omp-conductor 0.3.24 → 0.3.25

package/README.md

@@ -617,7 +617,7 @@ Then, per admitted issue:
    | --- | --- | --- | --- |
    | `pushed-pending` | `agent:in-progress` stays while the daemon rechecks GitHub | removed | none |
    | `pushed-green` | `agent:in-progress` stays while the PR is open | removed | none |
-   | `blocked` | swapped to `agent:blocked` | removed | Tier 1 |
+   | `blocked` | swapped to `agent:blocked` | dirty tree committed to the branch, then removed | Tier 1 |
    | `failed` / `killed` | swapped to `agent:failed` | dirty tree committed to the branch, then retained until the PR or issue is terminal | Tier 1 |
    | unexpected error | swapped to `agent:failed` | same | Tier 1 |
 
@@ -630,18 +630,38 @@ Then, per admitted issue:
    leaves a window in which the issue carries no state label at all, which is
    exactly the shape eligibility reads as fresh work.
 
-   **A non-graceful end salvages the tree first.** A turns-cap kill, a
-   wall-clock kill and a crash are all external and unannounced: they land
-   mid-edit, and only the run's *branch* is preserved across attempts — the tree
-   is removed `--force` by the next one. So before the escalation is written,
-   a dirty tree is committed to the run's own branch as
-   `wip(#<issue>): attempt <n> killed by <reason> — auto-salvaged` (everything,
-   including files git has never seen) and pushed, and the escalation says where
-   it went: `WIP committed to <branch> @ <sha>`. A push that is refused leaves
-   the commit in this host's mirror and says so; a salvage that fails outright
-   says that, loudly, naming the tree that now holds the only copy. A `blocked`
-   run is deliberately *not* salvaged — it stopped on purpose, with turns still
-   in hand to commit for itself.
+   **Every continuable end salvages the tree first.** A turns-cap kill, a
+   wall-clock kill, a crash and a graceful block all leave a tree the next
+   attempt removes `--force` — only the run's *branch* is preserved across
+   attempts. So before the escalation is written, a dirty tree is committed to
+   the run's own branch as `wip(#<issue>): attempt <n> <ending> — auto-salvaged`
+   (everything, including files git has never seen) and pushed, and the
+   escalation says where it went: `WIP committed to <branch> @ <sha>`. A push
+   that is refused leaves the commit in this host's mirror and says so.
+
+   Blocking was excluded from this until #118, on the argument that a worker
+   which stops on purpose has turns left to commit for itself. It cost a
+   34-file refactor: the worker blocked to ask whether a failing test was
+   obsolete — which is precisely a worker declining to commit a half-migrated
+   tree — and the daemon removed the tree seconds later, leaving the run branch
+   and `origin/main` on the same commit. A `pushed-green` or `pushed-pending`
+   run is now the only end that does not salvage: its deliverable is already on
+   a remote branch, and appending a WIP commit would turn the PR the daemon
+   just verified red.
+
+   **A salvage that fails keeps the tree and stops the issue.** If git refuses
+   the commit, the worktree is the only copy in existence, so it is retained
+   whatever the run's outcome was, the row records the failure, and the issue
+   is held out of dispatch with the `unsalvaged-wip` reason — because claiming
+   it is what would finally destroy the tree. `status` shows it under `wip` as
+   `UNSALVAGED`, and `omp-conductor unblock <n>` refuses. Recover the tree by
+   hand, then `unblock <n> --force` records that you accepted it and releases
+   the hold.
+
+   **A preserved tip is named to the next worker.** The sha is written to the
+   run row, shown by `status` and the board, and the continuation brief tells
+   the resuming worker the exact commit it is building on and that it is the
+   only copy.
 
    Later ticks reap retained failure trees in bounded batches after the tracker
    proves their PR merged/closed or their issue closed, provided no live run or
@@ -1280,11 +1300,14 @@ nowhere. `omp-conductor status` is where they are told apart — its `telegram`
 names the specific fault.
 
 One caveat the file cannot express: omp-telegram binds its own copy of the token
-in `startBot()` at session start, and rebinds it only on `/telegram token` or
-`/telegram on`. Writing a token into `.env` out-of-band therefore restores
-tier-2 paging immediately — conductor sends those itself — while the bridge's own
+in `startBot()` at session start, and only when the bridge is switched on. It
+rebinds only on `/telegram token` or `/telegram on`. So writing a token into
+`.env` out-of-band — or flipping `enabled` to true by hand — restores tier-2
+paging immediately, because conductor sends those itself, while the bridge's own
 tools, `telegram_send` and `telegram_ask`, stay dead until you reload it. After
-adding a token by hand, run `/telegram on` in the orchestrator session.
+either edit, run `/telegram on` in the orchestrator session. Until you do, ticks
+carry an explicit note that an amendment cannot be approved on this surface, and
+the conductor never assumes an answer it did not receive.
 
 Leaving `accessFile` unset passes the gate, because an ordinary developer session
 that happens to have a `.conductor-tick.json` has no bridge to check. It is not an
@@ -1392,7 +1415,7 @@ omp-conductor disarm [--project NAME]
 omp-conductor release-pane [--project NAME]
 omp-conductor tail <issue> [--project NAME]
 omp-conductor extend <issue> --turns N [--project NAME]
-omp-conductor unblock <issue> [--project NAME]
+omp-conductor unblock <issue> [--force] [--project NAME]
 omp-conductor friction <escalation-digest|report-noise|report-surprise> --detail TEXT [--issue N] [--project NAME]
 omp-conductor daemon [--once] [--port N] [--project NAME]
 omp-conductor pause
@@ -1417,7 +1440,7 @@ omp-conductor help
 | `release-pane [--project NAME]` | Clear the `halt --pane` recovery pin so herdr-conductor may resume the fleet agent again. |
 | `tail <issue>` | Follow the newest run for that issue: the worker's assistant text as `assistant: …` and each tool it calls as `tool: <name>`, printed as they land. Workers are omp sessions inside the daemon rather than terminals, so this is the only way to watch one live — a herdr pane running it becomes an observation window. Starts from the top of the transcript, not the end, so attaching to a run that is already ten turns in shows those ten turns. Exits `1` with `no run recorded for #N` when the issue has never been dispatched, or `no transcript yet (state: …)` when the attempt has not opened one. Otherwise it runs until `Ctrl-C`, or until the run has finished and its transcript has been silent for five seconds, and prints `run ended: <state>`. |
 | `extend <issue> --turns N [--project NAME]` | Monotonically raise that live worker's effective turn ceiling through its owning daemon. The current omp session keeps running; no restart or continuation is created. The daemon persists the new ceiling for `status` and rejects missing, settled, cap-killed, equal, or lower requests instead of implying that an immutable session changed. |
-| `unblock <issue>` | Remove that issue's `blocked` and `failed` labels so an answered escalation can be claimed again. `agent:in-progress` comes off too, but only when the newest recorded run is terminal — that row is the proof no worker still owns the issue, so a live run keeps the label, and so does an issue with no run row at all. Run history remains intact: blocks consume the independent continuation budget, not failed implementation attempts. The output reports both budgets and warns when either will make the next tick escalate instead of dispatch. Exits `2` when the issue number is missing or malformed. |
+| `unblock <issue> [--force]` | Remove that issue's `blocked` and `failed` labels so an answered escalation can be claimed again. `agent:in-progress` comes off too, but only when the newest recorded run is terminal — that row is the proof no worker still owns the issue, so a live run keeps the label, and so does an issue with no run row at all. Run history remains intact: blocks consume the independent continuation budget, not failed implementation attempts. The output reports both budgets and warns when either will make the next tick escalate instead of dispatch. **Refuses, clearing nothing and exiting `3`, when the newest attempt's work could not be committed and its worktree is the only copy** — re-claiming removes that tree. `--force` records the operator's acceptance on the run row and then clears; the salvage failure stays in history. Exits `2` when the issue number is missing or malformed. |
 | `friction <kind> --detail TEXT [--issue N]` | Record one bounded judgment the daemon cannot infer: an escalation belonged in a digest, or a tick report was noise/surprising. The detail is limited to 160 characters. One event never changes policy; three observations inside seven days make the aggregate eligible for one Learning-loop prompt, followed by a seven-day cooldown. |
 | `daemon` | Run the loop in the **foreground**, ticking every 5 minutes and serving `/healthz`. Admitted workers run in a tracked background pool, so settlement and capacity checks remain periodic while they work; shutdown drains the pool before closing the store. This is what `start` launches and what a systemd unit should call. |
 | `daemon --once` | Run a single tick, wait for workers admitted by that tick, and exit. No HTTP server or pidfile — a drill must not register itself as the daemon, or the next reader believes it and the real daemon's in-flight runs get reconciled as orphans. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.3.24",
+  "version": "0.3.25",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/approval-surface.ts

@@ -36,7 +36,7 @@
  */
 
 import { readFileSync } from "node:fs";
-import { join } from "node:path";
+import { dirname, join } from "node:path";
 
 /** The tool the package floor names for the Learning-loop yes/no amendment
  *  approval (`## Learning loop`, step 2, in `briefs/orchestrator.md`). Held as
@@ -96,6 +96,41 @@ export function hasBotToken(stateDir: string): boolean {
   return false;
 }
 
+/**
+ * Whether omp-telegram would have *bound* a token, which is what its own tools
+ * depend on and is strictly narrower than the token existing.
+ *
+ * `startBot()` is the only thing that assigns `token`, and `session_start` calls
+ * it only when the bridge is switched on:
+ *
+ * ```js
+ * if (pi.getFlag("telegram") === true || process.env.OMP_TELEGRAM === "1" || access.enabled) await startBot(ctx);
+ * ```
+ *
+ * So a token sitting beside a bridge that was disabled at start was never
+ * picked up, and flipping `enabled` to true in the file afterwards does not pick
+ * it up either — only `/telegram on` or a restart does. Both halves therefore
+ * have to be true *at the same moment*, which is why this is sampled once rather
+ * than re-read.
+ *
+ * `pi.getFlag("telegram")` is omp's own launch flag and is not visible to this
+ * extension, so a session started with it but with `enabled: false` on disk
+ * reads as unbound here. That is the conservative direction: the cost is a
+ * fallback instruction the orchestrator can carry out, against an amendment
+ * recorded as approved that nobody answered.
+ */
+export function bridgeTokenBound(accessPath: string): boolean {
+  if (!hasBotToken(dirname(accessPath))) return false;
+  if (process.env["OMP_TELEGRAM"] === "1") return true;
+  let access: unknown;
+  try {
+    access = JSON.parse(readFileSync(accessPath, "utf8"));
+  } catch {
+    return false;
+  }
+  return field(access, "enabled") === true;
+}
+
 /** Reads the omp-telegram access file and answers whether a locally injected
  *  turn would resolve an answerable destination.
  *

package/src/board.ts

@@ -418,7 +418,12 @@ function runCardLines(run: RunRecord, snapshot: BoardSnapshot): string[] {
     `attempt ${run.attempt} · ${run.turns}/${run.maxTurns}t`,
     `$${run.spendUsd.toFixed(2)} · ${duration}`,
   ];
-  if (run.state === "pushed-pending") lines.push("checks pending");
+  // Ordered by what needs a human first. An unsalvaged tree outranks even a
+  // last error: the error describes a run that is over, the tree is work that
+  // is still at risk and an issue that will not dispatch (#118).
+  if (run.salvageError !== undefined && run.salvageAckAt === undefined) lines.push("UNSALVAGED WIP");
+  else if (run.state === "pushed-pending") lines.push("checks pending");
+  else if (run.salvageSha !== undefined) lines.push(`wip @ ${run.salvageSha.slice(0, 7)}`);
   else if (run.lastError !== undefined) lines.push(run.lastError.replace(/\s+/g, " "));
   else if (run.prUrl !== undefined) lines.push(run.prUrl.replace(/^https?:\/\//, ""));
   else lines.push(run.branch);

package/src/briefs/orchestrator.md

@@ -125,6 +125,14 @@ which in its output: a run that is genuinely still live, where declining is the
 correct answer, and no run row at all to prove the worker is gone. In that second
 case, escalate the stuck issue rather than editing its labels.
 
+`unblock` refuses outright, clearing nothing, when the newest attempt's work
+could not be committed and its worktree is the only copy of it — re-claiming the
+issue force-removes that tree. Its output names the directory and offers
+`--force`. **`--force` is never yours to pass.** It records that a human
+inspected the tree and accepted the loss, which is a judgement about work you
+cannot see, and the daemon has already paged the operator about it. Report the
+refusal and move on to the next issue.
+
 Never leave an orphan holding a slot "to be safe": a label nobody is working under
 is not safety, it is a deadlocked fleet that looks busy.
 

package/src/cli.ts

@@ -94,7 +94,7 @@ usage:
   omp-conductor release-pane [--project NAME]
   omp-conductor tail <issue> [--project NAME]
   omp-conductor extend <issue> --turns N [--project NAME]
-  omp-conductor unblock <issue> [--project NAME]
+  omp-conductor unblock <issue> [--force] [--project NAME]
   omp-conductor daemon [--once] [--port N] [--project NAME]
   omp-conductor pause
   omp-conductor resume
@@ -150,6 +150,9 @@ usage:
            and why the brief's "never hand-edit a state label" rule can stay
            absolute. Run history is kept; answered blocks consume the separate
            operational-continuation budget, not failed implementation attempts.
+           Refuses when the newest attempt's work could not be committed and
+           its worktree is the only copy: re-claiming removes that tree. Use
+           --force once you have recovered it or accepted the loss.
   friction record a bounded observation the daemon cannot classify itself:
            an escalation that belonged in a digest, or a tick report that was
            noise/surprising. Repeated observations feed the existing Learning
@@ -636,8 +639,12 @@ try {
       const project = findProject(cfg, flag(argv, "project"));
       const store = openStore(dbPath());
       try {
-        const outcome = await unblockIssue(project, makeTracker(project), store, issue);
+        const outcome = await unblockIssue(project, makeTracker(project), store, issue, {
+          force: argv.includes("--force"),
+        });
         process.stdout.write(`${formatUnblock(issue, outcome, project, resolveCaps(project, cfg.defaults))}\n`);
+        // A refusal must not read as success to a script or a board keypress.
+        if (outcome.refused !== undefined) process.exitCode = 3;
       } finally {
         store.close();
       }

package/src/daemon.ts

@@ -387,16 +387,30 @@ async function safeEscalate(d: Pick<Deps, "escalate">, e: Escalation): Promise<b
  * `checkIntegrity` is — this wording is the whole thing a human acts on, so it
  * is worth a test holding it, and the sha in it is the only pointer to work
  * that no longer has any other copy.
+ *
+ * `retained` is not cosmetic. These lines used to promise a tree "kept for
+ * inspection" unconditionally, which was true only because salvage ran only on
+ * the paths that keep one. A blocked run's tree is removed the moment its work
+ * is safely on the branch, and sending an operator to a path this process just
+ * deleted is the same class of mistake as #118 itself.
  */
-export function salvageLines(outcome: SalvageOutcome, worktree: string): string[] {
-  const kept = `Worktree kept for inspection: ${worktree}`;
+export function salvageLines(
+  outcome: SalvageOutcome,
+  worktree: string,
+  retained: boolean,
+): string[] {
+  const fate = retained
+    ? `Worktree kept for inspection: ${worktree}`
+    : `Worktree removed: ${worktree}`;
 
-  if (outcome.kind === "nothing") return [`${kept} — nothing uncommitted to salvage`];
+  if (outcome.kind === "nothing") return [`${fate} — nothing uncommitted to salvage`];
 
   if (outcome.kind === "failed") {
     return [
       `WIP SALVAGE FAILED: ${outcome.error}`,
-      `Uncommitted work in ${worktree} is the only copy of it, and the next attempt removes that tree.`,
+      `Uncommitted work in ${worktree} is the only copy of it, so the tree was kept.`,
+      "This issue is held out of dispatch until the tree is recovered by hand and",
+      "`omp-conductor unblock <n> --force` records that you accepted it.",
     ];
   }
 
@@ -415,35 +429,80 @@ export function salvageLines(outcome: SalvageOutcome, worktree: string): string[
       : `${count}; new: ${outcome.newPaths.slice(0, 12).join(", ")}${
           outcome.newPaths.length > 12 ? `, … +${outcome.newPaths.length - 12} more` : ""
         }`;
-  return [where, manifest, kept];
+  return [where, manifest, fate];
+}
+
+/** Everything a settled run has to record and say about its worktree. */
+export interface WorktreeSettlement {
+  outcome: SalvageOutcome;
+  /** Whether the tree still exists now the run is over. */
+  retained: boolean;
+  /** Escalation lines naming where the work went. */
+  lines: string[];
+  /** Row fields recording the durable ref, or the failure that blocks a re-claim. */
+  patch: Pick<RunRecord, "salvageSha" | "salvageError">;
 }
 
 /**
- * Commits and pushes whatever a dead run left uncommitted, logs the outcome and
- * returns the escalation lines that say where that work now lives.
+ * Decides what becomes of a finished run's worktree: save the work, then keep
+ * or remove the tree, then say which.
+ *
+ * One function because the two halves are one decision and splitting them is
+ * how #118 happened — the removal at the end of dispatch had no idea whether
+ * anything had been saved, and the salvage at the top of the failure branch had
+ * no idea the blocked branch fell through to a `--force` removal.
+ *
+ * A salvage that *fails* retains the tree whatever the caller asked for. There
+ * was real work, git refused to commit it, and the tree is now the only copy in
+ * existence: deleting it on schedule would be the data loss this whole path
+ * exists to prevent. The issue is held out of dispatch until an operator says
+ * otherwise, because the next attempt's `worktree remove --force` would finish
+ * the job (see `admitCandidates`).
  *
- * Only ever called on a non-graceful end — a cap kill, a crashed session, a
- * dispatch error. A `blocked` run stopped on purpose, with turns still in hand
- * and a brief that tells it to report rather than push, so nothing is committed
- * behind its back. The rest never got the chance: the kill is external and
- * lands mid-edit, in the tree the next attempt removes `--force`.
+ * Exported so a test can drive the real decision against a real git tree.
  */
-async function salvage(
-  issue: number,
-  attempt: number,
-  reason: string,
-  worktree: string,
-): Promise<string[]> {
-  const lines = salvageLines(await salvageWip(worktree, issue, attempt, reason), worktree);
+export async function settleWorktree(
+  args: {
+    issue: number;
+    attempt: number;
+    /** Clause for the commit subject: "killed by the turns cap", "blocked …". */
+    ending: string;
+    worktree: string;
+  } & (
+    | /** Terminal-failure and orphan trees are evidence, and are kept even when clean. */
+    { tree: "keep" }
+    | { tree: "remove"; mirrorPath: string }
+  ),
+): Promise<WorktreeSettlement> {
+  const { issue, attempt, ending, worktree } = args;
+  const outcome = await salvageWip(worktree, issue, attempt, ending);
+  const retained = args.tree === "keep" || outcome.kind === "failed";
+  if (!retained && args.tree === "remove") await removeWorktree(args.mirrorPath, worktree);
+
+  const lines = salvageLines(outcome, worktree, retained);
   log(`#${issue} salvage: ${lines.join(" ")}`);
-  return lines;
+  return {
+    outcome,
+    retained,
+    lines,
+    patch:
+      outcome.kind === "salvaged"
+        ? { salvageSha: outcome.sha }
+        : outcome.kind === "failed"
+          ? { salvageError: outcome.error }
+          : {},
+  };
 }
 
-/** How a run's end is named — in the salvage commit, and to whoever reads it. */
+/**
+ * How a run's end is named — in the salvage commit, and to whoever reads it.
+ * The whole clause, not a bare reason: a graceful block was not killed by
+ * anything, and the commit subject is read during recovery.
+ */
 function endedBy(killedBy: KilledBy | undefined): string {
-  if (killedBy === "turns") return "the turns cap";
-  if (killedBy === "wallclock") return "the wall-clock cap";
-  return "a failed run";
+  if (killedBy === "turns") return "killed by the turns cap";
+  if (killedBy === "wallclock") return "killed by the wall-clock cap";
+  return "killed by a failed run";
 }
 
 /**
@@ -460,7 +519,7 @@ export async function buildBrief(
   r: Routed,
   branch: string,
   worktree: string,
-  opts: { continuation?: boolean; defaultBranch?: string } = {},
+  opts: { continuation?: boolean; defaultBranch?: string; salvagedSha?: string } = {},
 ): Promise<string> {
   // Read per dispatch rather than caching: editing the brief then takes effect
   // on the next issue instead of needing a daemon restart.
@@ -474,6 +533,14 @@ export async function buildBrief(
           "",
           `You are **resuming** issue #${r.issue.number}. Branch \`${branch}\` already exists`,
           "and was reattached with prior commits (and possibly a salvaged WIP tip).",
+          ...(opts.salvagedSha === undefined
+            ? []
+            : [
+                "",
+                `The previous attempt's uncommitted work was preserved for you as commit`,
+                `\`${opts.salvagedSha}\` on this branch. It is the tip you are continuing from,`,
+                "and it is the only copy of that work — do not reset past it or force-push over it.",
+              ]),
           "Before writing anything:",
           "",
           "```bash",
@@ -599,9 +666,10 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
 
   let claimed = false;
   let run: RunRecord | undefined;
-  // Hoisted out of the try so the catch path can still name the tree: a crash
-  // mid-dispatch is one of the non-graceful ends whose uncommitted work has to
-  // be salvaged too, and it is the path least likely to have committed first.
+  // Hoisted out of the try so the catch path can still name and save the tree:
+  // a crash mid-dispatch is one of the ends whose uncommitted work has to be
+  // salvaged too, and it is the path least likely to have committed first.
+  const mirrorPath = mirrorPathFor(r.repo, project.mirrorRoot);
   let worktreePath: string | undefined;
   let turnLimit: TurnLimitController | undefined;
 
@@ -612,6 +680,10 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // issue out, and a human decides what to do with the orphan.
     await tracker.addLabel(issue, inProgress);
     claimed = true;
+    // Read before this attempt's own row exists, so `latestRun` still means the
+    // attempt whose work this one inherits.
+    const priorSalvage = store.latestRun(project.name, issue)?.salvageSha;
+
 
     run = store.createRun({
       project: project.name,
@@ -635,7 +707,6 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // tolerates a mirror or tree that is not there yet, so this is safe on a
     // first attempt. addWorktree does its own ensureMirror; calling it here too
     // would cost a second network fetch per attempt.
-    const mirrorPath = mirrorPathFor(r.repo, project.mirrorRoot);
     await removeWorktree(mirrorPath, worktreePathFor(project.workspaceRoot, issue));
     const provisioned = await addWorktree(
       r.repo,
@@ -664,6 +735,9 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         brief: await buildBrief(project, r, branch, worktreePath, {
           continuation: provisioned.reattached,
           defaultBranch: r.repo.defaultBranch,
+          ...(provisioned.reattached && priorSalvage !== undefined
+            ? { salvagedSha: priorSalvage }
+            : {}),
         }),
         cwd: worktreePath,
         caps,
@@ -706,6 +780,27 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     const finalReport =
       verified.reason === undefined ? result.report : `${verified.reason}\n\n${result.report}`;
 
+    // What becomes of the tree, decided once, before any label or page. A
+    // `pushed-*` run is the only end that does not salvage: its deliverable is
+    // already on a remote branch, whatever is left loose in the tree is by the
+    // worker's own account not part of it, and appending a WIP commit would
+    // turn the green PR this daemon just verified red. Every other end is
+    // continuable, so its tree is treated as work.
+    const settlement =
+      state === "pushed-green" || state === "pushed-pending" || state === "merged"
+        ? undefined
+        : await settleWorktree({
+            issue,
+            attempt,
+            ending:
+              state === "blocked" ? "blocked for an operator decision" : endedBy(result.killedBy),
+            worktree: worktreePath,
+            ...(state === "failed" || state === "killed"
+              ? ({ tree: "keep" } as const)
+              : ({ tree: "remove", mirrorPath } as const)),
+          });
+    if (settlement === undefined) await removeWorktree(mirrorPath, worktreePath);
+
     store.updateRun(runId, {
       state,
       endedAt: Date.now(),
@@ -715,8 +810,11 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       headSha: result.headSha,
       sessionFile: result.sessionFile,
       ...(verified.reason === undefined ? {} : { lastError: verified.reason }),
+      ...settlement?.patch,
     });
 
+    const salvaged = settlement?.lines ?? [];
+
     if (state === "blocked") {
       await swapLabel(tracker, issue, inProgress, project.stateLabels.blocked);
       await safeEscalate(d, {
@@ -725,7 +823,7 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         issue,
         runId,
         summary: `#${issue} is blocked on attempt ${attempt} and needs a decision`,
-        detail: [`${r.issue.title}`, r.issue.url, "", result.report].join("\n"),
+        detail: [`${r.issue.title}`, r.issue.url, "", ...salvaged, "", result.report].join("\n"),
       });
     } else if (state === "failed" || state === "killed") {
       // A turns cap consumes the independent continuation budget, not an
@@ -735,7 +833,6 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       const continueTurns =
         result.killedBy === "turns" &&
         hasContinuationBudget(continuation, caps.maxContinuationsPerIssue);
-      const salvaged = await salvage(issue, attempt, endedBy(result.killedBy), worktreePath);
 
       if (continueTurns) {
         await tracker.removeLabel(issue, inProgress);
@@ -790,13 +887,6 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       // checks or merge settle, preventing another worker from duplicating it.
       log(`#${issue} ${state}${result.prUrl ? ` ${result.prUrl}` : ""}`);
     }
-
-    // A failed or killed tree is evidence — keep it. Anything else is just
-    // disk, and the mirror means re-provisioning is cheap. (The kept tree is
-    // wiped by the next attempt, not left to accumulate forever.)
-    if (state !== "failed" && state !== "killed") {
-      await removeWorktree(mirrorPath, worktreePath);
-    }
   } catch (err) {
     // Dispatch setup can fail after the controller opens but before runWorker's
     // inner settlement guard exists. Latch it before any terminal write or await.
@@ -804,8 +894,25 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     turnLimit = undefined;
     const detail = errText(err);
     log(`#${issue} errored: ${detail}`);
+    // A crash lands anywhere, including mid-edit in a tree holding the only
+    // copy of real work. Nothing else on this path so much as looks at it.
+    const settlement =
+      worktreePath === undefined
+        ? undefined
+        : await settleWorktree({
+            issue,
+            attempt,
+            ending: "killed by a dispatch error",
+            worktree: worktreePath,
+            tree: "keep",
+          });
     if (run) {
-      store.updateRun(run.id, { state: "failed", endedAt: Date.now(), lastError: detail });
+      store.updateRun(run.id, {
+        state: "failed",
+        endedAt: Date.now(),
+        lastError: detail,
+        ...settlement?.patch,
+      });
     }
     if (claimed) {
       // Leaving the issue stuck as in-progress would hide it from both the
@@ -816,13 +923,8 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         log(`#${issue} could not be relabelled: ${errText(relabelErr)}`);
       }
     }
-    // A crash lands anywhere, including mid-edit in a tree holding the only
-    // copy of real work. Nothing else on this path so much as looks at it.
-    const salvaged =
-      worktreePath === undefined
-        ? []
-        : await salvage(issue, attempt, "a dispatch error", worktreePath);
 
+    const salvaged = settlement?.lines ?? [];
     await safeEscalate(d, {
       tier: 1,
       project: project.name,
@@ -1278,6 +1380,32 @@ export async function admitCandidates(
       continue;
     }
 
+    // Fail closed on work that exists only in a worktree. `addWorktree` clears
+    // the tree at <workspaceRoot>/<issue> before it provisions, so admitting
+    // this issue is what finally destroys the copy the salvage could not save
+    // (#118). Nothing here can recover it — git already refused once — so the
+    // only safe move is to refuse the claim and keep saying why until an
+    // operator has looked and run `unblock --force`.
+    const newest = store.latestRun(project.name, issue);
+    if (newest?.salvageError !== undefined && newest.salvageAckAt === undefined) {
+      hold(issue, "unsalvaged-wip");
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue,
+        summary: `#${issue} is holding unsalvaged work and will not be re-claimed`,
+        detail: [
+          r.issue.title,
+          r.issue.url,
+          `Attempt ${newest.attempt} could not commit its uncommitted changes: ${newest.salvageError}`,
+          `The only copy is the worktree ${newest.worktree === "" ? "(path not recorded)" : newest.worktree}.`,
+          "Dispatch is held because claiming this issue removes that tree.",
+          "Recover it by hand, then `omp-conductor unblock <n> --force` to release the hold.",
+        ].join("\n"),
+      });
+      continue;
+    }
+
     // Soft concurrency per epic: at most one in-flight child of a given parent.
     // No parent means today's concurrent admission. Cheap local filters already
     // ran; this sits before the open-PR API call so a held sibling frees the
@@ -1674,6 +1802,9 @@ export interface StatusSnapshot {
   caps: Caps;
   /** Occupied issues: live workers plus green PRs awaiting a human merge. */
   activeRuns: RunRecord[];
+  /** Newest attempts holding a preserved WIP tip, or a tree that is still the
+   *  only copy of work the daemon could not save. */
+  salvagedRuns: RunRecord[];
   /** Runs backed by a worker process — the number capacity compares against. */
   liveWorkers: number;
   runsToday: number;
@@ -1694,6 +1825,7 @@ export function statusSnapshotFromStore(p: ProjectConfig, caps: Caps, store: Sto
     paused: isPaused(),
     caps,
     activeRuns: store.activeRuns(p.name),
+    salvagedRuns: store.salvagedRuns(p.name),
     liveWorkers: store.liveRuns(p.name).length,
     runsToday: store.runsStartedSince(p.name, since),
     spendTodayUsd: store.spendSince(p.name, since),
@@ -1737,6 +1869,32 @@ export function formatDispatchSummary(summary?: DispatchSummary): string {
   return lines.join("\n");
 }
 
+/**
+ * The WIP block: every issue whose newest attempt left work behind, and
+ * whether that work is safe.
+ *
+ * Blocked runs used to be invisible here, which is exactly how #118 stayed
+ * invisible for a full attempt cycle — the operator saw a blocked issue and had
+ * no way to tell "stopped with 34 uncommitted files" from "stopped clean".
+ * A preserved line is informational; an UNSALVAGED line is an alarm, and it
+ * names the directory because that directory is the work.
+ */
+export function formatSalvagedRuns(runs: readonly RunRecord[]): string[] {
+  if (runs.length === 0) return [];
+  const lines = ["", "wip"];
+  for (const r of runs) {
+    lines.push(
+      r.salvageError !== undefined && r.salvageAckAt === undefined
+        ? `  #${r.issue}  UNSALVAGED  ${r.worktree === "" ? "(path not recorded)" : r.worktree} — ` +
+          `only copy, dispatch held (${r.salvageError})`
+        : r.salvageError !== undefined
+          ? `  #${r.issue}  accepted as lost  attempt ${r.attempt} (${r.salvageError})`
+          : `  #${r.issue}  preserved  ${r.salvageSha ?? "?"} on ${r.branch} (attempt ${r.attempt}, ${r.state})`,
+    );
+  }
+  return lines;
+}
+
 export function formatStatus(s: StatusSnapshot): string {
   const lines = [
     `project   ${s.project}${s.paused ? "  (PAUSED)" : ""}`,
@@ -1769,6 +1927,7 @@ export function formatStatus(s: StatusSnapshot): string {
       );
     }
   }
+  lines.push(...formatSalvagedRuns(s.salvagedRuns));
   // Deploy hint: a restart while workers are live orphans them (salvage runs
   // first — #35). Prefer pause + drain to zero live workers when you can wait.
   if (s.liveWorkers > 0) {
@@ -1873,12 +2032,20 @@ export async function reconcileOrphanedRuns(
   const endedAt = Date.now();
   for (const r of stale) {
     // Salvage before the row flips: the worktree path is on the record, and
-    // salvageWip is a no-op for a missing/clean tree. Reason string matches
-    // the cap-kill wording so triage reads the same either way.
-    if (r.worktree !== "") {
-      await salvage(r.issue, r.attempt, "a daemon restart", r.worktree);
-    }
-    store.updateRun(r.id, { state: "orphaned", endedAt });
+    // salvageWip is a no-op for a missing/clean tree. The clause matches the
+    // cap-kill wording so triage reads the same either way, and the tree is
+    // kept because an orphan's remains are the orchestrator's drain-duty call.
+    const settlement =
+      r.worktree === ""
+        ? undefined
+        : await settleWorktree({
+            issue: r.issue,
+            attempt: r.attempt,
+            ending: "killed by a daemon restart",
+            worktree: r.worktree,
+            tree: "keep",
+          });
+    store.updateRun(r.id, { state: "orphaned", endedAt, ...settlement?.patch });
   }
   return stale;
 }

package/src/fleet.ts

@@ -30,7 +30,14 @@ import { dirname, join } from "node:path";
 import { findProject, loadConfig, stateDir } from "./config.ts";
 import { readApprovalSurface } from "./approval-surface.ts";
 import { probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
-import { formatDispatchSummary, isPaused, setPaused, statusSnapshot, type StatusSnapshot } from "./daemon.ts";
+import {
+  formatDispatchSummary,
+  formatSalvagedRuns,
+  isPaused,
+  setPaused,
+  statusSnapshot,
+  type StatusSnapshot,
+} from "./daemon.ts";
 import {
   healthCheck,
   isAlive,
@@ -1029,6 +1036,7 @@ function formatProjectBody(s: StatusSnapshot): string {
       );
     }
   }
+  lines.push(...formatSalvagedRuns(s.salvagedRuns));
   if (s.liveWorkers > 0) {
     lines.push(
       "",

package/src/orchestrator-tick.ts

@@ -48,7 +48,12 @@ import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
 import { findProject, loadConfig, resolveReleasePolicy } from "./config.ts";
-import { hasBotToken, readApprovalSurface, TELEGRAM_APPROVAL_TOOL } from "./approval-surface.ts";
+import {
+  bridgeTokenBound,
+  hasBotToken,
+  readApprovalSurface,
+  TELEGRAM_APPROVAL_TOOL,
+} from "./approval-surface.ts";
 import {
   briefPathForProject,
   policyPathForProject,
@@ -1054,6 +1059,15 @@ interface TickSession {
    * background noise.
    */
   approvalToolMissingLogged: boolean;
+  /**
+   * Whether omp-telegram could have bound a bot token when this session started.
+   * False means its `telegram_ask` / `telegram_send` are dead for this session
+   * however good `access.json` looks now, because the bridge resolves its token
+   * once in `startBot()`. Defaults true so a session that never reaches
+   * `session_start` — every unit test that calls `tick()` directly — keeps the
+   * behaviour the access file describes.
+   */
+  bridgeTokenAtStart: boolean;
   /** Consecutive {@link PENDING_REASON} skips — see {@link STALL_MARKER_FILE}. */
   pendingSkips: number;
 }
@@ -1153,11 +1167,28 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
   // approved here is the one that should read last.
   //
   // No access file configured means no fleet channel to judge, so nothing is
-  // claimed: the channel gate above already treats that as "not the fleet". A
-  // missing bot token is likewise not this check's business — it fails the
-  // channel gate outright, so a tick that reaches here can already send, and the
-  // only open question is whether an answer can come back.
-  const approval = config.accessFile === undefined ? undefined : readApprovalSurface(config.accessFile);
+  // claimed: the channel gate above already treats that as "not the fleet".
+  //
+  // Two facts have to hold and the access file carries only one. It says whether
+  // a destination would resolve; it cannot say whether the bridge holds a token
+  // to resolve it with, because omp-telegram binds that once in `startBot()`. A
+  // token written out-of-band after this session started opens the channel gate
+  // — conductor pages tier 2 itself, so that much is honest — while leaving
+  // `telegram_ask` and `telegram_send` dead until `/telegram on`. Trusting the
+  // file alone there puts the tick straight back to mandating a call its surface
+  // cannot make, which is #114 exactly.
+  const approval =
+    config.accessFile === undefined
+      ? undefined
+      : session.bridgeTokenAtStart
+        ? readApprovalSurface(config.accessFile)
+        : ({
+            kind: "missing",
+            reason:
+              `${TELEGRAM_APPROVAL_TOOL} unavailable on local ticks: omp-telegram had no bot token when this ` +
+              "session started, so it bound none and its tools stay dead however complete the access file looks " +
+              "now — run `/telegram on` in this session, or restart it, to rebind the bridge",
+          } as const);
   if (approval?.kind === "missing") {
     content = `${content}\n${TICK_APPROVAL_UNAVAILABLE_RULE}`;
     if (!session.approvalToolMissingLogged) {
@@ -1253,6 +1284,7 @@ export default function orchestratorTickExtension(pi: TickApi): void {
   const session: TickSession = {
     scopeFallbackLogged: false,
     approvalToolMissingLogged: false,
+    bridgeTokenAtStart: true,
     pendingSkips: 0,
   };
   let releaseGateArmed = false;
@@ -1352,6 +1384,24 @@ export default function orchestratorTickExtension(pi: TickApi): void {
 
     const config = result.config;
 
+    // Whether omp-telegram could have bound a token when this session started,
+    // which is a different question from whether one exists now and is the only
+    // one the approval preflight can honestly ask. The bridge resolves its token
+    // once, in `startBot()`, and rebinds only on `/telegram token` or
+    // `/telegram on` — so a token written into `.env` out-of-band leaves
+    // `telegram_ask` and `telegram_send` dead for the life of this session even
+    // though the file now looks perfect. Sampling here, next to the same
+    // `session_start` omp-telegram binds on, is as close as another package can
+    // get to that fact.
+    //
+    // Conservative on the other transition: an operator who ran `/telegram on`
+    // after start really does have a working bridge, and this snapshot will keep
+    // saying otherwise until the session restarts. That costs a fallback
+    // instruction the orchestrator can follow, where guessing the other way
+    // costs an amendment recorded as approved that nobody ever answered.
+    session.bridgeTokenAtStart =
+      config.accessFile === undefined ? true : bridgeTokenBound(config.accessFile);
+
     // Activation is a property of the directory, so every omp session started in
     // the fleet's cwd used to become a ticker — and with merge and release
     // delegated in config, a shell opened beside the orchestrator believed it

package/src/store.ts

@@ -85,6 +85,9 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   sessionFile: true,
   prUrl: true,
   headSha: true,
+  salvageSha: true,
+  salvageError: true,
+  salvageAckAt: true,
   startedAt: true,
   endedAt: true,
   lastError: true,
@@ -109,6 +112,9 @@ interface RunRow {
   sessionFile: string | null;
   prUrl: string | null;
   headSha: string | null;
+  salvageSha: string | null;
+  salvageError: string | null;
+  salvageAckAt: number | null;
   startedAt: number;
   endedAt: number | null;
   lastError: string | null;
@@ -146,6 +152,9 @@ CREATE TABLE IF NOT EXISTS runs (
   sessionFile TEXT,
   prUrl       TEXT,
   headSha     TEXT,
+  salvageSha  TEXT,
+  salvageError TEXT,
+  salvageAckAt INTEGER,
   startedAt   INTEGER NOT NULL,
   endedAt     INTEGER,
   lastError   TEXT
@@ -217,6 +226,9 @@ function toRecord(row: RunRow): RunRecord {
   if (row.sessionFile !== null) record.sessionFile = row.sessionFile;
   if (row.prUrl !== null) record.prUrl = row.prUrl;
   if (row.headSha !== null) record.headSha = row.headSha;
+  if (row.salvageSha !== null) record.salvageSha = row.salvageSha;
+  if (row.salvageError !== null) record.salvageError = row.salvageError;
+  if (row.salvageAckAt !== null) record.salvageAckAt = row.salvageAckAt;
   if (row.endedAt !== null) record.endedAt = row.endedAt;
   if (row.lastError !== null) record.lastError = row.lastError;
   return record;
@@ -324,12 +336,27 @@ export function openStore(dbPath: string): Store {
   if (!columns.some((column) => column.name === "headSha")) {
     db.exec("ALTER TABLE runs ADD COLUMN headSha TEXT");
   }
+  // v0.3.22 and earlier removed a blocked run's dirty tree without saving it
+  // (#118), so no row before this release has anywhere to record where the
+  // work went. A NULL `salvageSha` on a historical row therefore means "never
+  // asked", which reads the same as "clean tree" — the honest reading for a
+  // release that never salvaged one.
+  for (const [name, type] of [
+    ["salvageSha", "TEXT"],
+    ["salvageError", "TEXT"],
+    ["salvageAckAt", "INTEGER"],
+  ] as const) {
+    if (!columns.some((column) => column.name === name)) {
+      db.exec(`ALTER TABLE runs ADD COLUMN ${name} ${type}`);
+    }
+  }
 
   const insertRun = db.query<unknown, SqlValue[]>(
     `INSERT INTO runs (
        id, project, issue, repo, branch, worktree, state, attempt, turns,
-       maxTurns, spendUsd, sessionFile, prUrl, headSha, startedAt, endedAt, lastError
-     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       maxTurns, spendUsd, sessionFile, prUrl, headSha, salvageSha, salvageError,
+       salvageAckAt, startedAt, endedAt, lastError
+     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   );
   const selectRun = db.query<RunRow, [string]>(`SELECT * FROM runs WHERE id = ?`);
   const selectActive = db.query<RunRow, SqlValue[]>(
@@ -370,6 +397,21 @@ export function openStore(dbPath: string): Store {
     `SELECT COUNT(*) AS n FROM runs
       WHERE project = ? AND issue = ? AND state IN ('killed', 'orphaned', 'blocked')`,
   );
+  // Salvage state that still describes an issue's present, so an operator is
+  // shown a preserved WIP tip exactly while it is the thing a re-claim would
+  // build on — and an unsalvaged tree for as long as it is the only copy.
+  // Newest-attempt-only for the same reason the board is: a later attempt has
+  // already consumed or superseded whatever an older one left behind.
+  const selectSalvaged = db.query<RunRow, [string]>(
+    `SELECT * FROM runs
+      WHERE rowid IN (
+        SELECT MAX(rowid) FROM runs
+        WHERE project = ?
+        GROUP BY issue
+      )
+        AND (salvageSha IS NOT NULL OR salvageError IS NOT NULL)
+      ORDER BY issue ASC`,
+  );
   // Newest attempt for one issue. `startedAt` is millisecond-resolution and two
   // attempts could in principle share one, so rowid breaks the tie by insertion
   // order — a `tail` that attached to the older of two same-millisecond attempts
@@ -487,6 +529,9 @@ export function openStore(dbPath: string): Store {
         toSql(record.sessionFile),
         toSql(record.prUrl),
         toSql(record.headSha),
+        toSql(record.salvageSha),
+        toSql(record.salvageError),
+        toSql(record.salvageAckAt),
         record.startedAt,
         toSql(record.endedAt),
         toSql(record.lastError),
@@ -532,6 +577,10 @@ export function openStore(dbPath: string): Store {
       return selectRecentRuns.all(project, mergedSinceEpochMs).map(toRecord);
     },
 
+    salvagedRuns(project: string): RunRecord[] {
+      return selectSalvaged.all(project).map(toRecord);
+    },
+
     attemptsFor(project: string, issue: number): number {
       return countAttempts.get(project, issue)?.n ?? 0;
     },

package/src/types.ts

@@ -373,6 +373,17 @@ export interface RunRecord {
   prUrl?: string;
   /** Pull request head the worker observed after its deterministic CI watcher exited. */
   headSha?: string;
+  /** Commit this run's uncommitted work was preserved as before its worktree
+   *  was removed, on the run's own branch. Absent means the daemon found
+   *  nothing to save, or never looked — see {@link RunRecord.salvageError}. */
+  salvageSha?: string;
+  /** Why the salvage failed. Present means the worktree still holds the only
+   *  copy of real work, so the tree was kept and the issue is held out of
+   *  dispatch until an operator acknowledges it. */
+  salvageError?: string;
+  /** When an operator accepted the loss or recovered the tree by hand
+   *  (`unblock --force`). Clears the hold without erasing what happened. */
+  salvageAckAt?: number;
   startedAt: number;
   endedAt?: number;
   /** Last failure text, surfaced verbatim in escalations. */
@@ -388,6 +399,7 @@ export type AdmissionHoldReason =
   | "sibling-active"
   | "open-pr-lookup-error"
   | "open-pr"
+  | "unsalvaged-wip"
   | "daily-spend-cap"
   | "unroutable:no-repo-label"
   | "unroutable:multiple-repo-labels"
@@ -470,6 +482,10 @@ export interface Store {
   /** Newest attempt per issue for the live board. Non-merged work remains
    * visible; merged rows are bounded by the supplied recent-history cutoff. */
   recentRuns(project: string, mergedSinceEpochMs: number): RunRecord[];
+  /** Newest attempt per issue that preserved work or failed to, so `status`
+   *  can name every WIP tip a re-claim would build on and every tree that is
+   *  still the only copy. */
+  salvagedRuns(project: string): RunRecord[];
   /** Total run segments, used only for the monotonically increasing run number. */
   attemptsFor(project: string, issue: number): number;
   /** Terminal implementation failures that consume `maxAttemptsPerIssue`. */

package/src/unblock.ts

@@ -40,6 +40,11 @@ export interface UnblockOutcome {
   continuationsUsed: number;
   /** Newest attempt, when the store has one for this issue at all. */
   latest?: RunRecord;
+  /** Set when nothing was cleared because the newest attempt's work exists
+   *  only in its worktree. Carries the salvage failure verbatim. */
+  refused?: string;
+  /** Set when `--force` recorded an operator's acceptance of that loss. */
+  forced?: true;
 }
 
 /**
@@ -81,11 +86,35 @@ export async function unblockIssue(
   tracker: Tracker,
   store: Store,
   issue: number,
+  opts: { force?: boolean } = {},
 ): Promise<UnblockOutcome> {
   // Read before any label is touched: terminality is the whole of the argument
   // for clearing in-progress, so the row that carries it decides the set.
   const latest = store.latestRun(project.name, issue);
   const terminal = latest !== undefined && !LIVE_STATES.includes(latest.state);
+  const counts = {
+    attemptsUsed: store.attemptsFor(project.name, issue),
+    failuresUsed: store.failuresFor(project.name, issue),
+    continuationsUsed: store.continuationsFor(project.name, issue),
+  };
+
+  // The one case where this verb refuses. Clearing the labels here re-queues an
+  // issue whose next claim starts by force-removing the worktree that holds the
+  // only copy of the last attempt's work (#118) — and unlike every other state
+  // this function reasons about, that is unrecoverable. `--force` is the way
+  // through, and it is deliberately a separate keystroke rather than a prompt
+  // the operator can wave past: it records, on the row, that a human accepted
+  // the loss or recovered the tree themselves. Narrowed to the row rather than
+  // a boolean so the reason printed and the acknowledgement written are
+  // provably about the same run.
+  const held =
+    latest !== undefined && latest.salvageError !== undefined && latest.salvageAckAt === undefined
+      ? latest
+      : undefined;
+  if (held !== undefined && opts.force !== true) {
+    return { cleared: [], ...counts, latest: held, refused: held.salvageError };
+  }
+  if (held !== undefined) store.updateRun(held.id, { salvageAckAt: Date.now() });
 
   const cleared: string[] = [];
   for (const label of new Set([
@@ -99,10 +128,9 @@ export async function unblockIssue(
 
   return {
     cleared,
-    attemptsUsed: store.attemptsFor(project.name, issue),
-    failuresUsed: store.failuresFor(project.name, issue),
-    continuationsUsed: store.continuationsFor(project.name, issue),
+    ...counts,
     ...(latest === undefined ? {} : { latest }),
+    ...(held === undefined ? {} : { forced: true as const }),
   };
 }
 
@@ -116,6 +144,11 @@ export async function unblockIssue(
  * run row at all, where that label may still be sitting there unread. #18 was
  * filed against this function saying `next tick eligible again` in a case where
  * it was not, so the wording is a contract rather than prose.
+ *
+ * A refusal is the loudest thing this verb prints, and it prints instead of
+ * everything else: the operator asked to re-queue an issue whose only copy of
+ * real work is a directory, and the next line they read has to be the one that
+ * stops them typing the same command again with `--force` on the end.
  */
 export function formatUnblock(
   issue: number,
@@ -124,7 +157,24 @@ export function formatUnblock(
   caps: Caps,
 ): string {
   const latest = o.latest;
+
+  if (o.refused !== undefined) {
+    return [
+      `#${issue}: REFUSED — nothing was cleared`,
+      `  reason     attempt ${latest?.attempt ?? "?"} could not commit its work: ${o.refused}`,
+      `  only copy  ${latest?.worktree === undefined || latest.worktree === "" ? "(worktree path not recorded)" : latest.worktree}`,
+      "  why        re-claiming this issue removes that worktree, and the work is not on any ref",
+      `  recover    inspect the tree and commit or copy what matters, then re-run with --force`,
+    ].join("\n");
+  }
+
   const lines = [`#${issue}: cleared ${o.cleared.join(", ")}`];
+  if (o.forced === true) {
+    lines.push(
+      `  forced     the unsalvaged worktree was accepted as lost or already recovered by hand — ` +
+        "the next claim removes it",
+    );
+  }
 
   if (latest === undefined) {
     lines.push("  runs       none recorded — the terminal labels were cleared anyway; eligibility is read off the tracker");

package/src/worktree.ts

@@ -417,15 +417,21 @@ const SALVAGE_COMMIT_CONFIG = [
  * Subject stays the historical one-liner so status greps keep working; the
  * body is the manifest (#38). Cap the new-path list so a runaway tree cannot
  * push a multi-kilobyte commit message into every escalation.
+ *
+ * `ending` is the whole clause rather than a bare reason because not every
+ * salvaged run was killed. A run that blocked for a decision stopped on
+ * purpose (#118), and a commit message telling the operator reading it during
+ * recovery that the attempt was "killed by a blocked run" is a lie about the
+ * one artefact they are using to reconstruct what happened.
  */
 export function salvageCommitMessage(
   issue: number,
   attempt: number,
-  reason: string,
+  ending: string,
   files: string[],
   newPaths: string[],
 ): { subject: string; body: string } {
-  const subject = `wip(#${issue}): attempt ${attempt} killed by ${reason} — auto-salvaged`;
+  const subject = `wip(#${issue}): attempt ${attempt} ${ending} — auto-salvaged`;
   const n = files.length;
   const count = `${n} file${n === 1 ? "" : "s"}`;
   if (newPaths.length === 0) {
@@ -459,19 +465,27 @@ function parseCachedNameStatus(raw: string): { files: string[]; newPaths: string
 }
 
 /**
- * Commits a dead run's uncommitted work to the run's own branch and pushes it,
- * so that the tree the next attempt destroys is no longer the only copy.
+ * Commits a run's uncommitted work to the run's own branch and pushes it, so
+ * that the tree the next attempt destroys is no longer the only copy.
  *
  * This closes a deliberate asymmetry. `addWorktree` preserves the run branch
  * precisely because "that branch can hold the only copy of work attempt 1
  * committed but never pushed", while `removeWorktree` runs `worktree remove
  * --force` and `addWorktree` refuses to reuse a tree that "may hold a previous
  * attempt's uncommitted work" — committed work is kept by design, uncommitted
- * work is discarded by design. That trade is fair for a worker that *stops*:
- * blocking is a decision it makes with turns left to commit first. It is not
- * fair for one killed by the turns cap or the wall clock, or one that crashes:
- * that end is external, unannounced, mid-sentence, and it lands hardest on the
- * long refactors carrying the most unsaved work. So: non-graceful ends only.
+ * work was discarded by design.
+ *
+ * That trade was first taken only for non-graceful ends, on the argument that
+ * a worker which *stops* had turns left to commit for itself. #118 is what
+ * that argument cost. veltro#349 blocked on a real decision — whether a
+ * failing test was obsolete — after editing 34 files across a request/auth
+ * boundary, and the daemon force-removed the tree seconds later; the branch
+ * and `origin/main` still pointed at the same commit, and the session
+ * transcript was the only surviving evidence the work had ever existed. A
+ * worker asking permission is precisely a worker declining to commit a
+ * half-migrated tree, so "had turns to commit" and "should have committed"
+ * were never the same claim. Every end whose tree is about to be removed
+ * salvages: killed, crashed, orphaned, and blocked alike.
  *
  * Never throws. Every outcome, including its own failure, comes back as a value
  * for the caller to log and to put in front of a human.
@@ -481,13 +495,13 @@ function parseCachedNameStatus(raw: string): { files: string[]; newPaths: string
  * commit in this host's mirror, which is strictly better than nothing. It is a
  * plain fast-forward push — never a force — and if the run already had a PR
  * open, that PR gains the WIP commit and re-runs its checks. That is the price
- * of work outliving its host, and only a run that already failed ever pays it.
+ * of work outliving its host.
  */
 export async function salvageWip(
   worktree: string,
   issue: number,
   attempt: number,
-  reason: string,
+  ending: string,
 ): Promise<SalvageOutcome> {
   try {
     // A tree that is not there cannot be holding work. Checked before spawning
@@ -532,7 +546,7 @@ export async function salvageWip(
       return { kind: "nothing" };
     }
     const { files, newPaths } = parseCachedNameStatus(cached);
-    const msg = salvageCommitMessage(issue, attempt, reason, files, newPaths);
+    const msg = salvageCommitMessage(issue, attempt, ending, files, newPaths);
     await git(
       [
         ...SALVAGE_COMMIT_CONFIG,