gh-glance 0.11.2 → 0.13.0

package/index.mjs

@@ -23,6 +23,7 @@
 process.env.NODE_ENV ??= "production";
 
 import { execFile, spawn } from "node:child_process";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import {
   chmodSync,
@@ -43,6 +44,7 @@ import { fileURLToPath } from "node:url";
 import { promisify } from "node:util";
 
 const execFileAsync = promisify(execFile);
+const requestIdentityStorage = new AsyncLocalStorage();
 
 // Running as the CLI vs. being imported by a test. Everything with a side
 // effect -- argv handling, the TTY guard, the preflight, entering the alternate
@@ -616,6 +618,7 @@ function registerLiveAbort(controller) {
   liveAbort = controller;
 }
 function abortLiveRequests() {
+  runtimeIdentityCoordinator?.close();
   liveAbort?.abort();
   liveAbort = null;
 }
@@ -627,24 +630,133 @@ function forwardSignalToChild(child, signal) {
   return child.kill(signal);
 }
 
-async function runGh(args, { signal, operation } = {}) {
+function inspectAdmittedHttpStart(scope, operation, now = Date.now) {
+  const costs = operationCost(operation);
+  if (!costs) return { ok: false, reason: "undeclared" };
+  if (RATE_RESOURCES.every((resource) => costs[resource] === 0)) return { ok: true };
+  const readNow = typeof now === "function" ? now : () => now;
+  const snapshot = inspectGovernor(scope, readNow());
+  if (!snapshot.ok || snapshot.missing) return snapshot.ok ? { ok: false, reason: "corrupt" } : snapshot;
+  const checkedAt = readNow();
+  for (const resource of RATE_RESOURCES) {
+    if (costs[resource] <= 0) continue;
+    const budget = snapshot.value.budgets[resource];
+    if (!budget) return { ok: false, reason: "budget-unknown", resource };
+    if (budget.blockUntil > checkedAt) return { ok: false, reason: "blocked", resource, retryAt: budget.blockUntil };
+    if (budget.resetMs <= checkedAt) return { ok: false, reason: "budget-reset", resource, retryAt: budget.resetMs + BUDGET_RESET_GRACE_MS };
+  }
+  return { ok: true };
+}
+
+// Re-checked either side of every wait a request can sit in, because admission,
+// the transport permit and the subprocess boundary are each far enough apart
+// that the account can change in between. One definition so the three checks
+// cannot drift, and so a request costs one identity snapshot instead of three.
+function assertBoundCredential(bound) {
+  if (bound?.accessKey && bound.accessKey !== runtimeIdentityCoordinator?.current()?.accessKey) {
+    throw new Error("Credential changed before request start");
+  }
+}
+
+// GraphQL documents are supplied on stdin rather than as an argument, so a
+// query never lands in argv where `ps` or an error string could carry it, and
+// so its size is bounded by a pipe rather than by the platform argument limit.
+// promisify(execFile) exposes the child, which is what lets stdin be written
+// without giving up the timeout, kill signal, maxBuffer, abort and redaction
+// contracts every other call depends on.
+// The control plane cannot be gated on the capacity it exists to establish.
+// Both observers are exempt from the data-admission recheck for that reason:
+// a resource whose budget is unknown would otherwise refuse the one request
+// that could learn it, and the tab would wait for a number nothing can fetch.
+// They remain bounded elsewhere -- by the rolling attempt allowance, the shared
+// transport permit and the secondary cooldown -- so this is an exemption from
+// data admission, not from accounting.
+const CONTROL_OPERATIONS = ["budget-core-observer", "graphql-observer"];
+
+// An operation whose actual cost exceeded its declared bound is paused until its
+// resource resets. Continuing to spend against a bound already known to be wrong
+// is how a reserve gets crossed with every individual request looking admissible.
+// Process-local on purpose: the bound is a property of this build's query text,
+// so a differently-built pane's bound is not this one's to suspend.
+const pausedOperations = new Map();
+
+function pauseOperation(operation, untilMs) {
+  if (!Number.isFinite(untilMs)) return;
+  pausedOperations.set(operation, Math.max(pausedOperations.get(operation) ?? 0, untilMs));
+}
+
+function operationPausedUntil(operation, now = Date.now()) {
+  const until = pausedOperations.get(operation);
+  if (until === undefined) return null;
+  if (until <= now) { pausedOperations.delete(operation); return null; }
+  return until;
+}
+
+async function runGh(args, { signal, operation, input = null } = {}) {
   if (operationCost(operation) === null) {
     throw new Error(`undeclared gh operation: ${operation ?? "missing"}`);
   }
+  const bound = requestIdentityStorage.getStore();
+  assertBoundCredential(bound);
+  const local = ["version", "local-git"].includes(operation);
+  let control = null;
+  const permit = runtimeIdentityCoordinator && !local
+    ? await acquireIdentityHttpPermit(runtimeIdentityCoordinator, { signal }) : null;
   const startedAt = Date.now();
+  let requestError = null;
+  let requestStdout = null;
   try {
-    const { stdout } = await execFileAsync("gh", args, {
+    assertBoundCredential(bound);
+    if (runtimeIdentityCoordinator && operation === "budget-core-observer") {
+      control = startIdentityControl(runtimeIdentityCoordinator);
+      if (!control.ok) throw new Error(identityCoordinationMessage(control.reason));
+    }
+    // Admission can precede this per-call transport slot by many seconds.
+    // A sibling request may publish a shared hold while this call is queued.
+    // Keep the started envelope charged, but recheck resource validity at the
+    // actual subprocess boundary without reserving the same work again.
+    const pausedUntil = operationPausedUntil(operation);
+    if (pausedUntil !== null) {
+      throw new Error(`Operation paused after an unbounded cost (retry after ${new Date(pausedUntil).toISOString()})`);
+    }
+    if (bound && !local && !CONTROL_OPERATIONS.includes(operation)) {
+      const ready = inspectAdmittedHttpStart(bound, operation);
+      if (!ready.ok) throw new Error(`API budget paused (${ready.reason})`);
+    }
+    assertBoundCredential(bound);
+    const pending = execFileAsync("gh", args, {
       timeout: GH_TIMEOUT_MS,
       killSignal: "SIGKILL",
       maxBuffer: GH_MAX_BUFFER,
       env: { ...process.env, ...GH_ENV_OVERRIDES },
       signal,
     });
+    if (typeof input === "string") {
+      // A child killed by the timeout or the abort signal closes stdin under
+      // us; that EPIPE is the kill's consequence, not the failure worth
+      // reporting, so let the awaited result below carry the real error.
+      pending.child.stdin?.on("error", () => {});
+      pending.child.stdin?.end(input);
+    }
+    const { stdout } = await pending;
+    requestStdout = stdout;
     logGh(args, startedAt, `ok ${stdout.length}B`);
     return stdout;
   } catch (err) {
+    requestError = err;
     logGh(args, startedAt, `FAILED ${shortErr(err)}`);
     throw err;
+  } finally {
+    if (permit) {
+      const release = () => releaseIdentityHttpPermit(runtimeIdentityCoordinator, permit, requestError);
+      const released = await retryIdentityCompletion(release, { timeoutMs: IDENTITY_RELEASE_WAIT_MS, shouldRetry: () => !runtimeIdentityCoordinator.isClosed() });
+      if (!released.ok) runtimeIdentityCoordinator.deferCompletion(`permit:${permit.nonce}`, release);
+    }
+    if (control?.ok) {
+      const settle = () => settleIdentityControl(runtimeIdentityCoordinator, control.value, requestStdout ?? requestError?.stdout);
+      const settled = await retryIdentityCompletion(settle, { timeoutMs: IDENTITY_RELEASE_WAIT_MS, shouldRetry: () => !runtimeIdentityCoordinator.isClosed() });
+      if (!settled.ok) runtimeIdentityCoordinator.deferCompletion(`control:${control.value.id}`, settle);
+    }
   }
 }
 
@@ -734,14 +846,141 @@ async function ghApi(args, { operation, signal, etag = null, run = runGh } = {})
   }
 }
 
-// The target as `gh` spells it: host-qualified when a host was given, the bare
-// slug otherwise -- which is exactly the [HOST/]OWNER/REPO form `gh --repo`
-// documents.
-function qualifiedRepo() {
-  const host = runtime.repoExplicit ? effectiveRuntimeHost() : runtime.host;
-  return host ? `${host}/${runtime.repo}` : runtime.repo;
+// ---------- Explicit GraphQL ----------
+
+// The version travels in the query key, so a changed document invalidates its
+// cursors instead of paging a new shape with an old cursor.
+const GRAPHQL_QUERY_VERSION = 1;
+// GitHub prices a connection by the pages it could return, and the row's single
+// label is a nested connection of its own. Two points is the conservative bound
+// for one page; the observer selects nothing but the meter and costs one.
+const GRAPHQL_PAGE_POINTS = 2;
+const GRAPHQL_OBSERVER_POINTS = 1;
+// 50 rows per page and no more than three pages preserves the existing
+// LIST_LIMIT of 150 while making every page a separately admitted request.
+const GRAPHQL_PAGE_SIZE = 50;
+// Two hours: comfortably past any real primary window, and short enough that a
+// nonsense timestamp cannot park the budget in a reset that never arrives.
+const GRAPHQL_MAX_RESET_MS = 2 * 60 * 60 * 1000;
+
+// Issues and pull requests are deliberately two documents, not one with two
+// connections: a combined query cannot publish either tab until both halves
+// are complete, which is exactly the completion barrier this phase removes.
+// Both select only what a row renders, which is also what keeps the cost at
+// its declared bound.
+const ISSUE_PAGE_QUERY = `query($owner:String!,$name:String!,$first:Int!,$after:String){
+  repository(owner:$owner,name:$name){
+    id
+    name
+    nameWithOwner
+    url
+    issues(first:$first,after:$after,states:OPEN,orderBy:{field:UPDATED_AT,direction:DESC}){
+      totalCount
+      pageInfo{hasNextPage endCursor}
+      nodes{id number title url updatedAt author{login} labels(first:1){nodes{name}}}
+    }
+  }
+  rateLimit{cost limit used remaining resetAt}
+}`;
+
+const PULL_PAGE_QUERY = `query($owner:String!,$name:String!,$first:Int!,$after:String){
+  repository(owner:$owner,name:$name){
+    id
+    name
+    nameWithOwner
+    url
+    pullRequests(first:$first,after:$after,states:OPEN,orderBy:{field:UPDATED_AT,direction:DESC}){
+      totalCount
+      pageInfo{hasNextPage endCursor}
+      nodes{id number title url updatedAt author{login} headRefName isDraft reviewDecision}
+    }
+  }
+  rateLimit{cost limit used remaining resetAt}
+}`;
+
+// Selects the meter and nothing else. This is the only claimed GraphQL
+// observer; a data page's counters constrain the same epoch but never open a
+// new one.
+const GRAPHQL_OBSERVER_QUERY = `query{rateLimit{cost limit used remaining resetAt}}`;
+
+// Replaces `gh repo view --json`, whose GraphQL cost was real but undeclared.
+const REPOSITORY_QUERY = `query($owner:String!,$name:String!){
+  repository(owner:$owner,name:$name){
+    id
+    nameWithOwner
+    url
+    viewerPermission
+  }
+  rateLimit{cost limit used remaining resetAt}
+}`;
+
+const GRAPHQL_QUERIES = Object.freeze({
+  repository: { query: REPOSITORY_QUERY, connection: null, points: GRAPHQL_OBSERVER_POINTS },
+  issues: { query: ISSUE_PAGE_QUERY, connection: "issues", points: GRAPHQL_PAGE_POINTS },
+  prs: { query: PULL_PAGE_QUERY, connection: "pullRequests", points: GRAPHQL_PAGE_POINTS },
+  observer: { query: GRAPHQL_OBSERVER_QUERY, connection: null, points: GRAPHQL_OBSERVER_POINTS },
+});
+
+// `--input -` keeps the document and its variables on stdin as one typed JSON
+// object, so variables stay typed rather than becoming the strings that
+// `-f`/`-F` would produce, and nothing reaches argv.
+function graphqlArgs(host = effectiveRuntimeHost()) {
+  return ["api", "-i", "graphql", "--input", "-", ...apiHostArgs(host)];
 }
 
+function graphqlInput(kind, variables) {
+  const declared = pick(GRAPHQL_QUERIES, kind, null);
+  if (!declared) throw new Error(`undeclared graphql query: ${kind}`);
+  if (variables === null) throw new Error(UNRESOLVED_REPOSITORY);
+  return JSON.stringify({ query: declared.query, variables });
+}
+
+// `gh` resolves an omitted repository from the working directory. GraphQL has
+// no such inference, so the slug must be resolved here or the document cannot
+// be built at all -- and running without `--repo` is the documented default.
+//
+// Refusing is deliberate. A half-filled variable set is worse than no request:
+// GitHub answers a missing `String!` with HTTP 200 and an errors array, which
+// is indistinguishable from a denied query, so the tab would report a
+// permission problem for what is really an unresolved target.
+function graphqlRepositoryVariables(repository = effectiveRuntimeRepository()) {
+  if (!repository) return null;
+  const [owner, name] = repository.split("/");
+  return { owner, name };
+}
+
+function graphqlPageVariables(after = null, repository = effectiveRuntimeRepository()) {
+  const target = graphqlRepositoryVariables(repository);
+  return target && { ...target, first: GRAPHQL_PAGE_SIZE, after };
+}
+
+// GitHub answers a rejected query with HTTP 200 and an `errors` array, and can
+// answer a partly-resolvable one with both `data` and `errors`. Headers and
+// envelope are therefore read separately: budget evidence stays usable even
+// when the data is not, which is the only way a failed page can still be paid
+// for honestly.
+function parseGraphqlEnvelope(body) {
+  let envelope;
+  try { envelope = JSON.parse(body); } catch { return { ok: false, reason: "unparseable", errors: [], data: null, rateLimit: null }; }
+  if (!isRecord(envelope)) return { ok: false, reason: "unparseable", errors: [], data: null, rateLimit: null };
+  const errors = Array.isArray(envelope.errors) ? envelope.errors : [];
+  const data = isRecord(envelope.data) ? envelope.data : null;
+  const meter = isRecord(data?.rateLimit) ? data.rateLimit : null;
+  const number = (value) => (Number.isSafeInteger(value) && value >= 0 ? value : null);
+  // A primary window is an hour; anything beyond a generous ceiling is not a
+  // reset this app can wait for, and accepting it would pin an epoch that
+  // `budget.resetMs <= now` never clears.
+  const parsedReset = typeof meter?.resetAt === "string" ? Date.parse(meter.resetAt) : Number.NaN;
+  const resetMs = Number.isFinite(parsedReset) && parsedReset <= Date.now() + GRAPHQL_MAX_RESET_MS
+    ? parsedReset
+    : Number.NaN;
+  const rateLimit = meter && [number(meter.limit), number(meter.used), number(meter.remaining)].every((value) => value !== null) && Number.isFinite(resetMs)
+    ? { resource: "graphql", limit: meter.limit, used: meter.used, remaining: meter.remaining, resetMs, cost: number(meter.cost) }
+    : null;
+  return { ok: errors.length === 0 && data !== null, reason: errors.length > 0 ? "graphql-errors" : data === null ? "no-data" : null, errors, data, rateLimit };
+}
+
+
 function normalizeHost(value) {
   if (typeof value !== "string") return null;
   const host = value.trim().toLowerCase();
@@ -787,6 +1026,51 @@ function resolveEffectiveHost({
   return hosts.size === 1 ? [...hosts][0] : null;
 }
 
+const UNRESOLVED_REPOSITORY = "Repository could not be resolved; pass --repo owner/name";
+
+// The owner/name half of the same question resolveEffectiveHost answers for the
+// host, and in the same precedence: an explicit --repo, then GH_REPO, then an
+// unambiguous git remote. Ambiguity resolves to null rather than to a guess.
+function remoteSlug(value) {
+  if (typeof value !== "string" || value.length === 0) return null;
+  let path;
+  if (value.includes("://")) {
+    try { path = new URL(value).pathname; } catch { return null; }
+  } else {
+    path = /^(?:[^@\s]+@)?[^:/\s]+:([^\s]+)$/.exec(value)?.[1] ?? null;
+  }
+  if (path === null) return null;
+  // Trimmed by index rather than with /\/+$/. An end-anchored quantifier is
+  // retried from every position, so a remote URL carrying a long run of slashes
+  // costs quadratic time to reject (CodeQL js/polynomial-redos, high). Remote
+  // URLs are library input: `git remote -v` reports whatever is configured.
+  let start = 0;
+  let end = path.length;
+  while (start < end && path[start] === "/") start += 1;
+  while (end > start && path[end - 1] === "/") end -= 1;
+  const trimmed = path.slice(start, end);
+  const slug = trimmed.endsWith(".git") ? trimmed.slice(0, -4) : trimmed;
+  return REPO_PATTERN.test(slug) ? slug : null;
+}
+
+function resolveEffectiveRepository({ runtimeRepo = null, ghRepo = null, remoteUrls = [] } = {}) {
+  if (runtimeRepo) return runtimeRepo;
+  if (ghRepo) {
+    try { return parseRepoTarget(ghRepo).slug; } catch { return null; }
+  }
+  const slugs = new Set(remoteUrls.map(remoteSlug).filter(Boolean));
+  return slugs.size === 1 ? [...slugs][0] : null;
+}
+
+function effectiveRuntimeRepository(options = {}) {
+  return resolveEffectiveRepository({
+    runtimeRepo: runtime.repo,
+    ghRepo: process.env.GH_REPO,
+    remoteUrls: runtimeRemoteUrls,
+    ...options,
+  });
+}
+
 function effectiveRuntimeHost(options = {}) {
   return resolveEffectiveHost({
     runtimeHost: runtime.host,
@@ -799,11 +1083,6 @@ function effectiveRuntimeHost(options = {}) {
   });
 }
 
-// `--repo` for the list subcommands. Empty when unset, so the argv vector stays
-// byte-identical to what shipped before.
-function repoArgs() {
-  return runtime.repo ? ["--repo", qualifiedRepo()] : [];
-}
 
 // `gh api` has no --repo, so a host-qualified target has nowhere to put its
 // host: GH_REPO=host/owner/repo supplies the owner and repo and *ignores* the
@@ -831,32 +1110,12 @@ function apiPath(path) {
 // inline, because `--doctor` reports these vectors and a second copy of them
 // would be a report that drifts away from what the dashboard actually sends --
 // which is the failure mode the whole diagnostics command exists to rule out.
-function repoContextArgs() {
-  const target = runtime.repo ? qualifiedRepo() : null;
-  return [
-    "repo",
-    "view",
-    ...(target ? [target] : []),
-    "--json",
-    "nameWithOwner,url,viewerPermission",
-  ];
-}
-
-function authContextArgs() {
-  return [
-    "auth",
-    "status",
-    "--active",
-    "--json",
-    "hosts",
-    "--jq",
-    ".hosts | to_entries | map(.key as $host | .value[] | select(.active == true) | {host: $host, login: .login})",
-  ];
-}
-
+// Parses the explicit repository query's envelope. The shape the rest of the
+// failure context consumes is unchanged; only how it was obtained is.
 function parseRepoContext(raw) {
   try {
-    const value = JSON.parse(raw);
+    const envelope = JSON.parse(raw);
+    const value = isRecord(envelope?.data?.repository) ? envelope.data.repository : envelope;
     if (
       value == null ||
       Array.isArray(value) ||
@@ -927,15 +1186,17 @@ async function resolveFailureContext(signal, governor = null, { run = runGh } =
         ...governor,
         operation: "failure-context:repository",
         signal,
-        run: (admittedSignal) => run(repoContextArgs(), {
+        run: (admittedSignal) => run(graphqlArgs(), {
           signal: admittedSignal,
           operation: "failure-context:repository",
-        }),
+          input: graphqlInput("repository", graphqlRepositoryVariables()),
+        }).then((stdout) => parseGhApiResponse(stdout).body),
       }).then((result) => result.ok ? result.value : Promise.reject(result.error))
     : Promise.reject(new Error("API budget unavailable"));
+  const identity = runtimeIdentityCoordinator?.current();
   const [repo, auth] = await Promise.allSettled([
     repoCall,
-    run(authContextArgs(), { signal, operation: "failure-context:auth" }),
+    identity ? Promise.resolve(JSON.stringify([{ host: identity.host, login: identity.login }])) : Promise.reject(new Error("Verified identity unavailable")),
   ]);
   return buildFailureContext(repo, auth);
 }
@@ -987,7 +1248,12 @@ function actionsRunsArgs(limit) {
     apiPath(`repos/{owner}/{repo}/actions/runs?exclude_pull_requests=true&per_page=${limit}`),
     ...apiHostArgs(),
     "--jq",
-    "[.workflow_runs[] | {databaseId: .id, displayTitle: .display_title, number: .run_number, headBranch: .head_branch, status, conclusion, startedAt: .run_started_at, updatedAt: .updated_at, workflowId: .workflow_id}]",
+    // html_url is projected because a run's page must come from the row itself.
+    // Deriving it from the repository slug only works when --repo was given;
+    // with an inferred repository the app never learns the slug, and the row is
+    // the one place the answer is always present. It costs nothing extra: the
+    // field is already in the response being parsed.
+    "[.workflow_runs[] | {databaseId: .id, displayTitle: .display_title, number: .run_number, headBranch: .head_branch, status, conclusion, startedAt: .run_started_at, updatedAt: .updated_at, workflowId: .workflow_id, url: .html_url}]",
   ];
 }
 
@@ -1015,6 +1281,7 @@ function parseActionsBodies(runsBody, workflowsBody) {
     conclusion: run.conclusion,
     startedAt: run.startedAt,
     updatedAt: run.updatedAt,
+    url: safe(run.url ?? ""),
   }));
 }
 
@@ -1140,85 +1407,188 @@ async function fetchActions(limit, signal, {
   };
 }
 
-// Both list endpoints return created-descending by default, while the row
-// renders updatedAt under a column headed AGE -- so the visible column was
-// non-monotonic (verified against cli/cli: a PR updated yesterday sat below one
-// updated three days earlier) and, worse, truncating to pane height dropped the
-// oldest-*created* rows. A PR opened six months ago and reviewed five minutes
-// ago was invisible. Sorting server-side fixes the ordering and the truncation
-// criterion together; verified that --search composes with --state open and
-// returns the same result count.
-const SORT_RECENT = ["--search", "sort:updated-desc"];
+// Ordering is part of the query now (`orderBy: UPDATED_AT DESC`) rather than a
+// `--search sort:` flag. The AGE column renders updatedAt, so a created-order
+// list made that column non-monotonic and, worse, truncating to pane height
+// dropped the oldest-*created* rows -- a PR opened six months ago and reviewed
+// five minutes ago was invisible. The old fix routed `gh issue list` through
+// GraphQL implicitly and at an unobservable cost; asking for the order directly
+// keeps the behaviour and makes the price visible.
+
+// One page of an explicit connection. Headers and envelope are settled
+// separately so a rejected query still pays honestly: GitHub answers those with
+// HTTP 200 and an `errors` array, and its counters are trustworthy even when
+// its data is not.
+async function fetchGraphqlPage(kind, { signal, after = null, run = runGh, operation, host = effectiveRuntimeHost(), variables = null } = {}) {
+  const declared = pick(GRAPHQL_QUERIES, kind, null);
+  if (!declared) throw new Error(`undeclared graphql query: ${kind}`);
+  let stdout;
+  let failure = null;
+  try {
+    stdout = await run(graphqlArgs(host), { signal, operation, input: graphqlInput(kind, variables ?? graphqlPageVariables(after)) });
+  } catch (error) {
+    failure = error;
+    // A failed call can still carry a complete response body: `gh` exits
+    // non-zero on 4xx/5xx but has already written the headers and envelope,
+    // and that is where trustworthy budget evidence lives.
+    stdout = typeof error?.stdout === "string" ? error.stdout : "";
+  }
+  const parsed = parseGhApiResponse(stdout);
+  const envelope = parseGraphqlEnvelope(parsed.body);
+  // Prefer the envelope's meter: it carries this query's actual `cost`, which
+  // the headers do not. Headers remain the fallback when the body is unusable.
+  const meter = envelope.rateLimit ?? pickRateLimit(parsed.headers);
+  // Absent evidence never refunds. An unobserved page keeps its conservative
+  // reservation rather than being treated as free.
+  const observedCost = Number.isSafeInteger(envelope.rateLimit?.cost)
+    ? envelope.rateLimit.cost
+    : declared.points;
+  const observation = meter && meter.resource === "graphql"
+    ? responseHeaderObservation(meter, observedCost)
+    : null;
+  return {
+    kind,
+    status: parsed.status,
+    ok: failure === null && parsed.status === 200 && envelope.ok,
+    reason: failure ? "transport" : parsed.status !== 200 ? "http" : envelope.reason,
+    failure,
+    data: envelope.data,
+    // Recorded in full even when it exceeds the declared bound: an overrun is
+    // evidence to reconcile, not a bookkeeping error to discard.
+    observedCost,
+    overrun: observedCost > declared.points,
+    observations: observation ? [observation] : [],
+  };
+}
 
-function issuesArgs() {
-  return [
-    "issue",
-    "list",
-    ...repoArgs(),
-    "--state",
-    "open",
-    "--limit",
-    String(LIST_LIMIT),
-    ...SORT_RECENT,
-    "--json",
-    "number,title,author,labels,createdAt,updatedAt",
-  ];
+function graphqlConnection(page, connection) {
+  const repository = isRecord(page.data?.repository) ? page.data.repository : null;
+  const value = isRecord(repository?.[connection]) ? repository[connection] : null;
+  return value && Array.isArray(value.nodes) ? value : null;
 }
 
-async function fetchIssues(signal) {
-  const raw = await runGh(issuesArgs(), { signal, operation: "tab:issues" });
+const ISSUE_ROW = (node) => ({
+  number: node.number,
+  title: safe(node.title),
+  author: safe(node.author?.login ?? ""),
+  label: safe(node.labels?.nodes?.[0]?.name ?? ""),
+  updatedAt: node.updatedAt,
+  url: safe(node.url ?? ""),
+});
+
+const PR_ROW = (node) => ({
+  number: node.number,
+  title: safe(node.title),
+  author: safe(node.author?.login ?? ""),
+  headRefName: safe(node.headRefName),
+  isDraft: node.isDraft,
+  reviewDecision: node.reviewDecision,
+  updatedAt: node.updatedAt,
+  url: safe(node.url ?? ""),
+});
+
+// Walks the connection one explicitly admitted page at a time. The first page
+// is covered by the tab's own reservation; each later page reserves its own
+// envelope, so a denial there is an ordinary scheduling outcome rather than a
+// hidden overspend. Rows already collected survive that denial and the result
+// is marked incomplete rather than being published as a complete tab.
+async function fetchGraphqlList(kind, mapRow, {
+  signal,
+  governor = null,
+  previousRaw = null,
+  // Seams, so the paging loop can be exercised without a live governor: the
+  // settlement figure it produces was wrong for months of repositories with
+  // more than one page, and nothing could see it.
+  fetchPage = fetchGraphqlPage,
+  admit = runAdmittedOperation,
+} = {}) {
+  const connection = GRAPHQL_QUERIES[kind].connection;
+  const operation = `tab:${kind}`;
+  const first = await fetchPage(kind, { signal, operation });
+  if (!first.ok) {
+    const error = first.failure ?? new Error(`GraphQL ${kind} page unavailable (${first.reason})`);
+    error.budgetObservations = first.observations;
+    throw error;
+  }
+  const rows = [];
+  const observations = [...first.observations];
+  // Only the first page. Pages past it opened their own reservation inside
+  // runAdmittedOperation and settle against it, so adding them here charges the
+  // same work twice -- and a settlement above its reservation is rejected as
+  // corrupt, which silently leaks the tab's reservation and discards every
+  // budget observation the fetch gathered.
+  const envelopeSpent = first.observedCost;
+  let spent = first.observedCost;
+  let page = graphqlConnection(first, connection);
+  let incomplete = false;
+  let overrun = first.overrun;
+  let totalCount = page?.totalCount ?? null;
+  for (const node of page?.nodes ?? []) rows.push(mapRow(node));
+  while (page?.pageInfo?.hasNextPage && rows.length < LIST_LIMIT) {
+    const cursor = page.pageInfo.endCursor;
+    if (typeof cursor !== "string" || cursor.length === 0) { incomplete = true; break; }
+    if (!governor) { incomplete = true; break; }
+    const admitted = await admit({
+      ...governor,
+      operation: `page:${kind}`,
+      priority: "background",
+      signal,
+      run: (admittedSignal) => fetchPage(kind, { signal: admittedSignal, after: cursor, operation: `page:${kind}` }),
+    });
+    // A later page that is denied, fails, or returns errors leaves the rows
+    // already gathered exactly as they are. Losing page one because page two
+    // was refused would turn a budget decision into data loss.
+    //
+    // Note that runAdmittedOperation settles these at their *declared* cost, not
+    // their observed one -- conservative, so never an under-charge. A later
+    // page's real meter reaches the ledger through the observations forwarded to
+    // the tab settlement rather than through its own reservation.
+    // Evidence first, and unconditionally: a page that failed as data still
+    // observed the meter, and dropping that is the one thing this phase says
+    // it will not do.
+    if (admitted.value?.observations) observations.push(...admitted.value.observations);
+    if (admitted.value?.overrun) overrun = true;
+    if (!admitted.ok || !admitted.value?.ok) { incomplete = true; break; }
+    const next = admitted.value;
+    spent += next.observedCost;
+    page = graphqlConnection(next, connection);
+    if (!page) { incomplete = true; break; }
+    for (const node of page.nodes) rows.push(mapRow(node));
+  }
+  if (page?.pageInfo?.hasNextPage && rows.length >= LIST_LIMIT) incomplete = true;
+  if (overrun) {
+    // Recorded at its real cost above; suspended here until the resource resets,
+    // which is the soonest a corrected bound could be trusted again.
+    const reset = observations.at(-1)?.resetMs;
+    pauseOperation(operation, Number.isFinite(reset) ? reset + BUDGET_RESET_GRACE_MS : Date.now() + BUDGET_PROBE_MS);
+  }
+  const limited = rows.slice(0, LIST_LIMIT);
+  // Serialized rows are the payload identity the unchanged-frame suppression
+  // and the cache both compare on, so it must cover exactly what is rendered.
+  const raw = JSON.stringify({ v: GRAPHQL_QUERY_VERSION, totalCount, incomplete, rows: limited });
   return {
-    raw,
-    limit: LIST_LIMIT,
-    // Stated rather than omitted so the zero is visibly deliberate: SORT_RECENT's
-    // --search routes this through GraphQL, which is a separate budget.
-    restSpent: REST_PER_FETCH.issues,
-    graphqlSpent: GRAPHQL_PER_FETCH.issues,
-    parse: () =>
-      parseJsonOutput(raw).map((i) => ({
-        number: i.number,
-        title: safe(i.title),
-        author: safe(i.author?.login ?? ""),
-        label: safe(i.labels?.[0]?.name ?? ""),
-        updatedAt: i.updatedAt,
-      })),
+    raw: raw === previousRaw ? previousRaw : raw,
+    // An incomplete walk reports the rows it has as its own limit, so the
+    // existing truncation indicator fires. "More rows exist than are shown" is
+    // exactly what incomplete means, and publishing 50 of 150 rows as a
+    // complete tab is indistinguishable from a repository with 50 open issues.
+    limit: incomplete ? limited.length : LIST_LIMIT,
+    restSpent: 0,
+    graphqlSpent: envelopeSpent,
+    // What the whole walk cost, for reporting. Never the settlement figure.
+    graphqlSpentTotal: spent,
+    observations,
+    incomplete,
+    parse: () => limited,
   };
 }
 
-function prsArgs() {
-  return [
-    "pr",
-    "list",
-    ...repoArgs(),
-    "--state",
-    "open",
-    "--limit",
-    String(LIST_LIMIT),
-    ...SORT_RECENT,
-    "--json",
-    "number,title,author,headRefName,isDraft,reviewDecision,createdAt,updatedAt",
-  ];
+async function fetchIssues(signal, { governor = null, previousRaw = null } = {}) {
+  return fetchGraphqlList("issues", ISSUE_ROW, { signal, governor, previousRaw });
 }
 
-async function fetchPRs(signal) {
-  const raw = await runGh(prsArgs(), { signal, operation: "tab:prs" });
-  return {
-    raw,
-    limit: LIST_LIMIT,
-    // Zero for the same reason as issues: --search makes this a GraphQL call.
-    restSpent: REST_PER_FETCH.prs,
-    graphqlSpent: GRAPHQL_PER_FETCH.prs,
-    parse: () =>
-      parseJsonOutput(raw).map((p) => ({
-        number: p.number,
-        title: safe(p.title),
-        author: safe(p.author?.login ?? ""),
-        headRefName: safe(p.headRefName),
-        isDraft: p.isDraft,
-        reviewDecision: p.reviewDecision,
-        updatedAt: p.updatedAt,
-      })),
-  };
+async function fetchPRs(signal, { governor = null, previousRaw = null } = {}) {
+  return fetchGraphqlList("prs", PR_ROW, { signal, governor, previousRaw });
 }
 
 // The three alert endpoints were three near-identical 26-line blocks that had
@@ -1320,11 +1690,14 @@ const OPERATION_COSTS = Object.freeze({
   "tab:actions-runs": { core: 1, graphql: 0 },
   "tab:actions-workflows": { core: 1, graphql: 0 },
   "tab:security-endpoint": { core: 1, graphql: 0 },
-  "failure-context:repository": { core: 0, graphql: 1 },
-  "failure-context:auth": { core: 0, graphql: 0 },
-  "open:actions": { core: REST_PER_FETCH.actions, graphql: 0 },
-  "open:issues": { core: 0, graphql: GRAPHQL_PER_FETCH.issues },
-  "open:prs": { core: 0, graphql: GRAPHQL_PER_FETCH.prs },
+  "failure-context:repository": { core: 0, graphql: GRAPHQL_OBSERVER_POINTS },
+  // Each page past the first reserves its own envelope, so a denial there is a
+  // scheduling outcome rather than an unadmitted overspend.
+  "page:issues": { core: 0, graphql: GRAPHQL_PAGE_POINTS },
+  "page:prs": { core: 0, graphql: GRAPHQL_PAGE_POINTS },
+  // The one claimed GraphQL observer. Not free, and not describable as free:
+  // it selects the meter and pays a point for it.
+  "graphql-observer": { core: 0, graphql: GRAPHQL_OBSERVER_POINTS },
   "doctor:repository": { core: 0, graphql: 1 },
   "doctor:actions-runs": { core: 1, graphql: 0 },
   "doctor:actions-workflows": { core: 1, graphql: 0 },
@@ -1337,7 +1710,6 @@ const OPERATION_COSTS = Object.freeze({
   "budget-core-observer": { core: 1, graphql: 0 },
   "rate-limit": { core: 0, graphql: 0 },
   "version": { core: 0, graphql: 0 },
-  "auth-status": { core: 0, graphql: 0 },
   "local-git": { core: 0, graphql: 0 },
 });
 
@@ -1726,6 +2098,7 @@ function scheduleIntents({
   cursors = {},
   nowMs,
   maxGrants = Number.POSITIVE_INFINITY,
+  manualStreak = 0,
 }) {
   const valid = [];
   const prunedIntentIds = [];
@@ -1766,11 +2139,29 @@ function scheduleIntents({
   const liveLeaseCount = countLiveLeases(leases, nowMs);
   const priorities = [...new Set(valid.map((intent) => intent.normalizedPriority))].sort((a, b) => a - b);
 
-  for (const priority of priorities) {
-    const pending = valid.filter((intent) => intent.normalizedPriority === priority);
+  let streak = Number.isSafeInteger(manualStreak) && manualStreak > 0 ? manualStreak : 0;
+  const grantedIds = new Set();
+  // Priority still decides every other question. This says only that "higher
+  // priority" cannot mean "always": once manual work has taken the last three
+  // turns and an active owner is waiting, that owner takes this one. The turn
+  // is a single grant, and it is subject to exactly the same budget, phase and
+  // lane checks as any other -- fairness reorders work, it never admits work
+  // that could not otherwise be paid for.
+  const owedActiveTurn = streak >= MANUAL_GRANT_STREAK_LIMIT &&
+    valid.some((intent) => intent.normalizedPriority === REQUEST_PRIORITIES.active);
+  const passes = owedActiveTurn
+    ? [{ priority: REQUEST_PRIORITIES.active, limit: 1, record: false },
+      ...priorities.map((priority) => ({ priority, limit: Number.POSITIVE_INFINITY, record: true }))]
+    : priorities.map((priority) => ({ priority, limit: Number.POSITIVE_INFINITY, record: true }));
+
+  for (const pass of passes) {
+    const priority = pass.priority;
+    const pending = valid.filter((intent) =>
+      intent.normalizedPriority === priority && !grantedIds.has(intent.id));
     const roundRobinState = createRoundRobinState(pending, updatedCursors);
+    let grantedThisPass = 0;
     while (pending.length > 0) {
-      if (grants.length >= maxGrants) break;
+      if (grants.length >= maxGrants || grantedThisPass >= pass.limit) break;
       const intent = pending.splice(nextRoundRobinIndex(pending, roundRobinState), 1)[0];
       const resources = RATE_RESOURCES.filter((resource) => intent.costs[resource] > 0);
       const decisions = Object.fromEntries(resources.map((resource) => [
@@ -1786,7 +2177,10 @@ function scheduleIntents({
       ]));
       const blocked = resources.find((resource) => decisions[resource].mode !== "open");
       if (blocked) {
-        denied.push({ intentId: intent.id, resource: blocked, ...decisions[blocked] });
+        // Only the ordinary pass records a denial. The owed-turn pass looks at
+        // the same intents again immediately afterwards, and recording here
+        // would report every one of them twice.
+        if (pass.record) denied.push({ intentId: intent.id, resource: blocked, ...decisions[blocked] });
         continue;
       }
 
@@ -1801,6 +2195,7 @@ function scheduleIntents({
       );
       const expiring = resources.find((resource) => notBefore >= decisions[resource].resetMs);
       if (expiring) {
+        if (!pass.record) continue;
         denied.push({
           intentId: intent.id,
           resource: expiring,
@@ -1835,6 +2230,12 @@ function scheduleIntents({
         reservation.sharingOwnerLeaseIds = sharingOwnerLeaseIds;
       }
       grants.push(reservation);
+      grantedIds.add(intent.id);
+      grantedThisPass += 1;
+      // A manual grant extends the run; anything else ends it. The counter has
+      // to persist, because the run this bounds is one manual intent per
+      // planning pass rather than several within one.
+      streak = priority === REQUEST_PRIORITIES.manual ? streak + 1 : 0;
       for (const resource of resources) {
         chargedTotals[resource] += intent.costs[resource];
         updatedLanes[resource] = {
@@ -1853,16 +2254,853 @@ function scheduleIntents({
     cursors: updatedCursors,
     denied,
     prunedIntentIds,
+    manualStreak: streak,
   };
 }
 
+// ---------- Credential identities and restart-safe coordination ----------
+const IDENTITY_VERSION = 1;
+const IDENTITY_ATTEMPT_WINDOW_MS = 15 * 60_000;
+const IDENTITY_ATTEMPT_LIMIT = 3;
+const IDENTITY_HOST_ATTEMPT_LIMIT = 12;
+const IDENTITY_MAX_ATTEMPTS = 4096;
+const HTTP_START_GAP_MS = 250;
+const HTTP_MAX_WAITERS = 128;
+// A permit is reclaimable once it cannot still belong to a live request. The
+// owner-death check alone cannot see a process that is stopped, or one whose
+// release lost its lock, so a permit outliving the subprocess timeout it guards
+// is stale by construction rather than by guess.
+const HTTP_PERMIT_MAX_MS = GH_TIMEOUT_MS + 5_000;
+// The longest a primary window can run. An attempt that never obtained reset
+// evidence is still covered once a full window has demonstrably elapsed since it
+// started, which is what keeps an unprovable charge from being retained forever.
+const IDENTITY_UNCERTAIN_MAX_MS = 3_600_000 + BUDGET_RESET_GRACE_MS;
+// Bound the in-band wait for the registry lock when a request is already
+// finishing. The permit is what other panes queue behind, so a slow release must
+// hand off to deferCompletion quickly instead of holding the whole machine.
+const IDENTITY_RELEASE_WAIT_MS = 500;
+// How long startup will wait for a warm local identity before painting. Long
+// enough to win the ordinary case, short enough that a stuck credential helper
+// costs a cache-cold first frame rather than a blank terminal.
+const WARM_IDENTITY_WAIT_MS = 1_000;
+// "busy" and "unwritable" say the registry could not be read or written *right
+// now*. Every other reason is a statement about the identity itself. Three
+// callers each drew this line differently -- retryIdentityCompletion retried
+// both, refresh() treated them as proof the identity was gone, and permit
+// acquisition threw on them -- so a 250 ms lock wait could be reported as an
+// account change. One definition keeps them from drifting apart again.
+const RETRYABLE_COORDINATION_REASONS = ["busy", "unwritable"];
+// 60 s doubling per prior attempt in the window. The two callers deliberately
+// count different prior sets -- bootstrap also has a per-host unknown-principal
+// allowance and the transport start gap to respect, while a known-capacity
+// observer is admitted normally and only the exceptional branch is throttled --
+// but the delay they apply is one law and belongs in one place.
+function attemptRetryDelayMs(priorAttempts) {
+  return 60_000 * 2 ** priorAttempts;
+}
+
+function retryableCoordination(reason) {
+  return RETRYABLE_COORDINATION_REASONS.includes(reason);
+}
+
+// A dead owner releases its permit immediately; a live owner keeps it only for
+// as long as a request could still be running under it. Without the second
+// test a stopped process, or one whose release never won the lock, holds the
+// single machine-wide permit forever and every pane queues behind it.
+function staleHttpPermit(permit, now, kill = process.kill.bind(process)) {
+  if (pidIsDead(permit.pid, kill)) return true;
+  return Number.isFinite(permit.startedAt) && now - permit.startedAt > HTTP_PERMIT_MAX_MS;
+}
+let runtimeIdentityCoordinator = null;
+
+function privateIdentityDigest(...parts) {
+  return createHash("sha256").update(JSON.stringify(parts)).digest("hex");
+}
+
+function identityRegistryRoot(pathOptions = {}) {
+  return join(dirname(widthPreferencesPath(pathOptions)), "coordination-v2");
+}
+
+function credentialEnvironmentNames(host) {
+  return host === "github.com" || host.endsWith(".ghe.com")
+    ? ["GH_TOKEN", "GITHUB_TOKEN"] : ["GH_ENTERPRISE_TOKEN", "GITHUB_ENTERPRISE_TOKEN"];
+}
+
+// Deliberately not memoized, despite being called on the render and request
+// paths. resolveEffectiveCredential brackets the `gh auth token` subprocess with
+// a before/after comparison of this value to catch a credential swapped while
+// resolution was in flight, so any cache whose window can cover that gap makes
+// the process bind the wrong credential -- and a local token can resolve in
+// under a millisecond. The cost is one statSync plus a digest of four numbers;
+// reduce the number of callers instead of caching the answer.
+function credentialConfigurationRevision(host, env = process.env) {
+  const names = credentialEnvironmentNames(host);
+  const selected = names.find((name) => env[name]);
+  if (selected) return privateIdentityDigest(host, String(env[selected]));
+  const directory = effectiveGhConfigDir({ env });
+  let stamp = null;
+  try {
+    const value = statSync(join(directory, "hosts.yml"));
+    stamp = [value.dev, value.ino, value.size, value.mtimeMs];
+  } catch { /* missing local configuration is resolved honestly by gh */ }
+  return privateIdentityDigest(host, directory, stamp);
+}
+
+async function resolveEffectiveCredential({ host, env = process.env, runLocalToken } = {}) {
+  host = normalizeHost(host);
+  if (!host) return { ok: false, reason: "unknown-host" };
+  const names = credentialEnvironmentNames(host);
+  const initialRevision = credentialConfigurationRevision(host, env);
+  let token;
+  try {
+    const selected = names.find((name) => env[name]);
+    if (selected) token = String(env[selected]);
+    else {
+      // This seam never passes through runGh/logGh and never exposes the child
+      // error, stdout or stderr. Credentials exist only in this lexical scope.
+      const result = await (runLocalToken ?? (async (args) => execFileAsync("gh", args, {
+        env: { ...env, ...GH_ENV_OVERRIDES }, timeout: GH_TIMEOUT_MS,
+        maxBuffer: 1024 * 1024, killSignal: "SIGKILL",
+      })))(["auth", "token", "--hostname", host]);
+      token = String(typeof result === "string" ? result : result.stdout ?? "").trim();
+    }
+    if (credentialConfigurationRevision(host, env) !== initialRevision) return { ok: false, reason: "credential-changed" };
+    if (!token || /\s/.test(token)) return { ok: false, reason: "credential-unavailable" };
+    const credentialKey = privateIdentityDigest("credential-v1", host, token);
+    token = null;
+    return { ok: true, value: { host, credentialKey, configurationRevision: initialRevision } };
+  } catch {
+    return { ok: false, reason: "credential-unavailable" };
+  }
+}
+
+function emptyIdentityRegistry() {
+  return { version: IDENTITY_VERSION, migration: { activated: false, holdUntil: 0 }, identities: {}, attempts: {}, hosts: {} };
+}
+
+function normalizeIdentityRegistry(raw) {
+  if (!exactKeys(raw, ["version", "migration", "identities", "attempts", "hosts"]) || raw.version !== IDENTITY_VERSION ||
+      !exactKeys(raw.migration, ["activated", "holdUntil"]) || typeof raw.migration.activated !== "boolean" ||
+      !Number.isFinite(raw.migration.holdUntil) || raw.migration.holdUntil < 0 ||
+      !isRecord(raw.identities) || !isRecord(raw.attempts) || !isRecord(raw.hosts) ||
+      Object.keys(raw.attempts).length > IDENTITY_MAX_ATTEMPTS) return null;
+  const digest = (value) => typeof value === "string" && /^[0-9a-f]{64}$/.test(value);
+  const time = (value) => Number.isFinite(value) && value >= 0;
+  for (const [key, identity] of Object.entries(raw.identities)) {
+    if (!digest(key) || !exactKeys(identity, ["host", "kind", "id", "login", "quotaKey", "accessKey", "generation", "observedAt"]) ||
+        !normalizeHost(identity.host) || identity.kind !== "user" || !Number.isSafeInteger(identity.id) || identity.id <= 0 ||
+        typeof identity.login !== "string" || identity.login !== safe(identity.login) || !digest(identity.quotaKey) || !digest(identity.accessKey) ||
+        !Number.isSafeInteger(identity.generation) || identity.generation < 1 || !time(identity.observedAt)) return null;
+  }
+  for (const [id, attempt] of Object.entries(raw.attempts)) {
+    if (!validGovernorId(id) || !exactKeys(attempt, ["credentialKey", "host", "resource", "startedAt", "retryAt", "ownerPid", "nonce", "status", "quotaKey", "resetMs", "accounted", "imported", "exceptional"]) ||
+        !digest(attempt.credentialKey) || !normalizeHost(attempt.host) || !RATE_RESOURCES.includes(attempt.resource) ||
+        !time(attempt.startedAt) || !time(attempt.retryAt) || !Number.isSafeInteger(attempt.ownerPid) || attempt.ownerPid < 1 || !validGovernorId(attempt.nonce) ||
+        !["started", "finished", "uncertain"].includes(attempt.status) || (attempt.quotaKey !== null && !digest(attempt.quotaKey)) ||
+        (attempt.resetMs !== null && !time(attempt.resetMs)) || typeof attempt.accounted !== "boolean" || typeof attempt.imported !== "boolean" || typeof attempt.exceptional !== "boolean") return null;
+  }
+  for (const [host, transport] of Object.entries(raw.hosts)) {
+    if (!isRecord(transport)) return null;
+    const keys = ["lastStartedAt", "cooldownUntil", "permit"];
+    if (Object.hasOwn(transport, "waiters")) keys.push("waiters");
+    if (Object.hasOwn(transport, "throttle")) keys.push("throttle");
+    if (!normalizeHost(host) || !exactKeys(transport, keys) ||
+        !time(transport.lastStartedAt) || !time(transport.cooldownUntil)) return null;
+    if (transport.permit !== null && (!exactKeys(transport.permit, ["pid", "nonce", "startedAt"]) ||
+        !Number.isSafeInteger(transport.permit.pid) || transport.permit.pid < 1 || !validGovernorId(transport.permit.nonce) || !time(transport.permit.startedAt))) return null;
+    if (!Object.hasOwn(transport, "throttle")) transport.throttle = emptyTransportThrottle();
+    if (!isRecord(transport.throttle) || !exactKeys(transport.throttle, ["attempts", "lastAt", "paused"]) ||
+        !Number.isSafeInteger(transport.throttle.attempts) || transport.throttle.attempts < 0 ||
+        transport.throttle.attempts > THROTTLE_PAUSE_AFTER ||
+        !time(transport.throttle.lastAt) || typeof transport.throttle.paused !== "boolean") return null;
+    if (!Object.hasOwn(transport, "waiters")) transport.waiters = [];
+    if (!Array.isArray(transport.waiters) || transport.waiters.length > HTTP_MAX_WAITERS ||
+        new Set(transport.waiters.map((waiter) => waiter?.nonce)).size !== transport.waiters.length ||
+        transport.waiters.some((waiter) => !exactKeys(waiter, ["pid", "nonce", "queuedAt", "deadline"]) ||
+          !Number.isSafeInteger(waiter.pid) || waiter.pid < 1 || !validGovernorId(waiter.nonce) ||
+          !time(waiter.queuedAt) || !time(waiter.deadline) || waiter.deadline <= waiter.queuedAt ||
+          waiter.deadline - waiter.queuedAt > GH_TIMEOUT_MS)) return null;
+  }
+  return raw;
+}
+
+function withIdentityRegistry(root, operation, { now = Date.now(), kill = process.kill.bind(process) } = {}) {
+  const path = join(root, "registry.json");
+  const scope = { path, hash: "identity-registry", host: "github.com", identityProvider: null, kill };
+  return withGovernorLock(scope, () => {
+    // Read and parse are separated for the same reason readGovernorState
+    // separates them: EACCES, EIO or EMFILE mean "try again", while unparseable
+    // bytes mean "stop and preserve the evidence". Collapsing the two reported a
+    // transient descriptor shortage as permanent corruption.
+    let raw = null;
+    try { raw = readFileSync(path, "utf8"); }
+    catch (error) { if (error?.code !== "ENOENT") return { ok: false, reason: "unwritable" }; }
+    let state;
+    if (raw === null) state = emptyIdentityRegistry();
+    else {
+      try { state = normalizeIdentityRegistry(JSON.parse(raw)); }
+      catch { return { ok: false, reason: "corrupt" }; }
+    }
+    if (!state) return { ok: false, reason: "corrupt" };
+    // Captured before the prunes below so their deletions still count as a
+    // change. Every governor operation -- including read-only inspection --
+    // funnels through here, and each one used to serialize and rename the
+    // registry while holding the one machine-wide lock.
+    const before = JSON.stringify(state);
+    for (const transport of Object.values(state.hosts)) {
+      transport.waiters = transport.waiters.filter((waiter) => waiter.deadline > now && !pidIsDead(waiter.pid, kill));
+    }
+    for (const [id, attempt] of Object.entries(state.attempts)) {
+      // Past its rolling window *and* past any backoff it still imposes. retryAt
+      // is what carries known exhaustion (settlement pushes it out to reset plus
+      // grace, beyond the window), so testing it is what lets an aged-out entry
+      // be dropped without forgiving a hold that is still in force.
+      if (attempt.startedAt + IDENTITY_ATTEMPT_WINDOW_MS > now || attempt.retryAt > now) continue;
+      const identity = state.identities[attempt.credentialKey];
+      // No identity for this credential means no quota scope, so there is no
+      // ledger receipt the attempt could be holding and nothing to reconcile.
+      // These are the failed bootstraps -- they never reach importIdentityDebts,
+      // so they used to be immortal and wedged claimIdentityBootstrap at
+      // IDENTITY_MAX_ATTEMPTS permanently, with deleting registry.json by hand
+      // as the only way out.
+      if (!identity) { delete state.attempts[id]; continue; }
+      const scope = { ...createQuotaScope({ ...identity, credentialKey: attempt.credentialKey }, { root, now: () => now, kill }), rootLocked: true };
+      const retired = withGovernorLock(scope, () => {
+        const ledger = readIdentityQuotaState(state, scope, now);
+        if (!ledger.ok || ledger.missing) return ledger.ok ? { ok: false, reason: "corrupt" } : ledger;
+        const budget = ledger.value.budgets[attempt.resource];
+        const resetCovered = attempt.resetMs !== null
+          ? now >= attempt.resetMs && budget?.resetMs > attempt.resetMs
+          // An attempt whose observer never returned core evidence has no reset
+          // of its own to wait for. A window boundary proven to fall after it
+          // started covers its charge just as well, and is the only thing that
+          // stops the entry from being retained for the life of the install.
+          : budget?.resetMs > attempt.startedAt + IDENTITY_UNCERTAIN_MAX_MS;
+        if (!attempt.accounted && !resetCovered) return { ok: true, value: false };
+        delete ledger.value.reservations[`reservation:${id}`];
+        const write = writeGovernorState(scope.path, ledger.value);
+        return write.ok ? { ok: true, value: true } : write;
+      });
+      if (!retired.ok) return retired;
+      if (retired.value) delete state.attempts[id];
+    }
+    const result = operation(state, now);
+    if (!normalizeIdentityRegistry(state)) return { ok: false, reason: "corrupt" };
+    if (JSON.stringify(state) === before) return result;
+    const written = writeGovernorState(path, state);
+    return written.ok ? result : written;
+  });
+}
+
+function inspectIdentityRegistry(root, options) {
+  return withIdentityRegistry(root, (state) => ({ ok: true, value: structuredClone(state) }), options);
+}
+
+function inspectLegacyMigration(root, state, now) {
+  let names;
+  try { names = readdirSync(dirname(root)).filter((name) => /^rate-governor-v1-[0-9a-f]{64}\.json$/.test(name)); }
+  catch (error) { return { ok: false, reason: error.code === "ENOENT" ? "unwritable" : "corrupt" }; }
+  let holdUntil = state.migration.holdUntil;
+  for (const name of names) {
+    let raw;
+    try { raw = JSON.parse(readFileSync(join(dirname(root), name), "utf8")); } catch { return { ok: false, reason: "legacy-corrupt" }; }
+    // Evidence is never rewritten. Recognize only the pinned legacy schemas.
+    // Every protocol an older pane could still be running, newest first. The set
+    // grows as GOVERNOR_STATE_VERSION advances: a version bump makes an old
+    // binary fail closed on its own gate, but this side must still recognise
+    // that binary's file well enough to see it holds a live lease.
+    const legacy = LEGACY_GOVERNOR_VERSIONS
+      .map((version) => readLegacyGovernorState(raw, now, version))
+      .find(Boolean) ?? migrateGovernorState(raw, now);
+    if (legacy && raw.version === 1 && raw.budgets?.core) {
+      const core = raw.budgets.core;
+      const preserved = normalizeGovernorBudget({ ...core, source: "core-observer", factorBaseline: { epoch: core.epoch, used: core.used, observedAt: core.observedAt }, knownLocalUsed: 0 }, now, "core");
+      if (!preserved) return { ok: false, reason: "legacy-corrupt" };
+      // This is a migration hold view only, never published as new authority.
+      legacy.budgets.core = preserved;
+      legacy.epochs.core = preserved.epoch;
+    }
+    if (!legacy) return { ok: false, reason: "legacy-corrupt" };
+    if (Object.values(legacy.leases).some((lease) => lease.expiresAt > now)) return { ok: false, reason: "restart-required" };
+    for (const resource of RATE_RESOURCES) {
+      const budget = legacy.budgets[resource];
+      holdUntil = Math.max(holdUntil, budget?.blockUntil ?? 0);
+      const uncertain = Object.values(legacy.reservations).some((reservation) =>
+        ["started", "completed"].includes(reservation.status) && reservationCost(reservation, resource, legacy.leases, now) > 0);
+      if (uncertain) {
+        const reset = budget?.resetMs;
+        if (!Number.isFinite(reset)) return { ok: false, reason: "legacy-unresolved" };
+        holdUntil = Math.max(holdUntil, reset + BUDGET_RESET_GRACE_MS);
+      }
+    }
+  }
+  state.migration.holdUntil = holdUntil;
+  if (holdUntil > now) return { ok: false, reason: "migration-hold", retryAt: holdUntil };
+  // Deliberately a record, not a gate. Re-listing the legacy directory on every
+  // operation is what satisfies "detect reappearing legacy leases during
+  // operation": an old binary started after migration must still be able to
+  // pause new admission, and it cannot announce itself through a sentinel it
+  // does not read. Short-circuiting on this flag would be faster and wrong.
+  state.migration.activated = true;
+  return { ok: true };
+}
+
+function claimIdentityBootstrap(root, { credentialKey, host, resource = "core", now = Date.now(), kill = process.kill.bind(process) } = {}) {
+  return withIdentityRegistry(root, (state) => {
+    const migration = inspectLegacyMigration(root, state, now);
+    if (!migration.ok) return migration;
+    const transport = state.hosts[host] ??= { lastStartedAt: 0, cooldownUntil: 0, permit: null };
+    if (transport.permit && staleHttpPermit(transport.permit, now, kill)) transport.permit = null;
+    if (transport.permit || transport.waiters?.length) return { ok: false, reason: "identity-busy", retryAt: now + 1000 };
+    const attempts = Object.values(state.attempts);
+    const recent = attempts.filter((attempt) => attempt.startedAt > now - IDENTITY_ATTEMPT_WINDOW_MS);
+    const own = recent.filter((attempt) => attempt.credentialKey === credentialKey && attempt.resource === resource && attempt.exceptional);
+    const unknown = recent.filter((attempt) => attempt.host === host && attempt.exceptional);
+    const retryAt = Math.max(transport.cooldownUntil, transport.lastStartedAt + HTTP_START_GAP_MS,
+      ...attempts.filter((attempt) => attempt.credentialKey === credentialKey && attempt.resource === resource).map((attempt) => attempt.retryAt),
+      own.length >= IDENTITY_ATTEMPT_LIMIT ? Math.min(...own.map((attempt) => attempt.startedAt)) + IDENTITY_ATTEMPT_WINDOW_MS : 0,
+      unknown.length >= IDENTITY_HOST_ATTEMPT_LIMIT ? Math.min(...unknown.map((attempt) => attempt.startedAt)) + IDENTITY_ATTEMPT_WINDOW_MS : 0);
+    if (retryAt > now) return { ok: false, reason: "identity-backoff", retryAt };
+    if (attempts.length >= IDENTITY_MAX_ATTEMPTS) return { ok: false, reason: "identity-capacity" };
+    const id = governorId();
+    const nonce = governorId();
+    state.attempts[id] = { credentialKey, host, resource, startedAt: now, retryAt: now + attemptRetryDelayMs(own.length),
+      ownerPid: process.pid, nonce, status: "started", quotaKey: null, resetMs: null, accounted: false, imported: false, exceptional: true };
+    transport.permit = { pid: process.pid, nonce, startedAt: now };
+    transport.lastStartedAt = now;
+    return { ok: true, value: { id, nonce } };
+  }, { now, kill });
+}
+
+function readIdentityQuotaState(registry, scope, now) {
+  const loaded = readGovernorState(scope.path, now);
+  const known = Object.values(registry.identities).some((identity) => identity.quotaKey === scope.quotaKey) ||
+    Object.values(registry.attempts).some((attempt) => attempt.imported && attempt.quotaKey === scope.quotaKey);
+  return loaded.ok && loaded.missing && known ? { ok: false, reason: "corrupt" } : loaded;
+}
+
+function importIdentityDebts(root, state, credentialKey, identity, now) {
+  const scope = { ...createQuotaScope({ ...identity, credentialKey }, { root, now: () => now }), rootLocked: true };
+  return withGovernorLock(scope, () => {
+    const loaded = readIdentityQuotaState(state, scope, now);
+    if (!loaded.ok) return loaded;
+    const transferred = [];
+    for (const [id, attempt] of Object.entries(state.attempts)) {
+      if (attempt.credentialKey !== credentialKey || attempt.imported) continue;
+      const reservationId = `reservation:${id}`;
+      loaded.value.reservations[reservationId] ??= {
+        leaseId: id, intentId: id, costs: { core: 0, graphql: 0, [attempt.resource]: 1 }, actualCosts: null,
+        accountedCosts: { core: 0, graphql: 0, [attempt.resource]: attempt.accounted ? 1 : 0 },
+        notBefore: attempt.startedAt, status: "started", epochs: { core: null, graphql: null },
+        startedAt: attempt.startedAt, completedAt: null, outcome: null,
+      };
+      transferred.push(id);
+    }
+    // importIdentityDebts writes this ledger before the registry transaction
+    // that records the mapping commits. A crash in between leaves a charged
+    // receipt here whose attempt is gone from the registry, and nothing else
+    // ever looks at it again -- it presents only as a permanently smaller
+    // budget. Re-bootstrapping the same credential is exactly when it can be
+    // recognised, and a full window since it started proves a reset covered it.
+    for (const key of Object.keys(loaded.value.reservations)) {
+      const attemptId = /^reservation:(.+)$/.exec(key)?.[1];
+      if (!attemptId || state.attempts[attemptId]) continue;
+      const reservation = loaded.value.reservations[key];
+      if (reservation.startedAt + IDENTITY_UNCERTAIN_MAX_MS > now) continue;
+      delete loaded.value.reservations[key];
+    }
+    const written = writeGovernorState(scope.path, loaded.value);
+    if (!written.ok) return written;
+    // Marked transferred only once the receipts are durable. withIdentityRegistry
+    // persists the registry whatever this returns, so setting these before the
+    // ledger write meant a failed write could leave the registry claiming a debt
+    // had moved to a ledger that never received it -- and the `imported` guard
+    // would then skip those attempts forever, dropping the conservative charge.
+    for (const id of transferred) {
+      state.attempts[id].quotaKey = identity.quotaKey;
+      state.attempts[id].imported = true;
+    }
+    return written;
+  });
+}
+
+function finishIdentityBootstrap(root, { credentialKey, id, nonce, response = null, now = Date.now(), isCurrent = () => true } = {}) {
+  return withIdentityRegistry(root, (state) => {
+    const attempt = state.attempts[id];
+    if (!attempt || attempt.nonce !== nonce || attempt.credentialKey !== credentialKey) return { ok: false, reason: "stale" };
+    const transport = state.hosts[attempt.host];
+    if (transport.permit?.nonce === nonce) transport.permit = null;
+    attempt.status = response ? "finished" : "uncertain";
+    const parsed = response?.body;
+    const evidence = response?.rateLimit;
+    applyTransportCooldown(transport, { retryAfter: response?.retryAfter, status: response?.status, secondary: response?.secondary, at: now });
+    if (evidence?.resource === "core" && normalizeBudgetResource(evidence, now)) {
+      attempt.resetMs = evidence.resetMs;
+      if (evidence.remaining === 0) attempt.retryAt = Math.max(attempt.retryAt, evidence.resetMs + BUDGET_RESET_GRACE_MS);
+    }
+    if (!isCurrent()) return { ok: false, reason: "stale" };
+    if ((response?.status ?? 200) !== 200 || !isRecord(parsed) || !Number.isSafeInteger(parsed.id) || parsed.id <= 0 || typeof parsed.login !== "string" ||
+        parsed.login.length === 0 || !evidence || evidence.resource !== "core" || !normalizeBudgetResource(evidence, now)) return { ok: false, reason: "identity-unavailable" };
+    const generation = state.identities[credentialKey]?.generation ?? 1;
+    const identity = { host: attempt.host, kind: "user", id: parsed.id, login: safe(parsed.login),
+      quotaKey: privateIdentityDigest("quota-v2", attempt.host, "user", parsed.id),
+      accessKey: privateIdentityDigest("access-v2", credentialKey, generation), generation, observedAt: now };
+    attempt.accounted = true;
+    for (const previous of Object.values(state.attempts)) {
+      if (previous.credentialKey === credentialKey && previous.resource === "core") previous.resetMs ??= evidence.resetMs;
+    }
+    // Record the mapping only after the ledger contains every debt. A crash
+    // between writes replays stable reservation IDs while the root lock prevents
+    // observers from deleting receipts before the mapping transaction finishes.
+    const imported = importIdentityDebts(root, state, credentialKey, identity, now);
+    if (!imported.ok) return imported;
+    // The admitted identity proof supplies core authority. Retain its validator
+    // so later observers can confirm unchanged identity without primary spend.
+    {
+      const scope = { ...createQuotaScope({ ...identity, credentialKey }, { root, now: () => now }), rootLocked: true };
+      const seeded = withGovernorLock(scope, () => {
+        const ledger = readIdentityQuotaState(state, scope, now);
+        if (!ledger.ok) return ledger;
+        const observation = budgetFromObservation(evidence, ledger.value.budgets.core, now, { resource: "core", source: "core-observer", receivedAt: now, allowEpochChange: true });
+        if (observation.status === "accepted") {
+          ledger.value.budgets.core = observation.budget;
+          ledger.value.epochs.core = observation.budget.epoch;
+          ledger.value.observers.core = { etag: typeof response.etag === "string" ? response.etag : null, outcome: "healthy", at: now, nextAt: now + BUDGET_PROBE_MS };
+        }
+        return writeGovernorState(scope.path, ledger.value);
+      });
+      if (!seeded.ok) return seeded;
+    }
+    if (!isCurrent()) return { ok: false, reason: "stale" };
+    state.identities[credentialKey] = identity;
+    return { ok: true, value: { ...identity, credentialKey } };
+  }, { now });
+}
+
+function createSettlementContext(scope, coordinator) {
+  return { scope: { ...scope, identityProvider: null }, isCurrent: () => coordinator.current()?.accessKey === scope.accessKey };
+}
+
+function createQuotaScope(identity, { root = identityRegistryRoot(), now = Date.now, identityProvider = null, kill = process.kill.bind(process) } = {}) {
+  return { hash: identity.quotaKey, quotaKey: identity.quotaKey, credentialKey: identity.credentialKey, accessKey: identity.accessKey,
+    path: join(root, `quota-${identity.quotaKey}.json`), coordinationRoot: root, host: identity.host, authIdentity: identity.quotaKey,
+    identityProvider, now, kill };
+}
+
+function createIdentityCoordinator({ host, pathOptions = {}, env = process.env, now = Date.now, kill = process.kill.bind(process), runLocalToken, requestIdentity } = {}) {
+  const root = identityRegistryRoot(pathOptions);
+  let current = null;
+  let revision = null;
+  let pending = null;
+  let failure = null;
+  let resolvedCredential = null;
+  let closed = false;
+  const bootstrapAbort = new AbortController();
+  const completions = new Map();
+  const deferCompletion = (key, operation) => completions.set(key, operation);
+  const flushCompletions = async () => {
+    for (const [key, operation] of completions) {
+      const result = await retryIdentityCompletion(operation, { shouldRetry: () => !closed });
+      if (!result.ok && ["busy", "unwritable"].includes(result.reason)) return result;
+      // A malformed/denied proof is a completed durable attempt, not pending
+      // storage work. Drop that callback so ordinary backoff can recover.
+      completions.delete(key);
+      if (!result.ok && result.reason === "corrupt") return result;
+    }
+    return { ok: true };
+  };
+  const resolveHost = () => normalizeHost(typeof host === "function" ? host() : host);
+  const snapshot = () => {
+    if (closed) return null;
+    const selectedHost = resolveHost();
+    if (current && (current.host !== selectedHost || credentialConfigurationRevision(selectedHost, env) !== revision)) current = null;
+    return current;
+  };
+  const refresh = ({ allowBootstrap = true } = {}) => {
+    if (closed) return Promise.resolve({ ok: false, reason: "closed" });
+    if (pending) return pending;
+    pending = (async () => {
+      const completed = await flushCompletions();
+      if (!completed.ok) { failure = completed; return completed; }
+      const selectedHost = resolveHost();
+      const wantedRevision = selectedHost ? credentialConfigurationRevision(selectedHost, env) : null;
+      const resolved = resolvedCredential?.value?.configurationRevision === wantedRevision
+        ? resolvedCredential : await resolveEffectiveCredential({ host: selectedHost, env, runLocalToken });
+      if (resolved.ok) resolvedCredential = resolved;
+      if (closed) return { ok: false, reason: "closed" };
+      if (!resolved.ok) { current = null; failure = resolved; return resolved; }
+      revision = resolved.value.configurationRevision;
+      const { credentialKey } = resolved.value;
+      const stored = withIdentityRegistry(root, (state) => {
+        const migration = inspectLegacyMigration(root, state, now());
+        if (!migration.ok) return migration;
+        const identity = state.identities[credentialKey];
+        return { ok: true, value: identity ? { ...identity, credentialKey } : null };
+      }, { now: now(), kill });
+      // A retryable lock failure says nothing about the identity, and nulling
+      // `current` for one makes ensureScope retire the lease and blank every
+      // tab -- discarding the ETags that make the next round cheap.
+      if (!stored.ok) { if (!retryableCoordination(stored.reason)) current = null; failure = stored; return stored; }
+      if (stored.value) { current = stored.value; failure = null; return { ok: true, value: current }; }
+      if (!allowBootstrap) {
+        failure = { ok: false, reason: "identity-unavailable" };
+        return failure;
+      }
+      const claim = claimIdentityBootstrap(root, { credentialKey, host: selectedHost, now: now(), kill });
+      if (!claim.ok) { if (!retryableCoordination(claim.reason)) current = null; failure = claim; return claim; }
+      const proofRevision = resolved.value.configurationRevision;
+      // Check after claim lock waits as well as inside deferred completion:
+      // either wait can outlive the host/configuration that selected this token.
+      const isCurrent = () => !closed && resolveHost() === selectedHost && credentialConfigurationRevision(selectedHost, env) === proofRevision;
+      let response = null;
+      try {
+        if (isCurrent()) response = await (requestIdentity ?? (async (requestHost, { signal }) => {
+          let stdout;
+          try {
+            ({ stdout } = await execFileAsync("gh", ["api", "-i", "user", "--hostname", requestHost], {
+              env: { ...env, ...GH_ENV_OVERRIDES }, timeout: GH_TIMEOUT_MS, maxBuffer: GH_MAX_BUFFER, killSignal: "SIGKILL", signal,
+            }));
+          } catch (error) { stdout = error.stdout ?? ""; }
+          const parsed = parseGhApiResponse(stdout);
+          let body = null;
+          try { body = JSON.parse(parsed.body); } catch { /* selected error evidence is still useful */ }
+          return { status: parsed.status, body, rateLimit: pickRateLimit(parsed.headers), etag: parsed.headers.etag ?? null,
+            retryAfter: parsed.headers["retry-after"] ?? null, secondary: SECONDARY_LIMIT_PATTERN.test(String(body?.message ?? "")) };
+        }))(selectedHost, { signal: bootstrapAbort.signal });
+      } catch { /* raw authentication errors never leave the credential seam */ }
+      const finish = () => finishIdentityBootstrap(root, { credentialKey, ...claim.value, response, now: now(), isCurrent });
+      const settled = await retryIdentityCompletion(finish, { shouldRetry: () => !closed });
+      if (!settled.ok && ["busy", "unwritable"].includes(settled.reason)) deferCompletion(`bootstrap:${claim.value.id}`, finish);
+      if (!isCurrent()) { current = null; return { ok: false, reason: "stale" }; }
+      current = settled.ok ? settled.value : null;
+      failure = settled.ok ? null : settled;
+      return settled;
+    })().finally(() => { pending = null; });
+    return pending;
+  };
+  return { root, current: snapshot, refresh, deferCompletion, flushCompletions, inspect: () => failure, isClosed: () => closed, close: () => { closed = true; current = null; bootstrapAbort.abort(); } };
+}
+
+async function retryIdentityCompletion(operation, { timeoutMs = GH_TIMEOUT_MS, shouldRetry = () => true } = {}) {
+  const deadline = performance.now() + timeoutMs;
+  for (;;) {
+    const result = operation();
+    if (result.ok || !retryableCoordination(result.reason) || !shouldRetry() || performance.now() >= deadline) return result;
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    // Shutdown retains the unresolved receipt; do not keep the CLI alive to
+    // retry a lock owned by another live process. Account switches still retry.
+    if (!shouldRetry()) return result;
+  }
+}
+
+function startIdentityControl(coordinator, now = Date.now()) {
+  const identity = coordinator.current();
+  if (!identity) return { ok: false, reason: "identity-unavailable" };
+  return withIdentityRegistry(coordinator.root, (registry) => {
+    const scope = { ...createQuotaScope(identity, { root: coordinator.root, now: () => now }), rootLocked: true };
+    return withGovernorLock(scope, () => {
+      const loaded = readIdentityQuotaState(registry, scope, now);
+      if (!loaded.ok) return loaded;
+      const state = loaded.value;
+      const budget = state.budgets.core;
+      const exceptional = !budget || now >= budget.resetMs + BUDGET_RESET_GRACE_MS;
+      if (budget && now >= budget.resetMs && !exceptional) return { ok: false, reason: "identity-backoff", retryAt: budget.resetMs + BUDGET_RESET_GRACE_MS };
+      if (!exceptional) {
+        const reserved = Object.values(state.reservations).reduce((sum, reservation) => sum + reservationCost(reservation, "core", state.leases, now), 0);
+        if (budget.remaining - resourceReserve(budget.limit) - reserved < 1) return { ok: false, reason: "identity-backoff", retryAt: budget.resetMs + BUDGET_RESET_GRACE_MS };
+      }
+      const recent = Object.values(registry.attempts).filter((attempt) => attempt.credentialKey === identity.credentialKey && attempt.resource === "core" && attempt.exceptional && attempt.startedAt > now - IDENTITY_ATTEMPT_WINDOW_MS);
+      const retryAt = Math.max(0, ...recent.map((attempt) => attempt.retryAt), recent.length >= IDENTITY_ATTEMPT_LIMIT ? Math.min(...recent.map((attempt) => attempt.startedAt)) + IDENTITY_ATTEMPT_WINDOW_MS : 0);
+      if (exceptional && retryAt > now) return { ok: false, reason: "identity-backoff", retryAt };
+      if (Object.keys(registry.attempts).length >= IDENTITY_MAX_ATTEMPTS || Object.keys(state.reservations).length >= GOVERNOR_MAX_RESERVATIONS) return { ok: false, reason: "identity-capacity" };
+      const id = governorId();
+      registry.attempts[id] = { credentialKey: identity.credentialKey, host: identity.host, resource: "core", startedAt: now,
+        retryAt: exceptional ? now + attemptRetryDelayMs(recent.length) : now, ownerPid: process.pid, nonce: governorId(), status: "started",
+        quotaKey: identity.quotaKey, resetMs: budget?.resetMs ?? null, accounted: false, imported: true, exceptional };
+      state.reservations[`reservation:${id}`] = { leaseId: id, intentId: id, costs: { core: 1, graphql: 0 }, actualCosts: null,
+        accountedCosts: { core: 0, graphql: 0 }, notBefore: now, status: "started", epochs: { core: budget?.epoch ?? null, graphql: null },
+        startedAt: now, completedAt: null, outcome: null };
+      const written = writeGovernorState(scope.path, state);
+      return written.ok ? { ok: true, value: { id, identity } } : written;
+    });
+  }, { now });
+}
+
+function settleIdentityControl(coordinator, control, stdout, now = Date.now()) {
+  return withIdentityRegistry(coordinator.root, (registry) => {
+    const attempt = registry.attempts[control.id];
+    if (!attempt) return { ok: false, reason: "stale" };
+    const parsed = parseGhApiResponse(stdout ?? "");
+    const evidence = pickRateLimit(parsed.headers);
+    const proven = [200, 304].includes(parsed.status) && evidence?.resource === "core";
+    attempt.status = proven ? "finished" : "uncertain";
+    attempt.accounted = proven;
+    if (evidence?.resource === "core") {
+      attempt.resetMs = evidence.resetMs;
+      if (evidence.remaining === 0) attempt.retryAt = Math.max(attempt.retryAt, evidence.resetMs + BUDGET_RESET_GRACE_MS);
+    }
+    const scope = { ...createQuotaScope(control.identity, { root: coordinator.root, now: () => now }), rootLocked: true };
+    return withGovernorLock(scope, () => {
+      const loaded = readIdentityQuotaState(registry, scope, now);
+      if (!loaded.ok) return loaded;
+      const reservation = loaded.value.reservations[`reservation:${control.id}`];
+      if (!reservation) return { ok: false, reason: "stale" };
+      if (proven) {
+        const cost = parsed.status === 304 ? 0 : 1;
+        reservation.status = "completed";
+        reservation.completedAt = now;
+        reservation.outcome = "measured-success";
+        reservation.actualCosts = { core: cost, graphql: 0 };
+        reservation.accountedCosts = { core: cost, graphql: 0 };
+      }
+      return writeGovernorState(scope.path, loaded.value);
+    });
+  }, { now });
+}
+
+async function acquireIdentityHttpPermit(coordinator, { signal, now = Date.now } = {}) {
+  const flushed = await coordinator.flushCompletions?.();
+  if (flushed && !flushed.ok) throw new Error(identityCoordinationMessage(flushed.reason));
+  const identity = coordinator.current();
+  if (!identity) throw new Error("Verified identity unavailable");
+  const queuedAt = now();
+  const deadline = queuedAt + GH_TIMEOUT_MS;
+  const nonce = governorId();
+  let acquired = false;
+  try {
+    for (;;) {
+      if (signal?.aborted) throw new Error("Request cancelled");
+      if (coordinator.current()?.accessKey !== identity.accessKey) throw new Error("Credential changed before request start");
+      if (now() >= deadline) throw new Error(identityCoordinationMessage("transport-busy"));
+      const result = withIdentityRegistry(coordinator.root, (state) => {
+        const migration = inspectLegacyMigration(coordinator.root, state, now());
+        if (!migration.ok) return migration;
+        if (now() >= deadline) return { ok: false, reason: "transport-busy", retryAt: deadline };
+        const transport = state.hosts[identity.host] ??= { lastStartedAt: 0, cooldownUntil: 0, permit: null, waiters: [], throttle: emptyTransportThrottle() };
+        // Five consecutive throttles means the ladder has stopped being useful.
+        // Waiting out the deadline is what produced the last one, so the pause
+        // holds until a person retries or a primary reset opens a recovery.
+        if (transport.throttle?.paused) {
+          return { ok: false, reason: "throttle-paused", retryAt: transport.cooldownUntil };
+        }
+        if (transport.permit && staleHttpPermit(transport.permit, now())) transport.permit = null;
+        // Admission can happen during the mandatory start gap. Persist call
+        // order once so later polling cannot overtake an earlier caller.
+        if (!transport.waiters.some((waiter) => waiter.nonce === nonce)) {
+          if (transport.waiters.length >= HTTP_MAX_WAITERS) return { ok: false, reason: "identity-capacity" };
+          transport.waiters.push({ pid: process.pid, nonce, queuedAt, deadline });
+        }
+        const retryAt = Math.max(transport.cooldownUntil, transport.lastStartedAt + HTTP_START_GAP_MS);
+        if (transport.permit || transport.waiters[0].nonce !== nonce || retryAt > now()) {
+          return { ok: false, reason: "transport-busy", retryAt: Math.max(retryAt, now() + 50) };
+        }
+        transport.waiters.shift();
+        transport.permit = { pid: process.pid, nonce, startedAt: now() };
+        transport.lastStartedAt = now();
+        return { ok: true, value: { nonce, host: identity.host } };
+      }, { now: now() });
+      if (result.ok) { acquired = true; return result.value; }
+      // A contended registry lock is the same class of wait as a held permit:
+      // both mean "not yet", not "no identity". Only transport-busy carries a
+      // retryAt, so give the rest the poll interval the loop already uses.
+      const retryAt = result.retryAt ?? now() + 50;
+      if ((result.reason !== "transport-busy" && !retryableCoordination(result.reason)) ||
+          now() >= deadline || retryAt >= deadline) throw new Error(identityCoordinationMessage(result.reason));
+      await new Promise((resolve) => setTimeout(resolve, Math.max(1, Math.min(50, retryAt - now()))));
+    }
+  } finally {
+    if (!acquired) {
+      const cleanup = () => withIdentityRegistry(coordinator.root, (state) => {
+        const transport = state.hosts[identity.host];
+        if (transport) transport.waiters = transport.waiters.filter((waiter) => waiter.nonce !== nonce);
+        return { ok: true };
+      }, { now: now() });
+      const cleaned = cleanup();
+      if (!cleaned.ok) coordinator.deferCompletion?.(`waiter:${nonce}`, cleanup);
+    }
+  }
+}
+
+// One cooldown law, two call sites: the bootstrap observer reads its evidence
+// from a parsed response, the permit release from a failed subprocess's captured
+// output. They had already drifted into two implementations with two different
+// secondary-limit detectors -- which is how a tuning applied to one quietly
+// stops applying to the other.
+const SECONDARY_LIMIT_PATTERN = /secondary rate|abuse/i;
+
+// The locally chosen delay climbs by consecutive throttle and stops climbing at
+// fifteen minutes. The cap bounds only what this client invents for itself: a
+// server that asks for two hours is given two hours, because it knows something
+// we do not.
+const THROTTLE_LADDER_MS = [60_000, 120_000, 240_000, 480_000, 900_000];
+// After this many consecutive throttles the transport stops choosing new delays
+// and waits for a person or a primary reset. Climbing forever keeps a wedged
+// credential politely hammering a limit it has no way to satisfy.
+const THROTTLE_PAUSE_AFTER = 5;
+
+function throttleLadderMs(priorThrottles) {
+  const step = Number.isSafeInteger(priorThrottles) && priorThrottles > 0 ? priorThrottles : 0;
+  return THROTTLE_LADDER_MS[Math.min(step, THROTTLE_LADDER_MS.length - 1)];
+}
+
+// Reads throttle evidence without inventing any. The case this exists to get
+// right is the permission-only 403: it carries the same status as an exhausted
+// primary limit and is not a throttle at all, so treating it as one pauses a
+// pane that was never limited -- it was just not allowed.
+function classifyThrottle({ status = null, headers = null, graphqlErrors = null, stderr = "", body = null } = {}) {
+  const header = (name) => {
+    const value = headers?.[name];
+    return typeof value === "string" ? value.trim() : null;
+  };
+  const integer = (name) => {
+    const value = Number(header(name));
+    return Number.isSafeInteger(value) ? value : null;
+  };
+  const secondary = SECONDARY_LIMIT_PATTERN.test([
+    String(body?.message ?? ""),
+    String(stderr ?? ""),
+    ...(Array.isArray(graphqlErrors)
+      ? graphqlErrors.map((error) => `${error?.type ?? ""} ${error?.message ?? ""}`)
+      : []),
+  ].join("\n"));
+  const retryAfter = header("retry-after");
+  const remaining = integer("x-ratelimit-remaining");
+  const reset = integer("x-ratelimit-reset");
+  const resource = header("x-ratelimit-resource")?.toLowerCase() ?? null;
+  // The counter itself says there is nothing left. That holds its own resource
+  // until its own reset, and says nothing about the other one.
+  if (!secondary && remaining === 0 && reset !== null && RATE_RESOURCES.includes(resource) &&
+      (status === 403 || status === 429)) {
+    return { kind: "primary", resource, resetMs: reset * 1000 };
+  }
+  if (retryAfter !== null || secondary || status === 429) {
+    return { kind: "secondary", retryAfter, secondary, status };
+  }
+  return { kind: "none" };
+}
+
+function transportCooldownDeadline({ retryAfter, status, secondary, at, attempts = 0 }) {
+  const supplied = typeof retryAfter === "string" && /^\d+(?:\.\d+)?$/.test(retryAfter)
+    ? at + Number(retryAfter) * 1000
+    : Date.parse(retryAfter ?? "");
+  // A deadline the server supplied is honoured exactly, however long. Only the
+  // delay chosen here is laddered, and only it is capped.
+  if (Number.isFinite(supplied)) return supplied;
+  return status === 429 || secondary === true ? at + throttleLadderMs(attempts) : null;
+}
+
+function emptyTransportThrottle() {
+  return { attempts: 0, lastAt: 0, paused: false };
+}
+
+function applyTransportCooldown(transport, evidence) {
+  const throttle = transport.throttle ?? emptyTransportThrottle();
+  const deadline = transportCooldownDeadline({ ...evidence, attempts: throttle.attempts });
+  if (deadline === null) return null;
+  // Merged by maximum, so a shorter concurrent error never shortens a hold
+  // another response already established, and the hold survives a primary epoch
+  // change: secondary limits are not accounted in the primary counter.
+  transport.cooldownUntil = Math.max(transport.cooldownUntil, deadline);
+  const attempts = Math.min(throttle.attempts + 1, THROTTLE_PAUSE_AFTER);
+  transport.throttle = { attempts, lastAt: evidence.at, paused: attempts >= THROTTLE_PAUSE_AFTER };
+  return transport.cooldownUntil;
+}
+
+// A request that came back carrying no throttle evidence is the only thing that
+// proves the hold is over, so it is the only thing that resets the ladder.
+// Merely waiting out a deadline does not: that is what produced the next
+// throttle last time.
+function clearTransportThrottle(transport) {
+  if (transport && transport.throttle && transport.throttle.attempts > 0) {
+    transport.throttle = emptyTransportThrottle();
+  }
+}
+
+function releaseIdentityHttpPermit(coordinator, permit, error = null) {
+  return withIdentityRegistry(coordinator.root, (state) => {
+    const transport = state.hosts[permit.host];
+    if (transport?.permit?.nonce === permit.nonce) transport.permit = null;
+    if (transport && error) {
+      const response = parseGhApiResponse(error.stdout ?? "");
+      const verdict = classifyThrottle({
+        status: response.status,
+        headers: response.headers,
+        stderr: error.stderr,
+      });
+      // A permission-only 403 reaches here too. It is a failure, but it is not a
+      // throttle, and holding the shared transport for it would pause every
+      // pane over one repository the user cannot read.
+      if (verdict.kind === "secondary") {
+        applyTransportCooldown(transport, {
+          retryAfter: verdict.retryAfter,
+          status: verdict.status,
+          secondary: verdict.secondary,
+          at: Date.now(),
+        });
+      }
+    } else if (transport && !error) {
+      clearTransportThrottle(transport);
+    }
+    return { ok: true };
+  });
+}
+
+// The explicit retry a paused transport waits for. Clears the ladder and the
+// deadline together: a person choosing to retry is choosing to spend the next
+// request finding out, which is exactly the recovery election the pause defers.
+function retryThrottledTransport(root, host, { now = Date.now } = {}) {
+  return withIdentityRegistry(root, (state) => {
+    const transport = state.hosts[host];
+    if (!transport?.throttle?.paused) return { ok: true, value: { resumed: false } };
+    transport.throttle = emptyTransportThrottle();
+    transport.cooldownUntil = Math.min(transport.cooldownUntil, now());
+    return { ok: true, value: { resumed: true } };
+  }, { now: now() });
+}
+
+function identityCoordinationMessage(reason) {
+  if (reason === "restart-required") return "Restart required: close older gh-glance panes";
+  if (["migration-hold", "legacy-unresolved"].includes(reason)) return "Upgrade waiting for legacy quota reset";
+  if (["legacy-corrupt", "corrupt"].includes(reason)) return "Coordination state unavailable; evidence preserved";
+  if (reason === "transport-busy") return "Shared HTTP request or cooldown in progress";
+  if (reason === "throttle-paused") return "Paused after repeated rate limits; refresh to retry";
+  if (retryableCoordination(reason)) return "Coordinating with your other panes";
+  if (reason === "identity-capacity") return "Coordination state full; retrying after the current window";
+  return "Verified identity unavailable; waiting to retry";
+}
+
 // ---------- Shared account governor ----------
 
 // The scope version is deliberately stable. Stored protocol revisions must use
 // the same file so an older process sees the new exact shape and fails closed
 // instead of coordinating through a second file.
 const GOVERNOR_SCOPE_VERSION = 1;
-const GOVERNOR_STATE_VERSION = 2;
+// 3: GraphQL budgets carry `graphql-observer` provenance. An older build does
+// not know that source and would reject the budget -- and normalizeGovernorState
+// turns one rejected budget into total loss, discarding every live pane's
+// leases, intents and reservations. The version gate makes it fail closed on the
+// file instead, which is the whole point of having one.
+// 4: observer claims, readiness and outcomes are per resource, so the schema
+// shape changed rather than a field's contents. Replaced atomically -- an older
+// build must fail closed on the version gate rather than half-read it.
+// 5: scheduling fairness is persisted, because the starvation it prevents
+// happens *between* planning passes -- each manual refresh is its own pass, so
+// a counter that lives only inside one cannot see a run of them.
+const GOVERNOR_STATE_VERSION = 5;
+// Readable-as-evidence, never written: the shapes a still-running older pane
+// holds. Recognising that such a pane owns a live lease is what the restart
+// boundary depends on.
+const LEGACY_GOVERNOR_VERSIONS = [GOVERNOR_STATE_VERSION, 4, 3, 2];
+// The first version whose file is already in the per-resource observer shape.
+// Anything below it is adapted before it can be read; see readLegacyGovernorState.
+const GOVERNOR_OBSERVER_SPLIT_VERSION = 4;
+// The first version carrying persisted scheduling fairness. A version 4 file is
+// otherwise in the current shape and only wants the field defaulted.
+const GOVERNOR_FAIRNESS_VERSION = 5;
+// Manual work outranks active work, which is right until it means "always". A
+// user holding the refresh key issues one manual intent per planning pass, and
+// without a bound the active owner behind them never gets a turn at all.
+const MANUAL_GRANT_STREAK_LIMIT = 3;
 const GOVERNOR_MAX_LEASES = 128;
 const GOVERNOR_MAX_INTENTS = 512;
 const GOVERNOR_MAX_RESERVATIONS = 512;
@@ -1965,7 +3203,8 @@ function currentGovernorScope(scope) {
   } catch {
     return { ok: false, reason: "stale" };
   }
-  const hash = governorScopeHash(current?.effectiveHost, current?.authIdentity);
+  const hash = scope.quotaKey ? current?.quotaKey : governorScopeHash(current?.effectiveHost, current?.authIdentity);
+  if (scope.quotaKey && current?.accessKey !== scope.accessKey) return { ok: false, reason: "stale" };
   return hash === scope.hash ? { ok: true, value: scope } : { ok: false, reason: "stale" };
 }
 
@@ -1974,11 +3213,16 @@ function emptyGovernorState() {
     version: GOVERNOR_STATE_VERSION,
     epochs: { core: null, graphql: null },
     budgets: {},
-    observers: {
-      core: { etag: null, outcome: "idle", at: 0, nextAt: 0 },
-    },
-    probeClaim: null,
-    probeOutcome: { status: "idle", at: 0, nextAt: 0 },
+    fairness: { manualStreak: 0 },
+    // Symmetric on purpose. Core observer state lived in `observers.core` while
+    // the GraphQL one lived in a differently-shaped `probeOutcome`, and a single
+    // `probeClaim` serialized both -- so a slow or failed observer for one
+    // resource held up the other's readiness for no reason the resources
+    // themselves impose.
+    observers: Object.fromEntries(RATE_RESOURCES.map((resource) => [
+      resource, { etag: null, outcome: "idle", at: 0, nextAt: 0 },
+    ])),
+    probeClaims: Object.fromEntries(RATE_RESOURCES.map((resource) => [resource, null])),
     leases: {},
     intents: {},
     reservations: {},
@@ -2013,8 +3257,12 @@ function normalizeGovernorBudget(raw, nowMs, resource = null) {
     (raw.blockReason !== null && !GOVERNOR_BLOCK_REASONS.has(raw.blockReason)) ||
     (raw.roundRobinCursor !== null && !validGovernorId(raw.roundRobinCursor)) ||
     !Number.isFinite(raw.lastExternalFactor) || raw.lastExternalFactor < 1 ||
-    !["response-header", "core-observer", "rate-limit-probe"].includes(raw.source) ||
-    raw.source === "rate-limit-probe" && resource === "core" ||
+    !["response-header", "core-observer", "graphql-observer", "rate-limit-probe"].includes(raw.source) ||
+    // "rate-limit-probe" is retained as readable legacy provenance only: ledgers
+    // written before the claimed GraphQL observer existed still carry it. Nothing
+    // writes it any more, and neither it nor the GraphQL observer may ever stand
+    // as core authority.
+    ["rate-limit-probe", "graphql-observer"].includes(raw.source) && resource === "core" ||
     !exactKeys(raw.factorBaseline, ["epoch", "used", "observedAt"]) ||
     !validGovernorEpoch(raw.factorBaseline.epoch) ||
     !Number.isSafeInteger(raw.factorBaseline.used) || raw.factorBaseline.used < 0 ||
@@ -2098,7 +3346,7 @@ function normalizeGovernorReservation(raw, nowMs) {
   return { ...raw, costs, actualCosts, accountedCosts, epochs };
 }
 
-function normalizeCoreObserver(raw, nowMs) {
+function normalizeResourceObserver(raw, nowMs) {
   if (!exactKeys(raw, ["etag", "outcome", "at", "nextAt"])) return null;
   if (
     raw.etag !== null && (typeof raw.etag !== "string" || raw.etag.length === 0) ||
@@ -2112,24 +3360,19 @@ function normalizeCoreObserver(raw, nowMs) {
 function normalizeProbeClaim(raw, nowMs) {
   if (raw === null) return null;
   if (!exactKeys(raw, [
-    "ownerLeaseId", "nonce", "leaseUntil", "nextAt", "claimAt", "startedReservationIds", "resources",
+    "ownerLeaseId", "nonce", "leaseUntil", "nextAt", "claimAt", "startedReservationIds",
   ])) {
     return undefined;
   }
-  const resources = Array.isArray(raw.resources) && raw.resources.length > 0 &&
-    raw.resources.every((resource) => RATE_RESOURCES.includes(resource))
-    ? [...new Set(raw.resources)]
-    : null;
   if (
     !validGovernorId(raw.ownerLeaseId) || !validGovernorId(raw.nonce) ||
     finiteTimestamp(raw.leaseUntil, nowMs) === undefined ||
     finiteTimestamp(raw.nextAt, nowMs) === undefined ||
     finiteTimestamp(raw.claimAt, nowMs) === undefined || raw.claimAt > nowMs ||
     !Array.isArray(raw.startedReservationIds) || raw.startedReservationIds.length > GOVERNOR_MAX_RESERVATIONS ||
-    raw.startedReservationIds.some((id) => !id.startsWith("reservation:") || !validGovernorId(id.slice(12))) ||
-    !resources
+    raw.startedReservationIds.some((id) => !id.startsWith("reservation:") || !validGovernorId(id.slice(12)))
   ) return undefined;
-  return { ...raw, startedReservationIds: [...new Set(raw.startedReservationIds)], resources };
+  return { ...raw, startedReservationIds: [...new Set(raw.startedReservationIds)] };
 }
 
 function normalizeManualProbe(raw, nowMs) {
@@ -2144,29 +3387,34 @@ function normalizeManualProbe(raw, nowMs) {
   return { ...raw };
 }
 
-function normalizeGovernorState(raw, nowMs, { prune = true } = {}) {
+// `acceptVersion` exists for one caller: the legacy inspector, which must be
+// able to *read* a still-running older pane's file to see its live leases. It
+// never publishes what it reads. Every other caller takes the default, so a
+// version this build does not write is unreadable and fails closed.
+function normalizeGovernorState(raw, nowMs, { prune = true, acceptVersion = GOVERNOR_STATE_VERSION } = {}) {
   if (!exactKeys(raw, [
-    "version", "epochs", "budgets", "observers", "probeClaim", "probeOutcome", "leases",
+    "version", "epochs", "budgets", "fairness", "observers", "probeClaims", "leases",
     "intents", "reservations", "manualProbe",
-  ]) || raw.version !== GOVERNOR_STATE_VERSION) return null;
+  ]) || raw.version !== acceptVersion) return null;
+  if (!exactKeys(raw.fairness, ["manualStreak"]) ||
+      !Number.isSafeInteger(raw.fairness.manualStreak) || raw.fairness.manualStreak < 0) return null;
   if (
     !exactKeys(raw.epochs, RATE_RESOURCES) ||
     RATE_RESOURCES.some((resource) => raw.epochs[resource] !== null && !validGovernorEpoch(raw.epochs[resource])) ||
     !isRecord(raw.budgets) || Object.keys(raw.budgets).some((resource) => !RATE_RESOURCES.includes(resource)) ||
-    !exactKeys(raw.observers, ["core"]) ||
-    !isRecord(raw.leases) || !isRecord(raw.intents) || !isRecord(raw.reservations) ||
-    !exactKeys(raw.probeOutcome, ["status", "at", "nextAt"]) ||
-    !GOVERNOR_PROBE_STATUSES.has(raw.probeOutcome.status) ||
-    finiteTimestamp(raw.probeOutcome.at, nowMs) === undefined ||
-    raw.probeOutcome.at > nowMs ||
-    finiteTimestamp(raw.probeOutcome.nextAt, nowMs) === undefined
+    !exactKeys(raw.observers, RATE_RESOURCES) ||
+    !exactKeys(raw.probeClaims, RATE_RESOURCES) ||
+    !isRecord(raw.leases) || !isRecord(raw.intents) || !isRecord(raw.reservations)
   ) return null;
 
   const state = emptyGovernorState();
   state.epochs = { ...raw.epochs };
-  state.probeOutcome = { ...raw.probeOutcome };
-  state.observers.core = normalizeCoreObserver(raw.observers.core, nowMs);
-  if (!state.observers.core) return null;
+  state.fairness = { ...raw.fairness };
+  for (const resource of RATE_RESOURCES) {
+    const observer = normalizeResourceObserver(raw.observers[resource], nowMs);
+    if (!observer) return null;
+    state.observers[resource] = observer;
+  }
   for (const resource of Object.keys(raw.budgets)) {
     const budget = normalizeGovernorBudget(raw.budgets[resource], nowMs, resource);
     if (!budget) return null;
@@ -2196,21 +3444,75 @@ function normalizeGovernorState(raw, nowMs, { prune = true } = {}) {
     ) state.reservations[id] = reservation;
   }
   if (Object.keys(state.reservations).length > GOVERNOR_MAX_RESERVATIONS) return null;
-  state.probeClaim = normalizeProbeClaim(raw.probeClaim, nowMs);
-  if (state.probeClaim === undefined) return null;
-  if (state.probeClaim?.leaseUntil <= nowMs) state.probeClaim = null;
+  for (const resource of RATE_RESOURCES) {
+    const claim = normalizeProbeClaim(raw.probeClaims[resource], nowMs);
+    if (claim === undefined) return null;
+    state.probeClaims[resource] = claim?.leaseUntil > nowMs ? claim : null;
+  }
   state.manualProbe = normalizeManualProbe(raw.manualProbe, nowMs);
   if (state.manualProbe === undefined) return null;
   return state;
 }
 
+// Reads a still-running older pane's file as evidence. A version number alone
+// is not enough to identify a document: versions 2 and 3 share a *shape* that
+// version 4 replaced, so accepting their version against the current key set
+// would reject every real file they wrote. Read-only -- the result is never
+// published and the file is never rewritten.
+function readLegacyGovernorState(raw, nowMs, version) {
+  if (!isRecord(raw) || raw.version !== version) return null;
+  const options = { prune: false, acceptVersion: version };
+  if (version >= GOVERNOR_FAIRNESS_VERSION) return normalizeGovernorState(raw, nowMs, options);
+  // A version 4 file is already in the per-resource observer shape and differs
+  // only by the field this version added, so defaulting it is the whole
+  // adaptation. Older files need their observer shape rewritten first.
+  const shaped = version >= GOVERNOR_OBSERVER_SPLIT_VERSION ? { ...raw } : adaptPreSplitGovernorShape(raw);
+  if (!shaped) return null;
+  shaped.fairness = { manualStreak: 0 };
+  return normalizeGovernorState(shaped, nowMs, options);
+}
+
+// Versions 2 and 3 held one observer for core, a differently shaped
+// `probeOutcome` standing in for GraphQL, and a single claim naming the
+// resources it covered. Rewrite that into the current shape so the inspector
+// above can see the leases, deadlines and uncertain work such a pane holds.
+// The claim's own `resources` list says which resources it covered, so
+// splitting it in two reads the file rather than guessing at it.
+function adaptPreSplitGovernorShape(raw) {
+  if (!exactKeys(raw, [
+    "version", "epochs", "budgets", "observers", "probeClaim", "probeOutcome",
+    "leases", "intents", "reservations", "manualProbe",
+  ])) return null;
+  if (!exactKeys(raw.observers, ["core"])) return null;
+  if (!exactKeys(raw.probeOutcome, ["status", "at", "nextAt"])) return null;
+  if (raw.probeClaim !== null && !isRecord(raw.probeClaim)) return null;
+  const { resources, ...claim } = raw.probeClaim ?? {};
+  const covered = Array.isArray(resources) ? resources : [];
+  const adapted = structuredClone(raw);
+  delete adapted.probeClaim;
+  delete adapted.probeOutcome;
+  adapted.observers = {
+    core: raw.observers.core,
+    graphql: {
+      etag: null,
+      outcome: raw.probeOutcome.status,
+      at: raw.probeOutcome.at,
+      nextAt: raw.probeOutcome.nextAt,
+    },
+  };
+  adapted.probeClaims = Object.fromEntries(RATE_RESOURCES.map((resource) => [
+    resource, raw.probeClaim && covered.includes(resource) ? structuredClone(claim) : null,
+  ]));
+  return adapted;
+}
+
 function serializeGovernorState(state) {
   return `${JSON.stringify(state)}\n`;
 }
 
 function migrateGovernorState(raw, nowMs) {
   if (!exactKeys(raw, [
-    "version", "epochs", "budgets", "probeClaim", "probeOutcome", "leases",
+    "version", "epochs", "budgets", "probeClaim", "probeOutcome", "leases",  // v1 shape
     "intents", "reservations", "manualProbe",
   ]) || raw.version !== 1 || !isRecord(raw.budgets) || !isRecord(raw.reservations)) return null;
   const migrated = structuredClone(raw);
@@ -2220,20 +3522,28 @@ function migrateGovernorState(raw, nowMs) {
   // preserve it as bootstrap evidence. GraphQL remains valid.
   delete migrated.budgets.core;
   migrated.epochs.core = null;
-  if (migrated.budgets.graphql) {
-    const budget = migrated.budgets.graphql;
-    budget.source = "rate-limit-probe";
-    budget.factorBaseline = {
-      epoch: budget.epoch,
-      used: budget.used,
-      observedAt: budget.observedAt,
-    };
-    budget.knownLocalUsed = 0;
-  }
+  // The v1 GraphQL value came from /rate_limit, for the same reason the core
+  // value did, and is dropped for the same reason: this phase makes that
+  // endpoint explicitly non-authoritative, and "never a source of spendable
+  // capacity" cannot have an exception for numbers that arrived before the rule.
+  // Keeping it would let a migrated pane admit GraphQL work against it and let
+  // it establish the epoch later headers refine. The claimed observer
+  // re-establishes capacity on the next probe.
+  delete migrated.budgets.graphql;
+  migrated.epochs.graphql = null;
   for (const reservation of Object.values(migrated.reservations)) {
     reservation.accountedCosts = { core: 0, graphql: 0 };
   }
-  if (migrated.probeClaim) migrated.probeClaim.resources = [...RATE_RESOURCES];
+  // v1 carried one claim for both resources; the new shape has one per resource
+  // and a migrated claim belongs to neither, so it is dropped rather than
+  // guessed at. The next probe re-claims what is actually due.
+  delete migrated.probeClaim;
+  delete migrated.probeOutcome;
+  migrated.observers = Object.fromEntries(RATE_RESOURCES.map((resource) => [
+    resource, { etag: null, outcome: "idle", at: 0, nextAt: 0 },
+  ]));
+  migrated.probeClaims = Object.fromEntries(RATE_RESOURCES.map((resource) => [resource, null]));
+  migrated.fairness = { manualStreak: 0 };
   return normalizeGovernorState(migrated, nowMs);
 }
 
@@ -2410,6 +3720,16 @@ function withGovernorLock(scope, operation, {
   kill = scope?.kill ?? process.kill.bind(process),
   observeArtifact = null,
 } = {}) {
+  if (scope?.coordinationRoot && !scope.rootLocked) {
+    return withIdentityRegistry(scope.coordinationRoot, (registry, at) => {
+      const migration = inspectLegacyMigration(scope.coordinationRoot, registry, at);
+      if (!migration.ok) return migration;
+      if (registry.identities[scope.credentialKey]) {
+        try { statSync(scope.path); } catch { return { ok: false, reason: "corrupt" }; }
+      }
+      return withGovernorLock({ ...scope, rootLocked: true }, operation, { pid, nonce, waitMs, kill, observeArtifact });
+    }, { now: scopeNow(scope), kill });
+  }
   const current = currentGovernorScope(scope);
   if (!current.ok) return current;
   const lockPath = `${scope.path}.lock`;
@@ -2506,6 +3826,33 @@ function mutateGovernor(scope, nowMs, mutate) {
   });
 }
 
+// The largest single operation the governor will ever admit. Returned pacing is
+// capped at one of these so an idle stretch cannot accumulate into a burst: at
+// most one operation's worth of the lane is ever given back at a time.
+const GOVERNOR_MAX_ATOMIC_COST = Math.max(...Object.values(OPERATION_COSTS)
+  .flatMap((costs) => RATE_RESOURCES.map((resource) => costs?.[resource] ?? 0)));
+
+// A grant paces the lane by what it *reserved*, which is a worst case. When the
+// request costs less than that -- a 304 costs nothing -- or never happens at
+// all, the difference is capacity paced away for nobody, and the next request
+// waits out a slot no one used.
+//
+// The lane is never pulled earlier than the transport gap, which is what keeps
+// this from becoming a burst. Recomputing the rate here can differ from the
+// rate at grant time if capacity has since changed, so the returned credit is
+// an estimate rather than an exact reversal; that is safe because admission
+// still re-checks affordability against the reserve before anything starts.
+// Pacing decides when work may go, never whether it may.
+function returnPacingCredit(state, resource, unusedCost, nowMs) {
+  const budget = state.budgets[resource];
+  if (!budget || !(unusedCost > 0)) return;
+  const decision = resourceDecision({ budget, resource, nowMs, cost: 0, chargedCost: 0 });
+  const callsPerMs = decision?.callsPerMs;
+  if (!Number.isFinite(callsPerMs) || callsPerMs <= 0) return;
+  const credit = Math.min(unusedCost, GOVERNOR_MAX_ATOMIC_COST) / callsPerMs;
+  budget.laneNextAt = Math.max(nowMs + HTTP_START_GAP_MS, budget.laneNextAt - credit);
+}
+
 function scheduleGovernorState(state, nowMs) {
   if (Object.keys(state.intents).length === 0) return { grants: [], denied: [] };
   let reservationCount = Object.keys(state.reservations).length;
@@ -2517,7 +3864,7 @@ function scheduleGovernorState(state, nowMs) {
       ? [[resource, state.budgets[resource].roundRobinCursor]]
       : [],
   ));
-  const deferredBackground = state.probeOutcome.status === "failed"
+  const deferredBackground = state.observers.graphql.outcome === "failed"
     ? Object.entries(state.intents)
       .filter(([, intent]) => intentPriority(intent) === REQUEST_PRIORITIES.background)
       .map(([id]) => id)
@@ -2538,7 +3885,9 @@ function scheduleGovernorState(state, nowMs) {
     cursors,
     nowMs,
     maxGrants: GOVERNOR_MAX_RESERVATIONS - reservationCount,
+    manualStreak: state.fairness.manualStreak,
   });
+  state.fairness.manualStreak = result.manualStreak;
   result.denied.push(...deferredBackground.map((intentId) => ({
     intentId,
     mode: "paused",
@@ -2625,76 +3974,79 @@ function maintainControlLease(scope, leaseId, floorMs, activeTab, nowMs) {
     : registered;
 }
 
-function claimProbe(scope, leaseId, nowMs) {
+// Claims the observer for one resource. Independence is the point: a slow or
+// failed GraphQL observer must not hold up core readiness, because nothing about
+// the resources themselves couples them. What still couples them is the shared
+// HTTP permit and any account-wide secondary hold, and those are enforced
+// elsewhere -- not by making one claim stand for both.
+function claimProbe(scope, leaseId, nowMs, resource) {
+  if (!RATE_RESOURCES.includes(resource)) return { ok: false, reason: "corrupt" };
   return mutateGovernor(scope, nowMs, (state, at) => {
     if (!state.leases[leaseId]) return { ok: false, reason: "stale" };
-    if (state.probeClaim && state.probeClaim.leaseUntil > at) {
-      return { value: { status: "waiting", leaseUntil: state.probeClaim.leaseUntil } };
+    const held = state.probeClaims[resource];
+    if (held && held.leaseUntil > at) {
+      return { value: { status: "waiting", leaseUntil: held.leaseUntil } };
     }
+    const resetAt = Number.isFinite(state.budgets[resource]?.resetMs)
+      ? state.budgets[resource].resetMs + BUDGET_RESET_GRACE_MS
+      : Number.POSITIVE_INFINITY;
+    // A core reset starts a new shared accounting epoch, so the GraphQL counter
+    // is also due then: external-spend baselines and the protected
+    // one-publication reset contract have to advance together.
     const coreResetAt = Number.isFinite(state.budgets.core?.resetMs)
       ? state.budgets.core.resetMs + BUDGET_RESET_GRACE_MS
       : Number.POSITIVE_INFINITY;
-    const graphqlResetAt = Number.isFinite(state.budgets.graphql?.resetMs)
-      ? state.budgets.graphql.resetMs + BUDGET_RESET_GRACE_MS
+    // ...but only until it has actually observed since that reset. Left
+    // unqualified, every pane keeps qualifying for as long as core has not
+    // published its new epoch, so a reset draws a stampede of GraphQL observers
+    // instead of the one the shared epoch needs. The publication used to close
+    // that window as a side effect of being read first; saying it here means it
+    // does not depend on which resource a refresh happens to reach first.
+    const dueAtCoreReset = resource === "graphql" &&
+      state.observers.graphql.at < coreResetAt
+      ? coreResetAt
       : Number.POSITIVE_INFINITY;
-    const dueAt = {
-      core: Math.min(
-        state.observers.core.nextAt,
-        coreResetAt,
-      ),
-      graphql: Math.min(
-        state.probeOutcome.nextAt,
-        graphqlResetAt,
-        // A core reset starts a new shared accounting epoch. Refresh the free
-        // GraphQL counter in that same nonce so external-spend baselines and
-        // the protected one-publication reset contract advance together.
-        coreResetAt,
-      ),
-    };
-    const nextAt = Math.min(...Object.values(dueAt));
+    const nextAt = Math.min(
+      state.observers[resource].nextAt,
+      resetAt,
+      dueAtCoreReset,
+    );
     if (nextAt > at) return { value: { status: "waiting", nextAt } };
-    // One nonce owns the control-plane transition, but only the sources whose
-    // persisted clocks are due may be read. In particular, a GraphQL minute
-    // sample cannot spend or retry the held core observer before its reset.
-    const resources = RATE_RESOURCES.filter((resource) => dueAt[resource] <= at);
     const nonce = randomUUID();
     const startedReservationIds = Object.entries(state.reservations)
       // An expired owner can no longer settle its request. Keep that uncertain
       // cost charged, but do not make every later probe wait for it to finish.
+      // Only work charging this resource is drained -- an unrelated lane's
+      // outstanding request says nothing about this counter.
       .filter(([, reservation]) => reservation.status === "started" &&
-        state.leases[reservation.leaseId]?.expiresAt > at)
+        state.leases[reservation.leaseId]?.expiresAt > at &&
+        reservationCost(reservation, resource, state.leases, at) > 0)
       .map(([id]) => id);
-    state.probeClaim = {
+    state.probeClaims[resource] = {
       ownerLeaseId: leaseId,
       nonce,
       leaseUntil: at + GOVERNOR_PROBE_LEASE_MS,
       nextAt: at,
       claimAt: at,
       startedReservationIds,
-      resources,
     };
-    if (resources.includes("core")) {
-      state.observers.core.outcome = "waiting";
-      state.observers.core.at = at;
-      state.observers.core.nextAt = at + GOVERNOR_PROBE_LEASE_MS;
-    }
-    if (resources.includes("graphql")) {
-      state.probeOutcome = { status: "waiting", at, nextAt: at + GOVERNOR_PROBE_LEASE_MS };
-    }
+    state.observers[resource].outcome = "waiting";
+    state.observers[resource].at = at;
+    state.observers[resource].nextAt = at + GOVERNOR_PROBE_LEASE_MS;
     return { value: {
       status: "claimed",
       nonce,
-      leaseUntil: state.probeClaim.leaseUntil,
+      resource,
+      leaseUntil: state.probeClaims[resource].leaseUntil,
       startedReservationIds,
-      resources,
-      coreEtag: state.observers.core.etag,
+      coreEtag: state.observers[resource].etag,
     } };
   });
 }
 
-function renewProbeClaim(scope, leaseId, nonce, nowMs) {
+function renewProbeClaim(scope, leaseId, nonce, nowMs, resource) {
   return mutateGovernor(scope, nowMs, (state, at) => {
-    const claim = state.probeClaim;
+    const claim = state.probeClaims[resource];
     if (!claim || claim.ownerLeaseId !== leaseId || claim.nonce !== nonce || claim.leaseUntil <= at) {
       return { ok: false, reason: "stale" };
     }
@@ -2714,8 +4066,8 @@ function budgetFromObservation(raw, previous, nowMs, {
   if (
     !normalized || normalized.resetMs <= nowMs || receivedAt > nowMs ||
     !RATE_RESOURCES.includes(resource) ||
-    !["response-header", "core-observer", "rate-limit-probe"].includes(source) ||
-    resource === "core" && source === "rate-limit-probe"
+    !["response-header", "core-observer", "graphql-observer", "rate-limit-probe"].includes(source) ||
+    resource === "core" && ["rate-limit-probe", "graphql-observer"].includes(source)
   ) return { status: "invalid" };
   const epoch = `${normalized.limit}:${normalized.resetMs}`;
   // Endpoint responses can carry cached or endpoint-specific rate headers.
@@ -2752,7 +4104,13 @@ function budgetFromObservation(raw, previous, nowMs, {
     blockReason: blockActive ? previous.blockReason : null,
     laneNextAt: epochChanged ? nowMs : previous.laneNextAt,
     roundRobinCursor: previous?.roundRobinCursor ?? null,
-    lastExternalFactor: previous?.lastExternalFactor ?? 1,
+    // A new epoch is a new accounting window, so what other clients did in the
+    // last one is not evidence about this one. The baseline and the local
+    // accumulation below are already reset here; carrying the factor across
+    // kept throttling this window on a ratio measured in a window that is over.
+    // Only a claimed observer can open an epoch, so this cannot be moved by a
+    // stale or reordered response.
+    lastExternalFactor: epochChanged ? 1 : (previous?.lastExternalFactor ?? 1),
     epoch,
     source,
     factorBaseline: epochChanged || !previous?.factorBaseline
@@ -2763,25 +4121,29 @@ function budgetFromObservation(raw, previous, nowMs, {
   return { status: "accepted", budget: next, epochChanged };
 }
 
-function publishProbe(scope, leaseId, nonce, budgets, nowMs) {
+function publishProbe(scope, leaseId, nonce, budgets, nowMs, resource) {
   return mutateGovernor(scope, nowMs, (state, at) => {
-    const claim = state.probeClaim;
+    const claim = state.probeClaims[resource];
     if (!claim || claim.ownerLeaseId !== leaseId || claim.nonce !== nonce || claim.leaseUntil <= at) {
       return { ok: false, reason: "stale" };
     }
     const nextBudgets = { ...state.budgets };
     const nextEpochs = { ...state.epochs };
+    // Captured before the publication overwrites it: the reset this epoch
+    // change supersedes is the boundary the GraphQL observer is measured against.
+    const supersededCoreResetMs = state.budgets.core?.resetMs;
     const changedResources = [];
     const resetResources = [];
-    if (!claim.resources.every((resource) => budgets?.[resource])) {
-      return { ok: false, reason: "corrupt" };
-    }
-    for (const resource of claim.resources) {
-      const supplied = budgets?.[resource];
-      if (!supplied) continue;
+    if (!budgets?.[resource]) return { ok: false, reason: "corrupt" };
+    const observerCosts = {};
+    {
+      const supplied = budgets[resource];
       const raw = supplied.budget ?? supplied;
-      const source = supplied.source ?? (resource === "core" ? "core-observer" : "rate-limit-probe");
-      const ownerSource = resource === "core" ? "core-observer" : "rate-limit-probe";
+      // The owner source names what actually established the number. Calling a
+      // GraphQL budget a "rate-limit-probe" was accurate when /rate_limit supplied
+      // it and is a lie now that the claimed observer does.
+      const source = supplied.source ?? (resource === "core" ? "core-observer" : "graphql-observer");
+      const ownerSource = resource === "core" ? "core-observer" : "graphql-observer";
       if (source !== ownerSource) return { ok: false, reason: "corrupt" };
       const observed = budgetFromObservation(raw, state.budgets[resource], at, {
         resource,
@@ -2791,15 +4153,20 @@ function publishProbe(scope, leaseId, nonce, budgets, nowMs) {
         allowEpochChange: true,
       });
       if (observed.status === "invalid") return { ok: false, reason: "corrupt" };
-      if (observed.status === "ignored") continue;
-      nextBudgets[resource] = observed.budget;
-      if (resource === "core" && supplied.blocked === true) {
-        nextBudgets[resource].blockUntil = observed.budget.resetMs;
-        nextBudgets[resource].blockReason = "rate-limit";
+      if (observed.status !== "ignored") {
+        // The observer's own cost is local spend. Left out, the external-factor
+        // reconciliation below attributes it to other clients, and the governor
+        // throttles the user's real work to make room for its own probing.
+        observerCosts[resource] = Number.isSafeInteger(supplied.cost) && supplied.cost > 0 ? supplied.cost : 0;
+        nextBudgets[resource] = observed.budget;
+        if (resource === "core" && supplied.blocked === true) {
+          nextBudgets[resource].blockUntil = observed.budget.resetMs;
+          nextBudgets[resource].blockReason = "rate-limit";
+        }
+        nextEpochs[resource] = observed.budget.epoch;
+        changedResources.push(resource);
+        if (observed.epochChanged && state.epochs[resource] !== null) resetResources.push(resource);
       }
-      nextEpochs[resource] = observed.budget.epoch;
-      changedResources.push(resource);
-      if (observed.epochChanged && state.epochs[resource] !== null) resetResources.push(resource);
     }
     if (changedResources.length === 0) return { ok: false, reason: "corrupt" };
     const completedBeforeClaim = Object.entries(state.reservations)
@@ -2817,19 +4184,32 @@ function publishProbe(scope, leaseId, nonce, budgets, nowMs) {
           total + (reservation.completedAt > baseline.observedAt
             ? reservationCost(reservation, resource, state.leases, at)
             : 0), 0);
+      const globalUsedDelta = nextBudgets[resource].used - baseline.used;
+      const sharedCompletedDelta = previous.knownLocalUsed + legacyCompletedDelta + (observerCosts[resource] ?? 0);
       const factor = nextExternalFactor({
         lastExternalFactor: previous.lastExternalFactor,
-        globalUsedDelta: nextBudgets[resource].used - baseline.used,
-        sharedCompletedDelta: previous.knownLocalUsed + legacyCompletedDelta,
+        globalUsedDelta,
+        sharedCompletedDelta,
       });
       if (factor === null) return { ok: false, reason: "corrupt" };
       nextBudgets[resource].lastExternalFactor = factor;
-      nextBudgets[resource].factorBaseline = {
-        epoch: nextBudgets[resource].epoch,
-        used: nextBudgets[resource].used,
-        observedAt: nextBudgets[resource].observedAt,
-      };
-      nextBudgets[resource].knownLocalUsed = 0;
+      // Closing the window costs the evidence in it, so only a window that
+      // actually reconciled may close. Four local units observed twice are
+      // eight, and eight are enough; discarding each four because neither
+      // reached five on its own is what kept a factor of seven alive through
+      // any amount of purely local spend.
+      if (externalSampleIsUsable({ globalUsedDelta, sharedCompletedDelta })) {
+        nextBudgets[resource].factorBaseline = {
+          epoch: nextBudgets[resource].epoch,
+          used: nextBudgets[resource].used,
+          observedAt: nextBudgets[resource].observedAt,
+        };
+        nextBudgets[resource].knownLocalUsed = 0;
+      }
+      // Otherwise both are left exactly as the observation produced them, which
+      // is the previous baseline and the previous local total. Rewriting them
+      // here would count the same completed reservations twice: they are still
+      // in the ledger precisely because the baseline did not advance past them.
     }
     for (const [id, reservation] of completedBeforeClaim) {
       const accountedByEveryResource = RATE_RESOURCES.every((resource) =>
@@ -2839,24 +4219,41 @@ function publishProbe(scope, leaseId, nonce, budgets, nowMs) {
     }
     state.budgets = nextBudgets;
     state.epochs = nextEpochs;
-    state.probeClaim = null;
-    if (claim.resources.includes("core")) {
-      const core = nextBudgets.core;
-      state.observers.core = {
-        etag: typeof budgets.core.etag === "string" ? budgets.core.etag : state.observers.core.etag,
+    state.probeClaims[resource] = null;
+    {
+      const published = nextBudgets[resource];
+      state.observers[resource] = {
+        etag: typeof budgets[resource].etag === "string" ? budgets[resource].etag : state.observers[resource].etag,
         outcome: "healthy",
         at,
-        nextAt: core.remaining === 0
-          ? core.resetMs + BUDGET_RESET_GRACE_MS
+        // A resource observed as empty is due again at its own reset, not at the
+        // ordinary cadence: probing an exhausted counter to be told it is still
+        // exhausted spends against it for nothing.
+        nextAt: published.remaining === 0
+          ? published.resetMs + BUDGET_RESET_GRACE_MS
           : at + BUDGET_PROBE_MS,
       };
     }
-    if (claim.resources.includes("graphql")) {
-      state.probeOutcome = {
-        status: "healthy",
-        at,
-        nextAt: at + BUDGET_PROBE_MS,
-      };
+    // A core reset opens a new shared accounting epoch, so the GraphQL counter
+    // is due with it: external-spend baselines and the protected
+    // one-publication reset contract have to advance together. A refresh that
+    // reads GraphQL before core has already done this, because core's old reset
+    // time still said GraphQL was due when that claim was evaluated. What
+    // cannot see it is a pane whose GraphQL observer last ran before the reset
+    // -- another pane published this epoch first, moving the reset out of
+    // reach. Only that case still owes an observation, so only that case is
+    // pulled forward; marking it unconditionally spends a second point to
+    // re-read a counter this same cycle has just read. An exhausted GraphQL
+    // counter waits for its own reset either way.
+    if (resource === "core" && resetResources.includes("core")) {
+      const graphql = nextBudgets.graphql;
+      const heldToReset = graphql && graphql.remaining === 0 &&
+        at < graphql.resetMs + BUDGET_RESET_GRACE_MS;
+      const observedSinceReset = Number.isFinite(supersededCoreResetMs) &&
+        state.observers.graphql.at >= supersededCoreResetMs;
+      if (!heldToReset && !observedSinceReset) {
+        state.observers.graphql.nextAt = Math.min(state.observers.graphql.nextAt || at, at);
+      }
     }
     if (resetResources.length > 0) state.manualProbe = null;
     else if (state.manualProbe &&
@@ -2873,24 +4270,22 @@ function publishProbe(scope, leaseId, nonce, budgets, nowMs) {
   });
 }
 
-function failProbeClaim(scope, leaseId, nonce, nowMs) {
+function failProbeClaim(scope, leaseId, nonce, nowMs, resource) {
   return mutateGovernor(scope, nowMs, (state, at) => {
-    const claim = state.probeClaim;
+    const claim = state.probeClaims[resource];
     if (!claim || claim.ownerLeaseId !== leaseId || claim.nonce !== nonce) {
       return { ok: false, reason: "stale" };
     }
-    state.probeClaim = null;
-    if (claim.resources.includes("graphql")) {
-      state.probeOutcome = { status: "failed", at, nextAt: at + BUDGET_PROBE_MS };
-    }
-    if (claim.resources.includes("core")) {
-      state.observers.core = {
-        ...state.observers.core,
-        outcome: "failed",
-        at,
-        nextAt: at + BUDGET_PROBE_MS,
-      };
-    }
+    // Only this resource's readiness is affected. A failed GraphQL observer that
+    // also marked core failed would erase authority core had legitimately
+    // established, and stall a lane with nothing wrong with it.
+    state.probeClaims[resource] = null;
+    state.observers[resource] = {
+      ...state.observers[resource],
+      outcome: "failed",
+      at,
+      nextAt: at + BUDGET_PROBE_MS,
+    };
     return { value: { retryAt: at + BUDGET_PROBE_MS } };
   });
 }
@@ -2912,7 +4307,7 @@ function requestManualProbe(scope, leaseId, epoch, observedAt, nowMs) {
         : Math.min(state.observers.core.nextAt || at, at);
     }
     if (state.epochs.graphql === epoch) {
-      state.probeOutcome.nextAt = Math.min(state.probeOutcome.nextAt || at, at);
+      state.observers.graphql.nextAt = Math.min(state.observers.graphql.nextAt || at, at);
     }
     return { value: { status: "pending", ...state.manualProbe } };
   });
@@ -2970,16 +4365,23 @@ function registerIntent(scope, intent) {
   });
 }
 
-function readIntentDecision(scope, intentId, nowMs) {
+function readIntentDecision(scope, intentId, nowMs, previousEvidence = null) {
   return mutateGovernor(scope, nowMs, (state, at) => {
     const scheduled = scheduleGovernorState(state, at);
     const reservationId = `reservation:${intentId}`;
     const reservation = state.reservations[reservationId];
     const grant = scheduled.grants.find((item) => item.id === reservationId);
+    // UI provenance stays process-local. Reuse it only for this same pending
+    // intent while its original owners and pane count remain valid.
+    const retainedSharing = previousEvidence?.intentId === intentId &&
+      reservation?.status === "scheduled" && reservation.notBefore > at &&
+      currentSharedLaneProvenance(previousEvidence, state.leases, at).waitCause
+      ? sharedLaneEvidence(previousEvidence) : {};
     if (reservation) return { value: {
       status: reservation.status,
       reservationId,
       ...reservation,
+      ...retainedSharing,
       ...sharedLaneEvidence(grant),
     } };
     if (!state.intents[intentId]) return { ok: false, reason: "stale" };
@@ -3008,6 +4410,10 @@ function cancelIntent(scope, intentId, nowMs) {
       return { ok: false, reason: "stale" };
     }
     delete state.reservations[reservationId];
+    // The request never started, so the whole slot it was paced into is free.
+    for (const resource of RATE_RESOURCES) {
+      returnPacingCredit(state, resource, reservation.costs[resource], nowMs ?? Date.now());
+    }
     return { value: { status: "cancelled", intentId, reservationId } };
   });
 }
@@ -3021,8 +4427,14 @@ function startReservation(scope, reservationId, nowMs) {
       return { ok: false, reason: "stale", write: Boolean(reservation) };
     }
     if (reservation.notBefore > at) return { value: { status: "waiting", notBefore: reservation.notBefore } };
-    if (state.probeClaim && state.probeClaim.leaseUntil > at) {
-      return { value: { status: "waiting", reason: "probe", notBefore: state.probeClaim.leaseUntil } };
+    // Any live observer claim defers a start: the claim owns the shared HTTP
+    // permit for its window, so starting here would contend for it.
+    const liveClaim = RATE_RESOURCES
+      .map((resource) => state.probeClaims[resource])
+      .filter((claim) => claim && claim.leaseUntil > at)
+      .sort((left, right) => right.leaseUntil - left.leaseUntil)[0];
+    if (liveClaim) {
+      return { value: { status: "waiting", reason: "probe", notBefore: liveClaim.leaseUntil } };
     }
     for (const resource of RATE_RESOURCES.filter((name) => reservation.costs[name] > 0)) {
       const budget = state.budgets[resource];
@@ -3157,6 +4569,15 @@ function settleReservationWithBudgetObservations(
         acceptedAfterBaseline[resource],
       );
     }
+    // Only a measured outcome knows what it spent. A timeout, abort or process
+    // loss proves nothing, so its worst case stays charged and its pacing stays
+    // spent -- refunding there would let a run of timeouts pace as though
+    // nothing had been sent.
+    if (completion.outcome === "measured-success") {
+      for (const resource of RATE_RESOURCES) {
+        returnPacingCredit(state, resource, reservation.costs[resource] - measured[resource], at);
+      }
+    }
     scheduleGovernorState(state, at);
     return { value: {
       status: "completed",
@@ -3179,8 +4600,8 @@ function recordResourceBlock(scope, resource, resetMs, reason) {
         resetMs + BUDGET_RESET_GRACE_MS,
       );
     } else {
-      state.probeOutcome.nextAt = Math.min(
-        state.probeOutcome.nextAt || resetMs + BUDGET_RESET_GRACE_MS,
+      state.observers.graphql.nextAt = Math.min(
+        state.observers.graphql.nextAt || resetMs + BUDGET_RESET_GRACE_MS,
         resetMs + BUDGET_RESET_GRACE_MS,
       );
     }
@@ -3216,7 +4637,7 @@ function governorHealth(result, nowMs = Date.now()) {
   if (!result?.ok) return { status: "unavailable", leases: 0, resources: {} };
   const state = result.value;
   let status = "healthy";
-  if (state.probeClaim?.leaseUntil > nowMs) status = "waiting for probe";
+  if (RATE_RESOURCES.some((resource) => state.probeClaims[resource]?.leaseUntil > nowMs)) status = "waiting for probe";
   else if (RATE_RESOURCES.some((resource) => !state.budgets[resource] ||
     nowMs - state.budgets[resource].observedAt > budgetSnapshotTtl(resource))) status = "stale";
   else if (RATE_RESOURCES.some((resource) => state.budgets[resource].blockUntil > nowMs)) status = "blocked";
@@ -3244,7 +4665,40 @@ async function retryGovernorMutation(run, { now, wait, deadline, signal }) {
   return result;
 }
 
-async function refreshSharedBudget(scope, leaseId, signal, {
+// Each resource refreshes on its own claim. A slow or failing observer for one
+// must not delay or invalidate the other's readiness -- nothing about the
+// resources couples them. What still couples them is the shared HTTP permit and
+// any account-wide secondary hold, and those are enforced where they belong.
+// Core is refreshed last because its publication is what reopens data
+// admission. Finishing the cycle's control work before that happens stops a
+// pane that merely published the reset from getting a head start, over the
+// shared permit, on higher-priority work waiting for the same lane. It is also
+// the order readSharedBudgetSources reads its sources in, and the order the
+// single claim this replaced already used, so the sequence of actual HTTP
+// calls is unchanged.
+const BUDGET_REFRESH_ORDER = ["graphql", "core"];
+
+async function refreshSharedBudget(scope, leaseId, signal, options = {}) {
+  const outcomes = [];
+  for (const resource of BUDGET_REFRESH_ORDER) {
+    outcomes.push([resource, await refreshResourceBudget(scope, leaseId, signal, resource, options)]);
+  }
+  const published = outcomes.filter(([, result]) => result.ok);
+  if (published.length === 0) return outcomes[0][1];
+  const inspect = options.inspect ?? inspectGovernor;
+  const now = options.now ?? (() => scopeNow(scope));
+  const snapshot = inspect(scope, now());
+  return {
+    ok: true,
+    value: {
+      status: "published",
+      budgets: snapshot.ok ? snapshot.value.budgets : {},
+      resources: published.map(([resource]) => resource),
+    },
+  };
+}
+
+async function refreshResourceBudget(scope, leaseId, signal, resource, {
   readBudgets = readSharedBudgetSources,
   now = () => scopeNow(scope),
   wait = (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
@@ -3253,7 +4707,7 @@ async function refreshSharedBudget(scope, leaseId, signal, {
   publish = publishProbe,
   fail = failProbeClaim,
 } = {}) {
-  let claim = claimProbe(scope, leaseId, now());
+  let claim = claimProbe(scope, leaseId, now(), resource);
   if (!claim.ok) return claim;
   if (claim.value.status !== "claimed") {
     const startedAt = now();
@@ -3266,32 +4720,33 @@ async function refreshSharedBudget(scope, leaseId, signal, {
       inspections += 1;
       const snapshot = inspect(scope, now());
       if (!snapshot.ok) return snapshot;
+      // Only this resource's freshness matters here. Waiting on the other's
+      // observer is what made one failing lane stall an unrelated healthy one.
       if (
-        RATE_RESOURCES.every((resource) =>
-          snapshot.value.budgets[resource] &&
-          now() - snapshot.value.budgets[resource].observedAt <= budgetSnapshotTtl(resource),
-        ) && snapshot.value.probeOutcome.status === "healthy"
+        snapshot.value.budgets[resource] &&
+        now() - snapshot.value.budgets[resource].observedAt <= budgetSnapshotTtl(resource) &&
+        snapshot.value.observers[resource].outcome === "healthy"
       ) {
         return { ok: true, value: { status: "published", budgets: snapshot.value.budgets } };
       }
       if (now() >= deadline || inspections >= 10) break;
       await wait(Math.min(100, Math.max(1, deadline - now())));
     }
-    claim = claimProbe(scope, leaseId, now());
+    claim = claimProbe(scope, leaseId, now(), resource);
     if (!claim.ok || claim.value.status !== "claimed") return claim;
   }
-  const { nonce, startedReservationIds, resources = RATE_RESOURCES, coreEtag = null } = claim.value;
+  const { nonce, startedReservationIds, coreEtag = null } = claim.value;
   const drainUntil = now() + GOVERNOR_PROBE_DRAIN_MS;
   while (startedReservationIds.length > 0 && now() < drainUntil) {
     const snapshot = inspect(scope, now());
     if (!snapshot.ok) {
-      failProbeClaim(scope, leaseId, nonce, now());
+      failProbeClaim(scope, leaseId, nonce, now(), resource);
       return snapshot;
     }
     const stillStarted = startedReservationIds.some((id) => snapshot.value.reservations[id]?.status === "started");
     if (!stillStarted) break;
     if (signal?.aborted) {
-      failProbeClaim(scope, leaseId, nonce, now());
+      failProbeClaim(scope, leaseId, nonce, now(), resource);
       return { ok: false, reason: "stale" };
     }
     await wait(Math.min(100, Math.max(1, drainUntil - now())));
@@ -3302,22 +4757,35 @@ async function refreshSharedBudget(scope, leaseId, signal, {
     renewalStartedAt + GOVERNOR_PROBE_TRANSITION_MS,
   );
   const renewed = await retryGovernorMutation(
-    () => renew(scope, leaseId, nonce, now()),
+    () => renew(scope, leaseId, nonce, now(), resource),
     { now, wait, deadline: renewalDeadline, signal },
   );
   if (!renewed.ok) {
-    failProbeClaim(scope, leaseId, nonce, now());
+    failProbeClaim(scope, leaseId, nonce, now(), resource);
     return renewed;
   }
+  // Known exhaustion waits for its actual reset. The GraphQL observer costs a
+  // point, so probing an already-empty budget to be told it is still empty digs
+  // the hole deeper -- the /rate_limit read this replaced was free and could
+  // afford to be unconditional.
+  const beforeRead = inspect(scope, now());
+  const exhausted = resource === "graphql" && beforeRead.ok &&
+    beforeRead.value.budgets.graphql &&
+    beforeRead.value.budgets.graphql.remaining <= 0 &&
+    now() < beforeRead.value.budgets.graphql.resetMs + BUDGET_RESET_GRACE_MS;
+  if (exhausted) {
+    failProbeClaim(scope, leaseId, nonce, now(), resource);
+    return { ok: false, reason: "budget-reset" };
+  }
   let budgets;
   try {
-    budgets = await readBudgets(signal, scope.host, {
-      resources,
+    budgets = await requestIdentityStorage.run(scope, () => readBudgets(signal, scope.host, {
+      resources: [resource],
       coreEtag,
       renewClaim: async () => {
         const startedAt = now();
         const extended = await retryGovernorMutation(
-          () => renew(scope, leaseId, nonce, now()),
+          () => renew(scope, leaseId, nonce, now(), resource),
           {
             now,
             wait,
@@ -3328,7 +4796,7 @@ async function refreshSharedBudget(scope, leaseId, signal, {
         if (extended.ok) renewed.value.leaseUntil = extended.value.leaseUntil;
         return extended.ok;
       },
-    });
+    }));
   } catch {
     budgets = null;
   }
@@ -3338,7 +4806,7 @@ async function refreshSharedBudget(scope, leaseId, signal, {
       now() + GOVERNOR_PROBE_TRANSITION_MS,
     );
     await retryGovernorMutation(
-      () => fail(scope, leaseId, nonce, now()),
+      () => fail(scope, leaseId, nonce, now(), resource),
       { now, wait, deadline: failureDeadline, signal },
     );
     return { ok: false, reason: "stale" };
@@ -3348,12 +4816,12 @@ async function refreshSharedBudget(scope, leaseId, signal, {
     now() + GOVERNOR_PROBE_TRANSITION_MS,
   );
   const published = await retryGovernorMutation(
-    () => publish(scope, leaseId, nonce, budgets, now()),
+    () => publish(scope, leaseId, nonce, budgets, now(), resource),
     { now, wait, deadline: transitionDeadline, signal },
   );
   if (!published.ok) {
     await retryGovernorMutation(
-      () => fail(scope, leaseId, nonce, now()),
+      () => fail(scope, leaseId, nonce, now(), resource),
       { now, wait, deadline: transitionDeadline, signal },
     );
   }
@@ -3417,8 +4885,13 @@ function mergeAlertRows(groups) {
 // mid-session is picked up within the hour.
 const alertBackoff = new Map();
 
+function backoffStorageKey(key) {
+  const access = requestIdentityStorage.getStore()?.accessKey ?? runtimeIdentityCoordinator?.current()?.accessKey;
+  return access ? `${access}\0${key}` : key;
+}
+
 function backoffActive(key, now) {
-  const state = alertBackoff.get(key);
+  const state = alertBackoff.get(backoffStorageKey(key));
   return Boolean(state) && now < state.until;
 }
 
@@ -3434,13 +4907,13 @@ const FAILURE_LADDER = {
 // which is the drift the ALERT_SOURCES comment below warns about: two copies of
 // this would diverge the first time one of them was fixed.
 function recordFailure(key, now, steps = BACKOFF_STEPS_MS) {
-  const previous = alertBackoff.get(key);
+  const previous = alertBackoff.get(backoffStorageKey(key));
   const step = Math.min((previous?.step ?? -1) + 1, steps.length - 1);
-  alertBackoff.set(key, { step, until: now + steps[step] });
+  alertBackoff.set(backoffStorageKey(key), { step, until: now + steps[step] });
 }
 
 function clearBackoff(key) {
-  alertBackoff.delete(key);
+  alertBackoff.delete(backoffStorageKey(key));
 }
 
 function forcedBackoffKeys(key) {
@@ -3462,7 +4935,7 @@ async function fetchAlertSource(source, signal, now, {
   request = fetchConditionalEntity,
 } = {}) {
   if (backoffActive(source.key, now)) {
-    const { note, verdict } = alertBackoff.get(source.key);
+    const { note, verdict } = alertBackoff.get(backoffStorageKey(source.key));
     // The verdict is replayed alongside the note. Replaying only the note left
     // the tab unable to tell "Dependabot is switched off here" from "we cannot
     // see Dependabot" for the whole length of a backoff window.
@@ -3557,7 +5030,7 @@ async function fetchAlertSource(source, signal, now, {
     const steps = pick(FAILURE_LADDER, verdict, null);
     if (steps) {
       recordFailure(source.key, now, steps);
-      Object.assign(alertBackoff.get(source.key), { note, verdict });
+      Object.assign(alertBackoff.get(backoffStorageKey(source.key)), { note, verdict });
     }
     return {
       raw: `unavailable:${note}`,
@@ -3668,36 +5141,72 @@ function reconcileSelectionViewport({ items, key, offset = 0, rows = 1 }) {
   return { key, offset: nextOffset };
 }
 
-// `gh <kind> view --web` for the tabs that have a per-item command. The Security
-// tab is absent on purpose: alerts have no `gh` view subcommand, so there is
-// nothing honest to open.
-const OPENABLE = { actions: "run", issues: "issue", prs: "pr" };
+// The tabs with a per-item URL. Security is absent on purpose: an alert has no
+// stable per-item page this app can construct honestly.
+const OPENABLE = ["actions", "issues", "prs"];
+
+// The platform's opener, by fixed argv and without a shell, so a URL is an
+// argument and never a fragment of a command line.
+// rundll32 rather than `cmd /c start ""`: cmd re-parses its /c string, so a URL
+// handed to it is a fragment of a command line and its metacharacters are live.
+// FileProtocolHandler takes the URL as one real argument, which is the whole
+// point of using execFile without a shell.
+const BROWSER_OPENERS = {
+  darwin: ["open"],
+  linux: ["xdg-open"],
+  win32: ["rundll32", "url.dll,FileProtocolHandler"],
+};
 
-// Output is captured rather than inherited. `gh ... --web` prints "Opening ...
-// in your browser" to stdout, and stdout is ink's frame stream -- letting that
-// through would corrupt the diff and the alternate screen.
-//
-// `gh run view` takes the run's databaseId, not its display `number` -- the
-// two are different ID spaces (databaseId is global across GitHub, number is
-// per-workflow and restarts near 1 in every repo), so a run's `number` is
-// almost never a valid databaseId elsewhere and 404s. `gh issue view` and
-// `gh pr view` are the opposite: they take the issue/PR number, and neither
-// row shape carries a databaseId to prefer instead.
-async function openInBrowser(tabKey, item, signal, governor = null, { run = runGh } = {}) {
-  const kind = pick(OPENABLE, tabKey, null);
-  const id = kind === "run" ? (item?.databaseId ?? item?.number) : (item?.number ?? item?.databaseId);
-  if (!kind || id == null) return;
-  if (!governor) throw new Error("API budget unavailable; refresh and try again");
-  const admitted = await runAdmittedOperation({
-    ...governor,
-    operation: `open:${tabKey}`,
-    signal,
-    run: (admittedSignal) => run([kind, "view", ...repoArgs(), String(id), "--web"], {
-      signal: admittedSignal,
-      operation: `open:${tabKey}`,
-    }),
+// Only https, and only the host this pane is actually talking to. A row is
+// remote data; without this a crafted `url` could point the user's browser
+// anywhere, or hand a `file:`/`javascript:` URL to the platform opener.
+function admittedRowUrl(value, host) {
+  if (typeof value !== "string" || value.length === 0) return null;
+  let parsed;
+  try { parsed = new URL(value); } catch { return null; }
+  if (parsed.protocol !== "https:") return null;
+  return parsed.host === host ? parsed.toString() : null;
+}
+
+// Actions rows come from REST and carry no URL, but a run's page is a pure
+// function of the repository and its databaseId -- both already validated --
+// so it is derived locally rather than fetched. Issues and PRs select `url` in
+// their query, which is validated against the same host before use.
+function rowBrowserUrl(tabKey, item, { host = effectiveRuntimeHost(), repo = effectiveRuntimeRepository() } = {}) {
+  if (!OPENABLE.includes(tabKey) || !isRecord(item) || !host) return null;
+  // The row's own URL first, for every tab. A run only falls back to a derived
+  // URL when the payload predates the projection, and that fallback needs the
+  // slug, which the app only has when --repo was given.
+  const declared = admittedRowUrl(item.url, host);
+  if (declared || tabKey !== "actions") return declared;
+  const id = item.databaseId ?? item.number;
+  if (!Number.isSafeInteger(id) || id <= 0 || !/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(String(repo ?? ""))) return null;
+  return `https://${host}/${repo}/actions/runs/${id}`;
+}
+
+// Opening a page the row already names costs nothing and needs no admission:
+// `gh <kind> view --web` spent a request to be told a URL that was already in
+// hand. Output is still captured rather than inherited, because stdout is ink's
+// frame stream and an opener's chatter would corrupt the alternate screen.
+async function openInBrowser(tabKey, item, signal, _governor = null, { run = null, host, repo } = {}) {
+  if (!OPENABLE.includes(tabKey)) return;
+  const url = rowBrowserUrl(tabKey, item, {
+    ...(host === undefined ? {} : { host }),
+    ...(repo === undefined ? {} : { repo }),
   });
-  if (!admitted.ok) throw admitted.error;
+  // Returning quietly here is how a dead Enter key looks: the row has no usable
+  // page, and the user is entitled to know that rather than press it again.
+  if (!url) throw new Error("This row has no page to open yet; refresh and try again");
+  const opener = pick(BROWSER_OPENERS, process.platform, null);
+  if (!opener) throw new Error(`Opening a browser is not supported on ${process.platform}`);
+  const [command, ...prefix] = opener;
+  const launch = run ?? ((argv) => execFileAsync(argv[0], argv.slice(1), {
+    timeout: GH_TIMEOUT_MS,
+    killSignal: "SIGKILL",
+    maxBuffer: GH_MAX_BUFFER,
+    signal,
+  }));
+  await launch([command, ...prefix, url]);
 }
 
 function createOpenRequestRegistry() {
@@ -3863,10 +5372,16 @@ async function captureGh(args, operation) {
 
 const PROBE_STDERR_LIMIT = 400;
 
-async function probe(name, args, operation) {
+async function probe(name, args, operation, input = null) {
   const startedAt = Date.now();
+  // A declared local prerequisite the run cannot satisfy is reported, not
+  // attempted: starting a request whose document cannot be built would spend a
+  // reservation to receive a GraphQL error that says nothing about the tenant.
+  if (input === UNRESOLVED_REPOSITORY) {
+    return { name, args, ms: 0, failed: true, stderr: UNRESOLVED_REPOSITORY, http: null, classified: "unavailable" };
+  }
   try {
-    const stdout = await runGh(args, { operation });
+    const stdout = await runGh(args, { operation, input });
     return { name, args, ms: Date.now() - startedAt, bytes: stdout.length, classified: "ok" };
   } catch (err) {
     return {
@@ -3947,6 +5462,28 @@ function targetSource() {
 // measures as free (verified: delta 0), so this is safe to run on a diagnostic
 // path. GHES tenants can be configured with a different ceiling, which is
 // exactly why this reports the server's own numbers rather than asserting 5,000.
+// The claimed GraphQL observer, and the only source of spendable GraphQL
+// capacity. `/rate_limit` used to supply this number for free, but a counter
+// obtained for free is not authority: it is another endpoint's view of the
+// meter, it can lag behind the spend it is meant to bound, and it can never
+// report what a particular query actually cost. This query costs a point and
+// says exactly what it cost, which is what makes it reconcilable.
+async function readGraphqlObserver(signal, host = effectiveRuntimeHost(), {
+  fetchPage = fetchGraphqlPage,
+} = {}) {
+  const page = await fetchPage("observer", { signal, operation: "graphql-observer", host, variables: {} });
+  const observed = page.observations[0];
+  if (!observed || observed.resource !== "graphql") return null;
+  return {
+    budget: { remaining: observed.remaining, limit: observed.limit, used: observed.used, resetMs: observed.resetMs },
+    receivedAt: observed.receivedAt,
+    cost: page.observedCost,
+  };
+}
+
+// Report data only, and explicitly not authority: it is left available because
+// a diagnostic that can contradict the observer is useful evidence, and pinned
+// as non-authoritative so it can never be mistaken for spendable capacity.
 async function readRateLimitResources(signal, host = effectiveRuntimeHost()) {
   const raw = await runGh(["api", "rate_limit", ...apiHostArgs(host)], {
     signal,
@@ -4037,20 +5574,21 @@ async function readSharedBudgetSources(signal, host = effectiveRuntimeHost(), {
   resources = RATE_RESOURCES,
   coreEtag = null,
   renewClaim = null,
-  readGraphql = readRateLimitResources,
+  readGraphql = readGraphqlObserver,
   readCore = readCoreBudget,
 } = {}) {
   const result = {};
   if (resources.includes("graphql")) {
-    const rateResources = await readGraphql(signal, host).catch(() => null);
-    const graphql = normalizeRateBudget(rateResources?.graphql);
-    if (!graphql) return null;
-    result.graphql = { budget: graphql, receivedAt: Date.now(), cost: 0 };
+    const observed = await readGraphql(signal, host).catch(() => null);
+    if (!observed?.budget) return null;
+    result.graphql = observed;
   }
   if (resources.includes("core")) {
-    // Each gh command is independently bounded, but two sequential commands
-    // can outlive one claim. Extend the same nonce after the free GraphQL read
-    // and before the one-cost bootstrap observer can start.
+    // Each gh command is independently bounded, but two sequential commands can
+    // outlive one claim. Extend the same nonce between the two observers. The
+    // GraphQL read is no longer the free one -- it costs a point of its own now
+    // -- so this renewal separates two charged requests, not a free one from a
+    // charged one.
     if (resources.includes("graphql") && typeof renewClaim === "function" && !await renewClaim()) return null;
     const core = await readCore(signal, host, coreEtag);
     if (core) result.core = core;
@@ -4072,12 +5610,21 @@ function projectedHourlyCost(activeKey) {
 }
 
 function doctorProbePlan() {
+  // GraphQL cannot infer a repository the way `gh` does, so a report run from a
+  // directory with no unambiguous remote says so per probe instead of sending a
+  // document with a missing variable and reporting the resulting error as if it
+  // came from the server.
+  const target = effectiveRuntimeRepository();
+  const document = (kind, variables) => (variables ? graphqlInput(kind, variables) : UNRESOLVED_REPOSITORY);
   return [
-    ["Repository access", repoContextArgs(), "doctor:repository"],
+    // Every probe is now an explicit request whose cost is declared. The old
+    // Issues/PRs entries ran `gh issue list`/`gh pr list`, whose `--search`
+    // routed through GraphQL at a price the report could not name.
+    ["Repository access", graphqlArgs(), "doctor:repository", document("repository", graphqlRepositoryVariables(target)), "repository"],
     ["Actions runs", ghApiArgs(actionsRunsArgs(MIN_RUN_LIMIT)), "doctor:actions-runs"],
     ["Actions workflows", ghApiArgs(actionsWorkflowsArgs()), "doctor:actions-workflows"],
-    ["Issues (issue list)", issuesArgs(), "doctor:issues"],
-    ["Pull requests (pr list)", prsArgs(), "doctor:prs"],
+    ["Issues (first page)", graphqlArgs(), "doctor:issues", document("issues", graphqlPageVariables(null, target)), "issues"],
+    ["Pull requests (first page)", graphqlArgs(), "doctor:prs", document("prs", graphqlPageVariables(null, target)), "prs"],
     ...ALERT_SOURCES.flatMap((source) =>
       alertRequestArgs(source).map((args, index) => [
         index === 0 ? source.name : `${source.name} (priority ${index})`,
@@ -4128,18 +5675,23 @@ async function runDoctor() {
 
   // Free checks run first. The display rate_limit read is report data only;
   // admission re-reads its GraphQL source after owning the shared claim.
-  const [ghVersion, authStatus, remote, remoteUrls] = await Promise.all([
+  const [ghVersion, remote, remoteUrls] = await Promise.all([
     captureGh(["--version"], "version"),
-    captureGh(["auth", "status"], "auth-status"),
     gitRemote(),
     gitRemoteUrls(),
   ]);
   const effectiveHost = effectiveRuntimeHost({ remoteUrls });
-  const resources = await readRateLimitResources(undefined, effectiveHost).catch(() => null);
+  runtimeIdentityCoordinator = createIdentityCoordinator({ host: effectiveHost });
+  const verified = await runtimeIdentityCoordinator.refresh();
+  const verifiedIdentity = runtimeIdentityCoordinator.current();
+  const authStatus = verifiedIdentity ? `${verifiedIdentity.host}: ${verifiedIdentity.login} (verified)` : identityCoordinationMessage(verified.reason);
+  const resources = verifiedIdentity ? await readRateLimitResources(undefined, effectiveHost).catch(() => null) : null;
   const budget = resources
     ? await rateBudget(resources)
     : { core: "unavailable", graphql: "unavailable" };
-  const scopeResult = createGovernorScope({ effectiveHost });
+  const scopeResult = verifiedIdentity
+    ? { ok: true, value: createQuotaScope(verifiedIdentity, { root: runtimeIdentityCoordinator.root, identityProvider: runtimeIdentityCoordinator.current }) }
+    : verified;
   let governorResult = scopeResult;
   let results = [];
   if (scopeResult.ok) {
@@ -4157,20 +5709,21 @@ async function runDoctor() {
     try {
       if (registered.ok) await refreshSharedBudget(scope, leaseId, undefined);
       const admissionAt = Date.now();
-      const admittedProbes = probes.map(([name, args, operation], index) => {
+      const admittedProbes = probes.map(([name, args, operation, input = null, document = null], index) => {
         const admitted = registered.ok
           ? admitGovernorOperation(scope, leaseId, operation, "diagnostic", admissionAt)
           : registered;
         if (!admitted?.ok || admitted.value.status !== "started") {
-          return { index, skipped: skippedDoctorProbe(name, args, admitted) };
+          return { index, skipped: { ...skippedDoctorProbe(name, args, admitted), ...(document ? { document } : {}) } };
         }
-        return { index, name, args, operation, reservationId: admitted.value.reservationId };
+        return { index, name, args, operation, input, document, reservationId: admitted.value.reservationId };
       });
       results = admittedProbes.map((item) => item.skipped ?? null);
       const runnable = admittedProbes.filter((item) => !item.skipped);
       const settled = await mapAllSettledBounded(runnable, 4, async (item) => {
-        const result = await probe(item.name, item.args, item.operation);
-        completeReservation(scope, item.reservationId, result.failed
+        const result = await requestIdentityStorage.run(scope, () => probe(item.name, item.args, item.operation, item.input));
+        if (item.document) result.document = item.document;
+        completeReservation({ ...scope, identityProvider: null }, item.reservationId, result.failed
           ? { outcome: "rejected" }
           : { outcome: "measured-success", actualCost: operationCost(item.operation) }, Date.now());
         return result;
@@ -4211,7 +5764,12 @@ async function runDoctor() {
     field("slug", runtime.repo ?? "(inferred from the working directory)"),
     field("git remote", remote),
     "",
-    ...section("API budget"),
+    // Labelled, because these two numbers come from `gh api rate_limit`, which
+    // this version treats as a diagnostic and never as spendable capacity. The
+    // "API governor" section below carries the numbers actually admitted
+    // against, with their provenance. A reader who cannot tell the two apart
+    // will believe the wrong one.
+    ...section("API budget (rate_limit, non-authoritative)"),
     field("REST core", budget.core),
     field("GraphQL", budget.graphql),
     field(
@@ -4246,6 +5804,10 @@ async function runDoctor() {
   for (const result of results) {
     lines.push(`  ${result.name}`);
     probeLine("argv", `gh ${result.args.join(" ")}`);
+    // Three GraphQL probes share one argv, and the document that distinguishes
+    // them travels on stdin. A report that cannot say which query it sent is
+    // exactly the drift this command exists to rule out.
+    if (result.document) probeLine("document", result.document);
     probeLine(
       "outcome",
       result.skipped
@@ -4626,6 +6188,21 @@ if (IS_MAIN) {
     console.error(problem);
     process.exit(3);
   }
+  runtimeRemoteUrls = await gitRemoteUrls();
+  runtimeIdentityCoordinator = createIdentityCoordinator({ host: () => effectiveRuntimeHost() });
+  // Resolve warm identity/cache locally; cold proof belongs to the mounted UI
+  // so quit/signal handling remains available while GitHub is slow.
+  //
+  // Bounded, because the warm path still spawns `gh auth token`: a prompting
+  // credential helper, a keyring daemon that is not up yet in a fresh login
+  // session, or a cold binary on a network filesystem would otherwise hold the
+  // first frame for the full subprocess timeout with nothing on screen at all.
+  // Past the bound the same refresh is picked up by the mounted UI, and
+  // ensureScope corrects the cache target and hydrates from it.
+  await Promise.race([
+    runtimeIdentityCoordinator.refresh({ allowBootstrap: false }),
+    new Promise((resolve) => { setTimeout(resolve, WARM_IDENTITY_WAIT_MS).unref(); }),
+  ]);
 }
 
 const ReactModule = await import("react");
@@ -5309,7 +6886,7 @@ const TABS = [
   },
   {
     key: "issues",
-    fetch: ({ signal }) => fetchIssues(signal),
+    fetch: ({ signal, governor, previousRaw }) => fetchIssues(signal, { governor, previousRaw }),
     label: "Issues",
     short: "Issues",
     header: ISSUES_HEADER,
@@ -5319,7 +6896,7 @@ const TABS = [
   },
   {
     key: "prs",
-    fetch: ({ signal }) => fetchPRs(signal),
+    fetch: ({ signal, governor, previousRaw }) => fetchPRs(signal, { governor, previousRaw }),
     label: "Pull requests",
     short: "PRs",
     header: PRS_HEADER,
@@ -5869,7 +7446,8 @@ const createWidthPreferenceWriter = createCoalescedWriter;
 
 // ---------- Last-known-good dashboard cache ----------
 
-const DASHBOARD_CACHE_VERSION = 2;
+// 3: cached rows carry their page URL, without which they cannot be opened.
+const DASHBOARD_CACHE_VERSION = 3;
 const MAX_DASHBOARD_CACHE_TARGETS = 5;
 const MAX_DASHBOARD_CACHE_ROWS_PER_TAB = 60;
 let dashboardCacheTempSequence = 0;
@@ -5958,6 +7536,9 @@ function normalizeCachedItem(tabKey, item) {
       conclusion: item.conclusion == null ? null : safe(item.conclusion),
       startedAt: safe(item.startedAt),
       updatedAt: safe(item.updatedAt),
+      // Retained because opening a row now reads its URL from the row. Dropping
+      // it made Enter on a cache-hydrated row do nothing at all, with no error.
+      url: safe(item.url ?? ""),
     };
   }
   if (tabKey === "issues") {
@@ -5968,6 +7549,7 @@ function normalizeCachedItem(tabKey, item) {
       author: safe(item.author),
       label: safe(item.label),
       updatedAt: safe(item.updatedAt),
+      url: safe(item.url ?? ""),
     };
   }
   if (tabKey === "prs") {
@@ -5980,6 +7562,7 @@ function normalizeCachedItem(tabKey, item) {
       isDraft: Boolean(item.isDraft),
       reviewDecision: safe(item.reviewDecision),
       updatedAt: safe(item.updatedAt),
+      url: safe(item.url ?? ""),
     };
   }
   if (tabKey === "security") {
@@ -6260,14 +7843,20 @@ function retryPollAfterAdmissionFailure({
 
 function governorWakeTimes(state, nowMs, floorMs, leaseId = null) {
   const budgets = Object.values(state?.budgets ?? {});
-  const observedCandidates = state?.probeOutcome?.status === "failed"
-    ? []
-    : budgets.map((budget) => budget.observedAt + BUDGET_PROBE_MS);
+  // A failed observer's own retry, not its stale sample's cadence, says when
+  // that resource is next worth reading. Suppress the cadence per resource: a
+  // global suppression let one failure silence a healthy lane's wake, and no
+  // suppression let the failed lane spin on the sample it already knows is old.
+  const observedCandidates = RATE_RESOURCES.flatMap((resource) => {
+    const budget = state?.budgets?.[resource];
+    if (!budget || state?.observers?.[resource]?.outcome === "failed") return [];
+    return [budget.observedAt + BUDGET_PROBE_MS];
+  });
   const controlAt = Math.min(
     ...observedCandidates,
     ...budgets.map((budget) => budget.resetMs + BUDGET_RESET_GRACE_MS),
-    state?.probeClaim?.leaseUntil ?? Number.POSITIVE_INFINITY,
-    state?.probeOutcome?.nextAt ?? Number.POSITIVE_INFINITY,
+    ...RATE_RESOURCES.map((resource) => state?.probeClaims?.[resource]?.leaseUntil ?? Number.POSITIVE_INFINITY),
+    ...RATE_RESOURCES.map((resource) => state?.observers?.[resource]?.nextAt ?? Number.POSITIVE_INFINITY),
   );
   const reservationAt = Object.values(state?.reservations ?? {})
     .filter((reservation) => reservation.status === "scheduled" &&
@@ -6282,7 +7871,8 @@ function governorWakeTimes(state, nowMs, floorMs, leaseId = null) {
 function governorProtocolReady(refreshResult, snapshot, nowMs) {
   if (!refreshResult?.ok || !snapshot?.ok) return false;
   if (["waiting", "paused", "probe"].includes(refreshResult.value?.status)) return false;
-  if (snapshot.value.probeClaim || snapshot.value.probeOutcome?.status !== "healthy") return false;
+  if (RATE_RESOURCES.some((resource) => snapshot.value.probeClaims[resource]) ||
+    RATE_RESOURCES.some((resource) => snapshot.value.observers[resource]?.outcome !== "healthy")) return false;
   return RATE_RESOURCES.every((resource) => {
     const budget = snapshot.value.budgets[resource];
     return budget && nowMs - budget.observedAt <= budgetSnapshotTtl(resource);
@@ -6439,10 +8029,27 @@ function rateLimitBlockDecision(results, resetMs) {
   };
 }
 
+// Identity reasons that name a condition the user can act on or wait out. The
+// list previously stopped short of identity-unavailable -- the ordinary "not
+// signed in" or "proof denied" case, and precisely the one this phase requires
+// to read as an honest unavailable state rather than a generic retry -- and of
+// identity-capacity and transport-busy.
+//
+// Purely internal reasons (corrupt, unwritable, unknown-host, closed) stay on
+// the generic message on purpose: this surface must not leak internal
+// vocabulary, which is the contract "coordination notices translate raw reasons
+// without exposing internal vocabulary" in test/unit.test.mjs pins.
+const IDENTITY_COORDINATION_REASONS = [
+  "restart-required", "migration-hold", "legacy-unresolved", "legacy-corrupt",
+  "credential-unavailable", "identity-backoff", "identity-busy",
+  "identity-unavailable", "identity-capacity", "transport-busy", "throttle-paused",
+];
+
 function coordinationNotice(reason) {
   if (reason === "unknown-scope") return "Confirming your GitHub login…";
   if (reason === "block-unpublished") return "Holding until the rate-limit block is shared";
   if (reason === "busy" || reason === "stale") return "Coordinating with your other panes";
+  if (IDENTITY_COORDINATION_REASONS.includes(reason)) return identityCoordinationMessage(reason);
   return "Can't coordinate API use — retrying";
 }
 
@@ -6523,16 +8130,18 @@ async function runAdmittedOperation({ scope, leaseId, operation, priority = "man
     return { ok: false, skipped: true, decision: admitted, error: new Error(`API budget paused${detail}`) };
   }
   const reservationId = admitted.value.reservationId;
+  const settlementScope = { ...scope, identityProvider: null };
   try {
-    const value = await run(signal);
+    const value = await requestIdentityStorage.run(scope, () => run(signal));
     const costs = operationCost(operation);
-    completeReservation(scope, reservationId, {
+    completeReservation(settlementScope, reservationId, {
       outcome: "measured-success",
       actualCost: costs,
     }, Date.now());
+    if (scope.accessKey && scope.accessKey !== runtimeIdentityCoordinator?.current()?.accessKey) return { ok: false, error: new Error("Credential changed"), reservationId };
     return { ok: true, value, reservationId };
   } catch (error) {
-    completeReservation(scope, reservationId, { outcome: governorOutcomeForError(error) }, Date.now());
+    completeReservation(settlementScope, reservationId, { outcome: governorOutcomeForError(error) }, Date.now());
     return { ok: false, error, reservationId };
   }
 }
@@ -7183,8 +8792,9 @@ function App({ onCreateRemote = () => {} } = {}) {
     dashboardCacheTarget({
       repo: runtime.repo,
       ghRepo: process.env.GH_REPO,
-      host: runtime.host ?? process.env.GH_HOST,
+      host: runtimeIdentityCoordinator?.current()?.host ?? effectiveRuntimeHost(),
       cwd: process.cwd(),
+      account: runtimeIdentityCoordinator?.current()?.accessKey ?? "unverified",
     }),
   );
   const [loadedCache] = useState(() => loadDashboardCache(cachePath, cacheTarget));
@@ -7885,6 +9495,9 @@ function App({ onCreateRemote = () => {} } = {}) {
       // refresh the tab you just landed on without waiting on an unrelated
       // background fetch -- and so a slow repo can't stack refreshes.
       if (inFlightRef.current[key]) return Promise.resolve();
+      const settlement = createSettlementContext(scope, runtimeIdentityCoordinator);
+      const settlementScope = settlement.scope;
+      const currentAccess = settlement.isCurrent;
       inFlightRef.current[key] = true;
       if (force) manualInFlight.add(key);
       admittedCadenceRef.current[key] = nextAdmittedCadence(
@@ -7910,9 +9523,9 @@ function App({ onCreateRemote = () => {} } = {}) {
           [key]: { automaticStatusVisible },
         }));
       }
-      return run()
+      return requestIdentityStorage.run(scope, run)
         .then((result) => {
-          settleReservationWithBudgetObservations(scope, leaseId, reservationId, result?.measuredSuccess === false
+          settleReservationWithBudgetObservations(settlementScope, leaseId, reservationId, result?.measuredSuccess === false
             ? { outcome: "rejected", observations: result?.observations ?? [] }
             : {
                 outcome: "measured-success",
@@ -7922,6 +9535,7 @@ function App({ onCreateRemote = () => {} } = {}) {
                 },
                 observations: result?.observations ?? [],
               }, Date.now());
+          if (!currentAccess()) return;
           if (result?.rateLimited) {
             const blockAt = Date.now();
             const budget = inspectGovernor(scope, blockAt).value?.budgets?.core;
@@ -8038,11 +9652,11 @@ function App({ onCreateRemote = () => {} } = {}) {
           });
         })
         .catch((err) => {
-          settleReservationWithBudgetObservations(scope, leaseId, reservationId, {
+          settleReservationWithBudgetObservations(settlementScope, leaseId, reservationId, {
             outcome: governorOutcomeForError(err),
             observations: err?.budgetObservations ?? [],
           }, Date.now());
-          if (cancelled || err?.name === "AbortError") return;
+          if (cancelled || !currentAccess() || err?.name === "AbortError") return;
           // Preserve both the verdict and the bounded raw error in state. The
           // renderer translates recognized verdicts at draw time, which lets a
           // later repository/account context refine the one-line remedy without
@@ -8076,6 +9690,7 @@ function App({ onCreateRemote = () => {} } = {}) {
         })
         .finally(() => {
           inFlightRef.current[key] = false;
+          if (!currentAccess() && !Object.values(inFlightRef.current).some(Boolean) && runtimeIdentityCoordinator?.current()?.quotaKey !== settlementScope.quotaKey) releaseLease(settlementScope, leaseId);
           manualInFlight.delete(key);
           onSettled?.();
           if (!cancelled) {
@@ -8109,6 +9724,10 @@ function App({ onCreateRemote = () => {} } = {}) {
     let scope = null;
     let cleanupScope = null;
     let registeredScopeHash = null;
+    // The access partition the retained rows belong to, kept across a window
+    // where the identity is momentarily unknown so that an account which comes
+    // back *different* still clears them. Null means nothing is retained.
+    let retainedAccessKey = null;
     let remoteUrls = [];
     let liveScheduling = false;
     let controlEpochs = null;
@@ -8178,14 +9797,34 @@ function App({ onCreateRemote = () => {} } = {}) {
     }
 
     function identity() {
-      return {
-        effectiveHost: effectiveRuntimeHost({ remoteUrls }),
-        authIdentity: authCacheIdentity(),
-      };
+      return runtimeIdentityCoordinator?.current() ?? null;
+    }
+
+    function retireCurrentScope() {
+      if (!cleanupScope || !registeredScopeHash) return;
+      for (const item of pending.values()) cancelIntent(cleanupScope, item.intentId, Date.now());
+      if (!Object.values(inFlightRef.current).some(Boolean)) releaseLease(cleanupScope, leaseId);
     }
 
-    function resetVisibleScope(nowMs, { immediate = false } = {}) {
+    // discardData separates the two reasons this runs. An account *change* must
+    // drop every row, validator and note, because they belong to an access
+    // partition this pane no longer holds. An identity that is merely unknown
+    // for a moment must not: the rows are still ours, and throwing away the
+    // ETags with them makes the recovery round cost full price.
+    function resetVisibleScope(nowMs, { immediate = false, discardData = true } = {}) {
       pending.clear();
+      coordinator.invalidate();
+      setFailureContext(null);
+      if (discardData) {
+        rawRef.current = {};
+        entityRef.current.clear();
+        lastOkRef.current = {};
+        setData(Object.fromEntries(TAB_KEYS.map((key) => [key, null])));
+        setMeta({});
+        setSecurityNotes([]);
+        setSecurityBlind(false);
+        retainedAccessKey = null;
+      }
       pendingBlockPublications.clear();
       liveScheduling = false;
       activePollAt = Number.POSITIVE_INFINITY;
@@ -8204,20 +9843,26 @@ function App({ onCreateRemote = () => {} } = {}) {
 
     function ensureScope(nowMs = Date.now(), { maintain = false } = {}) {
       const current = identity();
-      const nextHash = governorScopeHash(current.effectiveHost, current.authIdentity);
+      const nextHash = current?.quotaKey;
       if (!nextHash) {
         if (scope !== null) {
-          if (cleanupScope && registeredScopeHash) releaseLease(cleanupScope, leaseId);
+          retireCurrentScope();
           registeredScopeHash = null;
           if (governorRef.current?.leaseId === leaseId) governorRef.current = null;
           scope = null;
           cleanupScope = null;
-          resetVisibleScope(nowMs);
+          // Unknown is not the same as changed. A contended registry lock, a
+          // `gh` write that only touched an unrelated host's entry, or a
+          // re-resolution still in flight all arrive here, and none of them says
+          // the rows on screen stopped being ours. Stop scheduling and let them
+          // age visibly; retainedAccessKey is what still clears them if the
+          // account turns out to have actually changed.
+          resetVisibleScope(nowMs, { discardData: false });
         }
         return null;
       }
-      const migrating = scope !== null && scope.hash !== nextHash;
-      if (scope?.hash === nextHash && registeredScopeHash === nextHash) {
+      const migrating = scope !== null && (scope.hash !== nextHash || scope.accessKey !== current.accessKey);
+      if (scope?.hash === nextHash && scope.accessKey === current.accessKey && registeredScopeHash === nextHash) {
         if (!maintain) return scope;
         const activeTab = TABS[activeIndexRef.current].key;
         const kept = maintainControlLease(scope, leaseId, runtime.refreshMs, activeTab, nowMs);
@@ -8226,20 +9871,40 @@ function App({ onCreateRemote = () => {} } = {}) {
         if (governorRef.current?.leaseId === leaseId) governorRef.current = null;
         return null;
       }
-      if (scope?.hash !== nextHash) {
-        if (cleanupScope && registeredScopeHash) releaseLease(cleanupScope, leaseId);
+      if (scope?.hash !== nextHash || scope.accessKey !== current.accessKey) {
+        retireCurrentScope();
         registeredScopeHash = null;
-        if (migrating) {
+        // The second test covers the identity returning after a window where it
+        // was unknown: scope is null by then, so `migrating` cannot see the
+        // change, and retained rows from the previous access partition would
+        // otherwise survive into an account that must not be able to read them.
+        if (migrating || (scope === null && retainedAccessKey !== null && retainedAccessKey !== current.accessKey)) {
           // The failed publication belonged to the old account scope. Releasing
           // that lease guarantees this process will start no more work there;
           // the new scope must establish its own authoritative budget instead
           // of inheriting an unrelated account's local hold.
           resetVisibleScope(nowMs, { immediate: true });
         }
-        const created = createGovernorScope({ ...current, identityProvider: identity });
-        if (!created.ok) return null;
-        scope = created.value;
+        scope = createQuotaScope(current, { root: runtimeIdentityCoordinator.root, identityProvider: identity });
         cleanupScope = { ...scope, identityProvider: null };
+        const nextTarget = dashboardCacheTarget({ repo: runtime.repo, ghRepo: process.env.GH_REPO, host: current.host, account: current.accessKey });
+        // The mount-time target had to guess the account, and guesses
+        // "unverified" whenever the bounded warm resolution above did not land
+        // in time -- so a session that has rows on disk can start with none.
+        // Now that the partition is proven, take them. Guarded on having
+        // published nothing yet, so this can never overwrite live rows.
+        if (nextTarget !== dashboardCacheTargetRef.current && retainedAccessKey === null &&
+            Object.values(dataRef.current).every((rows) => rows === null)) {
+          const warm = pick(dashboardCacheRef.current, nextTarget, null);
+          if (warm) {
+            setData(Object.fromEntries(TABS.map((candidate) => [candidate.key, warm.tabs[candidate.key]?.data ?? null])));
+            setMeta(Object.fromEntries(TABS.map((candidate) => [candidate.key, warm.tabs[candidate.key]?.meta ?? null])));
+            setSecurityNotes(warm.securityNotes ?? []);
+            setSecurityBlind(warm.securityBlind ?? false);
+          }
+        }
+        retainedAccessKey = current.accessKey;
+        dashboardCacheTargetRef.current = nextTarget;
       }
       const activeTab = TABS[activeIndexRef.current].key;
       const registered = registerLease(scope, {
@@ -8416,6 +10081,7 @@ function App({ onCreateRemote = () => {} } = {}) {
           runLimit: runLimitRef.current,
           entities: entityRef.current,
           force,
+          governor: { scope: currentScope, leaseId },
           previousRaw: rawRef.current[key] ?? null,
         }),
         {
@@ -8455,13 +10121,14 @@ function App({ onCreateRemote = () => {} } = {}) {
         if (inFlightRef.current[key]) continue;
         const currentScope = ensureScope(nowMs);
         if (!currentScope) continue;
-        const decision = readIntentDecision(currentScope, item.intentId, nowMs);
+        const decision = readIntentDecision(currentScope, item.intentId, nowMs, item);
         if (!decision.ok) {
           pauseCoordination(key, decision.reason);
           if (pendingFailureIsTerminal(decision.reason)) pending.delete(key);
           else armWake("data", governorControlRetryAt(nowMs, runtime.refreshMs), dataWake);
           continue;
         }
+        Object.assign(item, sharedLaneEvidence(decision.value));
         if (decision.value.status !== "scheduled" || decision.value.notBefore > nowMs) {
           item.wasDeferred = true;
           setTabGovernorDecision(key, visibleGovernorDecision({
@@ -8501,6 +10168,7 @@ function App({ onCreateRemote = () => {} } = {}) {
             runLimit: runLimitRef.current,
             entities: entityRef.current,
             force: item.force,
+            governor: { scope: currentScope, leaseId },
             previousRaw: rawRef.current[key] ?? null,
           }),
           {
@@ -8585,6 +10253,8 @@ function App({ onCreateRemote = () => {} } = {}) {
     });
 
     async function controlWake() {
+      if (cancelled) return;
+      await runtimeIdentityCoordinator.refresh();
       if (cancelled) return;
       const nowMs = Date.now();
       const currentScope = ensureScope(nowMs, { maintain: true });
@@ -8599,7 +10269,7 @@ function App({ onCreateRemote = () => {} } = {}) {
       }
       const refreshed = currentScope
         ? await refreshSharedBudget(currentScope, leaseId, controller.signal)
-        : { ok: false, reason: "stale" };
+        : { ok: false, reason: runtimeIdentityCoordinator?.inspect()?.reason ?? "stale" };
       if (cancelled) return;
       const checkedAt = Date.now();
       const snapshot = currentScope ? inspectGovernor(currentScope, checkedAt) : refreshed;
@@ -8645,12 +10315,13 @@ function App({ onCreateRemote = () => {} } = {}) {
     }
 
     async function bootstrap() {
-      remoteUrls = await gitRemoteUrls();
+      remoteUrls = runtimeRemoteUrls.length > 0 ? runtimeRemoteUrls : await gitRemoteUrls();
       runtimeRemoteUrls = remoteUrls;
+      await runtimeIdentityCoordinator.refresh();
       if (cancelled) return;
       const currentScope = ensureScope(Date.now());
       if (!currentScope) {
-        pauseCoordination(TABS[activeIndexRef.current].key, "unknown-scope");
+        pauseCoordination(TABS[activeIndexRef.current].key, runtimeIdentityCoordinator?.inspect()?.reason ?? "unknown-scope");
         armWake("control", governorControlRetryAt(Date.now(), runtime.refreshMs), controlWake);
         return;
       }
@@ -9149,7 +10820,7 @@ function App({ onCreateRemote = () => {} } = {}) {
       canMove: allItems.length > 0,
       canOpen:
         selectedKey !== null &&
-        Object.hasOwn(OPENABLE, tab.key) &&
+        OPENABLE.includes(tab.key) &&
         allItems.some((item) => itemKey(item) === selectedKey),
       canResize: fullHeaderVisible,
     }),
@@ -9342,6 +11013,10 @@ if (IS_MAIN) {
       });
   };
   app = render(e(App, { onCreateRemote: createRemote }), { incrementalRendering: true });
+  // Ink's q/Esc/Ctrl+C exit unmounts directly rather than calling unmountApp.
+  // Only close the identity coordinator after that actual application exit,
+  // not when a polling effect reruns. Rejections reach the crash handler above.
+  void app.waitUntilExit().then(abortLiveRequests);
 
   // 128 + signal number, so a supervisor or `timeout` can tell an interrupted
   // run from a clean one. These fire on external `kill` and when raw mode is
@@ -9371,6 +11046,7 @@ if (IS_MAIN) {
     const finish = () => {
       unmountApp();
       restoreScreen();
+      abortLiveRequests();
       process.exit(code);
     };
 
@@ -9396,6 +11072,19 @@ if (IS_MAIN) {
 // Exported for unit tests. The dashboard itself is still one file; these are
 // the pure functions worth pinning, and nothing here is part of the public API.
 export {
+  retryIdentityCompletion,
+  createSettlementContext,
+  startIdentityControl,
+  settleIdentityControl,
+  resolveEffectiveCredential,
+  identityRegistryRoot,
+  inspectIdentityRegistry,
+  claimIdentityBootstrap,
+  finishIdentityBootstrap,
+  createIdentityCoordinator,
+  createQuotaScope,
+  acquireIdentityHttpPermit,
+  releaseIdentityHttpPermit,
   parseArgs,
   validateArgs,
   parseRepoTarget,
@@ -9438,6 +11127,7 @@ export {
   governorPhaseOffset,
   scheduleIntents,
   GOVERNOR_STATE_VERSION,
+  RATE_RESOURCES,
   GOVERNOR_MAX_LEASES,
   GOVERNOR_MAX_INTENTS,
   GOVERNOR_MAX_RESERVATIONS,
@@ -9463,6 +11153,16 @@ export {
   heartbeatLease,
   maintainControlLease,
   claimProbe,
+  classifyThrottle,
+  applyTransportCooldown,
+  clearTransportThrottle,
+  emptyTransportThrottle,
+  throttleLadderMs,
+  transportCooldownDeadline,
+  retryThrottledTransport,
+  THROTTLE_LADDER_MS,
+  THROTTLE_PAUSE_AFTER,
+  MANUAL_GRANT_STREAK_LIMIT,
   renewProbeClaim,
   publishProbe,
   failProbeClaim,
@@ -9475,6 +11175,7 @@ export {
   settleReservationWithBudgetObservations,
   recordResourceBlock,
   releaseLease,
+  inspectAdmittedHttpStart,
   inspectGovernor,
   governorHealth,
   refreshSharedBudget,
@@ -9576,6 +11277,24 @@ export {
   forcedBackoffKeys,
   clearForcedBackoffAfterStart,
   doctorProbePlan,
+  rowBrowserUrl,
+  admittedRowUrl,
+  remoteSlug,
+  resolveEffectiveRepository,
+  graphqlPageVariables,
+  graphqlRepositoryVariables,
+  parseGraphqlEnvelope,
+  graphqlInput,
+  graphqlArgs,
+  fetchGraphqlPage,
+  fetchGraphqlList,
+  operationPausedUntil,
+  LIST_LIMIT,
+  readGraphqlObserver,
+  GRAPHQL_QUERIES,
+  GRAPHQL_PAGE_SIZE,
+  GRAPHQL_PAGE_POINTS,
+  GRAPHQL_OBSERVER_POINTS,
   mapAllSettledBounded,
   alertRequestArgs,
   shouldFetchAlertPriorityLanes,