omp-conductor 0.20.0 → 0.20.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.20.0",
+  "version": "0.20.2",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/schema/config.schema.json

@@ -92,6 +92,18 @@
           "minimum": 0,
           "description": "Wall-clock ceiling for one worker (default 5400000)"
         },
+        "workerStallSilenceMs": {
+          "anyOf": [
+            {
+              "type": "number",
+              "minimum": 0
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "How long a live worker's transcript may stay unwritten before the daemon settles it as a progress stall; null derives a third of workerWallClockMs"
+        },
         "maxAttemptsPerIssue": {
           "type": "number",
           "minimum": 0,
@@ -357,6 +369,18 @@
                 "minimum": 0,
                 "description": "Wall-clock ceiling for one worker (default 5400000)"
               },
+              "workerStallSilenceMs": {
+                "anyOf": [
+                  {
+                    "type": "number",
+                    "minimum": 0
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "description": "How long a live worker's transcript may stay unwritten before the daemon settles it as a progress stall; null derives a third of workerWallClockMs"
+              },
               "maxAttemptsPerIssue": {
                 "type": "number",
                 "minimum": 0,

package/src/admission.ts

@@ -270,7 +270,9 @@ function planUsageEscalation(project: string, plan: PlanUsageStatus): Escalation
  *   optional bold/heading markers) whose rest carries the paths as
  *   backtick-delimited spans (the brief form), with a bare
  *   comma/space-separated fallback that keeps tokens that look like relative
- *   paths.
+ *   paths. The paths are the *leading* backticked run: a comma/space-separated
+ *   list at the line's start, and any backticked path later on the line is
+ *   prose, not a write target (#1073).
  * - The write-lane section (#825): a markdown heading "Exact write lane" (or
  *   "Write lane" / "write-lane") whose immediately following bullet items
  *   carry the paths — the package-floor decomposition format, where a groomed
@@ -278,7 +280,9 @@ function planUsageEscalation(project: string, plan: PlanUsageStatus): Escalation
  *   the contiguous bullet run under that heading is read: a following
  *   paragraph (like a "Read only:" caveat) or a later section ends it, so
  *   read-only entry points, proof commands and acceptance bullets elsewhere in
- *   the issue are never captured.
+ *   the issue are never captured. Each bullet contributes its leading
+ *   backticked path run alone — a filename named in a bullet's prose (say, to
+ *   note that it does not exist) is prose, never a lane entry (#1073).
  *
  * Inline wins when both are present — the machine-shaped sentence has held
  * since #555, and the mediated label echo shows exactly which declaration
@@ -295,20 +299,59 @@ export function laneDeclaration(text: string): LaneDeclaration | undefined {
   return inlineLaneDeclaration(text) ?? sectionLaneDeclaration(text);
 }
 
+/** One declared surface's paths (#1073). The canonical spelling is a leading
+ *  run of backticked paths — a comma/space-separated list at the surface's
+ *  start. A backticked path later in the same surface is prose, not part of
+ *  the lane: a parenthetical like "(there is no `settle-pass.test.ts`)" is a
+ *  sentence for the reader, and reading it as a write target makes a correct
+ *  issue permanently refuse. A surface with no leading backticked path keeps
+ *  the fallback: every backticked pathlike token, else bare
+ *  comma/space-separated pathlike tokens (the unbackticked spelling). */
+function writeLanePaths(text: string): string[] {
+  const fromRun = leadingBacktickedRun(text).filter(isPathLike);
+  if (fromRun.length > 0) return fromRun;
+  const backticked = [...text.matchAll(/`([^`]+)`/g)]
+    .map((m) => m[1]!.trim())
+    .filter(isPathLike);
+  return backticked.length > 0
+    ? [...new Set(backticked)]
+    : [...new Set(text.split(/[,\s]+/).map((s) => s.trim()).filter(isPathLike))];
+}
+
+/** The leading backticked run of a surface (or bullet): consecutive
+ *  backtick-delimited tokens separated by commas or whitespace, starting at
+ *  the first character. A run is a *list*; the first non-backtick,
+ *  non-separator character ends it, so "`a.ts`, `b.ts`" yields both while
+ *  "`a.ts` — see `b.ts`" yields only `a.ts`. Empty when the surface does not
+ *  open with a backtick. */
+function leadingBacktickedRun(text: string): string[] {
+  const trimmed = text.trim();
+  if (!trimmed.startsWith("`")) return [];
+  const run: string[] = [];
+  let pos = 0;
+  while (true) {
+    if (trimmed[pos] !== "`") break;
+    const close = trimmed.indexOf("`", pos + 1);
+    if (close < 0) break;
+    const token = trimmed.slice(pos + 1, close).trim();
+    if (token === "") break;
+    run.push(token);
+    pos = close + 1;
+    const sep = /^[,\s]+/.exec(trimmed.slice(pos));
+    if (sep === null) break;
+    pos += sep[0].length;
+  }
+  return run;
+}
+
 /** The inline `File lane:`/`File-lane=` sentence grammar (see {@link laneDeclaration}). */
 function inlineLaneDeclaration(text: string): LaneDeclaration | undefined {
   const match = text.match(
-    /^\s*(?:[#>*-]\s*)*file[- ]lane\s*[:=]\s*([^\n]*)$/im,
+    /^\s*(?:[#>*-]\s*)*file[- ]lane\s*[:=]\s*(?:(?:\*\*|\*|__|_)\s*)?([^\n]*)$/im,
   );
   if (match === null) return undefined;
   const rest = match[1] ?? "";
-  const backticked = [...rest.matchAll(/`([^`]+)`/g)]
-    .map((m) => m[1]!.trim())
-    .filter(isPathLike);
-  const files =
-    backticked.length > 0
-      ? [...new Set(backticked)]
-      : [...new Set(rest.split(/[,\s]+/).map((s) => s.trim()).filter(isPathLike))];
+  const files = writeLanePaths(rest);
   if (files.length === 0) return undefined;
   return { files, source: match[0].trim() };
 }
@@ -351,10 +394,11 @@ function sectionLaneDeclaration(text: string): LaneDeclaration | undefined {
     const marker = line.match(/^[ \t]*(?:[-*+]|\d+[.)])[ \t]+(?:\[[ xX]\][ \t]+)?/);
     if (marker === null) break;
     const rest = line.slice(marker[0].length);
-    const backticked = [...rest.matchAll(/`([^`]+)`/g)]
-      .map((m) => m[1]!.trim())
-      .filter(isPathLike);
-    files.push(...(backticked.length > 0 ? backticked : rest.split(/[,\s]+/).map((s) => s.trim()).filter(isPathLike)));
+    // One bullet contributes its leading backticked path run — what it
+    // declares it writes, not every backticked token its prose mentions.
+    // A bullet without a leading backticked path keeps the fallback
+    // (bare pathlike tokens), so unbackticked lanes are unaffected.
+    files.push(...writeLanePaths(rest));
     bullets.push(line.trim());
   }
   if (files.length === 0) return undefined;

package/src/arm-challenge.ts

@@ -5,9 +5,12 @@
  * orchestrator-workflow redesign).
  *
  * `armTicks` (fleet.ts) sends a short-lived `FLEET-…` code to the operator and
- * files the challenge here. Verification is a second, mechanical CLI step:
- * `omp-conductor arm --reply "<the operator's message>"` classifies the
- * message against these records and arms the projects the challenge named.
+ * files the challenge here. Verification classifies the operator's message
+ * against these records and arms the projects the challenge named — either
+ * mechanically in the orchestrator session, which owns the project topic the
+ * challenge is sent to (#1061), or through the CLI step
+ * `omp-conductor arm --reply "<the operator's message>"` from a console host
+ * whose DM the operator answered in.
  *
  * Nothing waits for the reply any more. The console session owns the operator
  * DM, and no tick extension runs there — so the in-session acknowledgement
@@ -498,3 +501,51 @@ export function observeArmChallenge(project: string | undefined): ArmChallengeSi
     ...(ack === undefined ? {} : { acknowledgedAt: ack.acknowledgedAt }),
   };
 }
+
+/** One expired, unsettled ceremony, with the key the notice clears it under. */
+export interface ExpiredArmChallenge {
+  /**
+   * The record's own state key — the project key or {@link FLEET_ARM_KEY} —
+   * passed straight back to {@link clearArmTransaction} after the notice, so
+   * the clear is addressed to the record that actually expired.
+   */
+  key: string;
+  /** The expired transaction's id. */
+  id: string;
+  /** The sighting, acknowledgement included when a reply was seen. */
+  sighting: ArmChallengeSighting;
+}
+
+/**
+ * Every pending challenge that is no longer a proof — the project's own record
+ * and the fleet-wide one, in the same consultation order as
+ * {@link resolveArmReply} — whose window has passed without being settled.
+ * An acknowledgement may already exist (the reply was seen but the settle
+ * never completed), which is still unsettled: the notice must name that
+ * reason, and {@link doctor} does the same. This is what lets the fleet
+ * session tell the operator a ceremony died instead of letting the record sit
+ * invisible until the next arm replaces it.
+ */
+export function expiredArmChallenges(
+  project: string | undefined,
+  now: number,
+): ExpiredArmChallenge[] {
+  const keys = projectKey(project) === FLEET_ARM_KEY ? [FLEET_ARM_KEY] : [projectKey(project), FLEET_ARM_KEY];
+  const expired: ExpiredArmChallenge[] = [];
+  for (const key of keys) {
+    const pending = readPendingFor(key);
+    if (pending === undefined || pending.expiresAt > now) continue;
+    const ack = readArmAcknowledgement(pending.id);
+    expired.push({
+      key,
+      id: pending.id,
+      sighting: {
+        id: pending.id,
+        ...(typeof pending.sentAt === "number" ? { sentAt: pending.sentAt } : {}),
+        ...(typeof pending.expiresAt === "number" ? { expiresAt: pending.expiresAt } : {}),
+        ...(ack === undefined ? {} : { acknowledgedAt: ack.acknowledgedAt }),
+      },
+    });
+  }
+  return expired;
+}

package/src/briefs/console.md

@@ -156,13 +156,18 @@ same turn — an approved answer is work to execute, not a proposal to re-open.
 
 ## Arm ceremony
 
-Ticks are gated on an operator-owned marker, and the console runs the ceremony
-that writes it. Two mechanical steps, and nothing waits anywhere:
+Ticks are gated on an operator-owned marker, and something real always owns
+the ceremony that writes it. Two mechanical halves, and nothing waits
+anywhere:
 
 1. `omp-conductor arm [--project {{PROJECT}}]` — records the challenge, sends it
-   to the operator, and returns immediately, naming the exact follow-up command.
-   It writes no marker.
-2. `omp-conductor arm --reply "<the operator's message, verbatim>" [--project
+   to the project topic (this fleet's own chat), and returns immediately,
+   naming the exact follow-up command. It writes no marker.
+2. A reply settles the ceremony. A reply sent in the project topic is consumed
+   mechanically by the orchestrator session itself — the challenge is sent to
+   the topic that session claims, so on a host with no console session the
+   ceremony still completes on its own. A reply sent here in the DM is yours:
+   `omp-conductor arm --reply "<the operator's message, verbatim>" [--project
    {{PROJECT}}]` — classifies that reply and, on a match, writes the marker for
    the targets the ceremony recorded.
 

package/src/commands/arm.ts

@@ -4,10 +4,11 @@
  * `arm` files a challenge, sends it, and returns immediately naming the
  * follow-up command. `arm --reply "<the operator's message>"` verifies that
  * message and writes the arm marker for exactly the projects the challenge
- * recorded. Nothing waits anywhere: the operator's reply lands in the console
- * session, which runs no tick extension, so the in-session acknowledgement wait
- * this replaces could never be satisfied (phase 1 of the orchestrator-workflow
- * redesign).
+ * recorded. Nothing waits anywhere: a reply sent to the project topic is
+ * consumed mechanically by the orchestrator pane itself (#1061), and this
+ * command remains the console's route for a reply that landed in the operator
+ * DM — the in-session acknowledgement wait this replaced could never be
+ * satisfied, because the console session runs no tick extension.
  *
  * Both halves print copy-pasteable commands, because the reader is usually an
  * agent in a console pane rather than a human at a prompt.
@@ -95,7 +96,8 @@ function challengeReceipt(sent: ArmChallengeSent): string {
   return (
     `CHALLENGE SENT — a code went to owner ${sent.owner}, valid for ${sent.validFor} ` +
     `(challenge ${sent.challengeId}).\n` +
-    `NOTHING IS ARMED YET. When the operator replies, run:\n` +
+    `NOTHING IS ARMED YET. A reply in the challenge's chat settles it automatically; ` +
+    `on a console host run:\n` +
     `  ${sent.followUp}\n` +
     `That reply will arm ${String(sent.targets.length)} project(s):\n` +
     sent.targets

package/src/commands/companion.ts

@@ -53,6 +53,52 @@ export function drawFrame(lines: readonly string[], previous: number): string {
   return lines.length < previous ? `${HOME}${body}\n${ERASE_BELOW}` : `${HOME}${body}\n`;
 }
 
+/**
+ * How the pane sleeps out the interval between renders. Production is
+ * {@link timerSleep}; tests inject a fake (#1085) so no real timer runs and
+ * the wait's scheduling is asserted directly.
+ */
+export type CompanionSleep = (ms: number, signal: AbortSignal) => Promise<void>;
+
+/** The production sleep: one ref'd timeout for the whole interval, ended
+ * early by an abort. Ref'd deliberately (#1085): the pending deadline is the
+ * event loop's reason to sleep out the minute. The old wait unref'd this
+ * timer and polled `stopped` every 250 ms instead — with nothing ref'd left
+ * to wait on, the loop never slept, and the pane burned ~99% of a core
+ * between renders (~10k epoll wakes a second, measured). The unrefs' real
+ * job — never outlive the pane — belongs to cleanup, not to the handle flag:
+ * every exit path here clears the timer and detaches its listener, SIGINT
+ * and SIGTERM abort within microseconds of delivery, and a pane closed by
+ * its terminal still kills the process by signal regardless of all this.
+ * Same shape as `sleepUntilAbort` in commands/tail.ts and board.ts's
+ * `waitForInput`, which never had the spin because its deadline stayed
+ * ref'd. */
+export const timerSleep: CompanionSleep = (ms, signal) => {
+  // An already-aborted signal can never fire its listener.
+  if (signal.aborted) return Promise.resolve();
+  return new Promise<void>((resolve) => {
+    const done = (): void => {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", done);
+      resolve();
+    };
+    const timer = setTimeout(done, ms);
+    signal.addEventListener("abort", done, { once: true });
+  });
+};
+/** Wait out one refresh interval, ending early the moment `stopped` aborts.
+ * Exactly one sleep is scheduled per render — the poll this replaced
+ * scheduled four a second and spun the process hot between them (#1085).
+ * A stop that has already landed ends the wait before anything is scheduled.
+ * Tests drive the wait through an injected {@link CompanionSleep}. */
+export async function waitOutRefreshInterval(
+  stopped: AbortSignal,
+  sleep: CompanionSleep = timerSleep,
+): Promise<void> {
+  if (stopped.aborted) return;
+  await sleep(COMPANION_REFRESH_SECONDS * 1_000, stopped);
+}
+
 export async function companionCommand(ctx: CommandContext): Promise<void> {
   const sub = ctx.argv[1];
   if (sub !== "decisions") {
@@ -65,14 +111,14 @@ export async function companionCommand(ctx: CommandContext): Promise<void> {
   const once = ctx.argv.includes("--once");
 
   let previous = 0;
-  let stopped = false;
+  const stopped = new AbortController();
   const stop = (): void => {
-    stopped = true;
+    stopped.abort();
   };
   process.on("SIGINT", stop);
   process.on("SIGTERM", stop);
 
-  while (!stopped) {
+  while (!stopped.signal.aborted) {
     // Opened per render, closed immediately: a companion pane lives for days,
     // and a handle held that long across daemon restarts and db snapshots is a
     // handle to a file that may no longer be the store.
@@ -86,18 +132,8 @@ export async function companionCommand(ctx: CommandContext): Promise<void> {
     process.stdout.write(drawFrame(lines, previous));
     previous = lines.length;
     if (once) return;
-    await new Promise<void>((resolve) => {
-      const timer = setTimeout(resolve, COMPANION_REFRESH_SECONDS * 1_000);
-      // Never hold the process open past a signal: the pane is closed by
-      // closing the pane, and a lingering timer would outlive it.
-      timer.unref?.();
-      const poll = setInterval(() => {
-        if (!stopped) return;
-        clearInterval(poll);
-        clearTimeout(timer);
-        resolve();
-      }, 250);
-      poll.unref?.();
-    });
+    // One ref'd sleep for the whole minute, aborted early on SIGINT/SIGTERM
+    // — see timerSleep above for why it must stay ref'd (#1085).
+    await waitOutRefreshInterval(stopped.signal);
   }
 }

package/src/commands/drain.ts

@@ -24,13 +24,15 @@ usage:
   omp-conductor drain cancel [--project NAME]
 
 A drain is a durable, self-expiring admission fence: new claims pause while
-existing runs settle, and admission resumes automatically at the absolute
+existing runs settle, an emptied fleet OPENS the release window rather than
+ending the drain (#1078), and admission resumes automatically at the absolute
 deadline — even if the orchestrator crashes. start replaces any prior drain of
 the project; --until takes an ISO instant or a relative duration (90s, 45m,
 2h, 1d) that must be bounded and in the future. status reports the active
-drain's creation time, absolute expiry, reason, and remaining active runs.
-cancel removes the project's drain and is idempotent. A drain never touches
-the pause sentinel, the arm marker, or any queue label — it is the file record
+drain's creation time, absolute expiry, reason, remaining active runs, and
+whether the window is still draining or already drained and holding. cancel
+removes the project's drain and is idempotent. A drain never touches the
+pause sentinel, the arm marker, or any queue label — it is the file record
 that expires on its own.`;
 
 /** The flags each drain subcommand accepts, after the subcommand itself. */
@@ -143,7 +145,7 @@ export async function drainCommand(ctx: CommandContext): Promise<void> {
     );
     process.stdout.write(
       dim(
-        "the drain is a durable record: it survives crashes and resumes admission at the deadline on its own",
+        "the drain is a durable record: it survives crashes, holds the window open once the fleet empties, and resumes admission at the deadline on its own",
       ) + "\n",
     );
     return;
@@ -161,6 +163,11 @@ export async function drainCommand(ctx: CommandContext): Promise<void> {
       `  expires at  ${new Date(drain.expiresAt).toISOString()}`,
       ...(drain.reason === undefined ? [] : [`  reason      ${drain.reason}`]),
       `  remaining   ${drain.remainingRuns} active run${drain.remainingRuns === 1 ? "" : "s"}`,
+      ...(drain.remainingRuns === 0
+        ? [
+            `  state       drained and holding until ${new Date(drain.expiresAt).toISOString()} — admission resumes at the deadline`,
+          ]
+        : ["  state       draining — the window holds while runs settle"]),
     ];
     process.stdout.write(`${lines.join("\n")}\n`);
     return;

package/src/commands/worker.ts

@@ -33,6 +33,10 @@ if (sub === "stop" && (reason === undefined || reason === "" || reason.length >
   );
   process.exit(2);
 }
+// A bare presence flag, parsed like every other boolean flag in this CLI:
+// the daemon refuses a stop that would strand an open PR (#1101), and this is
+// the operator's explicit record of choosing to do so anyway.
+const allowOpenPr = sub === "stop" && ctx.argv.includes("--allow-open-pr");
 const project = findProject(loadConfig(), ctx.projectFlag);
 // The pidfile is authoritative when it names a live process; a missing or
 // stale record falls back to the systemd unit, proved through its own
@@ -51,6 +55,7 @@ const response = await fetch(
       project: project.name,
       source: "cli",
       ...(reason === undefined ? {} : { reason }),
+      ...(allowOpenPr ? { allowOpenPr: true } : {}),
     }),
   },
 );

package/src/config-schema.ts

@@ -137,6 +137,14 @@ const capsSchema = z
     workerMaxTurns: z.number().min(0).describe(`Turn ceiling for one worker (default ${DEFAULT_CAPS.workerMaxTurns})`),
     workerMaxTurnsCeiling: z.number().min(0).describe(`Maximum turn budget assignable to one issue's next attempt`),
     workerWallClockMs: z.number().min(0).describe(`Wall-clock ceiling for one worker (default ${DEFAULT_CAPS.workerWallClockMs})`),
+    workerStallSilenceMs: z
+      .number()
+      .min(0)
+      .nullable()
+      .describe(
+        "How long a live worker's transcript may stay unwritten before the daemon settles it as a " +
+          "progress stall; null derives a third of workerWallClockMs",
+      ),
     maxAttemptsPerIssue: z.number().min(0).describe(`Failed attempts allowed before escalation (default ${DEFAULT_CAPS.maxAttemptsPerIssue})`),
     maxContinuationsPerIssue: z.number().min(0).describe(`Operational continuations allowed before crash/resume escalation (default ${DEFAULT_CAPS.maxContinuationsPerIssue})`),
   })

package/src/config.ts

@@ -293,6 +293,11 @@ export function resolveCaps(p: ProjectConfig, defaults: Caps): Caps {
       o.workerMaxTurnsCeiling ??
       (o.workerMaxTurns === undefined ? defaults.workerMaxTurnsCeiling : workerMaxTurns * 2),
     workerWallClockMs: o.workerWallClockMs ?? defaults.workerWallClockMs,
+    // Same `!== undefined` reading as `maxRunSpendUsd`: an explicit `null`
+    // means "derive from workerWallClockMs", not "inherit a global override"
+    // (#1086).
+    workerStallSilenceMs:
+      o.workerStallSilenceMs !== undefined ? o.workerStallSilenceMs : defaults.workerStallSilenceMs,
     maxAttemptsPerIssue: o.maxAttemptsPerIssue ?? defaults.maxAttemptsPerIssue,
     maxContinuationsPerIssue:
       o.maxContinuationsPerIssue ?? defaults.maxContinuationsPerIssue,
@@ -1109,7 +1114,9 @@ function capProblem(key: string, found: string): string {
   }
   return key === "dailySpendUsd"
     ? `caps.dailySpendUsd must be a non-negative finite number or null (no cap), found ${found}`
-    : `caps.${key} must be a non-negative finite number, found ${found}`;
+    : key === "workerStallSilenceMs"
+      ? `caps.workerStallSilenceMs must be a non-negative finite number or null (derive it from workerWallClockMs), found ${found}`
+      : `caps.${key} must be a non-negative finite number, found ${found}`;
 }
 
 /** Quted fallback key lists for policy unknown-key errors. */
@@ -1729,10 +1736,18 @@ function reconcileCaps(
       out.dailySpendUsd = null;
       continue;
     }
+    if (key === "workerStallSilenceMs" && v === null) {
+      // Null is the derive-it value (#1086): a third of the wall-clock ceiling,
+      // computed where the window is read, so it passes through untouched.
+      out.workerStallSilenceMs = null;
+      continue;
+    }
     problems.push(
       key === "dailySpendUsd"
         ? `${label}.${key} must be a non-negative finite number or null (no cap), found ${JSON.stringify(v)}`
-        : `${label}.${key} must be a non-negative finite number, found ${JSON.stringify(v)}`,
+        : key === "workerStallSilenceMs"
+          ? `${label}.${key} must be a non-negative finite number or null (derive it from workerWallClockMs), found ${JSON.stringify(v)}`
+          : `${label}.${key} must be a non-negative finite number, found ${JSON.stringify(v)}`,
     );
   }
 

package/src/daemon/drain.ts

@@ -35,6 +35,10 @@ export interface DrainRecord {
   createdAt: string;
   /** Absolute ISO deadline: admission resumes automatically at or after it. */
   expiresAt: string;
+  /** ISO instant a dispatch pass first observed an empty active set under
+   *  this drain — the moment the release window opened (#1078). Written by
+   *  the tick's drain pass, never by the operator; absent until then. */
+  drainedAt?: string;
   /** Purpose recorded at creation (release window, maintenance…). */
   reason?: string;
 }
@@ -54,6 +58,7 @@ export type DrainProblem =
   | "invalid-project"
   | "invalid-created-at"
   | "invalid-expires-at"
+  | "invalid-drained-at"
   | "expiry-not-future"
   | "invalid-reason";
 
@@ -143,6 +148,13 @@ export function readDrain(project: string, now = Date.now()): DrainVerdict {
   if (reason !== undefined && typeof reason !== "string") {
     return { kind: "error", problem: "invalid-reason" };
   }
+  const drainedAt = rec["drainedAt"];
+  if (
+    drainedAt !== undefined &&
+    (typeof drainedAt !== "string" || Number.isNaN(Date.parse(drainedAt)))
+  ) {
+    return { kind: "error", problem: "invalid-drained-at" };
+  }
   if (rec["project"] !== project) {
     // A record persisted at this project's path but naming another project is
     // either a copy or a rename mishap; it fences nobody (that project's drain
@@ -157,6 +169,7 @@ export function readDrain(project: string, now = Date.now()): DrainVerdict {
     createdAt: rec["createdAt"],
     expiresAt: rec["expiresAt"],
     ...(reason === undefined ? {} : { reason }),
+    ...(drainedAt === undefined ? {} : { drainedAt }),
   };
   return { kind: "active", drain };
 }
@@ -179,6 +192,26 @@ export function consumeDrain(project: string, now = Date.now()): DrainVerdict {
   return verdict;
 }
 
+/**
+ * Marks an active drain with the instant its active set first reached zero —
+ * the moment the release window opened (#1078). A no-op for anything that is
+ * not a fresh, unmarked fence: absent, expired, malformed and already-marked
+ * records are left exactly as they were, so only the opening transition ever
+ * writes. The rewrite is atomic (tmp + rename, exactly like
+ * {@link createDrain}), so a crash mid-write can never leave a half-record.
+ * The annotation is what makes the window's opening durable and keeps the
+ * tick's log line a once-per-drain event instead of once-per-pass noise.
+ */
+export function markDrained(project: string, now = Date.now()): void {
+  const verdict = readDrain(project, now);
+  if (verdict.kind !== "active" || verdict.drain.drainedAt !== undefined) return;
+  const marked: DrainRecord = { ...verdict.drain, drainedAt: new Date(now).toISOString() };
+  const path = drainPath(project);
+  const tmp = `${path}.${process.pid.toString(36)}.${Date.now().toString(36)}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(marked, null, 2)}\n`);
+  renameSync(tmp, path);
+}
+
 /** Removes this project's drain, idempotently — a second cancel is a no-op. */
 export function cancelDrain(project: string): void {
   rmSync(drainPath(project), { force: true });

package/src/daemon/groom-pass.ts

@@ -245,14 +245,23 @@ export async function handleToSpecGrooming(
     at: Date.now(),
   });
 
-  // The scout's answer, unjudged, through the one validator. Its report stands
-  // in when it produced no answer at all, so the refusal names what went wrong
-  // (an unresolvable role, a harness that would not start) instead of recording
-  // an empty string nobody can diagnose.
+  // The scout's answer, unjudged, through the one validator (#1064). Only the
+  // structured payload is graded: a session that produced no payload at all is
+  // its own refusal class (`no-answer`), with the narration recorded as
+  // context, and a payload recovered from the text carries its `via` marker so
+  // the record says it did not come through the yield contract. `raw: ""`
+  // therefore means "no answer", and the pass never grades `result.report` as
+  // if it were one.
   const outcome = recordToSpecGrooming(d.store, {
     project: project.name,
     issue,
-    input: result.raw === "" ? result.report : result.raw,
+    input: result.raw,
+    via: result.via === "text" ? "text" : result.raw === "" ? undefined : "yield",
+    report: result.report,
+    repaired: result.repaired,
+    killedAtCeiling: result.killedAtCeiling,
+    maxTurns: TO_SPEC_MAX_TURNS,
+    turns: result.turns,
     launchedAt: batch.launchedAt,
   });
   const ran = result.model === undefined ? "" : ` by ${result.model}`;
@@ -261,9 +270,10 @@ export async function handleToSpecGrooming(
   // stores and what the stats lane renders.
   const cost =
     result.turns > 0 && result.spendUsd === 0 ? "unmetered" : `$${result.spendUsd.toFixed(2)}`;
+  const repairNote = result.repaired === true ? " (repaired)" : "";
   log(
     `#${issue} groomed ${outcome.record.verdict}(${outcome.record.reason})${ran} in batch ${batch.id} — ` +
-      `${result.turns} turn(s), ${cost}`,
+      `${result.turns} turn(s), ${cost}${repairNote}`,
   );
   if (outcome.kind !== "persisted" || outcome.record.verdict !== "promotable") return;
   await promoteGroomedVerdict(d, outcome.record);

package/src/daemon/http.ts

@@ -176,6 +176,34 @@ export async function workerControlResponse(
 
 
   const issue = Number(match[1]);
+  // The #1101 front door: stopping a live run that has already pushed a PR
+  // strands that PR — the review verb could not return it and dispatch will
+  // not re-claim an issue with an open PR. Refuse and name the PR so the
+  // operator chooses knowingly; the explicit flag records that choice. A row
+  // that is not live settles as already-terminal below, where no strand is
+  // possible, and a run that never pushed has nothing to strand.
+  const rawAllowOpenPr = Reflect.get(body, "allowOpenPr");
+  if (rawAllowOpenPr !== undefined && typeof rawAllowOpenPr !== "boolean") {
+    return Response.json({ error: "allowOpenPr must be a boolean when present" }, { status: 400 });
+  }
+  const controlled = action === "stop" ? store.latestRun(project, issue) : undefined;
+  if (
+    action === "stop" &&
+    rawAllowOpenPr !== true &&
+    controlled !== undefined &&
+    controlled.prUrl !== undefined &&
+    LIVE_STATES.includes(controlled.state)
+  ) {
+    return Response.json(
+      {
+        error:
+          `#${issue} run ${controlled.id} already pushed ${controlled.prUrl} — stopping now would strand it: ` +
+          "a stopped run cannot be returned for review, and dispatch will not re-claim an issue with an open PR. " +
+          "Pass allowOpenPr (worker stop --allow-open-pr) to stop it anyway.",
+      },
+      { status: 409 },
+    );
+  }
   const outcome =
     action === "pause"
       ? await registry.pause(project, issue, source)