omp-conductor 0.16.2 → 0.17.1

package/src/daemon.ts

@@ -8,7 +8,7 @@
  * here and enforced before anything is claimed.
  */
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import {
   configPath,
@@ -31,7 +31,7 @@ import { digestScheduleState, type DigestScheduleState } from "./digest-schedule
 import { createEscalator, escalationIssueRef } from "./escalate.ts";
 import { pendingCodeGraph, probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
 import { graphHint } from "./graph.ts";
-import { acquireOnceLease, healthCheck, livingDaemon } from "./lifecycle.ts";
+import { acquireOnceLease, healthCheck, livingDaemon, probeUnit, SYSTEMD_UNIT } from "./lifecycle.ts";
 import { requestImmediateTick, resolveTickConfigCwd, STALL_MARKER_FILE } from "./orchestrator-tick.ts";
 import { runDoctor } from "./doctor.ts";
 import { appendJournal, launchTransientUnit, readUpgradeJournal } from "./upgrade-journal.ts";
@@ -52,17 +52,23 @@ import {
 } from "./reports.ts";
 import {
   recordReleaseBlock,
+  sharedHostBriefNotice,
   type GateShape,
   type ReleaseBlockContext,
 } from "./release-policy.ts";
 import { branchName, effectiveLabels, route } from "./routing.ts";
 import type { Routed, UnroutableReason } from "./routing.ts";
-import { admitCandidates, hasContinuationBudget, hasFailedAttemptBudget } from "./admission.ts";
-import type { Admission, AdmissionHold } from "./admission.ts";
+import {
+  admitCandidates,
+  effectiveLane,
+  hasContinuationBudget,
+  hasFailedAttemptBudget,
+} from "./admission.ts";
+import type { Admission, AdmissionHold, FileLane } from "./admission.ts";
 import { log, errText, safeEscalate } from "./log.ts";
 import { materializeOmpSettings } from "./omp-settings.ts";
 import { evaluateDecisionConditions, probeNpmVersion, probeRateLimitReset } from "./decisions.ts";
-import { classifyRun, providerCreditRefusal, providerTransientFault, type ClassifyFacts } from "./failure-class.ts";
+import { classifyRun, infraLogSignature, infraSignatureVersion, normalise, providerCreditRefusal, providerTransientFault, type ClassifyFacts } from "./failure-class.ts";
 import {
   DEFAULT_MODEL_FALLBACK_THRESHOLD,
   fallbackClause,
@@ -73,7 +79,7 @@ import {
 } from "./model-fallback.ts";
 import { projectLabels } from "./label-projection.ts";
 import { dbPath, LIVE_STATES, openStore, utcDay } from "./store.ts";
-import { makeTracker, type RateLimitStatus } from "./tracker/github.ts";
+import { GraphqlBreaker, makeTracker, type RateLimitStatus } from "./tracker/github.ts";
 import { DEFAULT_REPORT_POLICY, RELEASE_SHAPES } from "./types.ts";
 import type {
   BaseFreeze,
@@ -97,6 +103,8 @@ import type {
   ResolvedGrants,
   FailureClass,
   RecoveryAction,
+  ReviewRevisionOutcome,
+  ReviewRevisionRecord,
   RunRecord,
   RunState,
   SettlementFlag,
@@ -104,6 +112,7 @@ import type {
   Tracker,
   VerbLedgerEntry,
   TurnOverride,
+  WorkflowRun,
 } from "./types.ts";
 import {
   type KilledBy,
@@ -113,6 +122,7 @@ import {
   type RunWorkerDeps,
   ORPHAN_RESUME_PROMPT,
   renderBrief,
+  renderReviewRevisionPrompt,
   runWorker,
 } from "./worker.ts";
 import {
@@ -289,7 +299,9 @@ interface Deps {
   /**
    * Reads one active run's file lane for the admission file-lane interlock
    * (#555): the union of its uncommitted worktree changes and its branch-vs-base
-   * diff. Wired by `runDaemon` to the mirror/worktree-backed
+   * diff. Reconciliation is not occupancy: while the run merges its base, the
+   * probe reports only files it has actually diverged on, never the files the
+   * merge merely staged (#684). Wired by `runDaemon` to the mirror/worktree-backed
    * {@link probeRunLane}; a test injects a fake. Absent, the interlock is inert
    * (no lane is ever known occupied), which is the issue's "fail open": the
    * gate adds holds, it never refuses a well-formed issue for lack of this
@@ -610,6 +622,135 @@ export function setPaused(
   }
 }
 
+// ----------------------------------------------------------------- admission
+// acknowledgement (#651, review #3)
+//
+// The setup-fence's "acknowledgement" must come from the daemon itself, not a
+// second synchronous worker count: a tick that passed its pause gate before
+// the fence landed can sit in awaited tracker/routing/admission work and claim
+// after the count and before setup mutates. Two places make that impossible
+// and record it durably:
+//
+//  - the tick's pause gate re-acknowledges every held pass (the daemon has
+//    reached its admission boundary and claims nothing);
+//  - the claim itself re-checks the pause immediately before creating the run
+//    row, so a tick already past its gate when the fence landed refuses at
+//    the claim — and writes the acknowledgement — instead of admitting.
+//
+// The acknowledgement file names the exact pause instance observed and the
+// daemon generation that observed it, so the setup barrier can prove the
+// acknowledged fence is the fence it froze and the acknowledgement belongs to
+// the daemon it began with.
+
+/** The durable admission acknowledgement a daemon writes when it observes a
+ *  pause fence at an admission boundary. */
+export interface AdmissionAckRecord {
+  /** The pause instance observed (source token, reason, creation instant). */
+  pause: { source: string; reason?: string; since: number };
+  /** The daemon generation that observed it — {@link daemonGeneration}. */
+  daemon: string;
+  /** When the daemon observed the fence. */
+  observedAt: number;
+}
+
+/** The acknowledgement file path. One per host: the fence is host-global. */
+export function admissionAckPath(): string {
+  return join(stateDir(), "admission-ack.json");
+}
+
+/**
+ * The generation identity of the running daemon, or `undefined` when nothing
+ * provably runs. The live pidfile record wins (its pid and boot instant
+ * identify the exact instance, #377); a record-less ACTIVE unit is still a
+ * running daemon and its MainPID is the generation that lets a fence spot a
+ * supervisor restart (#651 review #2). Shared by the ack writer and the setup
+ * barrier's identity so both sides of the acknowledgement name the same
+ * instance by the same rule.
+ */
+export function daemonGeneration(): string | undefined {
+  const daemon = livingDaemon();
+  if (daemon !== undefined) return `${daemon.pid}@${daemon.startedAt}`;
+  const ownership = probeUnit(SYSTEMD_UNIT);
+  return ownership.kind === "active" ? `systemd:${ownership.pid}` : undefined;
+}
+
+/** Reads the current admission acknowledgement, if one is readable. A corrupt
+ *  or unreadable file is absence — the barrier fails closed on the absence. */
+export function readAdmissionAck(): AdmissionAckRecord | undefined {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(readFileSync(admissionAckPath(), "utf8"));
+  } catch {
+    return undefined;
+  }
+  if (parsed === null || typeof parsed !== "object") return undefined;
+  const r = parsed as Record<string, unknown>;
+  const pause = r["pause"];
+  const daemon = r["daemon"];
+  const observedAt = r["observedAt"];
+  if (pause === null || typeof pause !== "object") return undefined;
+  const p = pause as Record<string, unknown>;
+  const source = p["source"];
+  const since = p["since"];
+  const reason = p["reason"];
+  if (typeof source !== "string" || source.length === 0) return undefined;
+  if (typeof since !== "number" || !Number.isFinite(since)) return undefined;
+  if (reason !== undefined && typeof reason !== "string") return undefined;
+  if (typeof daemon !== "string" || daemon.length === 0) return undefined;
+  if (typeof observedAt !== "number" || !Number.isFinite(observedAt)) return undefined;
+  return { pause: { source, since, ...(reason === undefined ? {} : { reason }) }, daemon, observedAt };
+}
+
+/**
+ * Writes the admission acknowledgement for the pause the daemon just observed.
+ * The observed instance is the most restrictive fence in force: a host-global
+ * sentinel gates every project and is the pause a host-wide transaction (setup,
+ * an all-projects hold) froze, so it wins over a project-scoped sentinel;
+ * otherwise the project's own sentinel is the effective one for the daemon's
+ * claims, matching {@link pauseInstance}. Recording the project sentinel while
+ * a global fence is also in force would name a narrower, older hold instead of
+ * the fence that actually gates the host — and a barrier that froze the global
+ * sentinel could then never match its own acknowledgement (#651 review #4). A
+ * no-op when no pause is readable: there is nothing to acknowledge. The
+ * generation is the writing daemon's own (the record it owns, or its
+ * supervised MainPID).
+ */
+export function writeAdmissionAck(project: string): void {
+  // `pauseInstance()` reads only the global sentinel; while it is in force it
+  // is the fence that gates every project, and the durable record must name it
+  // rather than a per-project hold that predates it.
+  const pause = pauseInstance() ?? pauseInstance(project);
+  if (pause === undefined) return;
+  const generation = daemonGeneration();
+  if (generation === undefined) return;
+  const path = admissionAckPath();
+  mkdirSync(dirname(path), { recursive: true });
+  const record: AdmissionAckRecord = { pause, daemon: generation, observedAt: Date.now() };
+  const tmp = `${path}.${process.pid.toString(36)}.${Date.now().toString(36)}.tmp`;
+  try {
+    writeFileSync(tmp, `${JSON.stringify(record, null, 2)}\n`, { mode: 0o600 });
+    renameSync(tmp, path);
+  } catch (err) {
+    rmSync(tmp, { force: true });
+    throw err;
+  }
+}
+
+/** Wake the daemon's dispatch loop to prompt a pass (best-effort; used by the
+ *  setup barrier so a live daemon acknowledges the fence without waiting for
+ *  its next five-minute tick). A refused/failed wake just lengthens the wait;
+ *  the barrier's deadline is what bounds it. */
+export async function wakeDaemon(port: number): Promise<void> {
+  try {
+    await fetch(`http://127.0.0.1:${port}/wake`, {
+      method: "POST",
+      signal: AbortSignal.timeout(1_500),
+    });
+  } catch {
+    // Best-effort by contract: the caller's bounded wait is the backstop.
+  }
+}
+
 // ----------------------------------------------------------- package integrity
 
 /** Enough differing paths to tell a deploy from a tamper at a glance; the full
@@ -775,16 +916,29 @@ const DISCUSSION_CHARS_BUDGET = 8_000;
  * the #517 failure. An empty comment list renders nothing, so a commentless
  * issue's brief stays byte-identical to what this package has always shipped.
  */
-function renderDiscussion(comments: IssueComment[] | "unread"): string {
+function renderDiscussion(comments: IssueComment[] | "unread", lane?: FileLane): string {
   if (comments === "unread") {
-    return [
+    const lines = [
       "## Discussion",
       "",
       "_The issue's comments could not be read at dispatch time. The live read below is_",
       "_the only path to them; if it prints nothing, that is a failed read, not an_",
       "_absence of discussion._",
       "",
-    ].join("\n");
+    ];
+    // The lane admission enforced is carried through dispatch, so even an
+    // unreadable thread cannot hide it from the worker (#608): the gate's
+    // effective declaration renders from the admission snapshot, not from the
+    // read that just failed. A body declaration needs no note — the body
+    // always renders.
+    if (lane !== undefined && lane.at !== "body") {
+      lines.push(
+        "_The effective file lane below was enforced at admission — it supersedes any earlier declaration._",
+        lane.source,
+        "",
+      );
+    }
+    return lines.join("\n");
   }
   if (comments.length === 0) return "";
   const total = comments.length;
@@ -812,9 +966,51 @@ function renderDiscussion(comments: IssueComment[] | "unread"): string {
       "",
     );
   }
+  // The file-lane gate resolves its effective lane across the whole thread,
+  // not just what this budget renders, so a winning declaration beyond the
+  // budget would otherwise control admission while the worker never sees it
+  // (#608). Reproduce the winning declaration verbatim here — `at` records
+  // the comment it came from — so the rendered brief and the gate agree on
+  // the same lane, and the note itself re-parses through the same
+  // `File lane:` grammar. The note is suppressed only when the winning
+  // declaration is provably visible in the rendered thread (the body always
+  // renders, so a body winner needs none); a carried admission lane whose
+  // comment the dispatch re-read shifted or dropped still renders here,
+  // whether or not the thread was truncated.
+  if (
+    lane !== undefined &&
+    lane.at !== "body" &&
+    !comments.slice(0, shown).some((c) => c.body.includes(lane.source))
+  ) {
+    lines.push(
+      `_The effective file lane was declared in comment ${lane.at + 1} — it supersedes any earlier declaration._`,
+      lane.source,
+      "",
+    );
+  }
   return lines.join("\n");
 }
 
+/**
+ * What an orphan-resumed worker is told about the file lane on top of the
+ * continuation notice (#608). The original brief already in the transcript
+ * may show an earlier declaration, while admission enforces the current one —
+ * replaying the whole brief would re-do the work, but continuing under a stale
+ * lane is the collision the gate exists to stop. The declaration is rendered
+ * verbatim, so it re-parses through the same `File lane:` grammar every
+ * surfaced declaration uses.
+ */
+function resumeLaneBlock(lane: FileLane): string {
+  return [
+    "",
+    "The file lane admission enforced for this continuation is below. It supersedes",
+    "any lane declaration in the brief already in your transcript:",
+    "",
+    lane.source,
+    "",
+  ].join("\n");
+}
+
 /**
  * Record a state-label swap for projection (#201). The add enqueues before the
  * remove — the reverse order would leave a window where the issue carries no
@@ -1066,6 +1262,15 @@ export async function buildBrief(
      *  when the tracker refused at dispatch — rare, but it must never read as
      *  "no comments" (the #517 failure mode). Absent means an empty list. */
     comments?: IssueComment[] | "unread";
+    /**
+     * The effective file lane admission resolved for this candidate (#608).
+     * When carried, the brief renders exactly this value — the gate's own
+     * snapshot — instead of recomputing from the dispatch-time comment read,
+     * so a changed or failed second read can neither hide nor reword the
+     * lane admission enforced. Absent (unit-level callers), the lane is
+     * resolved from the rendered thread itself.
+     */
+    lane?: FileLane;
   } = {},
 ): Promise<string> {
   // Read per dispatch rather than caching: editing the brief then takes effect
@@ -1103,6 +1308,13 @@ export async function buildBrief(
           "",
         ].join("\n")
       : "";
+  // The comments as rendered, and the effective file lane the brief must show
+  // — the admission-carried value when dispatch has one, else the lane the
+  // thread itself resolves to — passed to the renderer so a winning
+  // declaration can be reproduced verbatim even when it sits beyond the
+  // discussion budget, keeping the gate and the worker-visible brief on one
+  // lane (#608).
+  const comments = opts.comments ?? [];
   return renderBrief(template, {
     ISSUE_NUMBER: String(r.issue.number),
     ISSUE_TITLE: r.issue.title,
@@ -1111,8 +1323,16 @@ export async function buildBrief(
     BRANCH: branch,
     WORKTREE: worktree,
     ACCEPTANCE_CRITERIA: acceptanceCriteria(r.issue),
-    ISSUE_COMMENTS: renderDiscussion(opts.comments ?? []),
+    ISSUE_COMMENTS: renderDiscussion(
+      comments,
+      opts.lane ?? (comments === "unread" ? undefined : effectiveLane(r.issue.body, comments)),
+    ),
     GATES: gatesBlock(r.repo),
+    // The guarded shell suites and their sanctioned parse-only check, derived
+    // from SHARED_HOST_SCRIPTS so the brief and the refusal share one list
+    // (#687). Non-empty whenever the guard has paths, so the placeholder line
+    // always renders to a line.
+    SHARED_HOST_NOTICE: sharedHostBriefNotice(),
     // Empty for a repo with no `graphProject`, and empty means *nothing*: the
     // placeholder sits flush against the next list item in the template, so an
     // unconfigured render leaves no blank line where a hint would have gone.
@@ -1681,7 +1901,12 @@ function orphanResumeVerdict(
   return { kind: "resume", prior };
 }
 
-export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
+export async function handleIssue(
+  d: Deps,
+  r: Routed,
+  attempt: number,
+  admittedLane?: FileLane,
+): Promise<void> {
   const { project, caps, tracker, store } = d;
   const issue = r.issue.number;
   const branch = branchName(r.issue);
@@ -1824,6 +2049,24 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
       return;
     }
 
+    // The claim-side of the pause fence (#651 review #3): the tick's pause
+    // gate sits above routing, so a tick that passed that gate before an
+    // operator wrote the freeze can still be mid-routing when the fence lands
+    // — it would claim after the setup barrier's acknowledgement and before
+    // its first mutation. The claim itself re-checks the pause and refuses,
+    // writing the durable admission acknowledgement the barrier waits for.
+    // A claim observed under the fence is the last admission boundary there
+    // is: nothing may create a run row beside a held fleet.
+    if (isPaused(d.project.name)) {
+      try {
+        writeAdmissionAck(d.project.name);
+      } catch (err) {
+        log(`admission acknowledgement write failed: ${errText(err)}`);
+      }
+      log(`#${issue} not claimed: dispatch is paused at claim time`);
+      return;
+    }
+
     // Claim on the STORE first, before anything that can fail. The run row —
     // not the label — is the crash-safe guard against double dispatch: rows
     // are local, written before any network call, and the startup orphan
@@ -2043,10 +2286,15 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
     // The continuation notice replaces the brief for a resumed attempt (#536).
     // The original brief is already in the resumed transcript; re-sending it is
     // how a resumed worker ends up re-doing the work it just did. Everything
-    // below the brief is fresh-dispatch-only, exactly as today.
+    // below the brief is fresh-dispatch-only, exactly as today — except the
+    // file lane admission enforced for this continuation, which rides the
+    // notice itself: the retained transcript's brief may show an earlier
+    // declaration, and a worker continuing under a stale lane is the collision
+    // the gate exists to stop (#608).
     let brief: string;
     if (resuming !== undefined) {
-      brief = ORPHAN_RESUME_PROMPT;
+      brief =
+        ORPHAN_RESUME_PROMPT + (admittedLane === undefined ? "" : resumeLaneBlock(admittedLane));
     } else {
       // The discussion is rendered at dispatch so a worker never depends on a
       // runtime `gh` read to see the orchestrator's grooming (#517). The read is
@@ -2068,6 +2316,7 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
           ? { salvagedSha: priorSalvage }
           : {}),
         comments,
+        lane: admittedLane,
       });
     }
     if (await settleStopBeforeSession()) return;
@@ -2535,6 +2784,749 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
   }
 }
 
+// ------------------------------------------------------------ review revisions
+
+/**
+ * The daemon half of the review-revision transport (#677): wake every pending
+ * revision the orchestrator's verb recorded, on the tick, exactly like
+ * admission — the verb has no handle on the worker machinery, and the CLI path
+ * must behave like the embedded one. Bounded by the same worker slots, so a
+ * queued revision can never push the fleet past `maxConcurrentWorkers`; the
+ * remaining rows stay pending for the next tick.
+ *
+ * The claim (`pushed-green` → `running`) is synchronous and atomic per row;
+ * only the resumed worker runs in the pool. A row that moved since the verb
+ * recorded it — merged after all, settled, re-claimed — fails the claim and is
+ * settled `skipped` rather than woken on stale identity.
+ */
+export async function dispatchReviewRevisions(d: Deps, pool?: WorkerPool): Promise<void> {
+  const pending = d.store.pendingReviewRevisions(d.project.name);
+  if (pending.length === 0) return;
+  const slots = Math.max(0, d.caps.maxConcurrentWorkers - d.store.liveRuns(d.project.name).length);
+  const batch = pending.slice(0, slots);
+  const launches: Promise<void>[] = [];
+  for (const revision of batch) {
+    if (d.drain?.draining === true) {
+      log(
+        `review revisions held: the daemon is draining (${batch.length - launches.length} of ${batch.length} not launched)`,
+      );
+      break;
+    }
+    if (!d.store.claimRunForReview(revision.runId)) {
+      d.store.settleReviewRevision(revision.id, "skipped", Date.now());
+      log(
+        `#${revision.issue} review round ${revision.round} skipped: run ${revision.runId} is no longer pushed-green`,
+      );
+      continue;
+    }
+    d.store.markReviewRevisionDispatched(revision.id, Date.now());
+    log(`#${revision.issue} review round ${revision.round} → resuming run ${revision.runId}`);
+    launches.push(handleReviewRevision(d, revision));
+  }
+  if (pool !== undefined) {
+    for (const launch of launches) pool.launch(launch);
+    return;
+  }
+  // `--once`: like admissions, the tick waits for the workers it launched.
+  await Promise.allSettled(launches);
+}
+
+/**
+ * Resume one review-revision worker: the run row is already claimed
+ * (`pushed-green` → `running` by the dispatch pass), so this resumes the SAME
+ * OMP session — same session directory, `resume: true` at the harness, and the
+ * `sessionFile` lineage compared at dispatch time — on the SAME branch and PR,
+ * then settles the row back the way {@link handleIssue} settles any worker.
+ *
+ * The run row is reused, never cloned: same attempt number, same prUrl, same
+ * transcript. That is what keeps a revision round off both budgets — the round
+ * is a state transition of one already-green row, green → running → green, and
+ * no new row exists for either counter to count. Only a revision worker that
+ * genuinely settles terminal falls through to the ordinary failure handling,
+ * budgets and all, exactly as today.
+ */
+export async function handleReviewRevision(d: Deps, revision: ReviewRevisionRecord): Promise<void> {
+  const { project, caps, tracker, store } = d;
+  const run = store.getRun(revision.runId);
+  if (run === undefined || run.state !== "running") {
+    log(
+      `#${revision.issue} review round ${revision.round} skipped: run ${revision.runId} is ${run?.state ?? "gone"} — ` +
+        "the row moved between the dispatch claim and the resume.",
+    );
+    store.settleReviewRevision(revision.id, "skipped", Date.now());
+    return;
+  }
+  const issue = run.issue;
+  const branch = run.branch;
+  const runId = run.id;
+  const inProgress = project.stateLabels.inProgress;
+  const repo = Object.values(project.routing.repos).find((candidate) => candidate.name === run.repo);
+  if (repo === undefined) {
+    log(`#${issue} review round ${revision.round} cannot dispatch: repo ${run.repo} is no longer routed`);
+    store.updateRun(runId, { state: "pushed-green", endedAt: Date.now() });
+    store.settleReviewRevision(revision.id, "skipped", Date.now());
+    return;
+  }
+  const mirrorPath = mirrorPathFor(repo, project.mirrorRoot);
+
+  // The session being resumed is the one the pushed-green row recorded. A
+  // revision without that transcript cannot continue the same session — the
+  // exact fake this feature exists to prevent — so fail loudly instead of
+  // silently starting a fresh one.
+  const priorSessionFile = run.sessionFile;
+  if (priorSessionFile === undefined || !existsSync(priorSessionFile)) {
+    log(
+      `#${issue} review round ${revision.round} cannot resume: the recorded transcript ` +
+        `${priorSessionFile ?? "(none)"} is gone`,
+    );
+    store.updateRun(runId, {
+      state: "pushed-green",
+      endedAt: Date.now(),
+      lastError: `review round ${revision.round} could not resume: the run's transcript is gone`,
+    });
+    store.settleReviewRevision(revision.id, "skipped", Date.now());
+    await safeEscalate(d, {
+      tier: 1,
+      project: project.name,
+      issue,
+      runId,
+      summary: `#${issue} review round ${revision.round} could not resume — the transcript is missing`,
+      detail: [
+        revision.prUrl,
+        "",
+        "The PR is still open and green; the run row was returned to pushed-green.",
+        "Resume the manual path (close + unblock + continuation) or merge it as it stands.",
+      ].join("\n"),
+    });
+    return;
+  }
+  const sessionDir = dirname(priorSessionFile);
+
+  let worktreePath: string | undefined;
+  let runRepo: RunRepoRef | undefined;
+  let turnLimit: TurnLimitController | undefined;
+  let workerControl: WorkerControlSlot | undefined;
+  let workerSessionInstalled = false;
+  let verbListener: VerbListener | undefined;
+  const repoSlug = githubRepo(repo.cloneUrl);
+
+  /**
+   * Publishes the run's branch on the privileged side: run repo → mirror →
+   * GitHub, fast-forward only — the same route `handleIssue` uses, so the
+   * revised head the worker pushed through its own `conductor_push` is
+   * re-verified against the remote before the tree dies.
+   */
+  const publish: RunPublisher = async () => {
+    if (runRepo === undefined) return { ok: false, stderr: "the run repository was never provisioned" };
+    return pushRunBranch(project, runRepo);
+  };
+
+  const settleStopBeforeSession = async (): Promise<boolean> => {
+    const reason = workerControl?.requestedStop();
+    if (reason === undefined || workerSessionInstalled) return false;
+    turnLimit?.close();
+    turnLimit = undefined;
+    recordOperatorStop(store, {
+      project: project.name,
+      issue,
+      runId,
+      inProgress,
+      reason,
+      patch: {
+        endedAt: Date.now(),
+        report: ["Operator stopped the review revision before its session started.", `Reason: ${reason}`].join("\n"),
+      },
+    });
+    store.settleReviewRevision(revision.id, "skipped", Date.now());
+    log(`#${issue} review round ${revision.round} stopped by operator before its session started: ${reason}`);
+    return true;
+  };
+
+  const settleDrainBeforeSession = async (): Promise<boolean> => {
+    if (d.drain?.draining !== true || workerSessionInstalled) return false;
+    turnLimit?.close();
+    turnLimit = undefined;
+    // A shutdown that interrupts the wake is the same situation as the
+    // provisioning-failure branch below, not an operator stop — nobody
+    // stopped anything, the PR is still green and still open, and only the
+    // wake failed; `settleStopBeforeSession` immediately above covers the
+    // case where an operator genuinely did. So mirror that branch: restore
+    // `pushed-green` naming the shutdown, settle the revision `skipped` so
+    // the round is not double-counted, and leave the in-progress label alone
+    // — the ordinary settle sweep releases it in the same breath it
+    // terminalises the row when the PR resolves. Stopping the row here would
+    // strand it: `settlePushedGreen` sweeps only pushed-* rows and
+    // classification excludes `stopped`, so the issue would carry neither
+    // label and nothing would ever revisit the still-green PR.
+    store.updateRun(runId, {
+      state: "pushed-green",
+      endedAt: Date.now(),
+      lastError: "daemon shutdown began after the review revision claim; the round was not launched",
+    });
+    store.settleReviewRevision(revision.id, "skipped", Date.now());
+    log(`#${issue} review round ${revision.round} not launched: daemon shutdown began after the claim`);
+    return true;
+  };
+
+  // Live-run controls, opened before any provisioning so the operator stop
+  // and shutdown fences cover the whole wake window, exactly as they do for a
+  // fresh claim in `handleIssue` (#374). The original run's entries were
+  // closed at its settle, so reopening by issue is safe.
+  turnLimit = d.turnLimits.open(project.name, issue, runId, run.maxTurns);
+  workerControl = d.workerControls.open(project.name, issue, runId);
+  if (await settleStopBeforeSession()) return;
+  if (await settleDrainBeforeSession()) return;
+
+  try {
+    // Reattach the run's own branch at the same per-issue path the run used:
+    // the worktree was removed at the pushed-green settle and the branch was
+    // published, so provisioning is the same continuation reattach as a
+    // normal re-claim. A provisioning failure restores the row — the PR is
+    // still green and still open, and only the wake failed — and says so.
+    try {
+      const provisioned = await addRunRepo(repo, project.mirrorRoot, project.workspaceRoot, issue, branch);
+      worktreePath = provisioned.path;
+      runRepo = { repo, runRepoPath: worktreePath, branch };
+    } catch (err) {
+      const detail = errText(err);
+      log(`#${issue} review round ${revision.round} cannot provision ${branch}: ${detail}`);
+      // An operator stop that landed during provisioning wins over restoration —
+      // it is a newer, explicit action, and the fences above already honoured
+      // one that landed earlier.
+      const pendingStop = workerControl?.requestedStop();
+      if (pendingStop === undefined) {
+        store.updateRun(runId, {
+          state: "pushed-green",
+          endedAt: Date.now(),
+          lastError: `review round ${revision.round} could not provision the worktree: ${detail}`,
+        });
+        store.settleReviewRevision(revision.id, "skipped", Date.now());
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue,
+          runId,
+          summary: `#${issue} review round ${revision.round} could not be dispatched — worktree provisioning failed`,
+          detail: [revision.prUrl, "", detail].join("\n"),
+        });
+      } else {
+        recordOperatorStop(store, {
+          project: project.name,
+          issue,
+          runId,
+          inProgress,
+          reason: pendingStop,
+          patch: {
+            endedAt: Date.now(),
+            report: [
+              `Operator stopped the review revision before its session started: ${pendingStop}`,
+              `(worktree provisioning also failed: ${detail})`,
+            ].join("\n"),
+          },
+        });
+        store.settleReviewRevision(revision.id, "skipped", Date.now());
+      }
+      return;
+    }
+    if (await settleStopBeforeSession()) return;
+    if (await settleDrainBeforeSession()) return;
+
+    // The fleet-owned omp settings overlay, staged under the SAME session
+    // directory the transcript lives in — a resumed session loads it exactly
+    // as the original run did (#537).
+    const ompSettingsFile = materializeOmpSettings(project, sessionDir);
+
+    // The run's mutation channel (#126): same run id, same issue, same repo —
+    // so `conductor_push` publishes the run's own branch and nothing else.
+    verbListener = await listenVerbChannel(
+      verbDeps(d),
+      {
+        kind: "run",
+        path: verbSocketPath(ensureVerbSocketDir(stateDir()), `run-${String(issue)}`),
+        project: project.name,
+        role: "worker",
+        runId,
+        issue,
+        repo,
+        runRepoPath: worktreePath,
+        branch,
+      },
+      { ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }) },
+    );
+    if (await settleStopBeforeSession()) return;
+    if (await settleDrainBeforeSession()) return;
+
+    store.updateRun(runId, { worktree: worktreePath });
+
+    // The row's own counters are cumulative across the revision: the revision
+    // worker meters its own session from zero, so its deltas are added to the
+    // totals the run already recorded.
+    const baseTurns = run.turns;
+    const baseSpend = run.spendUsd;
+
+    log(`#${issue} review round ${revision.round} → resuming ${branch} (${priorSessionFile})`);
+
+    let result: WorkerResult;
+    try {
+      result = await runWorker({
+        brief: renderReviewRevisionPrompt(revision.findings, revision.round),
+        cwd: worktreePath,
+        caps,
+        ...(repoSlug === undefined ? {} : { repoSlug }),
+        maxTurns: () => turnLimit?.maxTurns() ?? run.maxTurns,
+        onPauseControl: (control) => {
+          workerSessionInstalled = true;
+          workerControl?.install(control);
+        },
+        sessionDir,
+        // The same-session half of the transport: `continueRecent` on the run's
+        // own session directory, never a fresh `run-<uuid>` transcript.
+        resume: true,
+        socketPath: join(sessionDir, "ipc.sock"),
+        verbSocketPath: verbListener.path,
+        onSpawn: (pid) => {
+          verbListener?.bindPid(pid);
+        },
+        onChildLog: (line) => {
+          log(`#${issue} ${line}`);
+        },
+        // The continuation stays on the model the green run used (#286).
+        ...(run.model === undefined ? {} : { model: run.model }),
+        ...(ompSettingsFile === undefined ? {} : { ompSettingsFile }),
+        releaseGrants: resolveReleaseGrants(project),
+        onReleaseBlocked: workerReleaseBlockRecorder(project.name, issue, runId),
+        onTurn: (n) => store.updateRun(runId, { turns: baseTurns + n }),
+        onSpend: (usd) => store.updateRun(runId, { spendUsd: baseSpend + usd }),
+        onKilled: () => {
+          turnLimit?.close();
+          turnLimit = undefined;
+        },
+        onSessionFile: (f) => {
+          store.updateRun(runId, { sessionFile: f });
+          // Same-file lineage is the proof the resume happened: a revision
+          // that opened a different transcript fell back to a fresh session.
+          if (f !== priorSessionFile) {
+            log(
+              `#${issue} review round ${revision.round} resume fell back to a fresh session: opened ${f} ` +
+                `instead of ${priorSessionFile}`,
+            );
+          }
+        },
+        maySpawn: () => d.drain?.draining !== true,
+      }, d.workerDeps);
+    } finally {
+      turnLimit?.close();
+      turnLimit = undefined;
+    }
+
+    if (result.modelFallbackMessage !== undefined) {
+      log(`#${issue} review round ${revision.round} model fallback: ${result.modelFallbackMessage}`);
+    }
+
+    const verified: { state: RunState; reason?: string } =
+      result.state === "pushed-green"
+        ? await verifyPushedGreenClaim(tracker, result)
+        : { state: result.state };
+    const state = verified.state;
+
+    const settlement =
+      state === "pushed-green" || state === "pushed-pending" || state === "merged"
+        ? undefined
+        : await settleWorktree({
+            issue,
+            attempt: run.attempt,
+            ending:
+              state === "blocked"
+                ? "blocked for an operator decision"
+                : state === "stopped"
+                  ? `stopped by the operator: ${result.stoppedReason ?? "no reason recorded"}`
+                  : endedBy(result.killedBy),
+            worktree: worktreePath,
+            branch,
+            publish,
+            ...(state === "failed" || state === "killed"
+              ? ({ tree: "keep" } as const)
+              : ({ tree: "remove", mirrorPath } as const)),
+          });
+    if (settlement === undefined) {
+      const published = await publish(branch);
+      if (!published.ok) {
+        log(`#${issue} publish before removal failed, work is preserved in the mirror: ${published.stderr}`);
+      }
+      await removeWorktree(mirrorPath, worktreePath);
+    }
+
+    // The settlement report names the review round first (#692): a run that
+    // reaches green again after a round must read as a revision outcome, not
+    // as a fresh run's first push, and a round that failed must still say the
+    // round — the state and classification below carry the failure itself.
+    const finalReport = [
+      `review round ${revision.round}: ${state}`,
+      ...(verified.reason === undefined ? [] : ["", verified.reason]),
+      result.report,
+    ].join("\n");
+
+    const terminalPatch: Partial<RunRecord> = {
+      endedAt: Date.now(),
+      turns: baseTurns + result.turns,
+      spendUsd: baseSpend + result.spendUsd,
+      provider429Count: result.provider429Count,
+      ...(result.model === undefined ? {} : { resolvedModel: result.model }),
+      ...(result.provider === undefined ? {} : { resolvedProvider: result.provider }),
+      retryFallbacks: result.retryFallbacks,
+      retryFallbackSucceeded: result.retryFallbackSucceeded,
+      modelRecoveries: result.modelRecoveries,
+      autoRetryCount: result.autoRetryCount,
+      autoCompactionCount: result.autoCompactionCount,
+      // The worker only reports these when it actually established them; a
+      // failure whose report named no PR must not wipe what the row already
+      // owns (#468).
+      ...(result.prUrl === undefined ? {} : { prUrl: result.prUrl }),
+      ...(result.headSha === undefined ? {} : { headSha: result.headSha }),
+      sessionFile: result.sessionFile,
+      report: finalReport,
+      ...settlement?.patch,
+    };
+    if (state === "stopped") {
+      recordOperatorStop(store, {
+        project: project.name,
+        issue,
+        runId,
+        inProgress,
+        reason: result.stoppedReason ?? "no reason recorded",
+        patch: terminalPatch,
+      });
+    } else {
+      const sessionErr = state === "failed" || state === "killed" ? readSessionError(result.sessionFile) : undefined;
+      const providerCredit = sessionErr === undefined ? undefined : providerCreditRefusal(sessionErr);
+      const providerTransient =
+        providerCredit !== undefined || sessionErr === undefined ? undefined : providerTransientFault(sessionErr);
+      const lastError = completionLastError(providerCredit, providerTransient, verified.reason, sessionErr);
+      store.updateRun(runId, {
+        ...terminalPatch,
+        state,
+        ...(lastError === undefined ? {} : { lastError }),
+      });
+    }
+
+    const outcome: ReviewRevisionOutcome =
+      state === "pushed-green" ? "revised" : state === "pushed-pending" ? "pending" : "failed";
+    store.settleReviewRevision(revision.id, outcome, Date.now());
+    log(`#${issue} review round ${revision.round} ${state}${result.prUrl ? ` ${result.prUrl}` : ""}`);
+
+    // Post-settle outcomes, mirroring handleIssue: a failed or killed revision
+    // worker falls through to exactly the same label, requeue and escalation
+    // handling as any failed run — budgets included — and a blocked one pages
+    // the orchestrator for a decision.
+    if (state === "stopped") {
+      log(`#${issue} review round ${revision.round} stopped by operator: ${result.stoppedReason}`);
+    } else if (state === "blocked") {
+      swapLabel(store, project.name, issue, inProgress, project.stateLabels.blocked);
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue,
+        runId,
+        summary: `#${issue} is blocked on review round ${revision.round} and needs a decision`,
+        detail: [`${result.prUrl ?? "(no PR URL)"}`, "", result.report].join("\n"),
+      });
+    } else if (state === "failed" || state === "killed") {
+      const continuation = store.continuationsFor(project.name, issue);
+      const continueTurns = shouldContinueAfterTurnsCap({
+        killedBy: result.killedBy,
+        prUrl: result.prUrl,
+        headSha: result.headSha,
+        salvageSha: settlement?.patch?.salvageSha,
+        continuation,
+        maxContinuations: caps.maxContinuationsPerIssue,
+      });
+      if (continueTurns) {
+        store.enqueueLabelOps(project.name, [
+          { issue, op: "remove", label: inProgress },
+          { issue, op: "add", label: project.queueLabel },
+        ]);
+        log(
+          `#${issue} review round ${revision.round} turns-cap, continuation ` +
+            `${continuation}/${caps.maxContinuationsPerIssue} — salvaged and re-queued`,
+        );
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue,
+          runId,
+          summary: `#${issue} hit the turns cap on review round ${revision.round} — auto-requeued for continuation`,
+          detail: [
+            `${result.prUrl ?? "(no PR URL)"}`,
+            "",
+            "The queue label is back on; the next tick should reattach the branch",
+            "and open a continuation brief. No failed label was applied.",
+            "",
+            result.report,
+          ].join("\n"),
+        });
+      } else {
+        swapLabel(store, project.name, issue, inProgress, project.stateLabels.failed);
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue,
+          runId,
+          summary: result.killedBy
+            ? `#${issue} was killed on review round ${revision.round} by the ${result.killedBy} cap`
+            : `#${issue} failed on review round ${revision.round}`,
+          detail: [`${result.prUrl ?? "(no PR URL)"}`, "", result.report].join("\n"),
+        });
+      }
+    }
+  } catch (err) {
+    // A crash anywhere after the worker ran settles like any run's dispatch
+    // error: the row is terminal, the tree is kept, and the issue is relabelled
+    // so nobody silently re-claims it.
+    turnLimit?.close();
+    turnLimit = undefined;
+    const detail = errText(err);
+    log(`#${issue} review round ${revision.round} errored: ${detail}`);
+    const settlement =
+      worktreePath === undefined
+        ? undefined
+        : await settleWorktree({
+            issue,
+            attempt: run.attempt,
+            ending: "killed by a dispatch error",
+            worktree: worktreePath,
+            branch,
+            publish,
+            tree: "keep",
+          });
+    store.updateRun(runId, {
+      state: "failed",
+      endedAt: Date.now(),
+      lastError: detail,
+      ...settlement?.patch,
+    });
+    store.settleReviewRevision(revision.id, "failed", Date.now());
+    swapLabel(store, project.name, issue, inProgress, project.stateLabels.failed);
+    await safeEscalate(d, {
+      tier: 1,
+      project: project.name,
+      issue,
+      runId,
+      summary: `#${issue} review round ${revision.round} could not be dispatched`,
+      detail: [
+        `${revision.prUrl}`,
+        "",
+        detail,
+        ...(settlement?.lines ?? []),
+      ].join("\n"),
+    });
+  } finally {
+    turnLimit?.close();
+    if (verbListener !== undefined) {
+      try {
+        await verbListener.close();
+      } catch (err) {
+        log(`#${issue} verb socket ${verbListener.path} did not close cleanly: ${errText(err)}`);
+      }
+      verbListener = undefined;
+    }
+    workerControl?.close();
+    workerControl = undefined;
+  }
+}
+
+/**
+ * Restart recovery for in-flight review revisions (#692): a revision the
+ * previous daemon claimed (`pushed-green` → `running`) and lost when it died
+ * is restored to the exact state the orchestrator's verb left it in — same
+ * run, same PR, same findings, same round, same session file — so the next
+ * dispatch pass resumes the SAME OMP session rather than leaving the run to
+ * the failure classifier.
+ *
+ * Runs AFTER the startup orphan sweep, on purpose: the sweep has already
+ * salvaged the crashed revision's worktree to the branch (so no work is lost)
+ * and marked the row `orphaned` — and this reconcile then restores that row
+ * to `pushed-green` and re-queues the round before the first tick, so the
+ * failure classifier never sees it. That ordering matters twice over: an
+ * orphaned row would charge the continuation budget for a round that must
+ * stay off it (#677), and the `review_revisions` row is the only place the
+ * findings and round live. A revision the previous daemon never claimed (its
+ * run is still `pushed-green`, its row still pending) needs no restoration —
+ * the ordinary dispatch pass wakes it on the next tick, exactly as #677
+ * already guarantees.
+ *
+ * A round whose run cannot be restored — the run is gone, settled terminal,
+ * or its repo is no longer routed — fails closed instead: the revision is
+ * settled `skipped` with the findings still on the row, ONE escalation names
+ * what could not be restored, and no worker is started against a PR that may
+ * already have one.
+ */
+export async function reconcileCrashedReviewRevisions(d: Deps): Promise<ReviewRevisionRecord[]> {
+  const { project, store } = d;
+  const revisions = store.unsettledReviewRevisions(project.name);
+  if (revisions.length === 0) return [];
+  const recovered: ReviewRevisionRecord[] = [];
+  for (const revision of revisions) {
+    const run = store.getRun(revision.runId);
+    if (run === undefined) {
+      log(
+        `#${revision.issue} review round ${revision.round} cannot be restored across the restart: ` +
+          `run ${revision.runId} no longer exists`,
+      );
+      store.settleReviewRevision(revision.id, "skipped", Date.now());
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue: revision.issue,
+        runId: revision.runId,
+        summary: `#${revision.issue} review round ${revision.round} could not be restored across the restart`,
+        detail: [
+          revision.prUrl,
+          "",
+          "The daemon restarted while this review round was in flight and the round cannot be re-dispatched:",
+          `the run row ${revision.runId} no longer exists.`,
+          "The round was settled skipped; the findings stay on this revision's durable row.",
+          "Re-review the PR (it is still open and green) or merge it as it stands.",
+        ].join("\n"),
+      });
+      continue;
+    }
+    // A revision the previous daemon never claimed: the run is still a
+    // settled green row and the round is still pending, so the ordinary
+    // dispatch pass wakes it on the next tick untouched.
+    if (run.state === "pushed-green") continue;
+    // The run a previous daemon claimed for this round and died on: the
+    // orphan sweep just marked it `orphaned` (salvaging the tree to the
+    // branch), so restore it to the reviewable state the verb recorded.
+    const crashed =
+      run.state === "claimed" || run.state === "running" || run.state === "orphaned";
+    if (!crashed) {
+      log(
+        `#${revision.issue} review round ${revision.round} cannot be restored across the restart: run ` +
+          `${revision.runId} is ${run.state}`,
+      );
+      store.settleReviewRevision(revision.id, "skipped", Date.now());
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue: revision.issue,
+        runId: revision.runId,
+        summary: `#${revision.issue} review round ${revision.round} could not be restored across the restart`,
+        detail: [
+          revision.prUrl,
+          "",
+          "The daemon restarted while this review round was in flight and the round cannot be re-dispatched:",
+          `the run row is ${run.state}, not a state a review round resumes from.`,
+          "The round was settled skipped; the findings stay on this revision's durable row.",
+          "Re-review the PR (it is still open and green) or merge it as it stands.",
+        ].join("\n"),
+      });
+      continue;
+    }
+    try {
+      // The crashed revision's worktree — salvaged and published by the orphan
+      // sweep that just ran, so the branch in the mirror has every committed
+      // byte — must be gone before the next dispatch, or `addRunRepo` refuses
+      // the reattach as possibly holding a previous attempt's work (#692).
+      // `settleWorktree` with `tree: "remove"` re-attempts the salvage instead
+      // of trusting it (a tree whose salvage failed is the only copy of work
+      // and is NEVER removed), and refuses the removal if that re-attempt
+      // fails — the fail-closed half of this recovery.
+      if (run.worktree !== "" && existsSync(run.worktree)) {
+        const repo = Object.values(project.routing.repos).find((candidate) => candidate.name === run.repo);
+        if (repo === undefined) {
+          log(
+            `#${revision.issue} review round ${revision.round} cannot clear worktree ${run.worktree}: ` +
+              `repo ${run.repo} is no longer routed — the tree may hold the only copy of work`,
+          );
+          store.settleReviewRevision(revision.id, "skipped", Date.now());
+          await safeEscalate(d, {
+            tier: 1,
+            project: project.name,
+            issue: revision.issue,
+            runId: revision.runId,
+            summary: `#${revision.issue} review round ${revision.round} could not be restored across the restart`,
+            detail: [
+              revision.prUrl,
+              "",
+              "The daemon restarted while this review round was in flight and the round cannot be re-dispatched:",
+              `repo ${run.repo} is no longer routed, so the crashed revision's worktree cannot be published and removed.`,
+              `The worktree is retained for recovery: ${run.worktree}`,
+              "Recover it by hand (it may hold the round's last work), then re-review or merge the PR.",
+            ].join("\n"),
+          });
+          continue;
+        }
+        const settlement = await settleWorktree({
+          issue: run.issue,
+          attempt: run.attempt,
+          ending: "interrupted by a daemon restart during a review round",
+          worktree: run.worktree,
+          branch: run.branch,
+          publish: (branch) => pushRunBranch(project, { repo, runRepoPath: run.worktree, branch }),
+          tree: "remove",
+          mirrorPath: mirrorPathFor(repo, project.mirrorRoot),
+        });
+        if (settlement.retained) {
+          log(
+            `#${revision.issue} review round ${revision.round} worktree ${run.worktree} retained: ` +
+              "its salvage failed, so the tree is the only copy of work and will not be removed",
+          );
+          store.settleReviewRevision(revision.id, "skipped", Date.now());
+          await safeEscalate(d, {
+            tier: 1,
+            project: project.name,
+            issue: revision.issue,
+            runId: revision.runId,
+            summary: `#${revision.issue} review round ${revision.round} could not be restored across the restart`,
+            detail: [
+              revision.prUrl,
+              "",
+              "The daemon restarted while this review round was in flight and the round cannot be re-dispatched:",
+              "the crashed revision's worktree could not be salvaged, so it is the only copy of work and was retained.",
+              `Recover the tree by hand: ${run.worktree}`,
+              "Then re-review the PR (still open and green) or merge it as it stands.",
+            ].join("\n"),
+          });
+          continue;
+        }
+      }
+    } catch (err) {
+      // A settleWorktree throw (mirror unreachable, git refused) must not take
+      // the whole startup reconcile down with one run's tree: fail this round
+      // closed and let the next one try.
+      const detail = errText(err);
+      log(`#${revision.issue} review round ${revision.round} restore errored: ${detail}`);
+      store.settleReviewRevision(revision.id, "skipped", Date.now());
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue: revision.issue,
+        runId: revision.runId,
+        summary: `#${revision.issue} review round ${revision.round} could not be restored across the restart`,
+        detail: [revision.prUrl, "", detail].join("\n"),
+      });
+      continue;
+    }
+    // The exact state the verb recorded: a pushed-green row plus a pending
+    // revision whose durable row still carries the findings, reviewed head,
+    // round and target session. The next tick's dispatch pass claims and
+    // wakes it exactly like a revision that was never dispatched.
+    store.updateRun(revision.runId, {
+      state: "pushed-green",
+      endedAt: Date.now(),
+      worktree: "",
+      lastError: `review round ${revision.round} was restored across a daemon restart; the round is re-queued`,
+    });
+    store.requeueReviewRevision(revision.id);
+    log(
+      `#${revision.issue} review round ${revision.round} restored across restart: run ${revision.runId} ` +
+        "is pushed-green again and the round is re-queued — the next dispatch pass resumes the same session",
+    );
+    recovered.push(revision);
+  }
+  return recovered;
+}
+
 // ------------------------------------------------------------------- settlement
 
 /** What a resolved PR turns its `pushed-green` row into. */
@@ -3277,6 +4269,7 @@ const DEGRADED_HOLDS: ReadonlySet<AdmissionHoldReason> = new Set([
   "parent-lookup-error",
   "open-pr-lookup-error",
   "issue-state-lookup-error",
+  "critical-base-verify-error",
 ]);
 
 /** Groups transient decisions into the bounded record exposed by status. */
@@ -3632,6 +4625,15 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // so `last dispatch` keeps moving while the fleet is deliberately parked. A
   // frozen clock is then a stall report, not a hold (#497).
   if (isPaused(d.project.name)) {
+    // The held pass is the daemon-side admission acknowledgement: the daemon
+    // has reached its admission boundary under the fence and claims nothing.
+    // Written durably so the setup barrier can prove the fence was observed
+    // (#651 review #3) — a pause cannot acknowledge itself.
+    try {
+      writeAdmissionAck(d.project.name);
+    } catch (err) {
+      log(`admission acknowledgement write failed: ${errText(err)}`);
+    }
     d.store.recordDispatch(d.project.name, summarizeHeldPass(settled));
     return;
   }
@@ -3694,6 +4696,18 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     return;
   }
 
+  // Review revisions are dispatch, not admission (#677): the orchestrator's
+  // verb recorded them durably and the run row already occupies its issue, so
+  // they bypass the ready queue and the claim path entirely — this pass wakes
+  // them (bounded by the same worker slots) BEFORE the queue's capacity gate
+  // reads live runs, so a claimed revision counts against capacity exactly like
+  // the worker it is about to spawn.
+  try {
+    await dispatchReviewRevisions(d, workers);
+  } catch (err) {
+    log(`review revision dispatch failed: ${errText(err)}`);
+  }
+
   // route() filters the queue through isEligible() itself, so anything already
   // carrying a state label is gone before it gets here.
   const ready = await d.tracker.listReady();
@@ -3817,7 +4831,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   log(`dispatching ${pass.admitted.map((a) => `#${a.r.issue.number}`).join(" ")}`);
   await dispatchAdmissions(
     pass.admitted,
-    (a) => handleIssue(d, a.r, a.attempt),
+    (a) => handleIssue(d, a.r, a.attempt, a.lane),
     workers,
   );
 
@@ -4213,6 +5227,15 @@ export interface StatusSnapshot {
   releaseGrants: ResolvedGrants;
   /** Occupied issues: live workers plus green PRs awaiting a human merge. */
   activeRuns: RunRecord[];
+  /**
+   * runId → live review-revision round, for runs whose revision worker is
+   * currently dispatched (#692). Derived from the durable `review_revisions`
+   * rows, so the rendered `review-revision N` state rests on the same facts
+   * the restart recovery reads — never on a label or a guess. A plain object
+   * (not a Map) so the dashboard's JSON round-trip of the snapshot preserves
+   * it byte for byte.
+   */
+  reviewRounds?: Readonly<Record<string, number>>;
   /** Newest attempts holding a preserved WIP tip, or a tree that is still the
    *  only copy of work the daemon could not save. */
   salvagedRuns: RunRecord[];
@@ -4302,6 +5325,13 @@ export function statusSnapshotFromStore(
   // Read once: the provenance read touches the filesystem, and the renderer
   // should never pay for it twice per status.
   const reason = pauseProvenance(p.name)?.reason;
+  // The live review-revision rounds, read from the same durable rows the
+  // restart recovery uses: a run whose revision is dispatched is read as
+  // `review-revision N` while its worker is live (#692).
+  const reviewRounds: Record<string, number> = {};
+  for (const revision of store.unsettledReviewRevisions(p.name)) {
+    if (revision.dispatchedAt !== undefined) reviewRounds[revision.runId] = revision.round;
+  }
   return {
     project: p.name,
     configPath: configPath(),
@@ -4313,6 +5343,7 @@ export function statusSnapshotFromStore(
     caps,
     releaseGrants: resolveReleaseGrants(p),
     activeRuns: store.activeRuns(p.name),
+    reviewRounds,
     salvagedRuns: store.salvagedRuns(p.name),
     turnOverrides: store.listTurnOverrides(p.name),
     openReports: store.openReports(p.name),
@@ -4758,7 +5789,10 @@ export async function classifyAndRecover(d: Deps): Promise<number> {
           // table can tell an infra outage (#177) from a real test failure by
           // the log's own words. First failure wins; a log that cannot be
           // fetched is left undefined and classification stays conservative.
-          const firstFailure = facts.checks.find((c) => c.state === "failure" && c.link !== undefined);
+          // GitHub reports check states as `FAILURE` while the classifier reads
+          // them lowercased — normalise so the live seam and the table agree on
+          // which check is the failure whose log we pull (#177).
+          const firstFailure = facts.checks.find((c) => normalise(c.state) === "failure" && c.link !== undefined);
           if (firstFailure?.link !== undefined) {
             facts.failingLog = await tracker.checkLog(firstFailure.link);
           }
@@ -4791,6 +5825,154 @@ export async function classifyAndRecover(d: Deps): Promise<number> {
   return settled;
 }
 
+/**
+ * How many settled `ci-deterministic` rows one reconciliation pass may
+ * re-examine beyond the persisted review cursor. Each candidate costs GitHub
+ * calls to re-fetch the evidence its check log carried, so a fleet with a
+ * long misclassified history works through it over several daemon starts
+ * rather than spending one boot's budget on all of it (#638).
+ */
+const HISTORICAL_INFRA_BATCH = 20;
+
+/** How many workflow runs for the head commit one row's evidence pass reads —
+ *  and the ceiling past which the row is refused as undecided rather than
+ *  decided from a prefix of its head-pinned runs (review #654). */
+const HISTORICAL_INFRA_RUNS = 3;
+
+/** How many attempts of one workflow run may be read for the failed log — and
+ *  the ceiling past which the run is refused as undecided rather than read as
+ *  a prefix that could hide a later attempt's real failure (review #654). A
+ *  failed job rerun to green leaves the failure in an earlier attempt; the
+ *  bound keeps one pathological run from costing the whole pass. */
+const HISTORICAL_INFRA_ATTEMPTS = 5;
+
+/**
+ * Repair settled `ci-deterministic` rows whose re-fetched check log carries a
+ * closed infrastructure signature (#638). The forward classifier now names
+ * the codeload setup 429 of #177 `ci-infra`, but a row already classified
+ * `ci-deterministic`/`escalate` never re-enters the classification sweep, so
+ * the old verdict charges an implementation attempt forever. Re-fetching the
+ * head-pinned workflow-run attempt logs through the tracker, matching the
+ * classifier's own closed signature list, and reclassifying `failureClass`
+ * alone returns the attempt without re-animating a months-old run into
+ * recovery.
+ *
+ * Bounded, idempotent and resumable: one batch per call, reclassifications
+ * only, and the store's update is guarded by the row still reading
+ * `ci-deterministic`, so a second pass touches nothing it already repaired.
+ * The batch resumes below a persisted review cursor, so each row is evaluated
+ * once rather than rescanning the newest non-matches forever and starving
+ * older repairable rows. A row whose evidence could not be read is a
+ * no-mutation refusal: the cursor never advances past it, so the next pass
+ * asks again; a row that was read and shown *not* to be infrastructure
+ * advances the cursor. Every repair requires *all* gathered failed logs to
+ * carry an infra signature — a setup 429 in one attempt must not waive a
+ * compile/test failure in a sibling attempt.
+ *
+ * Returns how many rows it repaired, for the boot log.
+ */
+export async function reconcileHistoricalInfra(d: Deps): Promise<number> {
+  const { project, store } = d;
+  const version = infraSignatureVersion();
+  const persisted = store.historicalInfraCursor(project.name);
+  // A cursor stamped by an older signature list is stale: the classifier now
+  // recognises more evidence, so the pass restarts from the newest row rather
+  // than skipping past newly repairable history (#638).
+  const cursor =
+    persisted !== undefined && persisted.classifierVersion === version
+      ? { startedAt: persisted.startedAt, rowid: persisted.rowid }
+      : undefined;
+  const candidates = store.historicalInfraCandidates(project.name, HISTORICAL_INFRA_BATCH, cursor);
+  let repaired = 0;
+  let lastDecided: { startedAt: number; rowid: number } | undefined;
+  for (const run of candidates) {
+    const chunks = await historicalInfraEvidence(d, run);
+    // Unreachable evidence is undecided exactly like a fresh classifier is: a
+    // no-mutation refusal the next pass asks again, and the cursor stops here
+    // so the row is re-offered rather than being skipped past.
+    if (chunks === undefined) break;
+    lastDecided = { startedAt: run.startedAt, rowid: run.rowid };
+    // The head's runs were read and none holds a failing log — determinately
+    // not infrastructure, so an old misclassified verdict stays charged.
+    if (chunks.length === 0) continue;
+    // Mixed guard: anything gathered that is not itself a closed infra
+    // signature (a compile/test failure in a sibling attempt, a product 429)
+    // refuses the whole row. One setup 429 is not permission to waive a real
+    // implementation failure.
+    if (!chunks.every((chunk) => infraLogSignature(chunk) !== undefined)) continue;
+    if (store.reclassifyInfra(run.id)) {
+      repaired += 1;
+      // The every-guard above guarantees a signature and a first chunk; the
+      // non-null assertions make the same fact readable to the type checker.
+      log(
+        `#${run.issue} repaired historical ${run.failureClass ?? "ci-deterministic"} → ci-infra (run ${run.id}): ` +
+          `"${infraLogSignature(chunks[0]!)}" in the failed check log`,
+      );
+    }
+  }
+  if (lastDecided !== undefined) {
+    store.setHistoricalInfraCursor(
+      project.name,
+      lastDecided.startedAt,
+      lastDecided.rowid,
+      version,
+    );
+  }
+  return repaired;
+}
+
+/**
+ * The failed check logs of a settled `ci-deterministic` row, head-pinned to
+ * the exact commit the row ran against, or `undefined` when the evidence is
+ * unreachable (#638). Only the workflow-run history at `run.headSha` is
+ * evidence: the PR's *current* check rollup is not, because a later push's
+ * checks must never classify an earlier run's row. `workflowRunsAt` is itself
+ * head-scoped, and each run's failed attempts are read through the tracker's
+ * guarded runner (call/refusal accounting and the rate-limit breaker apply).
+ *
+ * Returns the per-failed-job failed logs gathered across the head's runs (one
+ * chunk per failed job, full and untruncated), or `undefined` when any read
+ * could not be made — the run register, an attempt's job register, a failed
+ * job's log, or the head-run list itself — or when a bounded evidence set
+ * exceeded its limit (more head-pinned runs than `HISTORICAL_INFRA_RUNS`, or
+ * more attempts than `HISTORICAL_INFRA_ATTEMPTS`). Undefined is a no-mutation
+ * refusal the next pass asks again; the cursor never advances past it. `[]`
+ * means the head's runs were read and none holds a failing log — a
+ * determinately non-infrastructure answer.
+ */
+async function historicalInfraEvidence(d: Deps, run: RunRecord): Promise<string[] | undefined> {
+  // Without a head SHA there is no safe way to pin evidence to this row; a
+  // head-less row is determinately not a repair candidate, so it advances the
+  // cursor rather than stalling the pass.
+  if (run.headSha === undefined) return [];
+  const target = d.project.routing.repos[run.repo];
+  const repoIdentity = target === undefined ? undefined : githubRepo(target.cloneUrl);
+  if (repoIdentity === undefined) return [];
+  let runs: WorkflowRun[] | undefined;
+  try {
+    runs = await d.tracker.workflowRunsAt(repoIdentity, run.headSha);
+  } catch {
+    return undefined;
+  }
+  if (runs === undefined) return undefined;
+  // Refuse rather than decide from the first `HISTORICAL_INFRA_RUNS`: three
+  // setup-429 runs must not waive a row whose fourth head-pinned run carries
+  // the real compile/test failure (review #654). Undecided means the cursor
+  // never advances past this row, so the next pass asks again.
+  if (runs.length > HISTORICAL_INFRA_RUNS) return undefined;
+  const chunks: string[] = [];
+  for (const wf of runs) {
+    const logs = await d.tracker.runFailedAttemptLogs(
+      repoIdentity,
+      wf.url,
+      HISTORICAL_INFRA_ATTEMPTS,
+    );
+    if (logs === undefined) return undefined;
+    chunks.push(...logs);
+  }
+  return chunks;
+}
+
 /** Performs the one action a class names. Never chooses one of its own. */
 async function recoverRun(
   d: Deps,
@@ -5450,12 +6632,17 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
       log(projects.length === 1 ? message : `[${project.name}] ${message}`);
     };
     const caps = resolveCaps(project, cfg.defaults);
+    // One transient-server-error breaker per project (#642): admission's
+    // GraphQL checks and the orchestrator mutation commands share it, so a 503
+    // observed by either side gates both instead of one provider outage being
+    // re-asked by every candidate AND every mutation.
+    const graphqlBreaker = new GraphqlBreaker();
     const tracker = makeTracker(project, undefined, {
       onCall: () => store.bumpGhCalls?.(utcDay(), "daemon"),
       onRefusal: (at) => store.recordGhRefusal?.(at),
       onNotModified: () => store.bumpGhCalls?.(utcDay(), "daemon-304"),
-    });
-    const verbActions = githubVerbActions(project);
+    }, { graphqlBreaker });
+    const verbActions = githubVerbActions(project, undefined, undefined, graphqlBreaker);
 
     if (alive === undefined || alive.pid === process.pid) {
       const orphanPublisher = (run: RunRecord): RunPublisher => {
@@ -5604,6 +6791,26 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
       verbActions,
     };
     runtimeDeps = d;
+    // Review-revision restart recovery (#692): a revision the previous daemon
+    // claimed and lost — its run is `running`/`orphaned` by the orphan sweep
+    // above — is restored to `pushed-green` and re-queued so this process's
+    // first dispatch pass resumes the exact session. Runs under the same
+    // dead-daemon guard as `reconcileOrphanedRuns`, and after it, so the
+    // revision's worktree has already been salvaged to the branch before it is
+    // cleared for a fresh reattach. A round that cannot be restored was
+    // settled and escalated by the reconcile itself.
+    if (alive === undefined || alive.pid === process.pid) {
+      try {
+        for (const revision of await reconcileCrashedReviewRevisions(d)) {
+          projectLog(
+            `#${revision.issue} review round ${revision.round} recovered across restart — ` +
+              `run ${revision.runId} is pushed-green again and awaits its next dispatch pass`,
+          );
+        }
+      } catch (err) {
+        projectLog(`review revision restart recovery failed: ${errText(err)}`);
+      }
+    }
     // Startup reconciliation: close an incident carried over from a previous
     // process when the orchestrator is up (one recovery notice), or open one
     // when it failed to start (one down page). A daemon restarted while still
@@ -5625,6 +6832,21 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     });
   }
 
+  // Historical budget repair (#638): one bounded pass per daemon process,
+  // before the first tick, so admission and `unblock` read the repaired counts
+  // from the moment the daemon starts. A classifier fix changes future
+  // verdicts but not rows already settled under the old one; re-fetching their
+  // failed check logs and reclassifying the exact closed infrastructure
+  // signature returns those attempts without re-animating the runs. Best-effort
+  // per project — one unreachable project must not stop the rest from booting.
+  for (const runtime of runtimes) {
+    try {
+      await reconcileHistoricalInfra(runtime.d);
+    } catch (err) {
+      log(`historical infra reconciliation failed: ${errText(err)}`);
+    }
+  }
+
   if (o.once) {
     try {
       for (const runtime of runtimes) await tick(runtime.d, workers);