omp-conductor 0.17.0 → 0.18.0

package/src/store.ts

@@ -11,7 +11,7 @@
 
 import { Database } from "bun:sqlite";
 import { randomUUID } from "node:crypto";
-import { existsSync, mkdirSync, rmSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, rmSync, unlinkSync } from "node:fs";
 import { dirname, join } from "node:path";
 
 import { backupTimestamp, publishTempFile } from "./backups.ts";
@@ -41,6 +41,7 @@ import type {
   FrictionKind,
   FrictionObservation,
   FrictionSignal,
+  HistoricalInfraCandidate,
   HeldNotice,
   InterruptCategory,
   HeldNoticeDraft,
@@ -60,6 +61,9 @@ import type {
   ReportKind,
   ReportRecord,
   RecoveryAction,
+  ReviewReason,
+  ReviewRevisionOutcome,
+  ReviewRevisionRecord,
   RunPatch,
   RunRecord,
   RunState,
@@ -99,6 +103,7 @@ const FRICTION_HOLD_REASONS: ReadonlySet<FrictionAdmissionReason> = new Set([
   "failed-attempts",
   "continuations",
   "stale-base",
+  "critical-base-verify-error",
   "parent-lookup-error",
   "issue-state-lookup-error",
   "open-pr-lookup-error",
@@ -141,6 +146,7 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   autoRetryCount: true,
   autoCompactionCount: true,
   sessionFile: true,
+  resumedFromRunId: true,
   prUrl: true,
   headSha: true,
   mergeSha: true,
@@ -150,6 +156,7 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   salvageSha: true,
   salvageError: true,
   salvageAckAt: true,
+  quarantineDetail: true,
   startedAt: true,
   endedAt: true,
   lastError: true,
@@ -186,6 +193,7 @@ interface RunRow {
   autoRetryCount: number | null;
   autoCompactionCount: number | null;
   sessionFile: string | null;
+  resumedFromRunId: string | null;
   prUrl: string | null;
   headSha: string | null;
   mergeSha: string | null;
@@ -195,6 +203,7 @@ interface RunRow {
   salvageSha: string | null;
   salvageError: string | null;
   salvageAckAt: number | null;
+  quarantineDetail: string | null;
   startedAt: number;
   endedAt: number | null;
   lastError: string | null;
@@ -361,6 +370,48 @@ interface MergeLockRow {
   at: number;
 }
 
+/** The `review_revisions` table exactly as SQLite hands it back (#677). */
+interface ReviewRevisionRow {
+  id: string;
+  project: string;
+  runId: string;
+  issue: number;
+  prUrl: string;
+  headSha: string;
+  findings: string;
+  round: number;
+  reason: string;
+  sessionFile: string | null;
+  requestedAt: number;
+  dispatchedAt: number | null;
+  settledAt: number | null;
+  outcome: string | null;
+}
+
+/**
+ * NULL columns become absent properties, matching the other row converters:
+ * a record read back out of the store deep-equals the one that went in.
+ */
+function toReviewRevision(row: ReviewRevisionRow): ReviewRevisionRecord {
+  const record: ReviewRevisionRecord = {
+    id: row.id,
+    project: row.project,
+    runId: row.runId,
+    issue: row.issue,
+    prUrl: row.prUrl,
+    headSha: row.headSha,
+    findings: row.findings,
+    round: row.round,
+    reason: row.reason as ReviewReason,
+    requestedAt: row.requestedAt,
+  };
+  if (row.sessionFile !== null) record.sessionFile = row.sessionFile;
+  if (row.dispatchedAt !== null) record.dispatchedAt = row.dispatchedAt;
+  if (row.settledAt !== null) record.settledAt = row.settledAt;
+  if (row.outcome !== null) record.outcome = row.outcome as ReviewRevisionOutcome;
+  return record;
+}
+
 /** The `intake_items` table exactly as SQLite hands it back (#299). */
 interface IntakeRow {
   id: string;
@@ -470,6 +521,7 @@ CREATE TABLE IF NOT EXISTS runs (
   autoRetryCount INTEGER,
   autoCompactionCount INTEGER,
   sessionFile TEXT,
+  resumedFromRunId TEXT,
   prUrl       TEXT,
   headSha     TEXT,
   mergeSha    TEXT,
@@ -492,6 +544,22 @@ CREATE TABLE IF NOT EXISTS runs (
 CREATE INDEX IF NOT EXISTS runs_project_issue ON runs (project, issue);
 CREATE INDEX IF NOT EXISTS runs_project_state ON runs (project, state);
 
+-- The historical infrastructure reconciliation's per-project review cursor
+-- (#638). A bounded pass examines settled ci-deterministic rows newest-first
+-- and persists the boundary of the last row it definitively decided, so older
+-- repairable rows are reached across later daemon starts instead of being
+-- starved by repeated rescans of the newest non-matches. classifierVersion is
+-- the signature-list fingerprint at the time the cursor advanced; when the
+-- classifier learns a new signature the stamp goes stale and the pass restarts
+-- from the newest row rather than skipping past newly recognised evidence.
+CREATE TABLE IF NOT EXISTS historical_infra_review (
+  project           TEXT    PRIMARY KEY,
+  cursorStartedAt   INTEGER NOT NULL,
+  cursorRowid       INTEGER NOT NULL,
+  classifierVersion TEXT    NOT NULL,
+  updatedAt         INTEGER NOT NULL
+);
+
 CREATE TABLE IF NOT EXISTS base_health (
   project   TEXT    NOT NULL,
   repo      TEXT    NOT NULL,
@@ -693,6 +761,31 @@ CREATE TABLE IF NOT EXISTS merge_locks (
   at      INTEGER NOT NULL
 );
 
+-- One durable review-revision request (#677): an orchestrator returned a
+-- green, run-owned pull request to its worker with blocking findings. Every
+-- field the daemon needs to resume the exact session is persisted BEFORE the
+-- worker is woken -- the findings, the exact reviewed head, the round number,
+-- and the target run/session -- and the row doubles as the duplicate guard: a
+-- revision whose row exists pending is one nobody may queue again.
+CREATE TABLE IF NOT EXISTS review_revisions (
+  id           TEXT    PRIMARY KEY,
+  project      TEXT    NOT NULL,
+  runId        TEXT    NOT NULL,
+  issue        INTEGER NOT NULL,
+  prUrl        TEXT    NOT NULL,
+  headSha      TEXT    NOT NULL,
+  findings     TEXT    NOT NULL,
+  round        INTEGER NOT NULL,
+  reason       TEXT    NOT NULL,
+  sessionFile  TEXT,
+  requestedAt  INTEGER NOT NULL,
+  dispatchedAt INTEGER,
+  settledAt    INTEGER,
+  outcome      TEXT
+);
+CREATE INDEX IF NOT EXISTS review_revisions_pending
+  ON review_revisions (project, dispatchedAt, runId);
+
 -- Questions the orchestrator has put to its operator, and their answers (#136).
 --
 -- The reason this is a table and not the session's memory: a question lived only
@@ -903,6 +996,7 @@ function toRecord(row: RunRow): RunRecord {
     startedAt: row.startedAt,
   };
   if (row.sessionFile !== null) record.sessionFile = row.sessionFile;
+  if (row.resumedFromRunId !== null) record.resumedFromRunId = row.resumedFromRunId;
   if (row.prUrl !== null) record.prUrl = row.prUrl;
   if (row.headSha !== null) record.headSha = row.headSha;
   if (row.mergeSha !== null) record.mergeSha = row.mergeSha;
@@ -912,6 +1006,7 @@ function toRecord(row: RunRow): RunRecord {
   if (row.salvageSha !== null) record.salvageSha = row.salvageSha;
   if (row.salvageError !== null) record.salvageError = row.salvageError;
   if (row.salvageAckAt !== null) record.salvageAckAt = row.salvageAckAt;
+  if (row.quarantineDetail !== null) record.quarantineDetail = row.quarantineDetail;
   if (row.endedAt !== null) record.endedAt = row.endedAt;
   if (row.lastError !== null) record.lastError = row.lastError;
   if (row.settlementFlags !== null) {
@@ -1143,12 +1238,59 @@ export function dbPath(): string {
   return join(stateDir(), "conductor.db");
 }
 
+/**
+ * Live worker count across the run store, opening the database WITHOUT
+ * creating or upgrading it. The setup apply's quiescence preflight must count
+ * workers before the acknowledged barrier, and database preparation is itself
+ * one of the mutations that barrier must precede — so the observation that
+ * gates it cannot be the thing that creates or migrates the store (#618). The
+ * on-disk database is opened read-only (never created, never "prepared"); a
+ * missing file reports zero because no run has ever been persisted, which the
+ * caller only trusts when no daemon is running either. An unreadable or
+ * schema-broken file throws rather than reading as zero — fail closed, never
+ * absence.
+ */
+export function liveWorkersReadOnly(project?: string): number {
+  const path = dbPath();
+  if (!existsSync(path)) return 0;
+  let db: Database | undefined;
+  try {
+    db = new Database(path, { create: false, readonly: true });
+    db.exec("PRAGMA busy_timeout = 5000;");
+    const placeholders = LIVE_STATES.map(() => "?").join(", ");
+    // `undefined` is the host-global selector: every project's live rows count,
+    // never only the rows of a project literally named "" — a host-global
+    // observation that scoped to `project = ''` hid every real named row and
+    // read zero beside a running fleet (#651 review #3).
+    const row =
+      project === undefined
+        ? db
+            .query<{ n: number }, SqlValue[]>(
+              `SELECT COUNT(*) AS n FROM runs WHERE state IN (${placeholders})`,
+            )
+            .get(...LIVE_STATES)
+        : db
+            .query<{ n: number }, SqlValue[]>(
+              `SELECT COUNT(*) AS n FROM runs WHERE project = ? AND state IN (${placeholders})`,
+            )
+            .get(project, ...LIVE_STATES);
+    return row?.n ?? 0;
+  } catch (err) {
+    throw new Error(
+      `cannot read ${path} to prove the fleet is quiescent: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  } finally {
+    db?.close();
+  }
+}
+
 /** The stem every restorable `conductor.db` snapshot is published under. */
 export const DB_SNAPSHOT_STEM = "conductor.db.bak";
 
 /**
- * A fresh, restorable copy of the store at `source`, published under `destDir`
- * with the same temp-then-atomic-publish convention as the config backups.
+ * A single-file, transaction-consistent copy of the store at `source` into
+ * `target` — the shared core of {@link snapshotDb} and the setup apply's
+ * rollback capture.
  *
  * Uses SQLite's own `VACUUM INTO`, never a plain file copy: the store opens
  * with `journal_mode=WAL`, and a `copyFileSync` can capture a torn database
@@ -1158,34 +1300,79 @@ export const DB_SNAPSHOT_STEM = "conductor.db.bak";
  * writes a single-file snapshot, so the result opens cleanly in a fresh
  * connection and contains every committed row.
  *
- * The snapshot runs against its own read of the source, deliberately not the
- * caller's writer connection, so a snapshot can be taken while a writer holds
- * an uncheckpointed WAL. `:memory:` has no on-disk state to snapshot and is
+ * Runs against its own read of the source, deliberately not the caller's
+ * writer connection, so a snapshot can be taken while a writer holds an
+ * uncheckpointed WAL. `:memory:` has no on-disk state to snapshot and is
  * refused.
- *
- * Returns the published snapshot path.
  */
-export function snapshotDb(source: string, destDir: string): string {
+export function vacuumInto(source: string, target: string): void {
   if (source === ":memory:") throw new Error("cannot snapshot an in-memory store");
   if (!existsSync(source)) {
     throw new Error(`cannot snapshot ${source}: the store does not exist`);
   }
-  mkdirSync(destDir, { recursive: true });
-  const temporary = join(destDir, `.${DB_SNAPSHOT_STEM}-${process.pid}.${randomUUID()}.tmp`);
   let connection: Database | undefined;
   try {
     connection = new Database(source);
     connection.exec("PRAGMA busy_timeout = 5000;");
     // `VACUUM INTO` takes the target as an SQL literal, not a bound parameter.
-    connection.exec(`VACUUM INTO '${temporary.replaceAll("'", "''")}'`);
+    connection.exec(`VACUUM INTO '${target.replaceAll("'", "''")}'`);
+  } finally {
+    connection?.close();
+  }
+}
+
+/**
+ * A fresh, restorable copy of the store at `source`, published under `destDir`
+ * with the same temp-then-atomic-publish convention as the config backups.
+ *
+ * The stem carries `at` (default now) so the filename's timestamp is the
+ * snapshot's logical instant — the cadence passes its tick time, keeping the
+ * name, the day marker and the retention ordering in one timeline.
+ *
+ * Returns the published snapshot path.
+ */
+export function snapshotDb(source: string, destDir: string, at: number = Date.now()): string {
+  if (source === ":memory:") throw new Error("cannot snapshot an in-memory store");
+  if (!existsSync(source)) {
+    throw new Error(`cannot snapshot ${source}: the store does not exist`);
+  }
+  mkdirSync(destDir, { recursive: true });
+  const temporary = join(destDir, `.${DB_SNAPSHOT_STEM}-${process.pid}.${randomUUID()}.tmp`);
+  try {
+    vacuumInto(source, temporary);
   } catch (err) {
     // Never leave a half-written snapshot on disk.
     rmSync(temporary, { force: true });
     throw err;
-  } finally {
-    connection?.close();
   }
-  return publishTempFile(temporary, destDir, `${DB_SNAPSHOT_STEM}-${backupTimestamp()}`);
+  return publishTempFile(temporary, destDir, `${DB_SNAPSHOT_STEM}-${backupTimestamp(at)}`);
+}
+
+/**
+ * How many conductor.db snapshots the daemon's daily cadence keeps — a week
+ * of ledger history at one snapshot per day. Deliberately a fixed count, not
+ * an age or space policy: the store's ledger is append-only and the issue
+ * forbids inventing a fleet-wide retention policy, so pruning is
+ * configured-count only (#289).
+ */
+export const DB_SNAPSHOT_RETENTION = 7;
+
+/**
+ * Prune a snapshot directory to the newest `keep` conductor.db snapshots.
+ *
+ * Snapshot stems embed the publish timestamp (`YYYY-MM-DDTHH-MM-SS…`), so
+ * lexicographic order is chronological; only files named with the shared
+ * `DB_SNAPSHOT_STEM` prefix are considered, never unrelated backups next to
+ * them. Idempotent: a directory already at or under the bound removes
+ * nothing. Returns the number of files removed.
+ */
+export function pruneDbSnapshots(dir: string, keep: number): number {
+  const names = readdirSync(dir)
+    .filter((name) => name.startsWith(DB_SNAPSHOT_STEM))
+    .sort();
+  const stale = names.length > keep ? names.slice(0, names.length - keep) : [];
+  for (const name of stale) unlinkSync(join(dir, name));
+  return stale.length;
 }
 
 /** The UTC calendar day (`YYYY-MM-DD`) a moment falls on — the partition key
@@ -1272,6 +1459,14 @@ export function openStore(dbPath: string): Store {
       db.exec(`ALTER TABLE runs ADD COLUMN ${name} ${type}`);
     }
   }
+  // Rows written before #737 were never asked whether their tree was
+  // quarantined, and a NULL means exactly that: the pre-quarantine passes
+  // reaped the same trees they always had, so nothing before this release
+  // needs backfilling — the column starts null and only a post-release pass
+  // that actually refuses a broken store writes it.
+  if (!columns.some((column) => column.name === "quarantineDetail")) {
+    db.exec("ALTER TABLE runs ADD COLUMN quarantineDetail TEXT");
+  }
   // Rows written before the settlement audit existed (#128) were never audited,
   // so a NULL here means "no audit ran" and reads the same as "found nothing".
   // That conflation is deliberate and harmless: the flags are advisory, and no
@@ -1306,6 +1501,13 @@ export function openStore(dbPath: string): Store {
   if (!columns.some((column) => column.name === "model")) {
     db.exec("ALTER TABLE runs ADD COLUMN model TEXT");
   }
+  // Resume provenance (#567): rows written before #564 landed were never
+  // resumed, so NULL is the honest reading of "no resume happened" — never
+  // "resumed from unknown". No backfill: the identity existed only in the
+  // dispatch decision, and deriving it now would guess at history.
+  if (!columns.some((column) => column.name === "resumedFromRunId")) {
+    db.exec("ALTER TABLE runs ADD COLUMN resumedFromRunId TEXT");
+  }
   // The count of in-session provider 429s a run recorded was first written by
   // the worker (#573). Rows predating the column are NULL, which is the honest
   // reading: the count was not recorded, so the classifier must not treat the
@@ -1465,10 +1667,10 @@ export function openStore(dbPath: string): Store {
   const insertRun = db.query<unknown, SqlValue[]>(
     `INSERT INTO runs (
        id, project, issue, repo, branch, worktree, state, attempt, turns,
-       maxTurns, spendUsd, sessionFile, prUrl, headSha, mergeSha, baseRef,
+       maxTurns, spendUsd, sessionFile, resumedFromRunId, prUrl, headSha, mergeSha, baseRef,
        baseCheck, baseCheckAt, salvageSha, salvageError, salvageAckAt, startedAt,
        endedAt, lastError, settlementFlags, report
-     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   );
   const selectRun = db.query<RunRow, [string]>(`SELECT * FROM runs WHERE id = ?`);
   const selectActive = db.query<RunRow, SqlValue[]>(
@@ -1644,6 +1846,56 @@ export function openStore(dbPath: string): Store {
       ORDER BY startedAt DESC, rowid DESC
       LIMIT ?`,
   );
+  // The settled rows a classifier correction can no longer reach (#638). A
+  // `ci-deterministic`/`escalate` row never re-enters `selectUnclassified`
+  // (its class is set and its recovery is not retryable), so evidence the
+  // classifier learned after the row was written — the codeload setup 429 of
+  // #177 — stays a charged attempt forever. This WHERE is the historical
+  // reconciliation's exact predicate: nothing but rows currently reading
+  // `ci-deterministic`, never a class a human re-read, and the class itself is
+  // only ever produced for `state = 'failed'`. Bounded like every other sweep
+  // read, because each candidate costs tracker calls to re-fetch its evidence.
+  // `after` is the persisted review cursor: candidates are only rows strictly
+  // older than it, so a bounded pass progresses through a long misclassified
+  // history instead of rescanning the newest non-matches forever. A NULL cursor
+  // (first pass, or one rendered stale by a classifier-signature change) means
+  // "start from the newest". `SELECT rowid, *` exposes the hidden tie-breaker
+  // so the pass can record an exact resume boundary.
+  const selectHistoricalInfraCandidates = db.query<RunRow & { rowid: number }, SqlValue[]>(
+    `SELECT rowid, * FROM runs
+      WHERE project = ? AND failureClass = 'ci-deterministic' AND state = 'failed'
+        AND (? IS NULL OR (startedAt < ? OR (startedAt = ? AND rowid < ?)))
+      ORDER BY startedAt DESC, rowid DESC
+      LIMIT ?`,
+  );
+  const selectHistoricalInfraCursor = db.query<
+    { cursorStartedAt: number; cursorRowid: number; classifierVersion: string },
+    [string]
+  >(
+    `SELECT cursorStartedAt, cursorRowid, classifierVersion FROM historical_infra_review
+      WHERE project = ?`,
+  );
+  const upsertHistoricalInfraCursor = db.query<
+    unknown,
+    [string, number, number, string, number]
+  >(
+    `INSERT INTO historical_infra_review
+       (project, cursorStartedAt, cursorRowid, classifierVersion, updatedAt)
+     VALUES (?, ?, ?, ?, ?)
+     ON CONFLICT(project) DO UPDATE SET
+       cursorStartedAt = excluded.cursorStartedAt,
+       cursorRowid = excluded.cursorRowid,
+       classifierVersion = excluded.classifierVersion,
+       updatedAt = excluded.updatedAt`,
+  );
+  // The one mutation the historical reconciliation may make. Guarded by the
+  // current class, so a second pass is a no-op and a race can never reclassify
+  // a row a human has re-read. Deliberately only `failureClass` — never
+  // `recoveryAction` or `recoveredAt`: relieving the budget is the point,
+  // re-animating a months-old run into the requeue sweep is not (#638).
+  const reclassifyToInfra = db.query<unknown, [string]>(
+    `UPDATE runs SET failureClass = 'ci-infra' WHERE id = ? AND failureClass = 'ci-deterministic'`,
+  );
   const selectFailureClassCounts = db.query<{ cls: string; n: number }, [string]>(
     `SELECT failureClass AS cls, COUNT(*) AS n FROM runs
       WHERE project = ? AND failureClass IS NOT NULL AND recoveredAt IS NULL
@@ -1671,6 +1923,21 @@ export function openStore(dbPath: string): Store {
         AND (salvageSha IS NOT NULL OR salvageError IS NOT NULL)
       ORDER BY issue ASC`,
   );
+  // Quarantined retained trees (#737), newest attempt per issue — the same
+  // shape as `selectSalvaged` because the same change can land twice: a row
+  // long since reaped must not keep its issue looking quarantined, and an
+  // older quarantined attempt must not claim the issue while a newer,
+  // healthy one replaced it.
+  const selectQuarantined = db.query<RunRow, [string]>(
+    `SELECT * FROM runs
+      WHERE rowid IN (
+        SELECT MAX(rowid) FROM runs
+        WHERE project = ?
+        GROUP BY issue
+      )
+        AND quarantineDetail IS NOT NULL
+      ORDER BY issue ASC`,
+  );
   // Newest attempt for one issue. `startedAt` is millisecond-resolution and two
   // attempts could in principle share one, so rowid breaks the tie by insertion
   // order — a `tail` that attached to the older of two same-millisecond attempts
@@ -2319,6 +2586,72 @@ export function openStore(dbPath: string): Store {
     },
   );
 
+  // The durable review-revision request outbox (#677): the orchestrator's verb
+  // writes the row (findings, head, round, target session) and the daemon's
+  // next dispatch pass wakes it. The duplicate in-flight guard is the insert:
+  // a pending row for the same run refuses the second request atomically, and
+  // once dispatched the run row's own state (pushed-green → running) is the
+  // in-flight marker.
+  const insertReviewRevision = db.query<unknown, SqlValue[]>(
+    `INSERT INTO review_revisions
+       (id, project, runId, issue, prUrl, headSha, findings, round, reason, sessionFile, requestedAt, dispatchedAt, settledAt, outcome)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, NULL, NULL, NULL)`,
+  );
+  const selectPendingReviewRevisions = db.query<ReviewRevisionRow, [string]>(
+    `SELECT * FROM review_revisions
+      WHERE project = ? AND dispatchedAt IS NULL AND settledAt IS NULL
+      ORDER BY requestedAt ASC, rowid ASC`,
+  );
+  const selectPendingReviewForRun = db.query<ReviewRevisionRow, [string, string]>(
+    `SELECT * FROM review_revisions
+      WHERE project = ? AND runId = ? AND dispatchedAt IS NULL AND settledAt IS NULL
+      LIMIT 1`,
+  );
+  const selectLatestReviewRound = db.query<{ n: number | null }, [string, string]>(
+    `SELECT MAX(round) AS n FROM review_revisions WHERE project = ? AND runId = ?`,
+  );
+  const markReviewRevisionDispatchedRow = db.query<unknown, [number, string]>(
+    `UPDATE review_revisions SET dispatchedAt = ? WHERE id = ?`,
+  );
+  const settleReviewRevisionRow = db.query<unknown, [string, number, string]>(
+    `UPDATE review_revisions SET outcome = ?, settledAt = ? WHERE id = ?`,
+  );
+  const selectUnsettledReviewRevisions = db.query<ReviewRevisionRow, [string]>(
+    `SELECT * FROM review_revisions
+      WHERE project = ? AND settledAt IS NULL
+      ORDER BY requestedAt ASC, rowid ASC`,
+  );
+  const requeueReviewRevisionRow = db.query<unknown, [string]>(
+    `UPDATE review_revisions SET dispatchedAt = NULL WHERE id = ?`,
+  );
+  const claimRunForReviewRow = db.query<unknown, [string]>(
+    `UPDATE runs SET state = 'running', endedAt = NULL WHERE id = ? AND state = 'pushed-green'`,
+  );
+
+  // The claim and the insert share a transaction so two concurrent revision
+  // requests for one run cannot both win: the second sees the first's pending
+  // row and returns undefined, which the verb turns into the in-flight refusal.
+  const claimReviewRevision = db.transaction(
+    (draft: Omit<ReviewRevisionRecord, "id">): ReviewRevisionRecord | undefined => {
+      if (selectPendingReviewForRun.get(draft.project, draft.runId) !== null) return undefined;
+      const record: ReviewRevisionRecord = { ...draft, id: crypto.randomUUID() };
+      insertReviewRevision.run(
+        record.id,
+        record.project,
+        record.runId,
+        record.issue,
+        record.prUrl,
+        record.headSha,
+        record.findings,
+        record.round,
+        record.reason,
+        record.sessionFile ?? null,
+        record.requestedAt,
+      );
+      return record;
+    },
+  );
+
   // The label projection outbox (#201). A decided label change is a row until
   // the tracker has applied it; the projector drains in id order, and one
   // issue's ops are atomic as a run — a failed op parks the rest of its issue
@@ -2443,6 +2776,7 @@ export function openStore(dbPath: string): Store {
       record.maxTurns,
       record.spendUsd,
       toSql(record.sessionFile),
+      toSql(record.resumedFromRunId),
       toSql(record.prUrl),
       toSql(record.headSha),
       toSql(record.mergeSha),
@@ -2526,6 +2860,30 @@ export function openStore(dbPath: string): Store {
     runsForProjectPr(project: string, prUrl: string, mergedSinceEpochMs: number): RunRecord[] {
       return selectRunsForPr.all(project, prUrl, mergedSinceEpochMs).map(toRecord);
     },
+    createReviewRevision(draft: Omit<ReviewRevisionRecord, "id">): ReviewRevisionRecord | undefined {
+      return claimReviewRevision(draft);
+    },
+    pendingReviewRevisions(project: string): ReviewRevisionRecord[] {
+      return selectPendingReviewRevisions.all(project).map(toReviewRevision);
+    },
+    latestReviewRound(project: string, runId: string): number {
+      return selectLatestReviewRound.get(project, runId)?.n ?? 0;
+    },
+    markReviewRevisionDispatched(id: string, at: number): void {
+      markReviewRevisionDispatchedRow.run(at, id);
+    },
+    settleReviewRevision(id: string, outcome: ReviewRevisionOutcome, at: number): void {
+      settleReviewRevisionRow.run(outcome, at, id);
+    },
+    unsettledReviewRevisions(project: string): ReviewRevisionRecord[] {
+      return selectUnsettledReviewRevisions.all(project).map(toReviewRevision);
+    },
+    requeueReviewRevision(id: string): void {
+      requeueReviewRevisionRow.run(id);
+    },
+    claimRunForReview(runId: string): boolean {
+      return claimRunForReviewRow.run(runId).changes > 0;
+    },
     runsNeedingBaseCheck(project: string, limit = 20): RunRecord[] {
       return selectPendingBaseChecks.all(project, limit).map(toRecord);
     },
@@ -2596,6 +2954,10 @@ export function openStore(dbPath: string): Store {
       return selectSalvaged.all(project).map(toRecord);
     },
 
+    quarantinedRuns(project: string): RunRecord[] {
+      return selectQuarantined.all(project).map(toRecord);
+    },
+
     attemptsFor(project: string, issue: number): number {
       return countAttempts.get(project, issue)?.n ?? 0;
     },
@@ -3066,6 +3428,38 @@ export function openStore(dbPath: string): Store {
       return selectUnclassified.all(project, limit).map(toRecord);
     },
 
+    historicalInfraCandidates(
+      project: string,
+      limit = 20,
+      after?: { startedAt: number; rowid: number },
+    ): HistoricalInfraCandidate[] {
+      const cursorAt = after?.startedAt ?? null;
+      const cursorRowid = after?.rowid ?? null;
+      return selectHistoricalInfraCandidates
+        .all(project, cursorAt, cursorAt, cursorAt, cursorRowid, limit)
+        .map((row) => ({ ...toRecord(row), rowid: row.rowid }));
+    },
+
+    historicalInfraCursor(project: string) {
+      const row = selectHistoricalInfraCursor.get(project);
+      return row == null
+        ? undefined
+        : { startedAt: row.cursorStartedAt, rowid: row.cursorRowid, classifierVersion: row.classifierVersion };
+    },
+
+    setHistoricalInfraCursor(
+      project: string,
+      startedAt: number,
+      rowid: number,
+      classifierVersion: string,
+    ): void {
+      upsertHistoricalInfraCursor.run(project, startedAt, rowid, classifierVersion, Date.now());
+    },
+
+    reclassifyInfra(id: string): boolean {
+      return reclassifyToInfra.run(id).changes > 0;
+    },
+
     failureClassCounts(project: string): { cls: FailureClass; n: number }[] {
       return selectFailureClassCounts
         .all(project)