omp-conductor 0.3.6 → 0.3.9

package/README.md

@@ -355,8 +355,11 @@ a yes over Telegram, which is the same protocol it uses for any other amendment.
    omp-conductor daemon --once
    ```
 
-The loop ticks every 5 minutes. `omp-conductor stop` sends `SIGTERM`, and the loop
-shuts down after the current tick rather than mid-run.
+The loop ticks every 5 minutes. `omp-conductor stop` shuts the loop down after
+the current tick rather than mid-run. When the live process is the MainPID of
+`omp-conductor.service`, stop goes through `systemctl stop` so a unit with
+`Restart=on-failure` cannot bring it straight back; otherwise it is a raw
+`SIGTERM` (then `SIGKILL` after 10 seconds).
 
 ## How one tick works
 
@@ -454,19 +457,48 @@ A `claimed` or `running` row is a promise that a worker process exists, and a
 daemon that just started knows that promise is broken: its workers died with the
 previous process. At startup — unless another daemon is alive, so a foreground
 `daemon --once` cannot orphan a running daemon's real workers — every such row is
-moved to `orphaned`, with a log line naming the issue, the attempt and the
-worktree. That frees the slots immediately; a fleet must never resume as
-deadlocked as it crashed.
-
-Only the rows change. The issue keeps `agent:in-progress` — the label is the
-crash guard against double-dispatch — and deciding what the dead worker's remains
-are worth is the orchestrator's drain-duty judgement, spelled out in its brief:
-an open green PR goes to the merge path, a dirty tree is reported before anything
-destroys it (uncommitted edits have no other copy; unpushed *commits* are safe on
-the run's branch in the mirror, which a retry deliberately reattaches), and a
-clean orphan has its label released so the next tick re-claims it. Orphaned
-attempts still count toward `maxAttemptsPerIssue`, so a crash loop escalates
-instead of redispatching forever.
+**salvaged first** (dirty tree → `wip(#N): attempt N killed by a daemon restart —
+auto-salvaged` on the run's branch, same path as a turns-cap kill), then moved to
+`orphaned`, with a log line naming the issue, the attempt and the worktree. That
+frees the slots immediately; a fleet must never resume as deadlocked as it
+crashed, and uncommitted edits must not wait for a human with `bun -e`.
+
+Only the rows change after salvage. The issue keeps `agent:in-progress` — the
+label is the crash guard against double-dispatch — and deciding what the dead
+worker's remains are worth is the orchestrator's drain-duty judgement, spelled
+out in its brief: an open green PR goes to the merge path, a salvaged sha is a
+continuation hand-off, and a clean orphan has its label released so the next
+tick re-claims it. Orphaned attempts still count toward `maxAttemptsPerIssue`,
+so a crash loop escalates instead of redispatching forever.
+
+### Deploying a new package onto a busy fleet
+
+`systemctl restart` / `omp-conductor restart` is safe for **work product** once
+this version is installed: startup salvage commits dirty trees before orphaning
+rows, and salvage rewrites the mirror's managed `info/exclude` to the package's
+current list before `git add` so a narrowed ignore cannot hide deliverables.
+
+It is still disruptive for **in-flight sessions** (the worker process dies; the
+attempt is spent). Prefer draining when you can wait:
+
+1. `omp-conductor pause` — stop new claims; live workers finish.
+2. Wait until `omp-conductor status` shows `workers 0 / N` (no `deploy` hint line).
+3. Install the new package (`bun add -g omp-conductor@…`, `omp plugin install …`).
+4. `systemctl restart omp-conductor` (or `omp-conductor restart`).
+5. `omp-conductor resume` if you left it paused.
+
+If you cannot wait:
+
+1. `omp-conductor pause` (optional but keeps new claims off during the swap).
+2. Install.
+3. Restart — salvage runs on boot for every live worktree, then rows go `orphaned`.
+4. Resume; the pane orchestrator triages `agent:in-progress` orphans (continuation
+   / merge / release label). Status prints a `deploy` line while live workers > 0
+   so you can see the risk before you restart.
+
+Do **not** edit files under the running install and expect the daemon to keep
+dispatching — the integrity tripwire pauses and pages. Install, then restart, so
+the new process records a fresh baseline.
 
 ### What settles a green PR
 
@@ -496,6 +528,17 @@ merged and whose issues were all closed, through two daemon restarts — and bec
 the active set *is* the busy set, those three issues were permanently unclaimable.
 A status page that has stopped being evidence is worse than no status page.
 
+### Continuation runs
+
+When a worktree is provisioned onto a branch that already exists in the mirror
+(reattach after a prior attempt, orphan, or turns-cap auto-requeue), the worker
+brief includes a **Continuation** section: read `git log` / `git diff` against
+the default branch first, and do not recreate work already on the branch.
+
+A **turns-cap kill with attempts remaining** salvages the tree, puts the queue
+label back on, and skips the failed label so the next tick reclaims as a
+continuation automatically.
+
 ### Branch names
 
 `<type>/<slug>`, where the type is `fix` when any label's last segment (after `:`
@@ -539,14 +582,14 @@ rest. `0` is a real value (a hard stop), not "unset".
 | Cap | Default | What it protects |
 | --- | --- | --- |
 | `maxConcurrentWorkers` | `2` | Parallel omp sessions. Two, because **CI runner slots, not model tokens, are the usual throughput ceiling** — a third worker would starve its own PR checks on a small self-hosted runner pool. Raise it only if you actually have the runners. |
-| `dailySpendUsd` | `25` | Rolling-day spend ceiling. The one cap that stops the fleet rather than deferring work. |
+| `dailySpendUsd` | `25` | Rolling-day spend ceiling in USD, or `null` for no spend gate. `0` is a hard stop. Metered from assistant `usage.cost.total`. |
 | `workerMaxTurns` | `120` | Turn ceiling for one worker. Catches a session looping without converging. |
 | `workerWallClockMs` | `5400000` (90 minutes) | Wall-clock ceiling for one worker. A session that is merely stuck spends no turns, so turns alone cannot detect it. |
 | `maxAttemptsPerIssue` | `2` | Retries per issue before it escalates. One clean retry recovers from flaky CI; a third attempt almost always means the issue itself is underspecified. |
 
 Days are counted from **local midnight**, matching how a human reads "today".
 
-Hitting `dailySpendUsd` is not the same as hitting the other caps. A concurrency
+Set `dailySpendUsd` to `null` (wizard: blank) for no money gate — turns and wall-clock still apply. Hitting a numeric `dailySpendUsd` is not the same as hitting the other caps. A concurrency
 limit simply defers work to a later tick. The spend cap **pauses the daemon and
 pages at Tier 2**: a loop that is burning money has to halt itself, because
 waiting for someone to notice tomorrow is how a runaway becomes expensive.
@@ -1065,9 +1108,9 @@ omp-conductor help
 | Command | Behaviour |
 | --- | --- |
 | `start` | Spawn the loop in the background, detached, and wait until it answers `GET /healthz` on `:8787`. Refuses if one is already live, naming its pid. If the process dies or never serves, `start` cleans up after it and quotes the tail of `daemon.log`. |
-| `stop` | `SIGTERM`, then `SIGKILL` after a 10-second grace period. Prints `not running` when there is nothing to stop. |
-| `restart` | `stop` then `start`, inheriting the running daemon's port and project unless a flag overrides them — a restart that quietly moved to the default port would leave every existing health check pointing at nothing. |
-| `status [--project NAME]` | Pause state, config and state paths, resolved caps, active runs and today's usage, plus a `daemon` block: pid, uptime, port, project, `/healthz` result and log path. A `.conductor-stalled` marker in the state directory adds an `orchestrator   STALLED since …` line — see [the stall marker](#a-wedged-session-and-the-marker-that-notices). Reads while a daemon in another process writes. |
+| `stop` | Prefer `systemctl stop omp-conductor.service` when that unit's MainPID is the live daemon — systemd then owns the stop and will not schedule a restart for the exit it just requested. Otherwise `SIGTERM`, then `SIGKILL` after a 10-second grace period. Prints `not running` when there is nothing to stop, and tags the confirmation with `(via systemctl)` when the unit path was used. |
+| `restart` | Prefer `systemctl restart` when the unit owns the live pid so the replacement stays supervised; otherwise `stop` then `start`, inheriting the running daemon's port and project unless a flag overrides them. The new process **salvages dirty live worktrees before orphaning** those rows — see [Deploying a new package onto a busy fleet](#deploying-a-new-package-onto-a-busy-fleet). |
+| `status [--project NAME]` | Pause state, config and state paths, resolved caps, active runs and today's usage, plus a `daemon` block: pid, uptime, port, project, `/healthz` result and log path. While live workers > 0, prints a `deploy` line naming the count so a busy restart is visible before you take it. A `.conductor-stalled` marker in the state directory adds an `orchestrator   STALLED since …` line — see [the stall marker](#a-wedged-session-and-the-marker-that-notices). Reads while a daemon in another process writes. |
 | `tail <issue>` | Follow the newest run for that issue: the worker's assistant text as `assistant: …` and each tool it calls as `tool: <name>`, printed as they land. Workers are omp sessions inside the daemon rather than terminals, so this is the only way to watch one live — a herdr pane running it becomes an observation window. Starts from the top of the transcript, not the end, so attaching to a run that is already ten turns in shows those ten turns. Exits `1` with `no run recorded for #N` when the issue has never been dispatched, or `no transcript yet (state: …)` when the attempt has not opened one. Otherwise it runs until `Ctrl-C`, or until the run has finished and its transcript has been silent for five seconds, and prints `run ended: <state>`. |
 | `unblock <issue>` | Remove that issue's `blocked` and `failed` state labels through the tracker, so the next tick can claim it again. This is the supported way back for an escalation you answered: eligibility disqualifies any issue carrying a state label, so an answered issue that keeps one is never re-claimed and the answer is inert. Removing a label the issue does not carry is a no-op, so both are always cleared and neither has to be looked up first. `agent:in-progress` is deliberately not touched — it means a worker process exists, which is not something an answer changes. The run history is left exactly as it is: an answered block still spent a worker, so it still counts toward `maxAttemptsPerIssue`, and the output says how many attempts remain — or warns that the next tick will escalate instead of dispatching, when none do. Exits `2` with `unblock needs an issue number` on a missing or malformed positional. |
 | `daemon` | Run the loop in the **foreground**, ticking every 5 minutes and serving `/healthz`. This is what `start` launches, and what a systemd unit should call. Writes the pidfile itself, and refuses with `another daemon is alive (pid N); stop it first` rather than becoming a second dispatcher. |
@@ -1187,10 +1230,14 @@ Known and deliberate in this version:
   retried rather than corrupted.
 - **Mirrors grow one branch ref per run.** Unpushed work is never discarded, so
   refs accumulate until you reap them.
-- **`stop` is a deadline, not a clean drain.** `SIGTERM` asks the loop to finish the
-  tick it is on, and a tick with a worker in flight can run for that worker's whole
-  wall clock; after 10 seconds it is `SIGKILL`. There is no "stop once the current
-  worker lands".
+- **`stop` is a deadline, not a clean drain.** Whether it goes through
+  `systemctl` or a raw signal, the loop is asked to finish the tick it is on, and
+  a tick with a worker in flight can run for that worker's whole wall clock; the
+  signal path escalates to `SIGKILL` after 10 seconds. There is no "stop once the
+  current worker lands". A unit that supervises the daemon should set
+  `SuccessExitStatus=0 143` (belt-and-braces for a handled `SIGTERM` exit) and
+  operators should prefer `omp-conductor stop` / `systemctl stop` over a raw
+  `kill`, so `Restart=on-failure` cannot misread a deliberate stop as a crash.
 - **A failed orchestrator degrades quietly.** The daemon logs a warning and keeps
   running, but tier-1 escalations then land in issue comments — which is exactly the
   "nobody reads it until morning" path the orchestrator exists to avoid. The warning

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.3.6",
+  "version": "0.3.9",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/briefs/orchestrator.md

@@ -100,8 +100,11 @@ checked in this order:
 - **Commits — pushed or not — or a PR that is not green.** Safe either way:
   pushed work lives on the remote, and unpushed commits live on the run's branch
   in the mirror, which a re-claim deliberately reattaches so the next worker
-  starts from them. Note what exists and release the label; the attempt counter
-  still bounds a loop of deaths.
+  starts from them with a **continuation brief** (read the log/diff first; do
+  not recreate existing work). Note what exists and release the label; the
+  attempt counter still bounds a loop of deaths. A turns-cap kill with attempts
+  left is re-queued automatically by the daemon — you should still notice it on
+  drain, but you do not have to invent the continuation prompt.
 - **Genuinely nothing** (clean tree, no commits, no PR). Release the label and let
   the next tick re-claim it clean.
 

package/src/briefs/worker.md

@@ -28,7 +28,7 @@ Then read the repo's own guidance before writing anything: `AGENTS.md`,
 `CLAUDE.md`, `CONTEXT.md`, and any `docs/adr/` entry the issue touches. Those
 files are canonical; your priors are not.
 
-## Acceptance criteria
+{{CONTINUATION}}## Acceptance criteria
 
 {{ACCEPTANCE_CRITERIA}}
 

package/src/cli.ts

@@ -16,6 +16,7 @@ import {
   DEFAULT_PORT,
   healthCheck,
   livingDaemon,
+  restartDaemon,
   startDaemon,
   stopDaemon,
   writeRecord,
@@ -46,9 +47,14 @@ usage:
   start    run the dispatch loop in the background and wait until it answers
            GET /healthz on :8787 (override with --port). Refuses if one is
            already running.
-  stop     signal the running daemon and wait for it to exit.
+  stop     stop the running daemon. Uses systemctl when the omp-conductor
+           unit owns the process (so Restart=on-failure cannot bring it back);
+           otherwise SIGTERM then SIGKILL.
   restart  stop then start, keeping the running daemon's port and project
-           unless a flag overrides them.
+           unless a flag overrides them. On boot the new process salvages any
+           dirty live worktrees before orphaning those rows — see README
+           "Deploying a new package onto a busy fleet". Goes through systemctl
+           when the unit owns the live pid.
   status   show pause state, caps, active runs, today's usage, and whether a
            daemon is alive.
   tail     follow the newest run for <issue>: the worker's assistant text and
@@ -398,27 +404,35 @@ try {
     }
 
     case "stop": {
-      // Read the pid before it stops existing, so the confirmation can name it.
-      const pid = livingDaemon()?.pid;
       const result = await stopDaemon();
-      process.stdout.write(result === "stopped" ? `stopped — pid ${pid ?? "?"}\n` : "not running\n");
+      if (result.kind === "not-running") {
+        process.stdout.write("not running\n");
+      } else {
+        process.stdout.write(
+          `stopped — pid ${result.pid}${result.via === "systemctl" ? " (via systemctl)" : ""}\n`,
+        );
+      }
       break;
     }
 
     case "restart": {
       // Inherit the running daemon's port and project: a restart that quietly
       // moved to the default port would leave every existing health check
-      // pointing at nothing.
-      const previous = livingDaemon();
-      const result = await stopDaemon();
-      if (result === "stopped") process.stdout.write(`stopped — pid ${previous?.pid ?? "?"}\n`);
-      const rec = await startDaemon({
-        port: portFlag(argv) ?? previous?.port,
-        project: flag(argv, "project") ?? previous?.project,
+      // pointing at nothing. When the unit owns the live pid, restartDaemon
+      // goes through systemctl so the replacement stays supervised.
+      const { previous, record, via } = await restartDaemon({
+        port: portFlag(argv),
+        project: flag(argv, "project"),
       });
+      if (previous !== undefined) {
+        process.stdout.write(
+          `stopped — pid ${previous.pid}${via === "systemctl" ? " (via systemctl)" : ""}\n`,
+        );
+      }
       process.stdout.write(
-        `started — pid ${rec.pid}, /healthz on :${rec.port}` +
-          `${rec.project === undefined ? "" : `, project ${rec.project}`}\nlog ${rec.logFile}\n`,
+        `started — pid ${record.pid}, /healthz on :${record.port}` +
+          `${record.project === undefined ? "" : `, project ${record.project}`}` +
+          `${via === "systemctl" ? " (via systemctl)" : ""}\nlog ${record.logFile}\n`,
       );
       break;
     }

package/src/config.ts

@@ -139,15 +139,16 @@ export function saveConfig(c: ConductorConfig): void {
 /**
  * Layers a project's overrides on the global defaults, field by field, so a
  * project that pins one cap still inherits the other five. `??` not `||`: a
- * deliberate `dailySpendUsd: 0` is a hard stop, not "unset". Spelled out per
- * field so adding a `Caps` member fails to compile here instead of resolving
- * to `undefined` at a call site.
+ * deliberate `dailySpendUsd: 0` is a hard stop, not "unset", and `null` is a
+ * deliberate "no spend gate" that must not fall through to the default.
+ * Spelled out per field so adding a `Caps` member fails to compile here.
  */
 export function resolveCaps(p: ProjectConfig, defaults: Caps): Caps {
   const o: Partial<Caps> = p.caps ?? {};
   return {
     maxConcurrentWorkers: o.maxConcurrentWorkers ?? defaults.maxConcurrentWorkers,
-    dailySpendUsd: o.dailySpendUsd ?? defaults.dailySpendUsd,
+    // nullish only — `null` means off; do not coalesce it to the default.
+    dailySpendUsd: o.dailySpendUsd !== undefined ? o.dailySpendUsd : defaults.dailySpendUsd,
     workerMaxTurns: o.workerMaxTurns ?? defaults.workerMaxTurns,
     workerWallClockMs: o.workerWallClockMs ?? defaults.workerWallClockMs,
     maxAttemptsPerIssue: o.maxAttemptsPerIssue ?? defaults.maxAttemptsPerIssue,
@@ -520,8 +521,18 @@ function coerceCaps(parsed: unknown, label: string, problems: string[], legacy:
   for (const key of CAP_KEYS) {
     const v = raw[key];
     if (v === undefined) continue;
+    // Spend is the only cap that may be null (= no gate). Every other ceiling
+    // is a non-negative number; 0 remains a hard stop where it already was.
+    if (key === "dailySpendUsd" && v === null) {
+      out.dailySpendUsd = null;
+      continue;
+    }
     if (typeof v !== "number" || !Number.isFinite(v) || v < 0) {
-      problems.push(`${label}.${key} must be a non-negative finite number, found ${JSON.stringify(v)}`);
+      problems.push(
+        key === "dailySpendUsd"
+          ? `${label}.${key} must be a non-negative finite number or null (no cap), found ${JSON.stringify(v)}`
+          : `${label}.${key} must be a non-negative finite number, found ${JSON.stringify(v)}`,
+      );
       continue;
     }
     out[key] = v;

package/src/daemon.ts

@@ -444,10 +444,35 @@ export async function buildBrief(
   r: Routed,
   branch: string,
   worktree: string,
+  opts: { continuation?: boolean; defaultBranch?: string } = {},
 ): Promise<string> {
   // Read per dispatch rather than caching: editing the brief then takes effect
   // on the next issue instead of needing a daemon restart.
   const template = await Bun.file(BRIEF_TEMPLATE_PATH).text();
+  const defaultBranch = opts.defaultBranch ?? r.repo.defaultBranch;
+  const continuation =
+    opts.continuation === true
+      ? [
+          "",
+          "## Continuation — do not start from zero",
+          "",
+          `You are **resuming** issue #${r.issue.number}. Branch \`${branch}\` already exists`,
+          "and was reattached with prior commits (and possibly a salvaged WIP tip).",
+          "Before writing anything:",
+          "",
+          "```bash",
+          "git log --oneline origin/" + defaultBranch + "..HEAD",
+          "git diff --stat origin/" + defaultBranch + "...HEAD",
+          "git status --porcelain",
+          "```",
+          "",
+          "Read that history. **Do not recreate work that already exists.** Finish",
+          "what remains against the same acceptance criteria. If a prior attempt",
+          "left a `wip(#…): … auto-salvaged` commit, treat it as your starting",
+          "point, not as trash to rewrite from scratch.",
+          "",
+        ].join("\n")
+      : "";
   return renderBrief(template, {
     ISSUE_NUMBER: String(r.issue.number),
     ISSUE_TITLE: r.issue.title,
@@ -461,6 +486,7 @@ export async function buildBrief(
     // placeholder sits flush against the next list item in the template, so an
     // unconfigured render leaves no blank line where a hint would have gone.
     GRAPH_HINT: graphHint(r.repo),
+    CONTINUATION: continuation,
   });
 }
 
@@ -513,14 +539,14 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // would cost a second network fetch per attempt.
     const mirrorPath = mirrorPathFor(r.repo, project.mirrorRoot);
     await removeWorktree(mirrorPath, worktreePathFor(project.workspaceRoot, issue));
-
-    worktreePath = await addWorktree(
+    const provisioned = await addWorktree(
       r.repo,
       project.mirrorRoot,
       project.workspaceRoot,
       issue,
       branch,
     );
+    worktreePath = provisioned.path;
 
     // The SDK names the transcript itself, so the daemon supplies the parent
     // directory and learns the real path back from the result. Inventing one
@@ -529,10 +555,16 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     mkdirSync(sessionDir, { recursive: true });
     store.updateRun(runId, { worktree: worktreePath, state: "running" });
 
-    log(`#${issue} attempt ${attempt} → ${r.repo.name} ${branch}`);
+    log(
+      `#${issue} attempt ${attempt} → ${r.repo.name} ${branch}` +
+        (provisioned.reattached ? " (continuation: reattached existing branch)" : ""),
+    );
 
     const result = await runWorker({
-      brief: await buildBrief(project, r, branch, worktreePath),
+      brief: await buildBrief(project, r, branch, worktreePath, {
+        continuation: provisioned.reattached,
+        defaultBranch: r.repo.defaultBranch,
+      }),
       cwd: worktreePath,
       caps,
       sessionDir,
@@ -572,30 +604,61 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         detail: [`${r.issue.title}`, r.issue.url, "", result.report].join("\n"),
       });
     } else if (result.state === "failed" || result.state === "killed") {
-      await swapLabel(tracker, issue, inProgress, project.stateLabels.failed);
-      // Before the escalation is composed, so it can say where the work went —
-      // and long before the next attempt provisions over this tree.
+      // Turns-cap with attempts left: salvage, put the issue back on the queue,
+      // and skip the failed label so the next tick reclaims as a continuation
+      // instead of burning a human triage cycle (#50 / #21).
+      const continueTurns =
+        result.killedBy === "turns" && attempt < caps.maxAttemptsPerIssue;
       const salvaged = await salvage(issue, attempt, endedBy(result.killedBy), worktreePath);
-      await safeEscalate(d, {
-        tier: 1,
-        project: project.name,
-        issue,
-        runId,
-        // The dedup key includes the summary, so the attempt number is what
-        // lets a genuine second failure page again while a tick that keeps
-        // seeing the same dead issue stays quiet.
-        summary: result.killedBy
-          ? `#${issue} was killed on attempt ${attempt} by the ${result.killedBy} cap`
-          : `#${issue} failed on attempt ${attempt}`,
-        detail: [
-          `${r.issue.title}`,
-          r.issue.url,
-          ...salvaged,
-          `Session: ${result.sessionFile ?? "(no transcript)"}`,
-          "",
-          result.report,
-        ].join("\n"),
-      });
+
+      if (continueTurns) {
+        await tracker.removeLabel(issue, inProgress);
+        await tracker.addLabel(issue, project.queueLabel);
+        log(
+          `#${issue} turns-cap on attempt ${attempt}/${caps.maxAttemptsPerIssue} — ` +
+            `salvaged and re-queued for continuation`,
+        );
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue,
+          runId,
+          summary: `#${issue} hit the turns cap on attempt ${attempt} — auto-requeued for continuation`,
+          detail: [
+            `${r.issue.title}`,
+            r.issue.url,
+            ...salvaged,
+            `Session: ${result.sessionFile ?? "(no transcript)"}`,
+            "",
+            "The queue label is back on; the next tick should reattach the branch",
+            "and open a continuation brief. No failed label was applied.",
+            "",
+            result.report,
+          ].join("\n"),
+        });
+      } else {
+        await swapLabel(tracker, issue, inProgress, project.stateLabels.failed);
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue,
+          runId,
+          // The dedup key includes the summary, so the attempt number is what
+          // lets a genuine second failure page again while a tick that keeps
+          // seeing the same dead issue stays quiet.
+          summary: result.killedBy
+            ? `#${issue} was killed on attempt ${attempt} by the ${result.killedBy} cap`
+            : `#${issue} failed on attempt ${attempt}`,
+          detail: [
+            `${r.issue.title}`,
+            r.issue.url,
+            ...salvaged,
+            `Session: ${result.sessionFile ?? "(no transcript)"}`,
+            "",
+            result.report,
+          ].join("\n"),
+        });
+      }
     } else {
       // pushed-green: the PR belongs to a human now. The in-progress label
       // stays on until the merge closes the issue, which is also what keeps
@@ -923,9 +986,10 @@ async function tick(d: Deps): Promise<void> {
 
   // Spend is the one cap that stops the fleet instead of merely deferring work.
   // A loop that is burning money has to halt itself; waiting for a human to
-  // notice tomorrow is how a runaway becomes expensive.
+  // notice tomorrow is how a runaway becomes expensive. `null` means the
+  // operator opted out — turns and wall-clock still brake every run (#46).
   const spent = store.spendSince(project.name, since);
-  if (spent >= caps.dailySpendUsd) {
+  if (caps.dailySpendUsd !== null && spent >= caps.dailySpendUsd) {
     setPaused(true);
     await safeEscalate(d, {
       tier: 2,
@@ -1011,7 +1075,9 @@ export function formatStatus(s: StatusSnapshot): string {
     "caps",
     `  workers            ${s.liveWorkers} / ${s.caps.maxConcurrentWorkers}`,
     `  issues today       ${s.runsToday}`,
-    `  spend today        $${s.spendTodayUsd.toFixed(2)} / $${s.caps.dailySpendUsd.toFixed(2)}`,
+    s.caps.dailySpendUsd === null
+      ? `  spend today        $${s.spendTodayUsd.toFixed(2)} (no daily cap)`
+      : `  spend today        $${s.spendTodayUsd.toFixed(2)} / $${s.caps.dailySpendUsd.toFixed(2)}`,
     `  worker max turns   ${s.caps.workerMaxTurns}`,
     `  worker wall clock  ${Math.round(s.caps.workerWallClockMs / 60_000)}m`,
     `  attempts per issue ${s.caps.maxAttemptsPerIssue}`,
@@ -1029,6 +1095,15 @@ export function formatStatus(s: StatusSnapshot): string {
       );
     }
   }
+  // Deploy hint: a restart while workers are live orphans them (salvage runs
+  // first — #35). Prefer pause + drain to zero live workers when you can wait.
+  if (s.liveWorkers > 0) {
+    lines.push(
+      "",
+      `deploy    ${s.liveWorkers} live worker(s) — restart salvages dirty trees then orphans the rows; ` +
+        `pause and wait for workers 0/${s.caps.maxConcurrentWorkers} when you can drain instead`,
+    );
+  }
   return lines.join("\n");
 }
 
@@ -1085,18 +1160,18 @@ export function armConductor(): void {
 }
 
 /**
- * Settles the runs a previous daemon process left in flight.
+ * Settles `claimed`/`running` rows left by a dead daemon process and, before
+ * marking each one `orphaned`, salvages any dirty worktree.
  *
- * A `claimed` or `running` row is a promise that a worker exists in *some*
- * process. This is called from a freshly started daemon, so when no other
- * daemon is alive every such row is a worker that died with the previous
- * process. Left "active", those rows deadlock admission forever: the slot
- * count reads full while nothing runs, and the fleet looks busy doing nothing
- * (found live, after a host restart killed two workers mid-run).
+ * Found live after a host restart killed two workers mid-run, and again on
+ * every package deploy that restarted while workers were live (#35): without
+ * the salvage call the next attempt's `worktree remove --force` destroyed
+ * uncommitted edits that had no other copy. Cap-kills already salvaged (#27);
+ * this is the same call site for the restart path.
  *
  * Only the rows change. The issue keeps its in-progress label — that label is
  * the crash guard against double-dispatch, and deciding what a dead worker's
- * remains are worth (an open PR? unpushed commits? a dirty tree?) is the
+ * remains are worth (an open PR? a salvaged sha? a clean tree?) is the
  * orchestrator's drain-duty judgement, not something to automate here. The
  * rows also keep counting toward `maxAttemptsPerIssue`, so a loop of deaths
  * still escalates instead of retrying forever.
@@ -1107,12 +1182,21 @@ export function armConductor(): void {
  * them is {@link settlePushedGreen}, on the tick, by asking the tracker what
  * became of the PR — the one question a restart cannot answer by inference.
  */
-export function reconcileOrphanedRuns(store: Store, project: string): RunRecord[] {
+export async function reconcileOrphanedRuns(
+  store: Store,
+  project: string,
+): Promise<RunRecord[]> {
   // Live runs only: `pushed-green` holds no process, so it cannot be orphaned by
   // a process dying — it is finished work waiting on a human merge.
   const stale = store.liveRuns(project);
   const endedAt = Date.now();
   for (const r of stale) {
+    // Salvage before the row flips: the worktree path is on the record, and
+    // salvageWip is a no-op for a missing/clean tree. Reason string matches
+    // the cap-kill wording so triage reads the same either way.
+    if (r.worktree !== "") {
+      await salvage(r.issue, r.attempt, "a daemon restart", r.worktree);
+    }
     store.updateRun(r.id, { state: "orphaned", endedAt });
   }
   return stale;
@@ -1141,7 +1225,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   // daemon must not orphan that daemon's real, live workers).
   const alive = livingDaemon();
   if (alive === undefined || alive.pid === process.pid) {
-    for (const r of reconcileOrphanedRuns(store, project.name)) {
+    for (const r of await reconcileOrphanedRuns(store, project.name)) {
       log(
         `#${r.issue} orphaned by a previous daemon (attempt ${r.attempt}, was ${r.state}, worktree ${r.worktree}) — ` +
           `slot freed; the ${project.stateLabels.inProgress} label stays until the orchestrator triages what the worker left`,
@@ -1283,5 +1367,11 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     await orchestrator?.dispose();
     store.close();
     log("stopped");
+    // A handled SIGTERM still leaves some runtimes with a non-zero default
+    // (historically 128+signal). Under systemd `Restart=on-failure` that looks
+    // like a crash and the unit comes straight back — the exact failure mode
+    // `omp-conductor stop` hit on the reference fleet. Force success so a
+    // graceful drain is not a restart.
+    process.exitCode = 0;
   }
 }

package/src/lifecycle.ts

@@ -10,16 +10,30 @@
  * operator real time are `start` refusing against a ghost and `status`
  * reporting a daemon that died hours ago.
  *
+ * When the live pid is the MainPID of the `omp-conductor.service` unit,
+ * `stop`/`restart` go through `systemctl` rather than a raw `SIGTERM`. A
+ * raw signal against a unit with `Restart=on-failure` is read as a crash and
+ * the unit comes straight back — the bug that made `omp-conductor stop` look
+ * like a no-op on a systemd-managed host.
+ *
  * Deliberately free of every other module in this package: nothing here opens
  * the store, loads the config or talks to `gh`, so `stop` and `status` keep
  * working when the config is the very thing that is broken.
  */
 
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { chmodSync, closeSync, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
+/**
+ * The systemd unit name operators are expected to install for a supervised
+ * daemon. Hardcoded rather than configured: one name on the host is the
+ * whole point of a unit, and a wrong name would silently fall back to the
+ * SIGTERM path and reintroduce the restart loop this module exists to avoid.
+ */
+export const SYSTEMD_UNIT = "omp-conductor.service";
+
 /**
  * Mirrors `DEFAULT_PORT` in ./daemon.ts. Duplicated rather than imported so
  * this module stays free of the dispatcher's dependency tree; exported so the
@@ -271,23 +285,67 @@ export async function startDaemon(o: { port?: number; project?: string } = {}):
 }
 
 /**
- * Stops the daemon: `SIGTERM`, wait, then `SIGKILL`.
+ * How the last stop actually landed. Callers print this so an operator can
+ * tell a supervised stop from a bare SIGTERM without reading the journal.
+ */
+export type StopResult =
+  | { kind: "stopped"; pid: number; via: "systemctl" | "signal" }
+  | { kind: "not-running" };
+
+/**
+ * Stops the daemon.
  *
- * `SIGTERM` asks the loop to finish the tick it is on, and a tick that has a
- * worker in flight can run for the worker's whole wall clock. The grace period
- * is therefore a deadline, not a promise of a clean drain.
- * // ponytail: no way to say "stop when the current worker lands". If that
- * // matters, take a `--timeout` on the CLI verb, or poll `activeRuns` before
- * // escalating.
+ * Prefer `systemctl stop omp-conductor.service` when that unit's MainPID is
+ * the live daemon: systemd then owns the stop and will not schedule a restart
+ * for the exit it just requested. A raw `SIGTERM` against a unit with
+ * `Restart=on-failure` is what made `omp-conductor stop` look like a no-op on
+ * the reference fleet — exit 143 was a "failure", and the unit came back five
+ * seconds later.
+ *
+ * Falls back to `SIGTERM` then `SIGKILL` when there is no unit, the unit is
+ * not running, or its MainPID is somebody else (a hand-started daemon next to
+ * a stopped unit). The grace period is a deadline, not a clean drain: a tick
+ * with a worker in flight can run for that worker's whole wall clock.
  */
-export async function stopDaemon(o: { timeoutMs?: number } = {}): Promise<"stopped" | "not-running"> {
+export async function stopDaemon(o: { timeoutMs?: number } = {}): Promise<StopResult> {
   const rec = livingDaemon();
   if (rec === undefined) {
     // `livingDaemon` already cleared a stale file; this covers the unparseable
-    // one it refused to read.
+    // one it refused to read. Still ask systemd: a unit can be running with
+    // no pidfile (boot race, wiped runtime dir) and stop must still land.
+    const unitPid = systemdMainPid();
+    if (unitPid !== undefined && (await stopViaSystemd(undefined))) {
+      const deadline = Date.now() + (o.timeoutMs ?? STOP_TIMEOUT_MS);
+      while (isAlive(unitPid) && Date.now() < deadline) await sleep(100);
+      if (isAlive(unitPid)) {
+        throw new Error(
+          `daemon pid ${unitPid} still alive after systemctl stop ${SYSTEMD_UNIT} — ` +
+            `check \`systemctl status ${SYSTEMD_UNIT}\``,
+        );
+      }
+      clearRecord();
+      return { kind: "stopped", pid: unitPid, via: "systemctl" };
+    }
     clearRecord();
-    return "not-running";
+    return { kind: "not-running" };
   }
+
+  if (await stopViaSystemd(rec.pid)) {
+    // Wait out the unit: systemctl stop is synchronous for Type=simple, but
+    // a slow drain still holds the old pid briefly and the next start would
+    // refuse against it.
+    const deadline = Date.now() + (o.timeoutMs ?? STOP_TIMEOUT_MS);
+    while (isAlive(rec.pid) && Date.now() < deadline) await sleep(100);
+    if (isAlive(rec.pid)) {
+      throw new Error(
+        `daemon pid ${rec.pid} still alive after systemctl stop ${SYSTEMD_UNIT} — ` +
+          `check \`systemctl status ${SYSTEMD_UNIT}\``,
+      );
+    }
+    clearRecord();
+    return { kind: "stopped", pid: rec.pid, via: "systemctl" };
+  }
+
   const gone = await terminate(rec.pid, o.timeoutMs ?? STOP_TIMEOUT_MS);
   if (!gone) {
     // The record stays: something is still holding that pid, and forgetting
@@ -295,13 +353,146 @@ export async function stopDaemon(o: { timeoutMs?: number } = {}): Promise<"stopp
     throw new Error(`daemon pid ${rec.pid} survived SIGTERM and SIGKILL — it may belong to another user`);
   }
   clearRecord();
-  return "stopped";
+  return { kind: "stopped", pid: rec.pid, via: "signal" };
+}
+
+/**
+ * Restarts the daemon.
+ *
+ * Same ownership rule as {@link stopDaemon}: when the unit owns the live pid,
+ * `systemctl restart` keeps systemd in charge of the replacement process so
+ * the new MainPID is still the unit's. Falling back to stop+start for a
+ * hand-started daemon would leave the unit dead and the new process
+ * unsupervised — fine for a laptop, wrong for the host that installed a unit
+ * specifically so a crash comes back.
+ *
+ * Returns the record of the process that is now answering `/healthz`.
+ */
+export async function restartDaemon(
+  o: { port?: number; project?: string; timeoutMs?: number } = {},
+): Promise<{ previous: DaemonRecord | undefined; record: DaemonRecord; via: "systemctl" | "cli" }> {
+  const previous = livingDaemon();
+  const unitPid = systemdMainPid();
+  const unitOwns =
+    unitPid !== undefined && (previous === undefined || previous.pid === unitPid);
+
+  if (unitOwns) {
+    const ran = systemctl(["restart", SYSTEMD_UNIT]);
+    if (ran.ok) {
+      // systemctl restart returns once the new MainPID is up; the pidfile is
+      // written by the daemon itself on boot, so wait for that rather than
+      // inventing a record from the unit alone.
+      const deadline = Date.now() + READY_TIMEOUT_MS;
+      for (;;) {
+        const rec = livingDaemon();
+        if (rec !== undefined) {
+          const health = await healthCheck(rec.port);
+          if (health.ok) return { previous, record: rec, via: "systemctl" };
+        }
+        if (Date.now() >= deadline) break;
+        await sleep(READY_POLL_MS);
+      }
+      throw new Error(
+        `systemctl restart ${SYSTEMD_UNIT} returned, but the daemon never answered /healthz`,
+      );
+    }
+    // Unit exists and owns the pid but systemctl refused (permissions, dbus
+    // down). Fall through to the signal path rather than stranding the
+    // operator with "restart failed" and a still-running daemon they cannot
+    // reach through the unit.
+  }
+
+  await stopDaemon({ timeoutMs: o.timeoutMs });
+  const record = await startDaemon({ port: o.port ?? previous?.port, project: o.project ?? previous?.project });
+  return { previous, record, via: "cli" };
+}
+
+/**
+ * The MainPID of {@link SYSTEMD_UNIT}, or `undefined` when systemd is absent,
+ * the unit is unknown, or it is not running. Never throws: a missing binary
+ * or a dbus blip is "no unit", and stop falls back to SIGTERM.
+ */
+export function systemdMainPid(unit = SYSTEMD_UNIT): number | undefined {
+  const ran = systemctl(["show", unit, "--property=MainPID", "--property=ActiveState", "--value"]);
+  if (!ran.ok) return undefined;
+  // `systemctl show --value` prints one property per line, MainPID then
+  // ActiveState, in the order requested. Tolerate either order and blank
+  // lines so a future systemctl rearrange does not silently disable the path.
+  const lines = ran.stdout
+    .split("\n")
+    .map((l) => l.trim())
+    .filter((l) => l.length > 0);
+  let pid: number | undefined;
+  let active: string | undefined;
+  for (const line of lines) {
+    if (/^\d+$/.test(line)) {
+      const n = Number(line);
+      if (Number.isInteger(n) && n > 1) pid = n;
+    } else {
+      active = line;
+    }
+  }
+  if (active !== undefined && active !== "active" && active !== "reactivating") return undefined;
+  return pid;
 }
 
 // ---------------------------------------------------------------------------
 // internals
 // ---------------------------------------------------------------------------
 
+/**
+ * Ask systemd to stop the unit, but only when it actually owns `pid`.
+ *
+ * `pid === undefined` means "no pidfile" — still stop the unit if it is
+ * active, because that is the only process that could be the daemon. A unit
+ * whose MainPID is some other process is left alone: stopping it would take
+ * down a neighbour, and the signal path handles *our* pid.
+ */
+async function stopViaSystemd(pid: number | undefined): Promise<boolean> {
+  const main = systemdMainPid();
+  if (main === undefined) return false;
+  if (pid !== undefined && main !== pid) return false;
+  const ran = systemctl(["stop", SYSTEMD_UNIT]);
+  return ran.ok;
+}
+
+/**
+ * Run one `systemctl` invocation. Captures output and never throws: absence
+ * of the binary, a missing unit, or a permission error are all "not ok", and
+ * the caller decides whether to fall back.
+ *
+ * The default shells out. Tests replace it with {@link setSystemctlForTest}
+ * so the ownership decision is exercised without a real systemd.
+ */
+export type SystemctlFn = (args: string[]) => { ok: boolean; stdout: string; stderr: string };
+
+function defaultSystemctl(args: string[]): { ok: boolean; stdout: string; stderr: string } {
+  try {
+    const res = spawnSync("systemctl", args, {
+      encoding: "utf8",
+      // A hung dbus is not worth blocking stop on; the signal path is right there.
+      timeout: 15_000,
+      env: process.env,
+    });
+    if (res.error) return { ok: false, stdout: "", stderr: res.error.message };
+    return {
+      ok: res.status === 0,
+      stdout: res.stdout ?? "",
+      stderr: res.stderr ?? "",
+    };
+  } catch (err) {
+    return { ok: false, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+let systemctl: SystemctlFn = defaultSystemctl;
+
+/** Test-only: replace the `systemctl` runner. Pass `undefined` to restore. */
+export function setSystemctlForTest(fn: SystemctlFn | undefined): void {
+  systemctl = fn ?? defaultSystemctl;
+}
+
+
 function sleep(ms: number): Promise<void> {
   return new Promise<void>((resolve) => {
     const t = setTimeout(resolve, ms);

package/src/omp.ts

@@ -162,6 +162,11 @@ export async function createSession(opts: {
     // sharing it fails to start. The daemon runs `maxConcurrentWorkers`
     // (2 by default) workers at once, which makes this the normal path.
     agentRegistry: new mod.AgentRegistry(),
+    // Default true in the SDK, but pass it explicitly so a harness change
+    // cannot silently strip MCP from workers. Discovery walks cwd + user
+    // agentDir (~/.omp/agent/mcp.json) — without this, workers grep-only and
+    // burn the turns cap on discovery (#29).
+    enableMCP: true,
   });
   const raw = asRawSession(created);
   // Surfaced rather than swallowed: this is how a quiet downgrade to a weaker

package/src/plugin.ts

@@ -193,6 +193,30 @@ async function askNumber(ctx: CommandContext, title: string, fallback: number):
   return value;
 }
 
+/**
+ * Daily spend ceiling. Blank / "none" / "off" → null (no gate). Unparseable
+ * non-empty input keeps the current value. Distinct from askNumber so operators
+ * can turn the money brake off without writing a magic 0 (which is a hard stop).
+ */
+async function askSpendCap(
+  ctx: CommandContext,
+  title: string,
+  fallback: number | null,
+): Promise<number | null> {
+  const seed = fallback === null ? "" : String(fallback);
+  const raw = (await ask(ctx, title, seed)).trim().toLowerCase();
+  if (raw === "" || raw === "none" || raw === "off" || raw === "null") return null;
+  const value = Number(raw);
+  if (!Number.isFinite(value) || value < 0) {
+    ctx.ui.notify(
+      `"${raw}" is not a non-negative number or blank — keeping ${fallback === null ? "no cap" : fallback}.`,
+      "warning",
+    );
+    return fallback;
+  }
+  return value;
+}
+
 /**
  * Pre-push gates as one comma-separated line, `cmd @ cwd` for a subdirectory:
  * `bun run check, bun test @ server`. Shown through `formatGates`, the same
@@ -500,10 +524,12 @@ const askGraph: AreaAsker = async (ctx, a) => {
  *  answer for anyone who has not measured their own runners. */
 const askCaps: AreaAsker = async (ctx, a) => {
   const caps: Partial<Caps> = { ...a.caps };
+  const spendLabel =
+    DEFAULT_CAPS.dailySpendUsd === null ? "no spend cap" : `$${DEFAULT_CAPS.dailySpendUsd}/day`;
   const tuneCaps = await ctx.ui.confirm(
     "Caps",
     `Defaults: ${DEFAULT_CAPS.maxConcurrentWorkers} workers, ` +
-      `$${DEFAULT_CAPS.dailySpendUsd}/day, ${DEFAULT_CAPS.workerMaxTurns} turns and ` +
+      `${spendLabel}, ${DEFAULT_CAPS.workerMaxTurns} turns and ` +
       `${Math.round(DEFAULT_CAPS.workerWallClockMs / 60000)} min per worker, ` +
       `${DEFAULT_CAPS.maxAttemptsPerIssue} attempts per issue. Change them?`,
   );
@@ -516,7 +542,11 @@ const askCaps: AreaAsker = async (ctx, a) => {
     "Max concurrent workers",
     caps.maxConcurrentWorkers ?? DEFAULT_CAPS.maxConcurrentWorkers,
   );
-  caps.dailySpendUsd = await askNumber(ctx, "Spend ceiling per rolling day (USD)", caps.dailySpendUsd ?? DEFAULT_CAPS.dailySpendUsd);
+  caps.dailySpendUsd = await askSpendCap(
+    ctx,
+    "Spend ceiling per rolling day (USD) — blank = no spend cap",
+    caps.dailySpendUsd !== undefined ? caps.dailySpendUsd : DEFAULT_CAPS.dailySpendUsd,
+  );
   caps.workerMaxTurns = await askNumber(ctx, "Turn ceiling per worker", caps.workerMaxTurns ?? DEFAULT_CAPS.workerMaxTurns);
   caps.workerWallClockMs = await askNumber(
     ctx,

package/src/setup.ts

@@ -954,9 +954,11 @@ export const AMEND_AREAS: {
     describe: (p) => {
       const c = resolveCaps(p, DEFAULT_CAPS);
       const answered = Object.keys(p.caps).length > 0;
+      const spend =
+        c.dailySpendUsd === null ? "no spend cap" : `$${c.dailySpendUsd}/day`;
       return (
         `${c.maxConcurrentWorkers} workers, ${c.workerMaxTurns} turns, ` +
-        `${Math.round(c.workerWallClockMs / 60000)}m, $${c.dailySpendUsd}/day, ` +
+        `${Math.round(c.workerWallClockMs / 60000)}m, ${spend}, ` +
         `${c.maxAttemptsPerIssue} attempts${answered ? "" : " (all defaults)"} — ` +
         `${p.workerModel === undefined ? "harness default model" : `model ${p.workerModel}`}`
       );

package/src/types.ts

@@ -16,8 +16,11 @@ export interface Caps {
   /** Parallel omp sessions. Two by default: on a small self-hosted runner pool
    *  a third worker would starve its own PR checks. */
   maxConcurrentWorkers: number;
-  /** Rolling-day spend ceiling; the loop stops claiming work once it is hit. */
-  dailySpendUsd: number;
+  /**
+   * Rolling-day spend ceiling. `null` means no spend gate (turns + wall-clock
+   * still apply). `0` is a hard stop — deliberate, not "unset".
+   */
+  dailySpendUsd: number | null;
   /** Turn ceiling for one worker — catches loops that are burning tokens
    *  without converging. */
   workerMaxTurns: number;

package/src/worker.ts

@@ -216,15 +216,22 @@ export async function runWorker(
     // is its report, whether it finished cleanly or was cut off.
     const text = reportText(field(message, "content"));
     if (text !== "") report = text;
+
+    // Real cost lives on assistant messages as `usage.cost.total` (live hermes
+    // transcripts, 2026-08-07). The earlier agent_end.telemetry path never
+    // fired, so every run recorded $0 and the daily cap was theater (#46).
+    const cost = costUsdFromMessage(message);
+    if (cost !== undefined) spendUsd += cost;
   });
 
   session.on("agent_end", (event) => {
-    // ponytail: cost only arrives when the harness run carries telemetry, so
-    // spend can legitimately read 0 and the daily-spend cap then leans on the
-    // turn and wall-clock ceilings. Upgrade path: pass a telemetry config
-    // through `createSession` once the harness exposes it on the SDK options.
+    // Fallback for harnesses that only attach cost on the terminal event.
     const estimated = field(field(field(event, "telemetry"), "cost"), "estimatedUsd");
-    if (typeof estimated === "number" && Number.isFinite(estimated)) spendUsd += estimated;
+    if (typeof estimated === "number" && Number.isFinite(estimated) && estimated > 0) {
+      // Prefer message totals when both exist — do not double-count a run that
+      // already accumulated per-message costs.
+      if (spendUsd === 0) spendUsd += estimated;
+    }
 
     // Anything that is not literally `false` — including garbage or nothing at
     // all — is a finished run.
@@ -282,6 +289,31 @@ export async function runWorker(
   );
 }
 
+/**
+ * USD cost from one assistant message's `usage.cost` block.
+ *
+ * Prefer `total` when present; otherwise sum the component fields the live
+ * harness emits (input/output/cacheRead/cacheWrite). Exported so a unit test
+ * can pin the shape without standing up a session.
+ */
+export function costUsdFromMessage(message: unknown): number | undefined {
+  const usage = field(message, "usage");
+  const cost = field(usage, "cost");
+  if (cost === null || typeof cost !== "object") return undefined;
+  const total = field(cost, "total");
+  if (typeof total === "number" && Number.isFinite(total) && total >= 0) return total;
+  let sum = 0;
+  let any = false;
+  for (const key of ["input", "output", "cacheRead", "cacheWrite"] as const) {
+    const v = field(cost, key);
+    if (typeof v === "number" && Number.isFinite(v) && v >= 0) {
+      sum += v;
+      any = true;
+    }
+  }
+  return any ? sum : undefined;
+}
+
 /**
  * Read one property off an unvalidated harness event. The event union lives in
  * the peer dependency, so the worker narrows the handful of fields it reads

package/src/worktree.ts

@@ -102,15 +102,27 @@ const EXCLUDE_END = "# <<< omp-conductor";
 
 /**
  * Appended to every mirror's `info/exclude`, and so in force in every worktree
- * cut from it. Deliberately the same shapes salvage therefore skips, and
- * for the same reason — a worker's own scaffolding is not the repo's business.
+ * cut from it: a worker's own scaffolding is not the repo's business, and
+ * keeping it out of `git status` keeps it out of the worker's own `git add -A`
+ * as well as out of salvage.
  *
- * Two layers because they catch different moments: this one keeps scratch out
- * of a worker's own `git add -A` and out of its `git status`, which salvage
- * never observes; the salvage list catches whatever a worker created before
- * this landed, or wrote past an ignore with `add -f`.
+ * **Only the directory form of `.scratch*`; the slash is the design.** An ignore
+ * here applies to every repo this fleet touches, and an ignored *new* file is
+ * invisible to salvage — `git add -A` skips it, and a tree holding only such
+ * files reports `nothing`. So a name that could plausibly be a deliverable must
+ * never appear in this list. The first version also carried `.env.local` and
+ * `*.local.sh`; its first correction still carried an unqualified `.scratch*`.
+ * All three make the same mistake: repos can legitimately ship an `.env.local`
+ * template, `bootstrap.local.sh`, `.scratchrc`, or `.scratchpad`, and a worker
+ * asked to add one would watch it vanish.
+ *
+ * The directory-only pattern survives because its trailing slash limits it to a
+ * directory whose name announces that its contents are disposable. That was
+ * the 2026-08-07 incident's exact shape (`.scratch82/env.sh`). Broader
+ * conventions belong in a repo's own `.gitignore`, where its operator chooses
+ * them, rather than being imposed by whatever dispatcher happens to be driving.
  */
-const LOCAL_EXCLUDE = [".scratch*/", ".scratch*", ".env.local", "*.local.sh"];
+const LOCAL_EXCLUDE = [".scratch*/"];
 
 /**
  * Adds the managed block to an `info/exclude`, preserving everything else.
@@ -182,6 +194,40 @@ async function configureMirror(mirrorPath: string): Promise<void> {
   writeFileSync(exclude, mergeExclude(existsSync(exclude) ? readFileSync(exclude, "utf8") : ""));
 }
 
+/**
+ * Rewrites this worktree's common `info/exclude` managed block to the package's
+ * current list. Salvage must do this itself: it is the path that runs after a
+ * package swap, when the mirror may still carry a previous release's patterns,
+ * and `git add -A` would otherwise silently skip legitimate new files the old
+ * list happened to name (dogfood 2026-08-07 / #44).
+ *
+ * Failures are swallowed — a missing common dir is "no exclude to heal", and
+ * the salvage dirty check still runs. Never throws into the salvage outcome.
+ */
+function refreshManagedExclude(worktree: string): void {
+  try {
+    // `--git-common-dir` is relative for linked worktrees; resolve against the
+    // tree so bare-mirror layouts and plain clones both land on info/exclude.
+    const common = Bun.spawnSync(["git", "rev-parse", "--git-common-dir"], {
+      cwd: worktree,
+      stdin: "ignore",
+      stdout: "pipe",
+      stderr: "pipe",
+      env: { ...process.env, GIT_TERMINAL_PROMPT: "0" },
+    });
+    if (common.exitCode !== 0) return;
+    const raw = common.stdout.toString().trim();
+    if (raw === "") return;
+    const commonDir = raw.startsWith("/") ? raw : join(worktree, raw);
+    const exclude = join(commonDir, "info", "exclude");
+    mkdirSync(dirname(exclude), { recursive: true });
+    writeFileSync(exclude, mergeExclude(existsSync(exclude) ? readFileSync(exclude, "utf8") : ""));
+  } catch {
+    // ponytail: exclude heal is best-effort; salvage still prefers a commit of
+    // whatever git can see over failing the whole orphan path.
+  }
+}
+
 /**
  * Returns the path of the bare mirror for `repo`, cloning it on first use and
  * refreshing it otherwise.
@@ -239,7 +285,7 @@ export async function addWorktree(
   workspaceRoot: string,
   issue: number,
   branch: string,
-): Promise<string> {
+): Promise<{ path: string; reattached: boolean }> {
   const mirrorPath = await ensureMirror(repo, mirrorRoot);
   mkdirSync(workspaceRoot, { recursive: true });
 
@@ -323,7 +369,7 @@ export async function addWorktree(
     }
   }
 
-  return worktreePath;
+  return { path: worktreePath, reattached: branchExists };
 }
 
 /**
@@ -394,6 +440,12 @@ export async function salvageWip(
     // code, and "no tree" is not a salvage failure worth alarming anyone with.
     if (!existsSync(worktree)) return { kind: "nothing" };
 
+    // Heal the managed ignore *before* status/add. A mirror left by an older
+    // build may still list patterns this release dropped; without this, an
+    // untracked deliverable matching the stale list is invisible to salvage
+    // and dies with the next `worktree remove --force` (#44).
+    refreshManagedExclude(worktree);
+
     if ((await git(["status", "--porcelain"], worktree)) === "") return { kind: "nothing" };
 
     // The tree's own branch, not one the caller believes it should be on: this