omp-conductor 0.20.0 → 0.20.2

package/src/failure-class.ts

@@ -15,7 +15,7 @@
  * green test per class" possible without a daemon, a tracker or a network.
  */
 
-import type { Caps, FailureClass, RecoveryAction, RunRecord } from "./types.ts";
+import { DEFAULT_CAPS, type Caps, type FailureClass, type RecoveryAction, type RunRecord } from "./types.ts";
 
 /** Facts the caller fetched, each only for the rows that need it.
  *
@@ -34,6 +34,14 @@ export interface ClassifyFacts {
    *  reachable. Lets the table tell an infrastructure outage (#177) from a
    *  deterministic test failure by the log's own words. */
   failingLog?: string;
+  /** The PR's changed-file list, derived at the settle call site from the
+   *  diff the settlement already fetches (#1059). Lets the table tell a
+   *  Compose dependency-startup failure no PR could have caused from one a
+   *  PR's own diff did — a PR that touches no container configuration cannot
+   *  have broken `docker compose up`. Absent means the diff could not be
+   *  read (or was cut short), which is "could not tell": the conditional
+   *  signature below then stays silent and the attempt is charged. */
+  changedFiles?: string[];
 }
 
 export interface Classification {
@@ -194,6 +202,45 @@ export const SPINNING_CAP_CLASSES: readonly FailureClass[] = [
   "wall-clock-cap-spinning",
 ];
 
+/** How much of the wall-clock ceiling the default stall window may take (#1086). */
+export const WALL_CLOCK_STALL_SHARE = 3;
+
+/**
+ * The transcript-silence window a stalled run is settled at (#1086): the
+ * configured `workerStallSilenceMs`, or a third of the wall-clock ceiling when
+ * it is null or unconfigured. Shared by the daemon's progress watch (which
+ * settles at this threshold) and the classifier (which recognises a row killed
+ * at it), so the two can never disagree about what a stall is.
+ */
+export function stallSilenceMs(
+  caps:
+    | {
+        workerStallSilenceMs?: number | null;
+        workerWallClockMs: number;
+      }
+    | undefined,
+): number {
+  const wallClock = caps?.workerWallClockMs ?? DEFAULT_CAPS.workerWallClockMs;
+  return caps?.workerStallSilenceMs ?? Math.floor(wallClock / WALL_CLOCK_STALL_SHARE);
+}
+
+/**
+ * How long a run sat silent before its stall kill, from the row's own facts
+ * (#1086). Defined only when the progress watch had observed the run AND the
+ * silence reached the configured window — the exact predicate that keeps every
+ * other killed-under-ceiling row (a drain, an operator stop) reading as
+ * `admin-kill`.
+ */
+export function stallSilence(
+  run: RunRecord,
+  caps: { workerStallSilenceMs?: number | null; workerWallClockMs: number } | undefined,
+): number | undefined {
+  if (run.lastProgressAt === undefined || run.endedAt === undefined) return undefined;
+  const silent = run.endedAt - run.lastProgressAt;
+  if (silent < stallSilenceMs(caps)) return undefined;
+  return silent;
+}
+
 /**
  * A stable fingerprint of the infrastructure signature list (#638). The
  * historical reconciliation persists a per-project review cursor stamped with
@@ -208,6 +255,62 @@ export function infraSignatureVersion(): string {
   return INFRA_LOG_SIGNATURES.join("|");
 }
 
+/**
+ * Compose's own sentence for a dependency that failed its healthcheck during
+ * `docker compose up`: "dependency failed to start: container
+ * chad-postgres-1 is unhealthy" (#1059). Matched with its trailing context,
+ * never a bare `is unhealthy` — that phrase is common enough in application
+ * logs to be unsafe on its own. Shared with the settle call site so the diff
+ * fetch and the classifier can never disagree about which log sentence needs
+ * the changed-file list.
+ */
+export const COMPOSE_DEPENDENCY_STARTUP_SIGNATURE =
+  "dependency failed to start: container ";
+
+/**
+ * A changed path that configures the containers Compose jobs run, or the
+ * workflow that invokes them: a compose file — `docker-compose*.ya?ml`,
+ * Compose v2's default `compose.ya?ml`, or any `*.ya?ml` directly inside a
+ * `compose/` directory (#1071) — anywhere in the tree, a `Dockerfile*`, or
+ * anything under `.github/workflows/`. A PR touching any of these can have
+ * broken `docker compose up` itself — that is what turns the signature below
+ * from infrastructure into a charged, deterministic failure. Matched
+ * case-insensitively: the price of missing a container file is waiving a
+ * genuine attempt, while a false positive (a path merely *named* like one)
+ * only charges one.
+ */
+const CONTAINER_CONFIG_PATH =
+  /(?:^|\/)(?:docker-compose[^/]*\.ya?ml|compose\.ya?ml|compose\/[^/]+\.ya?ml|Dockerfile[^/]*)$|(?:^|\/)\.github\/workflows\//i;
+
+/**
+ * Evidence that a failed check's log names a Compose dependency-startup
+ * failure, or `undefined` when the log does not name one or the PR's own diff
+ * could have caused it (#1059).
+ *
+ * Deliberately conditional on the PR's changed-file list, and deliberately
+ * left out of {@link INFRA_LOG_SIGNATURES}: a job that runs `docker compose`
+ * can be broken by the diff itself — a bad `docker-compose.yml` in a PR
+ * produces this exact sentence — so the blanket signature would waive the
+ * implementation attempt for a real defect. Only when the diff touches no
+ * compose file, no Dockerfile and no workflow is the fault one the PR cannot
+ * have introduced, and the recovery (`rerun-checks`) is bounded by the strike
+ * cap either way.
+ *
+ * Fails closed: `undefined` changedFiles is "could not read the diff", never
+ * "clean", and stays silent — an unknown or truncated diff must not waive an
+ * attempt.
+ */
+export function composeDependencyStartup(
+  log: string,
+  changedFiles: string[] | undefined,
+): string | undefined {
+  if (changedFiles === undefined) return undefined;
+  const lower = log.toLowerCase();
+  if (!lower.includes(COMPOSE_DEPENDENCY_STARTUP_SIGNATURE)) return undefined;
+  if (changedFiles.some((path) => CONTAINER_CONFIG_PATH.test(path))) return undefined;
+  return COMPOSE_DEPENDENCY_STARTUP_SIGNATURE.trim();
+}
+
 /** Lowercased check state — `gh pr checks` has emitted both `failure` and
  *  `FAILURE` across versions, and the classifier's callers must agree on one
  *  spelling so log selection and classification see the same set of checks. */
@@ -601,10 +704,163 @@ export function noVerdictExit(run: RunRecord): string | undefined {
   return `the session ended without delivering a settlement verdict; last words: "${lastWords.slice(0, 80)}"`;
 }
 
+/** A reliable PR reference inside a blocker's prose: a `PR #N`/
+ *  `pull request #N` mention or a GitHub `…/pull/N` URL. Named once so the
+ *  evidence's "the next act is an observation of this PR" claim and the code
+ *  that finds the PR stay one pattern (#1068). */
+const PR_REFERENCE_PATTERN =
+  /(?:PR|pull request)\s+#?\s*\d+|github\.com\/[^\s/]+\/[^\s/]+\/pull\/\d+/i;
+
+/**
+ * The `blockers:` list of a blocked settlement's stored report, in order
+ * (#1068). The worker's structured yield renders one item per blocker as
+ * `  - <item>` under a `blockers:` heading, and prose settlements that use the
+ * same heading parse the same way. `undefined` when the report carries no
+ * such section — a report that names no blockers and a missing report read
+ * identically, which is honest: the worker did not name a condition to
+ * observe.
+ */
+function blockedSettlementBlockers(report: string | undefined): string[] | undefined {
+  if (report === undefined) return undefined;
+  const blockers: string[] = [];
+  let inBlockers = false;
+  for (const line of report.split("\n")) {
+    if (inBlockers) {
+      const item = /^ {2,}-\s+(.*)$/.exec(line);
+      if (item === null) break;
+      blockers.push(item[1]!.trim());
+      continue;
+    }
+    if (/^blockers:\s*$/i.test(line)) inBlockers = true;
+  }
+  return blockers.length === 0 ? undefined : blockers;
+}
+
+/**
+ * An explicit question in the blocked row's own words, or `undefined` when the
+ * row names none (#1068). The worker's question travels in the pre-existing
+ * `lastError` slot, or as a `blockers:` item that ends interrogative; a
+ * blocker that names a condition to observe ("PR #1067 checks still
+ * pending…") is not a question. Quoted verbatim into the escalation evidence,
+ * because the orchestrator answers the worker's own words rather than a
+ * paraphrase.
+ */
+function blockedQuestion(run: RunRecord): string | undefined {
+  if (run.lastError !== undefined && run.lastError.trim() !== "") return run.lastError;
+  return blockedSettlementBlockers(run.report)?.find((b) => /[?？]\s*$/.test(b));
+}
+
+/**
+ * The report's first substantive line: skips the `status:`/`pr:`/`branch:`/
+ * `head:` headers and blank lines a structured settlement puts on top, and
+ * bounds the quote so a prose dump cannot balloon an evidence line. `undefined`
+ * when the report is empty or carries nothing but scaffold.
+ */
+function firstReportContentLine(report: string | undefined): string | undefined {
+  if (report === undefined) return undefined;
+  for (const raw of report.split("\n")) {
+    const line = raw.trim();
+    if (line === "") continue;
+    if (/^(?:status|pr|branch|head):\s*\S/.test(line)) continue;
+    return line.length > 200 ? `${line.slice(0, 200)}…` : line;
+  }
+  return undefined;
+}
+
+/**
+ * What the wall-clock ceiling actually buys on this fleet right now (#1063).
+ *
+ * `caps.workerMaxTurns` and `caps.workerWallClockMs` are independent config
+ * values, but they meet at an implicit pace: 0.5 minutes per turn at the
+ * shipped defaults. A model slower than that can never reach the turn ceiling,
+ * so the budget a groomer sized a slice against is fiction — the run dies of
+ * the clock first. This observation is derived from *completed* runs (never
+ * from the configured numbers, whose ratio is a constant and tells nobody
+ * anything), so `status` and the settlement report can name the real number.
+ */
+export interface ObservedTurnBudget {
+  /** Aggregate elapsed minutes ÷ aggregate turns across the sample. */
+  minutesPerTurn: number;
+  /** Completed runs the figure was derived from. */
+  sampleSize: number;
+  /** ⌊wall clock ÷ minutesPerTurn⌋ — what the clock buys at that pace. */
+  effectiveTurns: number;
+}
+
+/** How many completed runs the effective-budget sample spans. */
+export const EFFECTIVE_BUDGET_SAMPLE_RUNS = 20;
+
+/** A wall-clock kill below this share of its turn ceiling is a latency
+ *  verdict; at or above it, both ceilings were nearly exhausted and size is
+ *  the honest reading (#1063). */
+export const WALL_CLOCK_SIZE_VERDICT_SHARE = 0.7;
+
+/** Strips omp selector suffixes (`:thinking`, `:max`) so only the model path
+ *  is compared. */
+function modelBase(selector: string): string {
+  const colon = selector.indexOf(":");
+  return colon === -1 ? selector : selector.slice(0, colon);
+}
+
+/**
+ * Whether one model attribution names the same model as the configured
+ * selector, compared as path suffixes: config says
+ * `openrouter/stealth/ox-alpha:max` while the transcript's resolved model
+ * reads `stealth/ox-alpha`, and strict equality would empty every sample.
+ * Role aliases (`@slow`) have no concrete spelling to resolve to from here, so
+ * they match themselves only — no sample, rather than an invented one.
+ */
+function sameModel(configured: string, observed: string): boolean {
+  if (configured.startsWith("@") || observed.startsWith("@")) return configured === observed;
+  const c = modelBase(configured);
+  const o = modelBase(observed);
+  return c === o || c.endsWith(`/${o}`) || o.endsWith(`/${c}`);
+}
+
+/**
+ * Derives {@link ObservedTurnBudget} from completed-run rows, newest-first
+ * callers' ordering irrelevant. Rows without turns or elapsed time carry no
+ * pace and are skipped; when a configured worker model is named, rows written
+ * by another model are skipped with them (`resolvedModel` preferred — what
+ * actually wrote the messages — falling back to the dispatch record).
+ * `undefined` when nothing qualifying remains: absence is the honest answer,
+ * never a guess from the configured constants.
+ */
+export function observeTurnBudget(
+  samples: readonly Pick<RunRecord, "id" | "turns" | "startedAt" | "endedAt" | "model" | "resolvedModel">[],
+  caps: Pick<Caps, "workerWallClockMs">,
+  configuredModel?: string,
+  excludeRunId?: string,
+): ObservedTurnBudget | undefined {
+  let minutes = 0;
+  let turns = 0;
+  let used = 0;
+  for (const s of samples) {
+    if (s.id === excludeRunId) continue;
+    if (s.turns <= 0 || s.endedAt === undefined || s.endedAt <= s.startedAt) continue;
+    if (configuredModel !== undefined) {
+      const attribution = s.resolvedModel ?? s.model;
+      if (attribution === undefined || !sameModel(configuredModel, attribution)) continue;
+    }
+    minutes += (s.endedAt - s.startedAt) / 60_000;
+    turns += s.turns;
+    used += 1;
+  }
+  if (used === 0 || turns <= 0) return undefined;
+  const minutesPerTurn = minutes / turns;
+  if (!Number.isFinite(minutesPerTurn) || minutesPerTurn <= 0) return undefined;
+  return {
+    minutesPerTurn,
+    sampleSize: used,
+    effectiveTurns: Math.floor(caps.workerWallClockMs / 60_000 / minutesPerTurn),
+  };
+}
+
 export function classifyRun(
   run: RunRecord,
   facts: ClassifyFacts,
-  caps?: Pick<Caps, "workerWallClockMs">,
+  caps?: Pick<Caps, "workerWallClockMs"> & { workerStallSilenceMs?: number | null },
+  observedBudget?: ObservedTurnBudget,
 ): Classification {
   const hasArtifacts = run.prUrl !== undefined || run.headSha !== undefined || run.salvageSha !== undefined;
   const providerError =
@@ -744,10 +1000,44 @@ export function classifyRun(
   }
 
   if (run.state === "blocked") {
+    // `blocked` is overloaded (#1068). A worker that finishes its work and
+    // stops because it is waiting on an observable condition — almost always
+    // its PR's checks — records that condition as `blockers:` in its
+    // settlement report; a worker that stops to ask records an actual
+    // question. Only the second shape is a human escalation: the first names
+    // the next act (observe, then the sweep settles the row the way it
+    // settles `settlement-stuck` when the PR resolves), so escalating it
+    // wakes the orchestrator for a question that does not exist and the act
+    // that *is* required appears nowhere. The evidence never claims the
+    // worker "left no report" — it quotes the question or the first blocker,
+    // and when the report genuinely is empty it says which fields are.
+    const question = blockedQuestion(run);
+    if (question !== undefined) {
+      return { cls: "question", recovery: "escalate", evidence: question };
+    }
+    const blockers = blockedSettlementBlockers(run.report);
+    if (blockers !== undefined) {
+      // Prefer the blocker that names a PR: the reader's next act is an
+      // observation of that PR and a merge, and the evidence must say so.
+      const named = blockers.find((b) => PR_REFERENCE_PATTERN.test(b)) ?? blockers[0]!;
+      return {
+        cls: "awaiting-observation",
+        recovery: "observe",
+        evidence: `waiting on ${named}`,
+      };
+    }
+    const reportEmpty = run.report === undefined || run.report.trim() === "";
+    const firstContent = firstReportContentLine(run.report);
     return {
       cls: "question",
       recovery: "escalate",
-      evidence: run.lastError ?? "the worker stopped to ask a question and left no report",
+      evidence: reportEmpty
+        ? `the worker stopped without a run report (run.report is empty${
+            run.lastError === undefined || run.lastError.trim() === "" ? "; lastError is empty too" : ""
+          })`
+        : firstContent === undefined
+          ? "the worker stopped without asking a question or naming a blocker (run.report is non-empty but has no readable content)"
+          : `the worker stopped without asking a question or naming a blocker — ${firstContent}`,
     };
   }
 
@@ -771,6 +1061,30 @@ export function classifyRun(
   }
 
   if (run.state === "killed") {
+    // A stall the daemon settled (#1086), recognised from the row's own facts
+    // — the watch observed a transcript write instant, and the silence to the
+    // kill reached the configured window. Checked before the cap branches on
+    // purpose: a hung session's turns never move, so this row is under its
+    // ceilings, but even if a config change made it *reach* one mid-hang, the
+    // silence is the operative fact about why it died. The same split as the
+    // caps: artifacts continue, nothing shows escalates.
+    const silentMs = stallSilence(run, caps);
+    if (silentMs !== undefined) {
+      const minutes = Math.round(silentMs / 60_000);
+      const silent =
+        minutes < 60 ? `${minutes}m` : `${Math.floor(minutes / 60)}h${minutes % 60 === 0 ? "" : `${minutes % 60}m`}`;
+      return hasArtifacts
+        ? {
+            cls: "progress-stall",
+            recovery: "continue",
+            evidence: `transcript silent ${silent} at turn ${run.turns}/${run.maxTurns}; the session never came back — work to continue from (${run.prUrl ?? run.salvageSha ?? run.headSha})`,
+          }
+        : {
+            cls: "progress-stall",
+            recovery: "escalate",
+            evidence: `transcript silent ${silent} at turn ${run.turns}/${run.maxTurns}, no PR, no commits — $${run.spendUsd.toFixed(2)} spent`,
+          };
+    }
     if (run.turns >= run.maxTurns) {
       return hasArtifacts
         ? {
@@ -789,21 +1103,40 @@ export function classifyRun(
     // worker slot until the ticks ran out (#490). The same split as the turns
     // path: artifacts mean the next attempt resumes from real work; nothing to
     // show means a human re-scopes, naming the time and spend consumed.
+    //
+    // #1063: which ceiling was ever reachable? The two caps meet at an implied
+    // pace (wall clock ÷ max turns), so a run killed at the clock far under
+    // its turn budget died of *latency* — re-attempting it as an oversized
+    // slice spends a continuation on the wrong diagnosis. The evidence names
+    // the run's own pace, the latency/size verdict the share of the turn
+    // ceiling implies, and — when the caller supplied one — the effective
+    // turn budget observed across completed runs on this model.
     const wallClockCap = caps?.workerWallClockMs;
     const wallClockElapsed =
       run.endedAt === undefined ? undefined : run.endedAt - run.startedAt;
     if (wallClockCap !== undefined && wallClockElapsed !== undefined && wallClockElapsed >= wallClockCap) {
       const clock = `${Math.round(wallClockElapsed / 60_000)}m of ${Math.round(wallClockCap / 60_000)}m`;
+      const pace =
+        run.turns > 0 ? ` at ${((wallClockElapsed / 60_000) / run.turns).toFixed(2)} min/turn` : "";
+      const share = run.maxTurns > 0 ? run.turns / run.maxTurns : 1;
+      const verdict =
+        share < WALL_CLOCK_SIZE_VERDICT_SHARE
+          ? `latency verdict: ${run.turns}/${run.maxTurns} turns before the clock — the slice fits, the model is slow`
+          : `size verdict: ${run.turns}/${run.maxTurns} turns — both ceilings nearly exhausted`;
+      const observed =
+        observedBudget === undefined
+          ? ""
+          : `; effective ~${observedBudget.effectiveTurns} turns at ${observedBudget.minutesPerTurn.toFixed(2)} min/turn (last ${observedBudget.sampleSize} runs)`;
       return hasArtifacts
         ? {
             cls: "wall-clock-cap-progress",
             recovery: "continue",
-            evidence: `wall clock ${clock} with work to continue from (${run.prUrl ?? run.salvageSha ?? run.headSha})`,
+            evidence: `wall clock ${clock}${pace} — ${verdict}${observed}; work to continue from (${run.prUrl ?? run.salvageSha ?? run.headSha})`,
           }
         : {
             cls: "wall-clock-cap-spinning",
             recovery: "escalate",
-            evidence: `wall clock ${clock}, no PR, no commits — $${run.spendUsd.toFixed(2)} spent`,
+            evidence: `wall clock ${clock}${pace} — ${verdict}${observed}; no PR, no commits — $${run.spendUsd.toFixed(2)} spent`,
           };
     }
     // Below its own ceilings, so nothing this worker did ended it: a daemon
@@ -854,6 +1187,26 @@ export function classifyRun(
             evidence: `infrastructure signature in ${check?.name === undefined ? "failed check" : check.name} log: "${signature}"`,
           };
         }
+        // A Compose dependency-startup failure is infra only when the PR's
+        // diff could not have caused it (#1059): a job that runs `docker
+        // compose` is broken by a PR that breaks its own compose file, and
+        // that attempt is genuinely spent. The settlement hands the
+        // classifier the PR's changed-file list, so "did this diff touch any
+        // container configuration" is a fact, not a guess from the log alone.
+        // Absent list (or a log without the sentence) stays silent and the
+        // row reads `ci-deterministic`.
+        const compose = composeDependencyStartup(facts.failingLog, facts.changedFiles);
+        if (compose !== undefined) {
+          const check = checks.find((c) => normalise(c.state) === "failure");
+          return {
+            cls: "ci-infra",
+            recovery: "rerun-checks",
+            // Both halves, so the evidence says *which* sentence matched and
+            // *why* it was not the diff's fault — the changed-file list
+            // showed no container configuration.
+            evidence: `infrastructure signature in ${check?.name === undefined ? "failed check" : check.name} log: "${compose}" — the PR diff touches no container configuration, so the PR cannot have failed this check`,
+          };
+        }
       }
       const failing = unresolved.filter((c) => normalise(c.state) === "failure");
       if (failing.length > 0) {

package/src/fleet.ts

@@ -37,6 +37,7 @@ import {
   lockPidAlive,
   pidAlive,
   readTelegramDmOwner,
+  readTelegramMisroutes,
   readTelegramPollState,
   resolveClaimedSessionFile,
   resolveProjectTopicId,
@@ -64,6 +65,7 @@ export {
   consumeDrain,
   createDrain,
   drainPath,
+  markDrained,
   readDrain,
   type CreateDrainOptions,
   type DrainProblem,
@@ -103,6 +105,7 @@ import {
   resolveArmState,
   TICK_CONFIG_FILE,
   tickConfigMatchesProject,
+  writeArmedMarker,
   type ArmState,
   type TickConfig,
   type TickConfigResult,
@@ -308,9 +311,10 @@ export interface ArmMarkersWritten {
  * A challenge filed and sent, with nothing armed yet.
  *
  * Arming used to block here for up to five minutes on an in-session
- * acknowledgement. With the console owning the operator DM, the reply lands in
- * a session that runs no tick extension, so that wait could never be satisfied
- * — it is now two mechanical steps, and this is the first one's receipt.
+ * acknowledgement. Nothing waits now: the reply is consumed mechanically by
+ * the session whose topic the challenge went to (the orchestrator pane,
+ * #1061), or by `omp-conductor arm --reply` on a console host whose DM the
+ * operator answered in. This is the send half's receipt.
  */
 export interface ArmChallengeSent {
   outcome: "challenge-sent";
@@ -433,9 +437,12 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
   // escalations already do (#318), following the bridge's current claim when the
   // pinned id has gone stale (#407). Missing project config keeps flat-chat 0.13.
   let sendTopic: number | undefined;
+  let sendProject: { name: string; workspaceRoot?: string } | undefined;
   if (named !== undefined) {
     try {
-      sendTopic = resolveProjectTopicId(findProject(loadConfig(), named), deps.pidAlive ?? pidAlive);
+      const cfg = findProject(loadConfig(), named);
+      sendTopic = resolveProjectTopicId(cfg, deps.pidAlive ?? pidAlive);
+      sendProject = { name: cfg.name, workspaceRoot: cfg.workspaceRoot };
     } catch {
       /* no project config */
     }
@@ -508,7 +515,7 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
     owner: channel.owner,
   });
   try {
-    await send(token, channel.owner, text, sendTopic);
+    await send(token, channel.owner, text, sendTopic, sendProject);
   } catch (err) {
     // The challenge never went out, so its transaction must not linger as a
     // classifiable proof either.
@@ -566,7 +573,8 @@ function armReplyCommand(projectName?: string): string {
  * proof cannot weaken it.
  *
  * Like {@link armTicks}, this returns as soon as the challenge is filed and
- * sent: `omp-conductor arm --reply` writes the markers.
+ * sent: the reply settles it mechanically on the orchestrator pane's own
+ * topic, or through `omp-conductor arm --reply` from the console.
  */
 export async function armFleet(
   projectNames: readonly string[],
@@ -625,9 +633,12 @@ export async function armFleet(
   // operator is reading, and the reply step reaches the record from any project
   // because it is fleet-wide rather than topic-scoped.
   let sendTopic: number | undefined;
+  let sendProject: { name: string; workspaceRoot?: string } | undefined;
   for (const target of targets) {
     try {
-      sendTopic = resolveProjectTopicId(findProject(loadConfig(), target.project));
+      const cfg = findProject(loadConfig(), target.project);
+      sendTopic = resolveProjectTopicId(cfg);
+      sendProject = { name: cfg.name, workspaceRoot: cfg.workspaceRoot };
     } catch {
       continue; /* no project config — try the next */
     }
@@ -661,7 +672,7 @@ export async function armFleet(
     owner: channel.owner,
   });
   try {
-    await send(token, channel.owner, text, sendTopic);
+    await send(token, channel.owner, text, sendTopic, sendProject);
   } catch (err) {
     clearArmTransaction(FLEET_ARM_KEY, challengeId);
     throw new Error(
@@ -709,10 +720,12 @@ export type ArmReplyResult = ArmReplyAccepted | ArmReplyRefused;
  * The verification half of the ceremony: classify the operator's verbatim
  * message and, on a match, arm exactly the projects the challenge recorded.
  *
- * This runs in the console session, which is where the operator's reply lands
- * now that it owns the Telegram DM. No session waits for anything: the
- * challenge is durable state, so the two halves are ordinary commands that can
- * run minutes apart in different processes.
+ * This is the host CLI half, and it is one of two consumers of the same
+ * durable record: the orchestrator session's inbound path settles a reply
+ * sent to the project topic mechanically (#1061), while this command remains
+ * the console's route for a reply that landed in the operator DM. No session
+ * waits for anything: the challenge is durable state, so the halves are
+ * ordinary commands that can run minutes apart in different processes.
  *
  * The security properties are the send half's, unchanged. Only the project's
  * own record and the fleet record are read (no other project's ceremony can be
@@ -3084,6 +3097,9 @@ export type FleetStatusReport = StatusSnapshot & {
   /** The project-scoped durable to-spec grooming lifecycle as status lines
    *  (#809), or nothing when there is nothing to report. */
   grooming: string | undefined;
+  /** The sends this project's stale pin already delivered to the flat chat
+   *  (#1094), or undefined when the pin is healthy or freshly repaired. */
+  topicMisroute: string | undefined;
   lastStop: DaemonStop | undefined;
   siblings: { project: string; live: number }[];
 };
@@ -3182,6 +3198,7 @@ export async function collectFleetStatus(projectName?: string): Promise<FleetSta
     workerPhases,
     intake: intakeStatusLine(project.name),
     grooming,
+    topicMisroute: telegramMisrouteStatusLine(project),
     lastStop,
     siblings,
   };
@@ -3203,6 +3220,7 @@ export function renderFleetStatusReport(report: FleetStatusReport): string {
     report.lastStop,
     report.siblings,
     report.grooming,
+    report.topicMisroute,
   );
 }
 
@@ -3210,6 +3228,26 @@ export async function renderStatus(projectName?: string): Promise<string> {
   return renderFleetStatusReport(await collectFleetStatus(projectName));
 }
 
+/**
+ * One status line naming the sends this project's stale pin already delivered
+ * to the flat chat (#1094) — the send-side evidence behind doctor's topic-pin
+ * warning. Rows match the *current* pin id, so re-pinning retires the row
+ * without anyone deleting history.
+ */
+function telegramMisrouteStatusLine(project: ProjectConfig): string | undefined {
+  const pinned = project.escalation.telegramTopicId;
+  if (pinned === undefined) return undefined;
+  const rows = readTelegramMisroutes().filter(
+    (row) => row.project === project.name && row.staleTopicId === pinned,
+  );
+  if (rows.length === 0) return undefined;
+  const last = new Date(rows[rows.length - 1]!.at).toISOString();
+  return (
+    `misroute  ${rows.length} send(s) went to the flat chat because pinned topic ${pinned} was stale — ` +
+    `last ${last}; re-pin escalation.telegramTopicId to clear`
+  );
+}
+
 /**
  * One line naming the brief layout, or nothing when it cannot be read.
  *
@@ -3552,18 +3590,6 @@ function armClock(ms: number): string {
   return minutes === 0 ? `${seconds}s` : `${minutes}m${String(seconds).padStart(2, "0")}s`;
 }
 
-/**
- * The one armed-marker write both proofs share: same content, same mode, and
- * the same restamp of the pre-per-project shared marker the heartbeat still
- * honours — a project that just armed must not leave the bare marker around to
- * re-arm future fleets through `disarm` (#316).
- */
-function writeArmedMarker(path: string, owner: string, arm: ArmState): void {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `armed ${new Date().toISOString()} owner=${owner}\n`, { mode: 0o600 });
-  if (arm.legacy === "honoured") rmSync(legacyArmedMarkerPath(), { force: true });
-}
-
 /**
  * The session surface the claim-only verdict judges: the tick-cwd-derived
  * session directory plus, when the live claim's file lives elsewhere in the
@@ -3619,9 +3645,13 @@ async function sendTelegramMessage(
   owner: string,
   text: string,
   topicId?: number,
+  project?: { name: string; workspaceRoot?: string },
 ): Promise<void> {
   // Shared transport: stale-topic retry + message_thread_id live in one place.
-  await sendTelegram(token, owner, text, { topicId });
+  // The project pair rides along (#1094), so a challenge whose pinned topic is
+  // refused follows the project's live claim or lands labelled flat like every
+  // other send on this seam.
+  await sendTelegram(token, owner, text, { topicId, ...(project === undefined ? {} : { project }) });
 }
 
 // ---------------------------------------------------------------------------