omp-conductor 0.19.6 → 0.20.0

package/src/fleet.ts

@@ -27,8 +27,10 @@ import { findProject, loadConfig, resolveArmProof, stateDir } from "./config.ts"
 import {
   clearArmTransaction,
   FLEET_ARM_KEY,
-  readArmAcknowledgement,
   recordArmChallenge,
+  resolveArmReply,
+  type ArmReplyVerdict,
+  type ArmTarget,
 } from "./arm-challenge.ts";
 import {
   claimedTelegramTopics,
@@ -283,19 +285,53 @@ export function disarmTicks(projectName?: string): { path: string; wasArmed: boo
   return { path, wasArmed };
 }
 
-export interface ArmResult {
-  path: string;
-  alreadyArmed: boolean;
-  owner: string;
-  /** The challenge code that proved arming, present only for `challenge` proof. */
-  challenge?: string;
+/** One project whose arm marker was written. */
+export interface ArmedProject {
   /**
-   * Which proof armed the fleet (#613): `challenge` for the authenticated
-   * round-trip, `claim-only` for the live-plumbing verdict with no send.
+   * The configured project name, absent only for a legacy unstamped
+   * single-project fleet.
    */
+  project?: string;
+  path: string;
+  alreadyArmed: boolean;
+}
+
+/** Markers written without any reply: the `claim-only` policy proof (#613). */
+export interface ArmMarkersWritten {
+  outcome: "armed";
   proof: ArmProof;
+  owner: string;
+  armed: ArmedProject[];
+}
+
+/**
+ * A challenge filed and sent, with nothing armed yet.
+ *
+ * Arming used to block here for up to five minutes on an in-session
+ * acknowledgement. With the console owning the operator DM, the reply lands in
+ * a session that runs no tick extension, so that wait could never be satisfied
+ * — it is now two mechanical steps, and this is the first one's receipt.
+ */
+export interface ArmChallengeSent {
+  outcome: "challenge-sent";
+  /** Always `challenge`: `claim-only` never sends, so it never reaches here. */
+  proof: "challenge";
+  /** The chat the challenge went to, recorded with the transaction. */
+  owner: string;
+  /** The pending transaction the reply must prove. */
+  challengeId: string;
+  /** Unix ms after which the code stops being a proof. */
+  expiresAt: number;
+  /** mm:ss the code stays good for — the same clock the message quotes. */
+  validFor: string;
+  /** Exactly what a matching reply will arm, as recorded with the challenge. */
+  targets: ArmTarget[];
+  /** The verbatim command that completes the ceremony, copy-pasteable as-is. */
+  followUp: string;
 }
 
+export type ArmResult = ArmMarkersWritten | ArmChallengeSent;
+
 export interface ArmDeps {
   sendChallenge?: (token: string, owner: string, text: string, topicId?: number) => Promise<void>;
   /**
@@ -307,7 +343,7 @@ export interface ArmDeps {
    */
   claimedSessionFile?: () => string | undefined;
   now?: () => number;
-  sleep?: (ms: number) => Promise<void>;
+  /** How long a sent code stays a proof. */
   timeoutMs?: number;
   /**
    * Liveness seams for the claim-only verdict (#613), with omp-telegram's own
@@ -321,11 +357,10 @@ export interface ArmDeps {
   lockPidAlive?: (pid: number) => boolean;
   lockFresh?: (mtimeMs: number) => boolean;
   /**
-   * Where the pending-proof heartbeat is written (#861). The challenge proof
-   * waits up to five minutes on a human, inside a fence that holds dispatch:
-   * without this, that wait is silent and a healthy process is indistinguishable
-   * from a dead one. Absent means no reporting — the callers that have a surface
-   * (the CLI, the wizard) pass theirs.
+   * Where the ceremony's one-line narration goes. Nothing waits any more, so
+   * this is no longer a liveness heartbeat (#861) — it is the send receipt and
+   * the follow-up instruction, for a surface that prints as it goes. Absent
+   * means no reporting.
    */
   progress?: (line: string) => void;
 }
@@ -367,31 +402,32 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
   // one pane that can ask. The challenge names which one, or the operator is
   // answering a question they cannot attribute.
   const named = tick.config.project ?? projectName;
-  // The handshake state key must be exactly what the orchestrator's inbound
-  // adapter computes: TickConfig.project, undefined for a legacy unstamped
-  // config. `named` may fall back to the CLI argument for the challenge text
-  // and config lookups; the state key must not — the adapter has no CLI
-  // argument to fall back to, and a mismatched key would make arming wait on
-  // an acknowledgement that can never be written.
+  // The handshake state key must be exactly what the reply step recomputes
+  // from this same tick config: TickConfig.project, undefined for a legacy
+  // unstamped config. `named` may fall back to the CLI argument for the
+  // challenge text and config lookups; the state key must not, or the reply
+  // would look for the challenge under a key nothing recorded.
   const stateKey = tick.config.project;
 
   // The arming proof is a declared per-project policy (#613). A config that
-  // cannot name the project fails safe to `challenge` — today's authenticated
+  // cannot name the project fails safe to `challenge` — the authenticated
   // round-trip — so a missing or unreadable config never silently weakens the
   // gate.
   let proof: ArmProof = DEFAULT_ARM_PROOF;
   try {
     proof = resolveArmProof(findProject(loadConfig(), named));
   } catch {
-    /* no project config — keep today's challenge behaviour */
+    /* no project config — keep the challenge behaviour */
   }
 
   // The orchestrator's live session file per omp-telegram's claim (#600) —
   // input to the claim-only verdict's session-identity checks below. The
-  // challenge proof never reads it: its acknowledgement is conductor state,
-  // so where (or whether) a transcript lives is no longer part of arming
-  // (#614).
-  const claimed = deps.claimedSessionFile !== undefined ? deps.claimedSessionFile() : claimedOrchestratorSessionFile(named);
+  // challenge proof never reads it: its proof is conductor state, so where (or
+  // whether) a transcript lives is no longer part of arming (#614).
+  const claimed =
+    deps.claimedSessionFile !== undefined
+      ? deps.claimedSessionFile()
+      : claimedOrchestratorSessionFile(named, deps.pidAlive ?? pidAlive);
 
   // Prefer the project's live forum topic so arm challenges land where
   // escalations already do (#318), following the bridge's current claim when the
@@ -399,24 +435,19 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
   let sendTopic: number | undefined;
   if (named !== undefined) {
     try {
-      sendTopic = resolveProjectTopicId(findProject(loadConfig(), named));
+      sendTopic = resolveProjectTopicId(findProject(loadConfig(), named), deps.pidAlive ?? pidAlive);
     } catch {
       /* no project config */
     }
   }
 
   const path = tick.config.armedFile;
-  // The gate as the heartbeat reads it, so "replaced previous marker" is not a
-  // lie about a fleet the shared marker was arming, and so the write below knows
-  // whether it is superseding that marker.
-  const arm = resolveArmState(path, named);
-  const alreadyArmed = arm.armed;
 
   if (proof === "claim-only") {
     // The human-intent gate is declared satisfied by policy, so #612's shared
     // verdict is the whole proof: the same state reads and the same liveness
     // rules the doctor's "telegram-plumbing" finding applies, on the route a
-    // challenge would have ridden. No Telegram send, no transcript wait, no
+    // challenge would have ridden. No Telegram send, no reply step, no
     // pending-challenge record. A failed fact refuses arming by name — never
     // a silent pass from file existence, and never a marker.
     const scan = armVerdictScanDirs(tick.cwd, claimed);
@@ -439,13 +470,23 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
           `NOT armed; no marker was written`,
       );
     }
+    // The gate as the heartbeat reads it, so "replaced previous marker" is not
+    // a lie about a fleet the shared marker was arming, and so the write knows
+    // whether it is superseding that marker.
+    const arm = resolveArmState(path, named);
     writeArmedMarker(path, channel.owner, arm);
-    return { path, alreadyArmed, owner: channel.owner, proof };
+    return {
+      outcome: "armed",
+      proof,
+      owner: channel.owner,
+      armed: [{ ...(named === undefined ? {} : { project: named }), path, alreadyArmed: arm.armed }],
+    };
   }
 
   const send = deps.sendChallenge ?? sendTelegramMessage;
   const timeoutMs = deps.timeoutMs ?? ARM_CHALLENGE_TIMEOUT_MS;
   const code = makeChallengeCode();
+  const followUp = armReplyCommand(projectName);
   // Self-describing (#991): with two live challenges in one chat the operator
   // was working out which was which from message order, and nothing said how
   // long a code stayed good — so the safe move was to scroll for the newest,
@@ -454,15 +495,18 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
     `Fleet arming check${named === undefined ? "" : ` — project ${named}`}. ` +
     `Reply to this chat with exactly:\n${code}\n` +
     `Valid for ${armClock(timeoutMs)}. ` +
-    `Nothing will be dispatched until that reply is seen in the orchestrator session.`;
+    `Nothing is dispatched until that reply is verified.`;
   const sentAt = (deps.now ?? Date.now)();
-  // The orchestrator's inbound adapter can only acknowledge an *active*
-  // challenge, so the authenticated pending record (hash + expiry, never the
-  // code) is written before the challenge goes out and settled the moment
-  // this end finishes (#415). The returned id pins the wait below: an
-  // acknowledgement can only ever name the currently-pending id, so replacing
-  // a challenge makes every prior acknowledgement inert.
-  const challengeId = recordArmChallenge(stateKey, code, sentAt, sentAt + timeoutMs);
+  // Recorded BEFORE the send, so a reply that beats this process's own return
+  // still finds an active challenge — and so a send that fails has a
+  // transaction to settle rather than a code loose in a chat (#415). The record
+  // carries what the reply will arm: the config could change before the
+  // operator answers, and arming anything but what the challenge named would
+  // arm a fleet nobody was asked about.
+  const challengeId = recordArmChallenge(stateKey, code, sentAt, sentAt + timeoutMs, {
+    targets: [{ ...(named === undefined ? {} : { project: named }), armedFile: path }],
+    owner: channel.owner,
+  });
   try {
     await send(token, channel.owner, text, sendTopic);
   } catch (err) {
@@ -473,50 +517,33 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
       `arm: outbound sendMessage failed — NOT armed: ${err instanceof Error ? err.message : String(err)}`,
     );
   }
-  // What is being waited on, before the wait starts: the window, the chat the
-  // reply has to land in, and the fact that dispatch is held until it does
-  // (#861). One line, so a five-minute wait opens with an explanation rather
-  // than with silence.
   deps.progress?.(
     `arm: challenge sent to ${channel.owner}${sendTopic === undefined ? "" : ` (topic ${sendTopic})`} — ` +
-      `waiting up to ${armClock(timeoutMs)} for the reply. Dispatch stays held until it arrives.`,
+      `valid for ${armClock(timeoutMs)}. Nothing is armed yet: run ${followUp}`,
   );
-
-  // Wait for the orchestrator's own acknowledgement — conductor state written
-  // by the inbound user-turn adapter when the real reply lands (#614). No
-  // transcript is read: the proof no longer depends on where (or whether) a
-  // session file lives, which is exactly the discovery that mis-fired on the
-  // host three times (#614). A wrong-project or lookalike reply writes no
-  // acknowledgement, so the window simply runs out fail-closed.
-  if (!(await waitForArmAcknowledgement(challengeId, timeoutMs, deps))) {
-    clearArmTransaction(stateKey, challengeId);
-    throw new Error(
-      `arm: the challenge was never acknowledged in time — NOT armed.\n` +
-        `The orchestrator's inbound adapter acknowledges the reply when it lands as a user turn; ` +
-        `no acknowledgement for challenge ${challengeId} arrived.\n` +
-        `Inbound Telegram is not reaching the omp session. Check, in order:\n` +
-        `  * is the bridge polling?      attach and run: /telegram status\n` +
-        `  * is another process holding this bot token? Telegram allows exactly one\n` +
-        `    getUpdates consumer and rejects the second with HTTP 409.\n` +
-        `  * did you reply in the DM with the bot, not another chat?\n`,
-    );
-  }
-
-  writeArmedMarker(path, channel.owner, arm);
-  // The acknowledgement landed and this project is armed: settling clears this
-  // transaction's pending record and acknowledgement — never a newer
-  // replacement's — so a later unsolicited lookalike stays inert past this
-  // handshake.
-  clearArmTransaction(stateKey, challengeId);
-  return { path, alreadyArmed, owner: channel.owner, challenge: code, proof };
+  return {
+    outcome: "challenge-sent",
+    proof: "challenge",
+    owner: channel.owner,
+    challengeId,
+    expiresAt: sentAt + timeoutMs,
+    validFor: armClock(timeoutMs),
+    targets: [{ ...(named === undefined ? {} : { project: named }), armedFile: path }],
+    followUp,
+  };
 }
 
-export interface FleetArmResult {
-  /** Every project this ceremony armed, in configuration order. */
-  armed: { project: string; path: string; alreadyArmed: boolean }[];
-  owner: string;
-  /** The transaction the single reply proved. */
-  challengeId: string;
+/**
+ * The second half of the ceremony, verbatim. Printed by every surface that
+ * issues a challenge, and quoted in the refusals, because an agent reading a
+ * console pane has to be able to paste it without composing anything: the
+ * operator's message is the only variable.
+ */
+function armReplyCommand(projectName?: string): string {
+  return (
+    `omp-conductor arm --reply "<the operator's reply, verbatim>"` +
+    `${projectName === undefined ? "" : ` --project ${projectName}`}`
+  );
 }
 
 /**
@@ -524,10 +551,9 @@ export interface FleetArmResult {
  *
  * Arming was per project: a two-project fleet meant two sequential handshakes
  * with two codes in one chat, though nothing about the fleet's state differed
- * between them. This sends **one** challenge and arms every configured project
- * from the single matching reply — which is a fleet-wide pending record, not a
- * loop that sends N challenges and waits for N replies. That loop is the
- * current friction with one command wrapped around it.
+ * between them. This sends **one** challenge whose single matching reply arms
+ * every configured project — one fleet-wide pending record, not a loop that
+ * sends N challenges and collects N replies.
  *
  * Every project is validated before anything is sent, so a fleet whose second
  * project has no `armedFile` refuses the ceremony instead of arming the first
@@ -538,11 +564,14 @@ export interface FleetArmResult {
  * authenticated round-trip is strictly stronger than the plumbing verdict that
  * policy would have accepted, so satisfying the weaker gate with the stronger
  * proof cannot weaken it.
+ *
+ * Like {@link armTicks}, this returns as soon as the challenge is filed and
+ * sent: `omp-conductor arm --reply` writes the markers.
  */
 export async function armFleet(
   projectNames: readonly string[],
   deps: ArmDeps = {},
-): Promise<FleetArmResult> {
+): Promise<ArmChallengeSent> {
   if (projectNames.length === 0) throw new Error("arm: no projects are configured");
 
   // Resolve and validate every project first. Nothing is sent and no marker is
@@ -593,8 +622,8 @@ export async function armFleet(
 
   // The first project that resolves a live topic carries the ceremony, and the
   // message says so: a fleet-wide question still has to land somewhere an
-  // operator is reading, and every session's adapter can acknowledge it because
-  // the pending record is fleet-wide rather than topic-scoped.
+  // operator is reading, and the reply step reaches the record from any project
+  // because it is fleet-wide rather than topic-scoped.
   let sendTopic: number | undefined;
   for (const target of targets) {
     try {
@@ -609,14 +638,28 @@ export async function armFleet(
   const timeoutMs = deps.timeoutMs ?? ARM_CHALLENGE_TIMEOUT_MS;
   const code = makeChallengeCode();
   const names = targets.map((t) => t.project).join(", ");
+  // No `--project`: the reply resolves the fleet record, which is the one this
+  // ceremony wrote. Naming a project here would be a narrower command than the
+  // challenge the operator answered.
+  const followUp = armReplyCommand();
   const text =
     `Fleet arming check — ${String(targets.length)} project(s): ${names}. ` +
     `Reply to this chat with exactly:\n${code}\n` +
     `Valid for ${armClock(timeoutMs)}, and one reply arms all of them. ` +
-    `Nothing will be dispatched until that reply is seen in the orchestrator session.`;
+    `Nothing is dispatched until that reply is verified.`;
 
   const sentAt = (deps.now ?? Date.now)();
-  const challengeId = recordArmChallenge(FLEET_ARM_KEY, code, sentAt, sentAt + timeoutMs);
+  // The record carries every project the message named, so the reply arms
+  // exactly the fleet the operator was asked about — not whatever the config
+  // says minutes later.
+  const armTargets: ArmTarget[] = targets.map((target) => ({
+    project: target.project,
+    armedFile: target.armedFile,
+  }));
+  const challengeId = recordArmChallenge(FLEET_ARM_KEY, code, sentAt, sentAt + timeoutMs, {
+    targets: armTargets,
+    owner: channel.owner,
+  });
   try {
     await send(token, channel.owner, text, sendTopic);
   } catch (err) {
@@ -627,31 +670,169 @@ export async function armFleet(
   }
   deps.progress?.(
     `arm: one challenge sent to ${channel.owner}${sendTopic === undefined ? "" : ` (topic ${sendTopic})`} for ${names} — ` +
-      `waiting up to ${armClock(timeoutMs)} for the reply. Dispatch stays held until it arrives.`,
+      `valid for ${armClock(timeoutMs)}. Nothing is armed yet: run ${followUp}`,
   );
+  return {
+    outcome: "challenge-sent",
+    proof: "challenge",
+    owner: channel.owner,
+    challengeId,
+    expiresAt: sentAt + timeoutMs,
+    validFor: armClock(timeoutMs),
+    targets: armTargets,
+    followUp,
+  };
+}
 
-  if (!(await waitForArmAcknowledgement(challengeId, timeoutMs, deps))) {
-    clearArmTransaction(FLEET_ARM_KEY, challengeId);
-    throw new Error(
-      `arm: the fleet challenge was never acknowledged in time — NOTHING armed.\n` +
-        `No acknowledgement for challenge ${challengeId} arrived, so no project's marker was written.\n` +
-        `Inbound Telegram is not reaching the omp session. Check, in order:\n` +
-        `  * is the bridge polling?      attach and run: /telegram status\n` +
-        `  * is another process holding this bot token? Telegram allows exactly one\n` +
-        `    getUpdates consumer and rejects the second with HTTP 409.\n` +
-        `  * did you reply in the chat the challenge names, not another one?\n`,
-    );
-  }
+/** What a reply that armed nothing was, and what to do about it. */
+export interface ArmReplyRefused {
+  outcome: "refused";
+  /** Never `matched`: a match is the armed outcome. */
+  verdict: Exclude<ArmReplyVerdict, "matched">;
+  /** One operator-facing sentence naming the verdict and the next move. */
+  message: string;
+}
 
-  // Proven once, applied to every project. Markers are written after the proof,
-  // so a refused ceremony leaves the fleet exactly as it was.
+export interface ArmReplyAccepted {
+  outcome: "armed";
+  /** The chat the proved challenge was sent to — the marker's `owner=`. */
+  owner: string;
+  /** The transaction the reply proved and this call settled. */
+  challengeId: string;
+  /** Every project the challenge recorded, now armed. */
+  armed: ArmedProject[];
+}
+
+export type ArmReplyResult = ArmReplyAccepted | ArmReplyRefused;
+
+/**
+ * The verification half of the ceremony: classify the operator's verbatim
+ * message and, on a match, arm exactly the projects the challenge recorded.
+ *
+ * This runs in the console session, which is where the operator's reply lands
+ * now that it owns the Telegram DM. No session waits for anything: the
+ * challenge is durable state, so the two halves are ordinary commands that can
+ * run minutes apart in different processes.
+ *
+ * The security properties are the send half's, unchanged. Only the project's
+ * own record and the fleet record are read (no other project's ceremony can be
+ * revealed or consumed), an expired record is never a proof, and a marker is
+ * written only for a `matched` verdict — every other verdict returns a refusal
+ * having written nothing.
+ */
+export function armReply(
+  replyText: string,
+  projectName?: string,
+  deps: Pick<ArmDeps, "now"> = {},
+): ArmReplyResult {
+  const tick = resolveTickConfig(projectName);
+  if (tick.kind === "invalid") {
+    // Every derivation below would come from this file. A config that does not
+    // parse cannot be trusted to name a state key or a marker.
+    throw new Error(`tick config invalid at ${tick.path}: ${tick.problem}`);
+  }
+  // An absent config is not fatal here, which is the difference between the two
+  // halves: a fleet ceremony's record carries its own targets, and on a
+  // multi-project host the search roots for an unnamed project resolve no
+  // config at all (the fleet cwds each carry their own). Refusing here would
+  // make `arm --reply` unusable for exactly the ceremony that needs it most.
+  const config = tick.kind === "ok" ? tick.config : undefined;
+  // The same derivation the send half used, from the same file: the state key
+  // is TickConfig.project (undefined for a legacy unstamped config), never the
+  // CLI argument, or the reply would look under a key nothing recorded.
+  const stateKey = config?.project;
+  const now = (deps.now ?? Date.now)();
+  const resolved = resolveArmReply(stateKey, replyText, now);
+  if (resolved.verdict !== "matched") {
+    return {
+      outcome: "refused",
+      verdict: resolved.verdict,
+      message: armRefusalText(resolved.verdict, projectName),
+    };
+  }
+  const match = resolved.match;
+  // Recorded targets are the contract. A record written before targets existed
+  // (one release of overlap) can only be read as naming the project it is keyed
+  // under — or, for the fleet record, the project this command was given, since
+  // re-deriving the fleet from today's config could arm a project the operator
+  // was never asked about.
+  const targets: ArmTarget[] = match.targets ?? [legacyArmTarget(config, projectName)];
+  // The owner the challenge was actually sent to. Only a pre-targets record
+  // lacks it, and then the paired channel is the only other honest source.
+  const owner = match.owner ?? pairedChannelOwner(config?.accessFile);
   const armed = targets.map((target) => {
     const state = resolveArmState(target.armedFile, target.project);
-    writeArmedMarker(target.armedFile, channel.owner, state);
-    return { project: target.project, path: target.armedFile, alreadyArmed: state.armed };
+    writeArmedMarker(target.armedFile, owner, state);
+    return {
+      ...(target.project === undefined ? {} : { project: target.project }),
+      path: target.armedFile,
+      alreadyArmed: state.armed,
+    };
   });
-  clearArmTransaction(FLEET_ARM_KEY, challengeId);
-  return { armed, owner: channel.owner, challengeId };
+  // Settled by id against the key that matched, so a replayed reply cannot arm
+  // a second time and a newer replacement's record is never removed.
+  clearArmTransaction(match.key, match.id);
+  return { outcome: "armed", owner, challengeId: match.id, armed };
+}
+
+/**
+ * What a pre-targets pending record arms. The tick config that resolved the
+ * state key also names this project's marker, which is exactly what the send
+ * half would have recorded. Without such a config there is nothing to fall back
+ * to, and guessing a marker path is not an option — a challenge from before the
+ * upgrade is simply re-run.
+ */
+function legacyArmTarget(config: TickConfig | undefined, projectName?: string): ArmTarget {
+  const named = config?.project ?? projectName;
+  if (config?.armedFile === undefined) {
+    throw new Error(
+      `arm: the pending challenge names no targets and no readable ${TICK_CONFIG_FILE} names an armedFile — ` +
+        `nothing to arm; re-run \`omp-conductor arm\` for a challenge that records its own targets`,
+    );
+  }
+  return { ...(named === undefined ? {} : { project: named }), armedFile: config.armedFile };
+}
+
+/** The paired owner, for the one record shape that does not carry its own. */
+function pairedChannelOwner(accessFile: string | undefined): string {
+  if (accessFile === undefined) {
+    throw new Error(`${TICK_CONFIG_FILE} has no accessFile — the challenge's owner cannot be established`);
+  }
+  const channel = readPairedChannel(accessFile);
+  if (channel.kind === "down") {
+    throw new Error(
+      `escalation channel is not up (${accessFile}): ${channel.reason} — ` +
+        `this challenge predates owner recording, so the marker cannot name whom it armed`,
+    );
+  }
+  return channel.owner;
+}
+
+/**
+ * Each non-matching verdict in the operator's words, with the next move. A
+ * silent no-op was the old failure mode: the operator could not tell a wrong
+ * code from an expired one from a command that never looked.
+ */
+function armRefusalText(verdict: Exclude<ArmReplyVerdict, "matched">, projectName?: string): string {
+  const reissue = `omp-conductor arm${projectName === undefined ? "" : ` --project ${projectName}`}`;
+  switch (verdict) {
+    case "expired":
+      return (
+        `arm: that code belongs to a challenge whose window has closed — NOT armed, no marker written. ` +
+        `An expired code is never a proof: send a fresh challenge with \`${reissue}\` and verify that one.`
+      );
+    case "unknown":
+      return (
+        `arm: that message carries an arming code, but no live challenge here matches it — NOT armed, ` +
+        `no marker written. Only this project's own challenge and the fleet ceremony are ever consulted. ` +
+        `Send a challenge with \`${reissue}\` and reply to that one.`
+      );
+    case "none":
+      return (
+        `arm: that message contains no arming code at all — NOT armed, no marker written. ` +
+        `Pass the operator's reply verbatim, including the FLEET-… code; if none was sent, run \`${reissue}\` first.`
+      );
+  }
 }
 
 export interface HoldResult {
@@ -907,10 +1088,17 @@ export interface WorkerPaneIdentity {
   sessionFile?: string;
 }
 
-/** A tracked pane, or the explicit reason there is none. Never a silent claim. */
+/** A tracked pane, or the explicit reason there is none. Never a silent claim.
+ *  The tracked variant names the marked workspace the representation lives in,
+ *  so a caller that just created one can protect it from the same pass's
+ *  empty-workspace cleanup. `phase` names the step that refused — `"split"`
+ *  marks the one failure the re-establishment budget spends whole (#998): a
+ *  terminal that refuses to split will refuse every retry within the pass, so
+ *  burning the budget once beats leaking an attempt per reconciliation pass
+ *  against a wall. */
 export type WorkerPaneOutcome =
-  | { kind: "tracked"; paneId: string; label: string; pid: number }
-  | { kind: "unavailable"; reason: string };
+  | { kind: "tracked"; paneId: string; label: string; pid: number; workspaceId?: string }
+  | { kind: "unavailable"; reason: string; phase?: "split" };
 
 /** One `herdr` invocation, injected so every path is testable with no terminal. */
 export type HerdrRun = (args: readonly string[]) => { ok: boolean; stdout: string; stderr: string };
@@ -920,6 +1108,9 @@ export interface WorkerPaneDeps {
   session?: string;
   /** The follower command the pane displays; the CLI by default. */
   viewer?: (identity: WorkerPaneIdentity) => readonly string[];
+  /** The durable ownership half of workspace discovery (#1035 review);
+   *  production wires the conductor store, tests a recorder. */
+  ownership?: WorkspaceOwnership;
 }
 
 /**
@@ -932,9 +1123,13 @@ export interface WorkerPaneDeps {
 /**
  * The external-supervisor source every conductor pane report carries.
  *
- * This, not the label, is what proves a pane is conductor's: it is written by
- * `openWorkerPane` and read back by {@link listWorkerPanes}, so the two halves
- * of reconciliation cannot come to disagree about what "ours" means.
+ * Written onto every pane conductor reports against. It is no longer what
+ * proves a pane is conductor's: production repeatedly handed back panes whose
+ * `agent_session` record Herdr had dropped (#1035), so filtering by reported
+ * source quietly exempted exactly the panes that needed cleaning. Ownership is
+ * structural now — conductor creates representations only inside a workspace
+ * it marked itself (see {@link WORKER_WORKSPACE_TOKEN}) — and this source
+ * remains on the reports as the display identity of who speaks for a pane.
  */
 export const WORKER_PANE_SOURCE = "omp-conductor";
 
@@ -950,6 +1145,26 @@ export const WORKER_PANE_SOURCE = "omp-conductor";
  */
 export const PANE_REATTEMPT_MAX = 3;
 
+/**
+ * The workspace metadata token that marks a workspace as conductor's
+ * per-project worker surface (#1035).
+ *
+ * Written once at creation (`workspace report-metadata --token
+ * conductor_workers=<project>`) and read back from `workspace list`, so
+ * rediscovery survives daemon and Herdr restarts without trusting the label,
+ * the sidebar position, or whichever workspace happens to be focused. Only
+ * panes inside a marked workspace are ever reconciled here, which is what makes
+ * the operator's own panes invisible to this surface by construction — and
+ * what makes every pane inside a marked workspace conductor's, however Herdr
+ * feels about reporting `agent_session` back.
+ */
+export const WORKER_WORKSPACE_TOKEN = "conductor_workers";
+
+/** The dedicated sibling workspace's display label. Never identity. */
+export function workerWorkspaceLabel(project: string): string {
+  return `${project}-workers`;
+}
+
 export function workerPaneLabel(identity: WorkerPaneIdentity): string {
   return `worker-${identity.project}-${identity.issue}-a${identity.attempt}-${identity.runId.slice(0, 8)}`;
 }
@@ -997,41 +1212,402 @@ function parsePaneId(stdout: string): string | undefined {
   return typeof paneId === "string" && paneId.trim() !== "" ? paneId.trim() : undefined;
 }
 
+/**
+ * The workspace and root-pane ids inside `herdr workspace create`'s answer
+ * (`{"id":"cli:workspace:create","result":{"workspace":{…},"root_pane":{…}}}`).
+ * The root pane is the anchor every later split targets, so a create answer
+ * without one is only half a workspace — the caller cleans it up rather than
+ * guessing at a pane to split.
+ */
+function parseCreatedWorkspace(stdout: string): { workspaceId: string; rootPaneId?: string } | undefined {
+  const result = envelopeOf(stdout);
+  if (result === undefined) return undefined;
+  const workspace = result["workspace"];
+  if (workspace === null || typeof workspace !== "object") return undefined;
+  const workspaceId = (workspace as Record<string, unknown>)["workspace_id"];
+  if (typeof workspaceId !== "string" || workspaceId.trim() === "") return undefined;
+  const root = (result as Record<string, unknown>)["root_pane"];
+  const rootPaneId =
+    root !== null && typeof root === "object"
+      ? (root as Record<string, unknown>)["pane_id"]
+      : undefined;
+  return {
+    workspaceId: workspaceId.trim(),
+    ...(typeof rootPaneId === "string" && rootPaneId.trim() !== "" ? { rootPaneId: rootPaneId.trim() } : {}),
+  };
+}
+
+/** The `{result: …}` object of a herdr CLI envelope, or nothing. */
+
+function envelopeOf(stdout: string): Record<string, unknown> | undefined {
+  const line = firstLine(stdout);
+  if (line === "") return undefined;
+  let payload: unknown;
+  try {
+    payload = JSON.parse(line);
+  } catch {
+    return undefined;
+  }
+  if (payload === null || typeof payload !== "object") return undefined;
+  const result = (payload as Record<string, unknown>)["result"];
+  return result === null || typeof result !== "object" ? undefined : (result as Record<string, unknown>);
+}
+
+/** The root-pane id inside a `tab create` answer (`result.root_pane.pane_id`):
+ *  a tab answer carries no workspace object, so {@link parseCreatedWorkspace}
+ *  cannot read it. */
+function parseRootPane(stdout: string): string | undefined {
+  const result = envelopeOf(stdout);
+  const root = result?.["root_pane"];
+  const paneId =
+    root !== null && typeof root === "object" ? (root as Record<string, unknown>)["pane_id"] : undefined;
+  return typeof paneId === "string" && paneId.trim() !== "" ? paneId.trim() : undefined;
+}
+
+/** Every workspace in a `workspace list` answer, with the tokens ownership is read from. */
+function parseWorkspaceList(stdout: string): { workspaces: { workspaceId: string; label?: string; tokens: Record<string, string> }[] } | undefined {
+  const result = envelopeOf(stdout);
+  const raw = result?.["workspaces"];
+  if (!Array.isArray(raw)) return undefined;
+  const workspaces: { workspaceId: string; label?: string; tokens: Record<string, string> }[] = [];
+  for (const entry of raw) {
+    if (entry === null || typeof entry !== "object") continue;
+    const w = entry as Record<string, unknown>;
+    if (typeof w["workspace_id"] !== "string" || w["workspace_id"].trim() === "") continue;
+    const tokens: Record<string, string> = {};
+    if (w["tokens"] !== null && typeof w["tokens"] === "object") {
+      for (const [name, value] of Object.entries(w["tokens"] as Record<string, unknown>)) {
+        if (typeof value === "string") tokens[name] = value;
+      }
+    }
+    workspaces.push({
+      workspaceId: w["workspace_id"],
+      ...(typeof w["label"] === "string" ? { label: w["label"] } : {}),
+      tokens,
+    });
+  }
+  return { workspaces };
+}
+
+/** One pane record out of any `pane list` answer — global or `--workspace`-scoped. */
+export interface ListedPane {
+  paneId: string;
+  /** The run id Herdr still reports for this pane, or "" when it reports none. */
+  runId: string;
+  agent?: string;
+  workspaceId?: string;
+}
+
+/** The panes of a `pane list` answer, carrying whichever fields reconciliation reads. */
+function parsePaneRecords(stdout: string): { panes: ListedPane[] } | undefined {
+  const result = envelopeOf(stdout);
+  const raw = result?.["panes"];
+  if (!Array.isArray(raw)) return undefined;
+  const panes: ListedPane[] = [];
+  for (const entry of raw) {
+    if (entry === null || typeof entry !== "object") continue;
+    const p = entry as Record<string, unknown>;
+    if (typeof p["pane_id"] !== "string" || p["pane_id"].trim() === "") continue;
+    const session = p["agent_session"];
+    const source = session !== null && typeof session === "object" ? (session as Record<string, unknown>)["source"] : undefined;
+    const value = session !== null && typeof session === "object" ? (session as Record<string, unknown>)["value"] : undefined;
+    panes.push({
+      paneId: p["pane_id"].trim(),
+      // Ours by construction inside a marked workspace; the reported session id
+      // is a secondary signal only (#1035), because Herdr has been observed to
+      // drop it while the pane lives on.
+      runId: typeof value === "string" && source === WORKER_PANE_SOURCE ? value : "",
+      ...(typeof p["agent"] === "string" ? { agent: p["agent"] } : {}),
+      ...(typeof p["workspace_id"] === "string" ? { workspaceId: p["workspace_id"] } : {}),
+    });
+  }
+  return { panes };
+}
+
+/** One conductor-marked worker workspace, as discovery returns it. */
+export interface WorkerWorkspace {
+  workspaceId: string;
+  /** The project the marking token binds it to — never derived from the label. */
+  project: string;
+  label?: string;
+}
+
+/**
+ * The durable half of worker-workspace discovery (#1035 review).
+ *
+ * Herdr restores a session's workspaces and panes across a server restart but
+ * drops `report-metadata` tokens — probed live: the restored worker workspace
+ * comes back carrying no tokens at all. Token-only discovery would then ignore
+ * the surface conductor created, build a duplicate beside it, and never be
+ * able to reconcile or remove the restored one's stale panes — exactly the
+ * accumulation this issue exists to end. Ownership is therefore two-legged:
+ * the live token AND the conductor-store record of workspace ids the project
+ * created. Either leg proves ownership; the store is the leg that survives.
+ */
+export interface WorkspaceOwnership {
+  /** Store-recorded workspace ids for a project, oldest first. */
+  recordedWorkspaces(project: string): readonly string[];
+  rememberWorkspace(project: string, workspaceId: string): void;
+  forgetWorkspace(project: string, workspaceId: string): void;
+}
+
+/** Every workspace in a `workspace list` answer, marked or not. */
+function listWorkspacesRaw(
+  deps: { run?: HerdrRun; session?: string } = {},
+): {
+  ok: true;
+  workspaces: { workspaceId: string; label?: string; tokens: Record<string, string> }[];
+} | { ok: false; reason: string } {
+  const run = deps.run ?? realHerdrRun;
+  const session = deps.session ?? resolveHerdrSession();
+  const res = run(["--session", session, "workspace", "list"]);
+  if (!res.ok) {
+    return { ok: false, reason: `herdr workspace list failed: ${firstLine(res.stderr) || "no output"}` };
+  }
+  const parsed = parseWorkspaceList(res.stdout);
+  if (parsed === undefined) return { ok: false, reason: "herdr workspace list was unreadable" };
+  return { ok: true, workspaces: parsed.workspaces };
+}
+
+/**
+ * Every conductor-marked worker workspace Herdr currently has, keyed by nothing:
+ * the caller filters and scopes. Discovery reads the token, not the label — a
+ * renamed workspace is still ours, and a lookalike label without the token is
+ * not (#1035).
+ */
+export function listWorkerWorkspaces(deps: { run?: HerdrRun; session?: string } = {}): {
+  ok: true;
+  workspaces: WorkerWorkspace[];
+} | { ok: false; reason: string } {
+  const listed = listWorkspacesRaw(deps);
+  if (!listed.ok) return listed;
+  const workspaces: WorkerWorkspace[] = [];
+  for (const w of listed.workspaces) {
+    const project = w.tokens[WORKER_WORKSPACE_TOKEN];
+    if (project === undefined || project.trim() === "") continue;
+    workspaces.push({
+      workspaceId: w.workspaceId,
+      project: project.trim(),
+      ...(w.label === undefined ? {} : { label: w.label }),
+    });
+  }
+  return { ok: true, workspaces };
+}
+
+/**
+ * Every worker workspace these projects own on the live Herdr (#1035 review):
+ * token-marked ones plus store-recorded ids that still exist. A recorded id
+ * Herdr no longer lists is dead weight rather than evidence — its workspace is
+ * gone, and reconciliation's removal path is what forgets it.
+ */
+export function ownedWorkerWorkspaces(
+  projects: readonly string[],
+  deps: { run?: HerdrRun; session?: string; ownership?: WorkspaceOwnership } = {},
+): { ok: true; workspaces: WorkerWorkspace[] } | { ok: false; reason: string } {
+  const raw = listWorkspacesRaw(deps);
+  if (!raw.ok) return raw;
+  const scope = new Set(projects);
+  const owned = new Map<string, WorkerWorkspace>();
+  for (const w of raw.workspaces) {
+    const project = w.tokens[WORKER_WORKSPACE_TOKEN]?.trim();
+    if (project === undefined || project === "" || !scope.has(project)) continue;
+    owned.set(w.workspaceId, {
+      workspaceId: w.workspaceId,
+      project,
+      ...(w.label === undefined ? {} : { label: w.label }),
+    });
+    // Adopt token-owned surfaces into the durable leg even when no pane needs
+    // opening this pass. Otherwise an upgrade followed by a Herdr restart can
+    // drop the token before ensureWorkerWorkspace ever records the workspace.
+    deps.ownership?.rememberWorkspace(project, w.workspaceId);
+  }
+  for (const project of projects) {
+    for (const id of deps.ownership?.recordedWorkspaces(project) ?? []) {
+      if (owned.has(id)) continue;
+      const hit = raw.workspaces.find((w) => w.workspaceId === id);
+      if (hit === undefined) {
+        // The workspace disappeared outside conductor. Forget the stale id now
+        // so a future Herdr session cannot reuse it as false ownership.
+        deps.ownership?.forgetWorkspace(project, id);
+        continue;
+      }
+      owned.set(id, { workspaceId: id, project, ...(hit.label === undefined ? {} : { label: hit.label }) });
+    }
+  }
+  return { ok: true, workspaces: [...owned.values()] };
+}
+
+export type WorkerWorkspaceResolution =
+  | { kind: "ready"; workspaceId: string; anchorPaneId: string; created?: true }
+  | { kind: "unavailable"; reason: string };
+
+/**
+ * Find this project's worker workspace or create it — the single door every
+ * split goes through (#1035).
+ *
+ * Identity is two-legged now (#1035 review): the marking token OR the
+ * conductor-store record, so rediscovery after any restart finds the same
+ * workspace whatever Herdr preserved. Duplicates are deliberately NOT
+ * resolved here: closing one blind — without listing its panes or checking
+ * the result — could destroy the only live representation and strand the
+ * durable row pointing at a dead pane. Convergence belongs to
+ * {@link reconcileWorkerPanes}, which attributes every pane first and removes
+ * a duplicate only once nothing living holds it. A discovered workspace with
+ * no panes gets a fresh tab rather than failing forever; a workspace CREATED
+ * by this call is closed again on every later failure, because newly-made
+ * residue is exactly what the acceptance criterion forbids.
+ */
+export function ensureWorkerWorkspace(
+  project: string,
+  deps: { run?: HerdrRun; session?: string; ownership?: WorkspaceOwnership } = {},
+): WorkerWorkspaceResolution {
+  const run = deps.run ?? realHerdrRun;
+  const session = deps.session ?? resolveHerdrSession();
+  const base = ["--session", session];
+
+  let listed = ownedWorkerWorkspaces([project], deps);
+  if (!listed.ok) return { kind: "unavailable", reason: listed.reason };
+
+  for (const existing of [...listed.workspaces].sort((a, b) => (a.workspaceId < b.workspaceId ? -1 : 1))) {
+    const res = run([...base, "pane", "list", "--workspace", existing.workspaceId]);
+    if (!res.ok) {
+      return { kind: "unavailable", reason: `herdr pane list failed: ${firstLine(res.stderr) || "no output"}` };
+    }
+    const parsed = parsePaneRecords(res.stdout);
+    if (parsed === undefined) return { kind: "unavailable", reason: "herdr pane list was unreadable" };
+    let anchor = parsed.panes[0]?.paneId;
+    if (anchor === undefined) {
+      // No pane to split: give the workspace a fresh tab and use its root pane.
+      const tabbed = run([...base, "tab", "create", "--workspace", existing.workspaceId, "--no-focus"]);
+      if (!tabbed.ok) {
+        return { kind: "unavailable", reason: `herdr tab create failed: ${firstLine(tabbed.stderr) || "no output"}` };
+      }
+      anchor = parseRootPane(tabbed.stdout);
+      if (anchor === undefined) {
+        return { kind: "unavailable", reason: "herdr tab create reported no root pane" };
+      }
+    }
+    // Adopted into the store: if this workspace's token is what Herdr drops
+    // next restart, the record below is what still finds it.
+    deps.ownership?.rememberWorkspace(project, existing.workspaceId);
+    return { kind: "ready", workspaceId: existing.workspaceId, anchorPaneId: anchor };
+  }
+
+  const made = run([
+    ...base,
+    "workspace",
+    "create",
+    "--label",
+    workerWorkspaceLabel(project),
+    "--no-focus",
+  ]);
+  if (!made.ok) {
+    return { kind: "unavailable", reason: `herdr workspace create failed: ${firstLine(made.stderr) || "no output"}` };
+  }
+  const parsed = parseCreatedWorkspace(made.stdout);
+  if (parsed === undefined) {
+    return { kind: "unavailable", reason: "herdr workspace create reported no workspace id" };
+  }
+  /** This attempt made the workspace, so every exit from here takes it back. */
+  const discardMade = (): void => {
+    run([...base, "workspace", "close", parsed.workspaceId]);
+    deps.ownership?.forgetWorkspace(project, parsed.workspaceId);
+  };
+  // Mark before use: an unmarked workspace would be invisible to token-side
+  // discovery on the next pass — an empty shell accumulating precisely as
+  // #1035 describes. A failure here takes the half-made workspace with it.
+  const marked = run([
+    ...base,
+    "workspace",
+    "report-metadata",
+    parsed.workspaceId,
+    "--source",
+    WORKER_PANE_SOURCE,
+    "--token",
+    `${WORKER_WORKSPACE_TOKEN}=${project}`,
+  ]);
+  if (!marked.ok) {
+    discardMade();
+    return {
+      kind: "unavailable",
+      reason: `herdr workspace report-metadata failed: ${firstLine(marked.stderr) || "no output"}`,
+    };
+  }
+  if (parsed.rootPaneId === undefined) {
+    // No anchor means no split can ever be targeted; a fresh-made workspace
+    // without one is residue this very attempt must not leave behind
+    // (#1035 review) — so it goes now, not on some later pass.
+    discardMade();
+    return { kind: "unavailable", reason: "herdr workspace create reported no root pane" };
+  }
+  deps.ownership?.rememberWorkspace(project, parsed.workspaceId);
+  return { kind: "ready", workspaceId: parsed.workspaceId, anchorPaneId: parsed.rootPaneId, created: true };
+}
+
 /**
  * Create the pane, run the follower in it, and report the child's identity and
  * initial state — or say exactly why it could not.
  *
- * Every step is checked, and the first failure returns `unavailable` with the
- * reason — and closes the pane the split had already created, because a
- * partially established representation is worse than none: it is a pane the
- * operator would read as a tracked worker, and before #992 it was left behind
- * on every single launch. What this deliberately does NOT do is decide what a
- * failure means for the launch — failing closed versus running degraded is
- * #841's policy, and inventing it here would pre-empt it.
+ * The representation lives in the project's worker workspace (#1035), found or
+ * created first, and the split targets an anchor pane inside it explicitly, so
+ * the operator's own layout is never touched. Every step is checked, and the
+ * first failure returns `unavailable` with the reason and leaves ZERO residue
+ * of this attempt (#1035 review): the pane the split had already created is
+ * closed, and a workspace this call CREATED is closed with it — only surfaces
+ * that already existed are preserved. A partially established representation
+ * is worse than none: it is a pane the operator would read as a tracked
+ * worker, and before #992 it was left behind on every single launch. What
+ * this deliberately does NOT do is decide what a failure means for the launch
+ * — failing closed versus running degraded is #841's policy, and inventing it
+ * here would pre-empt it.
  */
 export function openWorkerPane(identity: WorkerPaneIdentity, deps: WorkerPaneDeps = {}): WorkerPaneOutcome {
   const run = deps.run ?? realHerdrRun;
   const session = deps.session ?? resolveHerdrSession();
   const label = workerPaneLabel(identity);
+  const ensured = ensureWorkerWorkspace(identity.project, deps);
+  if (ensured.kind === "unavailable") return ensured;
   const base = ["--session", session, "pane"];
 
-  const split = run([...base, "split", "--direction", "down", "--ratio", "0.3"]);
+  /** Undo everything this attempt built so far — the split's pane once there
+   *  is one, and always a workspace this call itself created (#1035 review). */
+  const abandon = (reason: string, phase?: "split", paneId?: string): WorkerPaneOutcome => {
+    if (paneId !== undefined) run([...base, "close", paneId]);
+    if (ensured.created === true) {
+      run(["--session", session, "workspace", "close", ensured.workspaceId]);
+      deps.ownership?.forgetWorkspace(identity.project, ensured.workspaceId);
+    }
+    return { kind: "unavailable", reason, ...(phase === undefined ? {} : { phase }) };
+  };
+
+  // The explicit target is the whole point (#1035): the split names a pane
+  // inside the worker workspace, so whichever pane the operator happens to be
+  // looking at is never touched.
+  const split = run([
+    ...base,
+    "split",
+    "--pane",
+    ensured.anchorPaneId,
+    "--direction",
+    "down",
+    "--ratio",
+    "0.3",
+    "--no-focus",
+  ]);
   if (!split.ok) {
-    return { kind: "unavailable", reason: `herdr pane split failed: ${firstLine(split.stderr) || "no output"}` };
+    return abandon(
+      `herdr pane split failed: ${firstLine(split.stderr) || "no output"}`,
+      "split",
+    );
   }
   const paneId = parsePaneId(split.stdout);
   if (paneId === undefined) {
-    return { kind: "unavailable", reason: "herdr pane split reported no pane id" };
+    return abandon("herdr pane split reported no pane id");
   }
-  // The split has created a pane. From here every exit must take it with it.
-  const abandon = (reason: string): WorkerPaneOutcome => {
-    run([...base, "close", paneId]);
-    return { kind: "unavailable", reason };
-  };
 
   const named = run([...base, "rename", paneId, label]);
   if (!named.ok) {
-    return abandon(`herdr pane rename failed: ${firstLine(named.stderr) || "no output"}`);
+    return abandon(`herdr pane rename failed: ${firstLine(named.stderr) || "no output"}`, undefined, paneId);
   }
 
   // Identity before display: the pane must be attributable to this exact run
@@ -1052,12 +1628,16 @@ export function openWorkerPane(identity: WorkerPaneIdentity, deps: WorkerPaneDep
     WORKER_PANE_SOURCE,
   ]);
   if (!identified.ok) {
-    return abandon(`herdr pane report-agent-session failed: ${firstLine(identified.stderr) || "no output"}`);
+    return abandon(
+      `herdr pane report-agent-session failed: ${firstLine(identified.stderr) || "no output"}`,
+      undefined,
+      paneId,
+    );
   }
 
   const started = run([...base, "run", paneId, ...deps.viewer?.(identity) ?? defaultViewer(identity)]);
   if (!started.ok) {
-    return abandon(`herdr pane run failed: ${firstLine(started.stderr) || "no output"}`);
+    return abandon(`herdr pane run failed: ${firstLine(started.stderr) || "no output"}`, undefined, paneId);
   }
 
   // A worker that has just spawned is working by definition. The ongoing
@@ -1065,9 +1645,9 @@ export function openWorkerPane(identity: WorkerPaneIdentity, deps: WorkerPaneDep
   // events — never from the pane's output.
   const reported = reportWorkerPaneState(paneId, label, "working", { run, session });
   if (!reported.ok) {
-    return abandon(reported.reason);
+    return abandon(reported.reason, undefined, paneId);
   }
-  return { kind: "tracked", paneId, label, pid: identity.pid };
+  return { kind: "tracked", paneId, label, pid: identity.pid, workspaceId: ensured.workspaceId };
 }
 
 /** Report one lifecycle state for a tracked pane. Monotonic `seq` is the caller's. */
@@ -1100,12 +1680,11 @@ export function reportWorkerPaneState(
 }
 
 /**
- * Hand lifecycle authority back when the worker is gone.
- *
- * Release, never close: whether a settled worker's pane is closed, kept, or
- * retained for N settlements is #841's documented policy, and a slice that
- * closed panes here would decide it by accident. Releasing says only "conductor
- * no longer speaks for this agent", which is exactly what is true.
+ * Hand lifecycle authority back when conductor no longer speaks for a pane's
+ * agent. Half of {@link retireWorkerPane}: it says "this agent record is no
+ * longer ours" without removing anything, which is what reconciliation wants
+ * for a pane it is about to close anyway but also stands alone for callers
+ * that only re-report identity (#842's adopt path).
  */
 export function releaseWorkerPane(
   paneId: string,
@@ -1131,71 +1710,153 @@ export function releaseWorkerPane(
     : { ok: false, reason: `herdr pane release-agent failed: ${firstLine(res.stderr) || "no output"}` };
 }
 
+/** Close one pane outright. The pane holds only ever a follower, so closing
+ *  it cannot reach the authoritative worker — that child belongs to the
+ *  daemon's process tree, not to any terminal (#1035). */
+export function closeWorkerPane(
+  paneId: string,
+  deps: { run?: HerdrRun; session?: string } = {},
+): { ok: true } | { ok: false; reason: string } {
+  const run = deps.run ?? realHerdrRun;
+  const session = deps.session ?? resolveHerdrSession();
+  const res = run(["--session", session, "pane", "close", paneId]);
+  return res.ok
+    ? { ok: true }
+    : { ok: false, reason: `herdr pane close failed: ${firstLine(res.stderr) || "no output"}` };
+}
+
+/**
+ * Retire one run's visual representation (#1035): hand lifecycle authority
+ * back to Herdr, then close the pane.
+ *
+ * #841 originally stopped at release, and production showed what that leaves:
+ * panes advertising `working` for runs that had settled hours earlier, their
+ * follower long exited, a bare shell where a worker used to be. A settled run
+ * keeps no representation. The close reaches only the follower — the
+ * authoritative child was never in the pane, so nothing here can signal it.
+ *
+ * A close failure is reported, not swallowed: the next reconciliation pass
+ * sees the pane as unclaimed junk and closes it again, so one refusal costs a
+ * pass rather than the representation.
+ */
+export function retireWorkerPane(
+  paneId: string,
+  label: string,
+  deps: { run?: HerdrRun; session?: string; seq?: number } = {},
+): { ok: true } | { ok: false; reason: string } {
+  const released = releaseWorkerPane(paneId, label, deps);
+  if (!released.ok) return released;
+  return closeWorkerPane(paneId, deps);
+}
+
 /**
- * Hand back the pane a dead worker left behind (#842).
+ * Hand back the representation a dead worker left behind (#842), retired for
+ * good by closing it (#1035) — but only once the recorded pane is PROVEN still
+ * conductor's (#1035 review).
  *
  * Called for every run a restart reaps. The recorded pid is deliberately NOT
  * consulted for liveness: a `session-host` child dies with the daemon that owned
  * its verb socket, so an orphaned row's worker is gone whatever pid it carries —
  * and pids are reused, so checking one is how a stranger's process comes to read
- * as a live worker. A run with no recorded pane is a no-op, not a failure: it
- * never had one to release.
+ * as a live worker. The same reuse argument applies to pane ids: after a Herdr
+ * restart the stored `w2:pT` may belong to a pane in somebody else's workspace,
+ * so a blind release+close could destroy a stranger's terminal. Ownership is
+ * therefore proven before anything is closed:
+ *
+ * - the pane must be listed inside a workspace conductor OWNS — a
+ *   {@link WORKER_WORKSPACE_TOKEN}-marked one, or one the store recorded for
+ *   the run's project (#1035 review: Herdr restarts restore workspaces without
+ *   their tokens, and a token-only check would leave the restored pane
+ *   unretired forever); and
  */
 export function releaseOrphanedWorkerPane(
-  run: { paneId?: string; paneLabel?: string },
-  deps: { run?: HerdrRun; session?: string; seq?: number } = {},
-): { kind: "none" } | { kind: "released"; paneId: string } | { kind: "failed"; paneId: string; reason: string } {
+  run: { paneId?: string; paneLabel?: string; runId?: string; project?: string },
+  deps: { run?: HerdrRun; session?: string; seq?: number; ownership?: WorkspaceOwnership } = {},
+):
+  | { kind: "none" }
+  | { kind: "released"; paneId: string }
+  | { kind: "failed"; paneId: string; reason: string }
+  | { kind: "unowned"; paneId: string; reason: string } {
   if (run.paneId === undefined || run.paneLabel === undefined) return { kind: "none" };
-  const released = releaseWorkerPane(run.paneId, run.paneLabel, deps);
-  return released.ok
+  const discovered = ownedWorkerWorkspaces(run.project === undefined ? [] : [run.project], deps);
+  if (!discovered.ok) {
+    return { kind: "failed", paneId: run.paneId, reason: discovered.reason };
+  }
+  const runFn = deps.run ?? realHerdrRun;
+  const session = deps.session ?? resolveHerdrSession();
+  let home: string | undefined;
+  let reportedAgent: string | undefined;
+  let reportedSession: string | undefined;
+  for (const ws of discovered.workspaces) {
+    const res = runFn(["--session", session, "pane", "list", "--workspace", ws.workspaceId]);
+    if (!res.ok) {
+      return {
+        kind: "failed",
+        paneId: run.paneId,
+        reason: `herdr pane list failed: ${firstLine(res.stderr) || "no output"}`,
+      };
+    }
+    const parsed = parsePaneRecords(res.stdout);
+    if (parsed === undefined) {
+      return { kind: "failed", paneId: run.paneId, reason: "herdr pane list was unreadable" };
+    }
+    const found = parsed.panes.find((pane) => pane.paneId === run.paneId);
+    if (found !== undefined && home === undefined) {
+      home = ws.workspaceId;
+      if (found.agent !== undefined) reportedAgent = found.agent;
+      if (found.runId !== "") reportedSession = found.runId;
+    }
+  }
+  if (home === undefined) {
+    // Not in any marked workspace: either already retired or never ours to
+    // touch. Both answers close nothing.
+    return { kind: "none" };
+  }
+  if (
+    (reportedAgent !== undefined && reportedAgent !== run.paneLabel) ||
+    (reportedSession !== undefined && run.runId !== undefined && reportedSession !== run.runId)
+  ) {
+    return {
+      kind: "unowned",
+      paneId: run.paneId,
+      reason: `pane ${run.paneId} in marked workspace ${home} reports another identity (agent ${reportedAgent ?? "none"}, session ${reportedSession ?? "none"})`,
+    };
+  }
+  const retired = retireWorkerPane(run.paneId, run.paneLabel, deps);
+  return retired.ok
     ? { kind: "released", paneId: run.paneId }
-    : { kind: "failed", paneId: run.paneId, reason: released.reason };
+    : { kind: "failed", paneId: run.paneId, reason: retired.reason };
 }
 
 /**
- * Every conductor-owned pane Herdr currently has, keyed by the run id it was
- * reported under (#841).
+ * Every pane inside a conductor-marked worker workspace (#1035).
  *
- * Read from `pane list`'s own agent-session record, never from a label pattern:
- * the label is what a human reads, and matching on it is exactly how a stale
- * lookalike (a renamed pane, a pane from a previous fleet) gets mistaken for a
- * live worker. `source` proves conductor reported it; `value` is the run id.
+ * Ownership here is structural: conductor created the workspace, marked it,
+ * and splits into it exclusively, so every pane inside it is conductor's
+ * however Herdr feels about reporting `agent_session` back — production has
+ * repeatedly handed back worker panes with that record dropped to null, which
+ * is why the previous source-filtered listing could not see the very panes
+ * that needed cleaning. The reported session id still rides along as a
+ * secondary attribution signal; an empty run id means "unattributable", and
+ * unattributable panes in a marked workspace are exactly the stale shells
+ * this surface exists to converge away.
  */
 export function listWorkerPanes(
   deps: { run?: HerdrRun; session?: string } = {},
-): { ok: true; panes: { paneId: string; runId: string; label?: string }[] } | { ok: false; reason: string } {
+): { ok: true; panes: (ListedPane & { project: string })[] } | { ok: false; reason: string } {
+  const workspaces = listWorkerWorkspaces(deps);
+  if (!workspaces.ok) return workspaces;
   const run = deps.run ?? realHerdrRun;
   const session = deps.session ?? resolveHerdrSession();
-  const res = run(["--session", session, "pane", "list"]);
-  if (!res.ok) {
-    return { ok: false, reason: `herdr pane list failed: ${firstLine(res.stderr) || "no output"}` };
-  }
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(res.stdout);
-  } catch (err) {
-    return { ok: false, reason: `herdr pane list was unreadable: ${err instanceof Error ? err.message : String(err)}` };
-  }
-  const panes = (parsed as { result?: { panes?: unknown[] } }).result?.panes;
-  if (!Array.isArray(panes)) return { ok: false, reason: "herdr pane list carried no pane array" };
-  const owned: { paneId: string; runId: string; label?: string }[] = [];
-  for (const pane of panes) {
-    const p = pane as {
-      pane_id?: unknown;
-      agent?: unknown;
-      agent_session?: { source?: unknown; value?: unknown };
-    };
-    if (typeof p.pane_id !== "string") continue;
-    if (p.agent_session?.source !== WORKER_PANE_SOURCE) continue;
-    const runId = p.agent_session.value;
-    // Ours by source but carrying no run id: an identity nobody can resolve is
-    // not an identity. Reported as a pane with an empty run id so the caller
-    // treats it as stale rather than silently ignoring it.
-    owned.push({
-      paneId: p.pane_id,
-      runId: typeof runId === "string" ? runId : "",
-      ...(typeof p.agent === "string" ? { label: p.agent } : {}),
-    });
+  const owned: (ListedPane & { project: string })[] = [];
+  for (const ws of workspaces.workspaces) {
+    const res = run(["--session", session, "pane", "list", "--workspace", ws.workspaceId]);
+    if (!res.ok) {
+      return { ok: false, reason: `herdr pane list failed: ${firstLine(res.stderr) || "no output"}` };
+    }
+    const parsed = parsePaneRecords(res.stdout);
+    if (parsed === undefined) return { ok: false, reason: "herdr pane list carried no pane array" };
+    for (const pane of parsed.panes) owned.push({ ...pane, project: ws.project });
   }
   return { ok: true, panes: owned };
 }
@@ -1213,43 +1874,147 @@ export interface LiveWorkerPane {
   sessionFile?: string;
 }
 
+export type StaleCause = "settled" | "duplicate" | "unidentified";
+
 export type WorkerPaneReconciliation =
-  /** The recorded pane is still there and still carries this run — nothing done. */
+  /** The recorded pane is still there and its follower is alive — nothing done. */
   | { kind: "intact"; runId: string; paneId: string }
-  /** Herdr lost the pane (a restart); a new one now represents the same child. */
+  /** The pane stands but its follower table could not decide life or death:
+   *  no evidence, no destruction (#1035 review). The visual may be stale; the
+   *  caller says so once instead of gambling a live worker's representation. */
+  | { kind: "visual-unreadable"; runId: string; paneId: string; reason: string }
+  /** The run had no usable representation; a new one now represents the same
+   *  child — a Herdr restart, a missing pane, or a follower that had exited. */
   | { kind: "reassociated"; runId: string; paneId: string; label: string }
   /** No representation, and the reason. The run keeps working regardless.
    *  `attempted` marks the ones that spent a re-establishment attempt (#998),
-   *  so the caller can bound them; the no-pid case costs nothing. */
-  | { kind: "untracked"; runId: string; reason: string; attempted?: true }
+   *  so the caller can bound them; the no-pid case costs nothing. `phase`
+   *  carries {@link WorkerPaneOutcome}'s split marker through. */
+  | { kind: "untracked"; runId: string; reason: string; attempted?: true; phase?: "split" }
   /** The attempt budget for this run is spent, so nothing was tried this pass
    *  (#998). Before this existed, a run whose pane could not be created was
    *  retried on every reconciliation pass forever — and each attempt leaked a
    *  pane until #992, ending in `ghostty error -2` once enough had piled up. */
   | { kind: "attempts-exhausted"; runId: string; attempts: number }
-  /** A conductor pane whose run is not live: handed back to Herdr. */
-  | { kind: "stale-released"; paneId: string; runId: string }
-  | { kind: "stale-release-failed"; paneId: string; runId: string; reason: string };
+  /** A conductor-workspace pane with no live run behind it: authority handed
+   *  back and the pane closed. `settled` — the run finished and its retirement
+   *  never landed; `duplicate` — a second representation of one live run, or
+   *  the one a fresh replacement displaced; `unidentified` — a representation
+   *  whose run id nobody can resolve any more, the bare shells production
+   *  accumulated (#1035). */
+  | { kind: "stale-released"; paneId: string; runId: string; cause: StaleCause }
+  | { kind: "stale-release-failed"; paneId: string; runId: string; reason: string; cause: StaleCause }
+  /** A scoped marked workspace nobody's live run holds any more, emptied by
+   *  the cleanup above, is closed (#1035). Every marked workspace converges,
+   *  not just one per project (#1035 review). */
+  | { kind: "workspace-removed"; project: string; workspaceId: string }
+  | { kind: "workspace-remove-failed"; project: string; workspaceId: string; reason: string };
+
+/** The verdict the foreground process table supports about one pane's
+ *  read-only follower. Terminal output is never read: this says whether the
+ *  *visual* is alive, nothing more, and settlement stays the store's business
+ *  (#1035). `unknown` is a real verdict, not an error — recognition of
+ *  `omp-conductor` in the table is positive evidence of life, but its absence
+ *  is only evidence of death when every entry carries enough identity (name or
+ *  argv) to rule it out. Real Herdr answers name + argv; a table with blanked
+ *  or missing fields, no shell pid, or no entries at all cannot decide, and a
+ *  pane destroyed on a guess we did not have is a live worker gone blind. */
+export type FollowerPulse =
+  | { pulse: "alive" }
+  | { pulse: "dead" }
+  | { pulse: "unknown"; reason: string };
+
+export function followerPulseFromProcessInfo(info: ProcessInfo): FollowerPulse {
+  const procs = Array.isArray(info.foreground_processes) ? info.foreground_processes : undefined;
+  if (procs === undefined || procs.length === 0) {
+    return { pulse: "unknown", reason: "process-info carried no foreground process table" };
+  }
+  const shell = typeof info.shell_pid === "number" ? info.shell_pid : undefined;
+  let nonShell = false;
+  for (const proc of procs) {
+    const parts = [proc.name ?? "", proc.argv0 ?? "", ...(proc.argv ?? [])];
+    const isShell = shell !== undefined && proc.pid === shell;
+    if (!isShell && !parts.some((a) => a !== "")) {
+      return { pulse: "unknown", reason: `foreground pid ${proc.pid ?? "unknown"} carries no name or argv` };
+    }
+    if (!isShell) {
+      nonShell = true;
+      if (parts.some((a) => a.toLowerCase() === "omp-conductor" || a.toLowerCase().endsWith("/omp-conductor"))) {
+        return { pulse: "alive" };
+      }
+    }
+  }
+  if (!nonShell && shell === undefined) {
+    return { pulse: "unknown", reason: "process-info named neither a shell nor any identifiable process" };
+  }
+  return { pulse: "dead" };
+}
+
+/**
+ * Probe one pane's follower liveness. A probe that cannot be read, or a table
+ * that cannot decide, answers `unknown` rather than dead: destroying a
+ * representation on evidence we do not have is how a healthy worker goes blind
+ * mid-run.
+ */
+export function paneFollowerAlive(
+  paneId: string,
+  deps: { run?: HerdrRun; session?: string } = {},
+): FollowerPulse {
+  const run = deps.run ?? realHerdrRun;
+  const session = deps.session ?? resolveHerdrSession();
+  const res = run(["--session", session, "pane", "process-info", "--pane", paneId]);
+  if (!res.ok) {
+    return {
+      pulse: "unknown",
+      reason: `herdr pane process-info failed: ${firstLine(res.stderr) || "no output"}`,
+    };
+  }
+  try {
+    return followerPulseFromProcessInfo(parseHerdrProcessInfo(res.stdout, paneId));
+  } catch (err) {
+    return { pulse: "unknown", reason: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+function firstLine(text: string): string {
+  return text.split("\n", 1)[0]?.trim() ?? "";
+}
+/** The kill syscall, injectable so error mapping is testable without one. */
+export type KillFn = (pid: number, sig: NodeJS.Signals | 0) => void;
+
+const realKill: KillFn = (pid, sig) => {
+  process.kill(pid, sig);
+};
 
 /**
- * Make Herdr's conductor-owned panes agree with the live run set (#841).
+ * Make the conductor-owned worker workspaces agree with the live run set
+ * (#841, reworked by #1035).
  *
  * Idempotent by construction: a second pass over an already-reconciled fleet
- * returns `intact` for every live run and finds no stale panes, so repeated
- * daemon or Herdr restarts converge rather than accumulate.
+ * returns `intact` for every live run and finds nothing left to close, so
+ * repeated launch/settlement/restart cycles converge instead of accumulating.
  *
- * Three rules, and each exists to refuse a specific way this goes wrong:
+ * Four rules, and each exists to refuse a specific way this goes wrong:
  *
- * - **A live run's pane is re-created, never duplicated.** Re-association is
- *   keyed on the run id Herdr itself reports, so a pane that is still there is
- *   left alone. Only a run whose pane Herdr no longer has gets a new one.
- * - **Cleanup is by exact identity, never by name or age.** A pane is stale only
- *   when the run id it carries is absent from the live set. A worker's own pane
- *   can therefore never be released while its run is live, whatever it is called
- *   and however old it is.
- * - **Nothing here can stop a worker.** The only mutation is `release-agent`,
- *   which hands lifecycle authority back to Herdr; the authoritative child is
- *   never signalled, and its pane is never closed.
+ * - **Only owned workspaces are touched.** Scope is the projects of the live
+ *   set plus the caller's managed list; ownership is the marking token OR the
+ *   conductor-store record (#1035 review), so a Herdr restart that drops
+ *   tokens still finds the restored surface. A pane in another project's
+ *   worker workspace is invisible to this pass, which is what keeps conductor
+ *   and veltrosecurity from discovering, reusing, or cleaning each other.
+ * - **Attribution is exact, structural first.** A pane belongs to the live run
+ *   the store recorded it under; the session id Herdr reports is the fallback.
+ *   Everything else in an owned workspace — a settled run's leftover, a
+ *   duplicate of a live run, a representation whose identity Herdr dropped —
+ *   is closed, because inside an owned workspace "ours" and "junk" are the
+ *   only options and leaving junk is what filled the operator's layout.
+ * - **A live run keeps exactly one living representation.** Duplicates fold
+ *   into the recorded pane; a pane whose follower has exited is replaced while
+ *   the run is live; a missing pane is recreated — all bounded by the same
+ *   re-establishment budget (#998).
+ * - **Nothing here can stop a worker.** Panes hold followers only; the
+ *   authoritative child lives in the daemon's process tree and is never
+ *   signalled, and worker liveness comes from the caller's live set alone.
  */
 export function reconcileWorkerPanes(
   live: readonly LiveWorkerPane[],
@@ -1258,39 +2023,184 @@ export function reconcileWorkerPanes(
    *  and a daemon restart legitimately gets a fresh budget (#998). */
   attempts: ReadonlyMap<string, number> = new Map(),
   maxAttempts = PANE_REATTEMPT_MAX,
+  /** Projects this pass manages even when they have no live runs: their stale
+   *  panes are cleaned and a workspace left empty by that cleanup is removed. */
+  managedProjects: readonly string[] = [],
 ): { ok: true; outcomes: WorkerPaneReconciliation[] } | { ok: false; reason: string } {
-  const listed = listWorkerPanes(deps);
-  if (!listed.ok) return { ok: false, reason: listed.reason };
-  const byRun = new Map(listed.panes.map((pane) => [pane.runId, pane]));
-  const liveIds = new Set(live.map((worker) => worker.runId));
+  const run = deps.run ?? realHerdrRun;
+  const session = deps.session ?? resolveHerdrSession();
+  const base = ["--session", session];
+
+  const scope = new Set([...managedProjects, ...live.map((worker) => worker.project)]);
+  const discovered = ownedWorkerWorkspaces([...scope], deps);
+  if (!discovered.ok) return { ok: false, reason: discovered.reason };
+  // Deterministic order so outcomes and closes are reproducible pass to pass.
+  const scoped = [...discovered.workspaces].sort((a, b) => (a.workspaceId < b.workspaceId ? -1 : 1));
+
+  // Every marked workspace of every scoped project converges (#1035 review):
+  // duplicate token-marked workspaces are cleaned like any other, so a settled
+  // project cannot keep stale shells in a second marked surface nobody tracks.
+  const entries: { ws: WorkerWorkspace; panes: ListedPane[] }[] = [];
+  for (const ws of scoped) {
+    const res = run([...base, "pane", "list", "--workspace", ws.workspaceId]);
+    if (!res.ok) {
+      // An unreadable workspace is not evidence that anything is stale, so the
+      // pass mutates nothing rather than closing on a guess.
+      return { ok: false, reason: `herdr pane list failed: ${firstLine(res.stderr) || "no output"}` };
+    }
+    const parsed = parsePaneRecords(res.stdout);
+    if (parsed === undefined) return { ok: false, reason: "herdr pane list carried no pane array" };
+    entries.push({ ws, panes: parsed.panes });
+  }
+
+  const liveByRun = new Map(live.map((worker) => [worker.runId, worker]));
   const outcomes: WorkerPaneReconciliation[] = [];
+  /** Panes this pass will close, with the identity the outcome names. */
+  const junk = new Map<string, { runId: string; cause: StaleCause; agent?: string }>();
+  /** Panes still standing when cleanup ends, keyed to their workspace — an
+   *  occupied workspace survives, whichever marked surface it sits in. */
+  const standingWs = new Map<string, string>();
+  /** Workspaces that gained a representation this pass, read from the tracked
+   *  outcomes: their listing predates the new pane, so removal never judges
+   *  them on it. */
+  const openedWs = new Set<string>();
+
+  /** One representation per live run: the pane plus the marked workspace that
+   *  holds it. Attribution runs across ALL of a project's marked workspaces,
+   *  because the recorded pane may sit in any of them. */
+  const held = new Map<string, { pane: ListedPane; wsId: string }>();
+  for (const entry of entries) {
+    const projectLive = live.filter((worker) => worker.project === entry.ws.project);
+    for (const pane of entry.panes) {
+      standingWs.set(pane.paneId, entry.ws.workspaceId);
+      const owner =
+        projectLive.find((worker) => worker.paneId === pane.paneId) ??
+        (pane.runId === "" ? undefined : liveByRun.get(pane.runId));
+      if (owner === undefined || owner.project !== entry.ws.project) {
+        // Not attributable to any live run of this project: a settled run's
+        // leftover (still carrying its old id) or an unidentified shell.
+        junk.set(pane.paneId, {
+          runId: pane.runId,
+          cause: pane.runId === "" ? "unidentified" : "settled",
+          ...(pane.agent === undefined ? {} : { agent: pane.agent }),
+        });
+        continue;
+      }
+      const bucket = held.get(owner.runId);
+      if (bucket === undefined) {
+        held.set(owner.runId, { pane, wsId: entry.ws.workspaceId });
+        continue;
+      }
+      // Exactly one focusable representation per live run: the recorded pane
+      // wins so the durable row stays true without a write; the other is a
+      // duplicate (#1035).
+      const keep =
+        bucket.pane.paneId === owner.paneId
+          ? bucket
+          : pane.paneId === owner.paneId
+            ? { pane, wsId: entry.ws.workspaceId }
+            : bucket;
+      const drop = keep.pane.paneId === bucket.pane.paneId ? pane : bucket.pane;
+      held.set(owner.runId, keep);
+      junk.set(drop.paneId, {
+        runId: owner.runId,
+        cause: "duplicate",
+        ...(drop.agent === undefined ? {} : { agent: drop.agent }),
+      });
+    }
+  }
 
   for (const worker of live) {
-    const held = byRun.get(worker.runId);
-    if (held !== undefined) {
-      outcomes.push({ kind: "intact", runId: worker.runId, paneId: held.paneId });
+    const hold = held.get(worker.runId);
+    if (hold === undefined) {
+      // No representation anywhere in the marked workspaces. Only the pid makes
+      // a replacement honest: the pane represents an exact child, so without
+      // one there is nothing to represent and inventing a pane would be the
+      // silent claim this whole surface exists to avoid.
+      if (worker.pid === undefined) {
+        outcomes.push({
+          kind: "untracked",
+          runId: worker.runId,
+          reason: "no session-host pid was ever recorded for this run",
+        });
+        continue;
+      }
+      // The budget, checked before the attempt: an exhausted run is skipped
+      // silently here and reported once by the caller (#998).
+      const spent = attempts.get(worker.runId) ?? 0;
+      if (spent >= maxAttempts) {
+        outcomes.push({ kind: "attempts-exhausted", runId: worker.runId, attempts: spent });
+        continue;
+      }
+      const opened = openWorkerPane(
+        {
+          project: worker.project,
+          issue: worker.issue,
+          attempt: worker.attempt,
+          runId: worker.runId,
+          pid: worker.pid,
+          ...(worker.sessionFile === undefined ? {} : { sessionFile: worker.sessionFile }),
+        },
+        deps,
+      );
+      if (opened.kind === "tracked") {
+        if (opened.workspaceId !== undefined) openedWs.add(opened.workspaceId);
+        outcomes.push({
+          kind: "reassociated",
+          runId: worker.runId,
+          paneId: opened.paneId,
+          label: opened.label,
+        });
+      } else {
+        outcomes.push({
+          kind: "untracked",
+          runId: worker.runId,
+          reason: opened.reason,
+          attempted: true,
+          ...(opened.phase === undefined ? {} : { phase: opened.phase }),
+        });
+      }
+      continue;
+    }
+    // The pane stands. Whether it still shows anything is the follower's
+    // question, asked only to decide the *visual* — never settlement (#1035).
+    // A probe that cannot be read, or a table that cannot decide, is no
+    // evidence the visual died: it is reported and the pane keeps standing,
+    // because a live worker's representation is never destroyed on a guess.
+    const pulse = paneFollowerAlive(hold.pane.paneId, deps);
+    if (pulse.pulse !== "dead") {
+      outcomes.push(
+        pulse.pulse === "alive"
+          ? { kind: "intact", runId: worker.runId, paneId: hold.pane.paneId }
+          : {
+              kind: "visual-unreadable",
+              runId: worker.runId,
+              paneId: hold.pane.paneId,
+              reason: pulse.reason,
+            },
+      );
       continue;
     }
-    // Herdr does not have this run's pane. Only the pid makes a replacement
-    // honest: the pane represents an exact child, so without one there is
-    // nothing to represent and inventing a pane would be the silent claim this
-    // whole surface exists to avoid.
+    // The follower has provably exited. A replacement represents the exact
+    // child, so a run with no recorded pid keeps its dead pane rather than
+    // gaining a representation of nobody — reported so the record drops and
+    // the next pass reads the orphan as junk.
     if (worker.pid === undefined) {
       outcomes.push({
         kind: "untracked",
         runId: worker.runId,
-        reason: "no session-host pid was ever recorded for this run",
+        reason: "follower exited but no session-host pid was ever recorded; not replacing",
       });
       continue;
     }
-    // The budget, checked before the attempt: an exhausted run is skipped
-    // silently here and reported once by the caller (#998).
     const spent = attempts.get(worker.runId) ?? 0;
     if (spent >= maxAttempts) {
+      // Out of budget: the dead pane keeps its last state until a restart
+      // refreshes the budget or the run settles and retires it outright.
       outcomes.push({ kind: "attempts-exhausted", runId: worker.runId, attempts: spent });
       continue;
     }
-    const opened = openWorkerPane(
+    const replaced = openWorkerPane(
       {
         project: worker.project,
         issue: worker.issue,
@@ -1301,36 +2211,89 @@ export function reconcileWorkerPanes(
       },
       deps,
     );
-    outcomes.push(
-      opened.kind === "tracked"
-        ? { kind: "reassociated", runId: worker.runId, paneId: opened.paneId, label: opened.label }
-        : { kind: "untracked", runId: worker.runId, reason: opened.reason, attempted: true },
-    );
+    if (replaced.kind === "tracked") {
+      if (replaced.workspaceId !== undefined) openedWs.add(replaced.workspaceId);
+      outcomes.push({
+        kind: "reassociated",
+        runId: worker.runId,
+        paneId: replaced.paneId,
+        label: replaced.label,
+      });
+      junk.set(hold.pane.paneId, {
+        runId: worker.runId,
+        cause: "duplicate",
+        ...(hold.pane.agent === undefined ? {} : { agent: hold.pane.agent }),
+      });
+    } else {
+      outcomes.push({
+        kind: "untracked",
+        runId: worker.runId,
+        reason: replaced.reason,
+        attempted: true,
+        ...(replaced.phase === undefined ? {} : { phase: replaced.phase }),
+      });
+      // The replacement failed; the dead pane has nothing left to show, so it
+      // goes now rather than advertising a worker for another pass. Its record
+      // is dropped either way, so a survivor is junk next pass.
+      closeWorkerPane(hold.pane.paneId, deps);
+      standingWs.delete(hold.pane.paneId);
+    }
+  }
+
+  for (const [paneId, info] of junk) {
+    const released =
+      info.agent === undefined ? ({ ok: true } as const) : releaseWorkerPane(paneId, info.agent, deps);
+    if (released.ok) {
+      const closed = closeWorkerPane(paneId, deps);
+      if (closed.ok) {
+        standingWs.delete(paneId);
+        outcomes.push({ kind: "stale-released", paneId, runId: info.runId, cause: info.cause });
+        continue;
+      }
+      outcomes.push({
+        kind: "stale-release-failed",
+        paneId,
+        runId: info.runId,
+        reason: closed.reason,
+        cause: info.cause,
+      });
+      continue;
+    }
+    outcomes.push({
+      kind: "stale-release-failed",
+      paneId,
+      runId: info.runId,
+      reason: released.reason,
+      cause: info.cause,
+    });
   }
 
-  for (const pane of listed.panes) {
-    if (liveIds.has(pane.runId)) continue;
-    const released = releaseWorkerPane(pane.paneId, pane.label ?? "", deps);
+  // Every scoped marked workspace whose panes the cleanup above emptied, and
+  // that gained no representation this pass, is closed — however many marked
+  // surfaces a project accumulated (#1035 review). A live project's primary
+  // workspace survives because its representation keeps it standing; extras
+  // converge away; repeated cycles hold at zero shells.
+  for (const entry of entries) {
+    if (openedWs.has(entry.ws.workspaceId)) continue;
+    if ([...standingWs.values()].some((wsId) => wsId === entry.ws.workspaceId)) continue;
+    const res = run([...base, "workspace", "close", entry.ws.workspaceId]);
+    if (res.ok) deps.ownership?.forgetWorkspace(entry.ws.project, entry.ws.workspaceId);
+    // A failed close keeps the record: the workspace may still exist, and
+    // forgetting ownership of a live surface is how orphans are manufactured.
     outcomes.push(
-      released.ok
-        ? { kind: "stale-released", paneId: pane.paneId, runId: pane.runId }
-        : { kind: "stale-release-failed", paneId: pane.paneId, runId: pane.runId, reason: released.reason },
+      res.ok
+        ? { kind: "workspace-removed", project: entry.ws.project, workspaceId: entry.ws.workspaceId }
+        : {
+            kind: "workspace-remove-failed",
+            project: entry.ws.project,
+            workspaceId: entry.ws.workspaceId,
+            reason: `herdr workspace close failed: ${firstLine(res.stderr) || "no output"}`,
+          },
     );
   }
   return { ok: true, outcomes };
 }
 
-function firstLine(text: string): string {
-  return text.split("\n", 1)[0]?.trim() ?? "";
-}
-
-/** The kill syscall, injectable so error mapping is testable without one. */
-export type KillFn = (pid: number, sig: NodeJS.Signals | 0) => void;
-
-const realKill: KillFn = (pid, sig) => {
-  process.kill(pid, sig);
-};
-
 /**
  * What a failed `kill` proves.
  *
@@ -2556,10 +3519,13 @@ export function sessionsRoot(): string {
  * claim-only verdict consumes this — the challenge proof reads conductor
  * state, not transcripts (#614).
  */
-function claimedOrchestratorSessionFile(named: string | undefined): string | undefined {
+function claimedOrchestratorSessionFile(
+  named: string | undefined,
+  alive?: (pid: number) => boolean,
+): string | undefined {
   if (named === undefined) return undefined;
   try {
-    return resolveClaimedSessionFile(findProject(loadConfig(), named));
+    return resolveClaimedSessionFile(findProject(loadConfig(), named), alive);
   } catch {
     return undefined;
   }
@@ -2573,11 +3539,11 @@ function makeChallengeCode(): string {
 }
 
 /**
- * mm:ss for a window whose whole length is five minutes. Deliberately not
+ * mm:ss for the window a challenge code stays good for. Deliberately not
  * `formatDownDuration`, which rounds to whole minutes because it reports
- * hours-to-days outages: rounded to the minute, the last 30 seconds of this
- * window would read "5m of 5m left" while the wait was nearly over, which is
- * the exact ambiguity the progress lines exist to remove (#861).
+ * hours-to-days outages: rounded to the minute, a code with 30 seconds left
+ * would read "5m", which is the exact ambiguity these lines exist to remove
+ * (#861).
  */
 function armClock(ms: number): string {
   const total = Math.max(0, Math.round(ms / 1000));
@@ -2586,58 +3552,6 @@ function armClock(ms: number): string {
   return minutes === 0 ? `${seconds}s` : `${minutes}m${String(seconds).padStart(2, "0")}s`;
 }
 
-/** How often the wait says it is still waiting. Six lines across the window. */
-const ARM_PROGRESS_INTERVAL_MS = 30_000;
-
-/**
- * Polls the acknowledgement record for one exact challenge id until the
- * orchestrator's inbound adapter writes it or the deadline passes (#614).
- *
- * The state is a small JSON file re-read every pass, never snapshotted: the
- * acknowledgement may land at any point in the window, written by the live
- * orchestrator process. Only a record naming this exact id satisfies the
- * wait — an acknowledgement cut for a replaced challenge is inert here by
- * construction, and no transcript anywhere is opened.
- *
- * It also *says* it is waiting (#861). Measured 2026-08-21: an arm proof sat
- * silent for five minutes and was reported as a hung setup — the process was
- * healthy and the operator had no way to tell. A silent five-minute wait
- * inside a fence that holds dispatch is indistinguishable from a dead one, so
- * the elapsed/remaining line lands every {@link ARM_PROGRESS_INTERVAL_MS}
- * regardless of the (much shorter) poll cadence, and the terminal outcome is
- * always printed.
- */
-async function waitForArmAcknowledgement(
-  challengeId: string,
-  timeoutMs: number,
-  deps: ArmDeps,
-): Promise<boolean> {
-  const now = deps.now ?? Date.now;
-  const sleep = deps.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));
-  const report = deps.progress;
-  const startedAt = now();
-  const deadline = startedAt + timeoutMs;
-  let nextReportAt = startedAt + ARM_PROGRESS_INTERVAL_MS;
-  for (;;) {
-    if (readArmAcknowledgement(challengeId) !== undefined) {
-      report?.(`arm: reply acknowledged after ${armClock(now() - startedAt)} — the fleet is armed.`);
-      return true;
-    }
-    const at = now();
-    if (at >= deadline) return false;
-    if (report !== undefined && at >= nextReportAt) {
-      report(
-        `arm: still waiting for the reply — ${armClock(at - startedAt)} elapsed, ` +
-          `${armClock(deadline - at)} left. Nothing is stuck: reply in the Telegram chat with the code.`,
-      );
-      // Anchored to the clock, not to this pass, so a slow pass cannot make the
-      // cadence drift into silence.
-      while (nextReportAt <= at) nextReportAt += ARM_PROGRESS_INTERVAL_MS;
-    }
-    await sleep(5_000);
-  }
-}
-
 /**
  * The one armed-marker write both proofs share: same content, same mode, and
  * the same restamp of the pre-per-project shared marker the heartbeat still