omp-conductor 0.3.23 → 0.3.25

package/src/daemon.ts

@@ -387,16 +387,30 @@ async function safeEscalate(d: Pick<Deps, "escalate">, e: Escalation): Promise<b
  * `checkIntegrity` is — this wording is the whole thing a human acts on, so it
  * is worth a test holding it, and the sha in it is the only pointer to work
  * that no longer has any other copy.
+ *
+ * `retained` is not cosmetic. These lines used to promise a tree "kept for
+ * inspection" unconditionally, which was true only because salvage ran only on
+ * the paths that keep one. A blocked run's tree is removed the moment its work
+ * is safely on the branch, and sending an operator to a path this process just
+ * deleted is the same class of mistake as #118 itself.
  */
-export function salvageLines(outcome: SalvageOutcome, worktree: string): string[] {
-  const kept = `Worktree kept for inspection: ${worktree}`;
+export function salvageLines(
+  outcome: SalvageOutcome,
+  worktree: string,
+  retained: boolean,
+): string[] {
+  const fate = retained
+    ? `Worktree kept for inspection: ${worktree}`
+    : `Worktree removed: ${worktree}`;
 
-  if (outcome.kind === "nothing") return [`${kept} — nothing uncommitted to salvage`];
+  if (outcome.kind === "nothing") return [`${fate} — nothing uncommitted to salvage`];
 
   if (outcome.kind === "failed") {
     return [
       `WIP SALVAGE FAILED: ${outcome.error}`,
-      `Uncommitted work in ${worktree} is the only copy of it, and the next attempt removes that tree.`,
+      `Uncommitted work in ${worktree} is the only copy of it, so the tree was kept.`,
+      "This issue is held out of dispatch until the tree is recovered by hand and",
+      "`omp-conductor unblock <n> --force` records that you accepted it.",
     ];
   }
 
@@ -415,35 +429,80 @@ export function salvageLines(outcome: SalvageOutcome, worktree: string): string[
       : `${count}; new: ${outcome.newPaths.slice(0, 12).join(", ")}${
           outcome.newPaths.length > 12 ? `, … +${outcome.newPaths.length - 12} more` : ""
         }`;
-  return [where, manifest, kept];
+  return [where, manifest, fate];
+}
+
+/** Everything a settled run has to record and say about its worktree. */
+export interface WorktreeSettlement {
+  outcome: SalvageOutcome;
+  /** Whether the tree still exists now the run is over. */
+  retained: boolean;
+  /** Escalation lines naming where the work went. */
+  lines: string[];
+  /** Row fields recording the durable ref, or the failure that blocks a re-claim. */
+  patch: Pick<RunRecord, "salvageSha" | "salvageError">;
 }
 
 /**
- * Commits and pushes whatever a dead run left uncommitted, logs the outcome and
- * returns the escalation lines that say where that work now lives.
+ * Decides what becomes of a finished run's worktree: save the work, then keep
+ * or remove the tree, then say which.
  *
- * Only ever called on a non-graceful end — a cap kill, a crashed session, a
- * dispatch error. A `blocked` run stopped on purpose, with turns still in hand
- * and a brief that tells it to report rather than push, so nothing is committed
- * behind its back. The rest never got the chance: the kill is external and
- * lands mid-edit, in the tree the next attempt removes `--force`.
+ * One function because the two halves are one decision and splitting them is
+ * how #118 happened — the removal at the end of dispatch had no idea whether
+ * anything had been saved, and the salvage at the top of the failure branch had
+ * no idea the blocked branch fell through to a `--force` removal.
+ *
+ * A salvage that *fails* retains the tree whatever the caller asked for. There
+ * was real work, git refused to commit it, and the tree is now the only copy in
+ * existence: deleting it on schedule would be the data loss this whole path
+ * exists to prevent. The issue is held out of dispatch until an operator says
+ * otherwise, because the next attempt's `worktree remove --force` would finish
+ * the job (see `admitCandidates`).
+ *
+ * Exported so a test can drive the real decision against a real git tree.
  */
-async function salvage(
-  issue: number,
-  attempt: number,
-  reason: string,
-  worktree: string,
-): Promise<string[]> {
-  const lines = salvageLines(await salvageWip(worktree, issue, attempt, reason), worktree);
+export async function settleWorktree(
+  args: {
+    issue: number;
+    attempt: number;
+    /** Clause for the commit subject: "killed by the turns cap", "blocked …". */
+    ending: string;
+    worktree: string;
+  } & (
+    | /** Terminal-failure and orphan trees are evidence, and are kept even when clean. */
+    { tree: "keep" }
+    | { tree: "remove"; mirrorPath: string }
+  ),
+): Promise<WorktreeSettlement> {
+  const { issue, attempt, ending, worktree } = args;
+  const outcome = await salvageWip(worktree, issue, attempt, ending);
+  const retained = args.tree === "keep" || outcome.kind === "failed";
+  if (!retained && args.tree === "remove") await removeWorktree(args.mirrorPath, worktree);
+
+  const lines = salvageLines(outcome, worktree, retained);
   log(`#${issue} salvage: ${lines.join(" ")}`);
-  return lines;
+  return {
+    outcome,
+    retained,
+    lines,
+    patch:
+      outcome.kind === "salvaged"
+        ? { salvageSha: outcome.sha }
+        : outcome.kind === "failed"
+          ? { salvageError: outcome.error }
+          : {},
+  };
 }
 
-/** How a run's end is named — in the salvage commit, and to whoever reads it. */
+/**
+ * How a run's end is named — in the salvage commit, and to whoever reads it.
+ * The whole clause, not a bare reason: a graceful block was not killed by
+ * anything, and the commit subject is read during recovery.
+ */
 function endedBy(killedBy: KilledBy | undefined): string {
-  if (killedBy === "turns") return "the turns cap";
-  if (killedBy === "wallclock") return "the wall-clock cap";
-  return "a failed run";
+  if (killedBy === "turns") return "killed by the turns cap";
+  if (killedBy === "wallclock") return "killed by the wall-clock cap";
+  return "killed by a failed run";
 }
 
 /**
@@ -460,7 +519,7 @@ export async function buildBrief(
   r: Routed,
   branch: string,
   worktree: string,
-  opts: { continuation?: boolean; defaultBranch?: string } = {},
+  opts: { continuation?: boolean; defaultBranch?: string; salvagedSha?: string } = {},
 ): Promise<string> {
   // Read per dispatch rather than caching: editing the brief then takes effect
   // on the next issue instead of needing a daemon restart.
@@ -474,6 +533,14 @@ export async function buildBrief(
           "",
           `You are **resuming** issue #${r.issue.number}. Branch \`${branch}\` already exists`,
           "and was reattached with prior commits (and possibly a salvaged WIP tip).",
+          ...(opts.salvagedSha === undefined
+            ? []
+            : [
+                "",
+                `The previous attempt's uncommitted work was preserved for you as commit`,
+                `\`${opts.salvagedSha}\` on this branch. It is the tip you are continuing from,`,
+                "and it is the only copy of that work — do not reset past it or force-push over it.",
+              ]),
           "Before writing anything:",
           "",
           "```bash",
@@ -599,9 +666,10 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
 
   let claimed = false;
   let run: RunRecord | undefined;
-  // Hoisted out of the try so the catch path can still name the tree: a crash
-  // mid-dispatch is one of the non-graceful ends whose uncommitted work has to
-  // be salvaged too, and it is the path least likely to have committed first.
+  // Hoisted out of the try so the catch path can still name and save the tree:
+  // a crash mid-dispatch is one of the ends whose uncommitted work has to be
+  // salvaged too, and it is the path least likely to have committed first.
+  const mirrorPath = mirrorPathFor(r.repo, project.mirrorRoot);
   let worktreePath: string | undefined;
   let turnLimit: TurnLimitController | undefined;
 
@@ -612,6 +680,10 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // issue out, and a human decides what to do with the orphan.
     await tracker.addLabel(issue, inProgress);
     claimed = true;
+    // Read before this attempt's own row exists, so `latestRun` still means the
+    // attempt whose work this one inherits.
+    const priorSalvage = store.latestRun(project.name, issue)?.salvageSha;
+
 
     run = store.createRun({
       project: project.name,
@@ -635,7 +707,6 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // tolerates a mirror or tree that is not there yet, so this is safe on a
     // first attempt. addWorktree does its own ensureMirror; calling it here too
     // would cost a second network fetch per attempt.
-    const mirrorPath = mirrorPathFor(r.repo, project.mirrorRoot);
     await removeWorktree(mirrorPath, worktreePathFor(project.workspaceRoot, issue));
     const provisioned = await addWorktree(
       r.repo,
@@ -664,6 +735,9 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         brief: await buildBrief(project, r, branch, worktreePath, {
           continuation: provisioned.reattached,
           defaultBranch: r.repo.defaultBranch,
+          ...(provisioned.reattached && priorSalvage !== undefined
+            ? { salvagedSha: priorSalvage }
+            : {}),
         }),
         cwd: worktreePath,
         caps,
@@ -706,6 +780,27 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     const finalReport =
       verified.reason === undefined ? result.report : `${verified.reason}\n\n${result.report}`;
 
+    // What becomes of the tree, decided once, before any label or page. A
+    // `pushed-*` run is the only end that does not salvage: its deliverable is
+    // already on a remote branch, whatever is left loose in the tree is by the
+    // worker's own account not part of it, and appending a WIP commit would
+    // turn the green PR this daemon just verified red. Every other end is
+    // continuable, so its tree is treated as work.
+    const settlement =
+      state === "pushed-green" || state === "pushed-pending" || state === "merged"
+        ? undefined
+        : await settleWorktree({
+            issue,
+            attempt,
+            ending:
+              state === "blocked" ? "blocked for an operator decision" : endedBy(result.killedBy),
+            worktree: worktreePath,
+            ...(state === "failed" || state === "killed"
+              ? ({ tree: "keep" } as const)
+              : ({ tree: "remove", mirrorPath } as const)),
+          });
+    if (settlement === undefined) await removeWorktree(mirrorPath, worktreePath);
+
     store.updateRun(runId, {
       state,
       endedAt: Date.now(),
@@ -715,8 +810,11 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       headSha: result.headSha,
       sessionFile: result.sessionFile,
       ...(verified.reason === undefined ? {} : { lastError: verified.reason }),
+      ...settlement?.patch,
     });
 
+    const salvaged = settlement?.lines ?? [];
+
     if (state === "blocked") {
       await swapLabel(tracker, issue, inProgress, project.stateLabels.blocked);
       await safeEscalate(d, {
@@ -725,7 +823,7 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         issue,
         runId,
         summary: `#${issue} is blocked on attempt ${attempt} and needs a decision`,
-        detail: [`${r.issue.title}`, r.issue.url, "", result.report].join("\n"),
+        detail: [`${r.issue.title}`, r.issue.url, "", ...salvaged, "", result.report].join("\n"),
       });
     } else if (state === "failed" || state === "killed") {
       // A turns cap consumes the independent continuation budget, not an
@@ -735,7 +833,6 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       const continueTurns =
         result.killedBy === "turns" &&
         hasContinuationBudget(continuation, caps.maxContinuationsPerIssue);
-      const salvaged = await salvage(issue, attempt, endedBy(result.killedBy), worktreePath);
 
       if (continueTurns) {
         await tracker.removeLabel(issue, inProgress);
@@ -790,13 +887,6 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       // checks or merge settle, preventing another worker from duplicating it.
       log(`#${issue} ${state}${result.prUrl ? ` ${result.prUrl}` : ""}`);
     }
-
-    // A failed or killed tree is evidence — keep it. Anything else is just
-    // disk, and the mirror means re-provisioning is cheap. (The kept tree is
-    // wiped by the next attempt, not left to accumulate forever.)
-    if (state !== "failed" && state !== "killed") {
-      await removeWorktree(mirrorPath, worktreePath);
-    }
   } catch (err) {
     // Dispatch setup can fail after the controller opens but before runWorker's
     // inner settlement guard exists. Latch it before any terminal write or await.
@@ -804,8 +894,25 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     turnLimit = undefined;
     const detail = errText(err);
     log(`#${issue} errored: ${detail}`);
+    // A crash lands anywhere, including mid-edit in a tree holding the only
+    // copy of real work. Nothing else on this path so much as looks at it.
+    const settlement =
+      worktreePath === undefined
+        ? undefined
+        : await settleWorktree({
+            issue,
+            attempt,
+            ending: "killed by a dispatch error",
+            worktree: worktreePath,
+            tree: "keep",
+          });
     if (run) {
-      store.updateRun(run.id, { state: "failed", endedAt: Date.now(), lastError: detail });
+      store.updateRun(run.id, {
+        state: "failed",
+        endedAt: Date.now(),
+        lastError: detail,
+        ...settlement?.patch,
+      });
     }
     if (claimed) {
       // Leaving the issue stuck as in-progress would hide it from both the
@@ -816,13 +923,8 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         log(`#${issue} could not be relabelled: ${errText(relabelErr)}`);
       }
     }
-    // A crash lands anywhere, including mid-edit in a tree holding the only
-    // copy of real work. Nothing else on this path so much as looks at it.
-    const salvaged =
-      worktreePath === undefined
-        ? []
-        : await salvage(issue, attempt, "a dispatch error", worktreePath);
 
+    const salvaged = settlement?.lines ?? [];
     await safeEscalate(d, {
       tier: 1,
       project: project.name,
@@ -893,26 +995,33 @@ export function settlementFor(pr: PrState | undefined, prUrl: string): Settlemen
  * hand-editing one, and `unblock` refused to clear that particular label — so
  * both issues were permanently unclaimable with no supported way back (#18).
  *
- * Never throws, and that is the point of it being a function rather than a
- * bare `removeLabel`. Callers are sweeps: the store transition this accompanies
- * has already been written, so a tracker that fails here must cost one label,
- * not the remaining rows. There is no retry — the row is terminal, so no later
- * tick revisits it — which makes the log line the entire record of the miss and
- * why it names both the label and the reason. The operator's recovery for that
- * rare case is `omp-conductor unblock`, which clears the label itself once the
- * newest run is terminal.
+ * Never throws, and reports whether the label is provably gone, because the
+ * caller has to decide what to write to the store on the strength of it. A
+ * sweep must not lose the rest of its rows to one unreachable tracker, and it
+ * must not terminalise a row whose label it failed to drop: the settlement
+ * sweep only ever revisits `pushed-*` rows, so a row written terminal is a row
+ * nothing asks about again, and swallowing the failure under it would recreate
+ * the exact permanent-`agent:in-progress` state of #18 in the one case that
+ * still reaches it. Answering false instead leaves the row where the next tick
+ * will find it.
+ *
+ * Removing a label the issue does not carry is success, not failure: the GitHub
+ * adapter treats an absent label as a no-op, so false means the tracker could
+ * not be reached or refused — a condition that passes.
  */
 export async function releaseInProgress(
   d: Pick<Deps, "project" | "tracker">,
   issue: number,
   why: string,
-): Promise<void> {
+): Promise<boolean> {
   const label = d.project.stateLabels.inProgress;
   try {
     await d.tracker.removeLabel(issue, label);
     log(`#${issue} released ${label}: ${why}`);
+    return true;
   } catch (err) {
-    log(`#${issue} could not release ${label} (${errText(err)}) — ${why}; clear it with \`unblock\``);
+    log(`#${issue} could not release ${label} (${errText(err)}) — ${why}; retrying next tick`);
+    return false;
   }
 }
 
@@ -946,6 +1055,15 @@ export async function releaseInProgress(
  * the same Tracker port the dispatcher claimed the issue with — orphan detection
  * is only trustworthy while every state label on the tracker came from this
  * package.
+ *
+ * The two writes are ordered label-then-row, and the order is load-bearing. This
+ * sweep is the only thing that revisits a `pushed-*` row, so the terminal state
+ * is also the row's exit from it: written first, a tracker that then failed on
+ * the label would leave `agent:in-progress` with nothing left to retry it — #18
+ * exactly, in the last window able to reach it. Writing the label first makes
+ * failure cost a repeated `gh` call on the next tick instead, and the row stays
+ * in the busy set throughout, so no second worker can be sent at the issue while
+ * it waits.
  */
 export async function settlePushedGreen(
   d: Pick<Deps, "project" | "tracker" | "store">,
@@ -978,14 +1096,19 @@ export async function settlePushedGreen(
 
     const settlement = settlementFor(pr, run.prUrl);
     if (settlement !== undefined) {
+      // Label first, row second, and the order is the whole safety argument.
+      // The sweep only ever revisits `pushed-*` rows, so writing the terminal
+      // state first would put this row beyond every later tick — and a tracker
+      // that failed on the label in that instant would strand
+      // `agent:in-progress` permanently, which is #18 again in the one window
+      // still able to reach it. Leaving the row `pushed-*` costs a stale active
+      // row until the tracker answers, and the busy set keeps the issue
+      // occupied meanwhile, so nothing can be dispatched onto it in between.
+      if (!(await releaseInProgress(d, run.issue, settlement.reason))) continue;
       const patch: Partial<RunRecord> = { state: settlement.state, endedAt: Date.now() };
       if (settlement.state === "failed") patch.lastError = settlement.reason;
       store.updateRun(run.id, patch);
       log(`#${run.issue} settled: ${settlement.reason}`);
-      // Store and tracker in the same breath, for the reason above: the row is
-      // terminal, so the label's interlock is spent. `releaseInProgress` never
-      // throws, so a tracker hiccup costs this label and not the later rows.
-      await releaseInProgress(d, run.issue, settlement.reason);
       continue;
     }
 
@@ -1002,13 +1125,13 @@ export async function settlePushedGreen(
       store.updateRun(run.id, { state: "pushed-green", lastError: undefined });
       log(`#${run.issue} checks settled: ${verification.reason}`);
     } else if (verification.status === "failed") {
+      // Equally terminal, so the same label-first order for the same reason:
+      // this row is about to leave the sweep's reach. The green branch above
+      // releases nothing — that row is still awaiting a merge, and its live PR
+      // is exactly the work the label must keep guarding.
+      if (!(await releaseInProgress(d, run.issue, verification.reason))) continue;
       store.updateRun(run.id, { state: "failed", lastError: verification.reason });
       log(`#${run.issue} checks failed: ${verification.reason}`);
-      // Equally terminal: a red check on a pushed row ends the attempt, so the
-      // same release applies. The green branch above deliberately does not —
-      // that row is still awaiting a merge, and its live PR is exactly the work
-      // the label must keep guarding.
-      await releaseInProgress(d, run.issue, verification.reason);
     } else {
       store.updateRun(run.id, { lastError: verification.reason });
     }
@@ -1257,6 +1380,32 @@ export async function admitCandidates(
       continue;
     }
 
+    // Fail closed on work that exists only in a worktree. `addWorktree` clears
+    // the tree at <workspaceRoot>/<issue> before it provisions, so admitting
+    // this issue is what finally destroys the copy the salvage could not save
+    // (#118). Nothing here can recover it — git already refused once — so the
+    // only safe move is to refuse the claim and keep saying why until an
+    // operator has looked and run `unblock --force`.
+    const newest = store.latestRun(project.name, issue);
+    if (newest?.salvageError !== undefined && newest.salvageAckAt === undefined) {
+      hold(issue, "unsalvaged-wip");
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue,
+        summary: `#${issue} is holding unsalvaged work and will not be re-claimed`,
+        detail: [
+          r.issue.title,
+          r.issue.url,
+          `Attempt ${newest.attempt} could not commit its uncommitted changes: ${newest.salvageError}`,
+          `The only copy is the worktree ${newest.worktree === "" ? "(path not recorded)" : newest.worktree}.`,
+          "Dispatch is held because claiming this issue removes that tree.",
+          "Recover it by hand, then `omp-conductor unblock <n> --force` to release the hold.",
+        ].join("\n"),
+      });
+      continue;
+    }
+
     // Soft concurrency per epic: at most one in-flight child of a given parent.
     // No parent means today's concurrent admission. Cheap local filters already
     // ran; this sits before the open-PR API call so a held sibling frees the
@@ -1653,6 +1802,9 @@ export interface StatusSnapshot {
   caps: Caps;
   /** Occupied issues: live workers plus green PRs awaiting a human merge. */
   activeRuns: RunRecord[];
+  /** Newest attempts holding a preserved WIP tip, or a tree that is still the
+   *  only copy of work the daemon could not save. */
+  salvagedRuns: RunRecord[];
   /** Runs backed by a worker process — the number capacity compares against. */
   liveWorkers: number;
   runsToday: number;
@@ -1673,6 +1825,7 @@ export function statusSnapshotFromStore(p: ProjectConfig, caps: Caps, store: Sto
     paused: isPaused(),
     caps,
     activeRuns: store.activeRuns(p.name),
+    salvagedRuns: store.salvagedRuns(p.name),
     liveWorkers: store.liveRuns(p.name).length,
     runsToday: store.runsStartedSince(p.name, since),
     spendTodayUsd: store.spendSince(p.name, since),
@@ -1716,6 +1869,32 @@ export function formatDispatchSummary(summary?: DispatchSummary): string {
   return lines.join("\n");
 }
 
+/**
+ * The WIP block: every issue whose newest attempt left work behind, and
+ * whether that work is safe.
+ *
+ * Blocked runs used to be invisible here, which is exactly how #118 stayed
+ * invisible for a full attempt cycle — the operator saw a blocked issue and had
+ * no way to tell "stopped with 34 uncommitted files" from "stopped clean".
+ * A preserved line is informational; an UNSALVAGED line is an alarm, and it
+ * names the directory because that directory is the work.
+ */
+export function formatSalvagedRuns(runs: readonly RunRecord[]): string[] {
+  if (runs.length === 0) return [];
+  const lines = ["", "wip"];
+  for (const r of runs) {
+    lines.push(
+      r.salvageError !== undefined && r.salvageAckAt === undefined
+        ? `  #${r.issue}  UNSALVAGED  ${r.worktree === "" ? "(path not recorded)" : r.worktree} — ` +
+          `only copy, dispatch held (${r.salvageError})`
+        : r.salvageError !== undefined
+          ? `  #${r.issue}  accepted as lost  attempt ${r.attempt} (${r.salvageError})`
+          : `  #${r.issue}  preserved  ${r.salvageSha ?? "?"} on ${r.branch} (attempt ${r.attempt}, ${r.state})`,
+    );
+  }
+  return lines;
+}
+
 export function formatStatus(s: StatusSnapshot): string {
   const lines = [
     `project   ${s.project}${s.paused ? "  (PAUSED)" : ""}`,
@@ -1748,6 +1927,7 @@ export function formatStatus(s: StatusSnapshot): string {
       );
     }
   }
+  lines.push(...formatSalvagedRuns(s.salvagedRuns));
   // Deploy hint: a restart while workers are live orphans them (salvage runs
   // first — #35). Prefer pause + drain to zero live workers when you can wait.
   if (s.liveWorkers > 0) {
@@ -1852,12 +2032,20 @@ export async function reconcileOrphanedRuns(
   const endedAt = Date.now();
   for (const r of stale) {
     // Salvage before the row flips: the worktree path is on the record, and
-    // salvageWip is a no-op for a missing/clean tree. Reason string matches
-    // the cap-kill wording so triage reads the same either way.
-    if (r.worktree !== "") {
-      await salvage(r.issue, r.attempt, "a daemon restart", r.worktree);
-    }
-    store.updateRun(r.id, { state: "orphaned", endedAt });
+    // salvageWip is a no-op for a missing/clean tree. The clause matches the
+    // cap-kill wording so triage reads the same either way, and the tree is
+    // kept because an orphan's remains are the orchestrator's drain-duty call.
+    const settlement =
+      r.worktree === ""
+        ? undefined
+        : await settleWorktree({
+            issue: r.issue,
+            attempt: r.attempt,
+            ending: "killed by a daemon restart",
+            worktree: r.worktree,
+            tree: "keep",
+          });
+    store.updateRun(r.id, { state: "orphaned", endedAt, ...settlement?.patch });
   }
   return stale;
 }

package/src/fleet.ts

@@ -28,8 +28,16 @@ import { createInterface } from "node:readline";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 import { findProject, loadConfig, stateDir } from "./config.ts";
+import { readApprovalSurface } from "./approval-surface.ts";
 import { probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
-import { formatDispatchSummary, isPaused, setPaused, statusSnapshot, type StatusSnapshot } from "./daemon.ts";
+import {
+  formatDispatchSummary,
+  formatSalvagedRuns,
+  isPaused,
+  setPaused,
+  statusSnapshot,
+  type StatusSnapshot,
+} from "./daemon.ts";
 import {
   healthCheck,
   isAlive,
@@ -1028,6 +1036,7 @@ function formatProjectBody(s: StatusSnapshot): string {
       );
     }
   }
+  lines.push(...formatSalvagedRuns(s.salvagedRuns));
   if (s.liveWorkers > 0) {
     lines.push(
       "",
@@ -1082,62 +1091,11 @@ function readPairedChannel(path: string): Channel {
 }
 
 /**
- * Whether the *approval* half of the Telegram surface works, which is a
- * different question from whether inbound works and was never asked before.
- *
- * `telegram_ask` is mounted by omp-telegram's `before_agent_start` handler only
- * for a turn whose prompt resolves a notify target. A Telegram-originated turn
- * resolves one from its own `<telegram-message>` wrapper; a locally injected
- * orchestrator tick has no wrapper, so it resolves one only through
- * `notifyTarget()` — which needs `notifyMode` set to "away" or "always" *and* a
- * destination, this session's forum topic under `topicsChat` or the flat
- * `notifyChat`. With neither, the tool is simply absent from the tick.
- *
- * That is exactly what happened on 2026-08-09 06:17Z: the fleet's access.json
- * had no `notifyMode`, so the locally injected tick could not ask the
- * Learning-loop yes/no question the package floor requires — while this very
- * status line reported `telegram  ok  (@tbcoder_bot; inbound configured)`
- * throughout (#114). A health row that stays green through a broken contract is
- * worse than no row, so the approval surface is now part of it.
- *
- * The legacy `away: true` boolean counts: `loadAccess()` migrates it to
- * `notifyMode: "away"` on read, so a fleet still carrying it resolves a target
- * and must not be reported as broken.
+ * The approval half of the Telegram surface is a different question from
+ * whether inbound works, and it is answered by {@link readApprovalSurface} —
+ * shared with the orchestrator tick so this row and the tick's own warning can
+ * never disagree about whether an amendment can be asked.
  */
-type ApprovalSurface = { kind: "ready" } | { kind: "missing"; reason: string };
-
-function readApprovalSurface(path: string): ApprovalSurface {
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(readFileSync(path, "utf8"));
-  } catch {
-    return { kind: "missing", reason: `telegram_ask unavailable on local ticks: cannot read ${path}` };
-  }
-  if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-    return { kind: "missing", reason: `telegram_ask unavailable on local ticks: ${path} is not an object` };
-  }
-  const access = parsed as { readonly [key: string]: unknown };
-  const mode = access["notifyMode"];
-  const active = mode === "away" || mode === "always" || access["away"] === true;
-  if (!active) {
-    return {
-      kind: "missing",
-      reason:
-        `telegram_ask unavailable on local ticks: no notifyMode in ${path} — ` +
-        `set it to "always" and give it a destination (notifyChat, or topicsChat for a forum)`,
-    };
-  }
-  const destination = access["notifyChat"] ?? access["topicsChat"];
-  if (typeof destination !== "string" || destination.length === 0) {
-    return {
-      kind: "missing",
-      reason:
-        `telegram_ask unavailable on local ticks: notifyMode is set but ${path} names no destination — ` +
-        "set notifyChat to the paired owner id (or topicsChat for a forum)",
-    };
-  }
-  return { kind: "ready" };
-}
 
 function readBotToken(): string | undefined {
   const env = process.env["TELEGRAM_BOT_TOKEN"];
@@ -1205,6 +1163,8 @@ export async function probeTelegramHealth(
   // Inbound first: a bridge that is down says nothing about the approval
   // surface, and stacking two remedies on one row buries the one to act on.
   if (channel.kind === "down") return { kind: "degraded", detail: `${username}; inbound ${channel.reason}` };
+  // The token is already proven: `getMe` succeeded above. What is left is
+  // whether an answer could come back, which is the access file's business.
   const approval = readApprovalSurface(accessPath);
   if (approval.kind === "missing") {
     return { kind: "degraded", detail: `${username}; inbound configured; ${approval.reason}` };