omp-conductor 0.12.0 → 0.13.0

package/README.md

@@ -989,7 +989,8 @@ rest. `0` is a real value (a hard stop), not "unset".
 | `maxConcurrentWorkersPerRepo` | `1` | Max live workers in the **same repo**. The mirror, branch-protection staleness and shared CI egress are all per-repo collision domains, so extra slots should land on other repos. Raise it only when a repo genuinely needs two workers at once. |
 | `dailySpendUsd` | `25` | Rolling-day spend ceiling in USD, or `null` for no spend gate. `0` is a hard stop. Metered from assistant `usage.cost.total`. |
 | `planUsage` | `null` (unmetered) | Subscription/plan allowance guard: `{ "windowId": "anthropic:7d", "maxUsedFraction": 0.85 }`, or `null` for no plan gate. Independent of `dailySpendUsd` — see [Plan allowance](#plan-allowance-planusage) below. |
-| `workerMaxTurns` | `120` | Startup ceiling for each new worker. Catches a session looping without converging; use `omp-conductor extend` to raise one live run without changing this default. |
+| `workerMaxTurns` | `120` | Base ceiling for each new worker. Catches a session looping without converging; use `omp-conductor extend` to raise one live run or one issue's next attempt without changing this default. |
+| `workerMaxTurnsCeiling` | `240` (twice the effective `workerMaxTurns` when omitted) | Upper bound for per-issue turn extensions. Prevents the loopback control from granting an unbounded worker budget. |
 | `workerWallClockMs` | `5400000` (90 minutes) | Wall-clock ceiling for one worker. A session that is merely stuck spends no turns, so turns alone cannot detect it. |
 | `maxAttemptsPerIssue` | `2` | Failed implementation or CI attempts before escalation. Operational stops do not consume this budget, so salvage can continue without stealing the retry needed for a real failure. |
 | `maxContinuationsPerIssue` | `2` | Cap-kill, daemon-orphan and answered-block resumes before escalation. This independently bounds crash/resume loops. |
@@ -1005,19 +1006,31 @@ Work resumes only after `omp-conductor resume` (or `/conductor resume`).
 `workerMaxTurns` and `workerWallClockMs` are enforced inside the session driver.
 The daemon reads a live run's effective turn ceiling at every turn boundary. Use
 `omp-conductor extend <issue> --turns N [--project NAME]` to raise it without
-restarting or reconstructing the session. Extension is monotonic: equal or lower
-values are refused, as are runs whose live controller has already settled. The
-effective value is persisted and shown beside that active run in `status`; editing
-`config.json` changes defaults for future daemon starts, not workers already in
-flight. A cap that fires aborts the run, records it as `killed`, and names the
-ceiling in the escalation.
+restarting or reconstructing the session. For a live worker, extension is
+monotonic: equal or lower values are refused. If the latest run is failed,
+killed, orphaned, or blocked, the command instead stores a one-shot ceiling for
+that issue's next attempt. A next-attempt ceiling must exceed the effective
+project base, and every extension must stay at or below
+`workerMaxTurnsCeiling`. `status` shows both active ceilings and pending
+next-attempt overrides. The store consumes an override atomically when it claims
+the next run, so later attempts return to the project base. Config edits change
+that base on the next tick but do not change workers already in flight. A cap
+that fires aborts the run, records it as `killed`, and names the ceiling in the
+escalation.
 
 Pause one live worker cooperatively with
 `omp-conductor worker pause <issue> [--project NAME]`. The daemon aborts the
 active turn to an idle harness state, freezes the remaining wall-clock budget,
 and keeps the run in the Running lane. `omp-conductor worker resume <issue>`
 continues the same session with a prompt to re-check its last action before
-proceeding. This is separate from fleet-level `pause`, which stops new claims.
+proceeding. To end that run instead, use
+`omp-conductor worker stop <issue> --reason TEXT [--project NAME]`. Stop works
+from running or paused, salvages dirty work before removing the worktree, records
+the distinct terminal `stopped` state, and removes `agent:in-progress` through
+the label outbox. A salvage failure keeps the only copy in place and reports its
+path. Stopped runs consume neither implementation-failure nor continuation
+budget. Repeating stop reports the already-terminal state. These worker controls
+are separate from fleet-level `pause`, which stops new claims.
 
 ### Plan allowance (`planUsage`)
 
@@ -1724,7 +1737,7 @@ policy instead of restating it — no threshold lives in two places.
 
 | Field | Values | Default | Means |
 | --- | --- | --- | --- |
-| `requires` | `runs-settled`, `no-open-prs`, `queue-drained`, `epic-children-closed` | `["runs-settled"]` | What must already have landed. Order and duplicates do not matter; the loader canonicalises. |
+| `requires` | `runs-settled`, `no-open-prs`, `queue-drained`, `base-branch-green`, `epic-children-closed` | `["runs-settled"]` | What must already have landed. `base-branch-green` requires the newest observed post-merge workflow verdict for that routed repository to be green; pending, unknown, red, or no observation refuses release. Order and duplicates do not matter; the loader canonicalises. |
 | `requiredChecks` | any check names | `[]` | Checks that must be green on the branch being released. Empty means every check it reports. |
 | `artefacts` | any names | `[]` | The packages or images this project releases. **Empty denies**: nothing has been authorised to ship. |
 | `environments` | any names | `[]` | Deploy targets. **Empty denies** every environment. |
@@ -1991,6 +2004,7 @@ omp-conductor tail <issue> [--project NAME]
 omp-conductor extend <issue> --turns N [--project NAME]
 omp-conductor worker pause <issue> [--project NAME]
 omp-conductor worker resume <issue> [--project NAME]
+omp-conductor worker stop <issue> --reason TEXT [--project NAME]
 omp-conductor unblock <issue> [--force] [--no-requeue] [--project NAME]
 omp-conductor verb <conductor_*> [--project NAME] [--arg k=v ...]
 omp-conductor friction <escalation-digest|report-noise|report-surprise> --detail TEXT [--issue N] [--project NAME]
@@ -2014,7 +2028,7 @@ omp-conductor help
 | `restart [--now] [--timeout SECONDS] [--port N] [--project NAME]` | Drains the fleet by default: pause new claims, wait until live workers reach `0 / N` (bounded by `--timeout SECONDS`, default 1800 = 30 min), restart, then restore the prior dispatch state. Prefer `systemctl restart` when the unit owns the live pid so the replacement stays supervised; otherwise `stop` then `start`, inheriting the running daemon's port and project unless a flag overrides them. `--now` skips the drain and restarts immediately, orphaning any live runs (old behaviour). A drain that hits `--timeout` restarts nothing and leaves dispatch paused — `omp-conductor resume` lifts it, or re-run `restart` to keep waiting. The new process **salvages dirty live worktrees before orphaning** those rows — see [Deploying a new package onto a busy fleet](#deploying-a-new-package-onto-a-busy-fleet). |
 | `upgrade [--to VERSION] [--project NAME]` | Deterministically update the Bun-global CLI, omp plugin, Herdr recovery plugin, and managed brief as one release. Resolves the npm version and exact `gitHead`, pauses only new claims, drains active workers, installs all surfaces, reloads Herdr and the daemon, waits for pane recovery, verifies identities and fleet health twice, then restores the original dispatch state. A no-op when already current. Failure leaves dispatch paused. Must run outside a Herdr-managed session. |
 | `status [--project NAME]` | Layered fleet report first: `dispatch` / `ticks` / next scheduled tick / `pane` / `recovery` / `herdr` / `telegram` / `brief` / `decisions` / optional `failure classes` and `code graph` / `daemon`, then the project body. The project body includes the latest completed dispatch timestamp, ready/routed/admitted counts, bounded hold groups, and the GitHub API budget (`graphql` / `core` remaining and reset, in the caps block); API failures are marked `DEGRADED` so queue starvation cannot look idle. The next tick comes from the live heartbeat process, not a guess from log timestamps. Telegram health uses `getMe` to prove API authentication without sending a message and reports inbound bridge configuration separately. Configured graphs report prerequisites, indexed repos, timer state, and refresh freshness without blocking dispatch. A `reports` block lists everything the outbox has not delivered, with its age, and prints `pending` (nobody has it) differently from `SENDING` (outcome unknown, it may already have arrived) — see [Report delivery](#report-delivery-the-outbox). The daemon block includes `rss` from `/healthz`; live workers add a busy-deploy warning. A `.conductor-stalled` marker adds an `orchestrator STALLED since …` line. |
-| `ledger [--issue N] [--limit N]` | Every [mediated-verb](#the-mediated-verbs-126) call and how the daemon decided it: the verb, the arguments it was given, allow or refuse, the named refusal reason, and any resulting SHA. Sessions cannot push, open a PR, merge, label or release except through those verbs, so this is the record of what they *tried* as well as what they did — the thing an escalation cites. Reads (`conductor_pr_status`) are deliberately absent: a poll every thirty seconds would bury the refusals. `--issue` narrows to one issue's run; `--limit` defaults to 50. The newest few also appear in `status`. |
+| `ledger [--issue N] [--limit N]` | The action audit: every [mediated-verb](#the-mediated-verbs-126) mutation and every next-attempt turn budget. Verb entries include the arguments, decision, named refusal, and resulting SHA. Turn-budget entries remain after an override is replaced or consumed. Reads (`conductor_pr_status`) are absent so polling cannot bury the signal. `--issue` narrows both histories; `--limit` defaults to 50. Recent verb refusals and pending turn overrides also appear in `status`. |
 | `board [--project NAME]` | Live keyboard-driven kanban over the same SQLite and `/healthz` truth as `status`, plus the tracker's current labels: Queue, Claimed, Running, Green, Blocked, Failed, Orphaned, the last 24 hours of Merged and Settled, and Parked (an issue the tracker has not confirmed closed — still open, or a label read that failed — so nothing dispatches it until a human labels it). Columns are mutually exclusive and describe current state, not the newest run row, so a requeued issue is queued rather than failed and a closed issue is neither. Refreshes run/spend/turn values every second, and health plus the label read every ten seconds. `Enter` follows the selected transcript in place; `u` invokes the existing unblock workflow on a Blocked, Failed, or Orphaned card; `i` / `p` open the issue / PR; `r` refreshes health; `?` shows all keys. Requires an interactive terminal of at least 50×20. |
 | `hold [--project NAME]` | Soft stop: pause claiming **and** disarm ticks. Daemon and pane stay up. Prefer this over `pause` when the intent is "stop the conductor" without killing processes. See [Stop the conductor](#stop-the-conductor-hold--halt). |
 | `halt [--pane] [--project NAME]` | `hold`, then stop the dispatch daemon (systemctl-aware). Pane stays up unless `--pane` is passed. `halt --pane` also pins herdr-conductor recovery off for the conductor agent only — it does **not** stop `herdr-fleet.service` or any other herdr session. Fail-closed: exits nonzero unless the agent is proven gone. |
@@ -2022,8 +2036,9 @@ omp-conductor help
 | `disarm [--project NAME]` | Remove the arm marker so ticks skip. Processes untouched. |
 | `release-pane [--project NAME]` | Clear the `halt --pane` recovery pin so herdr-conductor may resume the fleet agent again. |
 | `tail <issue>` | Follow the newest run for that issue: the worker's assistant text as `assistant: …` and each tool it calls as `tool: <name>`, printed as they land. Workers are omp sessions inside the daemon rather than terminals, so this is the only way to watch one live — a herdr pane running it becomes an observation window. Starts from the top of the transcript, not the end, so attaching to a run that is already ten turns in shows those ten turns. Exits `1` with `no run recorded for #N` when the issue has never been dispatched, or `no transcript yet (state: …)` when the attempt has not opened one. Otherwise it runs until `Ctrl-C`, or until the run has finished and its transcript has been silent for five seconds, and prints `run ended: <state>`. |
-| `extend <issue> --turns N [--project NAME]` | Monotonically raise that live worker's effective turn ceiling through its owning daemon. The current omp session keeps running; no restart or continuation is created. The daemon persists the new ceiling for `status` and rejects missing, settled, cap-killed, equal, or lower requests instead of implying that an immutable session changed. |
-| `worker pause <issue>` / `worker resume <issue>` | Cooperatively park one live worker without changing its run state or lane. Pause aborts the active turn to harness idle and freezes the remaining wall-clock budget; resume continues the same session with a prompt to re-check its last action before repeating it. This is distinct from fleet-level `pause`, which stops new claims. |
+| `extend <issue> --turns N [--project NAME]` | Raise a live worker's effective turn ceiling through its owning daemon without restarting its session. If the latest run is failed, killed, orphaned, or blocked and has no live controller, store a one-shot ceiling for that issue's next claimed attempt instead. A next-attempt value must exceed the project base, every extension must stay at or below `workerMaxTurnsCeiling`, and live extensions remain monotonic. The pending value appears in `status`, is recorded in `ledger`, and is consumed atomically by one claim. |
+| `worker pause <issue>` / `worker resume <issue>` | Cooperatively park one live worker without changing its run state or lane. Pause aborts the active turn to harness idle and freezes the remaining wall-clock budget; resume continues the same session with a prompt to re-check its last action before repeating it. This is separate from fleet-level `pause`, which refuses new claims and work-starting mutations while allowing pre-pause completion work and releases. |
+| `worker stop <issue> --reason TEXT [--project NAME]` | Terminally end a running or cooperatively paused worker. The reason is required (1–500 characters) and persisted on the run. The command waits for settlement, records the distinct `stopped` state, salvages and publishes dirty work, removes `agent:in-progress` through the durable label outbox, and consumes neither failed-attempt nor continuation budget. If salvage fails, the tree holding the only copy stays in place and the command names it. Repeating stop is idempotent and reports the run's already-terminal state. |
 | `unblock <issue> [--force] [--no-requeue]` | Remove that issue's `blocked` and `failed` labels so an answered escalation can be claimed again, and restore the project queue label by default so the dispatcher actually sees it. `agent:in-progress` comes off too, but only when the newest recorded run is terminal — that row is the proof no worker still owns the issue, so a live run keeps the label (and the queue label stays off until that run settles), and so does an issue with no run row at all. Run history remains intact: blocks consume the independent continuation budget, not failed implementation attempts. The output reports both budgets and warns when either will make the next tick escalate instead of dispatch. The label changes go through the [label projection outbox](#the-tick): they are applied inline before the command returns, but **a tracker that refuses them (403, rate limit) no longer fails the verb** — it exits `0`, the intended label state is durable and the daemon retries it, and the output says `label sync queued (N pending) — the daemon retries` instead of claiming the labels were restored. Safety is preserved, but the issue is only claimable once the queue label itself lands: the queue read asks GitHub for issues carrying that label, so a refused queue-label add keeps the issue out of dispatch until projection succeeds. `--no-requeue` clears the state labels only, leaving the queue label untouched — the case where you are about to close the issue. **Refuses, clearing nothing and exiting `3`, when the newest attempt's work could not be committed and its worktree is the only copy** — re-claiming removes that tree. `--force` records the operator's acceptance on the run row and then clears; the salvage failure stays in history. Exits `2` when the issue number is missing or malformed. |
 | `verb <conductor_*> [--arg k=v ...]` | Run one [mediated verb](#the-mediated-verbs-126) as the orchestrator, from the CLI — the external-orchestrator half of the verb surface. Every argument goes in as a `--arg k=v` string; an orchestrator can merge (`conductor_pr_merge`), label (`conductor_label`), release (`conductor_release`), update a branch (`conductor_pr_update_branch`) or title/body (`conductor_pr_update`), or read PR state (`conductor_pr_status`). The daemon applies the same checks and writes the same ledger rows a session's call would; a missing `--arg` is refused exactly as a missing tool argument is, worker-only verbs (`conductor_push`, `conductor_pr_create`) are refused with `role-not-allowed`, and a refusal exits `3`. An unknown verb exits `2`. |
 | `friction <kind> --detail TEXT [--issue N]` | Record one bounded judgment the daemon cannot infer: an escalation belonged in a digest, or a tick report was noise/surprising. The detail is limited to 160 characters. One event never changes policy; three observations inside seven days make the aggregate eligible for one Learning-loop prompt, followed by a seven-day cooldown. |
@@ -2036,7 +2051,7 @@ omp-conductor help
 | `daemon --once` | Run a single tick, wait for workers admitted by that tick, and exit. No HTTP server or pidfile — a drill must not register itself as the daemon, or the next reader believes it and the real daemon's in-flight runs get reconciled as orphans. |
 | `--port N` | Accepted by `start`, `restart` and `daemon`. Both `--port 9000` and `--port=9000` work; missing or out of range exits `2` rather than falling back to the default, because probing the wrong endpoint is worse than a hard failure. |
 | `--project NAME` | Pick the project to service. One daemon process serves exactly one project; with several configured projects the name is required. |
-| `pause [--reason TEXT]` | Stop claiming new work only. The running daemon notices on its next tick; runs already in flight finish. The orchestrator heartbeat keeps ticking if armed — its gate is the arm marker, not this flag. Prefer `hold` to silence both. `--reason TEXT` is recorded in the pause sentinel, which `status` shows as the pause provenance. |
+| `pause [--reason TEXT]` | Stop new claims and work-starting mutations only. The running daemon notices on its next tick; runs already in flight finish. The orchestrator may still merge, update, or label runs admitted before the pause, and may release when the release policy's own preconditions hold. The orchestrator heartbeat keeps ticking if armed — its gate is the arm marker, not this flag. Per-worker pause is separate. Prefer `hold` to silence both. `--reason TEXT` is recorded in the pause sentinel, which `status` shows as the pause provenance. |
 | `resume` | Clear pause only — does **not** re-arm. Run `arm` after an inbound Telegram proof to resume ticks. |
 | `--version`, `-V`, `version` | Print the installed `omp-conductor` package version and exit `0`. Works from the global binary and npm/plugin install because it reads the package metadata beside the shipped CLI. |
 | `graph-setup` | Print how to set up the code-graph indexes workers query instead of grepping: a `git clone` for every index-only clone that does not exist yet, the one-shot index command per repo, and a `cbm-reindex.service` + `cbm-reindex.timer` pair generated from the project's own repos and branches. Reads only, so it is safe on a host where you are not root. Exits `1` when no repo in the project has [`graphProject`](#configuration) set, because the fix is a wizard answer rather than a flag. See [Code-graph discovery](#code-graph-discovery). |
@@ -2049,8 +2064,11 @@ omp-conductor help
 | `help`, `--help`, `-h` | Print usage. An unknown or missing verb prints it too, and exits `2`. |
 
 Pause is a flag file under the state directory, so it applies to every project and
-survives a daemon restart. Hold also removes the arm marker the heartbeat reads,
-so both brains go quiet without killing processes.
+survives a daemon restart. It refuses new claims and work-starting mutations,
+allows completion verbs only for runs admitted before the pause, and leaves
+`conductor_release` to its normal authority, grant, and precondition checks.
+Per-worker pause is independent. Hold also removes the arm marker the heartbeat
+reads, so both brains go quiet without killing processes.
 
 These are available in-session as `/conductor setup`, `/conductor status`,
 `/conductor hold`, `/conductor halt [--pane]`, `/conductor arm`, `/conductor disarm`,
@@ -2210,7 +2228,7 @@ What holds the orchestrator instead:
 | | |
 | --- | --- |
 | **The brief** | `ORCHESTRATOR.md`'s hard boundaries — never read or edit a worker's checkout or the mirror cache; when you need a run's code, read its PR. |
-| **The verb ledger** | Every `conductor_*` call records what was asked for and what the dispatcher decided, refusals included. `omp-conductor ledger` is the audit. |
+| **The action ledger** | Every `conductor_*` mutation and operator-selected next-attempt turn budget remains auditable. `omp-conductor ledger` shows both, including refused calls and consumed or replaced budget overrides. |
 | **The dispatcher** | Merge, label and release authority are checked in the daemon against the operator's grant, across a process boundary, never in the prompt. |
 
 Unconfined means auditable, not licensed. `orchestratorReadPaths` is retired: it
@@ -2325,9 +2343,12 @@ no socket it fails closed and says so, rather than reaching for `git push`.
 
 ### The ledger
 
-Every mutating call is recorded with its arguments, the decision, the named
-refusal reason and any resulting SHA. Reads are not: a status poll every thirty
-seconds would bury the refusals the record exists to surface.
+Every mutating verb call is recorded with its arguments, the decision, the
+named refusal reason and any resulting SHA. Reads are not: a status poll every
+thirty seconds would bury the refusals the record exists to surface.
+
+Every `extend` that sets a next-attempt budget also appends an audit entry.
+Replacing or consuming the pending override does not erase that history.
 
 ```console
 $ omp-conductor ledger --issue 7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.12.0",
+  "version": "0.13.0",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/board.ts

@@ -95,7 +95,7 @@ const LIVE_LANES: Partial<Record<RunState, BoardLane>> = {
  *  that has to stay visible — #173. Differs from {@link LIVE_LANES} in that
  *  these are rows, never current work, and from MERGED in that they are not a
  *  happy resolution. */
-const PARKED_STATES = new Set<RunState>(["blocked", "failed", "killed", "orphaned"]);
+const PARKED_STATES = new Set<RunState>(["blocked", "failed", "killed", "stopped", "orphaned"]);
 
 /** Whether a terminal blocked/failed run is wearing its own state label. When
  *  the label is absent the run row is the only record of what happened, so the

package/src/briefs/orchestrator.md

@@ -351,6 +351,7 @@ the same checks and the same ledger rows, through the CLI:
 omp-conductor verb conductor_pr_merge --arg prUrl=<url> --arg headSha=<sha> --arg reason=<reason>
 omp-conductor verb conductor_label --arg issueUrl=<url> --arg label=<name> --arg action=add --arg reason=<reason>
 omp-conductor verb conductor_release --arg shape=git-tag --arg repo=<name> --arg reason=<reason> --arg tag=<tag>
+omp-conductor verb conductor_pr_status --arg prUrl=<url>
 omp-conductor verb conductor_pr_update_branch --arg prUrl=<url>
 omp-conductor verb conductor_pr_update --arg prUrl=<url> --arg title=<title>
 ```
@@ -368,8 +369,37 @@ sessions do not.
 | `conductor_label` | always | The label is one this project declared. Lifecycle labels (`agent:in-progress`, `agent:blocked`, `agent:failed`) are refused — those stay the dispatcher's, and `omp-conductor unblock` is how you clear them. |
 | `conductor_release` | `authority.release` is yours | You are the configured holder, the shape is granted, the artefact or environment was declared, and the release preconditions hold. |
 
-**`conductor_pr_merge` wants the SHA you believe you are merging.** Read it with
-`conductor_pr_status` and pass it. The dispatcher re-reads the live head
+### Stopping and pausing
+
+Four controls stop different work:
+
+- **Pause one worker:** `omp-conductor worker pause <issue>` cooperatively drains
+  the active turn to harness idle, freezes its remaining wall clock, and keeps
+  the same live run, session, attempt and worktree. Its slot stays occupied and
+  its lifecycle labels stay in place. `omp-conductor worker resume <issue>`
+  continues that same session with a prompt to re-check its last action before
+  proceeding.
+- **End one worker:** `omp-conductor worker stop <issue> --reason TEXT`
+  terminally settles a running or paused run as `stopped`. It salvages dirty
+  work, releases the worker slot, and removes `agent:in-progress`; it does not
+  spend a failure or continuation budget. Use it when the operator explicitly
+  ends obsolete or already-delivered work. A salvage failure keeps the tree and
+  names the path; recover that copy before any forced unblock.
+- **Fleet dispatch:** `omp-conductor pause` stops new claims and work-starting
+  mutations. Work admitted before the pause may still complete, and completion
+  verbs and releases remain available.
+- **Orchestrator ticks:** `omp-conductor disarm` removes the operator-owned
+  `ARMED` marker so ticks skip. It does not pause workers or stop processes.
+
+Per-worker pause is not SIGSTOP/SIGCONT, fleet pause, unblock/requeue, or a
+durable restart boundary. Daemon loss still follows the normal salvage and
+orphan handling. Pause only when the operator asks to park one worker, or when
+one live run must quiesce before resolving a proven shared-state collision.
+Never pause routine work speculatively.
+
+**`conductor_pr_merge` wants the SHA you believe you are merging.** Call
+`conductor_pr_status` with the PR URL; its reply includes the current full SHA.
+Pass that SHA to `conductor_pr_merge`. The dispatcher re-reads the live head
 immediately before merging and refuses on any mismatch, naming both SHAs —
 because any push since you looked invalidates the green you saw. A refusal there
 is the mechanism working: re-read, re-check, call again.

package/src/cli.ts

@@ -106,6 +106,7 @@ usage:
   omp-conductor extend <issue> --turns N [--project NAME]
   omp-conductor worker pause <issue> [--project NAME]
   omp-conductor worker resume <issue> [--project NAME]
+  omp-conductor worker stop <issue> --reason TEXT [--project NAME]
   omp-conductor unblock <issue> [--force] [--no-requeue] [--project NAME]
   omp-conductor verb <conductor_*> [--project NAME] [--arg k=v ...]
   omp-conductor daemon [--once] [--port N] [--project NAME]
@@ -172,8 +173,9 @@ usage:
            the daemon rather than terminals, so this is the only way to watch
            one live. Runs until Ctrl-C, or until the run has finished and its
            transcript has stopped growing.
-  extend   monotonically raise a live run's turn ceiling without restarting its
-           session. Refuses settled runs and values at or below its current cap.
+  extend   raise a live run's turn ceiling, or set a bounded one-shot ceiling
+           after a failed, killed, orphaned or blocked run. Refuses values outside
+           configured bounds.
   worker   cooperatively pause one live worker at harness idle, then resume the
            same session with a continuation prompt. Its wall clock is frozen
            while parked. Distinct from fleet-level pause/resume.
@@ -612,14 +614,11 @@ try {
     }
 
     /**
-     * The action ledger (#126): every conductor-verb call, what it asked for,
-     * and how the daemon decided it.
-     *
-     * Its own command as well as a block in `status`, because the two questions
-     * are different sizes. `status` answers "is anything being refused right
-     * now"; this answers "what did run 3 actually try to do", which is the
-     * question an escalation about a run asks, and it needs the whole record
-     * rather than the newest five lines of every run at once.
+     * The action ledger: mediated conductor verbs plus durable per-issue budget
+     * changes. Its own command as well as a block in `status`, because the two
+     * questions are different sizes. `status` answers "what is pending or being
+     * refused now"; this answers "what did run 3 actually try, and what budget
+     * did the operator assign", which needs history rather than only live state.
      */
     case "ledger": {
       const cfg = loadConfig();
@@ -641,18 +640,38 @@ try {
           ...(issue === undefined ? {} : { issue }),
           limit,
         });
-        if (entries.length === 0) {
+        const overrides = store.turnOverrideLedger(p.name, {
+          ...(issue === undefined ? {} : { issue }),
+          limit,
+        });
+        if (entries.length === 0 && overrides.length === 0) {
           process.stdout.write(
-            `no conductor-verb calls recorded for ${p.name}` +
+            `no conductor actions recorded for ${p.name}` +
               `${issue === undefined ? "" : ` on #${String(issue)}`}\n`,
           );
           break;
         }
-        const refused = entries.filter((e) => e.decision === "refused").length;
-        process.stdout.write(
-          `${p.name} — ${entries.length} verb call(s), ${refused} refused (newest first)\n` +
-            `${entries.flatMap(formatVerbLedgerEntry).join("\n")}\n`,
-        );
+        const blocks: string[] = [];
+        if (entries.length > 0) {
+          const refused = entries.filter((e) => e.decision === "refused").length;
+          blocks.push(
+            `${p.name} — ${entries.length} verb call(s), ${refused} refused (newest first)\n` +
+              entries.flatMap(formatVerbLedgerEntry).join("\n"),
+          );
+        }
+        if (overrides.length > 0) {
+          blocks.push(
+            `${p.name} — ${overrides.length} turn override(s) (newest first)\n` +
+              overrides
+                .map(
+                  (entry) =>
+                    `  ${new Date(entry.setAt).toISOString()}  #${entry.issue}  ` +
+                    `${entry.maxTurns} turns`,
+                )
+                .join("\n"),
+          );
+        }
+        process.stdout.write(`${blocks.join("\n\n")}\n`);
       } finally {
         store.close();
       }
@@ -774,14 +793,30 @@ try {
       );
       const payload = (await response.json()) as {
         error?: unknown;
+        kind?: unknown;
         runId?: unknown;
         maxTurns?: unknown;
+        issue?: unknown;
+        nextAttemptMaxTurns?: unknown;
+        baseMaxTurns?: unknown;
       };
       if (!response.ok) {
         throw new Error(
           typeof payload.error === "string" ? payload.error : `daemon returned HTTP ${response.status}`,
         );
       }
+      if (
+        payload.kind === "next-attempt" &&
+        payload.issue === issue &&
+        typeof payload.nextAttemptMaxTurns === "number" &&
+        typeof payload.baseMaxTurns === "number"
+      ) {
+        process.stdout.write(
+          `#${issue} next attempt turn ceiling set to ${payload.nextAttemptMaxTurns} ` +
+            `(project base ${payload.baseMaxTurns})\n`,
+        );
+        break;
+      }
       if (typeof payload.runId !== "string" || typeof payload.maxTurns !== "number") {
         throw new Error("daemon returned an invalid turn-extension response");
       }
@@ -793,13 +828,21 @@ try {
 
     case "worker": {
       const sub = argv[1];
-      if (sub !== "pause" && sub !== "resume") {
+      if (sub !== "pause" && sub !== "resume" && sub !== "stop") {
         process.stderr.write(
-          "omp-conductor: worker needs pause or resume, then an issue number\n",
+          "omp-conductor: worker needs pause, resume, or stop, then an issue number\n",
         );
         process.exit(2);
       }
       const issue = issueArg("worker", argv[2]);
+      const rawReason = sub === "stop" ? flag(argv, "reason") : undefined;
+      const reason = rawReason?.trim().replace(/\s+/g, " ");
+      if (sub === "stop" && (reason === undefined || reason === "" || reason.length > 500)) {
+        process.stderr.write(
+          "omp-conductor: worker stop needs --reason with 1-500 characters\n",
+        );
+        process.exit(2);
+      }
       const project = findProject(loadConfig(), flag(argv, "project"));
       const daemon = livingDaemon();
       if (daemon === undefined) throw new Error("daemon is not running");
@@ -813,25 +856,63 @@ try {
         {
           method: "PUT",
           headers: { "content-type": "application/json" },
-          body: JSON.stringify({ project: project.name }),
+          body: JSON.stringify({
+            project: project.name,
+            ...(reason === undefined ? {} : { reason }),
+          }),
         },
       );
       const payload = (await response.json()) as {
         error?: unknown;
         runId?: unknown;
         phase?: unknown;
+        outcome?: unknown;
+        state?: unknown;
+        reason?: unknown;
+        salvageSha?: unknown;
+        salvageError?: unknown;
+        worktree?: unknown;
       };
       if (!response.ok) {
         throw new Error(
           typeof payload.error === "string" ? payload.error : `daemon returned HTTP ${response.status}`,
         );
       }
+      if (sub === "stop") {
+        if (
+          typeof payload.runId !== "string" ||
+          typeof payload.state !== "string" ||
+          (payload.outcome !== "stopped" && payload.outcome !== "already-terminal")
+        ) {
+          throw new Error("daemon returned an invalid worker-stop response");
+        }
+        if (payload.outcome === "already-terminal") {
+          process.stdout.write(
+            `#${issue} worker already terminal: ${payload.state} (run ${payload.runId})\n`,
+          );
+          break;
+        }
+        if (typeof payload.reason !== "string") {
+          throw new Error("daemon returned an invalid worker-stop response");
+        }
+        process.stdout.write(
+          `#${issue} worker stopped (run ${payload.runId}): ${payload.reason}\n`,
+        );
+        if (typeof payload.salvageSha === "string") {
+          process.stdout.write(`work preserved: ${payload.salvageSha}\n`);
+        }
+        if (typeof payload.salvageError === "string") {
+          process.stdout.write(
+            `WIP SALVAGE FAILED: ${payload.salvageError}\n` +
+            `worktree kept: ${typeof payload.worktree === "string" ? payload.worktree : "(path unavailable)"}\n`,
+          );
+        }
+        break;
+      }
       if (typeof payload.runId !== "string" || typeof payload.phase !== "string") {
         throw new Error("daemon returned an invalid worker-control response");
       }
-      process.stdout.write(
-        `#${issue} worker ${payload.phase} (run ${payload.runId})\n`,
-      );
+      process.stdout.write(`#${issue} worker ${payload.phase} (run ${payload.runId})\n`);
       break;
     }
 

package/src/config.ts

@@ -227,12 +227,16 @@ export function writeConfigRaw(text: string): void {
  */
 export function resolveCaps(p: ProjectConfig, defaults: Caps): Caps {
   const o: Partial<Caps> = p.caps ?? {};
+  const workerMaxTurns = o.workerMaxTurns ?? defaults.workerMaxTurns;
   return {
     maxConcurrentWorkers: o.maxConcurrentWorkers ?? defaults.maxConcurrentWorkers,
     maxConcurrentWorkersPerRepo: o.maxConcurrentWorkersPerRepo ?? defaults.maxConcurrentWorkersPerRepo,
     dailySpendUsd: o.dailySpendUsd !== undefined ? o.dailySpendUsd : defaults.dailySpendUsd,
     planUsage: o.planUsage !== undefined ? o.planUsage : defaults.planUsage,
-    workerMaxTurns: o.workerMaxTurns ?? defaults.workerMaxTurns,
+    workerMaxTurns,
+    workerMaxTurnsCeiling:
+      o.workerMaxTurnsCeiling ??
+      (o.workerMaxTurns === undefined ? defaults.workerMaxTurnsCeiling : workerMaxTurns * 2),
     workerWallClockMs: o.workerWallClockMs ?? defaults.workerWallClockMs,
     maxAttemptsPerIssue: o.maxAttemptsPerIssue ?? defaults.maxAttemptsPerIssue,
     maxContinuationsPerIssue:
@@ -366,9 +370,13 @@ function validate(parsed: unknown, path: string): ConductorConfig {
     );
   }
 
+  const configuredDefaults = coerceCaps(root["defaults"], `"defaults"`, problems, legacyCaps);
+  const defaultWorkerMaxTurns = configuredDefaults.workerMaxTurns ?? DEFAULT_CAPS.workerMaxTurns;
   const defaults: Caps = {
     ...DEFAULT_CAPS,
-    ...coerceCaps(root["defaults"], `"defaults"`, problems, legacyCaps),
+    ...configuredDefaults,
+    workerMaxTurnsCeiling:
+      configuredDefaults.workerMaxTurnsCeiling ?? defaultWorkerMaxTurns * 2,
   };
 
   const rawProjects = root["projects"];