omp-conductor 0.17.0 → 0.18.0

package/REFERENCE.md

@@ -1078,11 +1078,15 @@ omp-conductor setup graph --print     # print the plan: clones, index commands,
 omp-conductor setup graph             # run it: clone, install, enable, seed, verify
 ```
 
-`setup graph --print` prints a `git clone` for every clone that does not exist yet, the
-one-shot index command per repo, and a `cbm-reindex.service` + `cbm-reindex.timer`
-pair built from the project's own repos and branches. `--write` stages all three
-in the state directory and prints the two `sudo` lines that install and enable
-them; it never runs `systemctl`.
+`setup graph --print` prints the plan: the host prerequisites, a `git clone` for
+every clone that does not exist yet, the one-shot index command per repo, and
+this project's `cbm-reindex-<project>.sh` script plus `cbm-reindex-<project>.service`
++ `cbm-reindex-<project>.timer` unit pair, named for the project so a second
+project on the same host gets its own refresh instead of silently replacing the
+first project's (#720). A run stages those three files in the state directory
+**only after its consent prompt** — declining leaves the staged tree
+byte-identical — then clones, installs and enables the timer as root, seeds one
+indexing run, and verifies; it never runs `systemctl` on its own authority.
 
 **Run it as the account the fleet runs as, never under `sudo`** — it refuses if
 you try. Everything it derives resolves per-account: the config it loads, the
@@ -1864,7 +1868,7 @@ policy instead of restating it — no threshold lives in two places.
 
 | Field | Values | Default | Means |
 | --- | --- | --- | --- |
-| `requires` | `runs-settled`, `no-open-prs`, `queue-drained`, `base-branch-green`, `epic-children-closed` | `["runs-settled"]` | What must already have landed. `runs-settled` reads each active run's PR fact at release time: a pushed run whose PR has merged counts as settled even when the settle sweep has not yet written the terminal row — so a hold-drained release does not wait an extra tick the operator reached the gate by holding. Live workers and unmerged/unknown PRs still refuse, and the message names which is which. `base-branch-green` requires the current live head's push-triggered workflow verdict for that routed repository to be green; pending, unknown, red, or no observation refuses release. Order and duplicates do not matter; the loader canonicalises. |
+| `requires` | `runs-settled`, `fleet-runs-settled`, `no-open-prs`, `queue-drained`, `base-branch-green`, `epic-children-closed` | `["runs-settled"]` | What must already have landed. `runs-settled` reads each active run of the released repo's PR fact at release time: a pushed run whose PR has merged counts as settled even when the settle sweep has not yet written the terminal row — so a hold-drained release does not wait an extra tick the operator reached the gate by holding. Runs in other routed repos never gate a repo-scoped release — they cannot invalidate the artifact being shipped; a genuinely suite-wide shape (a pin or manifest consuming several repos) opts back into project-wide strictness with the named `fleet-runs-settled` requirement. Live workers and unmerged/unknown PRs still refuse, the message names which is which and which runs are blocking by repo and issue. `base-branch-green` requires the current live head's push-triggered workflow verdict for that routed repository to be green; pending, unknown, red, or no observation refuses release. Order and duplicates do not matter; the loader canonicali…
 | `requiredChecks` | any check names | `[]` | Checks that must be green on the branch being released. Empty means every check it reports. |
 | `artefacts` | any names | `[]` | The packages or images this project releases. **Empty denies**: nothing has been authorised to ship. |
 | `environments` | any names | `[]` | Deploy targets. **Empty denies** every environment. |
@@ -2255,7 +2259,7 @@ omp-conductor help
 | --- | --- | --- |
 | `setup [area] [--no-ai] [--answers FILE] [--save-answers FILE] [--project NAME]` | project | The deterministic interview, with styled Clack prompts on an interactive TTY and byte-stable plain output for pipes or `OMP_CONDUCTOR_PLAIN_UI=1`. `--answers` validates a JSON object of stable prompt keys before setup and replaces every prompt; a missing required key exits `1` naming the key and file instead of hanging. `--save-answers` records accepted interactive answers as replayable JSON after a successful run. Bare setup is a full first run, or — when the project already exists — a chooser of which area to amend. Naming an area positionally skips that chooser and amends only that area: `tracker`, `gates`, `caps`, `code-graph`, `authority`, `policy`, `escalation`, `reporting`, `brief`. `host` and `graph` are install subcommands rather than areas and are matched first; anything else exits `2` listing both vocabularies. Every prompt shows its current value as the default, and Enter accepts what you see; `Ctrl-C` at any prompt abandons the run and writes nothing. Setup also **reads your repos to propose answers**: the gates prompt is pre-filled from what CI actually runs, and the brief's `## Project context` and release procedure are drafted from every routing repo and shown for confirmation before anything is written. Each probe is a short session with **no shell, no editor and no verbs** in a throwaway shallow clone, and every answer is a proposal you edit or decline — a probe that cannot clone, cannot reach a model, or answers unusably costs you one warning and the shipped stub. `--no-ai` asks every question with the reading half removed. |
 | `setup host [--project NAME]` | host | Re-render and stage the systemd unit, then **run** the install: `install -m 0644` into `/etc/systemd/system`, `daemon-reload`, `enable`, `restart`. Stages the fleet recovery oneshot (`omp-conductor-recover.service`) and its playbook (`/usr/local/sbin/omp-conductor-recover`) alongside, and installs them **before** the fleet units: both fleet units carry `OnFailure=` to the recovery unit, so a crash-looped daemon or herdr session now collects evidence durably, attempts one bounded recovery, and pages tier-2 instead of dying silently (#485). Every command is shown with its exact argv, one confirm covers the batch, and `sudo` asks for your password once before the first step — or is skipped entirely on a fleet that genuinely runs as root. The first failure stops the rest and prints the un-run remainder verbatim so you can finish by hand. Refuses an *escalated* invocation (`sudo`, or `sudo -i`/`su -` detected by the invoking account disagreeing with the fleet's) before writing anything, naming both accounts, because staging derives the unit's `User=`/`HOME=` from whoever ran it. On a non-Linux host the files are still staged and only the `systemctl` steps are refused. |
-| `setup graph [--no-seed] [--print] [--project NAME]` | project | The code-graph install end to end, in one preview and one confirm: check the prerequisites read-only and stop before installing anything when `codebase-memory-mcp` is absent or no MCP entry mounts it (printing the entry to add); `git clone` each missing index-only checkout **as you, never through sudo**; install and enable `cbm-reindex.timer` as root; then seed one indexing run so the first fetch happens while you watch, and verify with the same probe `status` uses. A repo that does not verify is a failure with the remediation, not a success — staged-but-not-trusted is how you discover months later that no worker read an index. `--no-seed` enables the timer without the seeding run and says plainly the graph is unusable until it first fires; it never skips the prerequisite or clone steps. `--print` changes nothing. Exits `1` when no repo has [`graphProject`](#configuration). |
+| `setup graph [--no-seed] [--print] [--project NAME]` | project | The code-graph install end to end, in one preview and one confirm: check the prerequisites read-only and stop before installing anything when `codebase-memory-mcp` is absent or no MCP entry mounts it (printing the entry to add); stage this project's `cbm-reindex-<project>.{sh,service,timer}` **after** the confirm — never before, so a declined run leaves the staged tree byte-identical — refusing a stem that already belongs to another project or to a file it did not generate (#720); `git clone` each missing index-only checkout **as you, never through sudo**; install and enable `cbm-reindex-<project>.timer` as root; then seed one indexing run so the first fetch happens while you watch, and verify with the same probe `status` uses. A repo that does not verify is a failure with the remediation, not a success — staged-but-not-trusted is how you discover months later that no worker read an index. `--no-seed` enables the timer without the seeding run and says plainly the graph is unusable until it first fires; it never skips the prerequisite or clone steps. `--print` changes nothing. Exits `1` when no repo has [`graphProject`](#configuration). |
 | `start` | host | Start `herdr-fleet.service` when that optional unit is installed, clearing a previous pane-recovery pin, then start the dispatch daemon and wait until it answers `GET /healthz`. When `omp-conductor.service` is installed, systemd is the only start path: even `start --project NAME` restores the shared unit and uses the name only to verify that `/healthz` serves the requested project. A detached daemon is allowed only when the unit is proven absent. It never clears pause or arms ticks. Refuses if a daemon is already live, naming its pid; manager refusal or unprovable ownership is an error rather than a detached fallback. |
 | `stop` | fleet | Prefer `systemctl stop omp-conductor.service` when that unit's MainPID is the live daemon — systemd then owns the stop and will not schedule a restart for the exit it just requested. Otherwise `SIGTERM`, then `SIGKILL` after a 10-second grace period. Prints `not running` when there is nothing to stop, and tags the confirmation with `(via systemctl)` when the unit path was used. |
 | `restart [--now] [--timeout SECONDS] [--port N] [--project NAME]` | host | Drains the fleet by default: pause new claims, wait until live workers reach `0 / N` (bounded by `--timeout SECONDS`, default 1800 = 30 min), restart, then restore the prior dispatch state. A daemon serving multiple configured projects makes restart host-wide: `--project` is rejected because draining one queue and restarting the shared process would kill another project's workers. Prefer `systemctl restart` when the unit owns the live pid so the replacement stays supervised; only a host proven not to have the installed unit may fall back to the standalone stop/start path. `--now` skips the drain and restarts immediately, orphaning any live runs (old behaviour). A drain that hits `--timeout` restarts nothing and leaves dispatch paused — `omp-conductor resume` lifts it, or re-run `restart` to keep waiting. The new process **salvages dirty live worktrees before orphaning** those rows — see [Deploying a new package onto a busy fleet](#deploying-a-new-package-onto-a-busy-fleet). |
@@ -2355,7 +2359,7 @@ curl -s localhost:8787/healthz
         "configured": true,
         "status": "degraded",
         "checkedAt": "2026-08-08T13:00:00.000Z",
-        "prerequisites": { "indexer": "present", "mcpMount": "missing" },
+        "prerequisites": { "indexer": "present", "mcpMount": "unconfigured" },
         "repos": [
           {
             "name": "api",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/schema/config.schema.json

@@ -136,7 +136,8 @@
             "properties": {
               "inProgress": {},
               "blocked": {},
-              "failed": {}
+              "failed": {},
+              "backlog": {}
             },
             "additionalProperties": false
           },
@@ -325,6 +326,43 @@
             },
             "additionalProperties": false
           },
+          "arm": {
+            "type": "object",
+            "properties": {
+              "proof": {
+                "default": "challenge",
+                "type": "string",
+                "enum": [
+                  "challenge",
+                  "claim-only"
+                ]
+              }
+            },
+            "additionalProperties": false,
+            "description": "How `arm` proves a human just approved arming"
+          },
+          "review": {
+            "type": "object",
+            "properties": {
+              "strictness": {
+                "default": "medium",
+                "type": "string",
+                "enum": [
+                  "low",
+                  "medium",
+                  "high"
+                ]
+              },
+              "maxRounds": {
+                "default": 3,
+                "type": "integer",
+                "minimum": 1,
+                "maximum": 6
+              }
+            },
+            "additionalProperties": false,
+            "description": "Review strictness and round ceiling for green PRs"
+          },
           "authority": {
             "type": "object",
             "properties": {
@@ -433,6 +471,7 @@
                       "type": "string",
                       "enum": [
                         "runs-settled",
+                        "fleet-runs-settled",
                         "no-open-prs",
                         "queue-drained",
                         "base-branch-green",

package/src/admission.ts

@@ -19,6 +19,7 @@ import { log, errText, safeEscalate } from "./log.ts";
 import type {
   Caps,
   Escalation,
+  IssueComment,
   IssueSnapshot,
   OpenCloser,
   ProjectConfig,
@@ -28,10 +29,11 @@ import type {
   AdmissionHoldReason,
 } from "./types.ts";
 import { readPlanUsage, type PlanUsageStatus, type UsageSource } from "./usage.ts";
-import type { CriticalBaseProbe, CriticalBaseVerdict, RunLaneProbe } from "./gitops.ts";
+import type { CriticalBaseProbe, CriticalBaseVerdict, LaneFile, LaneSource, RunLaneProbe } from "./gitops.ts";
 import { repoSlugFor } from "./gitops.ts";
 import { branchName, type Routed } from "./routing.ts";
-import { parseDependsOn } from "./depends-on.ts";
+import { parseDependsOn, buildDependencyCycles } from "./depends-on.ts";
+import type { DependencyCycle, DependencyNodeReader } from "./depends-on.ts";
 
 /** Fleet-wide escalations still need an issue number in the payload; 0 is the
  *  sentinel that reads as "no issue" in every renderer. */
@@ -63,6 +65,16 @@ export interface AdmissionDeps {
    * prerequisite closed too — the daemon always wires it.
    */
   probeIssueIn?: (repo: string, issue: number) => Promise<IssueSnapshot | undefined>;
+  /**
+   * Reads one issue's BODY in a repository the admission tracker is NOT bound
+   * to — the cross-repo half of the dependency-graph cycle pass (#421). The
+   * tracker bound to `project.tracker.repo` already answers same-repo bodies
+   * via {@link Tracker.issueBody}; a reachable prerequisite body in a routed
+   * repo goes through this. Undefined means "could not tell"; unset, a routed
+   * reachable body fails that branch closed (no false cycle), exactly like
+   * {@link Tracker.issueBody}. The daemon always wires it.
+   */
+  probeBodyIn?: (repo: string, issue: number) => Promise<string | undefined>;
 }
 /** `stops` are the operational ends that each require one resume. */
 export function hasContinuationBudget(stops: number, maxContinuations: number): boolean {
@@ -77,10 +89,16 @@ export function hasFailedAttemptBudget(failures: number, maxAttempts: number): b
   return failures < maxAttempts;
 }
 
-/** A candidate cleared for dispatch, with the attempt number it will run as. */
+/** A candidate cleared for dispatch, with the attempt number it will run as.
+ *  `lane` is the effective file-lane declaration admission resolved for it
+ *  (#608): the exact snapshot the overlap gate enforced. Dispatch renders this
+ *  value into the worker brief, so a changed or failed second comment read can
+ *  neither hide nor reword the lane admission held — the gate and the
+ *  worker-visible brief are one value, not two reads of the same thread. */
 export interface Admission {
   r: Routed;
   attempt: number;
+  lane?: FileLane;
 }
 
 export interface AdmissionHold {
@@ -174,27 +192,94 @@ function planUsageEscalation(project: string, plan: PlanUsageStatus): Escalation
  * files an issue declares it will touch (#555).
  *
  * The orchestrator already writes exactly this list into every promotion brief
- * in prose; this parses that same sentence out of the issue body so the
- * interlock is load-bearing rather than advisory. A body line beginning with
- * "file lane" (case-insensitive, optional bold/heading markers) is accepted,
- * and paths are read as backtick-delimited spans (the brief form) with a bare
- * comma/space-separated fallback that keeps tokens that look like relative
- * paths. Anything else — including an absent line, which is the default — is
- * an empty lane: the issue is admitted exactly as today (`fail open`), and the
- * gate never refuse work for wanting a lane. Exported so the format is pinned
- * independent of admission.
+ * in prose; this parses that same sentence out of the issue body — or out of a
+ * pre-dispatch comment, which is the same sentence on a supported brief
+ * surface since #517 — so the interlock is load-bearing rather than advisory.
+ * A line beginning with "file lane" (case-insensitive, optional
+ * bold/heading markers) is accepted, and paths are read as backtick-delimited
+ * spans (the brief form) with a bare comma/space-separated fallback that keeps
+ * tokens that look like relative paths. A line whose tokens are not pathlike
+ * (like `File lane: none`) is not a declaration. Anything else — including an
+ * absent declaration, which is the default — is an empty lane: the issue is
+ * admitted exactly as today (`fail open`), and the gate never refuses work for
+ * wanting a lane. This is the one grammar for all surfaces; there is no second
+ * comment-only spelling.
  */
-export function declaredLane(body: string): string[] {
-  const match = body.match(
+export function laneDeclaration(text: string): LaneDeclaration | undefined {
+  const match = text.match(
     /^\s*(?:[#>*-]\s*)*file[- ]lane\s*[:=]\s*([^\n]*)$/im,
   );
-  if (match === null) return [];
+  if (match === null) return undefined;
   const rest = match[1] ?? "";
   const backticked = [...rest.matchAll(/`([^`]+)`/g)]
     .map((m) => m[1]!.trim())
     .filter(isPathLike);
-  if (backticked.length > 0) return [...new Set(backticked)];
-  return [...new Set(rest.split(/[,\s]+/).map((s) => s.trim()).filter(isPathLike))];
+  const files =
+    backticked.length > 0
+      ? [...new Set(backticked)]
+      : [...new Set(rest.split(/[,\s]+/).map((s) => s.trim()).filter(isPathLike))];
+  if (files.length === 0) return undefined;
+  return { files, source: match[0].trim() };
+}
+
+/** One parsed `File lane:` declaration: the paths and the verbatim source
+ *  line, so a renderer can reproduce the declaration itself rather than a
+ *  summary of it. Exported for the brief's guarantee that the gate's effective
+ *  lane is always visible to the worker (#608). */
+export interface LaneDeclaration {
+  files: string[];
+  /** The declaration line verbatim, as written on the surface it came from. */
+  source: string;
+}
+
+/**
+ * The effective file lane as both admission and the worker brief must read it
+ * (#608): the latest `File lane:` declaration among the issue body and every
+ * comment, in the tracker's oldest-first order. This is the "later correction
+ * visibly supersedes" contract applied across both surfaces at once, and it is
+ * the single source of truth the gate enforces and the brief renders — so a
+ * declaration can never control admission while staying invisible to the
+ * worker. `at` records which surface won (`"body"`, or the 0-based comment
+ * index), letting the brief reproduce the declaration verbatim when the
+ * winning comment sits beyond its rendered discussion budget.
+ */
+export interface FileLane extends LaneDeclaration {
+  at: "body" | number;
+}
+
+/** Who holds one file's lane this admission pass, and which read proved it.
+ *  `"declared"` is the same-pass half: an admitted candidate's own lane
+ *  occupies for the rest of the pass without any probe read. */
+export type LaneHolder = { issue: number; source: LaneSource | "declared" };
+
+/** Resolves the effective lane across the body and the whole comment thread. */
+export function effectiveLane(body: string, comments: IssueComment[]): FileLane | undefined {
+  let current: FileLane | undefined;
+  const bodyDecl = laneDeclaration(body);
+  if (bodyDecl !== undefined) current = { ...bodyDecl, at: "body" };
+  for (let i = 0; i < comments.length; i++) {
+    const decl = laneDeclaration(comments[i]!.body);
+    if (decl !== undefined) current = { ...decl, at: i };
+  }
+  return current;
+}
+
+/** The paths of an issue body's declared lane (empty for no declaration).
+ *  Exported so the format is pinned independent of admission. */
+export function declaredLane(body: string): string[] {
+  return laneDeclaration(body)?.files ?? [];
+}
+
+/**
+ * The file lane as one line, for surfaces where a human asserts the claim
+ * (#724): the parsed file list exactly as admission will enforce it, or the
+ * explicit fail-open note when nothing parsed. Verbatim parser output only —
+ * a paraphrase would hide the very over-parse (#720) or under-parse (#684)
+ * this echo exists to surface.
+ */
+export function laneEcho(lane: LaneDeclaration | undefined): string {
+  if (lane === undefined) return "no lane declared (fail open)";
+  return lane.files.join(", ");
 }
 
 /** A plausible relative path: it has a `.` extension or a directory separator. */
@@ -271,14 +356,14 @@ export async function admitCandidates(
   // and one on the web repo are different files. Built lazily and once, only
   // when the first candidate that declares a lane reaches the gate, so a queue
   // of laneless issues pays nothing for it.
-  let laneOccupancy: Map<string, Map<string, number>> | undefined;
-  const ensureLaneOccupancy = async (): Promise<Map<string, Map<string, number>>> => {
+  let laneOccupancy: Map<string, Map<string, LaneHolder>> | undefined;
+  const ensureLaneOccupancy = async (): Promise<Map<string, Map<string, LaneHolder>>> => {
     if (laneOccupancy !== undefined) return laneOccupancy;
-    const occupied = new Map<string, Map<string, number>>();
+    const occupied = new Map<string, Map<string, LaneHolder>>();
     for (const run of activeRuns) {
       if (d.probeWorktreeLane === undefined) break;
       const base = project.routing.repos[run.repo]?.defaultBranch ?? "main";
-      let files: string[];
+      let files: LaneFile[];
       try {
         files = await d.probeWorktreeLane({
           worktree: run.worktree,
@@ -291,20 +376,64 @@ export async function admitCandidates(
         // well-formed issue because one probe could not be answered.
         files = [];
       }
-      for (const file of files) {
-        if (occupied.get(run.repo)?.has(file) === true) continue;
+      for (const { file, source } of files) {
         let perRepo = occupied.get(run.repo);
         if (perRepo === undefined) {
           perRepo = new Map();
           occupied.set(run.repo, perRepo);
         }
-        perRepo.set(file, run.issue);
+        // First read wins: a file the run both commits and edits in its
+        // worktree is tagged by its live uncommitted half.
+        if (!perRepo.has(file)) perRepo.set(file, { issue: run.issue, source });
       }
     }
     laneOccupancy = occupied;
     return occupied;
   };
 
+  // The candidate half of the file-lane interlock (#555): the machine-readable
+  // lane an issue declares. Since #517 a promotion brief may live in a
+  // pre-dispatch comment rather than the body, so the lane is read from both
+  // surfaces — the same two the worker brief renders — through the tracker's
+  // existing comment port, never a second comment reader. Body and comments
+  // share the one `laneDeclaration` grammar, and the brief's "later correction
+  // visibly supersedes" contract holds: the effective lane is the latest
+  // declaration among the body and the WHOLE thread, so a correction posted as
+  // a comment replaces an earlier body lane instead of widening it (#608).
+  //
+  // Reading every comment — not just the ones the brief's discussion budget
+  // renders — is deliberate: this is the same `effectiveLane` the brief
+  // renders, and the dispatch side guarantees the winning declaration appears
+  // in the brief verbatim even when it sits beyond the budget. The gate and
+  // the worker therefore agree on one lane, which is the #608 defect's shape.
+  //
+  // Comments are read at most once per issue per pass — the lane feeds both
+  // the gate and the same-pass sibling occupancy below, so the cache is what
+  // stops one candidate costing two comment reads. Unreadable comments fail
+  // open to the body declaration (a body lane stays load-bearing), and with no
+  // readable declaration at all the #555 fail-open admission is unchanged.
+  //
+  // The resolved `FileLane` — not just its paths — is what an admitted
+  // candidate carries into dispatch (#608): the gate and the brief must agree
+  // on the *same declaration* (paths, verbatim source line, and which surface
+  // it came from), so dispatch renders this cached value rather than reading
+  // the thread a second time and hoping it did not change.
+  const laneCache = new Map<number, FileLane | undefined>();
+  const laneFor = async (r: Routed): Promise<FileLane | undefined> => {
+    const issue = r.issue.number;
+    if (laneCache.has(issue)) return laneCache.get(issue);
+    let lane: FileLane | undefined;
+    try {
+      lane = effectiveLane(r.issue.body, await tracker.listComments(issue));
+    } catch (err) {
+      const bodyDecl = laneDeclaration(r.issue.body);
+      lane = bodyDecl === undefined ? undefined : { ...bodyDecl, at: "body" };
+      log(`#${issue} comments unreadable at admission; the body's file lane stands: ${errText(err)}`);
+    }
+    laneCache.set(issue, lane);
+    return lane;
+  };
+
   // The plan allowance is a fleet-wide question, so it is asked once per pass
   // and answers for every candidate — unlike every gate below it, which is
   // per-issue. It sits here rather than beside the spend cap in `tick` for one
@@ -363,8 +492,79 @@ export async function admitCandidates(
   }
 
   const admitted: Admission[] = [];
+
+  // Phase A — dependency-graph cycle pass (#421). Built ONCE per pass, before
+  // any per-candidate open-prerequisite hold, so a candidate sitting on a cycle
+  // is held as `dependency-cycle` instead of having an open first edge mask the
+  // group. Readers follow the same tracker/probe seams as the per-candidate
+  // interlock: same-repo refs via `tracker`, routed refs via `probeIssueIn` /
+  // `probeBodyIn`. Traversal is bounded to the tracker/routed repos and every
+  // node is read at most once; a tracker failure fails closed (no edge) rather
+  // than ever synthesising a cycle.
+  const readDepNode: DependencyNodeReader = async (repo, issue) => {
+    const snap = await (async () => {
+      try {
+        if (repo === project.tracker.repo) return await tracker.issueSnapshot(issue);
+        return d.probeIssueIn === undefined ? undefined : await d.probeIssueIn(repo, issue);
+      } catch {
+        return undefined;
+      }
+    })();
+    if (snap === undefined) return undefined;
+    if (snap.state === "closed") return { state: "closed", body: "" };
+    const body = await (async () => {
+      try {
+        if (repo === project.tracker.repo) return await tracker.issueBody(issue);
+        return d.probeBodyIn === undefined ? undefined : await d.probeBodyIn(repo, issue);
+      } catch {
+        return undefined;
+      }
+    })();
+    return body === undefined ? undefined : { state: "open", body };
+  };
+  const graph = await buildDependencyCycles(
+    routed.map((r) => ({ repo: project.tracker.repo, issue: r.issue.number, body: r.issue.body })),
+    project.tracker.repo,
+    (ownerRepo) => crossRepoTarget(project, ownerRepo),
+    readDepNode,
+  );
+  // candidate issue -> the cycle path that holds it, for status/digest.
+  const memberCycle = new Map<number, string>();
+  for (const cycle of graph.cycles) {
+    for (const member of cycle.members) {
+      const [repo, issueStr] = member.split("#") as [string, string];
+      if (repo !== project.tracker.repo) continue;
+      const n = Number(issueStr);
+      // Prefer the cycle anchored at this member (its "own" cycle) when a
+      // candidate sits on more than one.
+      if (!memberCycle.has(n) || cycle.anchorIssue === n) memberCycle.set(n, cycle.display);
+    }
+    // One material event per stable cycle identity: the escalation ledger
+    // dedupes on project/issue/tier/summary, and the summary carries the
+    // canonical path, so a stable cycle pages once and a changed cycle emits a
+    // new event (the rotated/queue-ordered spelling is canonicalised away).
+    await safeEscalate(d, {
+      tier: 1,
+      project: project.name,
+      issue: cycle.anchorIssue,
+      summary: `Dependency cycle detected: ${cycle.display}`,
+      detail: [
+        "None of the issues on this cycle can be dispatched until one edge is broken.",
+        `Cycle: ${cycle.display}`,
+        "Break it by closing or reordering a `Depends-on:` reference, and the affected",
+        "candidates become claimable again on the next tick.",
+      ].join("\n"),
+    });
+  }
+
   for (const r of routed) {
     const issue = r.issue.number;
+    const cyclePath = memberCycle.get(issue);
+    if (cyclePath !== undefined) {
+      hold(issue, "dependency-cycle", cyclePath);
+      log(`#${issue} held (dependency-cycle): ${cyclePath}`);
+      continue;
+    }
     if (admitted.length >= slots) {
       hold(issue, "capacity");
       continue;
@@ -505,25 +705,30 @@ export async function admitCandidates(
       }
       if (verdict.state === "unknown") {
         // Fail closed: a branch that cannot be *proven* to contain the marker
-        // is refused, and the reason names the unverifiable marker so the
-        // operator can fix the fetch or the marker rather than guess.
-        hold(issue, "stale-base");
+        // is refused. This is a verification/lookup failure — the mirror fetch
+        // failed, the marker did not resolve, or no probe is wired — never
+        // evidence that the branch predates the marker. Hold with a distinct
+        // reason so status and the friction rollup do not read a provider
+        // outage as branch staleness, and prescribe no branch change: the next
+        // admission pass re-runs the probe and admits the unchanged branch
+        // once verification succeeds.
+        hold(issue, "critical-base-verify-error");
         log(
-          `#${issue} held (stale-base): continuation branch ${branch} could not be verified ` +
+          `#${issue} held (critical-base-verify-error): continuation branch ${branch} could not be verified ` +
             `against critical-base marker(s) ${markers.join(", ")} (${verdict.error})`,
         );
         await safeEscalate(d, {
           tier: 1,
           project: project.name,
           issue,
-          summary: `#${issue} continuation branch could not be verified against a critical base safety commit and is held (stale-base)`,
+          summary: `#${issue} continuation branch could not be verified against a critical base safety commit and is held (critical-base-verify-error)`,
           detail: [
             r.issue.title,
             r.issue.url,
             `The retained branch ${branch} could not be verified against critical-base marker(s) ${markers.join(", ")}: ${verdict.error}`,
-            "Recovery: merge current base into the branch so it contains the marker, and the next",
-            "admission pass re-admits it automatically without losing the branch's work; or review",
-            "the branch by hand and clear the hold once the fix is present.",
+            "The branch is not claimed to predate the marker: this is a verification failure.",
+            "No branch change is prescribed. The next admission pass retries the critical-base",
+            "verification automatically and admits the unchanged branch once the probe succeeds.",
           ].join("\n"),
         });
         continue;
@@ -650,6 +855,15 @@ export async function admitCandidates(
       log(`#${issue} skipped: queue label ${project.queueLabel} was removed (search index lag)`);
       continue;
     }
+    // Park beats queue here too (#734): the candidate list was fetched from
+    // the search index before the operator parked the issue, so the fresh
+    // snapshot is the last gate. A park never touches a live run — it only
+    // stops a claim.
+    if (snapshot.labels.includes(project.stateLabels.backlog)) {
+      hold(issue, "issue-parked");
+      log(`#${issue} skipped: park label ${project.stateLabels.backlog} was applied since listing`);
+      continue;
+    }
 
     // The Depends-on interlock (#419/#420): a candidate declares the issues it
     // must not be dispatched before — same-repo (`#123`) or cross-repo
@@ -795,18 +1009,23 @@ export async function admitCandidates(
     // a live run's *actual* lane is held until that run's work has merged, so
     // no second worker is sent at files another worker is still writing. The
     // gate is the mechanical version of the prose rule that failed three times
-    // in one day. Only the machine-readable lane participates: a candidate
-    // without one is admitted exactly as today (fail open), and a candidate's
-    // own retained run never holds it — that is the continuation it continues.
-    const lane = declaredLane(r.issue.body);
-    if (lane.length > 0) {
+    // in one day. Only the machine-readable lane participates — read from the
+    // body and pre-dispatch comments alike, so the gate sees the same surface
+    // the worker brief renders (#608) — and a candidate without one is
+    // admitted exactly as today (fail open), while a candidate's own retained
+    // run never holds it — that is the continuation it continues.
+    const lane = await laneFor(r);
+    if (lane !== undefined && lane.files.length > 0) {
       const occupied = await ensureLaneOccupancy();
       const perRepo = occupied.get(r.repo.name);
       let blocked = false;
-      for (const file of lane) {
+      for (const file of lane.files) {
         const holder = perRepo?.get(file);
-        if (holder !== undefined && holder !== issue) {
-          const detail = `${file} held by run #${holder}`;
+        if (holder !== undefined && holder.issue !== issue) {
+          // The source names the probe read that proved the occupancy, so a
+          // hold reads as authored work — worktree or branch — rather than the
+          // base-reconciliation noise #684 filters out of the probe entirely.
+          const detail = `${file} held by run #${holder.issue} (${holder.source})`;
           hold(issue, "file-lane", detail);
           log(`#${issue} held (file-lane): ${detail}`);
           blocked = true;
@@ -816,20 +1035,20 @@ export async function admitCandidates(
       if (blocked) continue;
     }
 
-    admitted.push({ r, attempt: priorRuns + 1 });
+    admitted.push({ r, attempt: priorRuns + 1, lane });
     liveByRepo.set(r.repo.name, (liveByRepo.get(r.repo.name) ?? 0) + 1);
     // Same-pass sibling occupancy for the file-lane gate: once admitted, a
     // candidate's declared lane occupies for the rest of the pass, so a later
     // overlapping candidate is held rather than both clearing in one tick.
-    if (lane.length > 0) {
+    if (lane !== undefined && lane.files.length > 0) {
       const occupied = await ensureLaneOccupancy();
       let perRepo = occupied.get(r.repo.name);
       if (perRepo === undefined) {
         perRepo = new Map();
         occupied.set(r.repo.name, perRepo);
       }
-      for (const file of lane) {
-        if (!perRepo.has(file)) perRepo.set(file, issue);
+      for (const file of lane.files) {
+        if (!perRepo.has(file)) perRepo.set(file, { issue, source: "declared" });
       }
     }
     if (parent !== undefined) {