omp-conductor 0.3.23 → 0.3.25

package/src/orchestrator-tick.ts

@@ -46,8 +46,14 @@
 
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { isAbsolute, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, resolve } from "node:path";
 import { findProject, loadConfig, resolveReleasePolicy } from "./config.ts";
+import {
+  bridgeTokenBound,
+  hasBotToken,
+  readApprovalSurface,
+  TELEGRAM_APPROVAL_TOOL,
+} from "./approval-surface.ts";
 import {
   briefPathForProject,
   policyPathForProject,
@@ -340,15 +346,9 @@ export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScope]: string } = {
 export const TICK_DELIVERY_RULE =
   "This tick was injected locally, not sent from Telegram, so your end-of-turn text does NOT reach your operator. Deliver anything reportable this turn by calling the telegram_send tool and confirming success; never claim a report was sent otherwise.";
 
-/**
- * The tool the package floor names for the Learning-loop yes/no amendment
- * approval (`## Learning loop`, step 2, in `briefs/orchestrator.md`).
- *
- * Held as a constant because two things must agree on it: the prose that tells
- * the turn to call it, and the preflight that checks whether it is callable at
- * all.
- */
-export const TELEGRAM_APPROVAL_TOOL = "telegram_ask";
+/** Re-exported so the tick's own contract stays readable from one file: the
+ *  constant itself lives beside the check that decides whether it is callable. */
+export { TELEGRAM_APPROVAL_TOOL };
 
 /**
  * Appended to every tick — the shipped prompt or the operator's own — composed
@@ -917,21 +917,44 @@ export function tickDecision(input: {
 }
 
 /**
- * Whether the Telegram bridge can still reach a person: enabled, with exactly
- * one paired owner.
+ * Whether the Telegram bridge can still reach a person: a bot token, enabled,
+ * with exactly one paired owner.
  *
  * Fail-closed, and every failure mode collapses to the same answer on purpose —
  * missing file, truncated write, hand-edit that dropped `enabled`, a second
- * chat id pasted in, or the pairing revoked. Distinguishing them would only
- * tempt a future reader into treating one of them as benign, and none of them
- * are: each one means a tier-2 escalation lands nowhere.
+ * chat id pasted in, the pairing revoked, or no token for the bot to send with.
+ * Distinguishing them would only tempt a future reader into treating one of them
+ * as benign, and none of them are: each one means a tier-2 escalation lands
+ * nowhere.
+ *
+ * The token belongs in this gate rather than further down. Without one nothing
+ * outbound works, so a tick would carry a delivery rule ordering a
+ * `telegram_send` that cannot happen and an approval fallback naming the same
+ * unusable tool — an unattended fleet dispatching with no way to page anybody,
+ * which is the one thing the arm handshake exists to prevent. A missing token
+ * fails the whole channel; the narrower approval preflight is reserved for a
+ * bridge that can send but cannot ask.
+ *
+ * Re-read on every tick, and specifically *not* snapshotted at session start,
+ * because of what this gate is actually about. Tier 2 is paged by conductor
+ * itself: `escalate.ts` reads the same `.env` and calls `api.telegram.org`
+ * directly, never through omp-telegram's bridge. So the question "can an
+ * escalation still reach a person" is answered by the file as it stands now, and
+ * an operator who fixes a missing token has fixed paging immediately — a startup
+ * snapshot would keep a working fleet silent until somebody restarted the
+ * session, which is a worse failure than the one it would prevent. Re-reading
+ * also catches the reverse: a channel that goes away mid-session stops the
+ * heartbeat on the next tick rather than days later.
  *
- * Re-read on every tick rather than cached at session start, because the bridge
- * is reconfigured by a long-lived operator out-of-band and a heartbeat that
- * trusted a startup snapshot would keep dispatching for days after the channel
- * went away.
+ * What the file cannot answer is whether *omp-telegram* holds a token. It binds
+ * one in `startBot()` at session start and rebinds only on `/telegram token` and
+ * `/telegram on`, so a token added out-of-band leaves the bridge's own tools —
+ * `telegram_ask`, `telegram_send` — dead until one of those runs. That is real,
+ * and it is deliberately not modelled here: this gate protects paging, the
+ * README says to reload the bridge, and `omp-conductor status` shows the row.
  */
 function channelIsUp(path: string): boolean {
+  if (!hasBotToken(dirname(path))) return false;
   let parsed: unknown;
   try {
     parsed = JSON.parse(readFileSync(path, "utf8"));
@@ -1036,6 +1059,15 @@ interface TickSession {
    * background noise.
    */
   approvalToolMissingLogged: boolean;
+  /**
+   * Whether omp-telegram could have bound a bot token when this session started.
+   * False means its `telegram_ask` / `telegram_send` are dead for this session
+   * however good `access.json` looks now, because the bridge resolves its token
+   * once in `startBot()`. Defaults true so a session that never reaches
+   * `session_start` — every unit test that calls `tick()` directly — keeps the
+   * behaviour the access file describes.
+   */
+  bridgeTokenAtStart: boolean;
   /** Consecutive {@link PENDING_REASON} skips — see {@link STALL_MARKER_FILE}. */
   pendingSkips: number;
 }
@@ -1115,13 +1147,49 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
     }
   }
 
-  // The floor's approval primitive, checked against the live mounted set at the
-  // moment this tick is composed — not once at session start, because the
-  // mounted set is exactly what differed between two consecutive turns of the
-  // same session on 2026-08-09 (#114). Appended last, after the friction
-  // digest: the digest is what provokes an amendment, so the sentence that says
-  // the amendment cannot be approved here is the one that should read last.
-  if (!pi.getActiveTools().includes(TELEGRAM_APPROVAL_TOOL)) {
+  // The floor's approval primitive, decided from configuration rather than from
+  // the live mounted set — and that is a correction, not a shortcut. The first
+  // attempt at this read `pi.getActiveTools()` here, which is wrong at exactly
+  // this point in the lifecycle: omp-telegram mounts `telegram_ask` in
+  // `before_agent_start` and takes it away again in `agent_end`
+  // (`restorePromptTools`), so it exists only *during* a turn. This runs between
+  // turns, composing the prompt that is about to start one, so the live set
+  // never contains the tool — a correctly configured fleet would have been told
+  // the approval was unavailable on every single tick, and the error line meant
+  // to flag a real fault would have fired 144 times a day saying nothing.
+  //
+  // What decides the mounting is knowable in advance and is shared with the
+  // status row, so the two cannot disagree: a locally injected tick has no
+  // `<telegram-message>` wrapper, so omp-telegram can only resolve a target
+  // through `notifyTarget()` — `notifyMode` plus a destination, both in the
+  // access file. Appended last, after the friction digest: the digest is what
+  // provokes an amendment, so the sentence saying the amendment cannot be
+  // approved here is the one that should read last.
+  //
+  // No access file configured means no fleet channel to judge, so nothing is
+  // claimed: the channel gate above already treats that as "not the fleet".
+  //
+  // Two facts have to hold and the access file carries only one. It says whether
+  // a destination would resolve; it cannot say whether the bridge holds a token
+  // to resolve it with, because omp-telegram binds that once in `startBot()`. A
+  // token written out-of-band after this session started opens the channel gate
+  // — conductor pages tier 2 itself, so that much is honest — while leaving
+  // `telegram_ask` and `telegram_send` dead until `/telegram on`. Trusting the
+  // file alone there puts the tick straight back to mandating a call its surface
+  // cannot make, which is #114 exactly.
+  const approval =
+    config.accessFile === undefined
+      ? undefined
+      : session.bridgeTokenAtStart
+        ? readApprovalSurface(config.accessFile)
+        : ({
+            kind: "missing",
+            reason:
+              `${TELEGRAM_APPROVAL_TOOL} unavailable on local ticks: omp-telegram had no bot token when this ` +
+              "session started, so it bound none and its tools stay dead however complete the access file looks " +
+              "now — run `/telegram on` in this session, or restart it, to rebind the bridge",
+          } as const);
+  if (approval?.kind === "missing") {
     content = `${content}\n${TICK_APPROVAL_UNAVAILABLE_RULE}`;
     if (!session.approvalToolMissingLogged) {
       session.approvalToolMissingLogged = true;
@@ -1129,20 +1197,10 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
       // inbound configured)` throughout the incident, so nothing else told the
       // operator the approval contract was unsatisfiable. A line buried at
       // info, beside one "tick sent" per interval, would not be found.
-      //
-      // It names the cause, not just the symptom, because the remedy is a file
-      // the operator owns: omp-telegram mounts the tool only for a turn whose
-      // prompt resolves a notify target, and a locally injected tick resolves
-      // one only through `notifyTarget()` — `notifyMode` "away" or "always",
-      // plus a destination.
-      pi.logger.error(
-        `[omp-conductor] ${TELEGRAM_APPROVAL_TOOL} is not mounted on this tick surface: omp-telegram mounts it ` +
-          "only for a turn that resolves a notify target, and a locally injected tick resolves one only when " +
-          `notifyMode is "away" or "always" with a destination (notifyChat, or topicsChat for a forum) in ` +
-          `${config.accessFile ?? "the omp-telegram access.json"} — until then ticks instruct the orchestrator ` +
-          "to deliver amendment questions with telegram_send and never to assume an answer",
-        { tool: TELEGRAM_APPROVAL_TOOL, ...(config.accessFile === undefined ? {} : { accessFile: config.accessFile }) },
-      );
+      pi.logger.error(`[omp-conductor] ${approval.reason}`, {
+        tool: TELEGRAM_APPROVAL_TOOL,
+        accessFile: config.accessFile,
+      });
     }
   }
 
@@ -1226,6 +1284,7 @@ export default function orchestratorTickExtension(pi: TickApi): void {
   const session: TickSession = {
     scopeFallbackLogged: false,
     approvalToolMissingLogged: false,
+    bridgeTokenAtStart: true,
     pendingSkips: 0,
   };
   let releaseGateArmed = false;
@@ -1325,6 +1384,24 @@ export default function orchestratorTickExtension(pi: TickApi): void {
 
     const config = result.config;
 
+    // Whether omp-telegram could have bound a token when this session started,
+    // which is a different question from whether one exists now and is the only
+    // one the approval preflight can honestly ask. The bridge resolves its token
+    // once, in `startBot()`, and rebinds only on `/telegram token` or
+    // `/telegram on` — so a token written into `.env` out-of-band leaves
+    // `telegram_ask` and `telegram_send` dead for the life of this session even
+    // though the file now looks perfect. Sampling here, next to the same
+    // `session_start` omp-telegram binds on, is as close as another package can
+    // get to that fact.
+    //
+    // Conservative on the other transition: an operator who ran `/telegram on`
+    // after start really does have a working bridge, and this snapshot will keep
+    // saying otherwise until the session restarts. That costs a fallback
+    // instruction the orchestrator can follow, where guessing the other way
+    // costs an amendment recorded as approved that nobody ever answered.
+    session.bridgeTokenAtStart =
+      config.accessFile === undefined ? true : bridgeTokenBound(config.accessFile);
+
     // Activation is a property of the directory, so every omp session started in
     // the fleet's cwd used to become a ticker — and with merge and release
     // delegated in config, a shell opened beside the orchestrator believed it

package/src/store.ts

@@ -85,6 +85,9 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   sessionFile: true,
   prUrl: true,
   headSha: true,
+  salvageSha: true,
+  salvageError: true,
+  salvageAckAt: true,
   startedAt: true,
   endedAt: true,
   lastError: true,
@@ -109,6 +112,9 @@ interface RunRow {
   sessionFile: string | null;
   prUrl: string | null;
   headSha: string | null;
+  salvageSha: string | null;
+  salvageError: string | null;
+  salvageAckAt: number | null;
   startedAt: number;
   endedAt: number | null;
   lastError: string | null;
@@ -146,6 +152,9 @@ CREATE TABLE IF NOT EXISTS runs (
   sessionFile TEXT,
   prUrl       TEXT,
   headSha     TEXT,
+  salvageSha  TEXT,
+  salvageError TEXT,
+  salvageAckAt INTEGER,
   startedAt   INTEGER NOT NULL,
   endedAt     INTEGER,
   lastError   TEXT
@@ -217,6 +226,9 @@ function toRecord(row: RunRow): RunRecord {
   if (row.sessionFile !== null) record.sessionFile = row.sessionFile;
   if (row.prUrl !== null) record.prUrl = row.prUrl;
   if (row.headSha !== null) record.headSha = row.headSha;
+  if (row.salvageSha !== null) record.salvageSha = row.salvageSha;
+  if (row.salvageError !== null) record.salvageError = row.salvageError;
+  if (row.salvageAckAt !== null) record.salvageAckAt = row.salvageAckAt;
   if (row.endedAt !== null) record.endedAt = row.endedAt;
   if (row.lastError !== null) record.lastError = row.lastError;
   return record;
@@ -324,12 +336,27 @@ export function openStore(dbPath: string): Store {
   if (!columns.some((column) => column.name === "headSha")) {
     db.exec("ALTER TABLE runs ADD COLUMN headSha TEXT");
   }
+  // v0.3.22 and earlier removed a blocked run's dirty tree without saving it
+  // (#118), so no row before this release has anywhere to record where the
+  // work went. A NULL `salvageSha` on a historical row therefore means "never
+  // asked", which reads the same as "clean tree" — the honest reading for a
+  // release that never salvaged one.
+  for (const [name, type] of [
+    ["salvageSha", "TEXT"],
+    ["salvageError", "TEXT"],
+    ["salvageAckAt", "INTEGER"],
+  ] as const) {
+    if (!columns.some((column) => column.name === name)) {
+      db.exec(`ALTER TABLE runs ADD COLUMN ${name} ${type}`);
+    }
+  }
 
   const insertRun = db.query<unknown, SqlValue[]>(
     `INSERT INTO runs (
        id, project, issue, repo, branch, worktree, state, attempt, turns,
-       maxTurns, spendUsd, sessionFile, prUrl, headSha, startedAt, endedAt, lastError
-     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       maxTurns, spendUsd, sessionFile, prUrl, headSha, salvageSha, salvageError,
+       salvageAckAt, startedAt, endedAt, lastError
+     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   );
   const selectRun = db.query<RunRow, [string]>(`SELECT * FROM runs WHERE id = ?`);
   const selectActive = db.query<RunRow, SqlValue[]>(
@@ -370,6 +397,21 @@ export function openStore(dbPath: string): Store {
     `SELECT COUNT(*) AS n FROM runs
       WHERE project = ? AND issue = ? AND state IN ('killed', 'orphaned', 'blocked')`,
   );
+  // Salvage state that still describes an issue's present, so an operator is
+  // shown a preserved WIP tip exactly while it is the thing a re-claim would
+  // build on — and an unsalvaged tree for as long as it is the only copy.
+  // Newest-attempt-only for the same reason the board is: a later attempt has
+  // already consumed or superseded whatever an older one left behind.
+  const selectSalvaged = db.query<RunRow, [string]>(
+    `SELECT * FROM runs
+      WHERE rowid IN (
+        SELECT MAX(rowid) FROM runs
+        WHERE project = ?
+        GROUP BY issue
+      )
+        AND (salvageSha IS NOT NULL OR salvageError IS NOT NULL)
+      ORDER BY issue ASC`,
+  );
   // Newest attempt for one issue. `startedAt` is millisecond-resolution and two
   // attempts could in principle share one, so rowid breaks the tie by insertion
   // order — a `tail` that attached to the older of two same-millisecond attempts
@@ -487,6 +529,9 @@ export function openStore(dbPath: string): Store {
         toSql(record.sessionFile),
         toSql(record.prUrl),
         toSql(record.headSha),
+        toSql(record.salvageSha),
+        toSql(record.salvageError),
+        toSql(record.salvageAckAt),
         record.startedAt,
         toSql(record.endedAt),
         toSql(record.lastError),
@@ -532,6 +577,10 @@ export function openStore(dbPath: string): Store {
       return selectRecentRuns.all(project, mergedSinceEpochMs).map(toRecord);
     },
 
+    salvagedRuns(project: string): RunRecord[] {
+      return selectSalvaged.all(project).map(toRecord);
+    },
+
     attemptsFor(project: string, issue: number): number {
       return countAttempts.get(project, issue)?.n ?? 0;
     },

package/src/types.ts

@@ -373,6 +373,17 @@ export interface RunRecord {
   prUrl?: string;
   /** Pull request head the worker observed after its deterministic CI watcher exited. */
   headSha?: string;
+  /** Commit this run's uncommitted work was preserved as before its worktree
+   *  was removed, on the run's own branch. Absent means the daemon found
+   *  nothing to save, or never looked — see {@link RunRecord.salvageError}. */
+  salvageSha?: string;
+  /** Why the salvage failed. Present means the worktree still holds the only
+   *  copy of real work, so the tree was kept and the issue is held out of
+   *  dispatch until an operator acknowledges it. */
+  salvageError?: string;
+  /** When an operator accepted the loss or recovered the tree by hand
+   *  (`unblock --force`). Clears the hold without erasing what happened. */
+  salvageAckAt?: number;
   startedAt: number;
   endedAt?: number;
   /** Last failure text, surfaced verbatim in escalations. */
@@ -388,6 +399,7 @@ export type AdmissionHoldReason =
   | "sibling-active"
   | "open-pr-lookup-error"
   | "open-pr"
+  | "unsalvaged-wip"
   | "daily-spend-cap"
   | "unroutable:no-repo-label"
   | "unroutable:multiple-repo-labels"
@@ -470,6 +482,10 @@ export interface Store {
   /** Newest attempt per issue for the live board. Non-merged work remains
    * visible; merged rows are bounded by the supplied recent-history cutoff. */
   recentRuns(project: string, mergedSinceEpochMs: number): RunRecord[];
+  /** Newest attempt per issue that preserved work or failed to, so `status`
+   *  can name every WIP tip a re-claim would build on and every tree that is
+   *  still the only copy. */
+  salvagedRuns(project: string): RunRecord[];
   /** Total run segments, used only for the monotonically increasing run number. */
   attemptsFor(project: string, issue: number): number;
   /** Terminal implementation failures that consume `maxAttemptsPerIssue`. */

package/src/unblock.ts

@@ -40,6 +40,11 @@ export interface UnblockOutcome {
   continuationsUsed: number;
   /** Newest attempt, when the store has one for this issue at all. */
   latest?: RunRecord;
+  /** Set when nothing was cleared because the newest attempt's work exists
+   *  only in its worktree. Carries the salvage failure verbatim. */
+  refused?: string;
+  /** Set when `--force` recorded an operator's acceptance of that loss. */
+  forced?: true;
 }
 
 /**
@@ -81,11 +86,35 @@ export async function unblockIssue(
   tracker: Tracker,
   store: Store,
   issue: number,
+  opts: { force?: boolean } = {},
 ): Promise<UnblockOutcome> {
   // Read before any label is touched: terminality is the whole of the argument
   // for clearing in-progress, so the row that carries it decides the set.
   const latest = store.latestRun(project.name, issue);
   const terminal = latest !== undefined && !LIVE_STATES.includes(latest.state);
+  const counts = {
+    attemptsUsed: store.attemptsFor(project.name, issue),
+    failuresUsed: store.failuresFor(project.name, issue),
+    continuationsUsed: store.continuationsFor(project.name, issue),
+  };
+
+  // The one case where this verb refuses. Clearing the labels here re-queues an
+  // issue whose next claim starts by force-removing the worktree that holds the
+  // only copy of the last attempt's work (#118) — and unlike every other state
+  // this function reasons about, that is unrecoverable. `--force` is the way
+  // through, and it is deliberately a separate keystroke rather than a prompt
+  // the operator can wave past: it records, on the row, that a human accepted
+  // the loss or recovered the tree themselves. Narrowed to the row rather than
+  // a boolean so the reason printed and the acknowledgement written are
+  // provably about the same run.
+  const held =
+    latest !== undefined && latest.salvageError !== undefined && latest.salvageAckAt === undefined
+      ? latest
+      : undefined;
+  if (held !== undefined && opts.force !== true) {
+    return { cleared: [], ...counts, latest: held, refused: held.salvageError };
+  }
+  if (held !== undefined) store.updateRun(held.id, { salvageAckAt: Date.now() });
 
   const cleared: string[] = [];
   for (const label of new Set([
@@ -99,10 +128,9 @@ export async function unblockIssue(
 
   return {
     cleared,
-    attemptsUsed: store.attemptsFor(project.name, issue),
-    failuresUsed: store.failuresFor(project.name, issue),
-    continuationsUsed: store.continuationsFor(project.name, issue),
+    ...counts,
     ...(latest === undefined ? {} : { latest }),
+    ...(held === undefined ? {} : { forced: true as const }),
   };
 }
 
@@ -116,6 +144,11 @@ export async function unblockIssue(
  * run row at all, where that label may still be sitting there unread. #18 was
  * filed against this function saying `next tick eligible again` in a case where
  * it was not, so the wording is a contract rather than prose.
+ *
+ * A refusal is the loudest thing this verb prints, and it prints instead of
+ * everything else: the operator asked to re-queue an issue whose only copy of
+ * real work is a directory, and the next line they read has to be the one that
+ * stops them typing the same command again with `--force` on the end.
  */
 export function formatUnblock(
   issue: number,
@@ -124,7 +157,24 @@ export function formatUnblock(
   caps: Caps,
 ): string {
   const latest = o.latest;
+
+  if (o.refused !== undefined) {
+    return [
+      `#${issue}: REFUSED — nothing was cleared`,
+      `  reason     attempt ${latest?.attempt ?? "?"} could not commit its work: ${o.refused}`,
+      `  only copy  ${latest?.worktree === undefined || latest.worktree === "" ? "(worktree path not recorded)" : latest.worktree}`,
+      "  why        re-claiming this issue removes that worktree, and the work is not on any ref",
+      `  recover    inspect the tree and commit or copy what matters, then re-run with --force`,
+    ].join("\n");
+  }
+
   const lines = [`#${issue}: cleared ${o.cleared.join(", ")}`];
+  if (o.forced === true) {
+    lines.push(
+      `  forced     the unsalvaged worktree was accepted as lost or already recovered by hand — ` +
+        "the next claim removes it",
+    );
+  }
 
   if (latest === undefined) {
     lines.push("  runs       none recorded — the terminal labels were cleared anyway; eligibility is read off the tracker");

package/src/worktree.ts

@@ -417,15 +417,21 @@ const SALVAGE_COMMIT_CONFIG = [
  * Subject stays the historical one-liner so status greps keep working; the
  * body is the manifest (#38). Cap the new-path list so a runaway tree cannot
  * push a multi-kilobyte commit message into every escalation.
+ *
+ * `ending` is the whole clause rather than a bare reason because not every
+ * salvaged run was killed. A run that blocked for a decision stopped on
+ * purpose (#118), and a commit message telling the operator reading it during
+ * recovery that the attempt was "killed by a blocked run" is a lie about the
+ * one artefact they are using to reconstruct what happened.
  */
 export function salvageCommitMessage(
   issue: number,
   attempt: number,
-  reason: string,
+  ending: string,
   files: string[],
   newPaths: string[],
 ): { subject: string; body: string } {
-  const subject = `wip(#${issue}): attempt ${attempt} killed by ${reason} — auto-salvaged`;
+  const subject = `wip(#${issue}): attempt ${attempt} ${ending} — auto-salvaged`;
   const n = files.length;
   const count = `${n} file${n === 1 ? "" : "s"}`;
   if (newPaths.length === 0) {
@@ -459,19 +465,27 @@ function parseCachedNameStatus(raw: string): { files: string[]; newPaths: string
 }
 
 /**
- * Commits a dead run's uncommitted work to the run's own branch and pushes it,
- * so that the tree the next attempt destroys is no longer the only copy.
+ * Commits a run's uncommitted work to the run's own branch and pushes it, so
+ * that the tree the next attempt destroys is no longer the only copy.
  *
  * This closes a deliberate asymmetry. `addWorktree` preserves the run branch
  * precisely because "that branch can hold the only copy of work attempt 1
  * committed but never pushed", while `removeWorktree` runs `worktree remove
  * --force` and `addWorktree` refuses to reuse a tree that "may hold a previous
  * attempt's uncommitted work" — committed work is kept by design, uncommitted
- * work is discarded by design. That trade is fair for a worker that *stops*:
- * blocking is a decision it makes with turns left to commit first. It is not
- * fair for one killed by the turns cap or the wall clock, or one that crashes:
- * that end is external, unannounced, mid-sentence, and it lands hardest on the
- * long refactors carrying the most unsaved work. So: non-graceful ends only.
+ * work was discarded by design.
+ *
+ * That trade was first taken only for non-graceful ends, on the argument that
+ * a worker which *stops* had turns left to commit for itself. #118 is what
+ * that argument cost. veltro#349 blocked on a real decision — whether a
+ * failing test was obsolete — after editing 34 files across a request/auth
+ * boundary, and the daemon force-removed the tree seconds later; the branch
+ * and `origin/main` still pointed at the same commit, and the session
+ * transcript was the only surviving evidence the work had ever existed. A
+ * worker asking permission is precisely a worker declining to commit a
+ * half-migrated tree, so "had turns to commit" and "should have committed"
+ * were never the same claim. Every end whose tree is about to be removed
+ * salvages: killed, crashed, orphaned, and blocked alike.
  *
  * Never throws. Every outcome, including its own failure, comes back as a value
  * for the caller to log and to put in front of a human.
@@ -481,13 +495,13 @@ function parseCachedNameStatus(raw: string): { files: string[]; newPaths: string
  * commit in this host's mirror, which is strictly better than nothing. It is a
  * plain fast-forward push — never a force — and if the run already had a PR
  * open, that PR gains the WIP commit and re-runs its checks. That is the price
- * of work outliving its host, and only a run that already failed ever pays it.
+ * of work outliving its host.
  */
 export async function salvageWip(
   worktree: string,
   issue: number,
   attempt: number,
-  reason: string,
+  ending: string,
 ): Promise<SalvageOutcome> {
   try {
     // A tree that is not there cannot be holding work. Checked before spawning
@@ -532,7 +546,7 @@ export async function salvageWip(
       return { kind: "nothing" };
     }
     const { files, newPaths } = parseCachedNameStatus(cached);
-    const msg = salvageCommitMessage(issue, attempt, reason, files, newPaths);
+    const msg = salvageCommitMessage(issue, attempt, ending, files, newPaths);
     await git(
       [
         ...SALVAGE_COMMIT_CONFIG,