omp-conductor 0.13.0 → 0.15.0

package/src/daemon.ts

@@ -18,19 +18,26 @@ import {
   resolveReleaseGrants,
   stateDir,
 } from "./config.ts";
+import { availabilityState, type AvailabilityState } from "./availability.ts";
 import {
   analyseSettlement,
   formatSettlementFlags,
   settlementFlagSummary,
 } from "./diff-flags.ts";
+import { digestScheduleState, type DigestScheduleState } from "./digest-schedule.ts";
 import { createEscalator, escalationIssueRef } from "./escalate.ts";
 import { pendingCodeGraph, probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
 import { graphHint } from "./graph.ts";
 import { livingDaemon } from "./lifecycle.ts";
-import { STALL_MARKER_FILE } from "./orchestrator-tick.ts";
+import { requestImmediateTick, resolveTickConfigCwd, STALL_MARKER_FILE } from "./orchestrator-tick.ts";
 import { startOrchestrator } from "./orchestrator.ts";
 import type { OrchestratorHandle } from "./orchestrator.ts";
-import { createReportOutbox, formatOpenReports } from "./reports.ts";
+import {
+  createReportOutbox,
+  enqueueAvailableHeldNotices,
+  formatOpenReports,
+  type ReportOutbox,
+} from "./reports.ts";
 import {
   recordReleaseBlock,
   type ReleaseBlockContext,
@@ -42,11 +49,13 @@ import { classifyRun, providerCreditRefusal, providerTransientFault, type Classi
 import { projectLabels } from "./label-projection.ts";
 import { dbPath, LIVE_STATES, openStore, utcDay } from "./store.ts";
 import { makeTracker, type RateLimitStatus } from "./tracker/github.ts";
-import { RELEASE_SHAPES } from "./types.ts";
+import { DEFAULT_REPORT_POLICY, RELEASE_SHAPES } from "./types.ts";
 import type {
+  BaseHealth,
   AdmissionHoldReason,
   Caps,
   DispatchSummary,
+  DigestBacklog,
   Escalation,
   IssueSnapshot,
   MergedPrInfo,
@@ -167,6 +176,9 @@ interface Deps {
   caps: Caps;
   tracker: Tracker;
   store: Store;
+  /** False after a live config reload fails; autonomous delivery then holds
+   * fail-closed until a later tick validates the config again. */
+  deliveryPolicyValid?: boolean;
   /** Provider-reported plan allowance, cached with a TTL. Resolved once at
    *  startup like every other dep so a tick cannot swap its own meter. */
   usage: UsageSource;
@@ -215,10 +227,10 @@ export function verbDeps(d: Pick<Deps, "project" | "store" | "tracker" | "verbAc
     tracker: d.tracker,
     actions: d.verbActions ?? githubVerbActions(d.project),
     fleetStop: () =>
-      isPaused()
-        ? "claiming is paused for this fleet (omp-conductor pause, hold or halt)"
+      isPaused(d.project.name)
+        ? "claiming is paused for this fleet (omp-conductor hold or stop)"
         : undefined,
-    pausedAt,
+    pausedAt: () => pausedAt(d.project.name),
     log,
     now: () => Date.now(),
     chain: { readBaseChain },
@@ -364,80 +376,92 @@ export async function watchOrchestrator(d: Deps, now = Date.now()): Promise<void
 }
 
 /**
- * Pause is a file rather than process state on purpose: `omp-conductor pause`
- * and `/conductor pause` run in a different process from the daemon, and a flag
+ * Pause is a file rather than process state on purpose: `omp-conductor hold`
+ * runs in a different process from the daemon, and a flag
  * on disk needs no IPC and survives a restart. A daemon that crashed while
  * paused comes back paused.
  */
-export function isPaused(): boolean {
-  return existsSync(join(stateDir(), "paused"));
+export function pausedPath(project?: string): string {
+  return join(stateDir(), project === undefined ? "paused" : `paused-${project}`);
+}
+
+function activePausePaths(project?: string): string[] {
+  const paths = project === undefined ? [pausedPath()] : [pausedPath(project), pausedPath()];
+  return paths.filter((path) => existsSync(path));
+}
+
+export function isPaused(project?: string): boolean {
+  return activePausePaths(project).length !== 0;
 }
 
 /**
- * The epoch-ms timestamp at which the current pause began, read from the same
- * sentinel file {@link setPaused} writes (`<stateDir()>/paused`). Returns
- * `undefined` when the fleet is not paused, or when the file's first line does
- * not parse as a date. A legacy/blank sentinel keeps completion mutations
- * fail-closed because a run admitted before an *unknown* pause cannot be proven
- * innocent. {@link isPaused} is the authority on *whether*; this answers *since
- * when*.
+ * The epoch-ms timestamp at which the current pause began. A project pause also
+ * observes the legacy bare sentinel, which pauses every project. If any active
+ * sentinel is unreadable or unparseable, the timestamp is unknown so callers
+ * continue to fail closed.
  */
-export function pausedAt(): number | undefined {
-  const f = join(stateDir(), "paused");
-  if (!existsSync(f)) return undefined;
-  try {
-    const first = readFileSync(f, "utf8").split("\n")[0]?.trim();
-    if (first === undefined || first === "") return undefined;
-    const t = Date.parse(first);
-    return Number.isNaN(t) ? undefined : t;
-  } catch {
-    // Unreadable sentinel (permissions, corruption): fail completion mutations
-    // closed like an unparseable line while the pause time is unprovable.
-    return undefined;
+export function pausedAt(project?: string): number | undefined {
+  const paths = activePausePaths(project);
+  if (paths.length === 0) return undefined;
+  const times: number[] = [];
+  for (const path of paths) {
+    try {
+      const first = readFileSync(path, "utf8").split("\n")[0]?.trim();
+      if (first === undefined || first === "") return undefined;
+      const time = Date.parse(first);
+      if (Number.isNaN(time)) return undefined;
+      times.push(time);
+    } catch {
+      return undefined;
+    }
   }
+  return Math.min(...times);
 }
 
 /**
- * Who paused the fleet and why, read from line 2 of the same sentinel
- * {@link setPaused} writes — `undefined` when the fleet is not paused or the
- * file has no (parseable) line 2. Provenance lives on its own line so line 1
- * stays a pure ISO timestamp that {@link pausedAt} can `Date.parse`; the `armed
- * <ISO> owner=<id>` marker `armTicks` writes is the same one-key-per-line
- * precedent.
+ * Who paused the project and why. Per-project provenance wins when both its
+ * sentinel and the legacy all-project sentinel are active.
  */
-export function pauseProvenance(): { source: string; reason?: string } | undefined {
-  const f = join(stateDir(), "paused");
-  if (!existsSync(f)) return undefined;
+export function pauseProvenance(
+  project?: string,
+): { source: string; reason?: string } | undefined {
+  const paths =
+    project === undefined
+      ? [pausedPath()]
+      : [pausedPath(project), pausedPath()];
+  const path = paths.find((candidate) => existsSync(candidate));
+  if (path === undefined) return undefined;
   try {
-    const second = readFileSync(f, "utf8").split("\n")[1];
+    const second = readFileSync(path, "utf8").split("\n")[1];
     if (second === undefined) return undefined;
     const match = /^source=(\S+)(?: reason="(.*)")?$/.exec(second.trim());
     if (match === null) return undefined;
-    const source = match[1]!; // the regex guarantees group 1 on a match
+    const source = match[1]!;
     const reason = match[2];
     return { source, ...(reason === undefined ? {} : { reason }) };
   } catch {
-    // Unreadable sentinel: no provenance to name. Completion mutations still
-    // fail closed because the pause time is unknown.
     return undefined;
   }
 }
 
-export function setPaused(v: boolean, why?: { source: string; reason?: string }): void {
-  const f = join(stateDir(), "paused");
+export function setPaused(
+  v: boolean,
+  why?: { source: string; reason?: string },
+  project?: string,
+): void {
+  const path = pausedPath(project);
   if (v) {
-    mkdirSync(dirname(f), { recursive: true });
+    mkdirSync(dirname(path), { recursive: true });
     const line1 = `${new Date().toISOString()}\n`;
     if (why === undefined) {
-      writeFileSync(f, line1);
+      writeFileSync(path, line1);
     } else {
-      // Quotes are stripped before embedding so a reason cannot break out of
-      // the `reason="..."` field of line 2.
       const reason = why.reason === undefined ? "" : ` reason="${why.reason.replaceAll('"', "")}"`;
-      writeFileSync(f, `${line1}source=${why.source}${reason}\n`);
+      writeFileSync(path, `${line1}source=${why.source}${reason}\n`);
     }
   } else {
-    rmSync(f, { force: true });
+    rmSync(path, { force: true });
+    if (project !== undefined) rmSync(pausedPath(), { force: true });
   }
 }
 
@@ -663,8 +687,8 @@ async function reactToProviderCredit(
   sessionFile: string | undefined,
 ): Promise<void> {
   const { project } = d;
-  const alreadyPaused = isPaused();
-  if (!alreadyPaused) setPaused(true, { source: "provider-credit", reason: message });
+  const alreadyPaused = isPaused(project.name);
+  if (!alreadyPaused) setPaused(true, { source: "provider-credit", reason: message }, project.name);
   log(
     `#${issue} provider refused for credit — dispatch ${alreadyPaused ? "remains paused" : "paused"}: ${message}`,
   );
@@ -1402,12 +1426,15 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
     });
     if (await settleStopBeforeSession()) return;
 
+    const repoSlug = githubRepo(r.repo.cloneUrl);
+
     let result: WorkerResult;
     try {
       result = await runWorker({
         brief,
         cwd: worktreePath,
         caps,
+        ...(repoSlug === undefined ? {} : { repoSlug }),
         maxTurns: () => turnLimit?.maxTurns() ?? maxTurns,
         onPauseControl: (control) => {
           workerSessionInstalled = true;
@@ -1804,12 +1831,12 @@ export interface Settlement {
  *
  * - `merged` — the work landed. That is what `merged` was reserved for.
  * - `closed` — a human read the work and said no. Leaving it `pushed-green`
- *   strands the issue forever behind a PR nobody will ever merge, and calling it
- *   `merged` is simply a lie about work that does not exist on the base branch.
- *   `failed` is true — the attempt did not land — and it releases the busy guard,
- *   so an issue a human re-queues can be attempted again. The attempt counter is
- *   untouched either way: this row was a real attempt, and pretending otherwise
- *   would let a rejected issue cycle past `maxAttemptsPerIssue`.
+ *   forever is a lie; `failed` records that it did not land and releases the
+ *   busy guard, so an issue a human re-queues can be attempted again. A row
+ *   that had reached `pushed-green` or `pushed-pending` is classified
+ *   `returned-for-revision` at settlement. A review decision asks for another
+ *   implementation pass, not a failure, so it consumes the continuation budget
+ *   instead of the failed-attempt budget.
  * - `open`, and undefined — nothing changes. Undefined is "could not tell": a
  *   flaky network, a revoked token, a deleted PR. Settling on it would record a
  *   merge that never happened, and the next tick asks again for free. An
@@ -1944,15 +1971,24 @@ export async function watchMergedBase(d: Pick<Deps, "project" | "tracker" | "sto
 
     let workflows;
     try {
-      workflows = await d.tracker.workflowRunsAt(repoIdentity, run.mergeSha);
+      workflows = await d.tracker.workflowRunsAt(repoIdentity, run.mergeSha, {
+        event: "push",
+        branch: run.baseRef,
+      });
     } catch (err) {
       log(`#${run.issue} base check unavailable (${errText(err)}) — retrying next tick`);
       continue;
     }
-    if (workflows === undefined || workflows.length === 0) {
+    if (workflows === undefined) {
       log(`#${run.issue} base check unavailable for ${run.mergeSha} — retrying next tick`);
       continue;
     }
+    if (workflows.length === 0) {
+      log(
+        `#${run.issue} base check: no push-triggered run yet for ${run.mergeSha} — retrying next tick`,
+      );
+      continue;
+    }
     if (workflows.some((workflow) => workflow.status !== "completed")) continue;
 
     const failed = workflows.find(
@@ -2016,6 +2052,110 @@ export async function watchMergedBase(d: Pick<Deps, "project" | "tracker" | "sto
   }
 }
 
+/**
+ * Refresh current base-branch health at each recently merged repository's live
+ * head. This is status and release-gate evidence only; the per-merge audit
+ * above remains the sole path that attributes and escalates a regression.
+ */
+export async function watchBaseHealth(
+  d: Pick<Deps, "project" | "tracker" | "store">,
+): Promise<void> {
+  const now = Date.now();
+  const previousByRepo = new Map(
+    d.store.baseHealth(d.project.name).map((row) => [row.repo, row] as const),
+  );
+  for (const { repo, baseRef } of d.store.mergedRepoBranches(
+    d.project.name,
+    now - BASE_STATUS_WINDOW_MS,
+  )) {
+    const target = d.project.routing.repos[repo];
+    if (target === undefined) {
+      log(`base health skipped: routed repository ${repo} is no longer configured`);
+      continue;
+    }
+    const identity = githubRepo(target.cloneUrl);
+    if (identity === undefined) {
+      log(`base health skipped: routed repository ${repo} has no GitHub identity`);
+      continue;
+    }
+    const branch = baseRef ?? target.defaultBranch;
+
+    let head: string | undefined;
+    try {
+      head = await d.tracker.branchHead(identity, branch);
+    } catch (err) {
+      log(`base ${repo}/${branch} head unavailable (${errText(err)}) — keeping previous health`);
+      continue;
+    }
+    if (head === undefined) {
+      log(`base ${repo}/${branch} head unavailable — keeping previous health`);
+      continue;
+    }
+
+    const previous = previousByRepo.get(repo);
+    if (
+      previous?.branch === branch &&
+      previous.headSha === head &&
+      (previous.verdict === "green" || previous.verdict === "red")
+    ) {
+      continue;
+    }
+
+    let runs;
+    try {
+      runs = await d.tracker.workflowRunsAt(identity, head, { event: "push", branch });
+    } catch (err) {
+      log(`base ${repo}/${branch} workflows unavailable (${errText(err)}) — keeping previous health`);
+      continue;
+    }
+    if (runs === undefined) {
+      log(`base ${repo}/${branch} workflows unavailable — keeping previous health`);
+      continue;
+    }
+
+    let verdict: BaseHealth["verdict"];
+    let detail: string | undefined;
+    if (runs.length === 0) {
+      verdict = "unknown";
+      detail = `no push-triggered workflow run for ${head.slice(0, 8)}`;
+    } else if (runs.some((run) => run.status !== "completed")) {
+      verdict = "pending";
+    } else {
+      const failed = runs.find(
+        (run) =>
+          run.conclusion !== undefined &&
+          FAILING_WORKFLOW_CONCLUSIONS.has(run.conclusion),
+      );
+      if (failed !== undefined) {
+        verdict = "red";
+        detail = `${failed.name} failed at ${head.slice(0, 8)} — ${failed.url}`;
+      } else if (
+        runs.some(
+          (run) =>
+            run.conclusion === undefined ||
+            !SUCCESSFUL_WORKFLOW_CONCLUSIONS.has(run.conclusion),
+        )
+      ) {
+        verdict = "pending";
+      } else {
+        verdict = "green";
+      }
+    }
+
+    const health: BaseHealth = {
+      repo,
+      branch,
+      headSha: head,
+      verdict,
+      runsCount: runs.length,
+      checkedAt: now,
+      ...(detail === undefined ? {} : { detail }),
+    };
+    d.store.upsertBaseHealth(d.project.name, health);
+    previousByRepo.set(repo, health);
+  }
+}
+
 export async function settlePushedGreen(
   d: Pick<Deps, "project" | "tracker" | "store">,
 ): Promise<void> {
@@ -2080,7 +2220,11 @@ export async function settlePushedGreen(
               baseCheck: "pending",
             }),
       };
-      if (settlement.state === "failed") patch.lastError = settlement.reason;
+      if (settlement.state === "failed") {
+        patch.lastError = settlement.reason;
+        patch.failureClass = "returned-for-revision";
+        patch.recoveryAction = "none";
+      }
       store.updateRun(run.id, patch);
       log(`#${run.issue} settled: ${settlement.reason}`);
       continue;
@@ -2808,6 +2952,40 @@ export async function dispatchAdmissions(
 
 // ----------------------------------------------------------------------- a tick
 
+/**
+ * After a false→true condition transition, poke the orchestrator heartbeat so
+ * it does not wait a full interval (#329). Best-effort: missing tick config or
+ * a failed write leaves the row flagged in the ledger for the next heartbeat.
+ */
+export function wakeOrchestratorForMetConditions(
+  projectName: string,
+  met: readonly { id: string; condition?: string }[],
+  writeLog: (line: string) => void = log,
+): void {
+  if (met.length === 0) return;
+  for (const decision of met) {
+    writeLog(
+      `decision ${decision.id} condition met (${decision.condition ?? "?"}) — requesting orchestrator tick`,
+    );
+  }
+  const tickCwd = resolveTickConfigCwd(projectName);
+  if (tickCwd === undefined) {
+    writeLog(
+      `decision condition met for ${met.map((m) => m.id).join(", ")} but no tick config cwd — heartbeat will surface them on its next interval`,
+    );
+    return;
+  }
+  const ids = met.map((m) => m.id).join(",");
+  const reason = `condition-met ${ids}`;
+  if (requestImmediateTick(tickCwd, reason)) {
+    writeLog(`requested immediate tick at ${tickCwd}: ${reason}`);
+  } else {
+    writeLog(
+      `could not write tick request under ${tickCwd}; conditions ${ids} wait for the next heartbeat`,
+    );
+  }
+}
+
 export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // A config edit takes effect on the next tick, not the next daemon restart
   // (#170). Re-resolve the project and its caps at the tick boundary so a tick
@@ -2823,8 +3001,26 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     }
     d.project = fresh;
     d.caps = freshCaps;
+    d.deliveryPolicyValid = true;
   } catch (err) {
-    log(`config reload failed (${errText(err)}) — continuing with the values loaded at boot`);
+    log(`config reload failed (${errText(err)}) — retaining boot values but blocking autonomous delivery`);
+    d.deliveryPolicyValid = false;
+  }
+
+  // Availability-held notices are already durable. Once the freshly reloaded
+  // policy opens (or newly allows their category), atomically hand a bounded
+  // batch to the report outbox. Pauses do not suppress delivery.
+  if (d.deliveryPolicyValid !== false) {
+    try {
+      const catchUp = enqueueAvailableHeldNotices(d.project, d.store, Date.now());
+      if (catchUp !== undefined && !catchUp.deduped) {
+        log(`availability catch-up ${catchUp.report.id} queued for ${d.project.name}`);
+      }
+    } catch (err) {
+      // The daily digest may have claimed the same rows from another process
+      // between selection and association. Either way the ledger still owns them.
+      log(`availability catch-up handoff deferred (${errText(err)}) — retrying next tick`);
+    }
   }
 
   // Before the pause check, deliberately. This one is not about dispatch: the
@@ -2844,6 +3040,11 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   } catch (err) {
     log(`base-branch check sweep failed: ${errText(err)}`);
   }
+  try {
+    await watchBaseHealth(d);
+  } catch (err) {
+    log(`current base-health sweep failed: ${errText(err)}`);
+  }
   try {
     await adoptSalvagedPrs(d);
   } catch (err) {
@@ -2884,11 +3085,14 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // Ledger maintenance, above the pause gate for the same reason the stall watch
   // is: a paused fleet still owes its operator the questions it asked, and a
   // condition that came true while dispatch was parked is exactly the thing the
-  // orchestrator has to see on its next tick.
+  // orchestrator has to see promptly (#329).
   //
   // Expiry is synchronous (one UPDATE); condition evaluation is fire-and-forget
   // because it shells out to `gh` and `npm`, and a registry that hangs must cost
-  // one unevaluated condition rather than the tick.
+  // one unevaluated condition rather than the tick. A false→true transition
+  // writes the same immediate-tick poke recover uses so the heartbeat does not
+  // wait a full interval; repeated sweeps while the condition stays true never
+  // re-enter `met` (store mark is idempotent).
   for (const expired of d.store.expireDueDecisions(d.project.name, Date.now())) {
     log(`decision ${expired.id} expired unanswered after seven days: ${expired.question}`);
   }
@@ -2900,9 +3104,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     Date.now,
   )
     .then((met) => {
-      for (const decision of met) {
-        log(`decision ${decision.id} condition met (${decision.condition ?? "?"}) — surfacing on the next tick`);
-      }
+      wakeOrchestratorForMetConditions(d.project.name, met);
     })
     .catch((err: unknown) => {
       log(`decision condition pass failed: ${errText(err)}`);
@@ -2910,7 +3112,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
 
   // A paused fleet claims nothing. Checked first so pausing takes effect on the
   // next tick without signalling the process.
-  if (isPaused()) return;
+  if (isPaused(d.project.name)) return;
 
   const { project, caps, store } = d;
 
@@ -2937,7 +3139,11 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
       `ERROR: the installed conductor changed under this daemon — ${integrity.diff.length} file(s) differ ` +
         `(${shown.join(", ")}${integrity.diff.length > shown.length ? ", …" : ""}) — pausing`,
     );
-    setPaused(true, { source: "integrity", reason: "installed package changed under the daemon" });
+    setPaused(
+      true,
+      { source: "integrity", reason: "installed package changed under the daemon" },
+      project.name,
+    );
     if (integrity.page) {
       const delivered = await safeEscalate(d, {
         tier: 2,
@@ -3027,7 +3233,11 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // operator opted out — turns and wall-clock still brake every run (#46).
   const spent = store.spendSince(project.name, since);
   if (caps.dailySpendUsd !== null && spent >= caps.dailySpendUsd) {
-    setPaused(true, { source: "spend-cap", reason: `daily spend reached $${caps.dailySpendUsd}` });
+    setPaused(
+      true,
+      { source: "spend-cap", reason: `daily spend reached $${caps.dailySpendUsd}` },
+      project.name,
+    );
     await safeEscalate(d, {
       tier: 2,
       category: "fleet-stopped",
@@ -3037,7 +3247,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
       summary: `Daily spend cap reached on ${new Date().toISOString().slice(0, 10)} — ${project.name} is paused`,
       detail: [
         `Spent $${spent.toFixed(2)} of the $${caps.dailySpendUsd.toFixed(2)} daily cap.`,
-        "No further work will be claimed until `omp-conductor resume` (or /conductor resume).",
+        "No further work will be claimed until `omp-conductor resume`.",
       ].join("\n"),
     });
     recordDispatch(0, [
@@ -3088,25 +3298,29 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
 // --------------------------------------------------------------- read-only views
 
 export interface DaemonHealthSnapshot {
-  ok: true;
+  ok: boolean;
   paused: boolean;
   activeRuns: number;
   project: string;
   /** One-shot issue ceilings waiting for the next claim. */
   turnOverrides: TurnOverride[];
-  /** Resident set of this daemon; workers are in-process omp sessions. */
-  rssBytes: number;
   dispatch?: DispatchSummary;
   codeGraph?: CodeGraphHealth;
   /** Live workers in a non-running pause phase; absent/empty = nothing paused. */
   workers?: { issue: number; runId: string; phase: WorkerPausePhase }[];
 }
 
+export interface DaemonHealth {
+  ok: boolean;
+  /** Resident set of this daemon; workers are in-process omp sessions. */
+  rssBytes: number;
+  projects: DaemonHealthSnapshot[];
+}
+
 export function daemonHealthSnapshot(
   store: Store,
   project: string,
-  paused = isPaused(),
-  rssBytes = process.memoryUsage().rss,
+  paused = isPaused(project),
   codeGraph?: CodeGraphHealth,
   workerControls?: WorkerControlRegistry,
 ): DaemonHealthSnapshot {
@@ -3117,13 +3331,19 @@ export function daemonHealthSnapshot(
     activeRuns: store.activeRuns(project).length,
     turnOverrides: store.listTurnOverrides(project),
     project,
-    rssBytes,
     ...(dispatch === undefined ? {} : { dispatch }),
     ...(codeGraph?.configured === true ? { codeGraph } : {}),
     ...(workerControls === undefined ? {} : { workers: workerControls.snapshot(project) }),
   };
 }
 
+export function daemonHealth(
+  projects: DaemonHealthSnapshot[],
+  rssBytes = process.memoryUsage().rss,
+): DaemonHealth {
+  return { ok: projects.every((project) => project.ok), rssBytes, projects };
+}
+
 const TURN_OVERRIDE_STATES: ReadonlySet<RunState> = new Set([
   "failed",
   "killed",
@@ -3329,13 +3549,17 @@ export async function workerControlResponse(
   );
 }
 
-export interface DaemonHttpDeps {
+export interface DaemonHttpProjectDeps {
   project: string;
   store: Pick<Store, "latestRun" | "setTurnOverride">;
   caps: () => Pick<Caps, "workerMaxTurns" | "workerMaxTurnsCeiling">;
+}
+
+export interface DaemonHttpDeps {
+  projects: readonly DaemonHttpProjectDeps[];
   turnLimits: TurnLimitRegistry;
   workerControls: WorkerControlRegistry;
-  health: () => DaemonHealthSnapshot;
+  health: () => DaemonHealth;
 }
 
 /**
@@ -3350,9 +3574,47 @@ export interface DaemonHttpDeps {
 export async function daemonHttpResponse(req: Request, d: DaemonHttpDeps): Promise<Response> {
   const url = new URL(req.url);
   if (req.method === "GET" && url.pathname === "/healthz") return Response.json(d.health());
-  const turnLimit = await turnLimitResponse(req, d.project, d.store, d.turnLimits, d.caps());
+
+  let selected = d.projects[0];
+  if (
+    req.method === "PUT" &&
+    /^\/runs\/\d+\/(?:turn-limit|pause|resume|stop)$/.test(url.pathname) &&
+    req.headers.get("content-type")?.startsWith("application/json")
+  ) {
+    try {
+      const body = await req.clone().json();
+      if (body !== null && typeof body === "object") {
+        const requested = Reflect.get(body, "project");
+        if (typeof requested === "string" && requested.length > 0) {
+          selected = d.projects.find(({ project }) => project === requested);
+          if (selected === undefined) {
+            return Response.json(
+              { error: `daemon does not serve requested project "${requested}"` },
+              { status: 409 },
+            );
+          }
+        }
+      }
+    } catch {
+      // The route handler below owns the public malformed-body response.
+    }
+  }
+  if (selected === undefined) return new Response("not found\n", { status: 404 });
+
+  const turnLimit = await turnLimitResponse(
+    req,
+    selected.project,
+    selected.store,
+    d.turnLimits,
+    selected.caps(),
+  );
   if (turnLimit !== undefined) return turnLimit;
-  const workerControl = await workerControlResponse(req, d.project, d.store, d.workerControls);
+  const workerControl = await workerControlResponse(
+    req,
+    selected.project,
+    selected.store,
+    d.workerControls,
+  );
   return workerControl ?? new Response("not found\n", { status: 404 });
 }
 
@@ -3367,6 +3629,10 @@ export interface StatusSnapshot {
    * reading like a mistake (#220).
    */
   pauseReason?: string;
+  /** Mechanical operator availability at the moment this snapshot was read. */
+  availability?: AvailabilityState;
+  /** Next digest opportunity under the same predicate that gates submission. */
+  digestSchedule?: DigestScheduleState;
   caps: Caps;
   /**
    * The effective per-shape release grants. On the snapshot rather than re-read
@@ -3386,6 +3652,9 @@ export interface StatusSnapshot {
    *  unknown outcome, or written off. An empty list is the only honest way to
    *  say "everything authored this cycle actually went out" (#123). */
   openReports: ReportRecord[];
+  /** Ordinary outcomes and deferred escalations not yet associated with an
+   * accepted digest report. */
+  digestBacklog: DigestBacklog;
   /**
    * The most recent conductor-verb calls and how the daemon decided them
    * (#126). On `status` rather than only behind `omp-conductor ledger` because
@@ -3393,8 +3662,8 @@ export interface StatusSnapshot {
    * config does not let it, and an operator who has to know to go looking is an
    * operator who finds out from the tracker instead.
    */
-  /** Newest post-merge base verdict per routed repository within seven days. */
-  baseChecks: RunRecord[];
+  /** Current live-head push-workflow verdict per recently merged repository. */
+  baseHealth: BaseHealth[];
   verbLedger: VerbLedgerEntry[];
   /** Runs backed by a worker process — the number capacity compares against. */
   liveWorkers: number;
@@ -3441,25 +3710,32 @@ export function statusSnapshotFromStore(
   store: Store,
   planUsage?: PlanUsageStatus,
 ): StatusSnapshot {
+  const now = Date.now();
+  const lastDigestKey = store.lastDigestDedupeKey(p.name);
+  const lastDigestDay =
+    lastDigestKey === undefined ? undefined : lastDigestKey.slice("digest:".length);
   const since = startOfToday();
   const dispatch = store.latestDispatch(p.name);
   const labelOpsPending = store.countPendingLabelOps(p.name);
   const oldestLabelOpAt = store.oldestPendingLabelOpAt(p.name);
   // Read once: the provenance read touches the filesystem, and the renderer
   // should never pay for it twice per status.
-  const reason = pauseProvenance()?.reason;
+  const reason = pauseProvenance(p.name)?.reason;
   return {
     project: p.name,
     configPath: configPath(),
     stateDir: stateDir(),
-    paused: isPaused(),
+    paused: isPaused(p.name),
     ...(reason === undefined ? {} : { pauseReason: reason }),
+    availability: availabilityState(p.reporting, now),
+    digestSchedule: digestScheduleState(p.reporting ?? DEFAULT_REPORT_POLICY, lastDigestDay, now),
     caps,
     releaseGrants: resolveReleaseGrants(p),
     activeRuns: store.activeRuns(p.name),
     salvagedRuns: store.salvagedRuns(p.name),
     turnOverrides: store.listTurnOverrides(p.name),
     openReports: store.openReports(p.name),
+    digestBacklog: store.digestBacklog(p.name),
     verbLedger: store.verbLedger(p.name, { limit: STATUS_LEDGER_SCAN }),
     liveWorkers: store.liveRuns(p.name).length,
     runsToday: store.runsStartedSince(p.name, since),
@@ -3468,12 +3744,12 @@ export function statusSnapshotFromStore(
     ...(planUsage === undefined ? {} : { planUsage }),
     // Written by the tracker's hooks rather than polled, so the renderer does
     // not re-read GitHub to know it is being refused (#198).
-    ghRefusals: store.ghRefusalsSince?.(Date.now() - 5 * 60_000),
+    ghRefusals: store.ghRefusalsSince?.(now - 5 * 60_000),
     ghCallsToday: store.ghCallsToday?.(utcDay()),
     ...(labelOpsPending === 0 || oldestLabelOpAt === undefined
       ? {}
-      : { labelOps: { pending: labelOpsPending, oldestAgeMs: Date.now() - oldestLabelOpAt } }),
-    baseChecks: store.latestBaseChecks(p.name, Date.now() - BASE_STATUS_WINDOW_MS),
+      : { labelOps: { pending: labelOpsPending, oldestAgeMs: now - oldestLabelOpAt } }),
+    baseHealth: store.baseHealth(p.name),
   };
 }
 
@@ -3556,18 +3832,22 @@ export function formatReleaseGrants(grants: ResolvedGrants): string[] {
     ...RELEASE_SHAPES.map((shape) => `  ${shape.padEnd(19)}${grants[shape]}`),
   ];
 }
-export function formatBaseChecks(runs: readonly RunRecord[]): string[] {
-  return runs.flatMap((run) => {
-    if (run.baseCheck === undefined) return [];
-    const branch = run.baseRef ?? "?";
-    const flag = run.settlementFlags?.find((candidate) => candidate.kind === "base-branch-red");
-    const verdict =
-      run.baseCheck === "red"
-        ? `RED — ${flag?.detail ?? "workflow failed after merge"}`
-        : run.baseCheck === "red-preexisting"
-          ? `red before merge${flag === undefined ? "" : ` — ${flag.detail}`}`
-          : run.baseCheck;
-    return [`base ${run.repo}/${branch}  ${verdict}`];
+export function formatBaseHealth(rows: readonly BaseHealth[]): string[] {
+  return rows.map((row) => {
+    const head = row.headSha.slice(0, 8);
+    if (row.verdict === "green") {
+      return `base ${row.repo}/${row.branch}  green (${row.runsCount} run(s)) at ${head}`;
+    }
+    if (row.verdict === "red") {
+      return `base ${row.repo}/${row.branch}  RED — ${row.detail ?? `workflow failed at ${head}`}`;
+    }
+    if (row.verdict === "pending") {
+      return `base ${row.repo}/${row.branch}  pending (${row.runsCount} run(s)) at ${head}`;
+    }
+    return (
+      `base ${row.repo}/${row.branch}  unknown — ` +
+      (row.detail ?? `no push-triggered workflow run for ${head}`)
+    );
   });
 }
 
@@ -3618,7 +3898,7 @@ export function formatStatus(s: StatusSnapshot): string {
       if (flagged !== undefined) lines.push(`      ${flagged}`);
     }
   }
-  lines.push(...formatBaseChecks(s.baseChecks));
+  lines.push(...formatBaseHealth(s.baseHealth));
   lines.push(...formatSalvagedRuns(s.salvagedRuns));
   lines.push(...formatOpenReports(s.openReports));
   lines.push(...formatVerbLedger(s.verbLedger));
@@ -3645,7 +3925,7 @@ export interface QueuePreview {
 
 /**
  * Exactly what the next tick would pick up, computed without touching a single
- * label, run row or worktree. This is what makes `/conductor setup` honest: the
+ * label, run row or worktree. This is what makes `omp-conductor setup` honest: the
  * dry run is the same routing code the loop uses, not a description of it.
  */
 export async function previewProject(
@@ -3661,7 +3941,7 @@ export async function previewProject(
       `open issues in ${p.tracker.repo} labelled "${p.queueLabel}", ` +
       `minus anything already labelled ${states}, ` +
       `routed by one "${p.routing.labelPrefix}<repo>" label`,
-    paused: isPaused(),
+    paused: isPaused(p.name),
     ready: routed.map((r) => ({
       number: r.issue.number,
       title: r.issue.title,
@@ -3688,9 +3968,9 @@ export async function previewQueue(project?: string): Promise<QueuePreview> {
  * Setup calls this immediately after consent. Every later setup error therefore
  * leaves the fleet paused instead of exposing a partially written runtime.
  */
-export function prepareConductor(): void {
+export function prepareConductor(project?: string): void {
   openStore(dbPath()).close();
-  setPaused(true, { source: "setup" });
+  setPaused(true, { source: "setup" }, project);
 }
 
 /** Bounded per tick: each row costs tracker calls to gather facts for. */
@@ -4211,283 +4491,264 @@ export async function reconcileOrphanedRuns(
 
 // ------------------------------------------------------------------- the daemon
 
+interface ProjectRuntime {
+  d: Deps;
+  outbox: ReportOutbox;
+  orchestrator?: OrchestratorHandle;
+  orchestratorVerbs?: VerbListener;
+  codeGraph: CodeGraphHealth;
+  graphProbe?: Promise<void>;
+  reportPass?: Promise<void>;
+}
+
+function orchestratorStandingOrders(project: ProjectConfig): {
+  brief: string;
+  releaseGrants: ResolvedGrants;
+} {
+  const releaseGrants = resolveReleaseGrants(project);
+  const grantedShapes = RELEASE_SHAPES.filter((shape) => releaseGrants[shape] === "orchestrator");
+  const deniedShapes = RELEASE_SHAPES.filter((shape) => releaseGrants[shape] !== "orchestrator");
+  return {
+    releaseGrants,
+    brief: [
+      `You are the omp-conductor orchestrator for project "${project.name}".`,
+      `Tracker: ${project.tracker.repo}. Pass --repo ${project.tracker.repo} to every gh command:`,
+      "this working directory is the conductor's state directory, not a checkout.",
+      `Labels: queue=${project.queueLabel}, running=${project.stateLabels.inProgress}, ` +
+        `blocked=${project.stateLabels.blocked}, failed=${project.stateLabels.failed}.`,
+      "The dispatcher claims queue-labelled issues, runs one worker session per attempt in its own",
+      "worktree under hard turn/wallclock/spend caps, and escalates to you when a worker blocks or",
+      "fails twice, its gates stay red, its branch conflicts, or a tripwire fires.",
+      "Your job when that happens: re-brief the issue (comment what the next worker must do",
+      `differently, then put ${project.queueLabel} back on it), file follow-up issues, or promote to`,
+      "tier 2 and let the human decide.",
+      project.authority.merge === "orchestrator"
+        ? "You never edit product code or push a branch — a worker session does that. Merging is yours: one PR at " +
+          "a time, freshness-checked against the base branch, per the Releases section of your POLICY.md."
+        : "You never edit product code, push a branch, or merge a PR — a worker session edits and pushes, and a " +
+          "human merges.",
+      `Release tool gate: ${
+        grantedShapes.length === 0
+          ? "every release and deploy shape is mechanically blocked for you"
+          : `you may invoke ${grantedShapes.join(", ")} — and only by the procedure in your POLICY.md`
+      }.` + (deniedShapes.length === 0 ? "" : ` Blocked: ${deniedShapes.join(", ")}.`),
+      "Handle each escalation below before the next one.",
+    ].join("\n"),
+  };
+}
+
 export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   const cfg = loadConfig();
-  const project = findProject(cfg, o.project);
-  const caps = resolveCaps(project, cfg.defaults);
+  const projects = o.project === undefined ? cfg.projects : [findProject(cfg, o.project)];
   const store = openStore(dbPath());
-  // The tracker's single `gh` funnel is bound to the store so the operator sees
-  // observed truth (#198): every spawn is counted per UTC day, and every
-  // rate-limit refusal is recorded for `status`'s 5m window. Board's ad-hoc
-  // trackers and the polled `fetchRateLimit` probe are deliberately not bound —
-  // this row is the daemon's own traffic.
-  const tracker = makeTracker(project, undefined, {
-    onCall: () => store.bumpGhCalls?.(utcDay(), "daemon"),
-    onRefusal: (at) => store.recordGhRefusal?.(at),
-    // A conditional 304 revalidation is a spawn but not a billed read (#203);
-    // counted separately so `status`'s call row keeps telling the truth once
-    // most spawns are free revalidations.
-    onNotModified: () => store.bumpGhCalls?.(utcDay(), "daemon-304"),
-  });
-
-  // #126's transport, stated at startup rather than guessed at first use. The
-  // banner names what this host can actually enforce — whether the kernel will
-  // vouch for a caller's uid, and whether runs get distinct principals at all —
-  // because "peer credentials asserted" is a claim, and a claim nobody printed
-  // is one nobody can check against the host it is running on.
   const verbPeerReader = peerCredentialReader();
-  const verbActions = githubVerbActions(project);
-  let orchestratorVerbs: VerbListener | undefined;
-  log(`verb transport: ${transportBanner(ensureVerbSocketDir(stateDir()), verbPeerReader)}`);
-
-  // Recorded here, before a single tick runs, so that the deploy an operator
-  // *means* to do never trips the tripwire: installing a new build and
-  // restarting the unit re-records this from the new files. What it catches is
-  // the other thing — the package changing while the daemon that dispatches
-  // work is holding it open, whether that is a worker that wandered out of its
-  // worktree or a human editing the live install "just to test something".
+  const verbDir = ensureVerbSocketDir(stateDir());
   const integrity: IntegrityGate = { baseline: packageManifest(), paged: false };
+  const usage = sharedUsageSource();
+  const turnLimits = createTurnLimitRegistry((runId, maxTurns) => {
+    store.updateRun(runId, { maxTurns });
+  });
+  const workerControls = createWorkerControlRegistry();
+  const workers = createWorkerPool();
+  const alive = livingDaemon();
+  const runtimes: ProjectRuntime[] = [];
+
+  log(`verb transport: ${transportBanner(verbDir, verbPeerReader)}`);
   log(`package integrity baseline: ${integrity.baseline.size} files under ${import.meta.dir}`);
 
-  // Before the first tick, settle what the last process left behind — unless
-  // another daemon is alive (a foreground `daemon --once` beside a running
-  // daemon must not orphan that daemon's real, live workers).
-  const alive = livingDaemon();
-  if (alive === undefined || alive.pid === process.pid) {
-    // The orphan path salvages, and #121 requires that salvage to reach
-    // GitHub. Since the run's commits now live in its own repository, the hop
-    // is the daemon's: resolve the routed repo by name off the run row.
-    const orphanPublisher = (r: RunRecord): RunPublisher => {
-      const repo = project.routing.repos[r.repo];
-      return async (branch) =>
-        repo === undefined
-          ? { ok: false, stderr: `run ${String(r.id)} names repo "${r.repo}", which this project no longer routes` }
-          : pushRunBranch(project, { repo, runRepoPath: r.worktree, branch });
+  for (const project of projects) {
+    const projectLog = (message: string): void => {
+      log(projects.length === 1 ? message : `[${project.name}] ${message}`);
     };
-    for (const r of await reconcileOrphanedRuns(store, project.name, orphanPublisher)) {
-      log(
-        `#${r.issue} orphaned by a previous daemon (attempt ${r.attempt}, was ${r.state}, worktree ${r.worktree}) — ` +
-          `slot freed; the ${project.stateLabels.inProgress} label stays until the orchestrator triages what the worker left`,
-      );
+    const caps = resolveCaps(project, cfg.defaults);
+    const tracker = makeTracker(project, undefined, {
+      onCall: () => store.bumpGhCalls?.(utcDay(), "daemon"),
+      onRefusal: (at) => store.recordGhRefusal?.(at),
+      onNotModified: () => store.bumpGhCalls?.(utcDay(), "daemon-304"),
+    });
+    const verbActions = githubVerbActions(project);
+
+    if (alive === undefined || alive.pid === process.pid) {
+      const orphanPublisher = (run: RunRecord): RunPublisher => {
+        const repo = project.routing.repos[run.repo];
+        return async (branch) =>
+          repo === undefined
+            ? {
+                ok: false,
+                stderr:
+                  `run ${String(run.id)} names repo "${run.repo}", ` +
+                  `which project "${project.name}" no longer routes`,
+              }
+            : pushRunBranch(project, { repo, runRepoPath: run.worktree, branch });
+      };
+      for (const run of await reconcileOrphanedRuns(store, project.name, orphanPublisher)) {
+        projectLog(
+          `#${run.issue} orphaned by a previous daemon (attempt ${run.attempt}, was ${run.state}, ` +
+            `worktree ${run.worktree}) — slot freed; the ${project.stateLabels.inProgress} label stays ` +
+            "until the orchestrator triages what the worker left",
+        );
+      }
+    } else if (runtimes.length === 0) {
+      log(`skipping orphan reconciliation: daemon pid ${alive.pid} is alive and owns the active runs`);
     }
-  } else {
-    log(`skipping orphan reconciliation: daemon pid ${alive.pid} is alive and owns the active runs`);
-  }
 
-  // Standing orders. The orchestrator holds none of this file's context, so
-  // everything it needs to act — which tracker, which labels, what the fleet
-  // does — has to be said once, in words.
-  const releaseGrants = resolveReleaseGrants(project);
-  const grantedShapes = RELEASE_SHAPES.filter((shape) => releaseGrants[shape] === "orchestrator");
-  const deniedShapes = RELEASE_SHAPES.filter((shape) => releaseGrants[shape] !== "orchestrator");
-  const brief = [
-    `You are the omp-conductor orchestrator for project "${project.name}".`,
-    `Tracker: ${project.tracker.repo}. Pass --repo ${project.tracker.repo} to every gh command:`,
-    "this working directory is the conductor's state directory, not a checkout.",
-    `Labels: queue=${project.queueLabel}, running=${project.stateLabels.inProgress}, ` +
-      `blocked=${project.stateLabels.blocked}, failed=${project.stateLabels.failed}.`,
-    "The dispatcher claims queue-labelled issues, runs one worker session per attempt in its own",
-    "worktree under hard turn/wallclock/spend caps, and escalates to you when a worker blocks or",
-    "fails twice, its gates stay red, its branch conflicts, or a tripwire fires.",
-    "Your job when that happens: re-brief the issue (comment what the next worker must do",
-    `differently, then put ${project.queueLabel} back on it), file follow-up issues, or promote to`,
-    "tier 2 and let the human decide.",
-    // Worded from `authority.merge` rather than fixed, so the standing orders
-    // and the Releases section of the rendered brief cannot disagree about who
-    // is holding the merge button. The daemon still merges nothing itself.
-    project.authority.merge === "orchestrator"
-      ? "You never edit product code or push a branch — a worker session does that. Merging is yours: one PR at " +
-        "a time, freshness-checked against the base branch, per the Releases section of your POLICY.md."
-      : "You never edit product code, push a branch, or merge a PR — a worker session edits and pushes, and a " +
-        "human merges.",
-    // Named shape by shape rather than as one policy word, so a stale grant is
-    // legible in the transcript instead of only in the config file — the #122
-    // incident began with a grant that no longer matched anyone's intent.
-    `Release tool gate: ${
-      grantedShapes.length === 0
-        ? "every release and deploy shape is mechanically blocked for you"
-        : `you may invoke ${grantedShapes.join(", ")} — and only by the procedure in your POLICY.md`
-    }.` + (deniedShapes.length === 0 ? "" : ` Blocked: ${deniedShapes.join(", ")}.`),
-    "Handle each escalation below before the next one.",
-  ].join("\n");
-
-  // One orchestrator per daemon run, not per tick: it is a persistent session
-  // whose whole value is remembering what it has already escalated, and a fresh
-  // one every five minutes would remember nothing. Its cwd is the state
-  // directory, deliberately not a checkout — the orchestrator re-briefs workers
-  // and talks to the tracker, it does not edit product code.
-  let orchestrator: OrchestratorHandle | undefined;
-  if (project.escalation.orchestrator === "external") {
-    // An operator already runs the brain — typically a visible TUI session that
-    // drains `blocked`/`failed` off the tracker as one of its standing duties.
-    // Starting a second one here would re-triage the same issues from a
-    // transcript nobody is watching, and the two would undo each other.
-    log("orchestrator: external — tier-1 escalations post as issue comments for the external session's drain duty");
-  } else {
-    try {
-      // The orchestrator is a child process of this daemon running as its own
-      // user. Nothing mechanically stops it reading a run checkout — what holds
-      // it is its brief and the verb ledger (#143).
-      const orchTreeRoot = stateDir();
-      const orchCwd = join(orchTreeRoot, "orchestrator");
-      mkdirSync(orchCwd, { recursive: true });
-      // A third socket, distinct from every run's, in the same daemon-owned
-      // 0711 parent. It makes the orchestrator's authority a property of the
-      // channel rather than of a payload: no argument list can move a worker's
-      // call onto this one (#126).
-      //
-      // It does NOT authenticate the session. Sessions share this daemon's uid,
-      // so one could list this directory and connect here, and the ledger would
-      // record the orchestrator's role because that is the channel's. See
-      // conductor#163 for the pid binding that would close it.
-      orchestratorVerbs = await listenVerbChannel(
-        verbDeps({ project, store, tracker, verbActions }),
-        {
-          kind: "orchestrator",
-          path: verbSocketPath(ensureVerbSocketDir(orchTreeRoot), "orchestrator"),
-          project: project.name,
-          role: "orchestrator",
-        },
-        { ...(verbPeerReader === undefined ? {} : { peerReader: verbPeerReader }) },
-      );
-      orchestrator = await startOrchestrator({
-        cwd: orchCwd,
-        brief,
-        releaseGrants,
-        socketPath: join(orchCwd, "ipc.sock"),
-        verbSocketPath: orchestratorVerbs.path,
-        // The orchestrator's channel is the one that matters most: it is the
-        // session authorised to merge, so an unbound channel here is a worker's
-        // route to that authority (#163).
-        onSpawn: (pid) => {
-          orchestratorVerbs?.bindPid(pid);
-        },
-        onChildLog: (line) => {
-          log(`orchestrator ${line}`);
-        },
-        onReleaseBlocked: (shape, context) =>
-          recordReleaseBlock(project.name, "orchestrator", shape, context),
-      });
-      const transcript = orchestrator.sessionFile();
-      log(`orchestrator session ready${transcript === undefined ? "" : ` · ${transcript}`}`);
-    } catch (err) {
-      // Loudly, but not fatally: tier-1 escalations degrade to issue comments,
-      // which a human still reads. A dispatcher that refuses to run because its
-      // re-briefing channel is down helps nobody.
-      log(
-        `WARNING: orchestrator session failed to start; tier-1 escalations will fall back to issue comments: ${errText(err)}`,
+    const { brief, releaseGrants } = orchestratorStandingOrders(project);
+    let orchestrator: OrchestratorHandle | undefined;
+    let orchestratorVerbs: VerbListener | undefined;
+    if (project.escalation.orchestrator === "external") {
+      projectLog(
+        "orchestrator: external — tier-1 escalations post as issue comments for the external session's drain duty",
       );
+    } else {
+      try {
+        const orchCwd = join(
+          stateDir(),
+          projects.length === 1 ? "orchestrator" : `orchestrator-${project.name}`,
+        );
+        mkdirSync(orchCwd, { recursive: true });
+        orchestratorVerbs = await listenVerbChannel(
+          verbDeps({ project, store, tracker, verbActions }),
+          {
+            kind: "orchestrator",
+            path: verbSocketPath(verbDir, `orchestrator-${project.name}`),
+            project: project.name,
+            role: "orchestrator",
+          },
+          { ...(verbPeerReader === undefined ? {} : { peerReader: verbPeerReader }) },
+        );
+        orchestrator = await startOrchestrator({
+          cwd: orchCwd,
+          brief,
+          releaseGrants,
+          socketPath: join(orchCwd, "ipc.sock"),
+          verbSocketPath: orchestratorVerbs.path,
+          onSpawn: (pid) => {
+            orchestratorVerbs?.bindPid(pid);
+          },
+          onChildLog: (line) => {
+            projectLog(`orchestrator ${line}`);
+          },
+          onReleaseBlocked: (shape, context) =>
+            recordReleaseBlock(project.name, "orchestrator", shape, context),
+        });
+        const transcript = orchestrator.sessionFile();
+        projectLog(`orchestrator session ready${transcript === undefined ? "" : ` · ${transcript}`}`);
+      } catch (err) {
+        projectLog(
+          "WARNING: orchestrator session failed to start; tier-1 escalations will fall back to issue " +
+            `comments: ${errText(err)}`,
+        );
+        await orchestratorVerbs?.close();
+        orchestratorVerbs = undefined;
+      }
     }
-  }
-
-  const escalator = createEscalator(project, tracker, store, orchestrator);
 
-  // Report delivery is the daemon's, not the model's (#123). Built beside the
-  // escalator because a report nobody can deliver pages through it, and driven
-  // on its own timer rather than inside `tick()`: a paused fleet claims nothing
-  // but still owes its operator the report it was handed, and five minutes is a
-  // long time to sit on a page.
-  const outbox = createReportOutbox({
-    project,
-    store,
-    escalate: (e) => escalator.escalate(e),
-    log,
-  });
-
-  // Every row still `sending` when a daemon boots belonged to a process that is
-  // gone, so its outcome will never be learned — retry it and say so in the
-  // message. Guarded exactly like the orphan reconciliation above and for the
-  // same reason: a row belonging to a *live* daemon is genuinely in flight, and
-  // stealing it would page the operator twice for one report.
-  if (alive === undefined || alive.pid === process.pid) {
-    for (const r of outbox.recover(Date.now())) {
-      log(
-        `report ${r.id} was left mid-send by a previous daemon (attempt ${r.attempts}) — ` +
-          `retrying; its message will say it may be a repeat`,
-      );
+    let runtimeDeps: Deps | undefined;
+    const currentProject = (): ProjectConfig => runtimeDeps?.project ?? project;
+    const deliveryPolicyValid = (): boolean => runtimeDeps?.deliveryPolicyValid === true;
+    const escalator = createEscalator(
+      currentProject,
+      tracker,
+      store,
+      orchestrator,
+      Date.now,
+      deliveryPolicyValid,
+    );
+    const outbox = createReportOutbox({
+      project: currentProject,
+      store,
+      escalate: (event) => escalator.escalate(event),
+      log: projectLog,
+      deliveryAllowed: deliveryPolicyValid,
+    });
+    if (alive === undefined || alive.pid === process.pid) {
+      for (const report of outbox.recover(Date.now())) {
+        projectLog(
+          `report ${report.id} was left mid-send by a previous daemon (attempt ${report.attempts}) — ` +
+            "retrying; its message will say it may be a repeat",
+        );
+      }
     }
-  }
 
-  const turnLimits = createTurnLimitRegistry((runId, maxTurns) => {
-    store.updateRun(runId, { maxTurns });
-  });
-  const workerControls = createWorkerControlRegistry();
-  const d: Deps = {
-    project,
-    caps,
-    tracker,
-    store,
-    // Process-wide, so a `status` served off this daemon's own HTTP surface
-    // reuses the tick's reading instead of shelling out again.
-    usage: sharedUsageSource(),
-    escalate: (e) => escalator.escalate(e),
-    turnLimits,
-    workerControls,
-    integrity,
-    // Fresh per daemon run, like the integrity gate: a restart is entitled to
-    // page again about a stall that is still on disk.
-    stall: { paged: false },
-    cleanup: { next: 0 },
-    ...(verbPeerReader === undefined ? {} : { verbPeerReader }),
-    verbActions,
-  };
+    const d: Deps = {
+      project,
+      caps,
+      tracker,
+      store,
+      deliveryPolicyValid: false,
+      usage,
+      escalate: (event) => escalator.escalate(event),
+      turnLimits,
+      workerControls,
+      integrity,
+      stall: { paged: false },
+      cleanup: { next: 0 },
+      ...(verbPeerReader === undefined ? {} : { verbPeerReader }),
+      verbActions,
+    };
+    runtimeDeps = d;
+    runtimes.push({
+      d,
+      outbox,
+      ...(orchestrator === undefined ? {} : { orchestrator }),
+      ...(orchestratorVerbs === undefined ? {} : { orchestratorVerbs }),
+      codeGraph: pendingCodeGraph(project),
+    });
+  }
 
   if (o.once) {
     try {
-      await tick(d);
-      // A single tick still owes the outbox a pass: a drill that leaves a
-      // report undelivered teaches an operator the wrong thing about the
-      // mechanism it is drilling.
-      await outbox.deliverDue();
+      for (const runtime of runtimes) await tick(runtime.d, workers);
+      await workers.drain();
+      for (const runtime of runtimes) await runtime.outbox.deliverDue();
     } finally {
-      await orchestrator?.dispose();
-      await orchestratorVerbs?.close();
+      for (const runtime of runtimes.toReversed()) {
+        await runtime.orchestrator?.dispose();
+        await runtime.orchestratorVerbs?.close();
+      }
       store.close();
     }
     return;
   }
 
-  // Graphs are optional, so their bounded probes run beside dispatch and feed
-  // a cache. /healthz remains an in-memory answer and never blocks liveness on
-  // the indexer or systemd.
-  let codeGraph = pendingCodeGraph(project);
-  let graphProbe: Promise<void> | undefined;
-  const refreshCodeGraph = (): void => {
-    if (graphProbe !== undefined) return;
-    graphProbe = probeCodeGraph(project)
+  const refreshCodeGraph = (runtime: ProjectRuntime): void => {
+    if (runtime.graphProbe !== undefined) return;
+    runtime.graphProbe = probeCodeGraph(runtime.d.project)
       .then((health) => {
-        codeGraph = health;
+        runtime.codeGraph = health;
       })
       .catch(() => {
-        log("code-graph health probe failed unexpectedly; retaining the previous bounded result");
+        log(
+          `[${runtime.d.project.name}] code-graph health probe failed unexpectedly; ` +
+            "retaining the previous bounded result",
+        );
       })
       .finally(() => {
-        graphProbe = undefined;
+        runtime.graphProbe = undefined;
       });
   };
-  refreshCodeGraph();
-  const graphTimer = setInterval(refreshCodeGraph, GRAPH_HEALTH_INTERVAL_MS);
-
-  // Overlap-guarded like the graph probe: a pass that is still waiting on
-  // Telegram must not have a second pass started on top of it, or one report
-  // would be claimed, reclaimed and sent twice by this process alone.
-  let reportPass: Promise<void> | undefined;
-  const drainReports = (): void => {
-    if (reportPass !== undefined) return;
-    reportPass = outbox
+  for (const runtime of runtimes) refreshCodeGraph(runtime);
+  const graphTimer = setInterval(() => {
+    for (const runtime of runtimes) refreshCodeGraph(runtime);
+  }, GRAPH_HEALTH_INTERVAL_MS);
+
+  const drainReports = (runtime: ProjectRuntime): void => {
+    if (runtime.reportPass !== undefined) return;
+    runtime.reportPass = runtime.outbox
       .deliverDue()
       .then(() => {})
       .catch((err: unknown) => {
-        log(`report delivery pass failed: ${errText(err)}`);
+        log(`[${runtime.d.project.name}] report delivery pass failed: ${errText(err)}`);
       })
       .finally(() => {
-        reportPass = undefined;
+        runtime.reportPass = undefined;
       });
   };
-  drainReports();
-  const reportTimer = setInterval(drainReports, REPORT_DELIVERY_INTERVAL_MS);
+  for (const runtime of runtimes) drainReports(runtime);
+  const reportTimer = setInterval(() => {
+    for (const runtime of runtimes) drainReports(runtime);
+  }, REPORT_DELIVERY_INTERVAL_MS);
 
-  const workers = createWorkerPool();
   let stopping = false;
   let wake: (() => void) | undefined;
   const stop = (): void => {
@@ -4499,54 +4760,58 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   process.on("SIGINT", stop);
   process.on("SIGTERM", stop);
 
-  // ── NO TRACKER OR REPOSITORY MUTATION BELONGS ON THIS PORT ───────────────
-  //
-  // This is unauthenticated loopback TCP. Every local user can reach it, it
-  // carries no credential of any kind, and it cannot tell one caller from
-  // another: `127.0.0.1` is not an identity. The turn-limit and worker
-  // pause/resume controls trust a body-supplied `project`, which is exactly the
-  // shape "identity from the payload" takes when nobody is watching. They stay
-  // tolerable only because every effect is bounded: pauses are reversible,
-  // live extensions touch one controller, and a persisted next-attempt
-  // override can only raise the project base up to its configured ceiling and
-  // is consumed by one claim.
-  //
-  // A merge, a push, a release or a label is none of those things. Do not add
-  // one here, and do not add "just a small one" behind a shared secret either:
-  // a secret readable by the process that would be attacking you is not
-  // authentication. Mutations go over the per-run unix sockets in
-  // `verbs/socket.ts`, where the kernel says who the caller is and the daemon
-  // derives project, run and role from the channel rather than the body (#126).
+  // This unauthenticated loopback surface exposes liveness and bounded live-run
+  // controls only. Repository and tracker mutations stay on credentialled verb
+  // sockets, where project and role come from the channel rather than a payload.
   const server = Bun.serve({
     hostname: "127.0.0.1",
     port: o.port ?? DEFAULT_PORT,
     fetch: (req) =>
       daemonHttpResponse(req, {
-        project: project.name,
-        store,
-        caps: () => d.caps,
+        projects: runtimes.map((runtime) => ({
+          project: runtime.d.project.name,
+          store,
+          caps: () => runtime.d.caps,
+        })),
         turnLimits,
         workerControls,
         health: () =>
-          daemonHealthSnapshot(store, project.name, undefined, undefined, codeGraph, workerControls),
+          daemonHealth(
+            runtimes.map((runtime) =>
+              daemonHealthSnapshot(
+                store,
+                runtime.d.project.name,
+                isPaused(runtime.d.project.name),
+                runtime.codeGraph,
+                workerControls,
+              ),
+            ),
+          ),
       }),
   });
-  log(`serving /healthz on :${server.port}, project ${project.name}`);
+  log(
+    projects.length === 1
+      ? `serving /healthz on :${server.port}, project ${projects[0]!.name}`
+      : `serving /healthz on :${server.port}, projects ${projects.map(({ name }) => name).join(", ")}`,
+  );
 
   try {
     while (!stopping) {
-      try {
-        await tick(d, workers);
-      } catch (err) {
-        // A tick that blows up outside an issue (the tracker is down, say) must
-        // not end the daemon; the next one will retry.
-        log(`tick failed: ${errText(err)}`);
+      for (const runtime of runtimes) {
+        try {
+          await tick(runtime.d, workers);
+        } catch (err) {
+          log(
+            `${projects.length === 1 ? "" : `[${runtime.d.project.name}] `}` +
+              `tick failed: ${errText(err)}`,
+          );
+        }
       }
       if (stopping) break;
       await new Promise<void>((resolve) => {
-        const t = setTimeout(resolve, TICK_INTERVAL_MS);
+        const timer = setTimeout(resolve, TICK_INTERVAL_MS);
         wake = () => {
-          clearTimeout(t);
+          clearTimeout(timer);
           resolve();
         };
       });
@@ -4557,26 +4822,15 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     process.off("SIGTERM", stop);
     clearInterval(graphTimer);
     clearInterval(reportTimer);
-    // Before the store closes, like the orchestrator below: a pass mid-send has
-    // a `markReportDelivered` still to write, and losing that write is exactly
-    // how a delivered report comes back as an ambiguous one on the next boot.
-    await reportPass;
+    for (const runtime of runtimes) await runtime.reportPass;
     await workers.drain();
     await server.stop(true);
-    // Before the store closes: a queued injection that rejects on the way out
-    // falls back to an issue comment, and that path writes the dedup marker.
-    await orchestrator?.dispose();
-    // After the session it belongs to is gone. A bound socket outliving its
-    // orchestrator is a channel accepting merges for a session that no longer
-    // exists.
-    await orchestratorVerbs?.close();
+    for (const runtime of runtimes.toReversed()) {
+      await runtime.orchestrator?.dispose();
+      await runtime.orchestratorVerbs?.close();
+    }
     store.close();
     log("stopped");
-    // A handled SIGTERM still leaves some runtimes with a non-zero default
-    // (historically 128+signal). Under systemd `Restart=on-failure` that looks
-    // like a crash and the unit comes straight back — the exact failure mode
-    // `omp-conductor stop` hit on the reference fleet. Force success so a
-    // graceful drain is not a restart.
     process.exitCode = 0;
   }
 }