omp-conductor 0.10.0 → 0.13.0

package/src/daemon.ts

@@ -31,13 +31,16 @@ import { STALL_MARKER_FILE } from "./orchestrator-tick.ts";
 import { startOrchestrator } from "./orchestrator.ts";
 import type { OrchestratorHandle } from "./orchestrator.ts";
 import { createReportOutbox, formatOpenReports } from "./reports.ts";
-import { recordReleaseBlock } from "./release-policy.ts";
+import {
+  recordReleaseBlock,
+  type ReleaseBlockContext,
+} from "./release-policy.ts";
 import { branchName, effectiveLabels, route } from "./routing.ts";
 import type { Routed, UnroutableReason } from "./routing.ts";
 import { evaluateDecisionConditions, probeNpmVersion, probeRateLimitReset } from "./decisions.ts";
-import { classifyRun, providerCreditRefusal, type ClassifyFacts } from "./failure-class.ts";
+import { classifyRun, providerCreditRefusal, providerTransientFault, type ClassifyFacts } from "./failure-class.ts";
 import { projectLabels } from "./label-projection.ts";
-import { dbPath, openStore, utcDay } from "./store.ts";
+import { dbPath, LIVE_STATES, openStore, utcDay } from "./store.ts";
 import { makeTracker, type RateLimitStatus } from "./tracker/github.ts";
 import { RELEASE_SHAPES } from "./types.ts";
 import type {
@@ -45,7 +48,10 @@ import type {
   Caps,
   DispatchSummary,
   Escalation,
+  IssueSnapshot,
+  MergedPrInfo,
   OpenCloser,
+  ReleaseShape,
   PrState,
   ProjectConfig,
   ReadyIssue,
@@ -60,8 +66,17 @@ import type {
   Store,
   Tracker,
   VerbLedgerEntry,
+  TurnOverride,
 } from "./types.ts";
-import { type KilledBy, type WorkerResult, renderBrief, runWorker } from "./worker.ts";
+import {
+  type KilledBy,
+  type WorkerPauseControl,
+  type WorkerPausePhase,
+  type WorkerResult,
+  type RunWorkerDeps,
+  renderBrief,
+  runWorker,
+} from "./worker.ts";
 import {
   addRunRepo,
   cleanupRetainedWorktree,
@@ -75,8 +90,13 @@ import {
 } from "./worktree.ts";
 import { githubVerbActions } from "./verbs/actions.ts";
 import { formatVerbLedger, STATUS_LEDGER_SCAN } from "./verbs/ledger.ts";
-import { listenVerbChannel } from "./verbs/server.ts";
-import type { VerbActions, VerbDeps, VerbListener } from "./verbs/server.ts";
+import {
+  listenVerbChannel,
+  PR_LOOKUP_WINDOW_MS,
+  type VerbActions,
+  type VerbDeps,
+  type VerbListener,
+} from "./verbs/server.ts";
 import {
   ensureVerbSocketDir,
   peerCredentialReader,
@@ -86,7 +106,7 @@ import {
 } from "./verbs/socket.ts";
 import { homedir } from "node:os";
 
-import { pushRunBranch, type RunRepoRef } from "./gitops.ts";
+import { pushRunBranch, readBaseChain, type RunRepoRef } from "./gitops.ts";
 import {
   planUsageLine,
   readPlanUsage,
@@ -108,6 +128,14 @@ const REPORT_DELIVERY_INTERVAL_MS = 30_000;
  *  means the mirror itself is broken, not unlucky, and the sweep escalates
  *  instead of burning a turn-0 run per tick forever (#168, #177). */
 const DISPATCH_INFRA_MAX_STRIKES = 3;
+/** A provider-transient requeue (stream stalled mid-run) is retried, but only a
+ *  bounded number of times: three aborted streams for one issue means the
+ *  provider itself is degraded, not unlucky, and the sweep escalates to a
+ *  human instead of requeueing into a down provider forever (#220). */
+const PROVIDER_TRANSIENT_MAX_STRIKES = 3;
+/** Terminal rows inspected for a salvaged PR per tick. GitHub provenance reads
+ *  are maintenance, but a backlog must not turn one tick into an API burst. */
+const SALVAGED_PR_ADOPTION_BATCH = 10;
 const DEFAULT_PORT = 8787;
 const BRIEF_TEMPLATE_PATH = join(import.meta.dir, "briefs", "worker.md");
 
@@ -144,6 +172,9 @@ interface Deps {
   usage: UsageSource;
   escalate(e: Escalation): Promise<void>;
   turnLimits: TurnLimitRegistry;
+  workerControls: WorkerControlRegistry;
+  /** Session seam for lifecycle integration tests; production uses the real harness. */
+  workerDeps?: RunWorkerDeps;
   integrity: IntegrityGate;
   stall: StallGate;
   cleanup?: RetainedCleanupCursor;
@@ -190,6 +221,7 @@ export function verbDeps(d: Pick<Deps, "project" | "store" | "tracker" | "verbAc
     pausedAt,
     log,
     now: () => Date.now(),
+    chain: { readBaseChain },
   };
 }
 
@@ -198,18 +230,25 @@ export function verbDeps(d: Pick<Deps, "project" | "store" | "tracker" | "verbAc
 
 // ------------------------------------------------------- orchestrator liveness
 
+/** No more than one reminder per hour while the same marker remains. */
+const STALL_RENOTIFY_MS = 60 * 60_000;
+
 /**
- * Whether the wedged-orchestrator page has already gone out for the stall
- * currently on disk. One page per episode: the marker persists until a tick is
- * consumed, so paging per five minutes would be paging forever.
+ * Whether the wedged-orchestrator page has gone out, and when it last went out,
+ * for the stall currently on disk.
  */
 export interface StallGate {
   paged: boolean;
+  lastPagedAt?: number;
 }
 
 export interface StallVerdict {
   /** The marker's own line, when one is there. */
   since?: string;
+  /** Count written by the stalled tick producer, when its marker is readable. */
+  unconsumedTicks?: number;
+  /** Whole hours elapsed since the marker timestamp, when it is parseable. */
+  stalledHours?: number;
   page: boolean;
 }
 
@@ -232,50 +271,84 @@ export interface StallVerdict {
  *
  * Resets when the marker disappears, so a second stall days later pages again.
  */
-export function checkStall(gate: StallGate, marker: string): StallVerdict {
+export function checkStall(gate: StallGate, marker: string, now = Date.now()): StallVerdict {
   if (!existsSync(marker)) {
     gate.paged = false;
+    delete gate.lastPagedAt;
     return { page: false };
   }
-  const page = !gate.paged;
+  const page =
+    !gate.paged ||
+    gate.lastPagedAt === undefined ||
+    now - gate.lastPagedAt >= STALL_RENOTIFY_MS;
   let since: string | undefined;
+  let unconsumedTicks: number | undefined;
+  let stalledHours: number | undefined;
   try {
     const body = readFileSync(marker, "utf8").split("\n")[0]?.trim();
-    if (body !== undefined && body !== "") since = body;
+    if (body !== undefined && body !== "") {
+      since = body;
+      const ticks = /\b(\d+) ticks queued unconsumed\b/.exec(body)?.[1];
+      if (ticks !== undefined) unconsumedTicks = Number(ticks);
+      const startedAt = Date.parse(body.split(/\s+/, 1)[0] ?? "");
+      if (Number.isFinite(startedAt)) {
+        stalledHours = Math.max(0, Math.floor((now - startedAt) / STALL_RENOTIFY_MS));
+      }
+    }
   } catch {
-    // An unreadable marker still means stalled; the timestamp is a nicety.
+    // An unreadable marker still means stalled; its evidence is a nicety.
   }
-  return { ...(since === undefined ? {} : { since }), page };
+  return {
+    ...(since === undefined ? {} : { since }),
+    ...(unconsumedTicks === undefined ? {} : { unconsumedTicks }),
+    ...(stalledHours === undefined ? {} : { stalledHours }),
+    page,
+  };
 }
 
 /**
- * Pages tier 2 once when the orchestrator session stops draining its queue.
+ * Pages tier 2 when the orchestrator session stops draining its queue.
  *
  * Deliberately does not restart anything. A wedge lands mid-turn, this process
  * cannot tell a half-applied edit from an idle loop, and killing the session
  * could destroy work an operator would rather read first — the same refusal to
  * guess that the recovery plugin is built on.
  */
-async function watchOrchestrator(d: Deps): Promise<void> {
+export async function watchOrchestrator(d: Deps, now = Date.now()): Promise<void> {
   const marker = join(stateDir(), STALL_MARKER_FILE);
-  const verdict = checkStall(d.stall, marker);
+  const repeat = d.stall.paged;
+  const verdict = checkStall(d.stall, marker, now);
   if (!verdict.page) return;
 
+  const greenRuns = d.store.activeRuns(d.project.name).filter((run) => run.state === "pushed-green");
+  const repeatSuffix = repeat
+    ? ` — still stalled (${
+        verdict.stalledHours === undefined
+          ? `${new Date(now).toISOString().slice(0, 13)}Z`
+          : `${verdict.stalledHours}h`
+      })`
+    : "";
+
   log(`ERROR: the orchestrator session is not draining its queue — ${verdict.since ?? "no timestamp"}`);
   const delivered = await safeEscalate(d, {
     tier: 2,
+    category: "confirmed-failure",
+    urgent: true,
     project: d.project.name,
     issue: NO_ISSUE,
     // Keyed on the marker's own timestamp, not the date. The dedup ledger keys
     // on this summary, and two wedges in one day is not a hypothetical — the
     // failure mode is a session that gets stuck, gets restarted, and gets stuck
-    // again on the same cause an hour later. A day-keyed summary would report
-    // the first and silently swallow every one after it.
+    // again on the same cause an hour later. The hourly suffix makes bounded
+    // reminders distinct without allowing every five-minute tick through.
     summary:
       `Orchestrator session wedged (${verdict.since ?? `marker at ${marker}`}) — ` +
-      `it has stopped reading its queue (${d.project.name})`,
+      `it has stopped reading its queue (${d.project.name})${repeatSuffix}`,
     detail: [
       verdict.since ?? "Marker present with no readable timestamp.",
+      `Unconsumed ticks: ${verdict.unconsumedTicks ?? "unknown"}`,
+      `Open green worker PRs: ${greenRuns.length}`,
+      ...greenRuns.map((run) => `- ${run.prUrl ?? `#${run.issue} (PR URL unavailable)`}`),
       `Marker: ${marker}`,
       "",
       "Its process and its herdr agent label are both healthy, which is why nothing else noticed:",
@@ -287,7 +360,7 @@ async function watchOrchestrator(d: Deps): Promise<void> {
       "Dispatch is unaffected: workers keep running. What stops is drain, groom, report and merge.",
     ].join("\n"),
   });
-  markPaged(d.stall, delivered);
+  markPaged(d.stall, delivered, now);
 }
 
 /**
@@ -304,10 +377,10 @@ export function isPaused(): boolean {
  * The epoch-ms timestamp at which the current pause began, read from the same
  * sentinel file {@link setPaused} writes (`<stateDir()>/paused`). Returns
  * `undefined` when the fleet is not paused, or when the file's first line does
- * not parse as a date — a legacy/blank sentinel keeps today's refuse-everything
- * behavior, because a run admitted before an *unknown* pause cannot be proven
- * innocent. {@link isPaused} is the authority on *whether*; this answers
- * *since when*.
+ * not parse as a date. A legacy/blank sentinel keeps completion mutations
+ * fail-closed because a run admitted before an *unknown* pause cannot be proven
+ * innocent. {@link isPaused} is the authority on *whether*; this answers *since
+ * when*.
  */
 export function pausedAt(): number | undefined {
   const f = join(stateDir(), "paused");
@@ -318,8 +391,8 @@ export function pausedAt(): number | undefined {
     const t = Date.parse(first);
     return Number.isNaN(t) ? undefined : t;
   } catch {
-    // Unreadable sentinel (permissions, corruption): fail closed like an
-    // unparseable line — refuse mutations while the pause is unprovable.
+    // Unreadable sentinel (permissions, corruption): fail completion mutations
+    // closed like an unparseable line while the pause time is unprovable.
     return undefined;
   }
 }
@@ -344,8 +417,8 @@ export function pauseProvenance(): { source: string; reason?: string } | undefin
     const reason = match[2];
     return { source, ...(reason === undefined ? {} : { reason }) };
   } catch {
-    // Unreadable sentinel: no provenance to name, and the refuse-everything
-    // posture of an unknown pause is unchanged.
+    // Unreadable sentinel: no provenance to name. Completion mutations still
+    // fail closed because the pause time is unknown.
     return undefined;
   }
 }
@@ -456,9 +529,17 @@ export function checkIntegrity(gate: IntegrityGate, current: Map<string, string>
   return { diff, pause: true, page: !gate.paged };
 }
 
-/** Latch a once-only page, after delivery is confirmed and never before. */
-export function markPaged(gate: { paged: boolean }, delivered: boolean): void {
-  if (delivered) gate.paged = true;
+/** Latch a page after delivery is confirmed, and never before. */
+export function markPaged(gate: StallGate, delivered: boolean, now: number): void;
+export function markPaged(gate: IntegrityGate, delivered: boolean): void;
+export function markPaged(
+  gate: { paged: boolean; lastPagedAt?: number },
+  delivered: boolean,
+  now?: number,
+): void {
+  if (!delivered) return;
+  gate.paged = true;
+  if (now !== undefined) gate.lastPagedAt = now;
 }
 
 // ---------------------------------------------------------------------- helpers
@@ -528,6 +609,32 @@ function swapLabel(store: Store, projectName: string, issue: number, from: strin
     { issue, op: "remove", label: from },
   ]);
 }
+/**
+ * Persist the operator-stop transition before releasing its live controller.
+ * The row is terminal first, then its in-progress label is removed through the
+ * same durable projection outbox as every other lifecycle transition.
+ */
+export function recordOperatorStop(
+  store: Pick<Store, "updateRun" | "enqueueLabelOps">,
+  args: {
+    project: string;
+    issue: number;
+    runId: string;
+    inProgress: string;
+    reason: string;
+    patch: Partial<RunRecord>;
+  },
+): void {
+  store.updateRun(args.runId, {
+    ...args.patch,
+    state: "stopped",
+    lastError: `operator stopped: ${args.reason}`,
+  });
+  store.enqueueLabelOps(args.project, [
+    { issue: args.issue, op: "remove", label: args.inProgress },
+  ]);
+}
+
 
 /**
  * The escalator throws when no transport is configured or Telegram rejects, and
@@ -549,6 +656,38 @@ async function safeEscalate(d: Pick<Deps, "escalate">, e: Escalation): Promise<b
   }
 }
 
+async function reactToProviderCredit(
+  d: Deps,
+  issue: number,
+  message: string,
+  sessionFile: string | undefined,
+): Promise<void> {
+  const { project } = d;
+  const alreadyPaused = isPaused();
+  if (!alreadyPaused) setPaused(true, { source: "provider-credit", reason: message });
+  log(
+    `#${issue} provider refused for credit — dispatch ${alreadyPaused ? "remains paused" : "paused"}: ${message}`,
+  );
+  // Fleet-scoped and run-independent on purpose. The notification ledger
+  // dedupes on `project:issue:tier:summary`, so `NO_ISSUE` plus a summary
+  // carrying no run or attempt pages once for the fleet, not once per run.
+  await safeEscalate(d, {
+    tier: 2,
+    category: "fleet-stopped",
+    project: project.name,
+    issue: NO_ISSUE,
+    summary: `Model provider refused for credit — ${project.name} is paused`,
+    detail: [
+      message,
+      "",
+      "No implementation attempt was charged: this is a billing state, not a",
+      "failed implementation. Each affected issue keeps its queue label and",
+      "re-dispatches on `omp-conductor resume` once the provider has credit.",
+      `Session: ${sessionFile ?? "(no transcript)"}`,
+    ].join("\n"),
+  });
+}
+
 /**
  * What a salvage attempt contributes to the escalation: where the work went, or
  * that it went nowhere. Split from the effects below for the same reason
@@ -823,6 +962,135 @@ export function createTurnLimitRegistry(
   };
 }
 
+export type WorkerControlResult =
+  | { kind: "ok"; runId: string; phase: WorkerPausePhase }
+  | { kind: "stopped"; runId: string; reason: string }
+  | { kind: "refused"; runId: string; error: string }
+  | { kind: "not-active" };
+
+export interface WorkerControlSlot {
+  install(control: WorkerPauseControl): void;
+  /** Stop accepted before the session controller exists. */
+  requestedStop(): string | undefined;
+  close(): void;
+}
+
+export interface WorkerControlRegistry {
+  open(project: string, issue: number, runId: string): WorkerControlSlot;
+  pause(project: string, issue: number): Promise<WorkerControlResult>;
+  resume(project: string, issue: number): WorkerControlResult;
+  stop(project: string, issue: number, reason: string): Promise<WorkerControlResult>;
+  /** Live runs whose phase is not `running` — what /healthz and the board show. */
+  snapshot(project: string): { issue: number; runId: string; phase: WorkerPausePhase }[];
+}
+
+/** Authoritative controls for sessions owned by this daemon process. */
+export function createWorkerControlRegistry(): WorkerControlRegistry {
+  interface Entry {
+    project: string;
+    issue: number;
+    runId: string;
+    control?: WorkerPauseControl;
+    stopReason?: string;
+    stopError?: string;
+    finished: PromiseWithResolvers<void>;
+  }
+
+  const active = new Map<string, Entry>();
+  const key = (project: string, issue: number): string => `${project}\0${issue}`;
+  return {
+    open(project, issue, runId) {
+      const k = key(project, issue);
+      if (active.has(k)) throw new Error(`#${issue} already has a live worker controller`);
+      const entry: Entry = {
+        project,
+        issue,
+        runId,
+        finished: Promise.withResolvers<void>(),
+      };
+      active.set(k, entry);
+      return {
+        install: (control) => {
+          if (active.get(k) !== entry) return;
+          entry.control = control;
+          if (entry.stopReason === undefined) return;
+          try {
+            control.stop(entry.stopReason);
+          } catch (err) {
+            entry.stopError = err instanceof Error ? err.message : String(err);
+          }
+        },
+        requestedStop: () => active.get(k) === entry ? entry.stopReason : undefined,
+        close: () => {
+          if (active.get(k) === entry) active.delete(k);
+          entry.finished.resolve();
+        },
+      };
+    },
+    async pause(project, issue) {
+      const entry = active.get(key(project, issue));
+      if (entry?.control === undefined) return { kind: "not-active" };
+      try {
+        await entry.control.pause();
+        return { kind: "ok", runId: entry.runId, phase: entry.control.phase() };
+      } catch (err) {
+        return {
+          kind: "refused",
+          runId: entry.runId,
+          error: err instanceof Error ? err.message : String(err),
+        };
+      }
+    },
+    resume(project, issue) {
+      const entry = active.get(key(project, issue));
+      if (entry?.control === undefined) return { kind: "not-active" };
+      try {
+        entry.control.resume();
+        return { kind: "ok", runId: entry.runId, phase: entry.control.phase() };
+      } catch (err) {
+        return {
+          kind: "refused",
+          runId: entry.runId,
+          error: err instanceof Error ? err.message : String(err),
+        };
+      }
+    },
+    async stop(project, issue, reason) {
+      const entry = active.get(key(project, issue));
+      if (entry === undefined) return { kind: "not-active" };
+      if (entry.stopReason === undefined) {
+        entry.stopReason = reason;
+        if (entry.control !== undefined) {
+          try {
+            entry.control.stop(reason);
+          } catch (err) {
+            entry.stopReason = undefined;
+            return {
+              kind: "refused",
+              runId: entry.runId,
+              error: err instanceof Error ? err.message : String(err),
+            };
+          }
+        }
+      }
+      await entry.finished.promise;
+      if (entry.stopError !== undefined) {
+        return { kind: "refused", runId: entry.runId, error: entry.stopError };
+      }
+      return { kind: "stopped", runId: entry.runId, reason: entry.stopReason! };
+    },
+    snapshot(project) {
+      const workers: { issue: number; runId: string; phase: WorkerPausePhase }[] = [];
+      for (const entry of active.values()) {
+        if (entry.project !== project || entry.control === undefined) continue;
+        const phase = entry.control.phase();
+        if (phase !== "running") workers.push({ issue: entry.issue, runId: entry.runId, phase });
+      }
+      return workers;
+    },
+  };
+}
+
 export async function verifyPushedGreenClaim(
   tracker: Pick<Tracker, "verifyPr">,
   claim: Pick<WorkerResult, "prUrl" | "headSha">,
@@ -912,7 +1180,28 @@ export function shouldContinueAfterTurnsCap(f: {
   return hasContinuationBudget(f.continuation, f.maxContinuations);
 }
 
-async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
+/** Bind a worker's run identity to every release-policy block it emits. */
+export function workerReleaseBlockRecorder(
+  project: string,
+  issue: number,
+  runId: string,
+  root = stateDir(),
+): (shape: ReleaseShape, context: ReleaseBlockContext) => void {
+  return (shape, context) =>
+    recordReleaseBlock(
+      project,
+      "worker",
+      shape,
+      {
+        ...context,
+        issue,
+        runId,
+      },
+      root,
+    );
+}
+
+export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
   const { project, caps, tracker, store } = d;
   const issue = r.issue.number;
   const branch = branchName(r.issue);
@@ -926,6 +1215,8 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
   const mirrorPath = mirrorPathFor(r.repo, project.mirrorRoot);
   let worktreePath: string | undefined;
   let turnLimit: TurnLimitController | undefined;
+  let workerControl: WorkerControlSlot | undefined;
+  let workerSessionInstalled = false;
   // The run's own repository. Hoisted for the same reason `worktreePath` is —
   // the catch and finally paths have to publish the branch.
   let runRepo: RunRepoRef | undefined;
@@ -947,6 +1238,53 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     return pushRunBranch(project, runRepo);
   };
 
+  /**
+   * A stop can arrive after the run is claimed but before `runWorker` exposes
+   * its controller. Settle that run here instead of turning an operator action
+   * into a dispatch failure or making the HTTP request wait for a session that
+   * will never exist.
+   */
+  const settleStopBeforeSession = async (): Promise<boolean> => {
+    const reason = workerControl?.requestedStop();
+    if (reason === undefined || run === undefined || workerSessionInstalled) return false;
+    turnLimit?.close();
+    turnLimit = undefined;
+    const settlement =
+      worktreePath === undefined
+        ? undefined
+        : await settleWorktree({
+            issue,
+            attempt,
+            ending: `stopped by the operator: ${reason}`,
+            worktree: worktreePath,
+            branch,
+            publish,
+            tree: "remove",
+            mirrorPath,
+          });
+    recordOperatorStop(store, {
+      project: project.name,
+      issue,
+      runId: run.id,
+      inProgress,
+      reason,
+      patch: {
+        endedAt: Date.now(),
+        turns: run.turns,
+        spendUsd: run.spendUsd,
+        worktree: worktreePath ?? run.worktree,
+        report: [
+          "Operator stopped the run before its worker session started.",
+          `Reason: ${reason}`,
+          ...(settlement?.lines ?? []),
+        ].join("\n"),
+        ...settlement?.patch,
+      },
+    });
+    log(`#${issue} stopped by operator before its worker session started: ${reason}`);
+    return true;
+  };
+
   try {
     // Claim on the STORE first, before anything that can fail. The run row —
     // not the label — is the crash-safe guard against double dispatch: rows
@@ -962,8 +1300,6 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // Read before this attempt's own row exists, so `latestRun` still means the
     // attempt whose work this one inherits.
     const priorSalvage = store.latestRun(project.name, issue)?.salvageSha;
-
-
     run = store.createRun({
       project: project.name,
       issue,
@@ -977,10 +1313,20 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       maxTurns: caps.workerMaxTurns,
       startedAt: Date.now(),
     });
+    const maxTurns = run.maxTurns;
+    const turnOverride = maxTurns > caps.workerMaxTurns ? maxTurns : undefined;
     const runId = run.id;
+    if (turnOverride !== undefined) {
+      log(
+        `#${issue} claimed with turn override ${turnOverride} ` +
+          `(base ${caps.workerMaxTurns})`,
+      );
+    }
     store.enqueueLabelOps(project.name, [{ issue, op: "add", label: inProgress }]);
     claimed = true;
-    turnLimit = d.turnLimits.open(project.name, issue, runId, caps.workerMaxTurns);
+    turnLimit = d.turnLimits.open(project.name, issue, runId, maxTurns);
+    workerControl = d.workerControls.open(project.name, issue, runId);
+    if (await settleStopBeforeSession()) return;
 
     // A run's tree is <workspaceRoot>/<issue> and addRunRepo refuses to reuse
     // an existing path, so a retry — or a tree kept from a failed attempt — has
@@ -989,6 +1335,7 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // first attempt. addRunRepo does its own ensureMirror; calling it here too
     // would cost a second network fetch per attempt.
     await removeWorktree(mirrorPath, worktreePathFor(project.workspaceRoot, issue));
+    if (await settleStopBeforeSession()) return;
     const provisioned = await addRunRepo(
       r.repo,
       project.mirrorRoot,
@@ -998,6 +1345,7 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     );
     worktreePath = provisioned.path;
     runRepo = { repo: r.repo, runRepoPath: worktreePath, branch };
+    if (await settleStopBeforeSession()) return;
 
     // The SDK names the transcript itself, so the daemon supplies the parent
     // directory and learns the real path back from the result. Inventing one
@@ -1036,6 +1384,7 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       },
       { ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }) },
     );
+    if (await settleStopBeforeSession()) return;
 
     store.updateRun(runId, { worktree: worktreePath, state: "running" });
 
@@ -1044,19 +1393,26 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         (provisioned.reattached ? " (continuation: reattached existing branch)" : ""),
     );
 
+    const brief = await buildBrief(project, r, branch, worktreePath, {
+      continuation: provisioned.reattached,
+      defaultBranch: r.repo.defaultBranch,
+      ...(provisioned.reattached && priorSalvage !== undefined
+        ? { salvagedSha: priorSalvage }
+        : {}),
+    });
+    if (await settleStopBeforeSession()) return;
+
     let result: WorkerResult;
     try {
       result = await runWorker({
-        brief: await buildBrief(project, r, branch, worktreePath, {
-          continuation: provisioned.reattached,
-          defaultBranch: r.repo.defaultBranch,
-          ...(provisioned.reattached && priorSalvage !== undefined
-            ? { salvagedSha: priorSalvage }
-            : {}),
-        }),
+        brief,
         cwd: worktreePath,
         caps,
-        maxTurns: () => turnLimit?.maxTurns() ?? caps.workerMaxTurns,
+        maxTurns: () => turnLimit?.maxTurns() ?? maxTurns,
+        onPauseControl: (control) => {
+          workerSessionInstalled = true;
+          workerControl?.install(control);
+        },
         sessionDir,
         // The session's control socket, under the daemon's own state directory —
         // a child process of the daemon reaches it directly.
@@ -1075,7 +1431,7 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         },
         ...(project.workerModel === undefined ? {} : { model: project.workerModel }),
         releaseGrants: resolveReleaseGrants(project),
-        onReleaseBlocked: (shape) => recordReleaseBlock(project.name, "worker", shape),
+        onReleaseBlocked: workerReleaseBlockRecorder(project.name, issue, runId),
         onTurn: (n) => store.updateRun(runId, { turns: n }),
         onSpend: (usd) => store.updateRun(runId, { spendUsd: usd }),
         onKilled: () => {
@@ -1087,7 +1443,7 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         // and a path written at completion is a path nobody can follow live. The
         // completion-time update below writes the same value again, harmlessly.
         onSessionFile: (f) => store.updateRun(runId, { sessionFile: f }),
-      });
+      }, d.workerDeps);
     } finally {
       // This is the authoritative settlement edge for `extend`: close before
       // PR verification or terminal row writes can leave stale `running` state.
@@ -1110,13 +1466,10 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
 
     // Read before the row is written so `lastError` carries the provider's own
     // message — it names the fix and the URL, which no classification can.
-    const providerCredit =
-      state === "failed" || state === "killed"
-        ? (() => {
-            const err = readSessionError(result.sessionFile);
-            return err === undefined ? undefined : providerCreditRefusal(err);
-          })()
-        : undefined;
+    const sessionErr = state === "failed" || state === "killed" ? readSessionError(result.sessionFile) : undefined;
+    const providerCredit = sessionErr === undefined ? undefined : providerCreditRefusal(sessionErr);
+    const providerTransient =
+      providerCredit !== undefined || sessionErr === undefined ? undefined : providerTransientFault(sessionErr);
 
     // The other half of not believing a worker about its own run (#128). The
     // claim being audited is `state: pushed-green`, so the audit runs on the
@@ -1160,8 +1513,8 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // `pushed-*` run is the only end that does not salvage: its deliverable is
     // already on a remote branch, whatever is left loose in the tree is by the
     // worker's own account not part of it, and appending a WIP commit would
-    // turn the green PR this daemon just verified red. Every other end is
-    // continuable, so its tree is treated as work.
+    // turn the green PR this daemon just verified red. Every other end may
+    // contain work, so it is salvaged before the tree's final fate is decided.
     const settlement =
       state === "pushed-green" || state === "pushed-pending" || state === "merged"
         ? undefined
@@ -1169,7 +1522,11 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
             issue,
             attempt,
             ending:
-              state === "blocked" ? "blocked for an operator decision" : endedBy(result.killedBy),
+              state === "blocked"
+                ? "blocked for an operator decision"
+                : state === "stopped"
+                  ? `stopped by the operator: ${result.stoppedReason ?? "no reason recorded"}`
+                  : endedBy(result.killedBy),
             worktree: worktreePath,
             branch,
             publish,
@@ -1190,8 +1547,7 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       await removeWorktree(mirrorPath, worktreePath);
     }
 
-    store.updateRun(runId, {
-      state,
+    const terminalPatch: Partial<RunRecord> = {
       endedAt: Date.now(),
       turns: result.turns,
       spendUsd: result.spendUsd,
@@ -1199,23 +1555,41 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       headSha: result.headSha,
       sessionFile: result.sessionFile,
       // Every terminal state persists the worker's report, not just a green
-      // push: the report of a killed attempt is exactly the one a later
-      // continuation must pool its disclosures from (#199).
+      // push: a stopped attempt's partial report is still part of its audit trail.
       report: result.report,
-      ...(providerCredit !== undefined
-        ? { lastError: providerCredit }
-        : verified.reason === undefined
-          ? {}
-          : { lastError: verified.reason }),
       ...settlement?.patch,
       ...(audit === undefined || audit.flags.length === 0
         ? {}
         : { settlementFlags: audit.flags }),
-    });
+    };
+    if (state === "stopped") {
+      recordOperatorStop(store, {
+        project: project.name,
+        issue,
+        runId,
+        inProgress,
+        reason: result.stoppedReason ?? "no reason recorded",
+        patch: terminalPatch,
+      });
+    } else {
+      const lastError = completionLastError(
+        providerCredit,
+        providerTransient,
+        verified.reason,
+        sessionErr,
+      );
+      store.updateRun(runId, {
+        ...terminalPatch,
+        state,
+        ...(lastError === undefined ? {} : { lastError }),
+      });
+    }
 
     const salvaged = settlement?.lines ?? [];
 
-    if (state === "blocked") {
+    if (state === "stopped") {
+      log(`#${issue} stopped by operator on attempt ${attempt}: ${result.stoppedReason}`);
+    } else if (state === "blocked") {
       swapLabel(store, project.name, issue, inProgress, project.stateLabels.blocked);
       await safeEscalate(d, {
         tier: 1,
@@ -1239,30 +1613,8 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       });
 
       if (providerCredit !== undefined) {
-        // Pause here rather than at classification: the sweep runs on the tick,
-        // and three issues each burned an attempt in the fifteen minutes between
-        // the first 402 and a human noticing (#220).
-        setPaused(true, { source: "provider-credit", reason: providerCredit });
-        log(`#${issue} provider refused for credit — dispatch paused: ${providerCredit}`);
-        swapLabel(store, project.name, issue, inProgress, project.stateLabels.failed);
-        // Fleet-scoped and run-independent on purpose. The notification ledger
-        // dedupes on `project:issue:tier:summary`, so `NO_ISSUE` plus a summary
-        // carrying no run or attempt is what makes this page once for the fleet
-        // instead of once per affected run.
-        await safeEscalate(d, {
-          tier: 2,
-          project: project.name,
-          issue: NO_ISSUE,
-          summary: `Model provider refused for credit — ${project.name} is paused`,
-          detail: [
-            providerCredit,
-            "",
-            "No implementation attempt was charged: this is a billing state, not a",
-            "failed implementation. Each affected issue keeps its queue label and",
-            "re-dispatches on `omp-conductor resume` once the provider has credit.",
-            `Session: ${result.sessionFile ?? "(no transcript)"}`,
-          ].join("\n"),
-        });
+        await reactToProviderCredit(d, issue, providerCredit, result.sessionFile);
+        swapToQueue(d, issue, inProgress);
       } else if (continueTurns) {
         // Requeue as one ordered pair: the in-progress removal before the
         // queue add, exactly the order the projector will apply them in (#201).
@@ -1364,6 +1716,7 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // inner settlement guard exists. Latch it before any terminal write or await.
     turnLimit?.close();
     turnLimit = undefined;
+    if (await settleStopBeforeSession()) return;
     const detail = errText(err);
     log(`#${issue} errored: ${detail}`);
     // A crash lands anywhere, including mid-edit in a tree holding the only
@@ -1421,6 +1774,8 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       }
       verbListener = undefined;
     }
+    workerControl?.close();
+    workerControl = undefined;
   }
 }
 
@@ -1538,6 +1893,129 @@ export function releaseInProgress(
  * in the busy set throughout, so no second worker can be sent at the issue while
  * it waits.
  */
+const BASE_CHECK_BATCH = 20;
+const BASE_CHECK_WINDOW_MS = 24 * 60 * 60 * 1_000;
+const BASE_STATUS_WINDOW_MS = 7 * 24 * 60 * 60 * 1_000;
+
+const SUCCESSFUL_WORKFLOW_CONCLUSIONS = new Set(["success", "neutral", "skipped"]);
+
+const FAILING_WORKFLOW_CONCLUSIONS = new Set([
+  "failure",
+  "cancelled",
+  "timed_out",
+  "action_required",
+  "startup_failure",
+  "stale",
+]);
+
+function appendSettlementFlag(run: RunRecord, flag: SettlementFlag): SettlementFlag[] {
+  const flags = run.settlementFlags ?? [];
+  return flags.some((existing) => existing.kind === flag.kind && existing.detail === flag.detail)
+    ? flags
+    : [...flags, flag];
+}
+
+/**
+ * Observe Actions on exact merge commits for up to one day. A running workflow
+ * stays quiet and pending; a failure becomes durable evidence on the merged row
+ * and pages exactly once because the row leaves `pending` before delivery.
+ */
+export async function watchMergedBase(d: Pick<Deps, "project" | "tracker" | "store" | "escalate">): Promise<void> {
+  const now = Date.now();
+  for (const run of d.store.runsNeedingBaseCheck(d.project.name, BASE_CHECK_BATCH)) {
+    if (
+      run.endedAt === undefined ||
+      now - run.endedAt > BASE_CHECK_WINDOW_MS ||
+      run.mergeSha === undefined ||
+      run.baseRef === undefined
+    ) {
+      d.store.updateRun(run.id, { baseCheck: "unknown", baseCheckAt: now });
+      log(`#${run.issue} base check unknown: merge identity is absent or older than 24h`);
+      continue;
+    }
+
+    const repo = d.project.routing.repos[run.repo];
+    const repoIdentity = repo === undefined ? undefined : githubRepo(repo.cloneUrl);
+    if (repoIdentity === undefined) {
+      d.store.updateRun(run.id, { baseCheck: "unknown", baseCheckAt: now });
+      log(`#${run.issue} base check unknown: routed repository ${run.repo} has no GitHub identity`);
+      continue;
+    }
+
+    let workflows;
+    try {
+      workflows = await d.tracker.workflowRunsAt(repoIdentity, run.mergeSha);
+    } catch (err) {
+      log(`#${run.issue} base check unavailable (${errText(err)}) — retrying next tick`);
+      continue;
+    }
+    if (workflows === undefined || workflows.length === 0) {
+      log(`#${run.issue} base check unavailable for ${run.mergeSha} — retrying next tick`);
+      continue;
+    }
+    if (workflows.some((workflow) => workflow.status !== "completed")) continue;
+
+    const failed = workflows.find(
+      (workflow) =>
+        workflow.conclusion !== undefined &&
+        FAILING_WORKFLOW_CONCLUSIONS.has(workflow.conclusion),
+    );
+    if (failed === undefined) {
+      const unknown = workflows.find(
+        (workflow) =>
+          workflow.conclusion === undefined ||
+          !SUCCESSFUL_WORKFLOW_CONCLUSIONS.has(workflow.conclusion),
+      );
+      if (unknown !== undefined) {
+        log(
+          `#${run.issue} base check has unrecognised completed conclusion ` +
+            `${JSON.stringify(unknown.conclusion)} for ${unknown.name} — retrying next tick`,
+        );
+        continue;
+      }
+      d.store.updateRun(run.id, { baseCheck: "green", baseCheckAt: now });
+      log(`#${run.issue} base ${run.baseRef} green at ${run.mergeSha}`);
+      continue;
+    }
+
+    let previous;
+    try {
+      previous = await d.tracker.previousWorkflowRun(
+        repoIdentity,
+        failed.workflowId,
+        run.baseRef,
+        failed.createdAt,
+      );
+    } catch (err) {
+      log(`#${run.issue} previous ${failed.name} run unavailable (${errText(err)}) — retrying next tick`);
+      continue;
+    }
+    if (previous === undefined || (previous !== null && previous.status !== "completed")) continue;
+    const preexisting =
+      previous !== null &&
+      previous.conclusion !== undefined &&
+      FAILING_WORKFLOW_CONCLUSIONS.has(previous.conclusion);
+    const detail =
+      `${failed.name} failed at ${run.mergeSha} — ${failed.url}` +
+      (preexisting ? " (already red before this merge)" : "");
+    const flag: SettlementFlag = { kind: "base-branch-red", file: "(base branch)", detail };
+    const delivered = await safeEscalate(d, {
+      tier: 1,
+      project: d.project.name,
+      issue: run.issue,
+      runId: run.id,
+      summary: `Base branch ${run.baseRef} is red after merge`,
+      detail,
+    });
+    if (!delivered) continue;
+    d.store.updateRun(run.id, {
+      baseCheck: preexisting ? "red-preexisting" : "red",
+      baseCheckAt: now,
+      settlementFlags: appendSettlementFlag(run, flag),
+    });
+  }
+}
+
 export async function settlePushedGreen(
   d: Pick<Deps, "project" | "tracker" | "store">,
 ): Promise<void> {
@@ -1569,16 +2047,39 @@ export async function settlePushedGreen(
 
     const settlement = settlementFor(pr, run.prUrl);
     if (settlement !== undefined) {
+      // A mediated merge enters a second, bounded observation phase. Record the
+      // exact merge commit before the row leaves the active set; if GitHub cannot
+      // supply it yet, retry this settlement next tick rather than create a
+      // merged row whose base result can never be attributed.
+      let merged: MergedPrInfo | undefined;
+      if (settlement.state === "merged") {
+        try {
+          merged = await tracker.mergedPrInfo(run.prUrl);
+        } catch (err) {
+          log(`#${run.issue} not settled: merge identity lookup failed (${errText(err)}) — retrying next tick`);
+          continue;
+        }
+        if (merged === undefined) {
+          log(`#${run.issue} not settled: merge identity unavailable — retrying next tick`);
+          continue;
+        }
+      }
+
       // The label removal and the terminal row are one fact again (#201): the
       // release is enqueued — a durable local write that cannot fail on the
-      // tracker — in the same breath as the row is terminalised, so there is
-      // no window in which a row beyond every later tick still owes its label.
-      // The projector applies it with retry; while pending, the eligibility
-      // overlay treats the label as already gone, so #18's
-      // permanent-`agent:in-progress` cannot re-form even when GitHub refuses
-      // the write.
+      // tracker — in the same breath as the row is terminalised.
       releaseInProgress(d, run.issue, settlement.reason);
-      const patch: Partial<RunRecord> = { state: settlement.state, endedAt: Date.now() };
+      const patch: Partial<RunRecord> = {
+        state: settlement.state,
+        endedAt: Date.now(),
+        ...(merged === undefined
+          ? {}
+          : {
+              mergeSha: merged.mergeSha,
+              baseRef: merged.baseRef,
+              baseCheck: "pending",
+            }),
+      };
       if (settlement.state === "failed") patch.lastError = settlement.reason;
       store.updateRun(run.id, patch);
       log(`#${run.issue} settled: ${settlement.reason}`);
@@ -1611,6 +2112,121 @@ export async function settlePushedGreen(
   }
 }
 
+const ADOPTABLE_PR_STATES: Partial<Record<RunState, true>> = {
+  failed: true,
+  killed: true,
+  orphaned: true,
+  blocked: true,
+};
+
+/**
+ * Reattaches a recovered PR to the terminal run that owns it (#245).
+ *
+ * A worker can fail before its completion report records `prUrl`, then have its
+ * dirty tree committed and pushed by salvage. If that branch already has a PR,
+ * the orchestrator otherwise has no policy-compliant path to inspect or merge
+ * it: ownership is store-backed. Adoption is deliberately stricter than
+ * admission. The tracker query proves the PR closes this run's issue; exact
+ * branch and canonical repository matches prove it is this run's recovered
+ * work, not an unrelated closer. Missing identity is refusal, never a guess.
+ *
+ * The newest run per issue is inspected, at most ten per tick and only inside
+ * the same 30-day window as mediated PR verbs. The cursor advances through the
+ * full eligible set so persistent non-matches cannot starve older recovered
+ * work. Successful adoption is idempotent because the row gains `prUrl`;
+ * non-matches are logged once per daemon process.
+ */
+const rejectedSalvagedPrRuns = new Set<string>();
+const salvagedPrCursor = new Map<string, string>();
+
+export async function adoptSalvagedPrs(
+  d: Pick<Deps, "project" | "tracker" | "store">,
+  now = Date.now(),
+): Promise<void> {
+  const { project, tracker, store } = d;
+  const eligible = store
+    .recentRuns(project.name, now - PR_LOOKUP_WINDOW_MS)
+    .filter(
+      (run) =>
+        ADOPTABLE_PR_STATES[run.state] === true &&
+        run.prUrl === undefined &&
+        run.branch.trim() !== "",
+    );
+  const previous = salvagedPrCursor.get(project.name);
+  const previousIndex =
+    previous === undefined ? -1 : eligible.findIndex((run) => run.id === previous);
+  const start = previousIndex === -1 ? 0 : (previousIndex + 1) % eligible.length;
+  const candidates = Array.from(
+    { length: Math.min(SALVAGED_PR_ADOPTION_BATCH, eligible.length) },
+    (_, offset) => eligible[(start + offset) % eligible.length]!,
+  );
+  const last = candidates.at(-1);
+  if (last !== undefined) salvagedPrCursor.set(project.name, last.id);
+
+  for (const run of candidates) {
+    const repo = project.routing.repos[run.repo];
+    const repoIdentity = repo === undefined ? undefined : githubRepo(repo.cloneUrl);
+    let closers: OpenCloser[];
+    try {
+      closers = await tracker.openClosersFor(run.issue);
+    } catch (err) {
+      log(`#${run.issue} PR adoption lookup failed (${errText(err)}) — retrying next tick`);
+      continue;
+    }
+
+    const closer = closers.find(
+      (candidate) =>
+        candidate.headRefName !== "" &&
+        candidate.headRefName === run.branch &&
+        repo !== undefined &&
+        candidate.repo !== "" &&
+        candidate.repo === repoIdentity,
+    );
+    if (closer === undefined) {
+      if (!rejectedSalvagedPrRuns.has(run.id)) {
+        const observed = closers[0];
+        const reason =
+          observed === undefined
+            ? "no open closing PR"
+            : observed.headRefName === ""
+              ? "closer has no head branch identity"
+              : observed.headRefName !== run.branch
+                ? `closer head ${observed.headRefName} does not match retained branch ${run.branch}`
+                : observed.repo === ""
+                  ? "closer has no repository identity"
+                  : `closer repository ${observed.repo} does not match routed repository`;
+        log(`#${run.issue} PR not adopted onto attempt ${run.attempt}: ${reason}`);
+        rejectedSalvagedPrRuns.add(run.id);
+      }
+      continue;
+    }
+
+    const flag: SettlementFlag = {
+      kind: "pr-adopted",
+      file: "(recovery)",
+      detail: `${closer.url} matched retained branch ${run.branch} in ${closer.repo}`,
+    };
+    store.updateRun(run.id, {
+      prUrl: closer.url,
+      settlementFlags: [...(run.settlementFlags ?? []), flag],
+    });
+    rejectedSalvagedPrRuns.delete(run.id);
+    log(
+      `#${run.issue} adopted PR ${closer.url} onto attempt ${run.attempt}` +
+        (run.salvageSha === undefined ? "" : ` (salvaged head ${run.salvageSha})`),
+    );
+  }
+}
+
+/** Canonical `owner/repo` identity from a configured network clone URL. */
+function githubRepo(cloneUrl: string): string | undefined {
+  const normalized = cloneUrl.replace(/\/$/, "").replace(/\.git$/, "");
+  const match = /^(?:https?:\/\/[^/]+\/|ssh:\/\/git@[^/]+\/|git@[^:]+:)([^/\s]+\/[^/\s]+)$/.exec(
+    normalized,
+  );
+  return match?.[1];
+}
+
 const RETAINED_CLEANUP_BATCH = 10;
 
 export interface RetainedCleanupCursor {
@@ -1724,12 +2340,14 @@ const HOLD_SAMPLE_SIZE = 5;
 const DEGRADED_HOLDS: ReadonlySet<AdmissionHoldReason> = new Set([
   "parent-lookup-error",
   "open-pr-lookup-error",
+  "issue-state-lookup-error",
 ]);
 
 /** Groups transient decisions into the bounded record exposed by status. */
 export function summarizeDispatch(
   ready: number,
   routed: number,
+  claimed: number,
   admitted: number,
   holds: readonly AdmissionHold[],
   completedAt = Date.now(),
@@ -1745,6 +2363,7 @@ export function summarizeDispatch(
     completedAt,
     ready,
     routed,
+    claimed,
     admitted,
     degraded: holds.some((hold) => DEGRADED_HOLDS.has(hold.reason)),
     holds: [...groups]
@@ -1792,6 +2411,7 @@ function planUsageEscalation(project: string, plan: PlanUsageStatus): Escalation
     return {
       ...base,
       tier: 2,
+      category: "fleet-stopped",
       // Dated: a meter that breaks again next month is a new incident, not a
       // repeat of this one.
       summary: `Plan usage source unreadable — ${project} is not claiming new work (${new Date().toISOString().slice(0, 10)})`,
@@ -1810,6 +2430,7 @@ function planUsageEscalation(project: string, plan: PlanUsageStatus): Escalation
     return {
       ...base,
       tier: 2,
+      category: "fleet-stopped",
       summary: `Plan usage cap names an unusable window "${plan.cap?.windowId ?? "?"}" — ${project} is not claiming new work`,
       detail: [
         plan.detail,
@@ -2104,6 +2725,32 @@ export async function admitCandidates(
       log(`#${issue} continuing retained PR ${closer.url} ${resume}`);
     }
 
+    // The queue comes from GitHub's eventually-consistent search index. Re-read
+    // state and labels directly at the last possible moment so a just-closed or
+    // explicitly dequeued issue cannot turn a stale candidate into another
+    // attempt (#247).
+    let snapshot: IssueSnapshot | undefined;
+    try {
+      snapshot = await tracker.issueSnapshot(issue);
+    } catch {
+      snapshot = undefined;
+    }
+    if (snapshot === undefined) {
+      hold(issue, "issue-state-lookup-error");
+      log(`#${issue} held: issue snapshot check failed — retrying next tick`);
+      continue;
+    }
+    if (snapshot.state === "closed") {
+      hold(issue, "issue-closed");
+      log(`#${issue} skipped: issue is closed (search index lag)`);
+      continue;
+    }
+    if (!snapshot.labels.includes(project.queueLabel)) {
+      hold(issue, "issue-dequeued");
+      log(`#${issue} skipped: queue label ${project.queueLabel} was removed (search index lag)`);
+      continue;
+    }
+
     admitted.push({ r, attempt: priorRuns + 1 });
     liveByRepo.set(r.repo.name, (liveByRepo.get(r.repo.name) ?? 0) + 1);
     if (parent !== undefined) {
@@ -2192,6 +2839,16 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // while the fleet is parked or workers are still active. Resident workers run
   // through the pool without blocking this five-minute tick.
   await settlePushedGreen(d);
+  try {
+    await watchMergedBase(d);
+  } catch (err) {
+    log(`base-branch check sweep failed: ${errText(err)}`);
+  }
+  try {
+    await adoptSalvagedPrs(d);
+  } catch (err) {
+    log(`salvaged PR adoption sweep failed: ${errText(err)}`);
+  }
 
   // Immediately after settlement and before any routing, so a class is on the
   // row before the next dispatch decision reads its budgets (#132). Above the
@@ -2284,6 +2941,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     if (integrity.page) {
       const delivered = await safeEscalate(d, {
         tier: 2,
+        category: "fleet-stopped",
         project: project.name,
         issue: NO_ISSUE,
         // Dated for the same reason the spend cap is: the dedup key is the
@@ -2327,6 +2985,10 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     return pending.length === 0 ? issue : { ...issue, labels: effectiveLabels(issue.labels, pending) };
   });
   const { routed, unroutable } = route(effective, project);
+  // Ready issues that route() dropped without a reason carry a state label —
+  // claimed by a live or settling run — so the claimed count is subtraction
+  // rather than a routed-state signal (#228).
+  const claimed = effective.length - routed.length - unroutable.length;
   const routingHolds: AdmissionHold[] = unroutable.map((u) => ({
     issue: u.issue.number,
     reason: `unroutable:${u.reason}`,
@@ -2334,7 +2996,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   const recordDispatch = (admitted: number, holds: readonly AdmissionHold[]): void => {
     store.recordDispatch(
       project.name,
-      summarizeDispatch(ready.length, routed.length, admitted, holds),
+      summarizeDispatch(ready.length, routed.length, claimed, admitted, holds),
     );
   };
 
@@ -2368,6 +3030,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     setPaused(true, { source: "spend-cap", reason: `daily spend reached $${caps.dailySpendUsd}` });
     await safeEscalate(d, {
       tier: 2,
+      category: "fleet-stopped",
       project: project.name,
       issue: NO_ISSUE,
       // Dated so the same cap pages again tomorrow, but only once per day.
@@ -2429,10 +3092,14 @@ export interface DaemonHealthSnapshot {
   paused: boolean;
   activeRuns: number;
   project: string;
+  /** One-shot issue ceilings waiting for the next claim. */
+  turnOverrides: TurnOverride[];
   /** Resident set of this daemon; workers are in-process omp sessions. */
   rssBytes: number;
   dispatch?: DispatchSummary;
   codeGraph?: CodeGraphHealth;
+  /** Live workers in a non-running pause phase; absent/empty = nothing paused. */
+  workers?: { issue: number; runId: string; phase: WorkerPausePhase }[];
 }
 
 export function daemonHealthSnapshot(
@@ -2441,24 +3108,35 @@ export function daemonHealthSnapshot(
   paused = isPaused(),
   rssBytes = process.memoryUsage().rss,
   codeGraph?: CodeGraphHealth,
+  workerControls?: WorkerControlRegistry,
 ): DaemonHealthSnapshot {
   const dispatch = store.latestDispatch(project);
   return {
     ok: true,
     paused,
     activeRuns: store.activeRuns(project).length,
+    turnOverrides: store.listTurnOverrides(project),
     project,
     rssBytes,
     ...(dispatch === undefined ? {} : { dispatch }),
     ...(codeGraph?.configured === true ? { codeGraph } : {}),
+    ...(workerControls === undefined ? {} : { workers: workerControls.snapshot(project) }),
   };
 }
 
+const TURN_OVERRIDE_STATES: ReadonlySet<RunState> = new Set([
+  "failed",
+  "killed",
+  "orphaned",
+  "blocked",
+]);
+
 export async function turnLimitResponse(
   req: Request,
   project: string,
-  store: Pick<Store, "latestRun">,
+  store: Pick<Store, "latestRun" | "setTurnOverride">,
   registry: TurnLimitRegistry,
+  caps: Pick<Caps, "workerMaxTurns" | "workerMaxTurnsCeiling">,
 ): Promise<Response | undefined> {
   const url = new URL(req.url);
   const match = /^\/runs\/(\d+)\/turn-limit$/.exec(url.pathname);
@@ -2492,6 +3170,16 @@ export async function turnLimitResponse(
   }
 
   const issue = Number(match[1]);
+  if ((maxTurns as number) > caps.workerMaxTurnsCeiling) {
+    return Response.json(
+      {
+        error:
+          `#${issue} turn budget ${maxTurns as number} exceeds the ` +
+          `${caps.workerMaxTurnsCeiling}-turn caps.workerMaxTurnsCeiling`,
+      },
+      { status: 422 },
+    );
+  }
   const outcome = registry.extend(project, issue, maxTurns as number);
   if (outcome.kind === "extended") return Response.json(outcome);
   if (outcome.kind === "not-increase") {
@@ -2505,6 +3193,132 @@ export async function turnLimitResponse(
   if (latest === undefined) {
     return Response.json({ error: `no run recorded for #${issue}` }, { status: 404 });
   }
+  if (!TURN_OVERRIDE_STATES.has(latest.state)) {
+    return Response.json(
+      {
+        error:
+          `#${issue} has no live worker controller; its session already settled ` +
+          `or belongs to another daemon (stored state: ${latest.state})`,
+      },
+      { status: 409 },
+    );
+  }
+  if ((maxTurns as number) <= caps.workerMaxTurns) {
+    return Response.json(
+      {
+        error:
+          `#${issue} next-attempt turn budget must exceed the ` +
+          `${caps.workerMaxTurns}-turn caps.workerMaxTurns base`,
+      },
+      { status: 409 },
+    );
+  }
+  store.setTurnOverride(project, issue, maxTurns as number);
+  return Response.json({
+    kind: "next-attempt",
+    issue,
+    nextAttemptMaxTurns: maxTurns,
+    baseMaxTurns: caps.workerMaxTurns,
+  });
+}
+
+export async function workerControlResponse(
+  req: Request,
+  project: string,
+  store: Pick<Store, "latestRun">,
+  registry: WorkerControlRegistry,
+): Promise<Response | undefined> {
+  const url = new URL(req.url);
+  const match = /^\/runs\/(\d+)\/(pause|resume|stop)$/.exec(url.pathname);
+  if (req.method !== "PUT" || match === null) return undefined;
+  if (!req.headers.get("content-type")?.startsWith("application/json")) {
+    return Response.json({ error: "content-type must be application/json" }, { status: 415 });
+  }
+
+  let body: unknown;
+  try {
+    body = await req.json();
+  } catch {
+    return Response.json({ error: "request body must be valid JSON" }, { status: 400 });
+  }
+  if (body === null || typeof body !== "object") {
+    return Response.json({ error: "request body must be a JSON object" }, { status: 400 });
+  }
+  const requestedProject = Reflect.get(body, "project");
+  if (typeof requestedProject !== "string" || requestedProject.length === 0) {
+    return Response.json({ error: "project must be a non-empty string" }, { status: 400 });
+  }
+  if (requestedProject !== project) {
+    return Response.json(
+      { error: `daemon serves project "${project}", not requested project "${requestedProject}"` },
+      { status: 409 },
+    );
+  }
+  const action = match[2] as "pause" | "resume" | "stop";
+  let reason: string | undefined;
+  if (action === "stop") {
+    const rawReason = Reflect.get(body, "reason");
+    if (typeof rawReason !== "string" || rawReason.trim() === "") {
+      return Response.json({ error: "reason must be a non-empty string" }, { status: 400 });
+    }
+    reason = rawReason.trim().replace(/\s+/g, " ");
+    if (reason.length > 500) {
+      return Response.json({ error: "reason must be at most 500 characters" }, { status: 400 });
+    }
+  }
+
+
+  const issue = Number(match[1]);
+  const outcome =
+    action === "pause"
+      ? await registry.pause(project, issue)
+      : action === "resume"
+        ? registry.resume(project, issue)
+        : await registry.stop(project, issue, reason!);
+  if (outcome.kind === "ok") {
+    return Response.json({ runId: outcome.runId, phase: outcome.phase });
+  }
+  if (outcome.kind === "refused") {
+    return Response.json({ error: `#${issue}: ${outcome.error}` }, { status: 409 });
+  }
+  if (outcome.kind === "stopped") {
+    const stopped = store.latestRun(project, issue);
+    if (stopped === undefined || stopped.id !== outcome.runId) {
+      return Response.json(
+        { error: `#${issue} stopped, but its terminal run record is unavailable` },
+        { status: 500 },
+      );
+    }
+    if (stopped.state !== "stopped") {
+      return Response.json({
+        outcome: "already-terminal",
+        runId: stopped.id,
+        state: stopped.state,
+      });
+    }
+    return Response.json({
+      outcome: "stopped",
+      runId: stopped.id,
+      state: stopped.state,
+      reason: outcome.reason,
+      ...(stopped.salvageSha === undefined ? {} : { salvageSha: stopped.salvageSha }),
+      ...(stopped.salvageError === undefined ? {} : { salvageError: stopped.salvageError }),
+      worktree: stopped.worktree,
+    });
+  }
+
+
+  const latest = store.latestRun(project, issue);
+  if (latest === undefined) {
+    return Response.json({ error: `no run recorded for #${issue}` }, { status: 404 });
+  }
+  if (action === "stop" && !LIVE_STATES.includes(latest.state)) {
+    return Response.json({
+      outcome: "already-terminal",
+      runId: latest.id,
+      state: latest.state,
+    });
+  }
   return Response.json(
     {
       error:
@@ -2517,8 +3331,10 @@ export async function turnLimitResponse(
 
 export interface DaemonHttpDeps {
   project: string;
-  store: Pick<Store, "latestRun">;
+  store: Pick<Store, "latestRun" | "setTurnOverride">;
+  caps: () => Pick<Caps, "workerMaxTurns" | "workerMaxTurnsCeiling">;
   turnLimits: TurnLimitRegistry;
+  workerControls: WorkerControlRegistry;
   health: () => DaemonHealthSnapshot;
 }
 
@@ -2526,17 +3342,18 @@ export interface DaemonHttpDeps {
  * The whole HTTP surface, in one named function so a test can pin what is *not*
  * on it.
  *
- * Two routes: a health read, and the turn-limit control. Everything else is
- * 404, and that is the contract — see the prohibition at the `Bun.serve` call
- * for why no mutation may be added here. Extracted from the serve callback
- * precisely so "the daemon's HTTP port exposes no mutation route" is something
- * a test asserts rather than something a reviewer has to notice (#126).
+ * Three route families: the health read, turn-limit control, and live-worker
+ * pause/resume/stop control. Everything else is 404. The controls mutate only
+ * daemon-owned live sessions; tracker and repository mutations stay on the
+ * authenticated per-run channel described at the `Bun.serve` call (#126).
  */
 export async function daemonHttpResponse(req: Request, d: DaemonHttpDeps): Promise<Response> {
   const url = new URL(req.url);
   if (req.method === "GET" && url.pathname === "/healthz") return Response.json(d.health());
-  const control = await turnLimitResponse(req, d.project, d.store, d.turnLimits);
-  return control ?? new Response("not found\n", { status: 404 });
+  const turnLimit = await turnLimitResponse(req, d.project, d.store, d.turnLimits, d.caps());
+  if (turnLimit !== undefined) return turnLimit;
+  const workerControl = await workerControlResponse(req, d.project, d.store, d.workerControls);
+  return workerControl ?? new Response("not found\n", { status: 404 });
 }
 
 export interface StatusSnapshot {
@@ -2563,6 +3380,8 @@ export interface StatusSnapshot {
   /** Newest attempts holding a preserved WIP tip, or a tree that is still the
    *  only copy of work the daemon could not save. */
   salvagedRuns: RunRecord[];
+  /** One-shot issue ceilings waiting for the next claim. */
+  turnOverrides: TurnOverride[];
   /** Reports the operator has not provably received: pending, in-flight with an
    *  unknown outcome, or written off. An empty list is the only honest way to
    *  say "everything authored this cycle actually went out" (#123). */
@@ -2574,6 +3393,8 @@ export interface StatusSnapshot {
    * config does not let it, and an operator who has to know to go looking is an
    * operator who finds out from the tracker instead.
    */
+  /** Newest post-merge base verdict per routed repository within seven days. */
+  baseChecks: RunRecord[];
   verbLedger: VerbLedgerEntry[];
   /** Runs backed by a worker process — the number capacity compares against. */
   liveWorkers: number;
@@ -2637,6 +3458,7 @@ export function statusSnapshotFromStore(
     releaseGrants: resolveReleaseGrants(p),
     activeRuns: store.activeRuns(p.name),
     salvagedRuns: store.salvagedRuns(p.name),
+    turnOverrides: store.listTurnOverrides(p.name),
     openReports: store.openReports(p.name),
     verbLedger: store.verbLedger(p.name, { limit: STATUS_LEDGER_SCAN }),
     liveWorkers: store.liveRuns(p.name).length,
@@ -2651,6 +3473,7 @@ export function statusSnapshotFromStore(
     ...(labelOpsPending === 0 || oldestLabelOpAt === undefined
       ? {}
       : { labelOps: { pending: labelOpsPending, oldestAgeMs: Date.now() - oldestLabelOpAt } }),
+    baseChecks: store.latestBaseChecks(p.name, Date.now() - BASE_STATUS_WINDOW_MS),
   };
 }
 
@@ -2672,7 +3495,7 @@ export function formatDispatchSummary(summary?: DispatchSummary): string {
   if (summary === undefined) return "last dispatch  (none recorded)";
   const lines = [
     `last dispatch  ${new Date(summary.completedAt).toISOString()}${summary.degraded ? "  DEGRADED" : ""}`,
-    `  candidates    ${summary.ready} ready / ${summary.routed} routed`,
+    `  candidates    ${summary.ready} ready / ${summary.claimed ?? 0} in flight / ${summary.routed} spare`,
     `  admitted      ${summary.admitted}`,
   ];
   if (summary.holds.length === 0) {
@@ -2733,6 +3556,21 @@ export function formatReleaseGrants(grants: ResolvedGrants): string[] {
     ...RELEASE_SHAPES.map((shape) => `  ${shape.padEnd(19)}${grants[shape]}`),
   ];
 }
+export function formatBaseChecks(runs: readonly RunRecord[]): string[] {
+  return runs.flatMap((run) => {
+    if (run.baseCheck === undefined) return [];
+    const branch = run.baseRef ?? "?";
+    const flag = run.settlementFlags?.find((candidate) => candidate.kind === "base-branch-red");
+    const verdict =
+      run.baseCheck === "red"
+        ? `RED — ${flag?.detail ?? "workflow failed after merge"}`
+        : run.baseCheck === "red-preexisting"
+          ? `red before merge${flag === undefined ? "" : ` — ${flag.detail}`}`
+          : run.baseCheck;
+    return [`base ${run.repo}/${branch}  ${verdict}`];
+  });
+}
+
 
 export function formatStatus(s: StatusSnapshot): string {
   const lines = [
@@ -2751,6 +3589,9 @@ export function formatStatus(s: StatusSnapshot): string {
     // fleet (#110).
     `  plan usage         ${planUsageLine(s.planUsage)}`,
     `  new worker turns   ${s.caps.workerMaxTurns}`,
+    ...s.turnOverrides.map(
+      ({ issue, maxTurns }) => `  turn override      #${issue} → ${maxTurns} (next attempt)`,
+    ),
     `  worker wall clock  ${Math.round(s.caps.workerWallClockMs / 60_000)}m`,
     `  failed attempts    ${s.caps.maxAttemptsPerIssue}`,
     `  continuations      ${s.caps.maxContinuationsPerIssue}`,
@@ -2777,6 +3618,7 @@ export function formatStatus(s: StatusSnapshot): string {
       if (flagged !== undefined) lines.push(`      ${flagged}`);
     }
   }
+  lines.push(...formatBaseChecks(s.baseChecks));
   lines.push(...formatSalvagedRuns(s.salvagedRuns));
   lines.push(...formatOpenReports(s.openReports));
   lines.push(...formatVerbLedger(s.verbLedger));
@@ -2912,6 +3754,15 @@ export interface SessionError {
   message: string;
 }
 
+export function completionLastError(
+  providerCredit: string | undefined,
+  providerTransient: string | undefined,
+  verifiedReason: string | undefined,
+  sessionErr: SessionError | undefined,
+): string | undefined {
+  return providerCredit ?? providerTransient ?? verifiedReason ?? sessionErr?.message;
+}
+
 /**
  * The last error a transcript recorded, or undefined when it recorded none.
  *
@@ -2978,6 +3829,19 @@ export async function classifyAndRecover(d: Deps): Promise<void> {
   const { project, tracker, store } = d;
   for (const run of store.runsNeedingClassification(project.name, CLASSIFY_BATCH)) {
     const facts: ClassifyFacts = {};
+    let classifiedRun = run;
+    if (run.state === "failed" || run.state === "killed") {
+      const sessionError = readSessionError(run.sessionFile);
+      if (sessionError !== undefined) {
+        if (run.lastError === undefined || run.lastError === sessionError.message) {
+          facts.sessionError = sessionError;
+        }
+        if (run.lastError === undefined) {
+          store.updateRun(run.id, { lastError: sessionError.message });
+          classifiedRun = { ...run, lastError: sessionError.message };
+        }
+      }
+    }
     try {
       if (run.prUrl !== undefined) {
         const pr = await tracker.prState(run.prUrl);
@@ -3004,7 +3868,7 @@ export async function classifyAndRecover(d: Deps): Promise<void> {
       continue;
     }
 
-    const { cls, recovery, evidence } = classifyRun(run, facts);
+    const { cls, recovery, evidence } = classifyRun(classifiedRun, facts);
 
     // A healthy green PR is not a failure of any class. Leaving the row
     // unclassified is what keeps it eligible for the sweep on the tick where its
@@ -3018,7 +3882,7 @@ export async function classifyAndRecover(d: Deps): Promise<void> {
         ? `#${run.issue} retrying ${recovery} for ${cls}: ${evidence}`
         : `#${run.issue} classified ${cls} → ${recovery}: ${evidence}`,
     );
-    await recoverRun(d, run, cls, recovery, evidence);
+    await recoverRun(d, classifiedRun, cls, recovery, evidence);
   }
 }
 
@@ -3084,6 +3948,9 @@ async function recoverRun(
   }
 
   if (recovery === "requeue") {
+    if (cls === "provider-credit") {
+      await reactToProviderCredit(d, run.issue, evidence, run.sessionFile);
+    }
     // A dispatch-infra requeue that keeps landing on the same issue means the
     // mirror for its repo is persistently broken — a ref-lock that retry already
     // exhausted, a dead remote. Requeueing forever spends a turn-0 run per tick
@@ -3104,6 +3971,28 @@ async function recoverRun(
       log(`#${run.issue} escalated from persistent ${cls}: ${evidence}`);
       return;
     }
+    // Same bound for provider-transient: an issue whose stream keeps stalling
+    // mid-run is requeued free (no attempt, no continuation charged) — but a
+    // provider that aborts three times for one issue is down, and a human has
+    // to check its status before hand-requeueing (#220).
+    if (
+      cls === "provider-transient" &&
+      store.classCountFor(project.name, run.issue, "provider-transient") >= PROVIDER_TRANSIENT_MAX_STRIKES
+    ) {
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue: run.issue,
+        summary: `[provider-transient] #${run.issue}: the provider keeps aborting mid-stream — ${evidence}`,
+        detail: [
+          `The provider aborted the stream for #${run.issue} ${PROVIDER_TRANSIENT_MAX_STRIKES} times without the run ever producing a verdict (0 tokens billed each time).`,
+          "Check provider status before requeueing by hand.",
+        ].join("\n"),
+      });
+      store.updateRun(run.id, { recoveredAt: Date.now() });
+      log(`#${run.issue} escalated from persistent ${cls}: ${evidence}`);
+      return;
+    }
     // Only when the tracker still shows this issue as ours to hand back. An
     // issue that is closed, or has no state label, was resolved by another route
     // and requeueing it would dispatch work nobody asked for.
@@ -3476,7 +4365,8 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
         onChildLog: (line) => {
           log(`orchestrator ${line}`);
         },
-        onReleaseBlocked: (shape) => recordReleaseBlock(project.name, "orchestrator", shape),
+        onReleaseBlocked: (shape, context) =>
+          recordReleaseBlock(project.name, "orchestrator", shape, context),
       });
       const transcript = orchestrator.sessionFile();
       log(`orchestrator session ready${transcript === undefined ? "" : ` · ${transcript}`}`);
@@ -3521,6 +4411,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   const turnLimits = createTurnLimitRegistry((runId, maxTurns) => {
     store.updateRun(runId, { maxTurns });
   });
+  const workerControls = createWorkerControlRegistry();
   const d: Deps = {
     project,
     caps,
@@ -3531,6 +4422,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     usage: sharedUsageSource(),
     escalate: (e) => escalator.escalate(e),
     turnLimits,
+    workerControls,
     integrity,
     // Fresh per daemon run, like the integrity gate: a restart is entitled to
     // page again about a stall that is still on disk.
@@ -3607,14 +4499,17 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   process.on("SIGINT", stop);
   process.on("SIGTERM", stop);
 
-  // ── NO MUTATION ROUTE BELONGS ON THIS PORT ────────────────────────────────
+  // ── NO TRACKER OR REPOSITORY MUTATION BELONGS ON THIS PORT ───────────────
   //
   // This is unauthenticated loopback TCP. Every local user can reach it, it
   // carries no credential of any kind, and it cannot tell one caller from
-  // another: `127.0.0.1` is not an identity. `turnLimitResponse` already shows
-  // what that costs — it trusts a body-supplied `project`, which is exactly the
-  // shape "identity from the payload" takes when nobody is watching, and it is
-  // tolerable only because raising a turn ceiling is bounded and reversible.
+  // another: `127.0.0.1` is not an identity. The turn-limit and worker
+  // pause/resume controls trust a body-supplied `project`, which is exactly the
+  // shape "identity from the payload" takes when nobody is watching. They stay
+  // tolerable only because every effect is bounded: pauses are reversible,
+  // live extensions touch one controller, and a persisted next-attempt
+  // override can only raise the project base up to its configured ceiling and
+  // is consumed by one claim.
   //
   // A merge, a push, a release or a label is none of those things. Do not add
   // one here, and do not add "just a small one" behind a shared secret either:
@@ -3629,8 +4524,11 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
       daemonHttpResponse(req, {
         project: project.name,
         store,
+        caps: () => d.caps,
         turnLimits,
-        health: () => daemonHealthSnapshot(store, project.name, undefined, undefined, codeGraph),
+        workerControls,
+        health: () =>
+          daemonHealthSnapshot(store, project.name, undefined, undefined, codeGraph, workerControls),
       }),
   });
   log(`serving /healthz on :${server.port}, project ${project.name}`);