omp-conductor 0.12.0 → 0.14.0

package/src/daemon.ts

@@ -18,11 +18,13 @@ import {
   resolveReleaseGrants,
   stateDir,
 } from "./config.ts";
+import { availabilityState, type AvailabilityState } from "./availability.ts";
 import {
   analyseSettlement,
   formatSettlementFlags,
   settlementFlagSummary,
 } from "./diff-flags.ts";
+import { digestScheduleState, type DigestScheduleState } from "./digest-schedule.ts";
 import { createEscalator, escalationIssueRef } from "./escalate.ts";
 import { pendingCodeGraph, probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
 import { graphHint } from "./graph.ts";
@@ -30,22 +32,34 @@ import { livingDaemon } from "./lifecycle.ts";
 import { STALL_MARKER_FILE } from "./orchestrator-tick.ts";
 import { startOrchestrator } from "./orchestrator.ts";
 import type { OrchestratorHandle } from "./orchestrator.ts";
-import { createReportOutbox, formatOpenReports } from "./reports.ts";
-import { recordReleaseBlock } from "./release-policy.ts";
+import {
+  createReportOutbox,
+  enqueueAvailableHeldNotices,
+  formatOpenReports,
+} from "./reports.ts";
+import {
+  recordReleaseBlock,
+  type ReleaseBlockContext,
+} from "./release-policy.ts";
 import { branchName, effectiveLabels, route } from "./routing.ts";
 import type { Routed, UnroutableReason } from "./routing.ts";
 import { evaluateDecisionConditions, probeNpmVersion, probeRateLimitReset } from "./decisions.ts";
 import { classifyRun, providerCreditRefusal, providerTransientFault, type ClassifyFacts } from "./failure-class.ts";
 import { projectLabels } from "./label-projection.ts";
-import { dbPath, openStore, utcDay } from "./store.ts";
+import { dbPath, LIVE_STATES, openStore, utcDay } from "./store.ts";
 import { makeTracker, type RateLimitStatus } from "./tracker/github.ts";
-import { RELEASE_SHAPES } from "./types.ts";
+import { DEFAULT_REPORT_POLICY, RELEASE_SHAPES } from "./types.ts";
 import type {
+  BaseHealth,
   AdmissionHoldReason,
   Caps,
   DispatchSummary,
+  DigestBacklog,
   Escalation,
+  IssueSnapshot,
+  MergedPrInfo,
   OpenCloser,
+  ReleaseShape,
   PrState,
   ProjectConfig,
   ReadyIssue,
@@ -60,12 +74,14 @@ import type {
   Store,
   Tracker,
   VerbLedgerEntry,
+  TurnOverride,
 } from "./types.ts";
 import {
   type KilledBy,
   type WorkerPauseControl,
   type WorkerPausePhase,
   type WorkerResult,
+  type RunWorkerDeps,
   renderBrief,
   runWorker,
 } from "./worker.ts";
@@ -82,8 +98,13 @@ import {
 } from "./worktree.ts";
 import { githubVerbActions } from "./verbs/actions.ts";
 import { formatVerbLedger, STATUS_LEDGER_SCAN } from "./verbs/ledger.ts";
-import { listenVerbChannel } from "./verbs/server.ts";
-import type { VerbActions, VerbDeps, VerbListener } from "./verbs/server.ts";
+import {
+  listenVerbChannel,
+  PR_LOOKUP_WINDOW_MS,
+  type VerbActions,
+  type VerbDeps,
+  type VerbListener,
+} from "./verbs/server.ts";
 import {
   ensureVerbSocketDir,
   peerCredentialReader,
@@ -120,6 +141,9 @@ const DISPATCH_INFRA_MAX_STRIKES = 3;
  *  provider itself is degraded, not unlucky, and the sweep escalates to a
  *  human instead of requeueing into a down provider forever (#220). */
 const PROVIDER_TRANSIENT_MAX_STRIKES = 3;
+/** Terminal rows inspected for a salvaged PR per tick. GitHub provenance reads
+ *  are maintenance, but a backlog must not turn one tick into an API burst. */
+const SALVAGED_PR_ADOPTION_BATCH = 10;
 const DEFAULT_PORT = 8787;
 const BRIEF_TEMPLATE_PATH = join(import.meta.dir, "briefs", "worker.md");
 
@@ -151,12 +175,17 @@ interface Deps {
   caps: Caps;
   tracker: Tracker;
   store: Store;
+  /** False after a live config reload fails; autonomous delivery then holds
+   * fail-closed until a later tick validates the config again. */
+  deliveryPolicyValid?: boolean;
   /** Provider-reported plan allowance, cached with a TTL. Resolved once at
    *  startup like every other dep so a tick cannot swap its own meter. */
   usage: UsageSource;
   escalate(e: Escalation): Promise<void>;
   turnLimits: TurnLimitRegistry;
   workerControls: WorkerControlRegistry;
+  /** Session seam for lifecycle integration tests; production uses the real harness. */
+  workerDeps?: RunWorkerDeps;
   integrity: IntegrityGate;
   stall: StallGate;
   cleanup?: RetainedCleanupCursor;
@@ -212,18 +241,25 @@ export function verbDeps(d: Pick<Deps, "project" | "store" | "tracker" | "verbAc
 
 // ------------------------------------------------------- orchestrator liveness
 
+/** No more than one reminder per hour while the same marker remains. */
+const STALL_RENOTIFY_MS = 60 * 60_000;
+
 /**
- * Whether the wedged-orchestrator page has already gone out for the stall
- * currently on disk. One page per episode: the marker persists until a tick is
- * consumed, so paging per five minutes would be paging forever.
+ * Whether the wedged-orchestrator page has gone out, and when it last went out,
+ * for the stall currently on disk.
  */
 export interface StallGate {
   paged: boolean;
+  lastPagedAt?: number;
 }
 
 export interface StallVerdict {
   /** The marker's own line, when one is there. */
   since?: string;
+  /** Count written by the stalled tick producer, when its marker is readable. */
+  unconsumedTicks?: number;
+  /** Whole hours elapsed since the marker timestamp, when it is parseable. */
+  stalledHours?: number;
   page: boolean;
 }
 
@@ -246,51 +282,84 @@ export interface StallVerdict {
  *
  * Resets when the marker disappears, so a second stall days later pages again.
  */
-export function checkStall(gate: StallGate, marker: string): StallVerdict {
+export function checkStall(gate: StallGate, marker: string, now = Date.now()): StallVerdict {
   if (!existsSync(marker)) {
     gate.paged = false;
+    delete gate.lastPagedAt;
     return { page: false };
   }
-  const page = !gate.paged;
+  const page =
+    !gate.paged ||
+    gate.lastPagedAt === undefined ||
+    now - gate.lastPagedAt >= STALL_RENOTIFY_MS;
   let since: string | undefined;
+  let unconsumedTicks: number | undefined;
+  let stalledHours: number | undefined;
   try {
     const body = readFileSync(marker, "utf8").split("\n")[0]?.trim();
-    if (body !== undefined && body !== "") since = body;
+    if (body !== undefined && body !== "") {
+      since = body;
+      const ticks = /\b(\d+) ticks queued unconsumed\b/.exec(body)?.[1];
+      if (ticks !== undefined) unconsumedTicks = Number(ticks);
+      const startedAt = Date.parse(body.split(/\s+/, 1)[0] ?? "");
+      if (Number.isFinite(startedAt)) {
+        stalledHours = Math.max(0, Math.floor((now - startedAt) / STALL_RENOTIFY_MS));
+      }
+    }
   } catch {
-    // An unreadable marker still means stalled; the timestamp is a nicety.
+    // An unreadable marker still means stalled; its evidence is a nicety.
   }
-  return { ...(since === undefined ? {} : { since }), page };
+  return {
+    ...(since === undefined ? {} : { since }),
+    ...(unconsumedTicks === undefined ? {} : { unconsumedTicks }),
+    ...(stalledHours === undefined ? {} : { stalledHours }),
+    page,
+  };
 }
 
 /**
- * Pages tier 2 once when the orchestrator session stops draining its queue.
+ * Pages tier 2 when the orchestrator session stops draining its queue.
  *
  * Deliberately does not restart anything. A wedge lands mid-turn, this process
  * cannot tell a half-applied edit from an idle loop, and killing the session
  * could destroy work an operator would rather read first — the same refusal to
  * guess that the recovery plugin is built on.
  */
-async function watchOrchestrator(d: Deps): Promise<void> {
+export async function watchOrchestrator(d: Deps, now = Date.now()): Promise<void> {
   const marker = join(stateDir(), STALL_MARKER_FILE);
-  const verdict = checkStall(d.stall, marker);
+  const repeat = d.stall.paged;
+  const verdict = checkStall(d.stall, marker, now);
   if (!verdict.page) return;
 
+  const greenRuns = d.store.activeRuns(d.project.name).filter((run) => run.state === "pushed-green");
+  const repeatSuffix = repeat
+    ? ` — still stalled (${
+        verdict.stalledHours === undefined
+          ? `${new Date(now).toISOString().slice(0, 13)}Z`
+          : `${verdict.stalledHours}h`
+      })`
+    : "";
+
   log(`ERROR: the orchestrator session is not draining its queue — ${verdict.since ?? "no timestamp"}`);
   const delivered = await safeEscalate(d, {
     tier: 2,
     category: "confirmed-failure",
+    urgent: true,
     project: d.project.name,
     issue: NO_ISSUE,
     // Keyed on the marker's own timestamp, not the date. The dedup ledger keys
     // on this summary, and two wedges in one day is not a hypothetical — the
     // failure mode is a session that gets stuck, gets restarted, and gets stuck
-    // again on the same cause an hour later. A day-keyed summary would report
-    // the first and silently swallow every one after it.
+    // again on the same cause an hour later. The hourly suffix makes bounded
+    // reminders distinct without allowing every five-minute tick through.
     summary:
       `Orchestrator session wedged (${verdict.since ?? `marker at ${marker}`}) — ` +
-      `it has stopped reading its queue (${d.project.name})`,
+      `it has stopped reading its queue (${d.project.name})${repeatSuffix}`,
     detail: [
       verdict.since ?? "Marker present with no readable timestamp.",
+      `Unconsumed ticks: ${verdict.unconsumedTicks ?? "unknown"}`,
+      `Open green worker PRs: ${greenRuns.length}`,
+      ...greenRuns.map((run) => `- ${run.prUrl ?? `#${run.issue} (PR URL unavailable)`}`),
       `Marker: ${marker}`,
       "",
       "Its process and its herdr agent label are both healthy, which is why nothing else noticed:",
@@ -302,7 +371,7 @@ async function watchOrchestrator(d: Deps): Promise<void> {
       "Dispatch is unaffected: workers keep running. What stops is drain, groom, report and merge.",
     ].join("\n"),
   });
-  markPaged(d.stall, delivered);
+  markPaged(d.stall, delivered, now);
 }
 
 /**
@@ -319,10 +388,10 @@ export function isPaused(): boolean {
  * The epoch-ms timestamp at which the current pause began, read from the same
  * sentinel file {@link setPaused} writes (`<stateDir()>/paused`). Returns
  * `undefined` when the fleet is not paused, or when the file's first line does
- * not parse as a date — a legacy/blank sentinel keeps today's refuse-everything
- * behavior, because a run admitted before an *unknown* pause cannot be proven
- * innocent. {@link isPaused} is the authority on *whether*; this answers
- * *since when*.
+ * not parse as a date. A legacy/blank sentinel keeps completion mutations
+ * fail-closed because a run admitted before an *unknown* pause cannot be proven
+ * innocent. {@link isPaused} is the authority on *whether*; this answers *since
+ * when*.
  */
 export function pausedAt(): number | undefined {
   const f = join(stateDir(), "paused");
@@ -333,8 +402,8 @@ export function pausedAt(): number | undefined {
     const t = Date.parse(first);
     return Number.isNaN(t) ? undefined : t;
   } catch {
-    // Unreadable sentinel (permissions, corruption): fail closed like an
-    // unparseable line — refuse mutations while the pause is unprovable.
+    // Unreadable sentinel (permissions, corruption): fail completion mutations
+    // closed like an unparseable line while the pause time is unprovable.
     return undefined;
   }
 }
@@ -359,8 +428,8 @@ export function pauseProvenance(): { source: string; reason?: string } | undefin
     const reason = match[2];
     return { source, ...(reason === undefined ? {} : { reason }) };
   } catch {
-    // Unreadable sentinel: no provenance to name, and the refuse-everything
-    // posture of an unknown pause is unchanged.
+    // Unreadable sentinel: no provenance to name. Completion mutations still
+    // fail closed because the pause time is unknown.
     return undefined;
   }
 }
@@ -471,9 +540,17 @@ export function checkIntegrity(gate: IntegrityGate, current: Map<string, string>
   return { diff, pause: true, page: !gate.paged };
 }
 
-/** Latch a once-only page, after delivery is confirmed and never before. */
-export function markPaged(gate: { paged: boolean }, delivered: boolean): void {
-  if (delivered) gate.paged = true;
+/** Latch a page after delivery is confirmed, and never before. */
+export function markPaged(gate: StallGate, delivered: boolean, now: number): void;
+export function markPaged(gate: IntegrityGate, delivered: boolean): void;
+export function markPaged(
+  gate: { paged: boolean; lastPagedAt?: number },
+  delivered: boolean,
+  now?: number,
+): void {
+  if (!delivered) return;
+  gate.paged = true;
+  if (now !== undefined) gate.lastPagedAt = now;
 }
 
 // ---------------------------------------------------------------------- helpers
@@ -543,6 +620,32 @@ function swapLabel(store: Store, projectName: string, issue: number, from: strin
     { issue, op: "remove", label: from },
   ]);
 }
+/**
+ * Persist the operator-stop transition before releasing its live controller.
+ * The row is terminal first, then its in-progress label is removed through the
+ * same durable projection outbox as every other lifecycle transition.
+ */
+export function recordOperatorStop(
+  store: Pick<Store, "updateRun" | "enqueueLabelOps">,
+  args: {
+    project: string;
+    issue: number;
+    runId: string;
+    inProgress: string;
+    reason: string;
+    patch: Partial<RunRecord>;
+  },
+): void {
+  store.updateRun(args.runId, {
+    ...args.patch,
+    state: "stopped",
+    lastError: `operator stopped: ${args.reason}`,
+  });
+  store.enqueueLabelOps(args.project, [
+    { issue: args.issue, op: "remove", label: args.inProgress },
+  ]);
+}
+
 
 /**
  * The escalator throws when no transport is configured or Telegram rejects, and
@@ -564,6 +667,38 @@ async function safeEscalate(d: Pick<Deps, "escalate">, e: Escalation): Promise<b
   }
 }
 
+async function reactToProviderCredit(
+  d: Deps,
+  issue: number,
+  message: string,
+  sessionFile: string | undefined,
+): Promise<void> {
+  const { project } = d;
+  const alreadyPaused = isPaused();
+  if (!alreadyPaused) setPaused(true, { source: "provider-credit", reason: message });
+  log(
+    `#${issue} provider refused for credit — dispatch ${alreadyPaused ? "remains paused" : "paused"}: ${message}`,
+  );
+  // Fleet-scoped and run-independent on purpose. The notification ledger
+  // dedupes on `project:issue:tier:summary`, so `NO_ISSUE` plus a summary
+  // carrying no run or attempt pages once for the fleet, not once per run.
+  await safeEscalate(d, {
+    tier: 2,
+    category: "fleet-stopped",
+    project: project.name,
+    issue: NO_ISSUE,
+    summary: `Model provider refused for credit — ${project.name} is paused`,
+    detail: [
+      message,
+      "",
+      "No implementation attempt was charged: this is a billing state, not a",
+      "failed implementation. Each affected issue keeps its queue label and",
+      "re-dispatches on `omp-conductor resume` once the provider has credit.",
+      `Session: ${sessionFile ?? "(no transcript)"}`,
+    ].join("\n"),
+  });
+}
+
 /**
  * What a salvage attempt contributes to the escalation: where the work went, or
  * that it went nowhere. Split from the effects below for the same reason
@@ -840,11 +975,14 @@ export function createTurnLimitRegistry(
 
 export type WorkerControlResult =
   | { kind: "ok"; runId: string; phase: WorkerPausePhase }
+  | { kind: "stopped"; runId: string; reason: string }
   | { kind: "refused"; runId: string; error: string }
   | { kind: "not-active" };
 
 export interface WorkerControlSlot {
   install(control: WorkerPauseControl): void;
+  /** Stop accepted before the session controller exists. */
+  requestedStop(): string | undefined;
   close(): void;
 }
 
@@ -852,34 +990,51 @@ export interface WorkerControlRegistry {
   open(project: string, issue: number, runId: string): WorkerControlSlot;
   pause(project: string, issue: number): Promise<WorkerControlResult>;
   resume(project: string, issue: number): WorkerControlResult;
+  stop(project: string, issue: number, reason: string): Promise<WorkerControlResult>;
   /** Live runs whose phase is not `running` — what /healthz and the board show. */
   snapshot(project: string): { issue: number; runId: string; phase: WorkerPausePhase }[];
 }
 
 /** Authoritative controls for sessions owned by this daemon process. */
 export function createWorkerControlRegistry(): WorkerControlRegistry {
-  const active = new Map<
-    string,
-    { project: string; issue: number; runId: string; control?: WorkerPauseControl }
-  >();
+  interface Entry {
+    project: string;
+    issue: number;
+    runId: string;
+    control?: WorkerPauseControl;
+    stopReason?: string;
+    stopError?: string;
+    finished: PromiseWithResolvers<void>;
+  }
+
+  const active = new Map<string, Entry>();
   const key = (project: string, issue: number): string => `${project}\0${issue}`;
   return {
     open(project, issue, runId) {
       const k = key(project, issue);
       if (active.has(k)) throw new Error(`#${issue} already has a live worker controller`);
-      const entry = { project, issue, runId } as {
-        project: string;
-        issue: number;
-        runId: string;
-        control?: WorkerPauseControl;
+      const entry: Entry = {
+        project,
+        issue,
+        runId,
+        finished: Promise.withResolvers<void>(),
       };
       active.set(k, entry);
       return {
         install: (control) => {
-          if (active.get(k) === entry) entry.control = control;
+          if (active.get(k) !== entry) return;
+          entry.control = control;
+          if (entry.stopReason === undefined) return;
+          try {
+            control.stop(entry.stopReason);
+          } catch (err) {
+            entry.stopError = err instanceof Error ? err.message : String(err);
+          }
         },
+        requestedStop: () => active.get(k) === entry ? entry.stopReason : undefined,
         close: () => {
           if (active.get(k) === entry) active.delete(k);
+          entry.finished.resolve();
         },
       };
     },
@@ -911,6 +1066,30 @@ export function createWorkerControlRegistry(): WorkerControlRegistry {
         };
       }
     },
+    async stop(project, issue, reason) {
+      const entry = active.get(key(project, issue));
+      if (entry === undefined) return { kind: "not-active" };
+      if (entry.stopReason === undefined) {
+        entry.stopReason = reason;
+        if (entry.control !== undefined) {
+          try {
+            entry.control.stop(reason);
+          } catch (err) {
+            entry.stopReason = undefined;
+            return {
+              kind: "refused",
+              runId: entry.runId,
+              error: err instanceof Error ? err.message : String(err),
+            };
+          }
+        }
+      }
+      await entry.finished.promise;
+      if (entry.stopError !== undefined) {
+        return { kind: "refused", runId: entry.runId, error: entry.stopError };
+      }
+      return { kind: "stopped", runId: entry.runId, reason: entry.stopReason! };
+    },
     snapshot(project) {
       const workers: { issue: number; runId: string; phase: WorkerPausePhase }[] = [];
       for (const entry of active.values()) {
@@ -1012,7 +1191,28 @@ export function shouldContinueAfterTurnsCap(f: {
   return hasContinuationBudget(f.continuation, f.maxContinuations);
 }
 
-async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
+/** Bind a worker's run identity to every release-policy block it emits. */
+export function workerReleaseBlockRecorder(
+  project: string,
+  issue: number,
+  runId: string,
+  root = stateDir(),
+): (shape: ReleaseShape, context: ReleaseBlockContext) => void {
+  return (shape, context) =>
+    recordReleaseBlock(
+      project,
+      "worker",
+      shape,
+      {
+        ...context,
+        issue,
+        runId,
+      },
+      root,
+    );
+}
+
+export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
   const { project, caps, tracker, store } = d;
   const issue = r.issue.number;
   const branch = branchName(r.issue);
@@ -1027,6 +1227,7 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
   let worktreePath: string | undefined;
   let turnLimit: TurnLimitController | undefined;
   let workerControl: WorkerControlSlot | undefined;
+  let workerSessionInstalled = false;
   // The run's own repository. Hoisted for the same reason `worktreePath` is —
   // the catch and finally paths have to publish the branch.
   let runRepo: RunRepoRef | undefined;
@@ -1048,6 +1249,53 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     return pushRunBranch(project, runRepo);
   };
 
+  /**
+   * A stop can arrive after the run is claimed but before `runWorker` exposes
+   * its controller. Settle that run here instead of turning an operator action
+   * into a dispatch failure or making the HTTP request wait for a session that
+   * will never exist.
+   */
+  const settleStopBeforeSession = async (): Promise<boolean> => {
+    const reason = workerControl?.requestedStop();
+    if (reason === undefined || run === undefined || workerSessionInstalled) return false;
+    turnLimit?.close();
+    turnLimit = undefined;
+    const settlement =
+      worktreePath === undefined
+        ? undefined
+        : await settleWorktree({
+            issue,
+            attempt,
+            ending: `stopped by the operator: ${reason}`,
+            worktree: worktreePath,
+            branch,
+            publish,
+            tree: "remove",
+            mirrorPath,
+          });
+    recordOperatorStop(store, {
+      project: project.name,
+      issue,
+      runId: run.id,
+      inProgress,
+      reason,
+      patch: {
+        endedAt: Date.now(),
+        turns: run.turns,
+        spendUsd: run.spendUsd,
+        worktree: worktreePath ?? run.worktree,
+        report: [
+          "Operator stopped the run before its worker session started.",
+          `Reason: ${reason}`,
+          ...(settlement?.lines ?? []),
+        ].join("\n"),
+        ...settlement?.patch,
+      },
+    });
+    log(`#${issue} stopped by operator before its worker session started: ${reason}`);
+    return true;
+  };
+
   try {
     // Claim on the STORE first, before anything that can fail. The run row —
     // not the label — is the crash-safe guard against double dispatch: rows
@@ -1063,8 +1311,6 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // Read before this attempt's own row exists, so `latestRun` still means the
     // attempt whose work this one inherits.
     const priorSalvage = store.latestRun(project.name, issue)?.salvageSha;
-
-
     run = store.createRun({
       project: project.name,
       issue,
@@ -1078,11 +1324,20 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       maxTurns: caps.workerMaxTurns,
       startedAt: Date.now(),
     });
+    const maxTurns = run.maxTurns;
+    const turnOverride = maxTurns > caps.workerMaxTurns ? maxTurns : undefined;
     const runId = run.id;
+    if (turnOverride !== undefined) {
+      log(
+        `#${issue} claimed with turn override ${turnOverride} ` +
+          `(base ${caps.workerMaxTurns})`,
+      );
+    }
     store.enqueueLabelOps(project.name, [{ issue, op: "add", label: inProgress }]);
     claimed = true;
-    turnLimit = d.turnLimits.open(project.name, issue, runId, caps.workerMaxTurns);
+    turnLimit = d.turnLimits.open(project.name, issue, runId, maxTurns);
     workerControl = d.workerControls.open(project.name, issue, runId);
+    if (await settleStopBeforeSession()) return;
 
     // A run's tree is <workspaceRoot>/<issue> and addRunRepo refuses to reuse
     // an existing path, so a retry — or a tree kept from a failed attempt — has
@@ -1091,6 +1346,7 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // first attempt. addRunRepo does its own ensureMirror; calling it here too
     // would cost a second network fetch per attempt.
     await removeWorktree(mirrorPath, worktreePathFor(project.workspaceRoot, issue));
+    if (await settleStopBeforeSession()) return;
     const provisioned = await addRunRepo(
       r.repo,
       project.mirrorRoot,
@@ -1100,6 +1356,7 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     );
     worktreePath = provisioned.path;
     runRepo = { repo: r.repo, runRepoPath: worktreePath, branch };
+    if (await settleStopBeforeSession()) return;
 
     // The SDK names the transcript itself, so the daemon supplies the parent
     // directory and learns the real path back from the result. Inventing one
@@ -1138,6 +1395,7 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       },
       { ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }) },
     );
+    if (await settleStopBeforeSession()) return;
 
     store.updateRun(runId, { worktree: worktreePath, state: "running" });
 
@@ -1146,20 +1404,29 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         (provisioned.reattached ? " (continuation: reattached existing branch)" : ""),
     );
 
+    const brief = await buildBrief(project, r, branch, worktreePath, {
+      continuation: provisioned.reattached,
+      defaultBranch: r.repo.defaultBranch,
+      ...(provisioned.reattached && priorSalvage !== undefined
+        ? { salvagedSha: priorSalvage }
+        : {}),
+    });
+    if (await settleStopBeforeSession()) return;
+
+    const repoSlug = githubRepo(r.repo.cloneUrl);
+
     let result: WorkerResult;
     try {
       result = await runWorker({
-        brief: await buildBrief(project, r, branch, worktreePath, {
-          continuation: provisioned.reattached,
-          defaultBranch: r.repo.defaultBranch,
-          ...(provisioned.reattached && priorSalvage !== undefined
-            ? { salvagedSha: priorSalvage }
-            : {}),
-        }),
+        brief,
         cwd: worktreePath,
         caps,
-        maxTurns: () => turnLimit?.maxTurns() ?? caps.workerMaxTurns,
-        onPauseControl: (control) => workerControl?.install(control),
+        ...(repoSlug === undefined ? {} : { repoSlug }),
+        maxTurns: () => turnLimit?.maxTurns() ?? maxTurns,
+        onPauseControl: (control) => {
+          workerSessionInstalled = true;
+          workerControl?.install(control);
+        },
         sessionDir,
         // The session's control socket, under the daemon's own state directory —
         // a child process of the daemon reaches it directly.
@@ -1178,28 +1445,24 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
         },
         ...(project.workerModel === undefined ? {} : { model: project.workerModel }),
         releaseGrants: resolveReleaseGrants(project),
-        onReleaseBlocked: (shape) => recordReleaseBlock(project.name, "worker", shape),
+        onReleaseBlocked: workerReleaseBlockRecorder(project.name, issue, runId),
         onTurn: (n) => store.updateRun(runId, { turns: n }),
         onSpend: (usd) => store.updateRun(runId, { spendUsd: usd }),
         onKilled: () => {
           turnLimit?.close();
           turnLimit = undefined;
-          workerControl?.close();
-          workerControl = undefined;
         },
         // Recorded the moment the session opens its transcript, not when the run
         // ends: `omp-conductor tail` resolves an issue to a file through this row,
         // and a path written at completion is a path nobody can follow live. The
         // completion-time update below writes the same value again, harmlessly.
         onSessionFile: (f) => store.updateRun(runId, { sessionFile: f }),
-      });
+      }, d.workerDeps);
     } finally {
       // This is the authoritative settlement edge for `extend`: close before
       // PR verification or terminal row writes can leave stale `running` state.
       turnLimit?.close();
       turnLimit = undefined;
-      workerControl?.close();
-      workerControl = undefined;
     }
 
     // A configured model the harness could not honour means this run was done by
@@ -1264,8 +1527,8 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // `pushed-*` run is the only end that does not salvage: its deliverable is
     // already on a remote branch, whatever is left loose in the tree is by the
     // worker's own account not part of it, and appending a WIP commit would
-    // turn the green PR this daemon just verified red. Every other end is
-    // continuable, so its tree is treated as work.
+    // turn the green PR this daemon just verified red. Every other end may
+    // contain work, so it is salvaged before the tree's final fate is decided.
     const settlement =
       state === "pushed-green" || state === "pushed-pending" || state === "merged"
         ? undefined
@@ -1273,7 +1536,11 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
             issue,
             attempt,
             ending:
-              state === "blocked" ? "blocked for an operator decision" : endedBy(result.killedBy),
+              state === "blocked"
+                ? "blocked for an operator decision"
+                : state === "stopped"
+                  ? `stopped by the operator: ${result.stoppedReason ?? "no reason recorded"}`
+                  : endedBy(result.killedBy),
             worktree: worktreePath,
             branch,
             publish,
@@ -1294,8 +1561,7 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       await removeWorktree(mirrorPath, worktreePath);
     }
 
-    store.updateRun(runId, {
-      state,
+    const terminalPatch: Partial<RunRecord> = {
       endedAt: Date.now(),
       turns: result.turns,
       spendUsd: result.spendUsd,
@@ -1303,23 +1569,41 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       headSha: result.headSha,
       sessionFile: result.sessionFile,
       // Every terminal state persists the worker's report, not just a green
-      // push: the report of a killed attempt is exactly the one a later
-      // continuation must pool its disclosures from (#199).
+      // push: a stopped attempt's partial report is still part of its audit trail.
       report: result.report,
-      ...(providerCredit !== undefined || providerTransient !== undefined
-        ? { lastError: providerCredit ?? providerTransient }
-        : verified.reason === undefined
-          ? {}
-          : { lastError: verified.reason }),
       ...settlement?.patch,
       ...(audit === undefined || audit.flags.length === 0
         ? {}
         : { settlementFlags: audit.flags }),
-    });
+    };
+    if (state === "stopped") {
+      recordOperatorStop(store, {
+        project: project.name,
+        issue,
+        runId,
+        inProgress,
+        reason: result.stoppedReason ?? "no reason recorded",
+        patch: terminalPatch,
+      });
+    } else {
+      const lastError = completionLastError(
+        providerCredit,
+        providerTransient,
+        verified.reason,
+        sessionErr,
+      );
+      store.updateRun(runId, {
+        ...terminalPatch,
+        state,
+        ...(lastError === undefined ? {} : { lastError }),
+      });
+    }
 
     const salvaged = settlement?.lines ?? [];
 
-    if (state === "blocked") {
+    if (state === "stopped") {
+      log(`#${issue} stopped by operator on attempt ${attempt}: ${result.stoppedReason}`);
+    } else if (state === "blocked") {
       swapLabel(store, project.name, issue, inProgress, project.stateLabels.blocked);
       await safeEscalate(d, {
         tier: 1,
@@ -1343,31 +1627,8 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       });
 
       if (providerCredit !== undefined) {
-        // Pause here rather than at classification: the sweep runs on the tick,
-        // and three issues each burned an attempt in the fifteen minutes between
-        // the first 402 and a human noticing (#220).
-        setPaused(true, { source: "provider-credit", reason: providerCredit });
-        log(`#${issue} provider refused for credit — dispatch paused: ${providerCredit}`);
-        swapLabel(store, project.name, issue, inProgress, project.stateLabels.failed);
-        // Fleet-scoped and run-independent on purpose. The notification ledger
-        // dedupes on `project:issue:tier:summary`, so `NO_ISSUE` plus a summary
-        // carrying no run or attempt is what makes this page once for the fleet
-        // instead of once per affected run.
-        await safeEscalate(d, {
-          tier: 2,
-          category: "fleet-stopped",
-          project: project.name,
-          issue: NO_ISSUE,
-          summary: `Model provider refused for credit — ${project.name} is paused`,
-          detail: [
-            providerCredit,
-            "",
-            "No implementation attempt was charged: this is a billing state, not a",
-            "failed implementation. Each affected issue keeps its queue label and",
-            "re-dispatches on `omp-conductor resume` once the provider has credit.",
-            `Session: ${result.sessionFile ?? "(no transcript)"}`,
-          ].join("\n"),
-        });
+        await reactToProviderCredit(d, issue, providerCredit, result.sessionFile);
+        swapToQueue(d, issue, inProgress);
       } else if (continueTurns) {
         // Requeue as one ordered pair: the in-progress removal before the
         // queue add, exactly the order the projector will apply them in (#201).
@@ -1469,8 +1730,7 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // inner settlement guard exists. Latch it before any terminal write or await.
     turnLimit?.close();
     turnLimit = undefined;
-    workerControl?.close();
-    workerControl = undefined;
+    if (await settleStopBeforeSession()) return;
     const detail = errText(err);
     log(`#${issue} errored: ${detail}`);
     // A crash lands anywhere, including mid-edit in a tree holding the only
@@ -1516,8 +1776,6 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
     // a failure path, and whatever it still held is now a commit on the branch.
   } finally {
     turnLimit?.close();
-    workerControl?.close();
-    workerControl = undefined;
     // The run is over, so its channel is too. Closed here rather than beside
     // the session so the crash path closes it as well: a listener left bound
     // after its run settled is a socket whose `run-not-live` check is the only
@@ -1530,6 +1788,8 @@ async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
       }
       verbListener = undefined;
     }
+    workerControl?.close();
+    workerControl = undefined;
   }
 }
 
@@ -1558,12 +1818,12 @@ export interface Settlement {
  *
  * - `merged` — the work landed. That is what `merged` was reserved for.
  * - `closed` — a human read the work and said no. Leaving it `pushed-green`
- *   strands the issue forever behind a PR nobody will ever merge, and calling it
- *   `merged` is simply a lie about work that does not exist on the base branch.
- *   `failed` is true — the attempt did not land — and it releases the busy guard,
- *   so an issue a human re-queues can be attempted again. The attempt counter is
- *   untouched either way: this row was a real attempt, and pretending otherwise
- *   would let a rejected issue cycle past `maxAttemptsPerIssue`.
+ *   forever is a lie; `failed` records that it did not land and releases the
+ *   busy guard, so an issue a human re-queues can be attempted again. A row
+ *   that had reached `pushed-green` or `pushed-pending` is classified
+ *   `returned-for-revision` at settlement. A review decision asks for another
+ *   implementation pass, not a failure, so it consumes the continuation budget
+ *   instead of the failed-attempt budget.
  * - `open`, and undefined — nothing changes. Undefined is "could not tell": a
  *   flaky network, a revoked token, a deleted PR. Settling on it would record a
  *   merge that never happened, and the next tick asks again for free. An
@@ -1647,6 +1907,242 @@ export function releaseInProgress(
  * in the busy set throughout, so no second worker can be sent at the issue while
  * it waits.
  */
+const BASE_CHECK_BATCH = 20;
+const BASE_CHECK_WINDOW_MS = 24 * 60 * 60 * 1_000;
+const BASE_STATUS_WINDOW_MS = 7 * 24 * 60 * 60 * 1_000;
+
+const SUCCESSFUL_WORKFLOW_CONCLUSIONS = new Set(["success", "neutral", "skipped"]);
+
+const FAILING_WORKFLOW_CONCLUSIONS = new Set([
+  "failure",
+  "cancelled",
+  "timed_out",
+  "action_required",
+  "startup_failure",
+  "stale",
+]);
+
+function appendSettlementFlag(run: RunRecord, flag: SettlementFlag): SettlementFlag[] {
+  const flags = run.settlementFlags ?? [];
+  return flags.some((existing) => existing.kind === flag.kind && existing.detail === flag.detail)
+    ? flags
+    : [...flags, flag];
+}
+
+/**
+ * Observe Actions on exact merge commits for up to one day. A running workflow
+ * stays quiet and pending; a failure becomes durable evidence on the merged row
+ * and pages exactly once because the row leaves `pending` before delivery.
+ */
+export async function watchMergedBase(d: Pick<Deps, "project" | "tracker" | "store" | "escalate">): Promise<void> {
+  const now = Date.now();
+  for (const run of d.store.runsNeedingBaseCheck(d.project.name, BASE_CHECK_BATCH)) {
+    if (
+      run.endedAt === undefined ||
+      now - run.endedAt > BASE_CHECK_WINDOW_MS ||
+      run.mergeSha === undefined ||
+      run.baseRef === undefined
+    ) {
+      d.store.updateRun(run.id, { baseCheck: "unknown", baseCheckAt: now });
+      log(`#${run.issue} base check unknown: merge identity is absent or older than 24h`);
+      continue;
+    }
+
+    const repo = d.project.routing.repos[run.repo];
+    const repoIdentity = repo === undefined ? undefined : githubRepo(repo.cloneUrl);
+    if (repoIdentity === undefined) {
+      d.store.updateRun(run.id, { baseCheck: "unknown", baseCheckAt: now });
+      log(`#${run.issue} base check unknown: routed repository ${run.repo} has no GitHub identity`);
+      continue;
+    }
+
+    let workflows;
+    try {
+      workflows = await d.tracker.workflowRunsAt(repoIdentity, run.mergeSha, {
+        event: "push",
+        branch: run.baseRef,
+      });
+    } catch (err) {
+      log(`#${run.issue} base check unavailable (${errText(err)}) — retrying next tick`);
+      continue;
+    }
+    if (workflows === undefined) {
+      log(`#${run.issue} base check unavailable for ${run.mergeSha} — retrying next tick`);
+      continue;
+    }
+    if (workflows.length === 0) {
+      log(
+        `#${run.issue} base check: no push-triggered run yet for ${run.mergeSha} — retrying next tick`,
+      );
+      continue;
+    }
+    if (workflows.some((workflow) => workflow.status !== "completed")) continue;
+
+    const failed = workflows.find(
+      (workflow) =>
+        workflow.conclusion !== undefined &&
+        FAILING_WORKFLOW_CONCLUSIONS.has(workflow.conclusion),
+    );
+    if (failed === undefined) {
+      const unknown = workflows.find(
+        (workflow) =>
+          workflow.conclusion === undefined ||
+          !SUCCESSFUL_WORKFLOW_CONCLUSIONS.has(workflow.conclusion),
+      );
+      if (unknown !== undefined) {
+        log(
+          `#${run.issue} base check has unrecognised completed conclusion ` +
+            `${JSON.stringify(unknown.conclusion)} for ${unknown.name} — retrying next tick`,
+        );
+        continue;
+      }
+      d.store.updateRun(run.id, { baseCheck: "green", baseCheckAt: now });
+      log(`#${run.issue} base ${run.baseRef} green at ${run.mergeSha}`);
+      continue;
+    }
+
+    let previous;
+    try {
+      previous = await d.tracker.previousWorkflowRun(
+        repoIdentity,
+        failed.workflowId,
+        run.baseRef,
+        failed.createdAt,
+      );
+    } catch (err) {
+      log(`#${run.issue} previous ${failed.name} run unavailable (${errText(err)}) — retrying next tick`);
+      continue;
+    }
+    if (previous === undefined || (previous !== null && previous.status !== "completed")) continue;
+    const preexisting =
+      previous !== null &&
+      previous.conclusion !== undefined &&
+      FAILING_WORKFLOW_CONCLUSIONS.has(previous.conclusion);
+    const detail =
+      `${failed.name} failed at ${run.mergeSha} — ${failed.url}` +
+      (preexisting ? " (already red before this merge)" : "");
+    const flag: SettlementFlag = { kind: "base-branch-red", file: "(base branch)", detail };
+    const delivered = await safeEscalate(d, {
+      tier: 1,
+      project: d.project.name,
+      issue: run.issue,
+      runId: run.id,
+      summary: `Base branch ${run.baseRef} is red after merge`,
+      detail,
+    });
+    if (!delivered) continue;
+    d.store.updateRun(run.id, {
+      baseCheck: preexisting ? "red-preexisting" : "red",
+      baseCheckAt: now,
+      settlementFlags: appendSettlementFlag(run, flag),
+    });
+  }
+}
+
+/**
+ * Refresh current base-branch health at each recently merged repository's live
+ * head. This is status and release-gate evidence only; the per-merge audit
+ * above remains the sole path that attributes and escalates a regression.
+ */
+export async function watchBaseHealth(
+  d: Pick<Deps, "project" | "tracker" | "store">,
+): Promise<void> {
+  const now = Date.now();
+  const previousByRepo = new Map(
+    d.store.baseHealth(d.project.name).map((row) => [row.repo, row] as const),
+  );
+  for (const { repo, baseRef } of d.store.mergedRepoBranches(
+    d.project.name,
+    now - BASE_STATUS_WINDOW_MS,
+  )) {
+    const target = d.project.routing.repos[repo];
+    if (target === undefined) {
+      log(`base health skipped: routed repository ${repo} is no longer configured`);
+      continue;
+    }
+    const identity = githubRepo(target.cloneUrl);
+    if (identity === undefined) {
+      log(`base health skipped: routed repository ${repo} has no GitHub identity`);
+      continue;
+    }
+    const branch = baseRef ?? target.defaultBranch;
+
+    let head: string | undefined;
+    try {
+      head = await d.tracker.branchHead(identity, branch);
+    } catch (err) {
+      log(`base ${repo}/${branch} head unavailable (${errText(err)}) — keeping previous health`);
+      continue;
+    }
+    if (head === undefined) {
+      log(`base ${repo}/${branch} head unavailable — keeping previous health`);
+      continue;
+    }
+
+    const previous = previousByRepo.get(repo);
+    if (
+      previous?.branch === branch &&
+      previous.headSha === head &&
+      (previous.verdict === "green" || previous.verdict === "red")
+    ) {
+      continue;
+    }
+
+    let runs;
+    try {
+      runs = await d.tracker.workflowRunsAt(identity, head, { event: "push", branch });
+    } catch (err) {
+      log(`base ${repo}/${branch} workflows unavailable (${errText(err)}) — keeping previous health`);
+      continue;
+    }
+    if (runs === undefined) {
+      log(`base ${repo}/${branch} workflows unavailable — keeping previous health`);
+      continue;
+    }
+
+    let verdict: BaseHealth["verdict"];
+    let detail: string | undefined;
+    if (runs.length === 0) {
+      verdict = "unknown";
+      detail = `no push-triggered workflow run for ${head.slice(0, 8)}`;
+    } else if (runs.some((run) => run.status !== "completed")) {
+      verdict = "pending";
+    } else {
+      const failed = runs.find(
+        (run) =>
+          run.conclusion !== undefined &&
+          FAILING_WORKFLOW_CONCLUSIONS.has(run.conclusion),
+      );
+      if (failed !== undefined) {
+        verdict = "red";
+        detail = `${failed.name} failed at ${head.slice(0, 8)} — ${failed.url}`;
+      } else if (
+        runs.some(
+          (run) =>
+            run.conclusion === undefined ||
+            !SUCCESSFUL_WORKFLOW_CONCLUSIONS.has(run.conclusion),
+        )
+      ) {
+        verdict = "pending";
+      } else {
+        verdict = "green";
+      }
+    }
+
+    const health: BaseHealth = {
+      repo,
+      branch,
+      headSha: head,
+      verdict,
+      runsCount: runs.length,
+      checkedAt: now,
+      ...(detail === undefined ? {} : { detail }),
+    };
+    d.store.upsertBaseHealth(d.project.name, health);
+    previousByRepo.set(repo, health);
+  }
+}
+
 export async function settlePushedGreen(
   d: Pick<Deps, "project" | "tracker" | "store">,
 ): Promise<void> {
@@ -1678,17 +2174,44 @@ export async function settlePushedGreen(
 
     const settlement = settlementFor(pr, run.prUrl);
     if (settlement !== undefined) {
+      // A mediated merge enters a second, bounded observation phase. Record the
+      // exact merge commit before the row leaves the active set; if GitHub cannot
+      // supply it yet, retry this settlement next tick rather than create a
+      // merged row whose base result can never be attributed.
+      let merged: MergedPrInfo | undefined;
+      if (settlement.state === "merged") {
+        try {
+          merged = await tracker.mergedPrInfo(run.prUrl);
+        } catch (err) {
+          log(`#${run.issue} not settled: merge identity lookup failed (${errText(err)}) — retrying next tick`);
+          continue;
+        }
+        if (merged === undefined) {
+          log(`#${run.issue} not settled: merge identity unavailable — retrying next tick`);
+          continue;
+        }
+      }
+
       // The label removal and the terminal row are one fact again (#201): the
       // release is enqueued — a durable local write that cannot fail on the
-      // tracker — in the same breath as the row is terminalised, so there is
-      // no window in which a row beyond every later tick still owes its label.
-      // The projector applies it with retry; while pending, the eligibility
-      // overlay treats the label as already gone, so #18's
-      // permanent-`agent:in-progress` cannot re-form even when GitHub refuses
-      // the write.
+      // tracker — in the same breath as the row is terminalised.
       releaseInProgress(d, run.issue, settlement.reason);
-      const patch: Partial<RunRecord> = { state: settlement.state, endedAt: Date.now() };
-      if (settlement.state === "failed") patch.lastError = settlement.reason;
+      const patch: Partial<RunRecord> = {
+        state: settlement.state,
+        endedAt: Date.now(),
+        ...(merged === undefined
+          ? {}
+          : {
+              mergeSha: merged.mergeSha,
+              baseRef: merged.baseRef,
+              baseCheck: "pending",
+            }),
+      };
+      if (settlement.state === "failed") {
+        patch.lastError = settlement.reason;
+        patch.failureClass = "returned-for-revision";
+        patch.recoveryAction = "none";
+      }
       store.updateRun(run.id, patch);
       log(`#${run.issue} settled: ${settlement.reason}`);
       continue;
@@ -1720,6 +2243,121 @@ export async function settlePushedGreen(
   }
 }
 
+const ADOPTABLE_PR_STATES: Partial<Record<RunState, true>> = {
+  failed: true,
+  killed: true,
+  orphaned: true,
+  blocked: true,
+};
+
+/**
+ * Reattaches a recovered PR to the terminal run that owns it (#245).
+ *
+ * A worker can fail before its completion report records `prUrl`, then have its
+ * dirty tree committed and pushed by salvage. If that branch already has a PR,
+ * the orchestrator otherwise has no policy-compliant path to inspect or merge
+ * it: ownership is store-backed. Adoption is deliberately stricter than
+ * admission. The tracker query proves the PR closes this run's issue; exact
+ * branch and canonical repository matches prove it is this run's recovered
+ * work, not an unrelated closer. Missing identity is refusal, never a guess.
+ *
+ * The newest run per issue is inspected, at most ten per tick and only inside
+ * the same 30-day window as mediated PR verbs. The cursor advances through the
+ * full eligible set so persistent non-matches cannot starve older recovered
+ * work. Successful adoption is idempotent because the row gains `prUrl`;
+ * non-matches are logged once per daemon process.
+ */
+const rejectedSalvagedPrRuns = new Set<string>();
+const salvagedPrCursor = new Map<string, string>();
+
+export async function adoptSalvagedPrs(
+  d: Pick<Deps, "project" | "tracker" | "store">,
+  now = Date.now(),
+): Promise<void> {
+  const { project, tracker, store } = d;
+  const eligible = store
+    .recentRuns(project.name, now - PR_LOOKUP_WINDOW_MS)
+    .filter(
+      (run) =>
+        ADOPTABLE_PR_STATES[run.state] === true &&
+        run.prUrl === undefined &&
+        run.branch.trim() !== "",
+    );
+  const previous = salvagedPrCursor.get(project.name);
+  const previousIndex =
+    previous === undefined ? -1 : eligible.findIndex((run) => run.id === previous);
+  const start = previousIndex === -1 ? 0 : (previousIndex + 1) % eligible.length;
+  const candidates = Array.from(
+    { length: Math.min(SALVAGED_PR_ADOPTION_BATCH, eligible.length) },
+    (_, offset) => eligible[(start + offset) % eligible.length]!,
+  );
+  const last = candidates.at(-1);
+  if (last !== undefined) salvagedPrCursor.set(project.name, last.id);
+
+  for (const run of candidates) {
+    const repo = project.routing.repos[run.repo];
+    const repoIdentity = repo === undefined ? undefined : githubRepo(repo.cloneUrl);
+    let closers: OpenCloser[];
+    try {
+      closers = await tracker.openClosersFor(run.issue);
+    } catch (err) {
+      log(`#${run.issue} PR adoption lookup failed (${errText(err)}) — retrying next tick`);
+      continue;
+    }
+
+    const closer = closers.find(
+      (candidate) =>
+        candidate.headRefName !== "" &&
+        candidate.headRefName === run.branch &&
+        repo !== undefined &&
+        candidate.repo !== "" &&
+        candidate.repo === repoIdentity,
+    );
+    if (closer === undefined) {
+      if (!rejectedSalvagedPrRuns.has(run.id)) {
+        const observed = closers[0];
+        const reason =
+          observed === undefined
+            ? "no open closing PR"
+            : observed.headRefName === ""
+              ? "closer has no head branch identity"
+              : observed.headRefName !== run.branch
+                ? `closer head ${observed.headRefName} does not match retained branch ${run.branch}`
+                : observed.repo === ""
+                  ? "closer has no repository identity"
+                  : `closer repository ${observed.repo} does not match routed repository`;
+        log(`#${run.issue} PR not adopted onto attempt ${run.attempt}: ${reason}`);
+        rejectedSalvagedPrRuns.add(run.id);
+      }
+      continue;
+    }
+
+    const flag: SettlementFlag = {
+      kind: "pr-adopted",
+      file: "(recovery)",
+      detail: `${closer.url} matched retained branch ${run.branch} in ${closer.repo}`,
+    };
+    store.updateRun(run.id, {
+      prUrl: closer.url,
+      settlementFlags: [...(run.settlementFlags ?? []), flag],
+    });
+    rejectedSalvagedPrRuns.delete(run.id);
+    log(
+      `#${run.issue} adopted PR ${closer.url} onto attempt ${run.attempt}` +
+        (run.salvageSha === undefined ? "" : ` (salvaged head ${run.salvageSha})`),
+    );
+  }
+}
+
+/** Canonical `owner/repo` identity from a configured network clone URL. */
+function githubRepo(cloneUrl: string): string | undefined {
+  const normalized = cloneUrl.replace(/\/$/, "").replace(/\.git$/, "");
+  const match = /^(?:https?:\/\/[^/]+\/|ssh:\/\/git@[^/]+\/|git@[^:]+:)([^/\s]+\/[^/\s]+)$/.exec(
+    normalized,
+  );
+  return match?.[1];
+}
+
 const RETAINED_CLEANUP_BATCH = 10;
 
 export interface RetainedCleanupCursor {
@@ -1833,6 +2471,7 @@ const HOLD_SAMPLE_SIZE = 5;
 const DEGRADED_HOLDS: ReadonlySet<AdmissionHoldReason> = new Set([
   "parent-lookup-error",
   "open-pr-lookup-error",
+  "issue-state-lookup-error",
 ]);
 
 /** Groups transient decisions into the bounded record exposed by status. */
@@ -2217,6 +2856,32 @@ export async function admitCandidates(
       log(`#${issue} continuing retained PR ${closer.url} ${resume}`);
     }
 
+    // The queue comes from GitHub's eventually-consistent search index. Re-read
+    // state and labels directly at the last possible moment so a just-closed or
+    // explicitly dequeued issue cannot turn a stale candidate into another
+    // attempt (#247).
+    let snapshot: IssueSnapshot | undefined;
+    try {
+      snapshot = await tracker.issueSnapshot(issue);
+    } catch {
+      snapshot = undefined;
+    }
+    if (snapshot === undefined) {
+      hold(issue, "issue-state-lookup-error");
+      log(`#${issue} held: issue snapshot check failed — retrying next tick`);
+      continue;
+    }
+    if (snapshot.state === "closed") {
+      hold(issue, "issue-closed");
+      log(`#${issue} skipped: issue is closed (search index lag)`);
+      continue;
+    }
+    if (!snapshot.labels.includes(project.queueLabel)) {
+      hold(issue, "issue-dequeued");
+      log(`#${issue} skipped: queue label ${project.queueLabel} was removed (search index lag)`);
+      continue;
+    }
+
     admitted.push({ r, attempt: priorRuns + 1 });
     liveByRepo.set(r.repo.name, (liveByRepo.get(r.repo.name) ?? 0) + 1);
     if (parent !== undefined) {
@@ -2289,8 +2954,26 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     }
     d.project = fresh;
     d.caps = freshCaps;
+    d.deliveryPolicyValid = true;
   } catch (err) {
-    log(`config reload failed (${errText(err)}) — continuing with the values loaded at boot`);
+    log(`config reload failed (${errText(err)}) — retaining boot values but blocking autonomous delivery`);
+    d.deliveryPolicyValid = false;
+  }
+
+  // Availability-held notices are already durable. Once the freshly reloaded
+  // policy opens (or newly allows their category), atomically hand a bounded
+  // batch to the report outbox. Pauses do not suppress delivery.
+  if (d.deliveryPolicyValid !== false) {
+    try {
+      const catchUp = enqueueAvailableHeldNotices(d.project, d.store, Date.now());
+      if (catchUp !== undefined && !catchUp.deduped) {
+        log(`availability catch-up ${catchUp.report.id} queued for ${d.project.name}`);
+      }
+    } catch (err) {
+      // The daily digest may have claimed the same rows from another process
+      // between selection and association. Either way the ledger still owns them.
+      log(`availability catch-up handoff deferred (${errText(err)}) — retrying next tick`);
+    }
   }
 
   // Before the pause check, deliberately. This one is not about dispatch: the
@@ -2305,6 +2988,21 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // while the fleet is parked or workers are still active. Resident workers run
   // through the pool without blocking this five-minute tick.
   await settlePushedGreen(d);
+  try {
+    await watchMergedBase(d);
+  } catch (err) {
+    log(`base-branch check sweep failed: ${errText(err)}`);
+  }
+  try {
+    await watchBaseHealth(d);
+  } catch (err) {
+    log(`current base-health sweep failed: ${errText(err)}`);
+  }
+  try {
+    await adoptSalvagedPrs(d);
+  } catch (err) {
+    log(`salvaged PR adoption sweep failed: ${errText(err)}`);
+  }
 
   // Immediately after settlement and before any routing, so a class is on the
   // row before the next dispatch decision reads its budgets (#132). Above the
@@ -2548,6 +3246,8 @@ export interface DaemonHealthSnapshot {
   paused: boolean;
   activeRuns: number;
   project: string;
+  /** One-shot issue ceilings waiting for the next claim. */
+  turnOverrides: TurnOverride[];
   /** Resident set of this daemon; workers are in-process omp sessions. */
   rssBytes: number;
   dispatch?: DispatchSummary;
@@ -2569,6 +3269,7 @@ export function daemonHealthSnapshot(
     ok: true,
     paused,
     activeRuns: store.activeRuns(project).length,
+    turnOverrides: store.listTurnOverrides(project),
     project,
     rssBytes,
     ...(dispatch === undefined ? {} : { dispatch }),
@@ -2577,11 +3278,19 @@ export function daemonHealthSnapshot(
   };
 }
 
+const TURN_OVERRIDE_STATES: ReadonlySet<RunState> = new Set([
+  "failed",
+  "killed",
+  "orphaned",
+  "blocked",
+]);
+
 export async function turnLimitResponse(
   req: Request,
   project: string,
-  store: Pick<Store, "latestRun">,
+  store: Pick<Store, "latestRun" | "setTurnOverride">,
   registry: TurnLimitRegistry,
+  caps: Pick<Caps, "workerMaxTurns" | "workerMaxTurnsCeiling">,
 ): Promise<Response | undefined> {
   const url = new URL(req.url);
   const match = /^\/runs\/(\d+)\/turn-limit$/.exec(url.pathname);
@@ -2615,6 +3324,16 @@ export async function turnLimitResponse(
   }
 
   const issue = Number(match[1]);
+  if ((maxTurns as number) > caps.workerMaxTurnsCeiling) {
+    return Response.json(
+      {
+        error:
+          `#${issue} turn budget ${maxTurns as number} exceeds the ` +
+          `${caps.workerMaxTurnsCeiling}-turn caps.workerMaxTurnsCeiling`,
+      },
+      { status: 422 },
+    );
+  }
   const outcome = registry.extend(project, issue, maxTurns as number);
   if (outcome.kind === "extended") return Response.json(outcome);
   if (outcome.kind === "not-increase") {
@@ -2628,14 +3347,33 @@ export async function turnLimitResponse(
   if (latest === undefined) {
     return Response.json({ error: `no run recorded for #${issue}` }, { status: 404 });
   }
-  return Response.json(
-    {
-      error:
-        `#${issue} has no live worker controller; its session already settled ` +
-        `or belongs to another daemon (stored state: ${latest.state})`,
-    },
-    { status: 409 },
-  );
+  if (!TURN_OVERRIDE_STATES.has(latest.state)) {
+    return Response.json(
+      {
+        error:
+          `#${issue} has no live worker controller; its session already settled ` +
+          `or belongs to another daemon (stored state: ${latest.state})`,
+      },
+      { status: 409 },
+    );
+  }
+  if ((maxTurns as number) <= caps.workerMaxTurns) {
+    return Response.json(
+      {
+        error:
+          `#${issue} next-attempt turn budget must exceed the ` +
+          `${caps.workerMaxTurns}-turn caps.workerMaxTurns base`,
+      },
+      { status: 409 },
+    );
+  }
+  store.setTurnOverride(project, issue, maxTurns as number);
+  return Response.json({
+    kind: "next-attempt",
+    issue,
+    nextAttemptMaxTurns: maxTurns,
+    baseMaxTurns: caps.workerMaxTurns,
+  });
 }
 
 export async function workerControlResponse(
@@ -2645,7 +3383,7 @@ export async function workerControlResponse(
   registry: WorkerControlRegistry,
 ): Promise<Response | undefined> {
   const url = new URL(req.url);
-  const match = /^\/runs\/(\d+)\/(pause|resume)$/.exec(url.pathname);
+  const match = /^\/runs\/(\d+)\/(pause|resume|stop)$/.exec(url.pathname);
   if (req.method !== "PUT" || match === null) return undefined;
   if (!req.headers.get("content-type")?.startsWith("application/json")) {
     return Response.json({ error: "content-type must be application/json" }, { status: 415 });
@@ -2670,23 +3408,71 @@ export async function workerControlResponse(
       { status: 409 },
     );
   }
+  const action = match[2] as "pause" | "resume" | "stop";
+  let reason: string | undefined;
+  if (action === "stop") {
+    const rawReason = Reflect.get(body, "reason");
+    if (typeof rawReason !== "string" || rawReason.trim() === "") {
+      return Response.json({ error: "reason must be a non-empty string" }, { status: 400 });
+    }
+    reason = rawReason.trim().replace(/\s+/g, " ");
+    if (reason.length > 500) {
+      return Response.json({ error: "reason must be at most 500 characters" }, { status: 400 });
+    }
+  }
+
 
   const issue = Number(match[1]);
   const outcome =
-    match[2] === "pause"
+    action === "pause"
       ? await registry.pause(project, issue)
-      : registry.resume(project, issue);
+      : action === "resume"
+        ? registry.resume(project, issue)
+        : await registry.stop(project, issue, reason!);
   if (outcome.kind === "ok") {
     return Response.json({ runId: outcome.runId, phase: outcome.phase });
   }
   if (outcome.kind === "refused") {
     return Response.json({ error: `#${issue}: ${outcome.error}` }, { status: 409 });
   }
+  if (outcome.kind === "stopped") {
+    const stopped = store.latestRun(project, issue);
+    if (stopped === undefined || stopped.id !== outcome.runId) {
+      return Response.json(
+        { error: `#${issue} stopped, but its terminal run record is unavailable` },
+        { status: 500 },
+      );
+    }
+    if (stopped.state !== "stopped") {
+      return Response.json({
+        outcome: "already-terminal",
+        runId: stopped.id,
+        state: stopped.state,
+      });
+    }
+    return Response.json({
+      outcome: "stopped",
+      runId: stopped.id,
+      state: stopped.state,
+      reason: outcome.reason,
+      ...(stopped.salvageSha === undefined ? {} : { salvageSha: stopped.salvageSha }),
+      ...(stopped.salvageError === undefined ? {} : { salvageError: stopped.salvageError }),
+      worktree: stopped.worktree,
+    });
+  }
+
 
   const latest = store.latestRun(project, issue);
   if (latest === undefined) {
     return Response.json({ error: `no run recorded for #${issue}` }, { status: 404 });
   }
+  if (action === "stop" && !LIVE_STATES.includes(latest.state)) {
+    return Response.json({
+      outcome: "already-terminal",
+      runId: latest.id,
+      state: latest.state,
+    });
+  }
   return Response.json(
     {
       error:
@@ -2699,7 +3485,8 @@ export async function workerControlResponse(
 
 export interface DaemonHttpDeps {
   project: string;
-  store: Pick<Store, "latestRun">;
+  store: Pick<Store, "latestRun" | "setTurnOverride">;
+  caps: () => Pick<Caps, "workerMaxTurns" | "workerMaxTurnsCeiling">;
   turnLimits: TurnLimitRegistry;
   workerControls: WorkerControlRegistry;
   health: () => DaemonHealthSnapshot;
@@ -2709,15 +3496,15 @@ export interface DaemonHttpDeps {
  * The whole HTTP surface, in one named function so a test can pin what is *not*
  * on it.
  *
- * Three route families: the health read, turn-limit control, and worker
- * pause/resume control. Everything else is 404. The controls mutate only
+ * Three route families: the health read, turn-limit control, and live-worker
+ * pause/resume/stop control. Everything else is 404. The controls mutate only
  * daemon-owned live sessions; tracker and repository mutations stay on the
  * authenticated per-run channel described at the `Bun.serve` call (#126).
  */
 export async function daemonHttpResponse(req: Request, d: DaemonHttpDeps): Promise<Response> {
   const url = new URL(req.url);
   if (req.method === "GET" && url.pathname === "/healthz") return Response.json(d.health());
-  const turnLimit = await turnLimitResponse(req, d.project, d.store, d.turnLimits);
+  const turnLimit = await turnLimitResponse(req, d.project, d.store, d.turnLimits, d.caps());
   if (turnLimit !== undefined) return turnLimit;
   const workerControl = await workerControlResponse(req, d.project, d.store, d.workerControls);
   return workerControl ?? new Response("not found\n", { status: 404 });
@@ -2734,6 +3521,10 @@ export interface StatusSnapshot {
    * reading like a mistake (#220).
    */
   pauseReason?: string;
+  /** Mechanical operator availability at the moment this snapshot was read. */
+  availability?: AvailabilityState;
+  /** Next digest opportunity under the same predicate that gates submission. */
+  digestSchedule?: DigestScheduleState;
   caps: Caps;
   /**
    * The effective per-shape release grants. On the snapshot rather than re-read
@@ -2747,10 +3538,15 @@ export interface StatusSnapshot {
   /** Newest attempts holding a preserved WIP tip, or a tree that is still the
    *  only copy of work the daemon could not save. */
   salvagedRuns: RunRecord[];
+  /** One-shot issue ceilings waiting for the next claim. */
+  turnOverrides: TurnOverride[];
   /** Reports the operator has not provably received: pending, in-flight with an
    *  unknown outcome, or written off. An empty list is the only honest way to
    *  say "everything authored this cycle actually went out" (#123). */
   openReports: ReportRecord[];
+  /** Ordinary outcomes and deferred escalations not yet associated with an
+   * accepted digest report. */
+  digestBacklog: DigestBacklog;
   /**
    * The most recent conductor-verb calls and how the daemon decided them
    * (#126). On `status` rather than only behind `omp-conductor ledger` because
@@ -2758,6 +3554,8 @@ export interface StatusSnapshot {
    * config does not let it, and an operator who has to know to go looking is an
    * operator who finds out from the tracker instead.
    */
+  /** Current live-head push-workflow verdict per recently merged repository. */
+  baseHealth: BaseHealth[];
   verbLedger: VerbLedgerEntry[];
   /** Runs backed by a worker process — the number capacity compares against. */
   liveWorkers: number;
@@ -2804,6 +3602,10 @@ export function statusSnapshotFromStore(
   store: Store,
   planUsage?: PlanUsageStatus,
 ): StatusSnapshot {
+  const now = Date.now();
+  const lastDigestKey = store.lastDigestDedupeKey(p.name);
+  const lastDigestDay =
+    lastDigestKey === undefined ? undefined : lastDigestKey.slice("digest:".length);
   const since = startOfToday();
   const dispatch = store.latestDispatch(p.name);
   const labelOpsPending = store.countPendingLabelOps(p.name);
@@ -2817,11 +3619,15 @@ export function statusSnapshotFromStore(
     stateDir: stateDir(),
     paused: isPaused(),
     ...(reason === undefined ? {} : { pauseReason: reason }),
+    availability: availabilityState(p.reporting, now),
+    digestSchedule: digestScheduleState(p.reporting ?? DEFAULT_REPORT_POLICY, lastDigestDay, now),
     caps,
     releaseGrants: resolveReleaseGrants(p),
     activeRuns: store.activeRuns(p.name),
     salvagedRuns: store.salvagedRuns(p.name),
+    turnOverrides: store.listTurnOverrides(p.name),
     openReports: store.openReports(p.name),
+    digestBacklog: store.digestBacklog(p.name),
     verbLedger: store.verbLedger(p.name, { limit: STATUS_LEDGER_SCAN }),
     liveWorkers: store.liveRuns(p.name).length,
     runsToday: store.runsStartedSince(p.name, since),
@@ -2830,11 +3636,12 @@ export function statusSnapshotFromStore(
     ...(planUsage === undefined ? {} : { planUsage }),
     // Written by the tracker's hooks rather than polled, so the renderer does
     // not re-read GitHub to know it is being refused (#198).
-    ghRefusals: store.ghRefusalsSince?.(Date.now() - 5 * 60_000),
+    ghRefusals: store.ghRefusalsSince?.(now - 5 * 60_000),
     ghCallsToday: store.ghCallsToday?.(utcDay()),
     ...(labelOpsPending === 0 || oldestLabelOpAt === undefined
       ? {}
-      : { labelOps: { pending: labelOpsPending, oldestAgeMs: Date.now() - oldestLabelOpAt } }),
+      : { labelOps: { pending: labelOpsPending, oldestAgeMs: now - oldestLabelOpAt } }),
+    baseHealth: store.baseHealth(p.name),
   };
 }
 
@@ -2917,6 +3724,25 @@ export function formatReleaseGrants(grants: ResolvedGrants): string[] {
     ...RELEASE_SHAPES.map((shape) => `  ${shape.padEnd(19)}${grants[shape]}`),
   ];
 }
+export function formatBaseHealth(rows: readonly BaseHealth[]): string[] {
+  return rows.map((row) => {
+    const head = row.headSha.slice(0, 8);
+    if (row.verdict === "green") {
+      return `base ${row.repo}/${row.branch}  green (${row.runsCount} run(s)) at ${head}`;
+    }
+    if (row.verdict === "red") {
+      return `base ${row.repo}/${row.branch}  RED — ${row.detail ?? `workflow failed at ${head}`}`;
+    }
+    if (row.verdict === "pending") {
+      return `base ${row.repo}/${row.branch}  pending (${row.runsCount} run(s)) at ${head}`;
+    }
+    return (
+      `base ${row.repo}/${row.branch}  unknown — ` +
+      (row.detail ?? `no push-triggered workflow run for ${head}`)
+    );
+  });
+}
+
 
 export function formatStatus(s: StatusSnapshot): string {
   const lines = [
@@ -2935,6 +3761,9 @@ export function formatStatus(s: StatusSnapshot): string {
     // fleet (#110).
     `  plan usage         ${planUsageLine(s.planUsage)}`,
     `  new worker turns   ${s.caps.workerMaxTurns}`,
+    ...s.turnOverrides.map(
+      ({ issue, maxTurns }) => `  turn override      #${issue} → ${maxTurns} (next attempt)`,
+    ),
     `  worker wall clock  ${Math.round(s.caps.workerWallClockMs / 60_000)}m`,
     `  failed attempts    ${s.caps.maxAttemptsPerIssue}`,
     `  continuations      ${s.caps.maxContinuationsPerIssue}`,
@@ -2961,6 +3790,7 @@ export function formatStatus(s: StatusSnapshot): string {
       if (flagged !== undefined) lines.push(`      ${flagged}`);
     }
   }
+  lines.push(...formatBaseHealth(s.baseHealth));
   lines.push(...formatSalvagedRuns(s.salvagedRuns));
   lines.push(...formatOpenReports(s.openReports));
   lines.push(...formatVerbLedger(s.verbLedger));
@@ -3096,6 +3926,15 @@ export interface SessionError {
   message: string;
 }
 
+export function completionLastError(
+  providerCredit: string | undefined,
+  providerTransient: string | undefined,
+  verifiedReason: string | undefined,
+  sessionErr: SessionError | undefined,
+): string | undefined {
+  return providerCredit ?? providerTransient ?? verifiedReason ?? sessionErr?.message;
+}
+
 /**
  * The last error a transcript recorded, or undefined when it recorded none.
  *
@@ -3162,6 +4001,19 @@ export async function classifyAndRecover(d: Deps): Promise<void> {
   const { project, tracker, store } = d;
   for (const run of store.runsNeedingClassification(project.name, CLASSIFY_BATCH)) {
     const facts: ClassifyFacts = {};
+    let classifiedRun = run;
+    if (run.state === "failed" || run.state === "killed") {
+      const sessionError = readSessionError(run.sessionFile);
+      if (sessionError !== undefined) {
+        if (run.lastError === undefined || run.lastError === sessionError.message) {
+          facts.sessionError = sessionError;
+        }
+        if (run.lastError === undefined) {
+          store.updateRun(run.id, { lastError: sessionError.message });
+          classifiedRun = { ...run, lastError: sessionError.message };
+        }
+      }
+    }
     try {
       if (run.prUrl !== undefined) {
         const pr = await tracker.prState(run.prUrl);
@@ -3188,7 +4040,7 @@ export async function classifyAndRecover(d: Deps): Promise<void> {
       continue;
     }
 
-    const { cls, recovery, evidence } = classifyRun(run, facts);
+    const { cls, recovery, evidence } = classifyRun(classifiedRun, facts);
 
     // A healthy green PR is not a failure of any class. Leaving the row
     // unclassified is what keeps it eligible for the sweep on the tick where its
@@ -3202,7 +4054,7 @@ export async function classifyAndRecover(d: Deps): Promise<void> {
         ? `#${run.issue} retrying ${recovery} for ${cls}: ${evidence}`
         : `#${run.issue} classified ${cls} → ${recovery}: ${evidence}`,
     );
-    await recoverRun(d, run, cls, recovery, evidence);
+    await recoverRun(d, classifiedRun, cls, recovery, evidence);
   }
 }
 
@@ -3268,6 +4120,9 @@ async function recoverRun(
   }
 
   if (recovery === "requeue") {
+    if (cls === "provider-credit") {
+      await reactToProviderCredit(d, run.issue, evidence, run.sessionFile);
+    }
     // A dispatch-infra requeue that keeps landing on the same issue means the
     // mirror for its repo is persistently broken — a ref-lock that retry already
     // exhausted, a dead remote. Requeueing forever spends a turn-0 run per tick
@@ -3682,7 +4537,8 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
         onChildLog: (line) => {
           log(`orchestrator ${line}`);
         },
-        onReleaseBlocked: (shape) => recordReleaseBlock(project.name, "orchestrator", shape),
+        onReleaseBlocked: (shape, context) =>
+          recordReleaseBlock(project.name, "orchestrator", shape, context),
       });
       const transcript = orchestrator.sessionFile();
       log(`orchestrator session ready${transcript === undefined ? "" : ` · ${transcript}`}`);
@@ -3696,7 +4552,17 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     }
   }
 
-  const escalator = createEscalator(project, tracker, store, orchestrator);
+  let runtimeDeps: Deps | undefined;
+  const currentProject = (): ProjectConfig => runtimeDeps?.project ?? project;
+  const deliveryPolicyValid = (): boolean => runtimeDeps?.deliveryPolicyValid === true;
+  const escalator = createEscalator(
+    currentProject,
+    tracker,
+    store,
+    orchestrator,
+    Date.now,
+    deliveryPolicyValid,
+  );
 
   // Report delivery is the daemon's, not the model's (#123). Built beside the
   // escalator because a report nobody can deliver pages through it, and driven
@@ -3704,10 +4570,11 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   // but still owes its operator the report it was handed, and five minutes is a
   // long time to sit on a page.
   const outbox = createReportOutbox({
-    project,
+    project: currentProject,
     store,
     escalate: (e) => escalator.escalate(e),
     log,
+    deliveryAllowed: deliveryPolicyValid,
   });
 
   // Every row still `sending` when a daemon boots belonged to a process that is
@@ -3733,6 +4600,8 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     caps,
     tracker,
     store,
+    // Fail closed until the first tick re-reads and validates the live config.
+    deliveryPolicyValid: false,
     // Process-wide, so a `status` served off this daemon's own HTTP surface
     // reuses the tick's reading instead of shelling out again.
     usage: sharedUsageSource(),
@@ -3747,6 +4616,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     ...(verbPeerReader === undefined ? {} : { verbPeerReader }),
     verbActions,
   };
+  runtimeDeps = d;
 
   if (o.once) {
     try {
@@ -3821,9 +4691,11 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   // carries no credential of any kind, and it cannot tell one caller from
   // another: `127.0.0.1` is not an identity. The turn-limit and worker
   // pause/resume controls trust a body-supplied `project`, which is exactly the
-  // shape "identity from the payload" takes when nobody is watching. Those
-  // controls are tolerable only because they are bounded, live-run-local, and
-  // reversible.
+  // shape "identity from the payload" takes when nobody is watching. They stay
+  // tolerable only because every effect is bounded: pauses are reversible,
+  // live extensions touch one controller, and a persisted next-attempt
+  // override can only raise the project base up to its configured ceiling and
+  // is consumed by one claim.
   //
   // A merge, a push, a release or a label is none of those things. Do not add
   // one here, and do not add "just a small one" behind a shared secret either:
@@ -3838,6 +4710,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
       daemonHttpResponse(req, {
         project: project.name,
         store,
+        caps: () => d.caps,
         turnLimits,
         workerControls,
         health: () =>