omp-conductor 0.3.7 → 0.3.11

package/src/daemon.ts

@@ -11,7 +11,7 @@ import { createHash } from "node:crypto";
 import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import { configPath, findProject, loadConfig, resolveCaps, stateDir } from "./config.ts";
-import { createEscalator } from "./escalate.ts";
+import { createEscalator, escalationIssueRef } from "./escalate.ts";
 import { graphHint } from "./graph.ts";
 import { livingDaemon } from "./lifecycle.ts";
 import { STALL_MARKER_FILE } from "./orchestrator-tick.ts";
@@ -369,7 +369,7 @@ async function safeEscalate(d: Pick<Deps, "escalate">, e: Escalation): Promise<b
     await d.escalate(e);
     return true;
   } catch (err) {
-    log(`escalation for #${e.issue} could not be delivered: ${errText(err)}`);
+    log(`escalation for ${escalationIssueRef(e.issue)} could not be delivered: ${errText(err)}`);
     return false;
   }
 }
@@ -393,13 +393,22 @@ export function salvageLines(outcome: SalvageOutcome, worktree: string): string[
     ];
   }
 
-  return [
+  const where =
     `WIP committed to ${outcome.branch} @ ${outcome.sha}` +
-      (outcome.pushed
-        ? " and pushed — the work outlives this worktree"
-        : ` but NOT pushed (${outcome.pushError ?? "no reason given"}) — it lives only in this host's mirror`),
-    kept,
-  ];
+    (outcome.pushed
+      ? " and pushed — the work outlives this worktree"
+      : ` but NOT pushed (${outcome.pushError ?? "no reason given"}) — it lives only in this host's mirror`);
+  // Manifest belongs in the escalation too: opening the commit is how the
+  // orchestrator talked itself into scrubbing a worker tree (#38).
+  const n = outcome.files.length;
+  const count = `${n} file${n === 1 ? "" : "s"}`;
+  const manifest =
+    outcome.newPaths.length === 0
+      ? `${count} (all modifications to tracked paths)`
+      : `${count}; new: ${outcome.newPaths.slice(0, 12).join(", ")}${
+          outcome.newPaths.length > 12 ? `, … +${outcome.newPaths.length - 12} more` : ""
+        }`;
+  return [where, manifest, kept];
 }
 
 /**
@@ -444,10 +453,35 @@ export async function buildBrief(
   r: Routed,
   branch: string,
   worktree: string,
+  opts: { continuation?: boolean; defaultBranch?: string } = {},
 ): Promise<string> {
   // Read per dispatch rather than caching: editing the brief then takes effect
   // on the next issue instead of needing a daemon restart.
   const template = await Bun.file(BRIEF_TEMPLATE_PATH).text();
+  const defaultBranch = opts.defaultBranch ?? r.repo.defaultBranch;
+  const continuation =
+    opts.continuation === true
+      ? [
+          "",
+          "## Continuation — do not start from zero",
+          "",
+          `You are **resuming** issue #${r.issue.number}. Branch \`${branch}\` already exists`,
+          "and was reattached with prior commits (and possibly a salvaged WIP tip).",
+          "Before writing anything:",
+          "",
+          "```bash",
+          "git log --oneline origin/" + defaultBranch + "..HEAD",
+          "git diff --stat origin/" + defaultBranch + "...HEAD",
+          "git status --porcelain",
+          "```",
+          "",
+          "Read that history. **Do not recreate work that already exists.** Finish",
+          "what remains against the same acceptance criteria. If a prior attempt",
+          "left a `wip(#…): … auto-salvaged` commit, treat it as your starting",
+          "point, not as trash to rewrite from scratch.",
+          "",
+        ].join("\n")
+      : "";
   return renderBrief(template, {
     ISSUE_NUMBER: String(r.issue.number),
     ISSUE_TITLE: r.issue.title,
@@ -461,6 +495,7 @@ export async function buildBrief(
     // placeholder sits flush against the next list item in the template, so an
     // unconfigured render leaves no blank line where a hint would have gone.
     GRAPH_HINT: graphHint(r.repo),
+    CONTINUATION: continuation,
   });
 }
 
@@ -513,14 +548,14 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // would cost a second network fetch per attempt.
     const mirrorPath = mirrorPathFor(r.repo, project.mirrorRoot);
     await removeWorktree(mirrorPath, worktreePathFor(project.workspaceRoot, issue));
-
-    worktreePath = await addWorktree(
+    const provisioned = await addWorktree(
       r.repo,
       project.mirrorRoot,
       project.workspaceRoot,
       issue,
       branch,
     );
+    worktreePath = provisioned.path;
 
     // The SDK names the transcript itself, so the daemon supplies the parent
     // directory and learns the real path back from the result. Inventing one
@@ -529,10 +564,16 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     mkdirSync(sessionDir, { recursive: true });
     store.updateRun(runId, { worktree: worktreePath, state: "running" });
 
-    log(`#${issue} attempt ${attempt} → ${r.repo.name} ${branch}`);
+    log(
+      `#${issue} attempt ${attempt} → ${r.repo.name} ${branch}` +
+        (provisioned.reattached ? " (continuation: reattached existing branch)" : ""),
+    );
 
     const result = await runWorker({
-      brief: await buildBrief(project, r, branch, worktreePath),
+      brief: await buildBrief(project, r, branch, worktreePath, {
+        continuation: provisioned.reattached,
+        defaultBranch: r.repo.defaultBranch,
+      }),
       cwd: worktreePath,
       caps,
       sessionDir,
@@ -572,30 +613,61 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         detail: [`${r.issue.title}`, r.issue.url, "", result.report].join("\n"),
       });
     } else if (result.state === "failed" || result.state === "killed") {
-      await swapLabel(tracker, issue, inProgress, project.stateLabels.failed);
-      // Before the escalation is composed, so it can say where the work went —
-      // and long before the next attempt provisions over this tree.
+      // Turns-cap with attempts left: salvage, put the issue back on the queue,
+      // and skip the failed label so the next tick reclaims as a continuation
+      // instead of burning a human triage cycle (#50 / #21).
+      const continueTurns =
+        result.killedBy === "turns" && attempt < caps.maxAttemptsPerIssue;
       const salvaged = await salvage(issue, attempt, endedBy(result.killedBy), worktreePath);
-      await safeEscalate(d, {
-        tier: 1,
-        project: project.name,
-        issue,
-        runId,
-        // The dedup key includes the summary, so the attempt number is what
-        // lets a genuine second failure page again while a tick that keeps
-        // seeing the same dead issue stays quiet.
-        summary: result.killedBy
-          ? `#${issue} was killed on attempt ${attempt} by the ${result.killedBy} cap`
-          : `#${issue} failed on attempt ${attempt}`,
-        detail: [
-          `${r.issue.title}`,
-          r.issue.url,
-          ...salvaged,
-          `Session: ${result.sessionFile ?? "(no transcript)"}`,
-          "",
-          result.report,
-        ].join("\n"),
-      });
+
+      if (continueTurns) {
+        await tracker.removeLabel(issue, inProgress);
+        await tracker.addLabel(issue, project.queueLabel);
+        log(
+          `#${issue} turns-cap on attempt ${attempt}/${caps.maxAttemptsPerIssue} — ` +
+            `salvaged and re-queued for continuation`,
+        );
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue,
+          runId,
+          summary: `#${issue} hit the turns cap on attempt ${attempt} — auto-requeued for continuation`,
+          detail: [
+            `${r.issue.title}`,
+            r.issue.url,
+            ...salvaged,
+            `Session: ${result.sessionFile ?? "(no transcript)"}`,
+            "",
+            "The queue label is back on; the next tick should reattach the branch",
+            "and open a continuation brief. No failed label was applied.",
+            "",
+            result.report,
+          ].join("\n"),
+        });
+      } else {
+        await swapLabel(tracker, issue, inProgress, project.stateLabels.failed);
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue,
+          runId,
+          // The dedup key includes the summary, so the attempt number is what
+          // lets a genuine second failure page again while a tick that keeps
+          // seeing the same dead issue stays quiet.
+          summary: result.killedBy
+            ? `#${issue} was killed on attempt ${attempt} by the ${result.killedBy} cap`
+            : `#${issue} failed on attempt ${attempt}`,
+          detail: [
+            `${r.issue.title}`,
+            r.issue.url,
+            ...salvaged,
+            `Session: ${result.sessionFile ?? "(no transcript)"}`,
+            "",
+            result.report,
+          ].join("\n"),
+        });
+      }
     } else {
       // pushed-green: the PR belongs to a human now. The in-progress label
       // stays on until the merge closes the issue, which is also what keeps
@@ -923,9 +995,10 @@ async function tick(d: Deps): Promise<void> {
 
   // Spend is the one cap that stops the fleet instead of merely deferring work.
   // A loop that is burning money has to halt itself; waiting for a human to
-  // notice tomorrow is how a runaway becomes expensive.
+  // notice tomorrow is how a runaway becomes expensive. `null` means the
+  // operator opted out — turns and wall-clock still brake every run (#46).
   const spent = store.spendSince(project.name, since);
-  if (spent >= caps.dailySpendUsd) {
+  if (caps.dailySpendUsd !== null && spent >= caps.dailySpendUsd) {
     setPaused(true);
     await safeEscalate(d, {
       tier: 2,
@@ -1011,7 +1084,9 @@ export function formatStatus(s: StatusSnapshot): string {
     "caps",
     `  workers            ${s.liveWorkers} / ${s.caps.maxConcurrentWorkers}`,
     `  issues today       ${s.runsToday}`,
-    `  spend today        $${s.spendTodayUsd.toFixed(2)} / $${s.caps.dailySpendUsd.toFixed(2)}`,
+    s.caps.dailySpendUsd === null
+      ? `  spend today        $${s.spendTodayUsd.toFixed(2)} (no daily cap)`
+      : `  spend today        $${s.spendTodayUsd.toFixed(2)} / $${s.caps.dailySpendUsd.toFixed(2)}`,
     `  worker max turns   ${s.caps.workerMaxTurns}`,
     `  worker wall clock  ${Math.round(s.caps.workerWallClockMs / 60_000)}m`,
     `  attempts per issue ${s.caps.maxAttemptsPerIssue}`,
@@ -1029,6 +1104,15 @@ export function formatStatus(s: StatusSnapshot): string {
       );
     }
   }
+  // Deploy hint: a restart while workers are live orphans them (salvage runs
+  // first — #35). Prefer pause + drain to zero live workers when you can wait.
+  if (s.liveWorkers > 0) {
+    lines.push(
+      "",
+      `deploy    ${s.liveWorkers} live worker(s) — restart salvages dirty trees then orphans the rows; ` +
+        `pause and wait for workers 0/${s.caps.maxConcurrentWorkers} when you can drain instead`,
+    );
+  }
   return lines.join("\n");
 }
 
@@ -1085,18 +1169,18 @@ export function armConductor(): void {
 }
 
 /**
- * Settles the runs a previous daemon process left in flight.
+ * Settles `claimed`/`running` rows left by a dead daemon process and, before
+ * marking each one `orphaned`, salvages any dirty worktree.
  *
- * A `claimed` or `running` row is a promise that a worker exists in *some*
- * process. This is called from a freshly started daemon, so when no other
- * daemon is alive every such row is a worker that died with the previous
- * process. Left "active", those rows deadlock admission forever: the slot
- * count reads full while nothing runs, and the fleet looks busy doing nothing
- * (found live, after a host restart killed two workers mid-run).
+ * Found live after a host restart killed two workers mid-run, and again on
+ * every package deploy that restarted while workers were live (#35): without
+ * the salvage call the next attempt's `worktree remove --force` destroyed
+ * uncommitted edits that had no other copy. Cap-kills already salvaged (#27);
+ * this is the same call site for the restart path.
  *
  * Only the rows change. The issue keeps its in-progress label — that label is
  * the crash guard against double-dispatch, and deciding what a dead worker's
- * remains are worth (an open PR? unpushed commits? a dirty tree?) is the
+ * remains are worth (an open PR? a salvaged sha? a clean tree?) is the
  * orchestrator's drain-duty judgement, not something to automate here. The
  * rows also keep counting toward `maxAttemptsPerIssue`, so a loop of deaths
  * still escalates instead of retrying forever.
@@ -1107,12 +1191,21 @@ export function armConductor(): void {
  * them is {@link settlePushedGreen}, on the tick, by asking the tracker what
  * became of the PR — the one question a restart cannot answer by inference.
  */
-export function reconcileOrphanedRuns(store: Store, project: string): RunRecord[] {
+export async function reconcileOrphanedRuns(
+  store: Store,
+  project: string,
+): Promise<RunRecord[]> {
   // Live runs only: `pushed-green` holds no process, so it cannot be orphaned by
   // a process dying — it is finished work waiting on a human merge.
   const stale = store.liveRuns(project);
   const endedAt = Date.now();
   for (const r of stale) {
+    // Salvage before the row flips: the worktree path is on the record, and
+    // salvageWip is a no-op for a missing/clean tree. Reason string matches
+    // the cap-kill wording so triage reads the same either way.
+    if (r.worktree !== "") {
+      await salvage(r.issue, r.attempt, "a daemon restart", r.worktree);
+    }
     store.updateRun(r.id, { state: "orphaned", endedAt });
   }
   return stale;
@@ -1141,7 +1234,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   // daemon must not orphan that daemon's real, live workers).
   const alive = livingDaemon();
   if (alive === undefined || alive.pid === process.pid) {
-    for (const r of reconcileOrphanedRuns(store, project.name)) {
+    for (const r of await reconcileOrphanedRuns(store, project.name)) {
       log(
         `#${r.issue} orphaned by a previous daemon (attempt ${r.attempt}, was ${r.state}, worktree ${r.worktree}) — ` +
           `slot freed; the ${project.stateLabels.inProgress} label stays until the orchestrator triages what the worker left`,
@@ -1283,5 +1376,11 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     await orchestrator?.dispose();
     store.close();
     log("stopped");
+    // A handled SIGTERM still leaves some runtimes with a non-zero default
+    // (historically 128+signal). Under systemd `Restart=on-failure` that looks
+    // like a crash and the unit comes straight back — the exact failure mode
+    // `omp-conductor stop` hit on the reference fleet. Force success so a
+    // graceful drain is not a restart.
+    process.exitCode = 0;
   }
 }

package/src/escalate.ts

@@ -45,11 +45,21 @@ export interface Escalator {
  * send, turning a cosmetic problem into a lost escalation. Plain text is also
  * valid Markdown, so the same string renders fine as an issue comment.
  */
+/**
+ * Fleet-scoped pages (integrity tripwire, spend-cap halt, stall) use issue `0`
+ * as a sentinel — there is no tracker issue. Rendering that as `#0` made
+ * Telegram pages and daemon logs look like a bug (#52). Keep the sentinel in
+ * the typed field; only the human-facing label changes here.
+ */
+export function escalationIssueRef(issue: number): string {
+  return issue === 0 ? "fleet" : `#${issue}`;
+}
+
 export function formatEscalation(e: Escalation, project: string): string {
   const lines = [
     `omp-conductor · tier ${e.tier} escalation`,
     `project: ${project}`,
-    `issue: #${e.issue}`,
+    `issue: ${escalationIssueRef(e.issue)}`,
     `summary: ${e.summary}`,
   ];
   if (e.detail) lines.push(`detail: ${e.detail}`);
@@ -99,18 +109,21 @@ export function createEscalator(
           const onTurnFailed = async (cause: unknown): Promise<void> => {
             if (!p.escalation.fallbackToIssueComment) {
               warn(
-                `tier 1 escalation on issue #${e.issue} was accepted by the orchestrator but its ` +
+                `tier 1 escalation on ${escalationIssueRef(e.issue)} was accepted by the orchestrator but its ` +
                   `turn failed (${errText(cause)}), and no fallback is configured — left unmarked ` +
                   `so the next tick retries`,
               );
               return;
             }
             try {
+              if (e.issue === 0) {
+                throw new Error("fleet-scoped escalation has no issue to comment on");
+              }
               await tracker.comment(e.issue, text);
               store.markNotified(key);
             } catch (err) {
               warn(
-                `tier 1 escalation on issue #${e.issue} failed after acceptance ` +
+                `tier 1 escalation on ${escalationIssueRef(e.issue)} failed after acceptance ` +
                   `(${errText(cause)}) and its issue-comment fallback failed too ` +
                   `(${errText(err)}) — left unmarked so the next tick retries`,
               );
@@ -154,10 +167,19 @@ export function createEscalator(
       if (!p.escalation.fallbackToIssueComment) {
         throw new Error(
           `no escalation transport configured for project "${p.name}": tier ${e.tier} ` +
-            `escalation on issue #${e.issue} (${e.summary}) could not be delivered — ` +
+            `escalation on ${escalationIssueRef(e.issue)} (${e.summary}) could not be delivered — ` +
             `set escalation.telegramChatId or escalation.fallbackToIssueComment`,
         );
       }
+      // Fleet pages (issue 0) have nowhere to comment. Falling through here used
+      // to call `issues/0/comments` and surface as a confusing "#0" delivery
+      // failure after Telegram had already been tried (#52).
+      if (e.issue === 0) {
+        throw new Error(
+          `fleet-scoped tier ${e.tier} escalation (${e.summary}) has no issue to comment on — ` +
+            `configure escalation.telegramChatId so integrity/spend/stall pages can reach an operator`,
+        );
+      }
       await tracker.comment(e.issue, text);
       store.markNotified(key);
     },

package/src/lifecycle.ts

@@ -10,16 +10,30 @@
  * operator real time are `start` refusing against a ghost and `status`
  * reporting a daemon that died hours ago.
  *
+ * When the live pid is the MainPID of the `omp-conductor.service` unit,
+ * `stop`/`restart` go through `systemctl` rather than a raw `SIGTERM`. A
+ * raw signal against a unit with `Restart=on-failure` is read as a crash and
+ * the unit comes straight back — the bug that made `omp-conductor stop` look
+ * like a no-op on a systemd-managed host.
+ *
  * Deliberately free of every other module in this package: nothing here opens
  * the store, loads the config or talks to `gh`, so `stop` and `status` keep
  * working when the config is the very thing that is broken.
  */
 
-import { spawn } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import { chmodSync, closeSync, mkdirSync, openSync, readFileSync, readSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
+/**
+ * The systemd unit name operators are expected to install for a supervised
+ * daemon. Hardcoded rather than configured: one name on the host is the
+ * whole point of a unit, and a wrong name would silently fall back to the
+ * SIGTERM path and reintroduce the restart loop this module exists to avoid.
+ */
+export const SYSTEMD_UNIT = "omp-conductor.service";
+
 /**
  * Mirrors `DEFAULT_PORT` in ./daemon.ts. Duplicated rather than imported so
  * this module stays free of the dispatcher's dependency tree; exported so the
@@ -271,23 +285,67 @@ export async function startDaemon(o: { port?: number; project?: string } = {}):
 }
 
 /**
- * Stops the daemon: `SIGTERM`, wait, then `SIGKILL`.
+ * How the last stop actually landed. Callers print this so an operator can
+ * tell a supervised stop from a bare SIGTERM without reading the journal.
+ */
+export type StopResult =
+  | { kind: "stopped"; pid: number; via: "systemctl" | "signal" }
+  | { kind: "not-running" };
+
+/**
+ * Stops the daemon.
  *
- * `SIGTERM` asks the loop to finish the tick it is on, and a tick that has a
- * worker in flight can run for the worker's whole wall clock. The grace period
- * is therefore a deadline, not a promise of a clean drain.
- * // ponytail: no way to say "stop when the current worker lands". If that
- * // matters, take a `--timeout` on the CLI verb, or poll `activeRuns` before
- * // escalating.
+ * Prefer `systemctl stop omp-conductor.service` when that unit's MainPID is
+ * the live daemon: systemd then owns the stop and will not schedule a restart
+ * for the exit it just requested. A raw `SIGTERM` against a unit with
+ * `Restart=on-failure` is what made `omp-conductor stop` look like a no-op on
+ * the reference fleet — exit 143 was a "failure", and the unit came back five
+ * seconds later.
+ *
+ * Falls back to `SIGTERM` then `SIGKILL` when there is no unit, the unit is
+ * not running, or its MainPID is somebody else (a hand-started daemon next to
+ * a stopped unit). The grace period is a deadline, not a clean drain: a tick
+ * with a worker in flight can run for that worker's whole wall clock.
  */
-export async function stopDaemon(o: { timeoutMs?: number } = {}): Promise<"stopped" | "not-running"> {
+export async function stopDaemon(o: { timeoutMs?: number } = {}): Promise<StopResult> {
   const rec = livingDaemon();
   if (rec === undefined) {
     // `livingDaemon` already cleared a stale file; this covers the unparseable
-    // one it refused to read.
+    // one it refused to read. Still ask systemd: a unit can be running with
+    // no pidfile (boot race, wiped runtime dir) and stop must still land.
+    const unitPid = systemdMainPid();
+    if (unitPid !== undefined && (await stopViaSystemd(undefined))) {
+      const deadline = Date.now() + (o.timeoutMs ?? STOP_TIMEOUT_MS);
+      while (isAlive(unitPid) && Date.now() < deadline) await sleep(100);
+      if (isAlive(unitPid)) {
+        throw new Error(
+          `daemon pid ${unitPid} still alive after systemctl stop ${SYSTEMD_UNIT} — ` +
+            `check \`systemctl status ${SYSTEMD_UNIT}\``,
+        );
+      }
+      clearRecord();
+      return { kind: "stopped", pid: unitPid, via: "systemctl" };
+    }
     clearRecord();
-    return "not-running";
+    return { kind: "not-running" };
   }
+
+  if (await stopViaSystemd(rec.pid)) {
+    // Wait out the unit: systemctl stop is synchronous for Type=simple, but
+    // a slow drain still holds the old pid briefly and the next start would
+    // refuse against it.
+    const deadline = Date.now() + (o.timeoutMs ?? STOP_TIMEOUT_MS);
+    while (isAlive(rec.pid) && Date.now() < deadline) await sleep(100);
+    if (isAlive(rec.pid)) {
+      throw new Error(
+        `daemon pid ${rec.pid} still alive after systemctl stop ${SYSTEMD_UNIT} — ` +
+          `check \`systemctl status ${SYSTEMD_UNIT}\``,
+      );
+    }
+    clearRecord();
+    return { kind: "stopped", pid: rec.pid, via: "systemctl" };
+  }
+
   const gone = await terminate(rec.pid, o.timeoutMs ?? STOP_TIMEOUT_MS);
   if (!gone) {
     // The record stays: something is still holding that pid, and forgetting
@@ -295,13 +353,146 @@ export async function stopDaemon(o: { timeoutMs?: number } = {}): Promise<"stopp
     throw new Error(`daemon pid ${rec.pid} survived SIGTERM and SIGKILL — it may belong to another user`);
   }
   clearRecord();
-  return "stopped";
+  return { kind: "stopped", pid: rec.pid, via: "signal" };
+}
+
+/**
+ * Restarts the daemon.
+ *
+ * Same ownership rule as {@link stopDaemon}: when the unit owns the live pid,
+ * `systemctl restart` keeps systemd in charge of the replacement process so
+ * the new MainPID is still the unit's. Falling back to stop+start for a
+ * hand-started daemon would leave the unit dead and the new process
+ * unsupervised — fine for a laptop, wrong for the host that installed a unit
+ * specifically so a crash comes back.
+ *
+ * Returns the record of the process that is now answering `/healthz`.
+ */
+export async function restartDaemon(
+  o: { port?: number; project?: string; timeoutMs?: number } = {},
+): Promise<{ previous: DaemonRecord | undefined; record: DaemonRecord; via: "systemctl" | "cli" }> {
+  const previous = livingDaemon();
+  const unitPid = systemdMainPid();
+  const unitOwns =
+    unitPid !== undefined && (previous === undefined || previous.pid === unitPid);
+
+  if (unitOwns) {
+    const ran = systemctl(["restart", SYSTEMD_UNIT]);
+    if (ran.ok) {
+      // systemctl restart returns once the new MainPID is up; the pidfile is
+      // written by the daemon itself on boot, so wait for that rather than
+      // inventing a record from the unit alone.
+      const deadline = Date.now() + READY_TIMEOUT_MS;
+      for (;;) {
+        const rec = livingDaemon();
+        if (rec !== undefined) {
+          const health = await healthCheck(rec.port);
+          if (health.ok) return { previous, record: rec, via: "systemctl" };
+        }
+        if (Date.now() >= deadline) break;
+        await sleep(READY_POLL_MS);
+      }
+      throw new Error(
+        `systemctl restart ${SYSTEMD_UNIT} returned, but the daemon never answered /healthz`,
+      );
+    }
+    // Unit exists and owns the pid but systemctl refused (permissions, dbus
+    // down). Fall through to the signal path rather than stranding the
+    // operator with "restart failed" and a still-running daemon they cannot
+    // reach through the unit.
+  }
+
+  await stopDaemon({ timeoutMs: o.timeoutMs });
+  const record = await startDaemon({ port: o.port ?? previous?.port, project: o.project ?? previous?.project });
+  return { previous, record, via: "cli" };
+}
+
+/**
+ * The MainPID of {@link SYSTEMD_UNIT}, or `undefined` when systemd is absent,
+ * the unit is unknown, or it is not running. Never throws: a missing binary
+ * or a dbus blip is "no unit", and stop falls back to SIGTERM.
+ */
+export function systemdMainPid(unit = SYSTEMD_UNIT): number | undefined {
+  const ran = systemctl(["show", unit, "--property=MainPID", "--property=ActiveState", "--value"]);
+  if (!ran.ok) return undefined;
+  // `systemctl show --value` prints one property per line, MainPID then
+  // ActiveState, in the order requested. Tolerate either order and blank
+  // lines so a future systemctl rearrange does not silently disable the path.
+  const lines = ran.stdout
+    .split("\n")
+    .map((l) => l.trim())
+    .filter((l) => l.length > 0);
+  let pid: number | undefined;
+  let active: string | undefined;
+  for (const line of lines) {
+    if (/^\d+$/.test(line)) {
+      const n = Number(line);
+      if (Number.isInteger(n) && n > 1) pid = n;
+    } else {
+      active = line;
+    }
+  }
+  if (active !== undefined && active !== "active" && active !== "reactivating") return undefined;
+  return pid;
 }
 
 // ---------------------------------------------------------------------------
 // internals
 // ---------------------------------------------------------------------------
 
+/**
+ * Ask systemd to stop the unit, but only when it actually owns `pid`.
+ *
+ * `pid === undefined` means "no pidfile" — still stop the unit if it is
+ * active, because that is the only process that could be the daemon. A unit
+ * whose MainPID is some other process is left alone: stopping it would take
+ * down a neighbour, and the signal path handles *our* pid.
+ */
+async function stopViaSystemd(pid: number | undefined): Promise<boolean> {
+  const main = systemdMainPid();
+  if (main === undefined) return false;
+  if (pid !== undefined && main !== pid) return false;
+  const ran = systemctl(["stop", SYSTEMD_UNIT]);
+  return ran.ok;
+}
+
+/**
+ * Run one `systemctl` invocation. Captures output and never throws: absence
+ * of the binary, a missing unit, or a permission error are all "not ok", and
+ * the caller decides whether to fall back.
+ *
+ * The default shells out. Tests replace it with {@link setSystemctlForTest}
+ * so the ownership decision is exercised without a real systemd.
+ */
+export type SystemctlFn = (args: string[]) => { ok: boolean; stdout: string; stderr: string };
+
+function defaultSystemctl(args: string[]): { ok: boolean; stdout: string; stderr: string } {
+  try {
+    const res = spawnSync("systemctl", args, {
+      encoding: "utf8",
+      // A hung dbus is not worth blocking stop on; the signal path is right there.
+      timeout: 15_000,
+      env: process.env,
+    });
+    if (res.error) return { ok: false, stdout: "", stderr: res.error.message };
+    return {
+      ok: res.status === 0,
+      stdout: res.stdout ?? "",
+      stderr: res.stderr ?? "",
+    };
+  } catch (err) {
+    return { ok: false, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
+  }
+}
+
+let systemctl: SystemctlFn = defaultSystemctl;
+
+/** Test-only: replace the `systemctl` runner. Pass `undefined` to restore. */
+export function setSystemctlForTest(fn: SystemctlFn | undefined): void {
+  systemctl = fn ?? defaultSystemctl;
+}
+
+
 function sleep(ms: number): Promise<void> {
   return new Promise<void>((resolve) => {
     const t = setTimeout(resolve, ms);

package/src/omp.ts

@@ -162,6 +162,11 @@ export async function createSession(opts: {
     // sharing it fails to start. The daemon runs `maxConcurrentWorkers`
     // (2 by default) workers at once, which makes this the normal path.
     agentRegistry: new mod.AgentRegistry(),
+    // Default true in the SDK, but pass it explicitly so a harness change
+    // cannot silently strip MCP from workers. Discovery walks cwd + user
+    // agentDir (~/.omp/agent/mcp.json) — without this, workers grep-only and
+    // burn the turns cap on discovery (#29).
+    enableMCP: true,
   });
   const raw = asRawSession(created);
   // Surfaced rather than swallowed: this is how a quiet downgrade to a weaker