed === 0 || groomingDue(dispatch.routed, groomBelow));
           let queueObservation: QueueObservation | undefined;
           let openSnapshot: readonly ReadyIssue[] | undefined;
           if (toSpecTrackerSeam !== undefined && needsQueueRead) {
@@ -4431,7 +4493,8 @@ export default function orchestratorTickExtension(
             ?.filter((part) => part.type === "text" && typeof part.text === "string")
             .map((part) => part.text as string)
             .join(" ") ?? "";
-        const proof = acknowledgeArmReply(configuredProject, replyText, Date.now());
+        const verdict = classifyArmReply(configuredProject, replyText, Date.now());
+        const proof = verdict === "matched";
         if (session.activeLocalTick !== undefined) {
           session.activeLocalTick.humanWaiting = true;
           if (proof) session.activeLocalTick.armingProof = true;
@@ -4444,6 +4507,24 @@ export default function orchestratorTickExtension(
             { customType: ARM_PROOF_CUSTOM_TYPE, content: ARM_PROOF_ACK_TEXT, display: true, attribution: "agent" },
             { triggerTurn: true, deliverAs: "steer" },
           );
+        } else if (verdict !== "none") {
+          // A code that matched nothing used to be silent: the waiter kept
+          // waiting and the operator had no idea whether they had been heard,
+          // so the fastest way to be sure of the current code was to scroll
+          // (#991). The answer never echoes the token — that would put the
+          // plaintext in the chat and in any log that captures outbound
+          // messages, defeating the hash-only storage on purpose — and it never
+          // says whether some other project has a live challenge, because
+          // `classifyArmReply` reads only this session's own records.
+          pi.sendMessage(
+            {
+              customType: ARM_REPLY_CUSTOM_TYPE,
+              content: verdict === "expired" ? ARM_EXPIRED_REPLY_TEXT : ARM_UNKNOWN_REPLY_TEXT,
+              display: true,
+              attribution: "agent",
+            },
+            { triggerTurn: true, deliverAs: "steer" },
+          );
         }
       }
     });

package/src/settlement.ts

@@ -15,6 +15,8 @@
  */
 
 import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
 import { log, errText, safeEscalate } from "./log.ts";
 import { hasContinuationBudget } from "./admission.ts";
 import {
@@ -72,6 +74,10 @@ export interface SettlementDeps {
   tracker: Tracker;
   store: Store;
   escalate(e: Escalation): Promise<void>;
+  /** Where the harness writes its per-process session logs, read for the
+   *  terminal evidence a settling row cannot supply itself (#986). Defaults to
+   *  the harness's own location — a test points it at a fixture. */
+  harnessLogDir?: string;
   /** Whether the pause sentinel is set, daemon-owned. */
   isPaused(project?: string): boolean;
   /** Writes the pause sentinel, daemon-owned. */
@@ -1266,6 +1272,118 @@ function assistantStopError(rec: { readonly [key: string]: unknown }): string |
   return undefined;
 }
 
+/**
+ * Where the harness writes its per-process session logs (#986).
+ *
+ * The harness's own location, not the conductor's: `OMP_CONDUCTOR_HOME`
+ * relocates conductor state and must not move this, because the file being
+ * read belongs to omp and is named by omp.
+ */
+export function harnessLogDir(): string {
+  return process.env["OMP_HARNESS_LOG_DIR"] ?? join(homedir(), ".omp", "logs");
+}
+
+/** The harness's own maintenance-routing markers, in the session log it writes
+ *  per process. These name why a session ended when the row cannot: the run
+ *  itself records no error, because from its side nothing failed (#986). */
+const HARNESS_ROUTE_MARKERS = [
+  "empty-stop-retry-cap",
+  "empty-stop-handled",
+  "bottom-checkCompaction",
+  "context-overflow",
+] as const;
+
+/**
+ * One bounded line of terminal evidence for a run that did not settle cleanly
+ * (#986), or `undefined` when nothing readable says anything.
+ *
+ * Two surfaces, because the interesting deaths leave nothing on the row:
+ *
+ * - **the transcript's own exit record** — `session_exit` carries the reason
+ *   and kind the harness disposed the session with;
+ * - **the harness session log for this run's session-host pid** — where the
+ *   provider-flake routes live (`empty-stop-retry-cap`). The path is
+ *   deterministic (`<logDir>/omp.<YYYY-MM-DD>.<pid>.log`, the harness's own
+ *   naming), so this reads exactly one file and never scans a directory.
+ *
+ * Bounded on purpose: this string is rendered in `status` beside a surviving
+ * `unknown`, and an operator reading a board does not want a stack trace.
+ */
+export function readTerminalEvidence(
+  run: Pick<RunRecord, "sessionFile" | "workerPid" | "startedAt">,
+  logDir: string,
+): string | undefined {
+  const parts: string[] = [];
+  const exit = readSessionExit(run.sessionFile);
+  if (exit !== undefined) parts.push(exit);
+  const route = readHarnessRoute(run, logDir);
+  if (route !== undefined) parts.push(route);
+  if (parts.length === 0) return undefined;
+  return parts.join("; ").slice(0, 300);
+}
+
+/** The transcript's own last word on how the session ended. */
+function readSessionExit(sessionFile: string | undefined): string | undefined {
+  if (sessionFile === undefined) return undefined;
+  let text: string;
+  try {
+    text = readFileSync(sessionFile, "utf8");
+  } catch {
+    return undefined;
+  }
+  const lines = text.split("\n");
+  for (let i = lines.length - 1; i >= 0; i -= 1) {
+    const line = lines[i];
+    if (line === undefined || line.length === 0) continue;
+    let row: unknown;
+    try {
+      row = JSON.parse(line) as unknown;
+    } catch {
+      continue;
+    }
+    if (row === null || typeof row !== "object") continue;
+    const rec = row as { readonly [key: string]: unknown };
+    if (rec["customType"] !== "session_exit") continue;
+    const data = rec["data"];
+    if (data === null || typeof data !== "object") continue;
+    const d = data as { readonly [key: string]: unknown };
+    const reason = typeof d["reason"] === "string" ? d["reason"] : undefined;
+    const kind = typeof d["kind"] === "string" ? d["kind"] : undefined;
+    if (reason === undefined && kind === undefined) continue;
+    return `session_exit ${reason ?? "?"}${kind === undefined ? "" : `/${kind}`}`;
+  }
+  return undefined;
+}
+
+/**
+ * The last maintenance route the harness logged for this run's session-host
+ * process, or `undefined`. Reads one deterministic path and nothing else: a
+ * settle sweep must never walk a log directory whose size is unbounded.
+ */
+function readHarnessRoute(
+  run: Pick<RunRecord, "workerPid" | "startedAt">,
+  logDir: string,
+): string | undefined {
+  if (run.workerPid === undefined) return undefined;
+  const day = new Date(run.startedAt).toISOString().slice(0, 10);
+  const path = join(logDir, `omp.${day}.${run.workerPid}.log`);
+  let text: string;
+  try {
+    text = readFileSync(path, "utf8");
+  } catch {
+    return undefined;
+  }
+  // Last match wins: the terminal route is the one that ended the session, and
+  // `empty-stop-handled` appearing earlier is a retry that worked.
+  let found: string | undefined;
+  for (const marker of HARNESS_ROUTE_MARKERS) {
+    const at = text.lastIndexOf(marker);
+    if (at === -1) continue;
+    if (found === undefined || at > text.lastIndexOf(found)) found = marker;
+  }
+  return found === undefined ? undefined : `harness route ${found}`;
+}
+
 export function readSessionError(sessionFile: string | undefined): TranscriptError | undefined {
   if (sessionFile === undefined) return undefined;
   let text: string;
@@ -1328,6 +1446,7 @@ export function readSessionError(sessionFile: string | undefined): TranscriptErr
  */
 export async function classifyAndRecover(d: SettlementDeps): Promise<number> {
   const { project, caps, tracker, store } = d;
+  const logDir = d.harnessLogDir ?? harnessLogDir();
   // Settle recoveries, counted for the pass's dispatch record — a row whose PR
   // merged is settled here when the settle sweep could not establish identity
   // (#497). Every other exit returns 0.
@@ -1346,6 +1465,19 @@ export async function classifyAndRecover(d: SettlementDeps): Promise<number> {
           classifiedRun = { ...run, lastError: sessionError.message };
         }
       }
+      // The evidence the row cannot supply itself (#986): the transcript's exit
+      // record and the harness's own routing for this run's process. Recorded
+      // before classification so the table can read it, and recorded even when
+      // it names nothing actionable — "what was known at settle time" is the
+      // question `status` answers beside a surviving `unknown`, and a blank is
+      // only honest when the sweep genuinely found nothing.
+      if (run.terminalEvidence === undefined) {
+        const evidence = readTerminalEvidence(run, logDir);
+        if (evidence !== undefined) {
+          store.updateRun(run.id, { terminalEvidence: evidence });
+          classifiedRun = { ...classifiedRun, terminalEvidence: evidence };
+        }
+      }
     }
     try {
       if (run.prUrl !== undefined) {
@@ -1515,6 +1647,41 @@ async function recoverRun(
       return;
     }
 
+    // `model-empty-stop`: the provider answered with empty turns until the
+    // harness ended the session. The work is not at fault and the row is not a
+    // failed attempt (the counters exclude the class), so this hands the queue
+    // label back and the next dispatch resumes from whatever the attempt
+    // pushed. Bounded by the continuation budget for the same reason the
+    // wall-clock path is: a provider stuck in that state must reach a human
+    // instead of consuming the issue forever, one free retry at a time.
+    if (cls === "model-empty-stop") {
+      const state = await tracker.issueState(run.issue).catch(() => undefined);
+      if (state !== "open") {
+        log(`#${run.issue} not continued from ${cls}: issue is ${state ?? "unreadable"}`);
+        return;
+      }
+      const continuation = store.continuationsFor(project.name, run.issue);
+      if (hasContinuationBudget(continuation, caps.maxContinuationsPerIssue)) {
+        swapToQueue(d, run.issue, project.stateLabels.failed);
+        store.updateRun(run.id, { recoveredAt: Date.now() });
+        log(`#${run.issue} requeued after a provider empty-stop: ${evidence}`);
+        return;
+      }
+      store.enqueueLabelOps(project.name, [
+        { issue: run.issue, op: "remove", label: project.stateLabels.failed },
+      ]);
+      store.updateRun(run.id, { recoveredAt: Date.now() });
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue: run.issue,
+        summary: `#${run.issue} keeps dying to provider empty-stops and has no continuation budget left`,
+        detail: `${evidence}\n\nThe provider ended ${continuation} session(s) on this issue by returning empty turns until the harness's retry cap. That is not the work failing, so no implementation attempt was charged — but the continuation budget is spent, and another free retry would just consume the issue. Switching this issue's model is the usual remedy.`,
+      });
+      log(`#${run.issue} escalated: provider empty-stops exhausted the continuation budget`);
+      return;
+    }
+
     // `merge-conflict`: the branch is retained and its PR is open, so #50's
     // continuation guard admits it and the next tick briefs a rebase.
     //

package/src/setup.ts

@@ -72,6 +72,7 @@ import {
   type DigestCadence,
   type DraftPolicy,
   type OrchestratorMode,
+  type GroomTrigger,
   type InterruptCategory,
   type ProjectConfig,
   type ProjectPolicy,
@@ -161,11 +162,12 @@ export interface SetupAnswers {
    */
   workerModel?: string;
   /**
-   * Routable-candidate count below which the tick prompt says to groom. The
-   * wizard never asks for it — it is hand-edited — so it exists here only to
-   * survive an amend of some other area (#369).
+   * The grooming trigger: a routable-candidate count below which the tick
+   * prompt says to groom, or `"always"` to groom on demand every tick (#988).
+   * The wizard never asks for it — it is hand-edited — so it exists here only
+   * to survive an amend of some other area (#369).
    */
-  groomBelow?: number;
+  groomBelow?: GroomTrigger;
   /**
    * Ordered fallback worker models and the provider-failure threshold that
    * starts them. The wizard never asks for either — they are hand-edited —

package/src/spend-telemetry.ts

@@ -66,7 +66,34 @@ export type SpendTelemetryVerdict =
   /** A majority of working runs reported nothing. */
   | { kind: "partial"; worked: number; missing: number }
   /** Every working run reported nothing — the same fact, stated louder. */
-  | { kind: "absent"; worked: number };
+  | { kind: "absent"; worked: number }
+  /**
+   * Every working run reported nothing **and this fleet does not bill in
+   * dollars** (#984). Not a fault: a subscription request has no per-request
+   * price, so the harness reports none and `spendUsd` is permanently 0.00 —
+   * accurate rather than missing. The constraint that actually binds is the
+   * provider's allowance window, named here.
+   */
+  | { kind: "subscription"; worked: number; window: string; evidence: "declared" | "observed" };
+
+/**
+ * What is known about how this project's runs are billed (#984).
+ *
+ * Two independent grounds, because on a real fleet the declaration is often
+ * absent while the evidence is unambiguous:
+ *
+ * - `declaredSubscription` — the project requires its providers to bill to a
+ *   subscription credential (`requireOauthProviders`, #852). A statement of
+ *   intent, so it is believed on its own.
+ * - `allowanceWindow` — the provider itself reports an allowance window
+ *   (`omp usage --json`), which is what a subscription has instead of a price.
+ *   Positive evidence only: a fleet whose provider reports no window has
+ *   nothing here, and its zeros stay a fault.
+ */
+export interface SpendBilling {
+  declaredSubscription?: boolean;
+  allowanceWindow?: string;
+}
 
 /**
  * Judge a newest-first sample.
@@ -78,13 +105,29 @@ export type SpendTelemetryVerdict =
 export function judgeSpendTelemetry(
   samples: readonly SpendSample[],
   limit: number,
+  billing: SpendBilling = {},
 ): SpendTelemetryVerdict {
   const working = samples.filter((row) => row.turns > 0).slice(0, limit);
   if (working.length < limit) {
     return { kind: "insufficient", worked: working.length, needed: limit };
   }
   const missing = working.filter((row) => row.spendUsd === 0).length;
-  if (missing === working.length) return { kind: "absent", worked: working.length };
+  if (missing === working.length) {
+    // Total absence is the only verdict a billing class can reclassify, and
+    // that asymmetry is the whole safety property: a metered neighbour proves
+    // dollars ARE being reported, so a zero beside one is real telemetry loss
+    // no matter how the fleet is billed. `partial` therefore always warns.
+    const window = subscriptionWindow(billing);
+    if (window !== undefined) {
+      return {
+        kind: "subscription",
+        worked: working.length,
+        window: window.window,
+        evidence: window.evidence,
+      };
+    }
+    return { kind: "absent", worked: working.length };
+  }
   if (missing / working.length >= SPEND_MISSING_SHARE) {
     return { kind: "partial", worked: working.length, missing };
   }
@@ -98,8 +141,37 @@ export function judgeSpendTelemetry(
 
 /** The operator-facing sentence, or undefined when there is nothing to say.
  *  Shared so `doctor` and `status` cannot word the same fact differently. */
+/**
+ * The allowance window to name, or `undefined` when nothing establishes that
+ * this fleet is subscription-billed.
+ *
+ * A declaration with no readable window still counts — the operator has said
+ * how the fleet bills, and a provider that cannot be read is not evidence
+ * against it — but it says so rather than inventing a window name.
+ */
+function subscriptionWindow(
+  billing: SpendBilling,
+): { window: string; evidence: "declared" | "observed" } | undefined {
+  if (billing.allowanceWindow !== undefined && billing.allowanceWindow.trim() !== "") {
+    return {
+      window: billing.allowanceWindow.trim(),
+      evidence: billing.declaredSubscription === true ? "declared" : "observed",
+    };
+  }
+  if (billing.declaredSubscription === true) {
+    return { window: "unreadable (omp usage --json reported no window)", evidence: "declared" };
+  }
+  return undefined;
+}
+
 export function spendTelemetryDetail(verdict: SpendTelemetryVerdict): string | undefined {
   switch (verdict.kind) {
+    case "subscription":
+      return (
+        `the last ${verdict.worked} working runs recorded $0.00, which is correct: this fleet bills to a ` +
+        `subscription (${verdict.evidence}), so requests carry no per-request price and no USD cap can fire` +
+        ` — the constraint that binds is the ${verdict.window} allowance`
+      );
     case "absent":
       return (
         `the last ${verdict.worked} completed runs that did any work all recorded $0.00 spend` +