omp-conductor 0.19.5 → 0.19.7

package/src/daemon.ts

@@ -17,6 +17,7 @@ import {
   loadConfig,
   resolveCaps,
   resolveReleaseGrants,
+  resolveSharedInstallAuthority,
   resolveReview,
   stateDir,
 } from "./config.ts";
@@ -63,6 +64,7 @@ import { inspectSurfaces, type InstalledSurfaces } from "./upgrade.ts";
 import { checkTelegramFreshness, type TelegramFreshness } from "./telegram-freshness.ts";
 import { processStartTimeMs } from "./upgrade-verify.ts";
 import {
+  closeWorkerPane,
   fleetLayers,
   herdrPaneOmpStarts,
   openWorkerPane,
@@ -72,6 +74,9 @@ import {
   releaseWorkerPane,
   reportWorkerPaneState,
   resolveHerdrSession,
+  retireWorkerPane,
+  type HerdrRun,
+  type WorkspaceOwnership,
   type WorkerPaneOutcome,
 } from "./fleet.ts";
 import { startOrchestrator } from "./orchestrator.ts";
@@ -171,6 +176,7 @@ import type {
   DigestBacklog,
   Escalation,
   InterruptCategory,
+  HandoffWithdrawal,
   IssueComment,
   IssueSnapshot,
   PrDiff,
@@ -338,6 +344,12 @@ interface Deps {
   workerDeps?: RunWorkerDeps;
   /** Harness per-process logs used to classify terminal worker routes. */
   harnessLogDir?: string;
+  /**
+   * The Herdr runner for the worker-representation surface (#1035). Production
+   * leaves it absent — the real `herdr` CLI answers; lifecycle tests inject a
+   * fake so convergence is proven without a terminal.
+   */
+  herdrRun?: HerdrRun;
   integrity: IntegrityGate;
   stall: StallGate;
   /**
@@ -451,6 +463,7 @@ interface Deps {
 export function verbDeps(d: Pick<Deps, "project" | "store" | "tracker" | "verbActions">): VerbDeps {
   return {
     project: () => findProject(loadConfig(), d.project.name),
+    projects: () => loadConfig().projects,
     store: d.store,
     tracker: d.tracker,
     actions: d.verbActions ?? githubVerbActions(d.project),
@@ -1909,6 +1922,17 @@ export async function handleIssue(
   // for a worker that has already blocked.
   let paneSeq = 0;
   const nextPaneSeq = (): number => (paneSeq += 1);
+  /**
+   * The injected Herdr runner, when this daemon carries one (#1035); every
+   * representation call below shares it so tests see one argv stream. The
+   * ownership adapter is always present in production — the store-backed
+   * half of workspace discovery, so what a Herdr restart forgets, the
+   * durable row remembers (#1035 review).
+   */
+  const herdr = {
+    ...(d.herdrRun === undefined ? {} : { run: d.herdrRun }),
+    ownership: workspaceOwnership(d.store),
+  };
   /**
    * Project one authoritative transition onto the pane (#842).
    *
@@ -1919,6 +1943,7 @@ export async function handleIssue(
   const projectPaneState = (state: "working" | "idle" | "blocked" | "unknown", message?: string): void => {
     if (workerPane === undefined) return;
     const reported = reportWorkerPaneState(workerPane.paneId, workerPane.label, state, {
+      ...herdr,
       seq: nextPaneSeq(),
       ...(message === undefined ? {} : { message }),
     });
@@ -2526,6 +2551,7 @@ export async function handleIssue(
               workerPane = { kind: "tracked", paneId: recorded.paneId, label: recorded.paneLabel, pid };
               store.updateRun(runId, { workerPid: pid });
               const state = reportWorkerPaneState(recorded.paneId, recorded.paneLabel, "working", {
+                ...herdr,
                 seq: nextPaneSeq(),
               });
               log(
@@ -2535,14 +2561,17 @@ export async function handleIssue(
               );
               return;
             }
-            const outcome = openWorkerPane({
-              project: project.name,
-              issue,
-              attempt,
-              runId,
-              pid,
-              ...(recorded?.sessionFile === undefined ? {} : { sessionFile: recorded.sessionFile }),
-            });
+            const outcome = openWorkerPane(
+              {
+                project: project.name,
+                issue,
+                attempt,
+                runId,
+                pid,
+                ...(recorded?.sessionFile === undefined ? {} : { sessionFile: recorded.sessionFile }),
+              },
+              herdr,
+            );
             if (outcome.kind === "tracked") {
               workerPane = outcome;
               // Durable before it is announced: a pane the store does not know
@@ -2566,8 +2595,14 @@ export async function handleIssue(
           },
           release: () => {
             if (workerPane === undefined) return;
-            const released = releaseWorkerPane(workerPane.paneId, workerPane.label, { seq: nextPaneSeq() });
-            if (!released.ok) log(`#${issue} herdr pane release failed: ${released.reason}`);
+            // Retirement, not release alone (#1035): a settled run keeps no
+            // representation. The close reaches only the follower; the
+            // authoritative child was never in the pane to be signalled.
+            const retired = retireWorkerPane(workerPane.paneId, workerPane.label, {
+              ...herdr,
+              seq: nextPaneSeq(),
+            });
+            if (!retired.ok) log(`#${issue} herdr pane retirement failed: ${retired.reason}`);
             workerPane = undefined;
           },
         },
@@ -3062,17 +3097,19 @@ export async function handleIssue(
  * losing a dispatch pass over a version string would be absurd.
  */
 /**
- * Make the workspace agree with the live run set, once per pass (#841).
+ * Make the worker workspaces agree with the live run set, once per pass
+ * (#841, reworked by #1035).
  *
  * Runs on every dispatch pass rather than only at startup, because the thing it
  * repairs — a Herdr restart — is not a conductor event and announces itself
  * nowhere. It is idempotent by construction: a reconciled fleet reports `intact`
- * for every live worker and finds no stale panes, so repeated passes converge
- * instead of accumulating panes or churning them.
+ * for every live worker and finds nothing left to close, so repeated passes
+ * converge instead of accumulating panes or churning them. This pass owns this
+ * project's worker workspace even when no run is live — that is how a settled-out
+ * project's stale shells converge to zero and its empty workspace is removed.
  *
- * Nothing here can stop a worker. The only mutations are creating a pane, and
- * releasing one whose run is not live; the authoritative child is never
- * signalled, and no pane is ever closed.
+ * Nothing here can stop a worker: panes hold followers only; the authoritative
+ * child lives in this daemon's process tree and is never signalled.
  */
 /**
  * Pane re-establishment attempts spent per run, for this daemon process only
@@ -3086,7 +3123,25 @@ export async function handleIssue(
  */
 const paneAttemptsSpent = new Map<string, number>();
 
-function reconcilePanes(d: Deps, project: string, log: (message: string) => void): void {
+/** Exported for the lifecycle tests (#1035): the pass is pure over the store
+ *  and the injected Herdr runner, so a test drives it exactly as the tick does. */
+/** The store-backed {@link WorkspaceOwnership} adapter (#1035 review): the
+ *  conductor store is the durable leg of workspace discovery, surviving both
+ *  daemon and Herdr restarts. One shape for every caller so they cannot
+ *  disagree about what ownership reads. */
+function workspaceOwnership(store: Deps["store"]): WorkspaceOwnership {
+  return {
+    recordedWorkspaces: (project) => store.workerWorkspaceIds(project),
+    rememberWorkspace: (project, workspaceId) => store.rememberWorkerWorkspace(project, workspaceId),
+    forgetWorkspace: (project, workspaceId) => store.forgetWorkerWorkspace(project, workspaceId),
+  };
+}
+
+export function reconcilePanes(
+  d: Pick<Deps, "store" | "herdrRun">,
+  project: string,
+  log: (message: string) => void,
+): void {
   const live = d.store.liveRuns(project);
   const liveKeys = new Set(live.map((run) => `${project}\u0000${run.id}`));
   for (const key of [...paneAttemptsSpent.keys()]) {
@@ -3106,8 +3161,10 @@ function reconcilePanes(d: Deps, project: string, log: (message: string) => void
       ...(run.paneLabel === undefined ? {} : { paneLabel: run.paneLabel }),
       ...(run.sessionFile === undefined ? {} : { sessionFile: run.sessionFile }),
     })),
-    {},
+    { ...(d.herdrRun === undefined ? {} : { run: d.herdrRun }), ownership: workspaceOwnership(d.store) },
     attempts,
+    PANE_REATTEMPT_MAX,
+    [project],
   );
   if (!result.ok) {
     // An unreadable workspace is not evidence that anything is stale, so nothing
@@ -3120,6 +3177,14 @@ function reconcilePanes(d: Deps, project: string, log: (message: string) => void
     switch (outcome.kind) {
       case "intact":
         break;
+      case "visual-unreadable":
+        // The pane keeps standing: an unreadable follower table is no evidence
+        // of death, and a live worker's representation is never destroyed on a
+        // guess (#1035 review). Said once per pass, not acted on.
+        log(
+          `#${runIssue(live, outcome.runId)} herdr pane ${outcome.paneId} visual unreadable, left standing: ${outcome.reason}`,
+        );
+        break;
       case "reassociated":
         d.store.updateRun(outcome.runId, {
           paneId: outcome.paneId,
@@ -3136,11 +3201,11 @@ function reconcilePanes(d: Deps, project: string, log: (message: string) => void
           break;
         }
         // #998: a terminal refusing to split will refuse the next one too, and
-        // each retry made the pile worse — spend the whole budget at once.
+        // each retry made the pile worse — spend the whole budget at once. The
+        // phase is structured now (#1035 review): the old substring sniff died
+        // when the reason strings changed and never fired again.
         const key = `${project}\u0000${outcome.runId}`;
-        const spent = outcome.reason.includes("pane_split_failed")
-          ? PANE_REATTEMPT_MAX
-          : (paneAttemptsSpent.get(key) ?? 0) + 1;
+        const spent = outcome.phase === "split" ? PANE_REATTEMPT_MAX : (paneAttemptsSpent.get(key) ?? 0) + 1;
         paneAttemptsSpent.set(key, spent);
         // Once per run, at the moment the budget runs out — not once per pass.
         // Four identical lines a minute for #986 is what made the real cause
@@ -3156,11 +3221,33 @@ function reconcilePanes(d: Deps, project: string, log: (message: string) => void
         // Already reported when the budget ran out; the run keeps working with
         // no pane, and a later restart gets a fresh budget.
         break;
-      case "stale-released":
-        log(`released stale herdr pane ${outcome.paneId} (run ${outcome.runId || "unidentified"} is not live)`);
+      case "stale-released": {
+        const what =
+          outcome.cause === "duplicate"
+            ? "closed duplicate herdr pane"
+            : outcome.cause === "unidentified"
+              ? "closed unidentified herdr pane"
+              : "released settled herdr pane";
+        log(`${what} ${outcome.paneId} (run ${outcome.runId || "unidentified"}${outcome.cause === "settled" ? " is not live" : ""})`);
         break;
-      case "stale-release-failed":
-        log(`stale herdr pane ${outcome.paneId} could not be released: ${outcome.reason}`);
+      }
+      case "stale-release-failed": {
+        const what =
+          outcome.cause === "duplicate"
+            ? "duplicate herdr pane"
+            : outcome.cause === "unidentified"
+              ? "unidentified herdr pane"
+              : "settled herdr pane";
+        log(`${what} ${outcome.paneId} could not be closed: ${outcome.reason}`);
+        break;
+      }
+      case "workspace-removed":
+        log(`removed empty herdr worker workspace ${outcome.workspaceId} for ${outcome.project}`);
+        break;
+      case "workspace-remove-failed":
+        log(
+          `herdr worker workspace ${outcome.workspaceId} for ${outcome.project} could not be removed: ${outcome.reason}`,
+        );
         break;
     }
   }
@@ -6605,6 +6692,8 @@ export interface StatusSnapshot {
    *  unknown outcome, or written off. An empty list is the only honest way to
    *  say "everything authored this cycle actually went out" (#123). */
   openReports: ReportRecord[];
+  /** Recent successful report/notice withdrawals, newest first. */
+  handoffWithdrawals?: HandoffWithdrawal[];
   /** Ordinary outcomes and deferred escalations not yet associated with an
    * accepted digest report. */
   digestBacklog: DigestBacklog;
@@ -6791,6 +6880,7 @@ export function statusSnapshotFromStore(
     quarantinedRuns: store.quarantinedRuns(p.name),
     turnOverrides: store.listTurnOverrides(p.name),
     openReports: store.openReports(p.name),
+    handoffWithdrawals: store.handoffWithdrawals(p.name),
     digestBacklog: store.digestBacklog(p.name),
     verbLedger: store.verbLedger(p.name, { limit: STATUS_LEDGER_SCAN }),
     liveWorkers: live.length,
@@ -7199,11 +7289,18 @@ interface ProjectRuntime {
   reportPass?: Promise<void>;
 }
 
-function orchestratorStandingOrders(project: ProjectConfig): {
+export function orchestratorStandingOrders(
+  project: ProjectConfig,
+  projects: readonly ProjectConfig[],
+): {
   brief: string;
   releaseGrants: ResolvedGrants;
 } {
-  const releaseGrants = resolveReleaseGrants(project);
+  const installAuthority = resolveSharedInstallAuthority(projects);
+  const releaseGrants = {
+    ...resolveReleaseGrants(project),
+    install: installAuthority.holder ?? "human",
+  };
   const grantedShapes = RELEASE_SHAPES.filter((shape) => releaseGrants[shape] === "orchestrator");
   const deniedShapes = RELEASE_SHAPES.filter((shape) => releaseGrants[shape] !== "orchestrator");
   return {
@@ -7230,6 +7327,13 @@ function orchestratorStandingOrders(project: ProjectConfig): {
           ? "every release and deploy shape is mechanically blocked for you"
           : `you may invoke ${grantedShapes.join(", ")} — and only by the procedure in your POLICY.md`
       }.` + (deniedShapes.length === 0 ? "" : ` Blocked: ${deniedShapes.join(", ")}.`),
+      ...(installAuthority.holder === undefined
+        ? [
+            `Host-global install authority conflicts: ${installAuthority.entries
+              .map((entry) => `${entry.project}=${entry.holder}`)
+              .join(", ")}. Install is blocked.`,
+          ]
+        : []),
       "Handle each escalation below before the next one.",
     ].join("\n"),
   };
@@ -7410,15 +7514,22 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
         // The workspace outlives the process, so a restart inherits panes whose
         // workers are gone (#842). A session-host child dies with the daemon that
         // owned its socket, so an orphaned row's pane is authoritatively dead
-        // whatever its recorded pid says — pids are reused, and matching one
-        // would be the mechanism that makes a stranger's process read as a live
-        // worker. Release (never close) so lifecycle authority goes back to
-        // Herdr and the pane stops claiming a worker conductor no longer runs.
-        const orphanPane = releaseOrphanedWorkerPane(run);
+        // whatever its recorded pid says. Ownership is proven before the close
+        // (#1035 review): pane ids are reused after a Herdr restart, so only a
+        // pane inside a workspace conductor owns — token-marked or store-recorded,
+        // which is what survives Herdr dropping tokens on restore — whose
+        // reported identity still agrees with this row is retired. An unowned
+        // hit closes nothing and says so.
+        const orphanPane = releaseOrphanedWorkerPane(
+          { paneId: run.paneId, paneLabel: run.paneLabel, runId: run.id, project: run.project },
+          { ownership: workspaceOwnership(store) },
+        );
         if (orphanPane.kind === "released") {
           projectLog(
-            `#${run.issue} herdr pane ${orphanPane.paneId} released: its worker died with the previous daemon`,
+            `#${run.issue} herdr pane ${orphanPane.paneId} retired: its worker died with the previous daemon`,
           );
+        } else if (orphanPane.kind === "unowned") {
+          projectLog(`#${run.issue} herdr pane ${orphanPane.paneId} left alone: ${orphanPane.reason}`);
         } else if (orphanPane.kind === "failed") {
           projectLog(`#${run.issue} herdr pane ${orphanPane.paneId} release failed: ${orphanPane.reason}`);
         }
@@ -7432,7 +7543,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
       log(`skipping orphan reconciliation: daemon pid ${alive.pid} is alive and owns the active runs`);
     }
 
-    const { brief, releaseGrants } = orchestratorStandingOrders(project);
+    const { brief, releaseGrants } = orchestratorStandingOrders(project, cfg.projects);
     let orchestrator: OrchestratorHandle | undefined;
     let orchestratorVerbs: VerbListener | undefined;
     /** First start-failure cause, surfaced by the orchestrator-down incident (#288). */

package/src/doctor.ts

@@ -68,6 +68,7 @@ import {
   claimedTelegramTopics,
   lockPidAlive,
   pidAlive,
+  killOf,
   readTelegramChannel,
   readTelegramDmOwner,
   readTelegramPollState,
@@ -85,6 +86,7 @@ import {
 import {
   herdrConductorPluginConfigDir,
   planHostRuntime,
+  RECOVER_SERVICE_NAME,
   STAGED_SERVICE_NAME,
   SYSTEMD_UNIT_DIR,
   tickCwdForProject,
@@ -229,6 +231,8 @@ export interface DoctorDeps {
   hasSystemd?: () => boolean;
   /** The installed unit text at an absolute path, or undefined when absent. */
   readUnit?: (path: string) => string | undefined;
+  /** Whether one installed systemd unit is currently failed; undefined when unreadable. */
+  unitFailed?: (name: string) => boolean | undefined;
   /** stat one path; undefined when it does not exist. */
   stat?: (path: string) => Stats | undefined;
   /** uid of a username (`id -u`), or undefined when it cannot be resolved. */
@@ -308,12 +312,11 @@ export interface DoctorDeps {
    *  claim-only verdict checks only. */
   armScanDirs?: (project: ProjectConfig) => readonly string[];
   /** Whether a recorded claim or dm-owner pid is live, with omp-telegram's
-   *  topics.ts semantics (EPERM is dead). */
+   *  topics.ts semantics (EPERM is dead). The one claim-liveness fact in this
+   *  package: topic-pin's dead partition, its exact-pin check, project
+   *  resolution and the telegram-plumbing verdict all derive from it, so two
+   *  rows cannot answer one claim differently (#987). */
   pidAlive?: (pid: number) => boolean;
-  /** Whether one claimed topic is live — the single fact `topic-pin` and
-   *  `telegram-plumbing` both read, so they cannot disagree about a claim
-   *  (#987). Defaults to {@link claimIsLive}. */
-  claimIsLive?: (claim: { pid?: number }) => boolean;
   /** The provider allowance window nearest its ceiling, from `omp usage --json`
    *  — what binds a subscription-billed fleet instead of a dollar cap (#984).
    *  `undefined` when the provider reports no comparable window. */
@@ -397,6 +400,18 @@ function defaultReadUnit(path: string): string | undefined {
   }
 }
 
+export function systemdStateFailed(state: string): boolean | undefined {
+  const normalized = state.trim();
+  if (normalized === "") return undefined;
+  return normalized === "failed";
+}
+
+function defaultUnitFailed(name: string): boolean | undefined {
+  const ran = spawnSync("systemctl", ["is-failed", name], { encoding: "utf8" });
+  if (ran.error !== undefined) return undefined;
+  return systemdStateFailed(ran.stdout ?? "");
+}
+
 function defaultStat(path: string): Stats | undefined {
   try {
     return statSync(path);
@@ -660,7 +675,7 @@ function dbBackupProbe(probes: Probes, cfg: ConductorConfig | undefined): Findin
     return warnFinding(
       "db-backup",
       "conductor.db has no snapshot — losing it loses the audit trail with no recovery path",
-      "take a conductor.db snapshot (the daemon's cadence files one; restore-db needs one to restore from)",
+      "run `omp-conductor snapshot-db` (the daemon cadence uses the same SQLite snapshot primitive)",
     );
   }
   const newestMtime = snapshots
@@ -670,7 +685,7 @@ function dbBackupProbe(probes: Probes, cfg: ConductorConfig | undefined): Findin
     return warnFinding(
       "db-backup",
       `conductor.db is newer than every snapshot (${snapshots.length} file(s)) — the newest writes were never snapshot`,
-      "take a fresh conductor.db snapshot so restore-db has the current state",
+      "run `omp-conductor snapshot-db` so restore-db has the current state",
     );
   }
   return passFinding("db-backup", `conductor.db snapshot is fresh (${snapshots.length} file(s))`);
@@ -934,6 +949,22 @@ function recoveryProbe(probes: Probes): Finding {
   );
 }
 
+function recoveryStateProbe(probes: Probes): Finding {
+  const id = "systemd-recovery-state";
+  if (!probes.hasSystemd()) return passFinding(id, "no systemd directory on this host — nothing to check");
+  if (probes.readUnit(join(SYSTEMD_UNIT_DIR, RECOVER_SERVICE_NAME)) === undefined) {
+    return passFinding(id, "recovery unit is not installed — systemd-recovery owns that finding");
+  }
+  const failed = probes.unitFailed(RECOVER_SERVICE_NAME);
+  if (failed === false) return passFinding(id, `${RECOVER_SERVICE_NAME} is not failed`);
+  const fix =
+    `inspect \`systemctl status ${RECOVER_SERVICE_NAME}\` and \`journalctl -u ${RECOVER_SERVICE_NAME}\`; ` +
+    `fix the root cause, then run \`systemctl reset-failed ${RECOVER_SERVICE_NAME}\` and rerun doctor`;
+  return failed === true
+    ? warnFinding(id, `${RECOVER_SERVICE_NAME} is in failed state — its last recovery did not complete`, fix)
+    : warnFinding(id, `${RECOVER_SERVICE_NAME} state could not be read`, fix);
+}
+
 function installedUnitUser(probes: Probes): string | undefined {
   const unit = probes.readUnit(join(SYSTEMD_UNIT_DIR, STAGED_SERVICE_NAME));
   if (unit === undefined) return undefined;
@@ -1370,12 +1401,16 @@ function topicPinProbe(probes: Probes, p: ProjectConfig): Finding {
       `check omp-telegram's claim registry (threads.json in its state dir) is readable and the bridge is running, then re-run doctor — until then sends keep the pinned topic and degrade to the flat chat on a missing thread (#318)`,
     );
   }
-  // One liveness fact, shared with `telegram-plumbing` (#987). Before this the
-  // registry's rows were all treated as live here, so a pin aimed at a corpse
-  // read PASS while the plumbing row called the same claim dead.
+  // One liveness fact for everything this probe decides — the dead partition,
+  // the exact-pin check below and identity resolution all read
+  // `probes.pidAlive` through the same helper, so diverging injections cannot
+  // split the rows' answer again (#987). Before #987 every registry row was
+  // treated as live here, so a pin aimed at a corpse read PASS while the
+  // plumbing row called the same claim dead.
+  const isLive = (claim: { pid?: number }): boolean => claimIsLive(claim, killOf(probes.pidAlive));
   const all = result.claims;
-  const claims = all.filter((claim) => probes.claimIsLive(claim));
-  const dead = all.filter((claim) => !probes.claimIsLive(claim));
+  const claims = all.filter(isLive);
+  const dead = all.filter((claim) => !isLive(claim));
   // Named, never dropped: the row is the only index to the remote topic, so
   // deleting it strands the topic instead of cleaning it up.
   const deadNote =
@@ -1397,10 +1432,12 @@ function topicPinProbe(probes: Probes, p: ProjectConfig): Finding {
       `[${p.name}] pinned topic ${pinned} — no live claims to compare (the bridge has claimed no topics yet); the pin stands`,
     );
   }
+  // `claims` is already the live partition, so a dead pinned row cannot win
+  // this check (#987).
   if (claims.some((claim) => claim.threadId === pinned)) {
     return passFinding("topic-pin", `[${p.name}] pinned topic ${pinned} is a live claim${deadNote}`);
   }
-  const match = resolveProjectClaim(claims, p.name);
+  const match = resolveProjectClaim(claims, p.name, probes.pidAlive);
   if (match.kind === "match") {
     return passFinding(
       "topic-pin",
@@ -1713,7 +1750,7 @@ function parseEnvKey(text: string, key: string): string | undefined {
 
 /**
  * Install-surface parity (#904). omp-conductor installs onto three surfaces —
- * the Bun-global CLI/daemon tree, the omp plugin, and the herdr recovery
+ * the discovered CLI package tree, the omp plugin, and the herdr recovery
  * plugin — and only a live `upgrade` invocation ever compared them. On a
  * fleet whose installs are manual they diverge silently: measured on this
  * host on 2026-08-22, the omp plugin sat on the withdrawn 0.18.1 release for
@@ -2002,6 +2039,7 @@ export async function runDoctor(projectName: string | undefined, opts: DoctorDep
   // the first one stands in for the rendering seam.
   findings.push(unitProbe(probes, projects[0], cfg));
   findings.push(recoveryProbe(probes));
+  findings.push(recoveryStateProbe(probes));
   findings.push(ownershipProbe(probes));
   // #541 seam checks, host-global: the live herdr config and the plugin's
   // config.env are single files on the host, not per-project facts.
@@ -2106,6 +2144,7 @@ export function defaultProbes(): Probes {
     repoLabels: defaultRepoLabels,
     hasSystemd: () => existsSync(SYSTEMD_UNIT_DIR),
     readUnit: defaultReadUnit,
+    unitFailed: defaultUnitFailed,
     stat: defaultStat,
     uidOf: defaultUidOf,
     dbIntegrity: defaultDbIntegrity,
@@ -2159,7 +2198,6 @@ export function defaultProbes(): Probes {
       return claimDir === cwdDir ? [cwdDir] : [cwdDir, claimDir];
     },
     pidAlive,
-    claimIsLive: (claim) => claimIsLive(claim),
     allowanceWindow: async () => bindingAllowanceWindow(await sharedUsageSource().read()),
     lockPidAlive,
     lockFresh: (mtimeMs) => Date.now() - mtimeMs < TELEGRAM_LOCK_FRESH_MS,

package/src/escalate.ts

@@ -467,11 +467,13 @@ export interface ClaimedTopic {
  * own maintenance, and every topic-addressed send silently degrades to the main
  * chat: tier-2 pages, reports, digests, arm challenges, direct messages (#407).
  *
- * The operator's pin still wins whenever it is live. Only a pin that is
- * *provably* absent from the current claims is replaced, and only by the claim
- * this project can be identified with — so a deliberately separate alerts topic
- * is never hijacked by the pane's own thread. Unavailable bridge state changes
- * nothing, and #318's stale-topic retry remains the last line of defence.
+ * The operator's pin still wins whenever it is live. Only a pin that no *live*
+ * claim carries is replaced, and only by the claim this project can be
+ * identified with — so a deliberately separate alerts topic is never hijacked
+ * by the pane's own thread. A dead row wearing the pin id does not keep it in
+ * place: the row is the bridge's past, not a destination (#987). Unavailable
+ * bridge state changes nothing, and #318's stale-topic retry remains the last
+ * line of defence.
  *
  * Identity is read from the herdr space first, and only then from the claim's
  * title. The bridge titles a topic `ownAgentName ?? basename(cwd)`, and both
@@ -483,14 +485,19 @@ export interface ClaimedTopic {
  * The substitution is logged, naming the project and which identity answered.
  * Never an id: a log line is a place these leak from.
  */
-export function resolveProjectTopicId(project: ProjectConfig): number | undefined {
+export function resolveProjectTopicId(project: ProjectConfig, alive?: (pid: number) => boolean): number | undefined {
   const pinned = project.escalation.telegramTopicId;
   if (pinned === undefined) return undefined;
   const result = claimedTelegramTopics();
   if (result.kind !== "ok" || result.claims.length === 0) return pinned;
   const claims = result.claims;
-  if (claims.some((claim) => claim.threadId === pinned)) return pinned;
-  const match = claimForProject(claims, project.name);
+  // The pin wins only while a *live* claim carries it; a dead pinned row falls
+  // through to the live-claim substitution below instead of winning the
+  // exact-pin check (#987).
+  if (claims.some((claim) => claim.threadId === pinned && claimIsLive(claim, alive === undefined ? undefined : killOf(alive)))) {
+    return pinned;
+  }
+  const match = claimForProject(claims, project.name, alive);
   if (match === undefined) return pinned;
   warn(
     `escalation.telegramTopicId for ${project.name} is no longer a claimed topic; ` +
@@ -519,25 +526,32 @@ export type ProjectClaim =
  * How the live claims answer to a project, identity spellings in order:
  * unique herdr space, then unique title.
  *
- * Ambiguity is not a coin toss: paging the wrong project's topic is worse
- * than the flat-chat degrade #318 already handles, and scanning the wrong
- * pane's session misses the reply entirely. The title is a fallback for
- * bridges that never captured a space, so it runs only when *no* claim
- * carries the project's space — several claims wearing the space is an
- * ambiguity the title cannot resolve, because the titled claim may be a
- * sibling pane, not this project (#626).
+ * Only live claims take part ({@link claimIsLive}): a dead row neither
+ * answers on its own nor turns this project's one live pane into an
+ * ambiguity (#987). Ambiguity is not a coin toss: paging the wrong project's
+ * topic is worse than the flat-chat degrade #318 already handles, and
+ * scanning the wrong pane's session misses the reply entirely. The title is
+ * a fallback for bridges that never captured a space, so it runs only when
+ * *no* live claim carries the project's space — several live claims wearing
+ * the space is an ambiguity the title cannot resolve, because the titled
+ * claim may be a sibling pane, not this project (#626).
  */
 export function resolveProjectClaim(
   claims: readonly ClaimedTopic[],
   projectName: string,
+  alive?: (pid: number) => boolean,
 ): ProjectClaim {
-  const bySpace = claims.filter((claim) => claim.workspaceLabel === projectName);
+  // Dead claims do not vote: a closed pane's row must not turn this project's
+  // one live claim into an ambiguity, and must not answer by title on its own
+  // (#987). Ambiguity among genuinely live claims is unchanged (#626).
+  const live = claims.filter((claim) => claimIsLive(claim, alive === undefined ? undefined : killOf(alive)));
+  const bySpace = live.filter((claim) => claim.workspaceLabel === projectName);
   if (bySpace.length > 0) {
     return bySpace.length === 1
       ? { kind: "match", claim: bySpace[0]! }
       : { kind: "ambiguous", claimants: bySpace };
   }
-  const byTitle = claims.filter((claim) => claim.name === projectName);
+  const byTitle = live.filter((claim) => claim.name === projectName);
   if (byTitle.length === 0) return { kind: "none" };
   return byTitle.length === 1
     ? { kind: "match", claim: byTitle[0]! }
@@ -556,8 +570,9 @@ export function resolveProjectClaim(
 export function claimForProject(
   claims: readonly ClaimedTopic[],
   projectName: string,
+  alive?: (pid: number) => boolean,
 ): ClaimedTopic | undefined {
-  const match = resolveProjectClaim(claims, projectName);
+  const match = resolveProjectClaim(claims, projectName, alive);
   return match.kind === "match" ? match.claim : undefined;
 }
 
@@ -574,10 +589,13 @@ export function claimForProject(
  * the claim names no file — the caller then falls back to the cwd-derived
  * directory, which is the honest answer for a host that predates claims.
  */
-export function resolveClaimedSessionFile(project: ProjectConfig): string | undefined {
+export function resolveClaimedSessionFile(
+  project: ProjectConfig,
+  alive?: (pid: number) => boolean,
+): string | undefined {
   const result = claimedTelegramTopics();
   if (result.kind !== "ok" || result.claims.length === 0) return undefined;
-  return claimForProject(result.claims, project.name)?.sessionFile;
+  return claimForProject(result.claims, project.name, alive)?.sessionFile;
 }
 
 /**
@@ -1111,7 +1129,7 @@ export type TelegramPlumbingScan = { dirs: readonly string[] };
  * Throwing is how `pidAlive` spells "dead", which is the contract it applies to
  * whatever this returns.
  */
-function killOf(alive: (pid: number) => boolean): (target: number, signal: number) => void {
+export function killOf(alive: (pid: number) => boolean): (target: number, signal: number) => void {
   return (target) => {
     if (!alive(target)) throw new Error("not alive");
   };