omp-conductor 0.19.7 → 0.20.1

package/src/stats.ts

@@ -17,10 +17,32 @@
  * the doctor `spend-telemetry` finding): a run whose `spendUsd` reads 0.00
  * means harness telemetry was absent, not that the run was free. Such runs are
  * counted separately as **unmetered** and never averaged into a per-issue cost.
+ *
+ * ## Attribution (Phase 4)
+ *
+ * Two additions, both about *where the money went* rather than what it bought:
+ *
+ * - **Per model.** Worker runs grouped by `resolvedModel` — the model the
+ *   harness actually ran and therefore the one that was billed. Never grouped
+ *   by the requested model: a requested model is not evidence of a resolved
+ *   one, and a row that observed none groups under {@link UNRESOLVED_MODEL}
+ *   rather than being guessed into a bucket.
+ * - **Daemon-owned sessions.** To-spec grooming and review adjudication run as
+ *   the daemon's own sessions, not as worker runs, so their cost was logged and
+ *   then lost. They arrive here as `sessionSpendSince` rows and are summed *per
+ *   role*, deliberately outside the issue-journey aggregation: a role row in
+ *   `runs` would corrupt the merged/settled counts, which is why the store
+ *   keeps them in their own table.
+ *
+ * The orchestrator's own tick turns are absent from both, and that absence is
+ * reported rather than hidden ({@link StatsReport.unmeteredRoles}): the tick
+ * extension observes no usage events at all, so there is no number — and a
+ * `$0.00` for it would read as free.
  */
 
 import { utcDay } from "./store.ts";
-import type { RunRecord } from "./types.ts";
+import { SESSION_SPEND_ROLES } from "./types.ts";
+import type { RunRecord, SessionSpendRole, SessionSpendRow } from "./types.ts";
 
 /** The bounded window a report answers over. Day keys are UTC (`YYYY-MM-DD`). */
 export interface StatsWindow {
@@ -57,6 +79,51 @@ export interface RepoStats {
   failureClasses: Record<string, number>;
 }
 
+/**
+ * Worker runs attributed to one billed model (Phase 4).
+ *
+ * Counted over every run in the outcomes this report counts — the failures
+ * included, because money spent losing is precisely what a per-model
+ * comparison exists to expose: a model that burns a budget and never merges
+ * must not read as cheap.
+ *
+ * So this is deliberately a *wider* figure than {@link RepoStats.spendUsd},
+ * which sums merged chains only. The two answer different questions ("what did
+ * delivered work cost" versus "what did this model cost us"), and they are not
+ * meant to add up to each other.
+ */
+export interface ModelStats {
+  /** `resolvedModel`, or {@link UNRESOLVED_MODEL} when the run observed none. */
+  model: string;
+  /** Runs in the window on this model, across every issue. */
+  runs: number;
+  /** Runs whose state is `merged` — the attempt that actually delivered. */
+  merges: number;
+  /** Metered (spendUsd > 0) spend on this model, rounded to cents. */
+  spendUsd: number;
+  /** `spendUsd / merges`; `null` with no merge to divide by — never a zero,
+   *  and never a division by zero. */
+  spendPerMerge: number | null;
+  /** Runs on this model whose spend read $0.00: telemetry absent, not free. */
+  unmeteredRuns: number;
+}
+
+/** One daemon-owned session role's accounting (Phase 4). */
+export interface SessionRoleStats {
+  role: SessionSpendRole;
+  sessions: number;
+  turns: number;
+  /** Summed cost of the sessions that reported one, rounded to cents. */
+  spendUsd: number;
+  /**
+   * Sessions whose provider reported no cost at all. Distinct from a reported
+   * `0` by contract (`SessionSpendRow.spendUsd` is optional for exactly this
+   * reason), so this count is the honest "cost unknown" — never folded into
+   * `spendUsd` as a zero.
+   */
+  unmeteredSessions: number;
+}
+
 /** The stable report shape `--json` prints; the human renderer reads it too. */
 export interface StatsReport {
   project: string;
@@ -72,6 +139,27 @@ export interface StatsReport {
   total: RepoStats;
   /** Per-repo aggregates of the same shape, busiest (by merges) first. */
   repos: RepoStats[];
+  /** Worker runs by billed model, busiest (by runs) first (Phase 4). */
+  models: ModelStats[];
+  /** Daemon-owned session spend by role, in `SESSION_SPEND_ROLES` order. */
+  sessions: SessionRoleStats[];
+  /**
+   * Metered spend on to-spec grooming sessions — the plan's `groomSpendUsd`,
+   * named at the top level because "what did keeping the queue full cost" is a
+   * question asked on its own. Same number as the `groom` row in
+   * {@link StatsReport.sessions}; `groomUnmeteredSessions` is the part of it
+   * whose cost is unknown rather than zero.
+   */
+  groomSpendUsd: number;
+  groomUnmeteredSessions: number;
+  /**
+   * Roles whose spend cannot be observed at all, so no row exists to sum and
+   * no total here includes them. Present in the shape so a consumer adding
+   * `total.spendUsd` to `sessions` knows what is still missing instead of
+   * reading the sum as the fleet's whole bill. Today: `orchestrator` — the
+   * tick extension observes no usage events.
+   */
+  unmeteredRoles: string[];
 }
 
 /** Terminal non-merged run states — everything the failure histogram counts. */
@@ -86,6 +174,16 @@ const FAILED_STATES: ReadonlySet<RunRecord["state"]> = new Set([
 /** Runs with no classified failure fall into this explicit bucket. */
 export const UNCLASSIFIED = "unclassified";
 
+/**
+ * Runs that never observed a resolved model group here (Phase 4).
+ *
+ * Parenthesised so it cannot collide with a real model id, and explicit rather
+ * than omitted: a run predating the column, or one whose harness never reported
+ * the model it ran, still cost money, and dropping it would make the per-model
+ * spend quietly fail to add up to the total.
+ */
+export const UNRESOLVED_MODEL = "(unresolved)";
+
 /** The timestamp a run is placed on the window timeline. Mirrors the store's
  *  `COALESCE(endedAt, startedAt)` convention everywhere else in this package. */
 const WINDOW_KEY = (run: RunRecord): number => run.endedAt ?? run.startedAt;
@@ -216,11 +314,19 @@ export function parseStatsWindow(raw: string, now: number): StatsWindow | undefi
   return undefined;
 }
 
+/**
+ * `sessions` is `store.sessionSpendSince(project, window.sinceEpochMs)`. It is
+ * optional because a caller with nothing to say about daemon-owned sessions —
+ * and every pre-Phase-4 caller — must still get a report; an empty list means
+ * "no grooming or adjudication in this window", which the renderer states as
+ * that rather than as a $0.00 bill.
+ */
 export function computeStats(args: {
   project: string;
   window: StatsWindow;
   ghCalls: number;
   runs: readonly RunRecord[];
+  sessions?: readonly SessionSpendRow[];
 }): StatsReport {
   const chains = new Map<number, RunRecord[]>();
   for (const run of args.runs) {
@@ -234,6 +340,7 @@ export function computeStats(args: {
   const failureRuns: { repo: string; cls: string }[] = [];
   let unmeteredRuns = 0;
   const unmeteredByRepo = new Map<string, number>();
+  const byModel = new Map<string, ModelBucket>();
 
   for (const chain of chains.values()) {
     // One issue merges once; if a weird history ever carried two merged rows,
@@ -262,6 +369,14 @@ export function computeStats(args: {
         unmeteredRuns += 1;
         unmeteredByRepo.set(run.repo, (unmeteredByRepo.get(run.repo) ?? 0) + 1);
       }
+      // Attributed over exactly the runs this report already counts, so the
+      // per-model breakdown adds up to the totals printed beside it. Grouped on
+      // the *resolved* model: that is the one that was billed.
+      const model = modelBucket(byModel, run.resolvedModel ?? UNRESOLVED_MODEL);
+      model.runs += 1;
+      if (run.state === "merged") model.merges += 1;
+      if (run.spendUsd > 0) model.spend += run.spendUsd;
+      else model.unmetered += 1;
       if (merged === undefined && FAILED_STATES.has(run.state) && WINDOW_KEY(run) >= args.window.sinceEpochMs) {
         failureRuns.push({ repo: run.repo, cls: run.failureClass ?? UNCLASSIFIED });
       }
@@ -297,6 +412,21 @@ export function computeStats(args: {
     )
     .sort((a, b) => b.merged - a.merged || b.settled - a.settled || a.repo.localeCompare(b.repo));
 
+  const models = [...byModel.entries()]
+    .map(([model, b]) => ({
+      model,
+      runs: b.runs,
+      merges: b.merges,
+      spendUsd: cents(b.spend),
+      // No merge to divide by is "not measured", never a zero and never a
+      // division by zero — the same rule the per-issue cost follows.
+      spendPerMerge: b.merges === 0 ? null : cents(b.spend / b.merges),
+      unmeteredRuns: b.unmetered,
+    }))
+    .sort((a, b) => b.runs - a.runs || b.spendUsd - a.spendUsd || a.model.localeCompare(b.model));
+  const sessions = summarizeSessions(args.sessions ?? []);
+  const groom = sessions.find((s) => s.role === "groom");
+
   return {
     project: args.project,
     window: args.window,
@@ -304,9 +434,63 @@ export function computeStats(args: {
     empty: outcomes.length === 0,
     total: summarize({ repo: "(all)", outcomes, failureRuns, unmeteredRuns }),
     repos,
+    models,
+    sessions,
+    groomSpendUsd: groom?.spendUsd ?? 0,
+    groomUnmeteredSessions: groom?.unmeteredSessions ?? 0,
+    unmeteredRoles: [...UNMETERED_ROLES],
   };
 }
 
+/** One model's accumulating totals while the chains are walked. */
+interface ModelBucket {
+  runs: number;
+  merges: number;
+  spend: number;
+  unmetered: number;
+}
+
+function modelBucket(map: Map<string, ModelBucket>, model: string): ModelBucket {
+  let found = map.get(model);
+  if (found === undefined) {
+    found = { runs: 0, merges: 0, spend: 0, unmetered: 0 };
+    map.set(model, found);
+  }
+  return found;
+}
+
+/**
+ * Roles the fleet runs whose spend nothing can observe, so no row exists to
+ * sum. The orchestrator session is the case: its tick extension reads content
+ * text out of `message_start` and no usage event at all, so there is no number
+ * to record. Named in the report rather than left out, because a total that
+ * silently omits a whole role is the misreading this surface exists to prevent.
+ */
+const UNMETERED_ROLES = ["orchestrator"] as const;
+
+/**
+ * Daemon-owned session rows reduced per role, in `SESSION_SPEND_ROLES` order so
+ * the shape is stable whether or not a role ran in the window.
+ *
+ * A session whose `spendUsd` is absent is counted in `unmeteredSessions` and
+ * contributes nothing to `spendUsd`: the store's contract distinguishes "the
+ * provider reported no cost" from "the provider reported zero", and collapsing
+ * them here would throw away the only place that distinction exists.
+ */
+function summarizeSessions(rows: readonly SessionSpendRow[]): SessionRoleStats[] {
+  return SESSION_SPEND_ROLES.map((role) => {
+    const mine = rows.filter((r) => r.role === role);
+    const metered = mine.filter((r) => r.spendUsd !== undefined);
+    return {
+      role,
+      sessions: mine.length,
+      turns: mine.reduce((sum, r) => sum + r.turns, 0),
+      spendUsd: cents(metered.reduce((sum, r) => sum + (r.spendUsd ?? 0), 0)),
+      unmeteredSessions: mine.length - metered.length,
+    };
+  });
+}
+
 /** `N` and its unit, for a count line that must not print "0" as a measure. */
 function countLine(n: number, noun: string, plural: string): string {
   return `${n} ${n === 1 ? noun : plural}`;
@@ -350,17 +534,88 @@ function renderRepo(repo: RepoStats, indent: string): string {
   return lines.join("\n");
 }
 
+/**
+ * The attribution block (Phase 4): where the money went, as opposed to what it
+ * bought. Rendered from the same report `--json` carries, and rendered even in
+ * the empty case — a dry queue is exactly when daemon-owned grooming runs, so
+ * hiding this behind "nothing settled" would hide the spend that had no
+ * outcome, which is the one an operator most wants to see.
+ */
+function renderAttribution(report: StatsReport, indent: string): string[] {
+  const lines: string[] = [];
+  if (report.models.length > 0) {
+    lines.push(`${indent}per model:`);
+    for (const m of report.models) {
+      // Nothing metered at all is stated as unknown, not as "$0.00 metered":
+      // the dollar figure is true but reads as free, which is the exact
+      // misreading this whole surface exists to prevent.
+      const cost =
+        m.spendUsd === 0 && m.unmeteredRuns === m.runs
+          ? `cost unknown — no run on this model metered`
+          : m.spendPerMerge === null
+            ? `$${m.spendUsd.toFixed(2)} metered (no merge on this model to divide by)`
+            : `$${m.spendUsd.toFixed(2)} metered ($${m.spendPerMerge.toFixed(2)}/merge)`;
+      const unmetered =
+        m.unmeteredRuns === 0 || m.unmeteredRuns === m.runs
+          ? ""
+          : ` · ${countLine(m.unmeteredRuns, "run", "runs")} unmetered`;
+      lines.push(
+        `${indent}  ${m.model}  ${countLine(m.runs, "run", "runs")}, ` +
+          `${countLine(m.merges, "merge", "merges")}  ${cost}${unmetered}`,
+      );
+    }
+  }
+  const ran = report.sessions.filter((s) => s.sessions > 0);
+  // Silence rather than a row of zeros: "no grooming sessions in this window"
+  // and "grooming cost nothing" are different claims, and only the first is true.
+  if (ran.length > 0) {
+    lines.push(`${indent}daemon sessions:`);
+    for (const s of ran) {
+      // Same rule as the per-model line: an unmetered session's cost is
+      // unknown, so it is a count, never a zero folded into the dollar figure.
+      if (s.spendUsd === 0 && s.unmeteredSessions === s.sessions) {
+        lines.push(
+          `${indent}  ${s.role}  ${countLine(s.sessions, "session", "sessions")}, ` +
+            `${countLine(s.turns, "turn", "turns")}  cost unknown — no session metered`,
+        );
+        continue;
+      }
+      const unknown =
+        s.unmeteredSessions === 0
+          ? ""
+          : ` · ${countLine(s.unmeteredSessions, "session", "sessions")} unmetered (cost unknown, not $0.00)`;
+      lines.push(
+        `${indent}  ${s.role}  ${countLine(s.sessions, "session", "sessions")}, ` +
+          `${countLine(s.turns, "turn", "turns")}  $${s.spendUsd.toFixed(2)} metered${unknown}`,
+      );
+    }
+  }
+  if (report.unmeteredRoles.length > 0) {
+    lines.push(
+      `${indent}  ${report.unmeteredRoles.join(", ")}  unmetered — no usage events are observable for ` +
+        `${report.unmeteredRoles.length === 1 ? "this session" : "these sessions"}, so the cost is unknown and no figure above includes it`,
+    );
+  }
+  return lines;
+}
+
 /** Render the human form of the same {@link StatsReport} `--json` prints. */
 export function renderStatsHuman(report: StatsReport): string {
   const w = report.window;
   const header = `${report.project} — outcomes ${w.sinceDay} → ${w.untilDay}`;
   if (report.empty) {
-    return `${header}\n  nothing settled in the window — no runs recorded, so there are no measurements to report yet (a fresh store or an idle fleet).\n`;
+    return [
+      header,
+      "  nothing settled in the window — no runs recorded, so there are no measurements to report yet (a fresh store or an idle fleet).",
+      ...renderAttribution(report, "  "),
+      "",
+    ].join("\n");
   }
   const lines = [header, renderRepo(report.total, "  "), `  gh api     ${report.ghCalls} tracked ${report.ghCalls === 1 ? "call" : "calls"} in the window`];
   if (report.repos.length > 0) {
     lines.push("  per repo:");
     for (const repo of report.repos) lines.push(renderRepo(repo, "    "));
   }
+  lines.push(...renderAttribution(report, "  "));
   return `${lines.join("\n")}\n`;
 }

package/src/status-render.ts

@@ -19,7 +19,13 @@
 
 import { formatZonedMinute } from "./availability.ts";
 import { spendTelemetryDetail, type SpendTelemetryVerdict } from "./spend-telemetry.ts";
-import type { DaemonStop, GroomingRecord, InstallSurfaceObservation, RunRecord } from "./types.ts";
+import type {
+  DaemonStop,
+  GroomingRecord,
+  InstallSurfaceObservation,
+  ReviewCorrectionRound,
+  RunRecord,
+} from "./types.ts";
 import { settlementFlagSummary } from "./diff-flags.ts";
 import type { CodeGraphHealth } from "./graph-health.ts";
 import { formatDigestBacklog, formatOpenReports } from "./reports.ts";
@@ -28,6 +34,12 @@ import { planUsageLine } from "./usage.ts";
 import { HEALTH_TIMEOUT_MS, SYSTEMD_UNIT, type UnitOwnership } from "./lifecycle.ts";
 import type { WorkerPauseView } from "./fleet.ts";
 import { formatRss, rssBytesFromHealthz } from "./host.ts";
+// One constant, two readers: the durable in-flight to-spec launch marker
+// (#777) is written by the daemon's grooming launcher and read here, so the
+// reason string is imported rather than hand-copied — the copy that used to
+// live in this file was a second source of truth for a row shape nobody
+// audits.
+import { TO_SPEC_IN_FLIGHT_REASON } from "./groom.ts";
 import {
   formatBaseHealth,
   formatDispatchSummary,
@@ -242,20 +254,18 @@ const MECHANICAL_GROOMING_REASONS: Record<string, true> = {
 };
 
 /**
- * The to-spec refusal classes persisted as blocked rows (#772) — a result
- * that failed validation is a mechanical block, never a verdict. Mirrors the
- * failure kinds of `ToSpecFailure` in `to-spec.ts`.
+ * The to-spec refusal classes persisted as blocked rows (#772, #1064) — a
+ * result that failed validation, or a pass that produced no answer at all, is
+ * a mechanical block, never a verdict. Mirrors the failure kinds of
+ * `ToSpecFailure` in `to-spec.ts`.
  */
 const REFUSED_GROOMING_REASONS: Record<string, true> = {
   malformed: true,
+  "no-answer": true,
   "missing-source": true,
   "stale-source": true,
 };
 
-/** The durable in-flight launch marker (#777) — a batch is running right now.
- *  Mirrors `TO_SPEC_IN_FLIGHT_REASON` in `orchestrator-tick.ts`. */
-const GROOMING_IN_FLIGHT_REASON = "in-flight";
-
 /**
  * One project's durable grooming state as status lines, or nothing when there
  * is nothing to report (#809).
@@ -281,10 +291,12 @@ const GROOMING_IN_FLIGHT_REASON = "in-flight";
  *    (`blocked` rows whose reason is a groomer verdict or a product-judgement
  *    label, e.g. `needs-product-decision`).
  *  - `mechanically blocked` — admission's lane/dependency holds.
- *  - `refused` — to-spec results that failed validation (`malformed`,
- *    `missing-source`, `stale-source`), told apart from the holds so an
- *    operator sees whether the runway cannot move or a result cannot be
- *    trusted.
+ *  - `refused` — to-spec passes that produced no usable verdict (`malformed`,
+ *    `no-answer`, `missing-source`, `stale-source`), told apart from the
+ *    holds so an operator sees whether the runway cannot move or a result
+ *    cannot be trusted. Each row's line names its own class (`#19 malformed`,
+ *    `#22 no-answer`), so a run of identical refusals is visible as a pattern
+ *    rather than a wall of one word.
  *  - `in-flight` — a launched batch is running (#777).
  *  - `operator-parked` — the dispatch snapshot's parked count (#507).
  *
@@ -332,7 +344,7 @@ export function formatGroomingStatus(input: GroomingStatusInput): string | undef
       row.verdict === "blocked" &&
       MECHANICAL_GROOMING_REASONS[row.reason] !== true &&
       REFUSED_GROOMING_REASONS[row.reason] !== true &&
-      row.reason !== GROOMING_IN_FLIGHT_REASON,
+      row.reason !== TO_SPEC_IN_FLIGHT_REASON,
   );
   const mechanical = records.filter(
     (row) => row.verdict === "blocked" && MECHANICAL_GROOMING_REASONS[row.reason] === true,
@@ -341,7 +353,7 @@ export function formatGroomingStatus(input: GroomingStatusInput): string | undef
     (row) => row.verdict === "blocked" && REFUSED_GROOMING_REASONS[row.reason] === true,
   );
   const inFlight = records.filter(
-    (row) => row.verdict === "blocked" && row.reason === GROOMING_IN_FLIGHT_REASON,
+    (row) => row.verdict === "blocked" && row.reason === TO_SPEC_IN_FLIGHT_REASON,
   );
   const awaiting = Math.max(0, routed - records.length);
   const lines: string[] = [];
@@ -662,6 +674,143 @@ function formatSiblingLive(siblings: { project: string; live: number }[]): strin
   return `shared    daemon also serves ${siblings.length} other project(s): ${counts}`;
 }
 
+// review-correction provenance (#1048)
+// ---------------------------------------------------------------------------
+
+/**
+ * How many rounds of one run's correction chain print. A review ceiling is low
+ * single digits, so this bounds a pathological row rather than routinely
+ * truncating — and the last line printed says how many rounds it stands for,
+ * because a silently shortened chain is how a repeating pattern hides.
+ */
+const CORRECTION_CHAIN_LINES = 3;
+
+/**
+ * A session lineage as a status row carries it. A ref is a session file path,
+ * and the leading directories are the same for every session in a fleet: the
+ * identifying half is the run and the file, so the line prints those and marks
+ * what it dropped with `…/` — the same honesty `firstLine` uses above, and the
+ * full ref stays in the durable row this line is projected from. Two lineages
+ * plus two models on one row is already at the width `omp-conductor status`
+ * can be read at; a full 60-character path twice is not.
+ *
+ * An absent ref reads `unrecorded`: rows written before #1045 know nothing
+ * about their own launch, and saying so is the only honest projection of one.
+ */
+function correctionRef(ref: string | undefined): string {
+  const value = ref?.trim() ?? "";
+  if (value === "") return "unrecorded";
+  const segments = value.split("/").filter((segment) => segment !== "");
+  const tail = segments.slice(-2).join("/");
+  return firstLine(segments.length > 2 ? `…/${tail}` : value, 60);
+}
+
+/**
+ * The models of one correction round: what the daemon asked for and what the
+ * harness actually resolved. Those two differing is the whole finding — in
+ * #1035 the fleet had already switched worker models while every correction
+ * round replayed the exhausted session under the old one — so the arrow form is
+ * kept whenever they differ and collapsed only when they agree.
+ *
+ * A resumed round is worded differently on purpose. `resolvedModel` is written
+ * only by `Store.recordReviewCorrectionSession`, which refuses a round decided
+ * `resume-original` (a resumed round *is* its origin session), so a resume
+ * durably has a request and no resolution. Rendering that through the fresh
+ * wording — `requested X → ran unrecorded` — would read as a launch that lost
+ * its model, when what actually happened is that the daemon asked the harness
+ * to continue an existing transcript on X and nothing re-recorded the
+ * resolution.
+ *
+ * Every branch reads the round's OWN recorded values. The project config is
+ * deliberately not a parameter: rendering it would make a round dispatched
+ * under a since-replaced model report the replacement, which is exactly the
+ * silent fake #1048 names.
+ */
+function correctionModels(round: ReviewCorrectionRound): string {
+  const { requestedModel: requested, resolvedModel: resolved } = round;
+  if (round.launchMode === "resume-original") {
+    if (resolved !== undefined)
+      return requested === undefined || requested === resolved
+        ? `ran ${resolved}`
+        : `ran ${resolved} (asked ${requested})`;
+    if (requested !== undefined)
+      return round.state === "pending"
+        ? `to continue on ${requested}, not launched yet`
+        : `asked to continue on ${requested}`;
+    return "model unrecorded";
+  }
+  if (requested !== undefined && resolved !== undefined)
+    return requested === resolved ? `model ${resolved} as requested` : `requested ${requested} → ran ${resolved}`;
+  if (requested !== undefined)
+    return round.state === "pending"
+      ? `requested ${requested}, not launched yet`
+      : `requested ${requested} → ran unrecorded`;
+  // A resolution with no request: the harness named what it ran, the decision
+  // row that asked for it predates #1045. Still not a guess in either direction.
+  if (resolved !== undefined) return `ran ${resolved} (request unrecorded)`;
+  return "model unrecorded";
+}
+
+/**
+ * One run's review-correction chain as status lines (#1048), newest round
+ * first, six-space indented like every other run annotation.
+ *
+ * Before this, a correction round rendered as `review-revision N` and a
+ * dispatch age: an operator could not tell whether conductor had resumed the
+ * diagnosed implementation transcript or launched a fresh correction, nor under
+ * which model — which is why #1035 read as idle while an exhausted session
+ * consumed every round the fleet's new model was never asked to run.
+ *
+ * The per-line `current`/`prior` marker is where the runtime/history split
+ * lives: `current` is the newest round that has not settled, the one whose
+ * elapsed time and cumulative turns the run line above reports; every other
+ * line is chain history and carries no runtime at all. That is deliberately a
+ * property of each line rather than a header, because a header explaining how
+ * to read the following lines is a line nobody reads.
+ *
+ * Exported so the projection can be asserted directly on hand-built rounds:
+ * the interesting cases (a differing requested/resolved pair, a legacy row with
+ * no provenance) are properties of one row, not of a whole fleet.
+ */
+export function formatReviewCorrections(rounds: readonly ReviewCorrectionRound[]): string[] {
+  if (rounds.length === 0) return [];
+  const newestFirst = [...rounds].sort((a, b) => b.round - a.round);
+  const shown = newestFirst.slice(0, CORRECTION_CHAIN_LINES);
+  const hidden = newestFirst.length - shown.length;
+  return shown.map((round, index) => {
+    const current = index === 0 && round.state !== "settled";
+    // The round's lifecycle as one phrase. `queued` covers both a round nobody
+    // has dispatched yet and one a restart returned to the queue — durably they
+    // are the same row, and status must not invent a distinction the store does
+    // not keep.
+    const state =
+      round.state === "settled"
+        ? `settled ${round.outcome ?? "outcome unrecorded"}`
+        : round.state === "pending"
+          ? "queued"
+          : "dispatched";
+    const provenance =
+      round.launchMode === undefined
+        ? // A row written before #1045 recorded no launch decision. Status says
+          // so and stops: the alternative — reading today's configuration back
+          // as though it had been this round's — is a fabricated provenance,
+          // and an operator auditing #1035 would have believed it.
+          "provenance unknown (pre-#1045 round)"
+        : round.launchMode === "resume-original"
+          ? // A resume continues one lineage, so there is one session to name:
+            // the implementation transcript the review diagnosed.
+            `resume-original  resumed session ${correctionRef(round.originSessionRef)}  ${correctionModels(round)}`
+          : // A fresh correction has two: the transcript that was reviewed, and
+            // the new session doing the correcting. Naming only one of them is
+            // how "fresh" became indistinguishable from "resumed".
+            `fresh-correction  new session ${correctionRef(round.correctionSessionRef)} (diagnosed ${correctionRef(
+              round.originSessionRef,
+            )})  ${correctionModels(round)}`;
+    const tail = index === shown.length - 1 && hidden > 0 ? `  (+${hidden} earlier round(s))` : "";
+    return `      correction round ${round.round} ${current ? "current" : "prior"} (${state})  ${provenance}${tail}`;
+  });
+}
+
 
 function formatProjectBody(
   s: StatusSnapshot,
@@ -867,6 +1016,12 @@ function formatProjectBody(
               : "failed at this head"
         } — unresolved findings; push a corrected head, or record a conductor_pr_review_clear for this exact head, before merge`,
       );
+    // The correction chain (#1048), rendered from the same annotation helper as
+    // the merge blocker above so it reaches BOTH surfaces that show a run: the
+    // live lease and the preserved artifact. A round whose worker has finished
+    // leaves the lease list, and that is precisely when an operator asks what
+    // the last correction actually did.
+    out.push(...formatReviewCorrections(s.reviewCorrections?.[r.id] ?? []));
     return out;
   };
   if (s.activeRuns.length === 0) {