omp-conductor 0.19.6 → 0.19.7

package/REFERENCE.md

@@ -848,6 +848,22 @@ the queue label is refused with `file-lane-unparseable` and an actionable
 message, because promoting beside overlapping work on a section that plainly
 tried to declare is the exact gap the interlock exists to close.
 
+Since #1036, a promotion also checks a contract. When the issue carries a
+durable `promotable` grooming verdict (the store's grooming row, written by
+the to-spec batch), adding the queue label first recovers that verdict's strict
+payload and requires its `PROMOTABLE` result, then compares the lane admission
+would enforce against the verdict's `fileLane` as deduplicated,
+order-independent path sets — exact in both directions, so a missing path
+refuses exactly like an extra one, and an order-only difference promotes. Any
+disagreement refuses with `promotion-brief-mismatch`, naming both sets; so
+does evidence behind a `promotable` row that does not recover as a strict
+PROMOTABLE result, and an issue unreadable at promotion time behind such a
+row. The durable verdict is what made the issue dispatchable, so the gate
+fails closed before any tracker mutation or daemon wake — but it never edits
+the issue itself: the remediation is applying the verdict's `proposedBrief`
+to the issue (its `## Exact write lane` included), then adding the label
+again. An issue without a `promotable` row promotes exactly as before.
+
 #### What status shows
 
 `status` renders the two lifecycle kinds as two blocks, because "a branch is
@@ -3099,7 +3115,7 @@ daemon, across a process boundary, not in a prompt the model can rewrite.
 | `conductor_pr_status` | worker or orchestrator | Read-only — nothing to gate. A worker reads only its own run's PR; an orchestrator may name any syntactically valid PR URL, open, merged, or closed, and gets its live state and head (checks are reported when available; a merged or closed PR reports its state instead of an `expected OPEN` refusal). |
 | `conductor_pr_update_branch` | orchestrator, or the worker owning the run | The PR belongs to this project and is open. A worker may only name its own run's PR. |
 | `conductor_pr_merge` | **orchestrator only** | Ordinarily, `authority.merge` equals the caller. A hand-edited `recoveryMerges` entry may instead authorize one exact unrecorded PR/head/reason while held. In both paths, while the project has an [active release composition](#the-active-release-composition-850), the PR must be named in it or carry an explicit operator override; then `headSha` equals the live head *at execution time*; checks are green at that same SHA; no [review evidence](#the-exact-head-review-gate-888) stands at that head without a recorded `conductor_pr_review_clear`; the project route and migration chain are valid; the project's single merge slot is free. |
-| `conductor_label` | **orchestrator only** | The label is in the project's own vocabulary. Lifecycle labels stay the daemon's. Adding the queue label echoes the parsed [file lane](#the-file-lane-declaration), or refuses with `file-lane-unparseable` when a clearly delimited write-lane section parsed nothing — it never claims fail-open beside a declaration that was actually attempted. |
+| `conductor_label` | **orchestrator only** | The label is in the project's own vocabulary. Lifecycle labels stay the daemon's. Adding the queue label echoes the parsed [file lane](#the-file-lane-declaration), or refuses with `file-lane-unparseable` when a clearly delimited write-lane section parsed nothing — it never claims fail-open beside a declaration that was actually attempted. When the issue carries a durable `promotable` grooming verdict, adding the queue label also verifies the current brief against that verdict before any mutation: a brief that disagrees with the verdict's `fileLane` (or evidence that no longer recovers as a strict PROMOTABLE result) refuses with `promotion-brief-mismatch` — apply the verdict's `proposedBrief`, then re-add ([the file-lane declaration](#the-file-lane-declaration)). |
 | `conductor_release` | **orchestrator only** | `authority.release` equals the caller; the per-shape grant permits it; the artefact or environment was declared; the release preconditions hold; the `reason` is in the closed enum. `version-bump-pr` creates or re-validates one deterministic version-only PR and, on a later call, merges only its exact green head through the project's single merge slot. |
 | `conductor_install` | **orchestrator only** | Gated like a release act: the `install` shape defaults to `human` and a grant is what moves it. The daemon refuses a version npm does not expose with a full `gitHead`, refuses while another install is still in flight, and otherwise starts a detached transient unit that pauses, drains, installs the CLI/omp plugin/Herdr plugin and reloads — outside this session and the daemon. The unit never declares its own success; the first tick after the restart verifies and reports through the durable outbox. |
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.19.6",
+  "version": "0.19.7",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/daemon.ts

@@ -64,6 +64,7 @@ import { inspectSurfaces, type InstalledSurfaces } from "./upgrade.ts";
 import { checkTelegramFreshness, type TelegramFreshness } from "./telegram-freshness.ts";
 import { processStartTimeMs } from "./upgrade-verify.ts";
 import {
+  closeWorkerPane,
   fleetLayers,
   herdrPaneOmpStarts,
   openWorkerPane,
@@ -73,6 +74,9 @@ import {
   releaseWorkerPane,
   reportWorkerPaneState,
   resolveHerdrSession,
+  retireWorkerPane,
+  type HerdrRun,
+  type WorkspaceOwnership,
   type WorkerPaneOutcome,
 } from "./fleet.ts";
 import { startOrchestrator } from "./orchestrator.ts";
@@ -340,6 +344,12 @@ interface Deps {
   workerDeps?: RunWorkerDeps;
   /** Harness per-process logs used to classify terminal worker routes. */
   harnessLogDir?: string;
+  /**
+   * The Herdr runner for the worker-representation surface (#1035). Production
+   * leaves it absent — the real `herdr` CLI answers; lifecycle tests inject a
+   * fake so convergence is proven without a terminal.
+   */
+  herdrRun?: HerdrRun;
   integrity: IntegrityGate;
   stall: StallGate;
   /**
@@ -1912,6 +1922,17 @@ export async function handleIssue(
   // for a worker that has already blocked.
   let paneSeq = 0;
   const nextPaneSeq = (): number => (paneSeq += 1);
+  /**
+   * The injected Herdr runner, when this daemon carries one (#1035); every
+   * representation call below shares it so tests see one argv stream. The
+   * ownership adapter is always present in production — the store-backed
+   * half of workspace discovery, so what a Herdr restart forgets, the
+   * durable row remembers (#1035 review).
+   */
+  const herdr = {
+    ...(d.herdrRun === undefined ? {} : { run: d.herdrRun }),
+    ownership: workspaceOwnership(d.store),
+  };
   /**
    * Project one authoritative transition onto the pane (#842).
    *
@@ -1922,6 +1943,7 @@ export async function handleIssue(
   const projectPaneState = (state: "working" | "idle" | "blocked" | "unknown", message?: string): void => {
     if (workerPane === undefined) return;
     const reported = reportWorkerPaneState(workerPane.paneId, workerPane.label, state, {
+      ...herdr,
       seq: nextPaneSeq(),
       ...(message === undefined ? {} : { message }),
     });
@@ -2529,6 +2551,7 @@ export async function handleIssue(
               workerPane = { kind: "tracked", paneId: recorded.paneId, label: recorded.paneLabel, pid };
               store.updateRun(runId, { workerPid: pid });
               const state = reportWorkerPaneState(recorded.paneId, recorded.paneLabel, "working", {
+                ...herdr,
                 seq: nextPaneSeq(),
               });
               log(
@@ -2538,14 +2561,17 @@ export async function handleIssue(
               );
               return;
             }
-            const outcome = openWorkerPane({
-              project: project.name,
-              issue,
-              attempt,
-              runId,
-              pid,
-              ...(recorded?.sessionFile === undefined ? {} : { sessionFile: recorded.sessionFile }),
-            });
+            const outcome = openWorkerPane(
+              {
+                project: project.name,
+                issue,
+                attempt,
+                runId,
+                pid,
+                ...(recorded?.sessionFile === undefined ? {} : { sessionFile: recorded.sessionFile }),
+              },
+              herdr,
+            );
             if (outcome.kind === "tracked") {
               workerPane = outcome;
               // Durable before it is announced: a pane the store does not know
@@ -2569,8 +2595,14 @@ export async function handleIssue(
           },
           release: () => {
             if (workerPane === undefined) return;
-            const released = releaseWorkerPane(workerPane.paneId, workerPane.label, { seq: nextPaneSeq() });
-            if (!released.ok) log(`#${issue} herdr pane release failed: ${released.reason}`);
+            // Retirement, not release alone (#1035): a settled run keeps no
+            // representation. The close reaches only the follower; the
+            // authoritative child was never in the pane to be signalled.
+            const retired = retireWorkerPane(workerPane.paneId, workerPane.label, {
+              ...herdr,
+              seq: nextPaneSeq(),
+            });
+            if (!retired.ok) log(`#${issue} herdr pane retirement failed: ${retired.reason}`);
             workerPane = undefined;
           },
         },
@@ -3065,17 +3097,19 @@ export async function handleIssue(
  * losing a dispatch pass over a version string would be absurd.
  */
 /**
- * Make the workspace agree with the live run set, once per pass (#841).
+ * Make the worker workspaces agree with the live run set, once per pass
+ * (#841, reworked by #1035).
  *
  * Runs on every dispatch pass rather than only at startup, because the thing it
  * repairs — a Herdr restart — is not a conductor event and announces itself
  * nowhere. It is idempotent by construction: a reconciled fleet reports `intact`
- * for every live worker and finds no stale panes, so repeated passes converge
- * instead of accumulating panes or churning them.
+ * for every live worker and finds nothing left to close, so repeated passes
+ * converge instead of accumulating panes or churning them. This pass owns this
+ * project's worker workspace even when no run is live — that is how a settled-out
+ * project's stale shells converge to zero and its empty workspace is removed.
  *
- * Nothing here can stop a worker. The only mutations are creating a pane, and
- * releasing one whose run is not live; the authoritative child is never
- * signalled, and no pane is ever closed.
+ * Nothing here can stop a worker: panes hold followers only; the authoritative
+ * child lives in this daemon's process tree and is never signalled.
  */
 /**
  * Pane re-establishment attempts spent per run, for this daemon process only
@@ -3089,7 +3123,25 @@ export async function handleIssue(
  */
 const paneAttemptsSpent = new Map<string, number>();
 
-function reconcilePanes(d: Deps, project: string, log: (message: string) => void): void {
+/** Exported for the lifecycle tests (#1035): the pass is pure over the store
+ *  and the injected Herdr runner, so a test drives it exactly as the tick does. */
+/** The store-backed {@link WorkspaceOwnership} adapter (#1035 review): the
+ *  conductor store is the durable leg of workspace discovery, surviving both
+ *  daemon and Herdr restarts. One shape for every caller so they cannot
+ *  disagree about what ownership reads. */
+function workspaceOwnership(store: Deps["store"]): WorkspaceOwnership {
+  return {
+    recordedWorkspaces: (project) => store.workerWorkspaceIds(project),
+    rememberWorkspace: (project, workspaceId) => store.rememberWorkerWorkspace(project, workspaceId),
+    forgetWorkspace: (project, workspaceId) => store.forgetWorkerWorkspace(project, workspaceId),
+  };
+}
+
+export function reconcilePanes(
+  d: Pick<Deps, "store" | "herdrRun">,
+  project: string,
+  log: (message: string) => void,
+): void {
   const live = d.store.liveRuns(project);
   const liveKeys = new Set(live.map((run) => `${project}\u0000${run.id}`));
   for (const key of [...paneAttemptsSpent.keys()]) {
@@ -3109,8 +3161,10 @@ function reconcilePanes(d: Deps, project: string, log: (message: string) => void
       ...(run.paneLabel === undefined ? {} : { paneLabel: run.paneLabel }),
       ...(run.sessionFile === undefined ? {} : { sessionFile: run.sessionFile }),
     })),
-    {},
+    { ...(d.herdrRun === undefined ? {} : { run: d.herdrRun }), ownership: workspaceOwnership(d.store) },
     attempts,
+    PANE_REATTEMPT_MAX,
+    [project],
   );
   if (!result.ok) {
     // An unreadable workspace is not evidence that anything is stale, so nothing
@@ -3123,6 +3177,14 @@ function reconcilePanes(d: Deps, project: string, log: (message: string) => void
     switch (outcome.kind) {
       case "intact":
         break;
+      case "visual-unreadable":
+        // The pane keeps standing: an unreadable follower table is no evidence
+        // of death, and a live worker's representation is never destroyed on a
+        // guess (#1035 review). Said once per pass, not acted on.
+        log(
+          `#${runIssue(live, outcome.runId)} herdr pane ${outcome.paneId} visual unreadable, left standing: ${outcome.reason}`,
+        );
+        break;
       case "reassociated":
         d.store.updateRun(outcome.runId, {
           paneId: outcome.paneId,
@@ -3139,11 +3201,11 @@ function reconcilePanes(d: Deps, project: string, log: (message: string) => void
           break;
         }
         // #998: a terminal refusing to split will refuse the next one too, and
-        // each retry made the pile worse — spend the whole budget at once.
+        // each retry made the pile worse — spend the whole budget at once. The
+        // phase is structured now (#1035 review): the old substring sniff died
+        // when the reason strings changed and never fired again.
         const key = `${project}\u0000${outcome.runId}`;
-        const spent = outcome.reason.includes("pane_split_failed")
-          ? PANE_REATTEMPT_MAX
-          : (paneAttemptsSpent.get(key) ?? 0) + 1;
+        const spent = outcome.phase === "split" ? PANE_REATTEMPT_MAX : (paneAttemptsSpent.get(key) ?? 0) + 1;
         paneAttemptsSpent.set(key, spent);
         // Once per run, at the moment the budget runs out — not once per pass.
         // Four identical lines a minute for #986 is what made the real cause
@@ -3159,11 +3221,33 @@ function reconcilePanes(d: Deps, project: string, log: (message: string) => void
         // Already reported when the budget ran out; the run keeps working with
         // no pane, and a later restart gets a fresh budget.
         break;
-      case "stale-released":
-        log(`released stale herdr pane ${outcome.paneId} (run ${outcome.runId || "unidentified"} is not live)`);
+      case "stale-released": {
+        const what =
+          outcome.cause === "duplicate"
+            ? "closed duplicate herdr pane"
+            : outcome.cause === "unidentified"
+              ? "closed unidentified herdr pane"
+              : "released settled herdr pane";
+        log(`${what} ${outcome.paneId} (run ${outcome.runId || "unidentified"}${outcome.cause === "settled" ? " is not live" : ""})`);
+        break;
+      }
+      case "stale-release-failed": {
+        const what =
+          outcome.cause === "duplicate"
+            ? "duplicate herdr pane"
+            : outcome.cause === "unidentified"
+              ? "unidentified herdr pane"
+              : "settled herdr pane";
+        log(`${what} ${outcome.paneId} could not be closed: ${outcome.reason}`);
+        break;
+      }
+      case "workspace-removed":
+        log(`removed empty herdr worker workspace ${outcome.workspaceId} for ${outcome.project}`);
         break;
-      case "stale-release-failed":
-        log(`stale herdr pane ${outcome.paneId} could not be released: ${outcome.reason}`);
+      case "workspace-remove-failed":
+        log(
+          `herdr worker workspace ${outcome.workspaceId} for ${outcome.project} could not be removed: ${outcome.reason}`,
+        );
         break;
     }
   }
@@ -7430,15 +7514,22 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
         // The workspace outlives the process, so a restart inherits panes whose
         // workers are gone (#842). A session-host child dies with the daemon that
         // owned its socket, so an orphaned row's pane is authoritatively dead
-        // whatever its recorded pid says — pids are reused, and matching one
-        // would be the mechanism that makes a stranger's process read as a live
-        // worker. Release (never close) so lifecycle authority goes back to
-        // Herdr and the pane stops claiming a worker conductor no longer runs.
-        const orphanPane = releaseOrphanedWorkerPane(run);
+        // whatever its recorded pid says. Ownership is proven before the close
+        // (#1035 review): pane ids are reused after a Herdr restart, so only a
+        // pane inside a workspace conductor owns — token-marked or store-recorded,
+        // which is what survives Herdr dropping tokens on restore — whose
+        // reported identity still agrees with this row is retired. An unowned
+        // hit closes nothing and says so.
+        const orphanPane = releaseOrphanedWorkerPane(
+          { paneId: run.paneId, paneLabel: run.paneLabel, runId: run.id, project: run.project },
+          { ownership: workspaceOwnership(store) },
+        );
         if (orphanPane.kind === "released") {
           projectLog(
-            `#${run.issue} herdr pane ${orphanPane.paneId} released: its worker died with the previous daemon`,
+            `#${run.issue} herdr pane ${orphanPane.paneId} retired: its worker died with the previous daemon`,
           );
+        } else if (orphanPane.kind === "unowned") {
+          projectLog(`#${run.issue} herdr pane ${orphanPane.paneId} left alone: ${orphanPane.reason}`);
         } else if (orphanPane.kind === "failed") {
           projectLog(`#${run.issue} herdr pane ${orphanPane.paneId} release failed: ${orphanPane.reason}`);
         }

package/src/doctor.ts

@@ -68,6 +68,7 @@ import {
   claimedTelegramTopics,
   lockPidAlive,
   pidAlive,
+  killOf,
   readTelegramChannel,
   readTelegramDmOwner,
   readTelegramPollState,
@@ -311,12 +312,11 @@ export interface DoctorDeps {
    *  claim-only verdict checks only. */
   armScanDirs?: (project: ProjectConfig) => readonly string[];
   /** Whether a recorded claim or dm-owner pid is live, with omp-telegram's
-   *  topics.ts semantics (EPERM is dead). */
+   *  topics.ts semantics (EPERM is dead). The one claim-liveness fact in this
+   *  package: topic-pin's dead partition, its exact-pin check, project
+   *  resolution and the telegram-plumbing verdict all derive from it, so two
+   *  rows cannot answer one claim differently (#987). */
   pidAlive?: (pid: number) => boolean;
-  /** Whether one claimed topic is live — the single fact `topic-pin` and
-   *  `telegram-plumbing` both read, so they cannot disagree about a claim
-   *  (#987). Defaults to {@link claimIsLive}. */
-  claimIsLive?: (claim: { pid?: number }) => boolean;
   /** The provider allowance window nearest its ceiling, from `omp usage --json`
    *  — what binds a subscription-billed fleet instead of a dollar cap (#984).
    *  `undefined` when the provider reports no comparable window. */
@@ -1401,12 +1401,16 @@ function topicPinProbe(probes: Probes, p: ProjectConfig): Finding {
       `check omp-telegram's claim registry (threads.json in its state dir) is readable and the bridge is running, then re-run doctor — until then sends keep the pinned topic and degrade to the flat chat on a missing thread (#318)`,
     );
   }
-  // One liveness fact, shared with `telegram-plumbing` (#987). Before this the
-  // registry's rows were all treated as live here, so a pin aimed at a corpse
-  // read PASS while the plumbing row called the same claim dead.
+  // One liveness fact for everything this probe decides — the dead partition,
+  // the exact-pin check below and identity resolution all read
+  // `probes.pidAlive` through the same helper, so diverging injections cannot
+  // split the rows' answer again (#987). Before #987 every registry row was
+  // treated as live here, so a pin aimed at a corpse read PASS while the
+  // plumbing row called the same claim dead.
+  const isLive = (claim: { pid?: number }): boolean => claimIsLive(claim, killOf(probes.pidAlive));
   const all = result.claims;
-  const claims = all.filter((claim) => probes.claimIsLive(claim));
-  const dead = all.filter((claim) => !probes.claimIsLive(claim));
+  const claims = all.filter(isLive);
+  const dead = all.filter((claim) => !isLive(claim));
   // Named, never dropped: the row is the only index to the remote topic, so
   // deleting it strands the topic instead of cleaning it up.
   const deadNote =
@@ -1428,10 +1432,12 @@ function topicPinProbe(probes: Probes, p: ProjectConfig): Finding {
       `[${p.name}] pinned topic ${pinned} — no live claims to compare (the bridge has claimed no topics yet); the pin stands`,
     );
   }
+  // `claims` is already the live partition, so a dead pinned row cannot win
+  // this check (#987).
   if (claims.some((claim) => claim.threadId === pinned)) {
     return passFinding("topic-pin", `[${p.name}] pinned topic ${pinned} is a live claim${deadNote}`);
   }
-  const match = resolveProjectClaim(claims, p.name);
+  const match = resolveProjectClaim(claims, p.name, probes.pidAlive);
   if (match.kind === "match") {
     return passFinding(
       "topic-pin",
@@ -2192,7 +2198,6 @@ export function defaultProbes(): Probes {
       return claimDir === cwdDir ? [cwdDir] : [cwdDir, claimDir];
     },
     pidAlive,
-    claimIsLive: (claim) => claimIsLive(claim),
     allowanceWindow: async () => bindingAllowanceWindow(await sharedUsageSource().read()),
     lockPidAlive,
     lockFresh: (mtimeMs) => Date.now() - mtimeMs < TELEGRAM_LOCK_FRESH_MS,

package/src/escalate.ts

@@ -467,11 +467,13 @@ export interface ClaimedTopic {
  * own maintenance, and every topic-addressed send silently degrades to the main
  * chat: tier-2 pages, reports, digests, arm challenges, direct messages (#407).
  *
- * The operator's pin still wins whenever it is live. Only a pin that is
- * *provably* absent from the current claims is replaced, and only by the claim
- * this project can be identified with — so a deliberately separate alerts topic
- * is never hijacked by the pane's own thread. Unavailable bridge state changes
- * nothing, and #318's stale-topic retry remains the last line of defence.
+ * The operator's pin still wins whenever it is live. Only a pin that no *live*
+ * claim carries is replaced, and only by the claim this project can be
+ * identified with — so a deliberately separate alerts topic is never hijacked
+ * by the pane's own thread. A dead row wearing the pin id does not keep it in
+ * place: the row is the bridge's past, not a destination (#987). Unavailable
+ * bridge state changes nothing, and #318's stale-topic retry remains the last
+ * line of defence.
  *
  * Identity is read from the herdr space first, and only then from the claim's
  * title. The bridge titles a topic `ownAgentName ?? basename(cwd)`, and both
@@ -483,14 +485,19 @@ export interface ClaimedTopic {
  * The substitution is logged, naming the project and which identity answered.
  * Never an id: a log line is a place these leak from.
  */
-export function resolveProjectTopicId(project: ProjectConfig): number | undefined {
+export function resolveProjectTopicId(project: ProjectConfig, alive?: (pid: number) => boolean): number | undefined {
   const pinned = project.escalation.telegramTopicId;
   if (pinned === undefined) return undefined;
   const result = claimedTelegramTopics();
   if (result.kind !== "ok" || result.claims.length === 0) return pinned;
   const claims = result.claims;
-  if (claims.some((claim) => claim.threadId === pinned)) return pinned;
-  const match = claimForProject(claims, project.name);
+  // The pin wins only while a *live* claim carries it; a dead pinned row falls
+  // through to the live-claim substitution below instead of winning the
+  // exact-pin check (#987).
+  if (claims.some((claim) => claim.threadId === pinned && claimIsLive(claim, alive === undefined ? undefined : killOf(alive)))) {
+    return pinned;
+  }
+  const match = claimForProject(claims, project.name, alive);
   if (match === undefined) return pinned;
   warn(
     `escalation.telegramTopicId for ${project.name} is no longer a claimed topic; ` +
@@ -519,25 +526,32 @@ export type ProjectClaim =
  * How the live claims answer to a project, identity spellings in order:
  * unique herdr space, then unique title.
  *
- * Ambiguity is not a coin toss: paging the wrong project's topic is worse
- * than the flat-chat degrade #318 already handles, and scanning the wrong
- * pane's session misses the reply entirely. The title is a fallback for
- * bridges that never captured a space, so it runs only when *no* claim
- * carries the project's space — several claims wearing the space is an
- * ambiguity the title cannot resolve, because the titled claim may be a
- * sibling pane, not this project (#626).
+ * Only live claims take part ({@link claimIsLive}): a dead row neither
+ * answers on its own nor turns this project's one live pane into an
+ * ambiguity (#987). Ambiguity is not a coin toss: paging the wrong project's
+ * topic is worse than the flat-chat degrade #318 already handles, and
+ * scanning the wrong pane's session misses the reply entirely. The title is
+ * a fallback for bridges that never captured a space, so it runs only when
+ * *no* live claim carries the project's space — several live claims wearing
+ * the space is an ambiguity the title cannot resolve, because the titled
+ * claim may be a sibling pane, not this project (#626).
  */
 export function resolveProjectClaim(
   claims: readonly ClaimedTopic[],
   projectName: string,
+  alive?: (pid: number) => boolean,
 ): ProjectClaim {
-  const bySpace = claims.filter((claim) => claim.workspaceLabel === projectName);
+  // Dead claims do not vote: a closed pane's row must not turn this project's
+  // one live claim into an ambiguity, and must not answer by title on its own
+  // (#987). Ambiguity among genuinely live claims is unchanged (#626).
+  const live = claims.filter((claim) => claimIsLive(claim, alive === undefined ? undefined : killOf(alive)));
+  const bySpace = live.filter((claim) => claim.workspaceLabel === projectName);
   if (bySpace.length > 0) {
     return bySpace.length === 1
       ? { kind: "match", claim: bySpace[0]! }
       : { kind: "ambiguous", claimants: bySpace };
   }
-  const byTitle = claims.filter((claim) => claim.name === projectName);
+  const byTitle = live.filter((claim) => claim.name === projectName);
   if (byTitle.length === 0) return { kind: "none" };
   return byTitle.length === 1
     ? { kind: "match", claim: byTitle[0]! }
@@ -556,8 +570,9 @@ export function resolveProjectClaim(
 export function claimForProject(
   claims: readonly ClaimedTopic[],
   projectName: string,
+  alive?: (pid: number) => boolean,
 ): ClaimedTopic | undefined {
-  const match = resolveProjectClaim(claims, projectName);
+  const match = resolveProjectClaim(claims, projectName, alive);
   return match.kind === "match" ? match.claim : undefined;
 }
 
@@ -574,10 +589,13 @@ export function claimForProject(
  * the claim names no file — the caller then falls back to the cwd-derived
  * directory, which is the honest answer for a host that predates claims.
  */
-export function resolveClaimedSessionFile(project: ProjectConfig): string | undefined {
+export function resolveClaimedSessionFile(
+  project: ProjectConfig,
+  alive?: (pid: number) => boolean,
+): string | undefined {
   const result = claimedTelegramTopics();
   if (result.kind !== "ok" || result.claims.length === 0) return undefined;
-  return claimForProject(result.claims, project.name)?.sessionFile;
+  return claimForProject(result.claims, project.name, alive)?.sessionFile;
 }
 
 /**
@@ -1111,7 +1129,7 @@ export type TelegramPlumbingScan = { dirs: readonly string[] };
  * Throwing is how `pidAlive` spells "dead", which is the contract it applies to
  * whatever this returns.
  */
-function killOf(alive: (pid: number) => boolean): (target: number, signal: number) => void {
+export function killOf(alive: (pid: number) => boolean): (target: number, signal: number) => void {
   return (target) => {
     if (!alive(target)) throw new Error("not alive");
   };