omp-conductor 0.3.1 → 0.3.2

package/README.md

@@ -769,23 +769,30 @@ prompt was never consumed, and the extension:
 Both escapes deliberately leave the session, because a loop that cannot drain
 its queue cannot report on itself — that is the whole failure.
 
-**Two things read it.** A marker nobody consumes is an artifact, not an alert:
-
-- **The daemon**, on its own five-minute tick, and *before* its pause check. The
-  orchestrator is a different process and can be wedged while the fleet is
-  deliberately paused — precisely the state the dogfood fleet was in when this
-  happened. One tier-2 page per stall, dated, re-armed when the marker clears,
-  and latched only once the page is confirmed delivered, so an escalation
-  channel that fails on the one tick that noticed does not buy permanent
-  silence. It restarts nothing: a wedge lands mid-turn, and this process cannot
-  tell a half-applied edit from an idle loop.
-- **herdr-conductor's recovery**, which treats marker-present as *not live*. Its
-  liveness test — agent listed AND a non-shell foreground process — passes
-  straight through a wedge, so without this a recovery run certifies a stuck
-  session as healthy and returns "nothing to do".
-
-The daemon is what covers a wedge beginning *between* herdr's lifecycle events,
-since a session that stays alive and stops working emits none of them.
+**The daemon reads it.** A marker nobody consumes is an artifact, not an alert,
+so the dispatch daemon checks it on its own five-minute tick — and *before* its
+pause check. The orchestrator is a different process and can be wedged while
+the fleet is deliberately paused, which is precisely the state the dogfood
+fleet was in when this happened. One tier-2 page per stall, keyed on the
+marker's own timestamp so a second wedge the same day is not swallowed as a
+repeat, re-armed when the marker clears, and latched only once the page is
+confirmed delivered — an escalation channel that fails on the one tick that
+noticed must not buy permanent silence.
+
+It restarts nothing. A wedge lands mid-turn, and no other process can tell a
+half-applied edit from an idle loop; the operator attaches, looks, and decides.
+
+**herdr-conductor deliberately does not read it**, though its liveness test
+(agent listed AND a non-shell foreground process) passes straight through a
+wedge. That plugin only runs on `startup`, `pane.exited` and
+`pane.agent_detected`, and a session that stays alive and stops working emits
+none of them — so the check could never fire during the wedge itself. What it
+*would* catch is the recovery afterwards: the marker survives a restart until
+the new session consumes a tick, so every operator SIGTERM-and-resume would
+page about the healthy session they just fixed. Telling those apart needs the
+process start time against the marker's, and herdr's `pane process-info`
+reports pids, not start times. The daemon gives up at most one tick of
+coverage and never cries wolf.
 
 The first tick that actually sends clears the counter and deletes the marker,
 and it deletes one it did not write: recovery normally arrives as a fresh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/daemon.ts

@@ -151,10 +151,13 @@ async function watchOrchestrator(d: Deps): Promise<void> {
     tier: 2,
     project: d.project.name,
     issue: NO_ISSUE,
-    // Dated like the other tier-2 summaries: the dedup key is the summary, and
-    // a second wedge next month must not read as a repeat of this one.
+    // Keyed on the marker's own timestamp, not the date. The dedup ledger keys
+    // on this summary, and two wedges in one day is not a hypothetical — the
+    // failure mode is a session that gets stuck, gets restarted, and gets stuck
+    // again on the same cause an hour later. A day-keyed summary would report
+    // the first and silently swallow every one after it.
     summary:
-      `Orchestrator session wedged on ${new Date().toISOString().slice(0, 10)} — ` +
+      `Orchestrator session wedged (${verdict.since ?? `marker at ${marker}`}) — ` +
       `it has stopped reading its queue (${d.project.name})`,
     detail: [
       verdict.since ?? "Marker present with no readable timestamp.",
@@ -731,6 +734,15 @@ async function tick(d: Deps): Promise<void> {
   // attributable. A legitimate deploy never trips it, because installing a new
   // build and restarting the unit re-records the baseline from the new files;
   // only an edit *underneath* a live daemon diverges from it.
+  //
+  // Below the pause gate on purpose, unlike the stall watch above. The property
+  // being defended is that no work is dispatched under a package the operator
+  // did not install — and a paused fleet dispatches nothing, so nothing needs
+  // attributing yet. Tampering during a pause is not missed, only deferred: the
+  // baseline is boot's, so the first tick after `resume` compares against it and
+  // pauses again before claiming anything. Checking above the gate instead would
+  // page on every legitimate build an operator deploys into a parked fleet,
+  // which is exactly when they deploy them.
   const integrity = checkIntegrity(d.integrity, packageManifest());
   if (integrity.pause) {
     const shown = integrity.diff.slice(0, INTEGRITY_SAMPLE);