omp-conductor 0.15.11 → 0.15.12

package/src/config.ts

@@ -355,8 +355,11 @@ export function findProject(c: ConductorConfig, name?: string): ProjectConfig {
   if (name === undefined) {
     const only = c.projects[0];
     if (c.projects.length !== 1 || only === undefined) {
+      // #514: every operator hitting this has to guess the spelling of the
+      // flag that names a project — say it outright. Doctor's project finding
+      // quotes this text, so keep the "name one explicitly" phrase.
       throw new Error(
-        `Ambiguous project: config has ${c.projects.length} projects (${names.join(", ") || "none"}) — name one explicitly.`,
+        `Ambiguous project: config has ${c.projects.length} projects (${names.join(", ") || "none"}) — name one explicitly with --project NAME.`,
       );
     }
     return only;
@@ -1080,6 +1083,34 @@ function finalizeProject(
   const workerModel =
     typeof rawWorkerModel === "string" && rawWorkerModel.trim() !== "" ? rawWorkerModel : undefined;
 
+  // The failover chain is a hint like workerModel, not a ceiling: an unusable
+  // entry or a malformed threshold is dropped rather than failing the load,
+  // and absent/empty `modelFallbacks` keeps today's dispatch byte for byte.
+  const rawFallbacks = p["modelFallbacks"];
+  const modelFallbacks = Array.isArray(rawFallbacks)
+    ? rawFallbacks
+        .filter((entry): entry is string => typeof entry === "string")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry !== "")
+    : [];
+  const rawThreshold = p["modelFallbackThreshold"];
+  const modelFallbackThreshold =
+    typeof rawThreshold === "number" && Number.isInteger(rawThreshold) && rawThreshold >= 1
+      ? rawThreshold
+      : undefined;
+
+  // Marked critical-base/safety markers (commit SHAs or refs). A continuation
+  // branch must contain every one before the dispatcher may reattach it;
+  // unusable entries are dropped like `modelFallbacks` and an absent or empty
+  // list keeps today's behaviour byte for byte.
+  const rawCriticalBase = p["criticalBase"];
+  const criticalBase = Array.isArray(rawCriticalBase)
+    ? rawCriticalBase
+        .filter((entry): entry is string => typeof entry === "string")
+        .map((entry) => entry.trim())
+        .filter((entry) => entry !== "")
+    : [];
+
   if (problems.length > before) return undefined;
 
   return {
@@ -1095,12 +1126,15 @@ function finalizeProject(
     routing: { labelPrefix, repos },
     caps,
     ...(workerModel === undefined ? {} : { workerModel }),
+    ...(modelFallbacks.length === 0 ? {} : { modelFallbacks }),
+    ...(modelFallbackThreshold === undefined ? {} : { modelFallbackThreshold }),
     escalation,
     authority,
     releasePolicy,
     policy,
     ...(recoveryMerges === undefined ? {} : { recoveryMerges }),
     reporting,
+    ...(criticalBase.length === 0 ? {} : { criticalBase }),
     workspaceRoot: expandHome(pickString(p["workspaceRoot"], defaultWorkspaceRoot())),
     mirrorRoot: expandHome(pickString(p["mirrorRoot"], defaultMirrorRoot())),
   };

package/src/daemon.ts

@@ -47,12 +47,21 @@ import {
 } from "./reports.ts";
 import {
   recordReleaseBlock,
+  type GateShape,
   type ReleaseBlockContext,
 } from "./release-policy.ts";
 import { branchName, effectiveLabels, route } from "./routing.ts";
 import type { Routed, UnroutableReason } from "./routing.ts";
 import { evaluateDecisionConditions, probeNpmVersion, probeRateLimitReset } from "./decisions.ts";
 import { classifyRun, providerCreditRefusal, providerTransientFault, type ClassifyFacts } from "./failure-class.ts";
+import {
+  DEFAULT_MODEL_FALLBACK_THRESHOLD,
+  fallbackClause,
+  formatModelsTried,
+  modelsTried,
+  providerFailureFacts,
+  resolveDispatchModel,
+} from "./model-fallback.ts";
 import { projectLabels } from "./label-projection.ts";
 import { dbPath, LIVE_STATES, openStore, utcDay } from "./store.ts";
 import { makeTracker, type RateLimitStatus } from "./tracker/github.ts";
@@ -64,6 +73,7 @@ import type {
   DispatchSummary,
   DigestBacklog,
   Escalation,
+  IssueComment,
   IssueSnapshot,
   MergedPrInfo,
   OpenCloser,
@@ -122,7 +132,14 @@ import {
 } from "./verbs/socket.ts";
 import { homedir } from "node:os";
 
-import { pushRunBranch, readBaseChain, type RunRepoRef } from "./gitops.ts";
+import {
+  probeCriticalBase,
+  pushRunBranch,
+  readBaseChain,
+  type CriticalBaseProbe,
+  type CriticalBaseVerdict,
+  type RunRepoRef,
+} from "./gitops.ts";
 import {
   planUsageLine,
   readPlanUsage,
@@ -233,6 +250,14 @@ interface Deps {
    * without touching the host's packages, journal or outbox.
    */
   upgradeVerifier?: (d: Deps) => Promise<void>;
+  /**
+   * Answers whether a preserved continuation branch contains every configured
+   * critical-base marker, for the stale-base admission hold (#428). Wired by
+   * `runDaemon` to the mirror-backed {@link probeCriticalBase}; a test injects
+   * a fake. Absent, the stale-base gate fails closed whenever a project names
+   * a marker (a safety interlock must not silently weaken).
+   */
+  probeCriticalBase?: CriticalBaseProbe;
 }
 
 /**
@@ -682,6 +707,64 @@ function acceptanceCriteria(issue: ReadyIssue): string {
     : "_The issue body is empty. Read the issue and its comments, and escalate if it is genuinely underspecified._";
 }
 
+/**
+ * How much of a comment thread one brief may hold. Grooming notes are short,
+ * and a thread that outgrows this is truncated with an explicit marker rather
+ * than a silently dropped tail — the disappearance this fix exists to prevent.
+ */
+const DISCUSSION_CHARS_BUDGET = 8_000;
+
+/**
+ * The issue's comments as a brief section: attributed, numbered, oldest
+ * first, so a later correction visibly supersedes an earlier note. Rendered
+ * beside the body at dispatch, because the orchestrator's grooming is posted
+ * as comments and a worker must never depend on a runtime read to see it.
+ *
+ * `"unread"` is not "empty": when the tracker refused at dispatch the section
+ * says so, instead of silently reading as "no discussion" — which is exactly
+ * the #517 failure. An empty comment list renders nothing, so a commentless
+ * issue's brief stays byte-identical to what this package has always shipped.
+ */
+function renderDiscussion(comments: IssueComment[] | "unread"): string {
+  if (comments === "unread") {
+    return [
+      "## Discussion",
+      "",
+      "_The issue's comments could not be read at dispatch time. The live read below is_",
+      "_the only path to them; if it prints nothing, that is a failed read, not an_",
+      "_absence of discussion._",
+      "",
+    ].join("\n");
+  }
+  if (comments.length === 0) return "";
+  const total = comments.length;
+  const lines = [
+    "## Discussion",
+    "",
+    `${total} comment${total === 1 ? "" : "s"} on the issue at dispatch, oldest first — a later`,
+    "comment supersedes an earlier one.",
+    "",
+  ];
+  let chars = lines.join("\n").length;
+  let shown = 0;
+  for (const comment of comments) {
+    const block = `**@${comment.author} — comment ${shown + 1}:**\n\n${comment.body}\n\n`;
+    if (shown > 0 && chars + block.length > DISCUSSION_CHARS_BUDGET) break;
+    lines.push(`**@${comment.author} — comment ${shown + 1}:**`, "", comment.body, "");
+    chars += block.length;
+    shown += 1;
+  }
+  if (shown < total) {
+    const omitted = total - shown;
+    lines.push(
+      `… ${omitted} comment${omitted === 1 ? "" : "s"} omitted — the discussion exceeded ${DISCUSSION_CHARS_BUDGET} characters.`,
+      "Read the issue for the tail.",
+      "",
+    );
+  }
+  return lines.join("\n");
+}
+
 /**
  * Record a state-label swap for projection (#201). The add enqueues before the
  * remove — the reverse order would leave a window where the issue carries no
@@ -934,7 +1017,15 @@ export async function buildBrief(
   r: Routed,
   branch: string,
   worktree: string,
-  opts: { continuation?: boolean; defaultBranch?: string; salvagedSha?: string } = {},
+  opts: {
+    continuation?: boolean;
+    defaultBranch?: string;
+    salvagedSha?: string;
+    /** The issue's comments, rendered into the Discussion section. `"unread"`
+     *  when the tracker refused at dispatch — rare, but it must never read as
+     *  "no comments" (the #517 failure mode). Absent means an empty list. */
+    comments?: IssueComment[] | "unread";
+  } = {},
 ): Promise<string> {
   // Read per dispatch rather than caching: editing the brief then takes effect
   // on the next issue instead of needing a daemon restart.
@@ -979,6 +1070,7 @@ export async function buildBrief(
     BRANCH: branch,
     WORKTREE: worktree,
     ACCEPTANCE_CRITERIA: acceptanceCriteria(r.issue),
+    ISSUE_COMMENTS: renderDiscussion(opts.comments ?? []),
     GATES: gatesBlock(r.repo),
     // Empty for a repo with no `graphProject`, and empty means *nothing*: the
     // placeholder sits flush against the next list item in the template, so an
@@ -1045,6 +1137,135 @@ function newestContinuableRun(runs: readonly RunRecord[]): RunRecord | undefined
   );
 }
 
+/** The fenced-block info string that marks an exhaustion postmortem comment, so
+ *  a grooming scout re-slicing the issue can find and parse the whole block by
+ *  grepping for it. */
+export const POSTMORTEM_MARKER = "conductor-postmortem";
+
+/** How one issue's attempt chain failed, as "3× ci-deterministic, 1× …" — the
+ *  digest shape for naming what the exhaustion was. Groups every row by its
+ *  failure class, whether or not it charged the continuation budget, because
+ *  the postmortem tells the whole story and not just the budget half (#290). */
+export function attemptClassBreakdown(runs: readonly RunRecord[]): string {
+  const perClass = new Map<string, number>();
+  for (const r of runs) {
+    const cls = r.failureClass ?? "unclassified";
+    perClass.set(cls, (perClass.get(cls) ?? 0) + 1);
+  }
+  if (perClass.size === 0) return "unclassified";
+  return Array.from(perClass, ([cls, n]) => `${n}× ${cls}`).join(", ");
+}
+
+/** Wall-clock duration of one run as a compact human string ("45m", "1h30m"). */
+export function humanDuration(ms: number): string {
+  const seconds = Math.max(0, Math.round(ms / 1_000));
+  if (seconds < 60) return `${seconds}s`;
+  const minutes = Math.round(seconds / 60);
+  if (minutes < 60) return `${minutes}m`;
+  const hours = Math.floor(minutes / 60);
+  const rest = minutes % 60;
+  return rest === 0 ? `${hours}h` : `${hours}h${rest}m`;
+}
+
+/** Flatten and bound a run's last error to one greppable table line. */
+export function oneLineBrief(text: string | undefined): string | undefined {
+  if (text === undefined || text.trim() === "") return undefined;
+  const flat = text.replace(/\s+/g, " ").trim();
+  return flat.length > 90 ? `${flat.slice(0, 89)}…` : flat;
+}
+
+/**
+ * The exhaustion postmortem block: one greppable fenced block covering every
+ * attempt in the chain — continuation rows included — with per-attempt turns,
+ * wall clock, failure class and a one-line last error, the explicit salvage
+ * state, the spend total and the transcript paths for local inspection.
+ *
+ * Pure so the tests hold the shape, not the transport: the writer below owns
+ * the once-only guarantee, this owns what "once" looks like.
+ */
+export function formatExhaustionPostmortem(args: {
+  issue: number;
+  runs: readonly RunRecord[];
+  reason: string;
+}): string {
+  const { issue, runs, reason } = args;
+  const artifact = newestContinuableRun(runs);
+  const totalSpend = runs.reduce((sum, r) => sum + r.spendUsd, 0);
+  const spend = `$${totalSpend.toFixed(2)}`;
+  const attemptLines = runs.map((r) => {
+    const wall = r.endedAt === undefined ? "—" : humanDuration(r.endedAt - r.startedAt);
+    const cls = r.failureClass ?? "unclassified";
+    const error = oneLineBrief(r.lastError) ?? "—";
+    return (
+      `  attempt ${r.attempt}  ${r.state.padEnd(12)}  turns ${r.turns}/${r.maxTurns}  ` +
+      `${cls.padEnd(24)}  ${wall.padStart(4)}  last error: ${error}`
+    );
+  });
+  const salvage =
+    artifact === undefined
+      ? "Salvaged WIP: absent — no attempt preserved a branch, head SHA or pull request."
+      : `Salvaged WIP: present — branch ${artifact.branch} at ${artifact.headSha ?? artifact.salvageSha}` +
+        `${artifact.prUrl === undefined ? "" : ` (PR ${artifact.prUrl})`}.`;
+  return [
+    `\`\`\`${POSTMORTEM_MARKER}`,
+    `#${issue} exhausted: ${attemptClassBreakdown(runs)}`,
+    reason,
+    "",
+    `Attempts (${runs.length} total, ${spend} spend):`,
+    ...attemptLines,
+    salvage,
+    `Spend total: ${spend} across ${runs.length} attempts.`,
+    "Transcripts:",
+    ...runs.map((r) => (r.sessionFile === undefined ? "  (none)" : `  ${r.sessionFile}`)),
+    "```",
+  ].join("\n");
+}
+
+/** Dedupe key prefix for the exhaustion postmortem comment, per issue. */
+function postmortemDedupeKey(project: string, issue: number): string {
+  return `${project}:postmortem:${issue}`;
+}
+
+/**
+ * The exhaustion postmortem: written exactly once per issue, at the point the
+ * continuation budget is spent and the issue is settled toward a human.
+ *
+ * The comment and the material event are both gated by the store's notification
+ * ledger — the same idempotence guard the escalator uses — so re-settling an
+ * already-postmortemed issue posts nothing and records nothing. A body-string
+ * match on the issue would be the wrong guard: an issue re-scoped and re-run
+ * would still carry the old block, and the guarantee asked of this is "decided
+ * once", not "deduped against what is already written".
+ *
+ * The digest must name the exhaustion even if the comment write fails, so the
+ * material event is recorded before the write and unconditionally (the ledger
+ * is append-only, and the gate above already ran once). The comment failure is
+ * logged rather than taking the sweep down with it.
+ */
+async function postExhaustionPostmortem(d: Deps, run: RunRecord, reason: string): Promise<void> {
+  const { project, tracker, store } = d;
+  const key = postmortemDedupeKey(project.name, run.issue);
+  if (store.wasNotified(key)) return;
+  const runs = store.runsForIssue(project.name, run.issue);
+  const body = formatExhaustionPostmortem({ issue: run.issue, runs, reason });
+  const occurredAt = Date.now();
+  store.recordMaterialEvent({
+    project: project.name,
+    category: "exhaustion",
+    summary: `#${run.issue} exhausted: ${attemptClassBreakdown(runs)}`,
+    evidence: body,
+    occurredAt,
+    recordedAt: occurredAt,
+  });
+  try {
+    await tracker.comment(run.issue, body);
+    store.markNotified(key);
+    log(`#${run.issue} posted exhaustion postmortem (${runs.length} attempts)`);
+  } catch (err) {
+    log(`#${run.issue} postmortem comment could not be posted (${errText(err)})`);
+  }
+}
+
 export type ExtendTurnLimitResult =
   | { kind: "extended"; runId: string; maxTurns: number }
   | { kind: "not-increase"; runId: string; maxTurns: number }
@@ -1329,7 +1550,7 @@ export function workerReleaseBlockRecorder(
   issue: number,
   runId: string,
   root = stateDir(),
-): (shape: ReleaseShape, context: ReleaseBlockContext) => void {
+): (shape: GateShape, context: ReleaseBlockContext) => void {
   return (shape, context) =>
     recordReleaseBlock(
       project,
@@ -1544,6 +1765,11 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
     // attempt whose work this one inherits.
     const prior = store.latestRun(project.name, issue);
     const priorSalvage = prior?.salvageSha;
+    // The failover decision is made from the store the same way admission is:
+    // counts of this issue's own rows, so the switch is sticky per chain and a
+    // fresh issue always starts on the primary (#286). Read before the claim
+    // writes this attempt's row, which would otherwise break the streak.
+    const chainFacts = providerFailureFacts(store.runsForIssue(project.name, issue));
     run = store.createRun({
       project: project.name,
       issue,
@@ -1657,17 +1883,50 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
 
     store.updateRun(runId, { worktree: worktreePath, state: "running" });
 
+    // Where this attempt goes, and (when the failover fired) the clause that
+    // makes it attributable: with no `modelFallbacks` configured this is the
+    // primary model — or none, for an unconfigured project — and today's
+    // dispatch is byte for byte what it has always been.
+    const chainConfigured = (project.modelFallbacks?.length ?? 0) > 0;
+    const choice = resolveDispatchModel({
+      workerModel: project.workerModel,
+      modelFallbacks: project.modelFallbacks,
+      threshold: project.modelFallbackThreshold ?? DEFAULT_MODEL_FALLBACK_THRESHOLD,
+      streak: chainFacts.streak,
+    });
+    // Recorded before the launch, so even a run killed mid-flight leaves the
+    // model it chose on its row. Only a chain-configured project writes the
+    // column: absent `modelFallbacks` must preserve today's rows byte for byte.
+    if (chainConfigured && choice.model !== undefined) {
+      store.updateRun(runId, { model: choice.model });
+    }
+    const clause = fallbackClause(choice, chainFacts, project.workerModel);
+
     log(
-      `#${issue} attempt ${attempt} → ${r.repo.name} ${branch}` +
+      `#${issue} attempt ${attempt}${clause === undefined ? "" : ` ${clause}`} → ${r.repo.name} ${branch}` +
         (provisioned.reattached ? " (continuation: reattached existing branch)" : ""),
     );
 
+    // The discussion is rendered at dispatch so a worker never depends on a
+    // runtime `gh` read to see the orchestrator's grooming (#517). The read is
+    // best-effort, but its failure is not silent: an unreadable tracker names
+    // itself in the brief's Discussion section instead of reading as "no
+    // comments" — the exact confusion this fix removes.
+    let comments: IssueComment[] | "unread";
+    try {
+      comments = await tracker.listComments(issue);
+    } catch (err) {
+      log(`#${issue} issue comments unreadable at dispatch; the brief will say so: ${errText(err)}`);
+      comments = "unread";
+    }
+
     const brief = await buildBrief(project, r, branch, worktreePath, {
       continuation: provisioned.reattached,
       defaultBranch: r.repo.defaultBranch,
       ...(provisioned.reattached && priorSalvage !== undefined
         ? { salvagedSha: priorSalvage }
         : {}),
+      comments,
     });
     if (await settleStopBeforeSession()) return;
     if (await settleDrainBeforeSession()) return;
@@ -1702,7 +1961,7 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
         onChildLog: (line) => {
           log(`#${issue} ${line}`);
         },
-        ...(project.workerModel === undefined ? {} : { model: project.workerModel }),
+        ...(choice.model === undefined ? {} : { model: choice.model }),
         releaseGrants: resolveReleaseGrants(project),
         onReleaseBlocked: workerReleaseBlockRecorder(project.name, issue, runId),
         onTurn: (n) => store.updateRun(runId, { turns: n }),
@@ -2886,7 +3145,7 @@ function planUsageEscalation(project: string, plan: PlanUsageStatus): Escalation
  * that grows a field has no business breaking these tests.
  */
 export async function admitCandidates(
-  d: Pick<Deps, "project" | "caps" | "tracker" | "store" | "escalate" | "usage">,
+  d: Pick<Deps, "project" | "caps" | "tracker" | "store" | "escalate" | "usage" | "probeCriticalBase">,
   routed: Routed[],
   slots: number,
 ): Promise<AdmissionPass> {
@@ -3066,6 +3325,81 @@ export async function admitCandidates(
       continue;
     }
 
+    // #428 half (a): a preserved continuation that predates a configured
+    // critical-base/safety marker must not be reattached. A base safety fix
+    // protects only branches forked after it landed — a continuation forked
+    // before it still carries the dangerous test/runtime code, and re-running
+    // it on the shared host is what SIGTERMed the production daemon. Fail
+    // closed: only a probe that proves every marker is in the reattach
+    // source's ancestry admits, and a project that names a marker but has no
+    // probe wired (never happens outside tests) holds. Both the hold and the
+    // escalation are durable across restart and orphan recovery because this
+    // gate runs every admission pass; the branch is re-admitted automatically
+    // once the operator updates it to contain the marker, without losing work.
+    const markers = project.criticalBase ?? [];
+    if (markers.length > 0) {
+      const branch = branchName(r.issue);
+      let verdict: CriticalBaseVerdict;
+      if (d.probeCriticalBase === undefined) {
+        verdict = { state: "unknown", error: "no critical-base probe is wired in this deployment" };
+      } else {
+        try {
+          verdict = await d.probeCriticalBase(r.repo, markers, branch);
+        } catch (err) {
+          verdict = { state: "unknown", error: errText(err) };
+        }
+      }
+      if (verdict.state === "stale") {
+        hold(issue, "stale-base");
+        log(
+          `#${issue} held (stale-base): continuation branch ${branch} predates critical-base marker ${verdict.marker}`,
+        );
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue,
+          summary: `#${issue} continuation branch predates a critical base safety commit and is held (stale-base)`,
+          detail: [
+            r.issue.title,
+            r.issue.url,
+            `The retained branch ${branch} does not contain critical-base marker ${verdict.marker}.`,
+            ...(verdict.range.length > 0
+              ? [`Base commits the branch is missing: ${verdict.range.join(", ")}`]
+              : []),
+            "Recovery: merge current base into the branch so it contains the marker, and the next",
+            "admission pass re-admits it automatically without losing the branch's work; or review",
+            "the branch by hand and clear the hold once the fix is present.",
+          ].join("\n"),
+        });
+        continue;
+      }
+      if (verdict.state === "unknown") {
+        // Fail closed: a branch that cannot be *proven* to contain the marker
+        // is refused, and the reason names the unverifiable marker so the
+        // operator can fix the fetch or the marker rather than guess.
+        hold(issue, "stale-base");
+        log(
+          `#${issue} held (stale-base): continuation branch ${branch} could not be verified ` +
+            `against critical-base marker(s) ${markers.join(", ")} (${verdict.error})`,
+        );
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue,
+          summary: `#${issue} continuation branch could not be verified against a critical base safety commit and is held (stale-base)`,
+          detail: [
+            r.issue.title,
+            r.issue.url,
+            `The retained branch ${branch} could not be verified against critical-base marker(s) ${markers.join(", ")}: ${verdict.error}`,
+            "Recovery: merge current base into the branch so it contains the marker, and the next",
+            "admission pass re-admits it automatically without losing the branch's work; or review",
+            "the branch by hand and clear the hold once the fix is present.",
+          ].join("\n"),
+        });
+        continue;
+      }
+    }
+
     // Soft concurrency per epic, per repository: at most one in-flight child of
     // a given parent in each repo. Children of one epic in *different* repos
     // parallelise freely — `repo-active` / `maxConcurrentWorkersPerRepo` owns
@@ -4677,6 +5011,11 @@ async function recoverRun(
             "The issue cannot finish inside the wall-clock cap, so another run would burn a worker slot for the same outcome. Re-scope it, raise maxContinuationsPerIssue for it, or finish the remaining work by hand.",
           ].join("\n"),
         });
+        await postExhaustionPostmortem(
+          d,
+          run,
+          `Attempt ${run.attempt} hit the wall-clock cap with work to continue from, but ${continuation} continuation(s) are already charged against a cap of ${caps.maxContinuationsPerIssue}.`,
+        );
         log(`#${run.issue} not continued from ${cls}: continuation budget exhausted`);
       }
       return;
@@ -4731,11 +5070,14 @@ async function recoverRun(
     // Same bound for provider-transient: an issue whose stream keeps stalling
     // mid-run is requeued free (no attempt, no continuation charged) — but a
     // provider that aborts three times for one issue is down, and a human has
-    // to check its status before hand-requeueing (#220).
+    // to check its status before hand-requeueing (#220). The escalation names
+    // every model the chain tried, so a merged branch built on a different
+    // model is attributable (#286).
     if (
       cls === "provider-transient" &&
       store.classCountFor(project.name, run.issue, "provider-transient") >= PROVIDER_TRANSIENT_MAX_STRIKES
     ) {
+      const tried = formatModelsTried(modelsTried(store.runsForIssue(project.name, run.issue)));
       await safeEscalate(d, {
         tier: 1,
         project: project.name,
@@ -4743,6 +5085,9 @@ async function recoverRun(
         summary: `[provider-transient] #${run.issue}: the provider keeps aborting mid-stream — ${evidence}`,
         detail: [
           `The provider aborted the stream for #${run.issue} ${PROVIDER_TRANSIENT_MAX_STRIKES} times without the run ever producing a verdict (0 tokens billed each time).`,
+          ...(tried === ""
+            ? []
+            : [`Models tried: ${tried}.`]),
           "Check provider status before requeueing by hand.",
         ].join("\n"),
       });
@@ -4816,6 +5161,11 @@ async function recoverRun(
             "What you can do: raise maxContinuationsPerIssue for this issue, re-scope it, or continue from the preserved work (or start clean if none).",
           ].join("\n"),
         });
+        await postExhaustionPostmortem(
+          d,
+          run,
+          `Attempt ${run.attempt} is not requeued: ${continuations} continuation(s) charged against a cap of ${caps.maxContinuationsPerIssue}.`,
+        );
         log(`#${run.issue} not requeued from orphan-clean: continuation budget exhausted`);
         return;
       }
@@ -5336,6 +5686,8 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
       integrity,
       stall: { paged: false },
       cleanup: { next: 0 },
+      probeCriticalBase: (repo, markers, branch) =>
+        probeCriticalBase(project, repo, branch, markers),
       ...(verbPeerReader === undefined ? {} : { verbPeerReader }),
       verbActions,
     };