P2: PR refresher can't see archived worker PRs (34 of 35 stuck OPEN); merged-worktree cleanup ignores running threads #1431

Found in the T3 Orchestrator V2 deep dive (report: reports/T3 Code orchestrator deep dive.md on branch coder/i-want-you-to-research-t3-codes-orchestr-fae77a). T3 V2 now polls watched PRs on the server and wakes the agent on failed checks, review comments and conflicts (t3code #15057). Solenta already has most of this. The gap is that its poller never looks at the threads that matter most.

Bugs

• P1: archived threads are skipped (verified). isPrRefreshCandidate starts with if (t.archived) return false; (electron/worktrees.js:4319), and a test pins it (electron/test/pr-refresh.test.js:384). sweepCrew archives finished workers (runner.js:1784-1820). So of the 35 worker PRs in the live store, 34 are archived and still OPEN, one is archived and merged, and three still hold a worktree. Not checked against GitHub: they may really be merged.
• P2: cleanup can delete a running worker's checkout. maybeCleanupMergedWorktree (worktrees.js:5539-5595) checks for a dirty tree but never checks whether the thread is running. A worker fixing review comments with a clean tree when its PR merges loses its working directory mid-run.

What already exists

• refreshPrStates / createPrStateRefresher: a serialized 5-minute pass (worktrees.js:4350-4547, wired in main.js:779-790).
• Host-side gh running under the user's own auth.
• Check bucketing, worktree reclaim on merge, and a post-merge re-verify hook.
• Settle-on-merge, computed in the renderer (src/threadSettle.ts:33-39).

Design (~150–220 lines + ~150 test lines)

1. Arm the watch. After createPr resolves in thread_pr (orchServer.js:678-686), write a main-process-only field on the worker: prWatch: {armedAt, notify: <lead id>, last: {state, mergeable, review, failing[]} | null}.
2. Poll armed threads even when archived. Change the candidate check to if (t.archived && !t.prWatch) return false;. Give the existing archived/OPEN rows one state refresh with no notices, so they reach a terminal state and drop out.
3. Fetch. For armed threads only, one gh pr view --json number,url,state,mergeable,reviewDecision,statusCheckRollup. Fall back through the existing isUnknownJsonField.
4. Notify on entering a bad or final state. Compare against prWatch.last, which is what the lead was last told. Send at most one line per thread per pass, only when entering merged / closed / CONFLICTING / CHANGES_REQUESTED, or when the failing-check set changes. The first observation is silent unless it's already bad.
5. Deliver through the runner. Add an injected opts.notify that main.js wires to runner.deliverNotice (runner.js:1282-1294). It skips when the lead is missing, trashed or archived. Line: [pr] Worker <id> ("title") PR #N <signal>. <url>. Send the worker the fix with thread_send; merging stays with the user. Persist last in the same save, so a crash can miss a wake but never duplicate one.
6. Guard cleanup (P2). Inject isRunning(threadId) and skip cleanup while the thread is running.

Deliberately left out: reading comments, a 1-minute cadence, agent-performed merges, and watching plain UI PRs (add a per-thread toggle if someone wants that).

Check before shipping: T3 #15388 had wake turns keeping merged threads from settling. Confirm which message timestamp effectiveSettled measures from, so [pr] notice turns can't block settling.

Tests (extend pr-refresh.test.js, which already injects ghTryAsyncFn)

• An armed archived worker is polled with the rich fields.
• A pass-to-fail transition notifies once, then stays quiet.
• CHANGES_REQUESTED and CONFLICTING notify.
• A merge notifies and cleans up, but not while the thread is running.
• Unarmed threads, and threads whose lead is archived, never notify.
• The unknown-field fallback still works.

There's a soft dependency on #1426: until notices are durable, a crash can lose a PR wake. The next pass after boot detects the transition again.