omp-conductor 0.15.11 → 0.15.13

package/src/daemon.ts

@@ -8,7 +8,7 @@
  * here and enforced before anything is claimed.
  */
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import {
   configPath,
@@ -39,6 +39,10 @@ import { runCommand, verifyPendingUpgrade, type UpgradeVerifyDeps } from "./upgr
 import { fleetLayers } from "./fleet.ts";
 import { startOrchestrator } from "./orchestrator.ts";
 import type { OrchestratorHandle } from "./orchestrator.ts";
+import {
+  formatOrchestratorDown,
+  reconcileOrchestratorDown,
+} from "./orchestrator-down.ts";
 import {
   createReportOutbox,
   enqueueAvailableHeldNotices,
@@ -47,12 +51,21 @@ import {
 } from "./reports.ts";
 import {
   recordReleaseBlock,
+  type GateShape,
   type ReleaseBlockContext,
 } from "./release-policy.ts";
 import { branchName, effectiveLabels, route } from "./routing.ts";
 import type { Routed, UnroutableReason } from "./routing.ts";
 import { evaluateDecisionConditions, probeNpmVersion, probeRateLimitReset } from "./decisions.ts";
 import { classifyRun, providerCreditRefusal, providerTransientFault, type ClassifyFacts } from "./failure-class.ts";
+import {
+  DEFAULT_MODEL_FALLBACK_THRESHOLD,
+  fallbackClause,
+  formatModelsTried,
+  modelsTried,
+  providerFailureFacts,
+  resolveDispatchModel,
+} from "./model-fallback.ts";
 import { projectLabels } from "./label-projection.ts";
 import { dbPath, LIVE_STATES, openStore, utcDay } from "./store.ts";
 import { makeTracker, type RateLimitStatus } from "./tracker/github.ts";
@@ -64,10 +77,12 @@ import type {
   DispatchSummary,
   DigestBacklog,
   Escalation,
+  IssueComment,
   IssueSnapshot,
   MergedPrInfo,
   OpenCloser,
   ReleaseShape,
+  OrchestratorIncident,
   PrState,
   ProjectConfig,
   ReadyIssue,
@@ -90,6 +105,7 @@ import {
   type WorkerPausePhase,
   type WorkerResult,
   type RunWorkerDeps,
+  ORPHAN_RESUME_PROMPT,
   renderBrief,
   runWorker,
 } from "./worker.ts";
@@ -122,7 +138,14 @@ import {
 } from "./verbs/socket.ts";
 import { homedir } from "node:os";
 
-import { pushRunBranch, readBaseChain, type RunRepoRef } from "./gitops.ts";
+import {
+  probeCriticalBase,
+  pushRunBranch,
+  readBaseChain,
+  type CriticalBaseProbe,
+  type CriticalBaseVerdict,
+  type RunRepoRef,
+} from "./gitops.ts";
 import {
   planUsageLine,
   readPlanUsage,
@@ -210,6 +233,13 @@ interface Deps {
   workerDeps?: RunWorkerDeps;
   integrity: IntegrityGate;
   stall: StallGate;
+  /**
+   * The embedded orchestrator session handle when one started; absent when it
+   * failed to start or the project uses an external orchestrator. Feeds the
+   * orchestrator-down reconcile ({@link reconcileOrchestratorDown}) so a
+   * crashed session pages once per incident instead of degrading quietly.
+   */
+  orchestrator?: OrchestratorHandle;
   cleanup?: RetainedCleanupCursor;
   /**
    * Reads the connecting uid off a verb socket (#126). Resolved once at startup
@@ -233,6 +263,14 @@ interface Deps {
    * without touching the host's packages, journal or outbox.
    */
   upgradeVerifier?: (d: Deps) => Promise<void>;
+  /**
+   * Answers whether a preserved continuation branch contains every configured
+   * critical-base marker, for the stale-base admission hold (#428). Wired by
+   * `runDaemon` to the mirror-backed {@link probeCriticalBase}; a test injects
+   * a fake. Absent, the stale-base gate fails closed whenever a project names
+   * a marker (a safety interlock must not silently weaken).
+   */
+  probeCriticalBase?: CriticalBaseProbe;
 }
 
 /**
@@ -506,6 +544,19 @@ export function pauseInstance(
   }
 }
 
+/**
+ * The pause sentinel's `source=` token, proven from a verb. The sentinel's
+ * source line is read back as a single `\S+` token (see {@link pauseInstance}
+ * and {@link pauseProvenance}), so a verb that contains a space (`setup host`)
+ * is unrepresentable verbatim and must be encoded before it reaches disk —
+ * otherwise the fence cannot prove its own pause and refuses forever (#552).
+ * Spaces become `-`; the human-readable verb is preserved in the sentinel's
+ * `reason=` instead.
+ */
+export function pauseSourceToken(verb: string): string {
+  return verb.trim().replace(/\s+/g, "-");
+}
+
 export function setPaused(
   v: boolean,
   why?: { source: string; reason?: string },
@@ -682,6 +733,64 @@ function acceptanceCriteria(issue: ReadyIssue): string {
     : "_The issue body is empty. Read the issue and its comments, and escalate if it is genuinely underspecified._";
 }
 
+/**
+ * How much of a comment thread one brief may hold. Grooming notes are short,
+ * and a thread that outgrows this is truncated with an explicit marker rather
+ * than a silently dropped tail — the disappearance this fix exists to prevent.
+ */
+const DISCUSSION_CHARS_BUDGET = 8_000;
+
+/**
+ * The issue's comments as a brief section: attributed, numbered, oldest
+ * first, so a later correction visibly supersedes an earlier note. Rendered
+ * beside the body at dispatch, because the orchestrator's grooming is posted
+ * as comments and a worker must never depend on a runtime read to see it.
+ *
+ * `"unread"` is not "empty": when the tracker refused at dispatch the section
+ * says so, instead of silently reading as "no discussion" — which is exactly
+ * the #517 failure. An empty comment list renders nothing, so a commentless
+ * issue's brief stays byte-identical to what this package has always shipped.
+ */
+function renderDiscussion(comments: IssueComment[] | "unread"): string {
+  if (comments === "unread") {
+    return [
+      "## Discussion",
+      "",
+      "_The issue's comments could not be read at dispatch time. The live read below is_",
+      "_the only path to them; if it prints nothing, that is a failed read, not an_",
+      "_absence of discussion._",
+      "",
+    ].join("\n");
+  }
+  if (comments.length === 0) return "";
+  const total = comments.length;
+  const lines = [
+    "## Discussion",
+    "",
+    `${total} comment${total === 1 ? "" : "s"} on the issue at dispatch, oldest first — a later`,
+    "comment supersedes an earlier one.",
+    "",
+  ];
+  let chars = lines.join("\n").length;
+  let shown = 0;
+  for (const comment of comments) {
+    const block = `**@${comment.author} — comment ${shown + 1}:**\n\n${comment.body}\n\n`;
+    if (shown > 0 && chars + block.length > DISCUSSION_CHARS_BUDGET) break;
+    lines.push(`**@${comment.author} — comment ${shown + 1}:**`, "", comment.body, "");
+    chars += block.length;
+    shown += 1;
+  }
+  if (shown < total) {
+    const omitted = total - shown;
+    lines.push(
+      `… ${omitted} comment${omitted === 1 ? "" : "s"} omitted — the discussion exceeded ${DISCUSSION_CHARS_BUDGET} characters.`,
+      "Read the issue for the tail.",
+      "",
+    );
+  }
+  return lines.join("\n");
+}
+
 /**
  * Record a state-label swap for projection (#201). The add enqueues before the
  * remove — the reverse order would leave a window where the issue carries no
@@ -934,7 +1043,15 @@ export async function buildBrief(
   r: Routed,
   branch: string,
   worktree: string,
-  opts: { continuation?: boolean; defaultBranch?: string; salvagedSha?: string } = {},
+  opts: {
+    continuation?: boolean;
+    defaultBranch?: string;
+    salvagedSha?: string;
+    /** The issue's comments, rendered into the Discussion section. `"unread"`
+     *  when the tracker refused at dispatch — rare, but it must never read as
+     *  "no comments" (the #517 failure mode). Absent means an empty list. */
+    comments?: IssueComment[] | "unread";
+  } = {},
 ): Promise<string> {
   // Read per dispatch rather than caching: editing the brief then takes effect
   // on the next issue instead of needing a daemon restart.
@@ -979,6 +1096,7 @@ export async function buildBrief(
     BRANCH: branch,
     WORKTREE: worktree,
     ACCEPTANCE_CRITERIA: acceptanceCriteria(r.issue),
+    ISSUE_COMMENTS: renderDiscussion(opts.comments ?? []),
     GATES: gatesBlock(r.repo),
     // Empty for a repo with no `graphProject`, and empty means *nothing*: the
     // placeholder sits flush against the next list item in the template, so an
@@ -1045,6 +1163,135 @@ function newestContinuableRun(runs: readonly RunRecord[]): RunRecord | undefined
   );
 }
 
+/** The fenced-block info string that marks an exhaustion postmortem comment, so
+ *  a grooming scout re-slicing the issue can find and parse the whole block by
+ *  grepping for it. */
+export const POSTMORTEM_MARKER = "conductor-postmortem";
+
+/** How one issue's attempt chain failed, as "3× ci-deterministic, 1× …" — the
+ *  digest shape for naming what the exhaustion was. Groups every row by its
+ *  failure class, whether or not it charged the continuation budget, because
+ *  the postmortem tells the whole story and not just the budget half (#290). */
+export function attemptClassBreakdown(runs: readonly RunRecord[]): string {
+  const perClass = new Map<string, number>();
+  for (const r of runs) {
+    const cls = r.failureClass ?? "unclassified";
+    perClass.set(cls, (perClass.get(cls) ?? 0) + 1);
+  }
+  if (perClass.size === 0) return "unclassified";
+  return Array.from(perClass, ([cls, n]) => `${n}× ${cls}`).join(", ");
+}
+
+/** Wall-clock duration of one run as a compact human string ("45m", "1h30m"). */
+export function humanDuration(ms: number): string {
+  const seconds = Math.max(0, Math.round(ms / 1_000));
+  if (seconds < 60) return `${seconds}s`;
+  const minutes = Math.round(seconds / 60);
+  if (minutes < 60) return `${minutes}m`;
+  const hours = Math.floor(minutes / 60);
+  const rest = minutes % 60;
+  return rest === 0 ? `${hours}h` : `${hours}h${rest}m`;
+}
+
+/** Flatten and bound a run's last error to one greppable table line. */
+export function oneLineBrief(text: string | undefined): string | undefined {
+  if (text === undefined || text.trim() === "") return undefined;
+  const flat = text.replace(/\s+/g, " ").trim();
+  return flat.length > 90 ? `${flat.slice(0, 89)}…` : flat;
+}
+
+/**
+ * The exhaustion postmortem block: one greppable fenced block covering every
+ * attempt in the chain — continuation rows included — with per-attempt turns,
+ * wall clock, failure class and a one-line last error, the explicit salvage
+ * state, the spend total and the transcript paths for local inspection.
+ *
+ * Pure so the tests hold the shape, not the transport: the writer below owns
+ * the once-only guarantee, this owns what "once" looks like.
+ */
+export function formatExhaustionPostmortem(args: {
+  issue: number;
+  runs: readonly RunRecord[];
+  reason: string;
+}): string {
+  const { issue, runs, reason } = args;
+  const artifact = newestContinuableRun(runs);
+  const totalSpend = runs.reduce((sum, r) => sum + r.spendUsd, 0);
+  const spend = `$${totalSpend.toFixed(2)}`;
+  const attemptLines = runs.map((r) => {
+    const wall = r.endedAt === undefined ? "—" : humanDuration(r.endedAt - r.startedAt);
+    const cls = r.failureClass ?? "unclassified";
+    const error = oneLineBrief(r.lastError) ?? "—";
+    return (
+      `  attempt ${r.attempt}  ${r.state.padEnd(12)}  turns ${r.turns}/${r.maxTurns}  ` +
+      `${cls.padEnd(24)}  ${wall.padStart(4)}  last error: ${error}`
+    );
+  });
+  const salvage =
+    artifact === undefined
+      ? "Salvaged WIP: absent — no attempt preserved a branch, head SHA or pull request."
+      : `Salvaged WIP: present — branch ${artifact.branch} at ${artifact.headSha ?? artifact.salvageSha}` +
+        `${artifact.prUrl === undefined ? "" : ` (PR ${artifact.prUrl})`}.`;
+  return [
+    `\`\`\`${POSTMORTEM_MARKER}`,
+    `#${issue} exhausted: ${attemptClassBreakdown(runs)}`,
+    reason,
+    "",
+    `Attempts (${runs.length} total, ${spend} spend):`,
+    ...attemptLines,
+    salvage,
+    `Spend total: ${spend} across ${runs.length} attempts.`,
+    "Transcripts:",
+    ...runs.map((r) => (r.sessionFile === undefined ? "  (none)" : `  ${r.sessionFile}`)),
+    "```",
+  ].join("\n");
+}
+
+/** Dedupe key prefix for the exhaustion postmortem comment, per issue. */
+function postmortemDedupeKey(project: string, issue: number): string {
+  return `${project}:postmortem:${issue}`;
+}
+
+/**
+ * The exhaustion postmortem: written exactly once per issue, at the point the
+ * continuation budget is spent and the issue is settled toward a human.
+ *
+ * The comment and the material event are both gated by the store's notification
+ * ledger — the same idempotence guard the escalator uses — so re-settling an
+ * already-postmortemed issue posts nothing and records nothing. A body-string
+ * match on the issue would be the wrong guard: an issue re-scoped and re-run
+ * would still carry the old block, and the guarantee asked of this is "decided
+ * once", not "deduped against what is already written".
+ *
+ * The digest must name the exhaustion even if the comment write fails, so the
+ * material event is recorded before the write and unconditionally (the ledger
+ * is append-only, and the gate above already ran once). The comment failure is
+ * logged rather than taking the sweep down with it.
+ */
+async function postExhaustionPostmortem(d: Deps, run: RunRecord, reason: string): Promise<void> {
+  const { project, tracker, store } = d;
+  const key = postmortemDedupeKey(project.name, run.issue);
+  if (store.wasNotified(key)) return;
+  const runs = store.runsForIssue(project.name, run.issue);
+  const body = formatExhaustionPostmortem({ issue: run.issue, runs, reason });
+  const occurredAt = Date.now();
+  store.recordMaterialEvent({
+    project: project.name,
+    category: "exhaustion",
+    summary: `#${run.issue} exhausted: ${attemptClassBreakdown(runs)}`,
+    evidence: body,
+    occurredAt,
+    recordedAt: occurredAt,
+  });
+  try {
+    await tracker.comment(run.issue, body);
+    store.markNotified(key);
+    log(`#${run.issue} posted exhaustion postmortem (${runs.length} attempts)`);
+  } catch (err) {
+    log(`#${run.issue} postmortem comment could not be posted (${errText(err)})`);
+  }
+}
+
 export type ExtendTurnLimitResult =
   | { kind: "extended"; runId: string; maxTurns: number }
   | { kind: "not-increase"; runId: string; maxTurns: number }
@@ -1329,7 +1576,7 @@ export function workerReleaseBlockRecorder(
   issue: number,
   runId: string,
   root = stateDir(),
-): (shape: ReleaseShape, context: ReleaseBlockContext) => void {
+): (shape: GateShape, context: ReleaseBlockContext) => void {
   return (shape, context) =>
     recordReleaseBlock(
       project,
@@ -1386,6 +1633,50 @@ export async function inheritedPrForContinuation(
   return { prUrl: prior.prUrl, ...(prior.headSha === undefined ? {} : { headSha: prior.headSha }) };
 }
 
+/**
+ * #536: whether an orphan-clean requeue may resume the interrupted session
+ * instead of dispatching fresh.
+ *
+ * `reconcileOrphanedRuns` keeps the worktree (salvage commit included) and the
+ * transcript is file-backed, so a daemon restart can hand the next attempt
+ * back its own memory: the same worktree, the same session directory, and
+ * `resume: true` at the harness. The old dispatch built a fresh
+ * `run-<uuid>` session and re-read the repo from zero — the exact rediscovery
+ * orphan-clean spent turns on in #535.
+ *
+ * Only `orphan-clean` resumes. A cap-killed or otherwise failed worker was
+ * killed for cause, and orphan-dirty is held precisely because the worktree is
+ * the only copy. The checks here are what the daemon can prove cheaply before
+ * the claim (the transcript is present and non-empty, the worktree is
+ * present); the harness's own `continueRecent` is the backstop, and a corrupt
+ * transcript it silently falls back from is surfaced loudly by the
+ * `sessionFile` lineage compare at the dispatch site rather than left quiet.
+ */
+function orphanResumeVerdict(
+  prior: RunRecord | undefined,
+): { kind: "resume"; prior: RunRecord } | { kind: "fresh"; reason?: string } {
+  if (prior === undefined || prior.state !== "orphaned" || prior.failureClass !== "orphan-clean") {
+    return { kind: "fresh" };
+  }
+  if (prior.sessionFile === undefined) {
+    return { kind: "fresh", reason: "the orphaned attempt recorded no transcript" };
+  }
+  try {
+    if (!existsSync(prior.sessionFile)) {
+      return { kind: "fresh", reason: `transcript ${prior.sessionFile} is gone` };
+    }
+    if (statSync(prior.sessionFile).size === 0) {
+      return { kind: "fresh", reason: `transcript ${prior.sessionFile} is empty` };
+    }
+  } catch (err) {
+    return { kind: "fresh", reason: `transcript ${prior.sessionFile} is unreadable (${errText(err)})` };
+  }
+  if (prior.worktree === "" || !existsSync(prior.worktree)) {
+    return { kind: "fresh", reason: `worktree ${prior.worktree} is gone` };
+  }
+  return { kind: "resume", prior };
+}
+
 export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
   const { project, caps, tracker, store } = d;
   const issue = r.issue.number;
@@ -1544,6 +1835,54 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
     // attempt whose work this one inherits.
     const prior = store.latestRun(project.name, issue);
     const priorSalvage = prior?.salvageSha;
+    // The failover decision is made from the store the same way admission is:
+    // counts of this issue's own rows, so the switch is sticky per chain and a
+    // fresh issue always starts on the primary (#286). Read before the claim
+    // writes this attempt's row, which would otherwise break the streak.
+    const chainFacts = providerFailureFacts(store.runsForIssue(project.name, issue));
+    // Resolved before the claim, not after provisioning: the model is also
+    // part of the #536 resume decision, which has to be made before the
+    // dispatch shape (fresh provision vs kept worktree) is chosen. With no
+    // `modelFallbacks` configured this is the primary model — or none, for an
+    // unconfigured project — and today's dispatch is byte for byte what it
+    // has always been.
+    const chainConfigured = (project.modelFallbacks?.length ?? 0) > 0;
+    const choice = resolveDispatchModel({
+      workerModel: project.workerModel,
+      modelFallbacks: project.modelFallbacks,
+      threshold: project.modelFallbackThreshold ?? DEFAULT_MODEL_FALLBACK_THRESHOLD,
+      streak: chainFacts.streak,
+    });
+    const clause = fallbackClause(choice, chainFacts, project.workerModel);
+
+    // #536: an orphan-clean requeue resumes the interrupted session instead of
+    // re-reading the repo from zero. Decided here, before this attempt's row
+    // exists, because `prior` is still the attempt whose work this one
+    // inherits and the whole dispatch shape follows the verdict.
+    let resuming: RunRecord | undefined;
+    const verdict = orphanResumeVerdict(prior);
+    if (verdict.kind === "resume") {
+      const resumePrior = verdict.prior;
+      // The continuation must stay on the model the interrupted session was
+      // using; a chain that now resolves differently dispatches fresh rather
+      // than quietly continuing on another model, which would smear one
+      // attempt's work across two models (#286 attribution).
+      if (resumePrior.model !== undefined && choice.model !== undefined && resumePrior.model !== choice.model) {
+        log(
+          `#${issue} attempt ${attempt} not resumed: attempt ${resumePrior.attempt} ran on ${resumePrior.model} but dispatch ` +
+            `now resolves ${choice.model} — fresh dispatch`,
+        );
+      } else {
+        resuming = resumePrior;
+        log(
+          `#${issue} attempt ${attempt} continuing session of attempt ${resuming.attempt} → ` +
+            `transcript ${resuming.sessionFile}, worktree kept`,
+        );
+      }
+    } else if (verdict.reason !== undefined) {
+      log(`#${issue} attempt ${attempt} not resumed: ${verdict.reason} — fresh dispatch`);
+    }
+
     run = store.createRun({
       project: project.name,
       issue,
@@ -1596,22 +1935,30 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
 
     // A run's tree is <workspaceRoot>/<issue> and addRunRepo refuses to reuse
     // an existing path, so a retry — or a tree kept from a failed attempt — has
-    // to be cleared first. Both helpers are pure path math and removeWorktree
-    // tolerates a mirror or tree that is not there yet, so this is safe on a
-    // first attempt. addRunRepo does its own ensureMirror; calling it here too
-    // would cost a second network fetch per attempt.
-    await removeWorktree(mirrorPath, worktreePathFor(project.workspaceRoot, issue));
-    if (await settleStopBeforeSession()) return;
-    if (await settleDrainBeforeSession()) return;
-    const provisioned = await addRunRepo(
-      r.repo,
-      project.mirrorRoot,
-      project.workspaceRoot,
-      issue,
-      branch,
-    );
-    worktreePath = provisioned.path;
-    runRepo = { repo: r.repo, runRepoPath: worktreePath, branch };
+    // to be cleared first. Both helpers are pure path math, and removeWorktree
+    // tolerates a mirror or tree that is not there yet. An attempted resume
+    // skips the whole dance: the orphaned run's tree is the work to continue
+    // (its salvage commit is already on the branch), and re-cloning it from
+    // the mirror would be exactly the rediscovery this feature exists to skip.
+    let provisioned: Awaited<ReturnType<typeof addRunRepo>> | undefined;
+    if (resuming !== undefined) {
+      worktreePath = resuming.worktree;
+      runRepo = { repo: r.repo, runRepoPath: worktreePath, branch };
+    } else {
+      await removeWorktree(mirrorPath, worktreePathFor(project.workspaceRoot, issue));
+      if (await settleStopBeforeSession()) return;
+      if (await settleDrainBeforeSession()) return;
+      const provisionedTree = await addRunRepo(
+        r.repo,
+        project.mirrorRoot,
+        project.workspaceRoot,
+        issue,
+        branch,
+      );
+      provisioned = provisionedTree;
+      worktreePath = provisionedTree.path;
+      runRepo = { repo: r.repo, runRepoPath: worktreePath, branch };
+    }
     if (await settleStopBeforeSession()) return;
     if (await settleDrainBeforeSession()) return;
 
@@ -1620,9 +1967,15 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
     // here would put a file that never gets written into an escalation.
     //
     // Per run rather than one shared directory, so one run's transcript cannot
-    // be truncated or replaced by the next.
+    // be truncated or replaced by the next — except for a resumed attempt,
+    // which deliberately reuses the interrupted session's directory so the
+    // SDK's `continueRecent(cwd, dir)` picks up that transcript and keeps
+    // writing it.
     const runTreeRoot = stateDir();
-    const sessionDir = join(runTreeRoot, "sessions", `run-${String(runId)}`);
+    const sessionDir =
+      resuming === undefined
+        ? join(runTreeRoot, "sessions", `run-${String(runId)}`)
+        : dirname(resuming.sessionFile!);
     mkdirSync(sessionDir, { recursive: true });
 
     // ---- the run's mutation channel (#126) -------------------------------
@@ -1657,18 +2010,52 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
 
     store.updateRun(runId, { worktree: worktreePath, state: "running" });
 
+    // Where this attempt goes, and (when the failover fired) the clause that
+    // makes it attributable. `chainConfigured`/`choice`/`clause` were resolved
+    // before the claim — the resume verdict had to be made before the dispatch
+    // shape was chosen (#536) — so only the record write lives here.
+    // Recorded before the launch, so even a run killed mid-flight leaves the
+    // model it chose on its row. Only a chain-configured project writes the
+    // column: absent `modelFallbacks` must preserve today's rows byte for byte.
+    if (chainConfigured && choice.model !== undefined) {
+      store.updateRun(runId, { model: choice.model });
+    }
+
     log(
-      `#${issue} attempt ${attempt} → ${r.repo.name} ${branch}` +
-        (provisioned.reattached ? " (continuation: reattached existing branch)" : ""),
+      `#${issue} attempt ${attempt}${clause === undefined ? "" : ` ${clause}`} → ${r.repo.name} ${branch}` +
+        (provisioned?.reattached ? " (continuation: reattached existing branch)" : ""),
     );
 
-    const brief = await buildBrief(project, r, branch, worktreePath, {
-      continuation: provisioned.reattached,
-      defaultBranch: r.repo.defaultBranch,
-      ...(provisioned.reattached && priorSalvage !== undefined
-        ? { salvagedSha: priorSalvage }
-        : {}),
-    });
+    // The continuation notice replaces the brief for a resumed attempt (#536).
+    // The original brief is already in the resumed transcript; re-sending it is
+    // how a resumed worker ends up re-doing the work it just did. Everything
+    // below the brief is fresh-dispatch-only, exactly as today.
+    let brief: string;
+    if (resuming !== undefined) {
+      brief = ORPHAN_RESUME_PROMPT;
+    } else {
+      // The discussion is rendered at dispatch so a worker never depends on a
+      // runtime `gh` read to see the orchestrator's grooming (#517). The read is
+      // best-effort, but its failure is not silent: an unreadable tracker names
+      // itself in the brief's Discussion section instead of reading as "no
+      // comments" — the exact confusion this fix removes.
+      let comments: IssueComment[] | "unread";
+      try {
+        comments = await tracker.listComments(issue);
+      } catch (err) {
+        log(`#${issue} issue comments unreadable at dispatch; the brief will say so: ${errText(err)}`);
+        comments = "unread";
+      }
+
+      brief = await buildBrief(project, r, branch, worktreePath, {
+        continuation: provisioned?.reattached === true,
+        defaultBranch: r.repo.defaultBranch,
+        ...(provisioned?.reattached === true && priorSalvage !== undefined
+          ? { salvagedSha: priorSalvage }
+          : {}),
+        comments,
+      });
+    }
     if (await settleStopBeforeSession()) return;
     if (await settleDrainBeforeSession()) return;
 
@@ -1687,6 +2074,7 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
           workerControl?.install(control);
         },
         sessionDir,
+        ...(resuming === undefined ? {} : { resume: true }),
         // The session's control socket, under the daemon's own state directory —
         // a child process of the daemon reaches it directly.
         socketPath: join(sessionDir, "ipc.sock"),
@@ -1702,7 +2090,7 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
         onChildLog: (line) => {
           log(`#${issue} ${line}`);
         },
-        ...(project.workerModel === undefined ? {} : { model: project.workerModel }),
+        ...(choice.model === undefined ? {} : { model: choice.model }),
         releaseGrants: resolveReleaseGrants(project),
         onReleaseBlocked: workerReleaseBlockRecorder(project.name, issue, runId),
         onTurn: (n) => store.updateRun(runId, { turns: n }),
@@ -1715,7 +2103,21 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
         // ends: `omp-conductor tail` resolves an issue to a file through this row,
         // and a path written at completion is a path nobody can follow live. The
         // completion-time update below writes the same value again, harmlessly.
-        onSessionFile: (f) => store.updateRun(runId, { sessionFile: f }),
+        onSessionFile: (f) => {
+          store.updateRun(runId, { sessionFile: f });
+          // #536: the harness's own `continueRecent` can still fall back to a
+          // blank session (corrupt transcript, nothing to continue) — and a
+          // blank session in the "resumed" worktree is indistinguishable from
+          // today's dispatch unless the downgrade is named. Same-file lineage
+          // is the proof the resume happened: the resumed run must keep
+          // writing the orphaned attempt's transcript.
+          if (resuming !== undefined && f !== resuming.sessionFile) {
+            log(
+              `#${issue} attempt ${attempt} resume fell back to a fresh session: opened ${f} ` +
+                `instead of the orphaned attempt's ${resuming.sessionFile}`,
+            );
+          }
+        },
         // The last fence (#374): every pre-launch settle check above has
         // passed, but the stop can still land while the session socket is
         // binding inside `createSession`. This gate is re-checked there,
@@ -2886,7 +3288,7 @@ function planUsageEscalation(project: string, plan: PlanUsageStatus): Escalation
  * that grows a field has no business breaking these tests.
  */
 export async function admitCandidates(
-  d: Pick<Deps, "project" | "caps" | "tracker" | "store" | "escalate" | "usage">,
+  d: Pick<Deps, "project" | "caps" | "tracker" | "store" | "escalate" | "usage" | "probeCriticalBase">,
   routed: Routed[],
   slots: number,
 ): Promise<AdmissionPass> {
@@ -3066,6 +3468,81 @@ export async function admitCandidates(
       continue;
     }
 
+    // #428 half (a): a preserved continuation that predates a configured
+    // critical-base/safety marker must not be reattached. A base safety fix
+    // protects only branches forked after it landed — a continuation forked
+    // before it still carries the dangerous test/runtime code, and re-running
+    // it on the shared host is what SIGTERMed the production daemon. Fail
+    // closed: only a probe that proves every marker is in the reattach
+    // source's ancestry admits, and a project that names a marker but has no
+    // probe wired (never happens outside tests) holds. Both the hold and the
+    // escalation are durable across restart and orphan recovery because this
+    // gate runs every admission pass; the branch is re-admitted automatically
+    // once the operator updates it to contain the marker, without losing work.
+    const markers = project.criticalBase ?? [];
+    if (markers.length > 0) {
+      const branch = branchName(r.issue);
+      let verdict: CriticalBaseVerdict;
+      if (d.probeCriticalBase === undefined) {
+        verdict = { state: "unknown", error: "no critical-base probe is wired in this deployment" };
+      } else {
+        try {
+          verdict = await d.probeCriticalBase(r.repo, markers, branch);
+        } catch (err) {
+          verdict = { state: "unknown", error: errText(err) };
+        }
+      }
+      if (verdict.state === "stale") {
+        hold(issue, "stale-base");
+        log(
+          `#${issue} held (stale-base): continuation branch ${branch} predates critical-base marker ${verdict.marker}`,
+        );
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue,
+          summary: `#${issue} continuation branch predates a critical base safety commit and is held (stale-base)`,
+          detail: [
+            r.issue.title,
+            r.issue.url,
+            `The retained branch ${branch} does not contain critical-base marker ${verdict.marker}.`,
+            ...(verdict.range.length > 0
+              ? [`Base commits the branch is missing: ${verdict.range.join(", ")}`]
+              : []),
+            "Recovery: merge current base into the branch so it contains the marker, and the next",
+            "admission pass re-admits it automatically without losing the branch's work; or review",
+            "the branch by hand and clear the hold once the fix is present.",
+          ].join("\n"),
+        });
+        continue;
+      }
+      if (verdict.state === "unknown") {
+        // Fail closed: a branch that cannot be *proven* to contain the marker
+        // is refused, and the reason names the unverifiable marker so the
+        // operator can fix the fetch or the marker rather than guess.
+        hold(issue, "stale-base");
+        log(
+          `#${issue} held (stale-base): continuation branch ${branch} could not be verified ` +
+            `against critical-base marker(s) ${markers.join(", ")} (${verdict.error})`,
+        );
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue,
+          summary: `#${issue} continuation branch could not be verified against a critical base safety commit and is held (stale-base)`,
+          detail: [
+            r.issue.title,
+            r.issue.url,
+            `The retained branch ${branch} could not be verified against critical-base marker(s) ${markers.join(", ")}: ${verdict.error}`,
+            "Recovery: merge current base into the branch so it contains the marker, and the next",
+            "admission pass re-admits it automatically without losing the branch's work; or review",
+            "the branch by hand and clear the hold once the fix is present.",
+          ].join("\n"),
+        });
+        continue;
+      }
+    }
+
     // Soft concurrency per epic, per repository: at most one in-flight child of
     // a given parent in each repo. Children of one epic in *different* repos
     // parallelise freely — `repo-active` / `maxConcurrentWorkersPerRepo` owns
@@ -3084,7 +3561,13 @@ export async function admitCandidates(
     if (parent !== undefined) {
       const occupied = occupiedParents.get(parent);
       const blocker = occupied?.get(r.repo.name) ?? occupied?.get("");
-      if (blocker !== undefined) {
+      // The gate serializes siblings under one epic: a held candidate must not
+      // proceed while a *different* child of the parent is occupied. But a
+      // candidate's own worker-free pushed-green row is exactly the work it is
+      // continuing, not a rival — the unblocked continuation of that same
+      // issue must not be rejected by its own occupancy, or the retained
+      // continuation deadlocks forever with the PR open.
+      if (blocker !== undefined && blocker !== issue) {
         hold(issue, "sibling-active");
         log(`#${issue} skipped: sibling #${blocker} in flight under epic #${parent} in ${r.repo.name}`);
         continue;
@@ -3389,6 +3872,18 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // failure happened. A pause silences claiming, not the operator's right to
   // know their supervising session stopped reading its queue.
   await watchOrchestrator(d);
+  // The down incident is reconciled the same place and for the same reason: a
+  // session that has actually died is as much the operator's concern as one
+  // that is wedged, and restarting it is the daemon's restart either way. This
+  // is what turns a crashed orchestrator into one page ("down since <t>") plus
+  // a diverting count, instead of a warning only in daemon.log.
+  await reconcileOrchestratorDown({
+    project: d.project,
+    store: d.store,
+    orchestrator: d.orchestrator,
+    escalate: (event) => d.escalate(event),
+    log,
+  });
 
   // Settlement is maintenance, not dispatch. Run it before every gate that can
   // stop claiming — pause, integrity, spend, and capacity — so status converges
@@ -4116,6 +4611,13 @@ export interface StatusSnapshot {
    * see rather than a silent gap.
    */
   labelOps?: { pending: number; oldestAgeMs: number };
+  /**
+   * The orchestrator-down incident, when the embedded orchestrator is down:
+   * mode, since-moment and the tier-1 escalations diverted to issue comments
+   * so far. Absent when the orchestrator is healthy (or external), so recovery
+   * drops the degrade row from `status` (#288).
+   */
+  orchestratorDown?: OrchestratorIncident;
 }
 
 /** Builds a status reading from an already-open store. Long-lived operator
@@ -4135,6 +4637,8 @@ export function statusSnapshotFromStore(
   const dispatch = store.latestDispatch(p.name);
   const labelOpsPending = store.countPendingLabelOps(p.name);
   const oldestLabelOpAt = store.oldestPendingLabelOpAt(p.name);
+  // Read once: `status` renders the degrade row off this while it is down.
+  const orchestratorDown = store.orchestratorIncident(p.name);
   // Read once: the provenance read touches the filesystem, and the renderer
   // should never pay for it twice per status.
   const reason = pauseProvenance(p.name)?.reason;
@@ -4167,6 +4671,7 @@ export function statusSnapshotFromStore(
       ? {}
       : { labelOps: { pending: labelOpsPending, oldestAgeMs: now - oldestLabelOpAt } }),
     baseHealth: store.baseHealth(p.name),
+    ...(orchestratorDown === undefined ? {} : { orchestratorDown }),
   };
 }
 
@@ -4285,6 +4790,7 @@ export function formatStatus(s: StatusSnapshot): string {
     `config    ${s.configPath}`,
     `state     ${s.stateDir}`,
     "",
+    ...(s.orchestratorDown === undefined ? [] : formatOrchestratorDown(s.orchestratorDown)),
     "caps",
     `  workers            ${s.liveWorkers} / ${s.caps.maxConcurrentWorkers}`,
     `  issues today       ${s.runsToday}`,
@@ -4677,6 +5183,11 @@ async function recoverRun(
             "The issue cannot finish inside the wall-clock cap, so another run would burn a worker slot for the same outcome. Re-scope it, raise maxContinuationsPerIssue for it, or finish the remaining work by hand.",
           ].join("\n"),
         });
+        await postExhaustionPostmortem(
+          d,
+          run,
+          `Attempt ${run.attempt} hit the wall-clock cap with work to continue from, but ${continuation} continuation(s) are already charged against a cap of ${caps.maxContinuationsPerIssue}.`,
+        );
         log(`#${run.issue} not continued from ${cls}: continuation budget exhausted`);
       }
       return;
@@ -4731,11 +5242,14 @@ async function recoverRun(
     // Same bound for provider-transient: an issue whose stream keeps stalling
     // mid-run is requeued free (no attempt, no continuation charged) — but a
     // provider that aborts three times for one issue is down, and a human has
-    // to check its status before hand-requeueing (#220).
+    // to check its status before hand-requeueing (#220). The escalation names
+    // every model the chain tried, so a merged branch built on a different
+    // model is attributable (#286).
     if (
       cls === "provider-transient" &&
       store.classCountFor(project.name, run.issue, "provider-transient") >= PROVIDER_TRANSIENT_MAX_STRIKES
     ) {
+      const tried = formatModelsTried(modelsTried(store.runsForIssue(project.name, run.issue)));
       await safeEscalate(d, {
         tier: 1,
         project: project.name,
@@ -4743,6 +5257,9 @@ async function recoverRun(
         summary: `[provider-transient] #${run.issue}: the provider keeps aborting mid-stream — ${evidence}`,
         detail: [
           `The provider aborted the stream for #${run.issue} ${PROVIDER_TRANSIENT_MAX_STRIKES} times without the run ever producing a verdict (0 tokens billed each time).`,
+          ...(tried === ""
+            ? []
+            : [`Models tried: ${tried}.`]),
           "Check provider status before requeueing by hand.",
         ].join("\n"),
       });
@@ -4816,6 +5333,11 @@ async function recoverRun(
             "What you can do: raise maxContinuationsPerIssue for this issue, re-scope it, or continue from the preserved work (or start clean if none).",
           ].join("\n"),
         });
+        await postExhaustionPostmortem(
+          d,
+          run,
+          `Attempt ${run.attempt} is not requeued: ${continuations} continuation(s) charged against a cap of ${caps.maxContinuationsPerIssue}.`,
+        );
         log(`#${run.issue} not requeued from orphan-clean: continuation budget exhausted`);
         return;
       }
@@ -5247,6 +5769,8 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     const { brief, releaseGrants } = orchestratorStandingOrders(project);
     let orchestrator: OrchestratorHandle | undefined;
     let orchestratorVerbs: VerbListener | undefined;
+    /** First start-failure cause, surfaced by the orchestrator-down incident (#288). */
+    let orchestratorStartError: string | undefined;
     if (project.escalation.orchestrator === "external") {
       projectLog(
         "orchestrator: external — tier-1 escalations post as issue comments for the external session's drain duty",
@@ -5286,9 +5810,10 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
         const transcript = orchestrator.sessionFile();
         projectLog(`orchestrator session ready${transcript === undefined ? "" : ` · ${transcript}`}`);
       } catch (err) {
+        orchestratorStartError = errText(err);
         projectLog(
           "WARNING: orchestrator session failed to start; tier-1 escalations will fall back to issue " +
-            `comments: ${errText(err)}`,
+            `comments: ${orchestratorStartError}`,
         );
         await orchestratorVerbs?.close();
         orchestratorVerbs = undefined;
@@ -5305,6 +5830,17 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
       orchestrator,
       Date.now,
       deliveryPolicyValid,
+      (e) => {
+        // Every tier-1 escalation that lands on the issue-comment fallback was
+        // diverted from the orchestrator. Count it durably on the open incident
+        // (a no-op when none is open), so the page and status name how much
+        // the outage diverted (#288).
+        store.bumpOrchestratorDiverted(project.name, 1);
+        projectLog(
+          `orchestrator: tier-1 escalation on ${escalationIssueRef(e.issue)} diverted to issue comments ` +
+            `while the orchestrator was down`,
+        );
+      },
     );
     const outbox = createReportOutbox({
       project: currentProject,
@@ -5335,11 +5871,26 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
       workerControls,
       integrity,
       stall: { paged: false },
+      ...(orchestrator === undefined ? {} : { orchestrator }),
       cleanup: { next: 0 },
+      probeCriticalBase: (repo, markers, branch) =>
+        probeCriticalBase(project, repo, branch, markers),
       ...(verbPeerReader === undefined ? {} : { verbPeerReader }),
       verbActions,
     };
     runtimeDeps = d;
+    // Startup reconciliation: close an incident carried over from a previous
+    // process when the orchestrator is up (one recovery notice), or open one
+    // when it failed to start (one down page). A daemon restarted while still
+    // down rediscovers the open incident and does not re-page it.
+    await reconcileOrchestratorDown({
+      project,
+      store,
+      orchestrator,
+      escalate: (event) => d.escalate(event),
+      ...(orchestratorStartError === undefined ? {} : { startCause: orchestratorStartError }),
+      log: projectLog,
+    });
     runtimes.push({
       d,
       outbox,