omp-conductor 0.16.2 → 0.17.1

package/src/setup.ts

@@ -8,7 +8,8 @@
  * least tested code in the package.
  *
  * Two functions here mutate something outside the process: `createMissingLabels`
- * and `writeOrchestratorBrief`. Everything else reads, or computes. That is what
+ * (and its rollback compensation half, `deleteCreatedLabels`) and
+ * `writeOrchestratorBrief`. Everything else reads, or computes. That is what
  * lets the plugin show a complete plan before asking for consent, and it is a
  * property worth preserving — check it before adding a function.
  *
@@ -40,6 +41,7 @@ import {
   configPath,
   defaultMirrorRoot,
   defaultWorkspaceRoot,
+  resolveArmProof,
   resolveCaps,
   resolvePolicy,
   resolveReleaseGrants,
@@ -50,6 +52,7 @@ import { graphProjectPath, graphRepos } from "./graph.ts";
 import { ompSettingsOverlay } from "./omp-settings.ts";
 import {
   CONFIG_VERSION,
+  DEFAULT_ARM_PROOF,
   DEFAULT_AUTHORITY,
   DEFAULT_CAPS,
   DEFAULT_PROJECT_POLICY,
@@ -57,6 +60,7 @@ import {
   DENIED_RELEASE_GRANTS,
   RELEASE_SHAPES,
   WEEKDAYS,
+  type ArmProof,
   type BaseFreshness,
   type BehindBaseAction,
   type AuthorityHolder,
@@ -205,6 +209,12 @@ export interface SetupAnswers {
    * leave one to be defaulted by whichever reader gets there first.
    */
   policy: ProjectPolicy;
+  /**
+   * How `arm` proves a human just approved arming (#613). Always complete:
+   * the wizard asks about it in the policy area, so an answers object can never
+   * leave it to be defaulted by whichever reader gets there first.
+   */
+  armProof: ArmProof;
   /**
    * Hand-edited recovery merge authorizations carried through setup unchanged.
    * The wizard never grants one; forgetting them during an unrelated amend
@@ -381,8 +391,23 @@ export const BEHIND_BASE_CHOICES: { readonly [K in BehindBaseAction]: string } =
   escalate: "page a human rather than guess",
 };
 
+/**
+ * What each arming proof means to the operator being asked about it, in their
+ * words rather than the gate's (conductor #613). The `claim-only` consequence
+ * is the one line the issue contract requires the question to state: anything
+ * that can invoke the already-privileged `omp-conductor arm` command can start
+ * dispatch once the live claim and poller pass. Mapped over the closed union
+ * so a third proof fails to compile here instead of reaching a wizard with no
+ * question for it.
+ */
+export const ARM_PROOF_CHOICES: { readonly [K in ArmProof]: string } = {
+  challenge: "an authenticated Telegram challenge proves a human just approved arming",
+  "claim-only": "anyone who can invoke the already-privileged `omp-conductor arm` command can start dispatch once the live claim and poller pass",
+};
+
 export const RELEASE_REQUIREMENT_CHOICES: { readonly [K in ReleaseRequirement]: string } = {
-  "runs-settled": "every run this release covers actually merged, not merely reached a green PR",
+  "runs-settled": "every run of the released repo actually merged, not merely reached a green PR",
+  "fleet-runs-settled": "every run in the project actually merged — suite-wide strictness for shapes that consume several repos",
   "no-open-prs": "no pull request is still open against the branch being released",
   "queue-drained": "nothing still carries the queue label",
   "base-branch-green": "the newest observed post-merge base-branch workflows are green",
@@ -700,11 +725,33 @@ export async function createMissingLabels(trackerRepo: string, plan: LabelPlan[]
       continue;
     }
     if (/already exists/i.test(r.stderr)) continue;
-    throw new Error(`Could not create label "${label.name}" in ${trackerRepo}: ${briefly(r.stderr)}`);
+    // The labels created before this one failed ride on the error: the setup
+    // transaction compensates the tracker exactly, and a throw without the
+    // partial list would orphan them (#652).
+    throw Object.assign(
+      new Error(`Could not create label "${label.name}" in ${trackerRepo}: ${briefly(r.stderr)}`),
+      { created },
+    );
   }
   return created;
 }
 
+/**
+ * Compensation half of {@link createMissingLabels}: deletes exactly the labels
+ * a failed setup apply created, so the tracker returns to its pre-entry state.
+ * Runs only on rollback, where a deletion failure is a reported restoration
+ * failure — the orphaned label is named, never silently left behind (#652).
+ */
+export async function deleteCreatedLabels(trackerRepo: string, created: string[]): Promise<void> {
+  const failures: string[] = [];
+  for (const name of created) {
+    const r = await gh(["label", "delete", name, "--repo", trackerRepo, "--yes"]);
+    if (r.code === 0 || /not found/i.test(r.stderr)) continue;
+    failures.push(`could not delete label "${name}" in ${trackerRepo}: ${briefly(r.stderr)}`);
+  }
+  if (failures.length > 0) throw new Error(failures.join("; "));
+}
+
 const QUIET_INTERRUPT_ON: InterruptCategory[] = [
   "tier2",
   "fleet-stopped",
@@ -877,6 +924,10 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
     // Written out in full for the same reason: the file then says what a merge
     // and a release require without anyone having to know a default (#129).
     policy: clonePolicy(a.policy),
+    // Written out even when it is the default, so an operator amending the
+    // policy has a line in the file to point at — and the recovery playbook
+    // can read which proof the project opted into (#613).
+    arm: { proof: a.armProof },
     ...(a.recoveryMerges === undefined
       ? {}
       : { recoveryMerges: a.recoveryMerges.map((entry) => ({ ...entry })) }),
@@ -964,6 +1015,9 @@ export function defaultAnswers(projectName: string, opts: { added?: boolean } =
     authority: { ...SETUP_DEFAULTS.authority },
     releaseGrants: { ...SETUP_DEFAULTS.releaseGrants },
     policy: clonePolicy(SETUP_DEFAULTS.policy),
+    // The strict reading, matching the loader's absent-key default: a project
+    // that never answered keeps today's authenticated challenge round-trip.
+    armProof: DEFAULT_ARM_PROOF,
     orchestratorMode: SETUP_DEFAULTS.orchestratorMode,
     reportScope: SETUP_DEFAULT_REPORT_SCOPE,
     writeOrchestratorBrief: false,
@@ -1060,6 +1114,9 @@ export function answersFromProject(p: ProjectConfig): SetupAnswers {
     authority: { ...p.authority },
     releaseGrants: resolveReleaseGrants(p),
     policy: resolvePolicy(p),
+    // The loader materialises `arm` complete, so this is the answer the project
+    // actually has — never a default guessed at the amend prompt.
+    armProof: resolveArmProof(p),
     orchestratorMode: p.escalation.orchestrator,
     reportScope: reportScopeFromPolicy(p.reporting),
     writeOrchestratorBrief: false,

package/src/status-render.ts

@@ -415,7 +415,17 @@ function formatProjectBody(
     lines.push("active runs");
     for (const r of s.activeRuns) {
       const phase = workerPhases.get(r.issue);
-      const state = phase === "pausing" || phase === "paused" ? phase : r.state;
+      // A run in a live review round reads `review-revision N`, distinct from
+      // a failure and from an ordinary continuation, with the round number
+      // from the durable revision row (#692). The live pause overlay still
+      // wins: an operator pause is the newer fact about the same session.
+      const round = s.reviewRounds?.[r.id];
+      const state =
+        phase === "pausing" || phase === "paused"
+          ? phase
+          : round !== undefined
+            ? `review-revision ${round}`
+            : r.state;
       lines.push(
         `  #${r.issue}  ${r.repo}  ${state}  attempt ${r.attempt}  ` +
           `${r.turns}/${r.maxTurns} turns  ${r.spendUsd.toFixed(2)}  ${r.branch}` +

package/src/store.ts

@@ -41,6 +41,7 @@ import type {
   FrictionKind,
   FrictionObservation,
   FrictionSignal,
+  HistoricalInfraCandidate,
   HeldNotice,
   InterruptCategory,
   HeldNoticeDraft,
@@ -60,6 +61,9 @@ import type {
   ReportKind,
   ReportRecord,
   RecoveryAction,
+  ReviewReason,
+  ReviewRevisionOutcome,
+  ReviewRevisionRecord,
   RunPatch,
   RunRecord,
   RunState,
@@ -99,6 +103,7 @@ const FRICTION_HOLD_REASONS: ReadonlySet<FrictionAdmissionReason> = new Set([
   "failed-attempts",
   "continuations",
   "stale-base",
+  "critical-base-verify-error",
   "parent-lookup-error",
   "issue-state-lookup-error",
   "open-pr-lookup-error",
@@ -361,6 +366,48 @@ interface MergeLockRow {
   at: number;
 }
 
+/** The `review_revisions` table exactly as SQLite hands it back (#677). */
+interface ReviewRevisionRow {
+  id: string;
+  project: string;
+  runId: string;
+  issue: number;
+  prUrl: string;
+  headSha: string;
+  findings: string;
+  round: number;
+  reason: string;
+  sessionFile: string | null;
+  requestedAt: number;
+  dispatchedAt: number | null;
+  settledAt: number | null;
+  outcome: string | null;
+}
+
+/**
+ * NULL columns become absent properties, matching the other row converters:
+ * a record read back out of the store deep-equals the one that went in.
+ */
+function toReviewRevision(row: ReviewRevisionRow): ReviewRevisionRecord {
+  const record: ReviewRevisionRecord = {
+    id: row.id,
+    project: row.project,
+    runId: row.runId,
+    issue: row.issue,
+    prUrl: row.prUrl,
+    headSha: row.headSha,
+    findings: row.findings,
+    round: row.round,
+    reason: row.reason as ReviewReason,
+    requestedAt: row.requestedAt,
+  };
+  if (row.sessionFile !== null) record.sessionFile = row.sessionFile;
+  if (row.dispatchedAt !== null) record.dispatchedAt = row.dispatchedAt;
+  if (row.settledAt !== null) record.settledAt = row.settledAt;
+  if (row.outcome !== null) record.outcome = row.outcome as ReviewRevisionOutcome;
+  return record;
+}
+
 /** The `intake_items` table exactly as SQLite hands it back (#299). */
 interface IntakeRow {
   id: string;
@@ -492,6 +539,22 @@ CREATE TABLE IF NOT EXISTS runs (
 CREATE INDEX IF NOT EXISTS runs_project_issue ON runs (project, issue);
 CREATE INDEX IF NOT EXISTS runs_project_state ON runs (project, state);
 
+-- The historical infrastructure reconciliation's per-project review cursor
+-- (#638). A bounded pass examines settled ci-deterministic rows newest-first
+-- and persists the boundary of the last row it definitively decided, so older
+-- repairable rows are reached across later daemon starts instead of being
+-- starved by repeated rescans of the newest non-matches. classifierVersion is
+-- the signature-list fingerprint at the time the cursor advanced; when the
+-- classifier learns a new signature the stamp goes stale and the pass restarts
+-- from the newest row rather than skipping past newly recognised evidence.
+CREATE TABLE IF NOT EXISTS historical_infra_review (
+  project           TEXT    PRIMARY KEY,
+  cursorStartedAt   INTEGER NOT NULL,
+  cursorRowid       INTEGER NOT NULL,
+  classifierVersion TEXT    NOT NULL,
+  updatedAt         INTEGER NOT NULL
+);
+
 CREATE TABLE IF NOT EXISTS base_health (
   project   TEXT    NOT NULL,
   repo      TEXT    NOT NULL,
@@ -693,6 +756,31 @@ CREATE TABLE IF NOT EXISTS merge_locks (
   at      INTEGER NOT NULL
 );
 
+-- One durable review-revision request (#677): an orchestrator returned a
+-- green, run-owned pull request to its worker with blocking findings. Every
+-- field the daemon needs to resume the exact session is persisted BEFORE the
+-- worker is woken -- the findings, the exact reviewed head, the round number,
+-- and the target run/session -- and the row doubles as the duplicate guard: a
+-- revision whose row exists pending is one nobody may queue again.
+CREATE TABLE IF NOT EXISTS review_revisions (
+  id           TEXT    PRIMARY KEY,
+  project      TEXT    NOT NULL,
+  runId        TEXT    NOT NULL,
+  issue        INTEGER NOT NULL,
+  prUrl        TEXT    NOT NULL,
+  headSha      TEXT    NOT NULL,
+  findings     TEXT    NOT NULL,
+  round        INTEGER NOT NULL,
+  reason       TEXT    NOT NULL,
+  sessionFile  TEXT,
+  requestedAt  INTEGER NOT NULL,
+  dispatchedAt INTEGER,
+  settledAt    INTEGER,
+  outcome      TEXT
+);
+CREATE INDEX IF NOT EXISTS review_revisions_pending
+  ON review_revisions (project, dispatchedAt, runId);
+
 -- Questions the orchestrator has put to its operator, and their answers (#136).
 --
 -- The reason this is a table and not the session's memory: a question lived only
@@ -1143,12 +1231,59 @@ export function dbPath(): string {
   return join(stateDir(), "conductor.db");
 }
 
+/**
+ * Live worker count across the run store, opening the database WITHOUT
+ * creating or upgrading it. The setup apply's quiescence preflight must count
+ * workers before the acknowledged barrier, and database preparation is itself
+ * one of the mutations that barrier must precede — so the observation that
+ * gates it cannot be the thing that creates or migrates the store (#618). The
+ * on-disk database is opened read-only (never created, never "prepared"); a
+ * missing file reports zero because no run has ever been persisted, which the
+ * caller only trusts when no daemon is running either. An unreadable or
+ * schema-broken file throws rather than reading as zero — fail closed, never
+ * absence.
+ */
+export function liveWorkersReadOnly(project?: string): number {
+  const path = dbPath();
+  if (!existsSync(path)) return 0;
+  let db: Database | undefined;
+  try {
+    db = new Database(path, { create: false, readonly: true });
+    db.exec("PRAGMA busy_timeout = 5000;");
+    const placeholders = LIVE_STATES.map(() => "?").join(", ");
+    // `undefined` is the host-global selector: every project's live rows count,
+    // never only the rows of a project literally named "" — a host-global
+    // observation that scoped to `project = ''` hid every real named row and
+    // read zero beside a running fleet (#651 review #3).
+    const row =
+      project === undefined
+        ? db
+            .query<{ n: number }, SqlValue[]>(
+              `SELECT COUNT(*) AS n FROM runs WHERE state IN (${placeholders})`,
+            )
+            .get(...LIVE_STATES)
+        : db
+            .query<{ n: number }, SqlValue[]>(
+              `SELECT COUNT(*) AS n FROM runs WHERE project = ? AND state IN (${placeholders})`,
+            )
+            .get(project, ...LIVE_STATES);
+    return row?.n ?? 0;
+  } catch (err) {
+    throw new Error(
+      `cannot read ${path} to prove the fleet is quiescent: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  } finally {
+    db?.close();
+  }
+}
+
 /** The stem every restorable `conductor.db` snapshot is published under. */
 export const DB_SNAPSHOT_STEM = "conductor.db.bak";
 
 /**
- * A fresh, restorable copy of the store at `source`, published under `destDir`
- * with the same temp-then-atomic-publish convention as the config backups.
+ * A single-file, transaction-consistent copy of the store at `source` into
+ * `target` — the shared core of {@link snapshotDb} and the setup apply's
+ * rollback capture.
  *
  * Uses SQLite's own `VACUUM INTO`, never a plain file copy: the store opens
  * with `journal_mode=WAL`, and a `copyFileSync` can capture a torn database
@@ -1158,10 +1293,30 @@ export const DB_SNAPSHOT_STEM = "conductor.db.bak";
  * writes a single-file snapshot, so the result opens cleanly in a fresh
  * connection and contains every committed row.
  *
- * The snapshot runs against its own read of the source, deliberately not the
- * caller's writer connection, so a snapshot can be taken while a writer holds
- * an uncheckpointed WAL. `:memory:` has no on-disk state to snapshot and is
+ * Runs against its own read of the source, deliberately not the caller's
+ * writer connection, so a snapshot can be taken while a writer holds an
+ * uncheckpointed WAL. `:memory:` has no on-disk state to snapshot and is
  * refused.
+ */
+export function vacuumInto(source: string, target: string): void {
+  if (source === ":memory:") throw new Error("cannot snapshot an in-memory store");
+  if (!existsSync(source)) {
+    throw new Error(`cannot snapshot ${source}: the store does not exist`);
+  }
+  let connection: Database | undefined;
+  try {
+    connection = new Database(source);
+    connection.exec("PRAGMA busy_timeout = 5000;");
+    // `VACUUM INTO` takes the target as an SQL literal, not a bound parameter.
+    connection.exec(`VACUUM INTO '${target.replaceAll("'", "''")}'`);
+  } finally {
+    connection?.close();
+  }
+}
+
+/**
+ * A fresh, restorable copy of the store at `source`, published under `destDir`
+ * with the same temp-then-atomic-publish convention as the config backups.
  *
  * Returns the published snapshot path.
  */
@@ -1172,18 +1327,12 @@ export function snapshotDb(source: string, destDir: string): string {
   }
   mkdirSync(destDir, { recursive: true });
   const temporary = join(destDir, `.${DB_SNAPSHOT_STEM}-${process.pid}.${randomUUID()}.tmp`);
-  let connection: Database | undefined;
   try {
-    connection = new Database(source);
-    connection.exec("PRAGMA busy_timeout = 5000;");
-    // `VACUUM INTO` takes the target as an SQL literal, not a bound parameter.
-    connection.exec(`VACUUM INTO '${temporary.replaceAll("'", "''")}'`);
+    vacuumInto(source, temporary);
   } catch (err) {
     // Never leave a half-written snapshot on disk.
     rmSync(temporary, { force: true });
     throw err;
-  } finally {
-    connection?.close();
   }
   return publishTempFile(temporary, destDir, `${DB_SNAPSHOT_STEM}-${backupTimestamp()}`);
 }
@@ -1644,6 +1793,56 @@ export function openStore(dbPath: string): Store {
       ORDER BY startedAt DESC, rowid DESC
       LIMIT ?`,
   );
+  // The settled rows a classifier correction can no longer reach (#638). A
+  // `ci-deterministic`/`escalate` row never re-enters `selectUnclassified`
+  // (its class is set and its recovery is not retryable), so evidence the
+  // classifier learned after the row was written — the codeload setup 429 of
+  // #177 — stays a charged attempt forever. This WHERE is the historical
+  // reconciliation's exact predicate: nothing but rows currently reading
+  // `ci-deterministic`, never a class a human re-read, and the class itself is
+  // only ever produced for `state = 'failed'`. Bounded like every other sweep
+  // read, because each candidate costs tracker calls to re-fetch its evidence.
+  // `after` is the persisted review cursor: candidates are only rows strictly
+  // older than it, so a bounded pass progresses through a long misclassified
+  // history instead of rescanning the newest non-matches forever. A NULL cursor
+  // (first pass, or one rendered stale by a classifier-signature change) means
+  // "start from the newest". `SELECT rowid, *` exposes the hidden tie-breaker
+  // so the pass can record an exact resume boundary.
+  const selectHistoricalInfraCandidates = db.query<RunRow & { rowid: number }, SqlValue[]>(
+    `SELECT rowid, * FROM runs
+      WHERE project = ? AND failureClass = 'ci-deterministic' AND state = 'failed'
+        AND (? IS NULL OR (startedAt < ? OR (startedAt = ? AND rowid < ?)))
+      ORDER BY startedAt DESC, rowid DESC
+      LIMIT ?`,
+  );
+  const selectHistoricalInfraCursor = db.query<
+    { cursorStartedAt: number; cursorRowid: number; classifierVersion: string },
+    [string]
+  >(
+    `SELECT cursorStartedAt, cursorRowid, classifierVersion FROM historical_infra_review
+      WHERE project = ?`,
+  );
+  const upsertHistoricalInfraCursor = db.query<
+    unknown,
+    [string, number, number, string, number]
+  >(
+    `INSERT INTO historical_infra_review
+       (project, cursorStartedAt, cursorRowid, classifierVersion, updatedAt)
+     VALUES (?, ?, ?, ?, ?)
+     ON CONFLICT(project) DO UPDATE SET
+       cursorStartedAt = excluded.cursorStartedAt,
+       cursorRowid = excluded.cursorRowid,
+       classifierVersion = excluded.classifierVersion,
+       updatedAt = excluded.updatedAt`,
+  );
+  // The one mutation the historical reconciliation may make. Guarded by the
+  // current class, so a second pass is a no-op and a race can never reclassify
+  // a row a human has re-read. Deliberately only `failureClass` — never
+  // `recoveryAction` or `recoveredAt`: relieving the budget is the point,
+  // re-animating a months-old run into the requeue sweep is not (#638).
+  const reclassifyToInfra = db.query<unknown, [string]>(
+    `UPDATE runs SET failureClass = 'ci-infra' WHERE id = ? AND failureClass = 'ci-deterministic'`,
+  );
   const selectFailureClassCounts = db.query<{ cls: string; n: number }, [string]>(
     `SELECT failureClass AS cls, COUNT(*) AS n FROM runs
       WHERE project = ? AND failureClass IS NOT NULL AND recoveredAt IS NULL
@@ -2319,6 +2518,72 @@ export function openStore(dbPath: string): Store {
     },
   );
 
+  // The durable review-revision request outbox (#677): the orchestrator's verb
+  // writes the row (findings, head, round, target session) and the daemon's
+  // next dispatch pass wakes it. The duplicate in-flight guard is the insert:
+  // a pending row for the same run refuses the second request atomically, and
+  // once dispatched the run row's own state (pushed-green → running) is the
+  // in-flight marker.
+  const insertReviewRevision = db.query<unknown, SqlValue[]>(
+    `INSERT INTO review_revisions
+       (id, project, runId, issue, prUrl, headSha, findings, round, reason, sessionFile, requestedAt, dispatchedAt, settledAt, outcome)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, NULL)`,
+  );
+  const selectPendingReviewRevisions = db.query<ReviewRevisionRow, [string]>(
+    `SELECT * FROM review_revisions
+      WHERE project = ? AND dispatchedAt IS NULL AND settledAt IS NULL
+      ORDER BY requestedAt ASC, rowid ASC`,
+  );
+  const selectPendingReviewForRun = db.query<ReviewRevisionRow, [string, string]>(
+    `SELECT * FROM review_revisions
+      WHERE project = ? AND runId = ? AND dispatchedAt IS NULL AND settledAt IS NULL
+      LIMIT 1`,
+  );
+  const selectLatestReviewRound = db.query<{ n: number | null }, [string, string]>(
+    `SELECT MAX(round) AS n FROM review_revisions WHERE project = ? AND runId = ?`,
+  );
+  const markReviewRevisionDispatchedRow = db.query<unknown, [number, string]>(
+    `UPDATE review_revisions SET dispatchedAt = ? WHERE id = ?`,
+  );
+  const settleReviewRevisionRow = db.query<unknown, [string, number, string]>(
+    `UPDATE review_revisions SET outcome = ?, settledAt = ? WHERE id = ?`,
+  );
+  const selectUnsettledReviewRevisions = db.query<ReviewRevisionRow, [string]>(
+    `SELECT * FROM review_revisions
+      WHERE project = ? AND settledAt IS NULL
+      ORDER BY requestedAt ASC, rowid ASC`,
+  );
+  const requeueReviewRevisionRow = db.query<unknown, [string]>(
+    `UPDATE review_revisions SET dispatchedAt = NULL WHERE id = ?`,
+  );
+  const claimRunForReviewRow = db.query<unknown, [string]>(
+    `UPDATE runs SET state = 'running', endedAt = NULL WHERE id = ? AND state = 'pushed-green'`,
+  );
+
+  // The claim and the insert share a transaction so two concurrent revision
+  // requests for one run cannot both win: the second sees the first's pending
+  // row and returns undefined, which the verb turns into the in-flight refusal.
+  const claimReviewRevision = db.transaction(
+    (draft: Omit<ReviewRevisionRecord, "id">): ReviewRevisionRecord | undefined => {
+      if (selectPendingReviewForRun.get(draft.project, draft.runId) !== null) return undefined;
+      const record: ReviewRevisionRecord = { ...draft, id: crypto.randomUUID() };
+      insertReviewRevision.run(
+        record.id,
+        record.project,
+        record.runId,
+        record.issue,
+        record.prUrl,
+        record.headSha,
+        record.findings,
+        record.round,
+        record.reason,
+        record.sessionFile ?? null,
+        record.requestedAt,
+      );
+      return record;
+    },
+  );
+
   // The label projection outbox (#201). A decided label change is a row until
   // the tracker has applied it; the projector drains in id order, and one
   // issue's ops are atomic as a run — a failed op parks the rest of its issue
@@ -2526,6 +2791,30 @@ export function openStore(dbPath: string): Store {
     runsForProjectPr(project: string, prUrl: string, mergedSinceEpochMs: number): RunRecord[] {
       return selectRunsForPr.all(project, prUrl, mergedSinceEpochMs).map(toRecord);
     },
+    createReviewRevision(draft: Omit<ReviewRevisionRecord, "id">): ReviewRevisionRecord | undefined {
+      return claimReviewRevision(draft);
+    },
+    pendingReviewRevisions(project: string): ReviewRevisionRecord[] {
+      return selectPendingReviewRevisions.all(project).map(toReviewRevision);
+    },
+    latestReviewRound(project: string, runId: string): number {
+      return selectLatestReviewRound.get(project, runId)?.n ?? 0;
+    },
+    markReviewRevisionDispatched(id: string, at: number): void {
+      markReviewRevisionDispatchedRow.run(at, id);
+    },
+    settleReviewRevision(id: string, outcome: ReviewRevisionOutcome, at: number): void {
+      settleReviewRevisionRow.run(outcome, at, id);
+    },
+    unsettledReviewRevisions(project: string): ReviewRevisionRecord[] {
+      return selectUnsettledReviewRevisions.all(project).map(toReviewRevision);
+    },
+    requeueReviewRevision(id: string): void {
+      requeueReviewRevisionRow.run(id);
+    },
+    claimRunForReview(runId: string): boolean {
+      return claimRunForReviewRow.run(runId).changes > 0;
+    },
     runsNeedingBaseCheck(project: string, limit = 20): RunRecord[] {
       return selectPendingBaseChecks.all(project, limit).map(toRecord);
     },
@@ -3066,6 +3355,38 @@ export function openStore(dbPath: string): Store {
       return selectUnclassified.all(project, limit).map(toRecord);
     },
 
+    historicalInfraCandidates(
+      project: string,
+      limit = 20,
+      after?: { startedAt: number; rowid: number },
+    ): HistoricalInfraCandidate[] {
+      const cursorAt = after?.startedAt ?? null;
+      const cursorRowid = after?.rowid ?? null;
+      return selectHistoricalInfraCandidates
+        .all(project, cursorAt, cursorAt, cursorAt, cursorRowid, limit)
+        .map((row) => ({ ...toRecord(row), rowid: row.rowid }));
+    },
+
+    historicalInfraCursor(project: string) {
+      const row = selectHistoricalInfraCursor.get(project);
+      return row == null
+        ? undefined
+        : { startedAt: row.cursorStartedAt, rowid: row.cursorRowid, classifierVersion: row.classifierVersion };
+    },
+
+    setHistoricalInfraCursor(
+      project: string,
+      startedAt: number,
+      rowid: number,
+      classifierVersion: string,
+    ): void {
+      upsertHistoricalInfraCursor.run(project, startedAt, rowid, classifierVersion, Date.now());
+    },
+
+    reclassifyInfra(id: string): boolean {
+      return reclassifyToInfra.run(id).changes > 0;
+    },
+
     failureClassCounts(project: string): { cls: FailureClass; n: number }[] {
       return selectFailureClassCounts
         .all(project)