omp-conductor 0.15.11 → 0.15.12

package/src/setup-install.ts

@@ -18,7 +18,17 @@
 import { existsSync, readFileSync } from "node:fs";
 import { platform } from "node:os";
 import { join } from "node:path";
-import { stateDir } from "./config.ts";
+import { loadConfig, stateDir } from "./config.ts";
+import { pauseInstance, setPaused, statusSnapshot } from "./daemon.ts";
+import { fleetLayers, DEFAULT_HERDR_UNIT } from "./fleet.ts";
+import { livingDaemon } from "./lifecycle.ts";
+import { dbPath, openStore } from "./store.ts";
+import {
+  resolveScope,
+  pauseAndDrain,
+  type DrainDeps,
+  type UpgradeScope,
+} from "./upgrade.ts";
 import {
   graphRepos,
   formatGraphSetup,
@@ -40,12 +50,12 @@ import {
   writeHostRuntime,
   STAGED_SERVICE_NAME,
   SYSTEMD_UNIT_DIR,
+  RECOVER_SCRIPT_INSTALL_PATH,
   type EscalationDeps,
   type ServiceRuntime,
 } from "./setup-host.ts";
-import { DEFAULT_HERDR_UNIT } from "./fleet.ts";
 import type { WizardUi } from "./wizard-ui.ts";
-import type { Caps, ProjectConfig } from "./types.ts";
+import type { Caps, ProjectConfig, Store } from "./types.ts";
 
 /**
  * Every outcome a caller has to tell apart. `staged` is the non-Linux answer:
@@ -64,12 +74,40 @@ export interface InstallDeps {
   /** `"linux"` gates the systemd half. Injectable so the refusal is testable. */
   platform?: () => string;
   unitDir?: string;
+  /**
+   * Where the recovery playbook installs. Injectable so the idempotency gate
+   * is testable hermetically; the real install uses
+   * {@link RECOVER_SCRIPT_INSTALL_PATH}.
+   */
+  recoverScriptInstallPath?: string;
   /**
    * The runtime the plan derives from. Injectable so tests pin herdr
    * present/absent deterministically; the default ({@link defaultServiceRuntime})
    * detects herdr from the host's own PATH.
    */
   runtime?: ServiceRuntime;
+  /**
+   * Whether the host configures more than one project, which scopes the
+   * recovery unit's RECOVER_PROJECT (host-global: never one project's name on
+   * a multi-project host, #510/#530). Injectable so tests pin the shape
+   * hermetically; the default ({@link hostMultiProject}) reads the config.
+   */
+  multiProject?: boolean;
+  /**
+   * The pause/drain fence around the restart (#512): which projects to drain,
+   * how long to wait, and the store used to attribute a run the restart kills.
+   * Injectable so tests pin the drain hermetically; the defaults read the real
+   * daemon, sentinel and store.
+   */
+  drain?: {
+    deps?: DrainDeps;
+    /** How long the drain waits for live workers before giving up and staying
+     *  paused; absent waits indefinitely, the `upgrade` posture. */
+    timeoutMs?: number;
+    /** The store consulted for runs still live at restart time, so they are
+     *  attributed before the session host restarts under them. */
+    drainStore?: Pick<Store, "liveRuns" | "updateRun">;
+  };
 }
 
 /**
@@ -100,11 +138,21 @@ function sameFile(a: string, b: string): boolean {
 }
 
 /**
- * Install the supervised daemon unit: re-render, stage, then run the four steps
- * `planHostRuntime` used to only print.
+ * Install the supervised daemon unit: re-render, stage, then run the plan's
+ * steps in order. The steps are the plan's own {@link HostRuntimePlan.steps} —
+ * the same single list its {@link installCommands} display renders from — so
+ * what is printed and what is executed can never diverge.
  */
 export async function runHostInstall(
-  project: ProjectConfig,
+  /**
+   * The project whose per-project tail to write, or `undefined` for a
+   * host-global install: the units are host-global (same staged paths, same
+   * systemd destinations, one shared daemon), so no project still installs
+   * and starts them. The per-project tail (tick config, brief link) is the
+   * only part that needs a name — with none, it is skipped with a printed
+   * note (#530).
+   */
+  project: ProjectConfig | undefined,
   caps: Caps,
   telegramStateDir: string,
   ui: WizardUi,
@@ -116,40 +164,105 @@ export async function runHostInstall(
     return { kind: "refused", reason: verdict.message };
   }
 
-  const plan = planHostRuntime(project, caps, telegramStateDir, deps.runtime, hostInstallWorkers(caps));
-  const { wrote, warnings } = writeHostRuntime(plan);
-  for (const warning of warnings) ui.notify(warning, "warning");
   const unitDir = deps.unitDir ?? SYSTEMD_UNIT_DIR;
+  // The plan is computed eagerly — `planHostRuntime` renders every byte and
+  // compares it against disk, so the prompt can print exactly what would be
+  // written and the currentInstall gate below can decide a re-run restarts
+  // nothing. But rendering is read-only: no file is written here. Staging
+  // happens only after consent (#510), so the prompt's "Nothing has been run
+  // yet" is true of the staged tree when it is printed, and a declined run
+  // leaves every staged file byte-identical.
+  const plan = planHostRuntime(
+    project,
+    caps,
+    telegramStateDir,
+    deps.runtime,
+    hostInstallWorkers(caps),
+    unitDir,
+    deps.recoverScriptInstallPath ?? RECOVER_SCRIPT_INSTALL_PATH,
+    deps.multiProject ?? hostMultiProject(),
+  );
+  // No pane-shell key is planned (unusable login shell, unparseable config):
+  // the operator hears why before the consent prompt, not after an install
+  // that quietly had nothing to say about the shell.
+  if (plan.herdrConfigProblem !== undefined) ui.notify(plan.herdrConfigProblem, "warning");
+  // A host-global install (no --project): the per-project tail was
+  // deliberately not written, and the operator must be told which files and
+  // how to get them — never a silent skip.
+  if (plan.noProject !== undefined) {
+    ui.notify(
+      `No project named: ${plan.noProject.skipped.join(", ")} were not written. ${plan.noProject.how}.`,
+      "info",
+    );
+  }
   const installed = join(unitDir, STAGED_SERVICE_NAME);
   const installedHerdr = join(unitDir, DEFAULT_HERDR_UNIT);
 
   const blocked = linuxOnly(deps);
   if (blocked !== undefined) {
+    // A non-Linux host cannot run systemd, so staging IS the deliverable: the
+    // rendered files are written for the operator to copy to the box that will
+    // run them, and only the systemctl half is refused. There is no consent
+    // prompt on this path — nothing privileged to approve — so the write lands
+    // here, not in the (never reached) post-consent hook.
+    const { wrote, warnings } = writeHostRuntime(plan);
+    for (const warning of warnings) ui.notify(warning, "warning");
     ui.notify(`${blocked} ${plan.service.path}`, "warning");
     return { kind: "staged", wrote, reason: `${blocked} ${plan.service.path}` };
   }
 
+  // A no-op re-run: every unit the steps would install is already current on
+  // disk, so installing them again would only touch mtimes and restart the
+  // units for nothing. Report success without running a single privileged step.
+  // Nothing is staged here either: a re-run with nothing to install has no
+  // reason to touch the staged tree.
+  if (plan.currentInstall) {
+    ui.notify("The supervised daemon and recovery unit are already current — nothing to install, nothing restarted.", "info");
+    return { kind: "installed", wrote: [] };
+  }
+
   // argv, not shell: `installCommands` renders `sudo …` strings for humans to
   // read, and re-parsing those into an argv is how a path with a space becomes
-  // two arguments. The steps are built from the same values instead.
-  const steps: PrivilegedStep[] = [
-    { title: `install ${STAGED_SERVICE_NAME}`, argv: ["install", "-m", "0644", plan.service.path, installed] },
-    { title: "reload systemd", argv: ["systemctl", "daemon-reload"] },
-    { title: `enable ${STAGED_SERVICE_NAME}`, argv: ["systemctl", "enable", STAGED_SERVICE_NAME] },
-    { title: `restart ${STAGED_SERVICE_NAME}`, argv: ["systemctl", "restart", STAGED_SERVICE_NAME] },
-    // The herdr session server, provisioned alongside the daemon (#456). Only
-    // when herdr is installed and the plan therefore staged a unit.
-    ...(plan.herdrUnit === undefined
-      ? []
-      : [
-          { title: `install ${DEFAULT_HERDR_UNIT}`, argv: ["install", "-m", "0644", plan.herdrUnit.path, installedHerdr] },
-          { title: "reload systemd", argv: ["systemctl", "daemon-reload"] },
-          { title: `enable ${DEFAULT_HERDR_UNIT}`, argv: ["systemctl", "enable", DEFAULT_HERDR_UNIT] },
-          { title: `restart ${DEFAULT_HERDR_UNIT}`, argv: ["systemctl", "restart", DEFAULT_HERDR_UNIT] },
-        ]),
-  ];
-
-  const outcome = await runPrivileged(steps, ui, {
+  // two arguments. The plan carries the exact argv once, in
+  // {@link HostRuntimePlan.steps}; we execute that same list, so the printed
+  // plan and the run are the same steps (#509).
+  //
+  // The fence `upgrade` already has (#512): pause new issue claims, drain live
+  // workers to idle, restart the units, then restore the dispatch state this
+  // began in. The consent prompt below names how many workers will be drained
+  // so the operator can choose the moment; it authorises the whole batch,
+  // drain included, in one confirm (the `beforeRun` hook).
+  const drainDeps = hostInstallDrainDeps(ui, deps);
+  // Host-wide by default (#389): the daemon this restarts serves every
+  // configured project, so the drain covers all of them — narrowing to the
+  // named project would restart the shared session host under the other
+  // projects' live workers without ever counting them.
+  const fenceScope = resolveScope(drainDeps, "setup host");
+  const liveWorkers = fenceScope.selectors.reduce((n, s) => n + drainDeps.snapshot(s).liveWorkers, 0);
+  let fence: { scope: UpgradeScope; initialPaused: boolean } | undefined;
+  // What the post-consent staging actually wrote, surfaced by the outcomes that
+  // report it. Empty on a decline — the hook never ran.
+  let wrote: readonly string[] = [];
+  const beforeRun = async (): Promise<void> => {
+    // Consent has been given; the plan's files may now land. Staging here —
+    // post-confirm, pre-step, under the same confirm that authorised the batch
+    // — is what makes the prompt's "Nothing has been run yet" true of the
+    // staged tree when it is printed: a declined prompt never reaches this
+    // hook, so nothing is staged and a re-run still plans an install (#510).
+    const staged = writeHostRuntime(plan);
+    wrote = staged.wrote;
+    for (const warning of staged.warnings) ui.notify(warning, "warning");
+    fence = await pauseAndDrain(drainDeps, "setup host", {
+      ...(deps.drain?.timeoutMs === undefined ? {} : { timeoutMs: deps.drain.timeoutMs }),
+    });
+    // Any run still live when the session host is about to restart is killed by
+    // it; record the actor on its row so the classifier reads an administrative
+    // kill rather than charging a failure for an operator's restart (#512). The
+    // fence drained to idle, so in the healthy path this records nothing.
+    attributeRestartKills(fence.scope, project?.name ?? "", deps.drain?.drainStore);
+  };
+
+  const outcome = await runPrivileged(plan.steps, ui, {
     ...(deps.privileged === undefined ? {} : { deps: deps.privileged }),
     title: "Install and start the supervised session?",
     preamble: [
@@ -159,18 +272,98 @@ export async function runHostInstall(
         : [
             `Also installs the fleet session unit as ${installedHerdr} with the account's login shell so panes`,
             "run it instead of dash, then enables and restarts it.",
+            ...(plan.herdrConfigTarget === undefined
+              ? []
+              : [
+                  `And merges [terminal] default_shell into ${plan.herdrConfigTarget} as you, before that restart,`,
+                  "so the session server reads the pinned shell the moment it comes up.",
+                ]),
           ]),
       "The unit runs as the account that staged it; nothing here changes that.",
+      "",
+      liveWorkers === 0
+        ? "No workers are live — nothing to drain before the restart."
+        : `Pauses new claims and drains ${liveWorkers} live worker(s) to idle first — this can take minutes per worker — then restarts the units and resumes dispatch.`,
     ],
+    beforeRun,
   });
   if (outcome.kind === "declined") return { kind: "declined", wrote };
   if (outcome.kind === "failed") {
+    // Restore the preceding dispatch state: a restart that failed is still a
+    // finished operator action whose units may or may not be up, so the fleet
+    // must not sit paused for it. A throw from the drain itself (a timeout or
+    // a superseded fence) never reaches here — it propagates and leaves
+    // dispatch paused, fail-closed, exactly as upgrade does.
+    if (fence !== undefined && !fence.initialPaused) drainDeps.setPaused(false, fence.scope.pauseKey);
     return { kind: "failed", reason: `${outcome.step.title} exited ${outcome.exitCode}` };
   }
+  if (fence !== undefined && !fence.initialPaused) drainDeps.setPaused(false, fence.scope.pauseKey);
   ui.notify(`Installed and started ${STAGED_SERVICE_NAME}.`, "info");
   return { kind: "installed", wrote };
 }
 
+/**
+ * The pause/drain fence's default accessors, overridable per test through
+ * {@link InstallDeps.drain.deps}. Mirrors `upgrade.ts`'s {@link DrainDeps}
+ * wiring, except the pause names `setup host` as the actor and the drain
+ * reports progress through the same UI surface.
+ */
+function hostInstallDrainDeps(ui: WizardUi, deps: InstallDeps): DrainDeps {
+  if (deps.drain?.deps !== undefined) return deps.drain.deps;
+  return {
+    snapshot: statusSnapshot,
+    layers: fleetLayers,
+    projectNames: () => loadConfig().projects.map((p) => p.name),
+    daemonIdentity: () => {
+      const daemon = livingDaemon();
+      return daemon === undefined
+        ? { running: false }
+        : { running: true, project: daemon.project, generation: `${daemon.pid}@${daemon.startedAt}` };
+    },
+    pauseState: (project) => pauseInstance(project),
+    setPaused: (v, project) => setPaused(v, { source: "setup host", reason: "setup host, draining" }, project),
+    sleep: Bun.sleep,
+    log: (message) => ui.notify(message, "info"),
+  };
+}
+
+/**
+ * Attribute the runs the restart is about to kill: any run still live when the
+ * session host restarts underneath it is that restart's casualty, not a failed
+ * attempt, so its row records the actor. The classifier reads this as an
+ * administrative kill that costs no budget and requeues (#512). The fence
+ * drains to idle first, so in the healthy path this records nothing — it is
+ * the safety net for a claim that raced the drain or a worker the drain could
+ * not bring to idle.
+ */
+function attributeRestartKills(
+  scope: UpgradeScope,
+  project: string,
+  store: Pick<Store, "liveRuns" | "updateRun"> | undefined,
+): void {
+  const attribute = (owner: Pick<Store, "liveRuns" | "updateRun">): void => {
+    for (const selector of scope.selectors) {
+      for (const run of owner.liveRuns(selector ?? project)) {
+        owner.updateRun(run.id, { lastError: "admin restart: setup host (draining)" });
+      }
+    }
+  };
+  if (store !== undefined) {
+    attribute(store);
+    return;
+  }
+  const path = dbPath();
+  // No store yet — a host that has never dispatched — means nothing to attribute
+  // and nothing a fresh open would do but create an empty database.
+  if (!existsSync(path)) return;
+  const owner = openStore(path);
+  try {
+    attribute(owner);
+  } finally {
+    owner.close();
+  }
+}
+
 /** Fleet-wide worker sum when config is loadable; otherwise this project's caps. */
 function hostInstallWorkers(caps: Caps): number {
   try {
@@ -180,6 +373,22 @@ function hostInstallWorkers(caps: Caps): number {
   }
 }
 
+/**
+ * Whether this host configures more than one project. The recovery unit is
+ * host-global and must not encode one project's name when several are
+ * configured, so the plan scopes RECOVER_PROJECT by this (#510/#530). A
+ * loadable config is the truth; when it cannot be read (a not-yet-configured
+ * box), there is no evidence of several projects and the named case stays
+ * unambiguous — the same fallback shape as {@link hostInstallWorkers}.
+ */
+function hostMultiProject(): boolean {
+  try {
+    return loadConfig().projects.length > 1;
+  } catch {
+    return false;
+  }
+}
+
 export interface GraphInstallOptions extends InstallDeps {
   /**
    * Skip the seeding step. The timer is still installed and enabled, and the

package/src/setup-wizard.ts

@@ -445,6 +445,27 @@ async function askPolicyPreconditions(
   return { merge, release };
 }
 
+/**
+ * The release questions a delegated release authority unlocks, in the order the
+ * interview asks them after the grant: one tool gate per release shape, then
+ * the release-policy conditions.
+ *
+ * The authority preview counts and names them from this list — and from
+ * `RELEASE_SHAPES` directly — so the prompt stays honest with the questions
+ * that follow: a shape added to `RELEASE_SHAPES` or a condition added here moves
+ * the number the preview quotes at the same time the later questions appear. A
+ * hard-coded count is the drift this exists to prevent.
+ */
+export function releaseUnlockPlan(): { gates: readonly string[]; policy: readonly string[] } {
+  return {
+    // `RELEASE_SHAPES`, not a copy that can rot: these are exactly the per-shape
+    // gates `askReleaseGrants` asks (seven, not five (#500)).
+    gates: [...RELEASE_SHAPES],
+    // The release half of `askPolicyPreconditions`, in the order it asks them.
+    policy: ["requirements", "required checks", "artefacts", "environments"],
+  };
+}
+
 /**
  * Who merges, who releases and who promotes. Three confirms rather than one
  * four-way list: these are independent grants — delegating merges is routine,
@@ -467,12 +488,16 @@ async function askAuthority(
       "re-checked against the base branch first. Default: humans merge" +
       `${prior.merge === "orchestrator" ? " — currently delegated, answer no to take it back" : ""}.`,
   );
+  const unlock = releaseUnlockPlan();
+  const unlockCount = unlock.gates.length + unlock.policy.length;
   const release = await askYesNo(
     ui,
     "Release authority",
     "Delegate release cutting to the orchestrator session? It would tag, pin and publish by the " +
       "procedure you write into its brief — and its brief forbids cutting one before you have. " +
-      "Default: humans release" +
+      `Delegating unlocks ${unlockCount} later decisions: the ${unlock.gates.length} release-tool ` +
+      `gates (${unlock.gates.join(", ")}) and the release-policy conditions (${unlock.policy.join(", ")}). ` +
+      "Declining means humans release and none are asked. Default: humans release" +
       `${prior.release === "orchestrator" ? " — currently delegated, answer no to take it back" : ""}.`,
   );
   const promotion = await askYesNo(
@@ -1479,6 +1504,32 @@ const AREA_ASKERS: { readonly [K in AmendAreaId]: AreaAsker } = {
     await askBrief(ui, { ...a, judgment: await askJudgment(ui, a.releaseGrants, a.judgment ?? {}) }, probes),
 };
 
+/**
+ * The full interview's areas, in the exact order `collectAnswers` walks them.
+ *
+ * This array is the single source of both the questions and their progress
+ * marker: the "m" in every `Area n of m` line is this list's `.length`, never a
+ * separate constant, so an area a branch predicate prunes takes its row and its
+ * slot in the denominator with it — the count cannot drift from the iterable.
+ *
+ * The order is load-bearing and each step documents its own rationale: the
+ * graph sits straight after the repos because the answer is derived per repo;
+ * the worker model sits after the policy block because the boundary is an
+ * authority-shaped decision, not a runtime knob; the brief is last because its
+ * write question needs the real path the rest of the answers derive.
+ */
+const INTERVIEW_AREAS: readonly { label: string; asker: AreaAsker }[] = [
+  { label: "tracker & repos", asker: askTrackerAndRepos },
+  { label: "code graph", asker: askGraph },
+  { label: "caps", asker: askCaps },
+  { label: "authority & release grants", asker: askAuthorityArea },
+  { label: "merge & release preconditions", asker: askPolicy },
+  { label: "worker model", asker: askWorkerModel },
+  { label: "escalation & triage", asker: askEscalation },
+  { label: "reporting", asker: askReporting },
+  { label: "orchestrator brief", asker: askBrief },
+];
+
 /** The two ways to answer the first question a configured project gets. Labels,
  *  because the harness's select resolves to the label it displayed. */
 const AMEND_ONE = "Change one area";
@@ -1594,19 +1645,14 @@ async function collectAnswers(
       mirrorRoot: scoped.mirrorRoot,
     };
   }
-  a = await askTrackerAndRepos(ui, a, probes);
-  // Straight after the repos, because it is a fact about them: one clone per
-  // routed repo, under one root.
-  a = await askGraph(ui, a, probes);
-  a = await askCaps(ui, a, probes);
-  a = await askAuthorityArea(ui, a, probes, discovered);
-  a = await askPolicy(ui, a, probes, discovered);
-  a = await askWorkerModel(ui, a, probes);
-  a = await askEscalation(ui, a, probes);
-  a = await askReporting(ui, a, probes);
-  // Asked last, and asked with the real path in the question — which needs the
-  // rest of the answers to derive.
-  return await askBrief(ui, a, probes);
+  // Walk the ordered area list once; the marker's denominator is the list's
+  // length, so an area a branch prunes drops its row and its slot together.
+  const areas = INTERVIEW_AREAS;
+  for (const [index, area] of areas.entries()) {
+    ui.notify(`Area ${index + 1} of ${areas.length}: ${area.label}`, "info");
+    a = await area.asker(ui, a, probes, discovered);
+  }
+  return a;
 }
 
 /** The dry run, rendered. Same routing code the loop uses, so this is what the
@@ -2002,11 +2048,13 @@ export async function setup(
         : runtime.tick.action === "keep"
           ? `Keeps the external heartbeat config at ${runtime.tick.path}.`
           : `${runtime.tick.action === "create" ? "Creates" : "Updates"} the external heartbeat config at ${runtime.tick.path}.`,
-      runtime.briefLink.action === "skip"
-        ? `Leaves the existing file at ${runtime.briefLink.path} alone (an operator's file, not overwritten).`
-        : runtime.briefLink.action === "keep"
-          ? `Keeps the brief link at ${runtime.briefLink.path}.`
-          : `${runtime.briefLink.action === "create" ? "Creates" : "Replaces"} the brief link at ${runtime.briefLink.path} -> ${runtime.briefLink.target}.`,
+      runtime.briefLink === undefined
+        ? ""
+        : runtime.briefLink.action === "skip"
+          ? `Leaves the existing file at ${runtime.briefLink.path} alone (an operator's file, not overwritten).`
+          : runtime.briefLink.action === "keep"
+            ? `Keeps the brief link at ${runtime.briefLink.path}.`
+            : `${runtime.briefLink.action === "create" ? "Creates" : "Replaces"} the brief link at ${runtime.briefLink.path} -> ${runtime.briefLink.target}.`,
       answers.writeOrchestratorBrief
         ? `Writes ${orchestratorBriefPath(answers)}, which is then yours to edit.`
         : "",

package/src/setup.ts

@@ -155,6 +155,14 @@ export interface SetupAnswers {
    * survive an amend of some other area (#369).
    */
   groomBelow?: number;
+  /**
+   * Ordered fallback worker models and the provider-failure threshold that
+   * starts them. The wizard never asks for either — they are hand-edited —
+   * so they exist here only to survive an amend of some other area (#369,
+   * #286).
+   */
+  modelFallbacks?: string[];
+  modelFallbackThreshold?: number;
   telegramChatId?: string;
   /** Forum topic for tier-2 Telegram pages; absent keeps flat-chat 0.13 behaviour. */
   telegramTopicId?: number;
@@ -193,6 +201,13 @@ export interface SetupAnswers {
    * merge provenance gate.
    */
   recoveryMerges?: ProjectConfig["recoveryMerges"];
+  /**
+   * Hand-edited critical-base/safety markers (commit SHAs or refs) carried
+   * through setup unchanged, like {@link recoveryMerges}. The wizard never
+   * invents one; forgetting them during an unrelated amend would drop the
+   * stale-base interlock from a project that relies on it (#428).
+   */
+  criticalBase?: ProjectConfig["criticalBase"];
   /**
    * Whether to render `ORCHESTRATOR.md` into the project's workspace root. Not
    * part of the config — the brief is the operator's file, and the conductor
@@ -836,6 +851,10 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
       : {}),
     // A documented hand-edited key, so an unrelated amend must not delete it.
     ...(a.groomBelow === undefined ? {} : { groomBelow: a.groomBelow }),
+    // The failover chain is hand-edited too: dropping it on an unrelated amend
+    // would pin every run of the project onto a dead provider again (#286).
+    ...(a.modelFallbacks === undefined ? {} : { modelFallbacks: [...a.modelFallbacks] }),
+    ...(a.modelFallbackThreshold === undefined ? {} : { modelFallbackThreshold: a.modelFallbackThreshold }),
     escalation,
     authority: { ...a.authority },
     // Written out in full, never as the legacy string: the file then says which
@@ -847,6 +866,9 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
     ...(a.recoveryMerges === undefined
       ? {}
       : { recoveryMerges: a.recoveryMerges.map((entry) => ({ ...entry })) }),
+    // Hand-edited safety markers carried unchanged on an unrelated amend
+    // (#428): dropping them would silently disarm the stale-base interlock.
+    ...(a.criticalBase === undefined ? {} : { criticalBase: [...a.criticalBase] }),
     // Written out even when it is the default, so an operator amending the
     // volume has a line in the file to point at. Opting into availability makes
     // the schedule explicit and daily; omitting it preserves the preset's
@@ -1037,11 +1059,14 @@ export function answersFromProject(p: ProjectConfig): SetupAnswers {
   // what keeps the rewritten config identical to the one that was read.
   if (p.workerModel !== undefined) answers.workerModel = p.workerModel;
   if (p.groomBelow !== undefined) answers.groomBelow = p.groomBelow;
+  if (p.modelFallbacks !== undefined) answers.modelFallbacks = [...p.modelFallbacks];
+  if (p.modelFallbackThreshold !== undefined) answers.modelFallbackThreshold = p.modelFallbackThreshold;
   if (p.escalation.telegramChatId !== undefined) answers.telegramChatId = p.escalation.telegramChatId;
   if (p.escalation.telegramTopicId !== undefined) answers.telegramTopicId = p.escalation.telegramTopicId;
   if (p.recoveryMerges !== undefined) {
     answers.recoveryMerges = p.recoveryMerges.map((entry) => ({ ...entry }));
   }
+  if (p.criticalBase !== undefined) answers.criticalBase = [...p.criticalBase];
   if (p.reporting?.digest.at !== undefined) answers.dailyDigestAt = p.reporting.digest.at;
   if (p.reporting?.digest.timezone !== undefined) {
     answers.reportingTimezone = p.reporting.digest.timezone;

package/src/store.ts

@@ -82,6 +82,7 @@ const ACTIVE_PLACEHOLDERS = ACTIVE_STATES.map(() => "?").join(", ");
 const FRICTION_HOLD_REASONS: ReadonlySet<FrictionAdmissionReason> = new Set([
   "failed-attempts",
   "continuations",
+  "stale-base",
   "parent-lookup-error",
   "issue-state-lookup-error",
   "open-pr-lookup-error",
@@ -133,6 +134,7 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   failureClass: true,
   recoveryAction: true,
   recoveredAt: true,
+  model: true,
 };
 
 /** Everything SQLite will accept from us. */
@@ -169,6 +171,7 @@ interface RunRow {
   failureClass: string | null;
   recoveryAction: string | null;
   recoveredAt: number | null;
+  model: string | null;
 }
 
 /** The `base_health` table exactly as SQLite hands it back. */
@@ -354,7 +357,8 @@ CREATE TABLE IF NOT EXISTS runs (
   report      TEXT,
   failureClass TEXT,
   recoveryAction TEXT,
-  recoveredAt INTEGER
+  recoveredAt INTEGER,
+  model       TEXT
 );
 CREATE INDEX IF NOT EXISTS runs_project_issue ON runs (project, issue);
 CREATE INDEX IF NOT EXISTS runs_project_state ON runs (project, state);
@@ -707,6 +711,7 @@ function toRecord(row: RunRow): RunRecord {
   if (row.failureClass !== null) record.failureClass = row.failureClass as FailureClass;
   if (row.recoveryAction !== null) record.recoveryAction = row.recoveryAction as RecoveryAction;
   if (row.recoveredAt !== null) record.recoveredAt = row.recoveredAt;
+  if (row.model !== null) record.model = row.model;
   return record;
 }
 
@@ -1006,6 +1011,13 @@ export function openStore(dbPath: string): Store {
       db.exec(`ALTER TABLE runs ADD COLUMN ${name} ${type}`);
     }
   }
+  // The model a run dispatched on was first written by the modelFallbacks
+  // failover chain (#286). Rows predating the column are NULL, which is the
+  // honest reading: only a chain-configured project records a model, and the
+  // harness's own downgrade stays on the worker result, never in this column.
+  if (!columns.some((column) => column.name === "model")) {
+    db.exec("ALTER TABLE runs ADD COLUMN model TEXT");
+  }
   // Existing held-notice rows predate exact digest ownership (#274). A NULL
   // report id is truthful for already-digested history and means "still owed"
   // only while digestedAt is also NULL.

package/src/tracker/github.ts

@@ -24,6 +24,7 @@
 import { credentialedEnv } from "../gitops.ts";
 import { parsePrDiff } from "../diff-flags.ts";
 import type {
+  IssueComment,
   IssueState,
   IssueSnapshot,
   MergedPrInfo,
@@ -760,6 +761,36 @@ export function readyIssuesFromRest(raw: string): ReadyIssue[] {
   return issues;
 }
 
+/**
+ * Parse the REST `/repos/{owner}/{repo}/issues/{n}/comments` body — already
+ * projected by jq to `[{author, body}]` — onto {@link IssueComment}.
+ *
+ * The REST endpoint answers chronological order (oldest first), so the array
+ * order is the order the brief renders. Nulls and unrecognizable payloads are
+ * tolerated the same way {@link readyIssuesFromRest} tolerates them: an empty
+ * answer means "no comments", and *only* a thrown read means "could not tell" —
+ * the caller distinguishes the two, because eliding them is the #517 failure.
+ */
+export function commentsFrom(raw: string): IssueComment[] {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw) as unknown;
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(parsed)) return [];
+  const comments: IssueComment[] = [];
+  for (const entry of parsed) {
+    if (entry === null || typeof entry !== "object") continue;
+    const row = entry as { readonly [key: string]: unknown };
+    const author = row["author"];
+    const body = row["body"];
+    if (typeof author !== "string" || typeof body !== "string") continue;
+    comments.push({ author, body });
+  }
+  return comments;
+}
+
 /** One cached page per request URL: the ETag GitHub answered, the raw JSON
  *  body it covered, and whether that page advertised a rel="next" successor.
  *  Module-level default so every makeTracker() in the process (board probe,
@@ -1103,6 +1134,22 @@ export function makeTracker(
       return pages.flatMap(readyIssuesFromRest);
     },
 
+    async listComments(issue: number): Promise<IssueComment[]> {
+      // REST, like `issueSnapshot` — deliberately not `gh issue view
+      // --comments`, whose renderer goes through the interactive pager and
+      // prints nothing on a non-TTY while still exiting 0 (the #517 failure).
+      // `gh api` output is never paged. One page: the brief truncates a huge
+      // thread with an explicit marker rather than paginating.
+      return commentsFrom(
+        await runGh([
+          "api",
+          `repos/${repo}/issues/${issue}/comments`,
+          "--jq",
+          "[.[] | {author: .user.login, body: .body}]",
+        ]),
+      );
+    },
+
     async addLabel(issue: number, label: string): Promise<void> {
       try {
         // REST POST is natively idempotent: re-adding a label the issue already