omp-conductor 0.17.0 → 0.18.0

package/src/daemon.ts

@@ -8,30 +8,35 @@
  * here and enforced before anything is claimed.
  */
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import {
   configPath,
+  dbBackupDirFor,
   findProject,
   loadConfig,
   resolveCaps,
   resolveReleaseGrants,
+  resolveReview,
   stateDir,
 } from "./config.ts";
 import { availabilityState, type AvailabilityState } from "./availability.ts";
 import {
-  UNREADABLE_TREE_FLAG,
-  analyseSettlement,
-  deriveChangedLine,
   formatSettlementFlags,
   settlementFlagSummary,
   withDerivedChangedLine,
 } from "./diff-flags.ts";
-import { digestScheduleState, type DigestScheduleState } from "./digest-schedule.ts";
+import {
+  dbSnapshotDue,
+  dbSnapshotMarkerKey,
+  digestScheduleState,
+  localDayKey,
+  type DigestScheduleState,
+} from "./digest-schedule.ts";
 import { createEscalator, escalationIssueRef } from "./escalate.ts";
 import { pendingCodeGraph, probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
 import { graphHint } from "./graph.ts";
-import { acquireOnceLease, healthCheck, livingDaemon } from "./lifecycle.ts";
+import { acquireOnceLease, healthCheck, livingDaemon, probeUnit, SYSTEMD_UNIT } from "./lifecycle.ts";
 import { requestImmediateTick, resolveTickConfigCwd, STALL_MARKER_FILE } from "./orchestrator-tick.ts";
 import { runDoctor } from "./doctor.ts";
 import { appendJournal, launchTransientUnit, readUpgradeJournal } from "./upgrade-journal.ts";
@@ -52,34 +57,64 @@ import {
 } from "./reports.ts";
 import {
   recordReleaseBlock,
+  sharedHostBriefNotice,
   type GateShape,
   type ReleaseBlockContext,
 } from "./release-policy.ts";
-import { branchName, effectiveLabels, route } from "./routing.ts";
+import { branchName, effectiveLabels, isEligible, route } from "./routing.ts";
 import type { Routed, UnroutableReason } from "./routing.ts";
-import { admitCandidates, hasContinuationBudget, hasFailedAttemptBudget } from "./admission.ts";
-import type { Admission, AdmissionHold } from "./admission.ts";
+import {
+  admitCandidates,
+  effectiveLane,
+  hasContinuationBudget,
+  hasFailedAttemptBudget,
+  laneEcho,
+} from "./admission.ts";
+import type { Admission, AdmissionHold, FileLane } from "./admission.ts";
 import { log, errText, safeEscalate } from "./log.ts";
+import {
+  adoptSalvagedPrs,
+  classifyAndRecover,
+  collectSettlementFlags,
+  formatQuarantinedRuns,
+  formatSalvagedRuns,
+  reactToProviderCredit,
+  readSessionError,
+  reconcileOrphanedRuns,
+  reconcileStaleLabels,
+  recordOperatorStop,
+  settlePushedGreen,
+  settleWorktree,
+  swapToQueue,
+} from "./settlement.ts";
 import { materializeOmpSettings } from "./omp-settings.ts";
 import { evaluateDecisionConditions, probeNpmVersion, probeRateLimitReset } from "./decisions.ts";
-import { classifyRun, providerCreditRefusal, providerTransientFault, type ClassifyFacts } from "./failure-class.ts";
+import { infraLogSignature, infraSignatureVersion, providerCreditRefusal, providerTransientFault } from "./failure-class.ts";
 import {
   DEFAULT_MODEL_FALLBACK_THRESHOLD,
   fallbackClause,
-  formatModelsTried,
-  modelsTried,
   providerFailureFacts,
   resolveDispatchModel,
 } from "./model-fallback.ts";
 import { projectLabels } from "./label-projection.ts";
-import { dbPath, LIVE_STATES, openStore, utcDay } from "./store.ts";
-import { makeTracker, type RateLimitStatus } from "./tracker/github.ts";
+import {
+  DB_SNAPSHOT_RETENTION,
+  ACTIVE_STATES,
+  dbPath,
+  LIVE_STATES,
+  openStore,
+  pruneDbSnapshots,
+  snapshotDb,
+  utcDay,
+} from "./store.ts";
+import { GraphqlBreaker, makeTracker, type RateLimitStatus } from "./tracker/github.ts";
 import { DEFAULT_REPORT_POLICY, RELEASE_SHAPES } from "./types.ts";
 import type {
   BaseFreeze,
   BaseHealth,
   AdmissionHoldReason,
   Caps,
+  ConductorConfig,
   DispatchSummary,
   DigestBacklog,
   Escalation,
@@ -92,11 +127,15 @@ import type {
   PrState,
   ProjectConfig,
   ReadyIssue,
+  ReportingPolicy,
   RepoTarget,
   ReportRecord,
   ResolvedGrants,
   FailureClass,
   RecoveryAction,
+  ReviewPolicy,
+  ReviewRevisionOutcome,
+  ReviewRevisionRecord,
   RunRecord,
   RunState,
   SettlementFlag,
@@ -104,6 +143,7 @@ import type {
   Tracker,
   VerbLedgerEntry,
   TurnOverride,
+  WorkflowRun,
 } from "./types.ts";
 import {
   type KilledBy,
@@ -113,6 +153,7 @@ import {
   type RunWorkerDeps,
   ORPHAN_RESUME_PROMPT,
   renderBrief,
+  renderReviewRevisionPrompt,
   runWorker,
 } from "./worker.ts";
 import {
@@ -130,7 +171,6 @@ import { githubVerbActions } from "./verbs/actions.ts";
 import { formatVerbLedger, STATUS_LEDGER_SCAN } from "./verbs/ledger.ts";
 import {
   listenVerbChannel,
-  PR_LOOKUP_WINDOW_MS,
   type VerbActions,
   type VerbDeps,
   type VerbListener,
@@ -170,26 +210,7 @@ const GRAPH_HEALTH_INTERVAL_MS = 60_000;
  *  report an operator is waiting on must not sit in the outbox for the length of
  *  a poll interval, and delivery is owed even while claiming is paused (#123). */
 const REPORT_DELIVERY_INTERVAL_MS = 30_000;
-/** A dispatch-infra run (turn-0 git failure) is requeued so the next tick
- *  retries — but only a bounded number of times. Three strikes for one issue
- *  means the mirror itself is broken, not unlucky, and the sweep escalates
- *  instead of burning a turn-0 run per tick forever (#168, #177). */
-const DISPATCH_INFRA_MAX_STRIKES = 3;
-/** A provider-transient requeue (stream stalled mid-run) is retried, but only a
- *  bounded number of times: three aborted streams for one issue means the
- *  provider itself is degraded, not unlucky, and the sweep escalates to a
- *  human instead of requeueing into a down provider forever (#220). */
-const PROVIDER_TRANSIENT_MAX_STRIKES = 3;
-/** A provider-capacity requeue (sustained in-session rate limiting) is retried,
- *  but only a bounded number of times: three throttled runs for one issue mean
- *  the provider is at capacity, not unlucky, and the sweep escalates to a human
- *  instead of requeueing into a throttled provider forever (#573). The issue's
- *  own chain moves onto its next model per strike (via {@link FAILOVER_CLASSES}),
- *  so a bounded chain is exhaustible; this caps the unbounded no-chain case. */
-const PROVIDER_CAPACITY_MAX_STRIKES = 3;
-/** Terminal rows inspected for a salvaged PR per tick. GitHub provenance reads
- *  are maintenance, but a backlog must not turn one tick into an API burst. */
-const SALVAGED_PR_ADOPTION_BATCH = 10;
+
 const DEFAULT_PORT = 8787;
 const BRIEF_TEMPLATE_PATH = join(import.meta.dir, "briefs", "worker.md");
 
@@ -289,7 +310,9 @@ interface Deps {
   /**
    * Reads one active run's file lane for the admission file-lane interlock
    * (#555): the union of its uncommitted worktree changes and its branch-vs-base
-   * diff. Wired by `runDaemon` to the mirror/worktree-backed
+   * diff. Reconciliation is not occupancy: while the run merges its base, the
+   * probe reports only files it has actually diverged on, never the files the
+   * merge merely staged (#684). Wired by `runDaemon` to the mirror/worktree-backed
    * {@link probeRunLane}; a test injects a fake. Absent, the interlock is inert
    * (no lane is ever known occupied), which is the issue's "fail open": the
    * gate adds holds, it never refuses a well-formed issue for lack of this
@@ -303,6 +326,13 @@ interface Deps {
    * admission fails a routed cross-repo prerequisite closed.
    */
   probeIssueIn?: (repo: string, issue: number) => Promise<IssueSnapshot | undefined>;
+  /**
+   * Reads one issue's BODY in a repository the admission tracker is not bound
+   * to — the dependency-graph cycle pass (#421). Wired by `runDaemon` to a
+   * repo-scoped tracker; a test injects a fake. Absent, a routed reachable
+   * body fails that branch closed rather than synthesising a cycle.
+   */
+  probeBodyIn?: (repo: string, issue: number) => Promise<string | undefined>;
 }
 
 /**
@@ -610,6 +640,135 @@ export function setPaused(
   }
 }
 
+// ----------------------------------------------------------------- admission
+// acknowledgement (#651, review #3)
+//
+// The setup-fence's "acknowledgement" must come from the daemon itself, not a
+// second synchronous worker count: a tick that passed its pause gate before
+// the fence landed can sit in awaited tracker/routing/admission work and claim
+// after the count and before setup mutates. Two places make that impossible
+// and record it durably:
+//
+//  - the tick's pause gate re-acknowledges every held pass (the daemon has
+//    reached its admission boundary and claims nothing);
+//  - the claim itself re-checks the pause immediately before creating the run
+//    row, so a tick already past its gate when the fence landed refuses at
+//    the claim — and writes the acknowledgement — instead of admitting.
+//
+// The acknowledgement file names the exact pause instance observed and the
+// daemon generation that observed it, so the setup barrier can prove the
+// acknowledged fence is the fence it froze and the acknowledgement belongs to
+// the daemon it began with.
+
+/** The durable admission acknowledgement a daemon writes when it observes a
+ *  pause fence at an admission boundary. */
+export interface AdmissionAckRecord {
+  /** The pause instance observed (source token, reason, creation instant). */
+  pause: { source: string; reason?: string; since: number };
+  /** The daemon generation that observed it — {@link daemonGeneration}. */
+  daemon: string;
+  /** When the daemon observed the fence. */
+  observedAt: number;
+}
+
+/** The acknowledgement file path. One per host: the fence is host-global. */
+export function admissionAckPath(): string {
+  return join(stateDir(), "admission-ack.json");
+}
+
+/**
+ * The generation identity of the running daemon, or `undefined` when nothing
+ * provably runs. The live pidfile record wins (its pid and boot instant
+ * identify the exact instance, #377); a record-less ACTIVE unit is still a
+ * running daemon and its MainPID is the generation that lets a fence spot a
+ * supervisor restart (#651 review #2). Shared by the ack writer and the setup
+ * barrier's identity so both sides of the acknowledgement name the same
+ * instance by the same rule.
+ */
+export function daemonGeneration(): string | undefined {
+  const daemon = livingDaemon();
+  if (daemon !== undefined) return `${daemon.pid}@${daemon.startedAt}`;
+  const ownership = probeUnit(SYSTEMD_UNIT);
+  return ownership.kind === "active" ? `systemd:${ownership.pid}` : undefined;
+}
+
+/** Reads the current admission acknowledgement, if one is readable. A corrupt
+ *  or unreadable file is absence — the barrier fails closed on the absence. */
+export function readAdmissionAck(): AdmissionAckRecord | undefined {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(readFileSync(admissionAckPath(), "utf8"));
+  } catch {
+    return undefined;
+  }
+  if (parsed === null || typeof parsed !== "object") return undefined;
+  const r = parsed as Record<string, unknown>;
+  const pause = r["pause"];
+  const daemon = r["daemon"];
+  const observedAt = r["observedAt"];
+  if (pause === null || typeof pause !== "object") return undefined;
+  const p = pause as Record<string, unknown>;
+  const source = p["source"];
+  const since = p["since"];
+  const reason = p["reason"];
+  if (typeof source !== "string" || source.length === 0) return undefined;
+  if (typeof since !== "number" || !Number.isFinite(since)) return undefined;
+  if (reason !== undefined && typeof reason !== "string") return undefined;
+  if (typeof daemon !== "string" || daemon.length === 0) return undefined;
+  if (typeof observedAt !== "number" || !Number.isFinite(observedAt)) return undefined;
+  return { pause: { source, since, ...(reason === undefined ? {} : { reason }) }, daemon, observedAt };
+}
+
+/**
+ * Writes the admission acknowledgement for the pause the daemon just observed.
+ * The observed instance is the most restrictive fence in force: a host-global
+ * sentinel gates every project and is the pause a host-wide transaction (setup,
+ * an all-projects hold) froze, so it wins over a project-scoped sentinel;
+ * otherwise the project's own sentinel is the effective one for the daemon's
+ * claims, matching {@link pauseInstance}. Recording the project sentinel while
+ * a global fence is also in force would name a narrower, older hold instead of
+ * the fence that actually gates the host — and a barrier that froze the global
+ * sentinel could then never match its own acknowledgement (#651 review #4). A
+ * no-op when no pause is readable: there is nothing to acknowledge. The
+ * generation is the writing daemon's own (the record it owns, or its
+ * supervised MainPID).
+ */
+export function writeAdmissionAck(project: string): void {
+  // `pauseInstance()` reads only the global sentinel; while it is in force it
+  // is the fence that gates every project, and the durable record must name it
+  // rather than a per-project hold that predates it.
+  const pause = pauseInstance() ?? pauseInstance(project);
+  if (pause === undefined) return;
+  const generation = daemonGeneration();
+  if (generation === undefined) return;
+  const path = admissionAckPath();
+  mkdirSync(dirname(path), { recursive: true });
+  const record: AdmissionAckRecord = { pause, daemon: generation, observedAt: Date.now() };
+  const tmp = `${path}.${process.pid.toString(36)}.${Date.now().toString(36)}.tmp`;
+  try {
+    writeFileSync(tmp, `${JSON.stringify(record, null, 2)}\n`, { mode: 0o600 });
+    renameSync(tmp, path);
+  } catch (err) {
+    rmSync(tmp, { force: true });
+    throw err;
+  }
+}
+
+/** Wake the daemon's dispatch loop to prompt a pass (best-effort; used by the
+ *  setup barrier so a live daemon acknowledges the fence without waiting for
+ *  its next five-minute tick). A refused/failed wake just lengthens the wait;
+ *  the barrier's deadline is what bounds it. */
+export async function wakeDaemon(port: number): Promise<void> {
+  try {
+    await fetch(`http://127.0.0.1:${port}/wake`, {
+      method: "POST",
+      signal: AbortSignal.timeout(1_500),
+    });
+  } catch {
+    // Best-effort by contract: the caller's bounded wait is the backstop.
+  }
+}
+
 // ----------------------------------------------------------- package integrity
 
 /** Enough differing paths to tell a deploy from a tamper at a glance; the full
@@ -775,16 +934,29 @@ const DISCUSSION_CHARS_BUDGET = 8_000;
  * the #517 failure. An empty comment list renders nothing, so a commentless
  * issue's brief stays byte-identical to what this package has always shipped.
  */
-function renderDiscussion(comments: IssueComment[] | "unread"): string {
+function renderDiscussion(comments: IssueComment[] | "unread", lane?: FileLane): string {
   if (comments === "unread") {
-    return [
+    const lines = [
       "## Discussion",
       "",
       "_The issue's comments could not be read at dispatch time. The live read below is_",
       "_the only path to them; if it prints nothing, that is a failed read, not an_",
       "_absence of discussion._",
       "",
-    ].join("\n");
+    ];
+    // The lane admission enforced is carried through dispatch, so even an
+    // unreadable thread cannot hide it from the worker (#608): the gate's
+    // effective declaration renders from the admission snapshot, not from the
+    // read that just failed. A body declaration needs no note — the body
+    // always renders.
+    if (lane !== undefined && lane.at !== "body") {
+      lines.push(
+        "_The effective file lane below was enforced at admission — it supersedes any earlier declaration._",
+        lane.source,
+        "",
+      );
+    }
+    return lines.join("\n");
   }
   if (comments.length === 0) return "";
   const total = comments.length;
@@ -812,9 +984,67 @@ function renderDiscussion(comments: IssueComment[] | "unread"): string {
       "",
     );
   }
+  // The file-lane gate resolves its effective lane across the whole thread,
+  // not just what this budget renders, so a winning declaration beyond the
+  // budget would otherwise control admission while the worker never sees it
+  // (#608). Reproduce the winning declaration verbatim here — `at` records
+  // the comment it came from — so the rendered brief and the gate agree on
+  // the same lane, and the note itself re-parses through the same
+  // `File lane:` grammar. The note is suppressed only when the winning
+  // declaration is provably visible in the rendered thread (the body always
+  // renders, so a body winner needs none); a carried admission lane whose
+  // comment the dispatch re-read shifted or dropped still renders here,
+  // whether or not the thread was truncated.
+  if (
+    lane !== undefined &&
+    lane.at !== "body" &&
+    !comments.slice(0, shown).some((c) => c.body.includes(lane.source))
+  ) {
+    lines.push(
+      `_The effective file lane was declared in comment ${lane.at + 1} — it supersedes any earlier declaration._`,
+      lane.source,
+      "",
+    );
+  }
   return lines.join("\n");
 }
 
+/**
+ * The parsed file lane as a brief section (#724): the file list the gate will
+ * enforce, or the explicit fail-open note — the same `laneEcho` the promotion
+ * verb prints, so the author and the worker read one parse. Deliberately only
+ * the parse, never the source line: the prose already renders in the body or
+ * the discussion, and in #720's case the prose is exactly what looked
+ * reasonable to a human while parsed greedily.
+ */
+function laneBlock(lane: FileLane | undefined): string {
+  const echo = laneEcho(lane);
+  const body = lane === undefined ? `_${echo}_` : `\`${echo}\``;
+  return ["## File lane (as parsed)", "", body, "", ""].join("\n");
+}
+
+/**
+ * What an orphan-resumed worker is told about the file lane on top of the
+ * continuation notice (#608). The original brief already in the transcript
+ * may show an earlier declaration, while admission enforces the current one —
+ * replaying the whole brief would re-do the work, but continuing under a stale
+ * lane is the collision the gate exists to stop. The declaration is rendered
+ * verbatim, so it re-parses through the same `File lane:` grammar every
+ * surfaced declaration uses.
+ */
+function resumeLaneBlock(lane: FileLane): string {
+  return [
+    "",
+    "The file lane admission enforced for this continuation is below. It supersedes",
+    "any lane declaration in the brief already in your transcript:",
+    "",
+    lane.source,
+    "",
+    `Parsed files: ${laneEcho(lane)}.`,
+    "",
+  ].join("\n");
+}
+
 /**
  * Record a state-label swap for projection (#201). The add enqueues before the
  * remove — the reverse order would leave a window where the issue carries no
@@ -828,211 +1058,6 @@ function swapLabel(store: Store, projectName: string, issue: number, from: strin
     { issue, op: "remove", label: from },
   ]);
 }
-/**
- * Persist the operator-stop transition before releasing its live controller.
- * The row is terminal first, then its in-progress label is removed through the
- * same durable projection outbox as every other lifecycle transition.
- */
-export function recordOperatorStop(
-  store: Pick<Store, "updateRun" | "enqueueLabelOps">,
-  args: {
-    project: string;
-    issue: number;
-    runId: string;
-    inProgress: string;
-    reason: string;
-    patch: Partial<RunRecord>;
-  },
-): void {
-  store.updateRun(args.runId, {
-    ...args.patch,
-    state: "stopped",
-    lastError: `operator stopped: ${args.reason}`,
-  });
-  store.enqueueLabelOps(args.project, [
-    { issue: args.issue, op: "remove", label: args.inProgress },
-  ]);
-}
-
-
-/**
- * The escalator throws when no transport is configured or Telegram rejects, and
- * only records the dedup marker on success. A page that cannot be delivered
- * must not take the tick down with it — log it and let the next tick retry.
- *
- * Returns whether it actually went out, because "page once" and "page once
- * *successfully*" are different promises: a caller that latches a once-only
- * gate on the attempt turns one failed delivery into permanent silence about a
- * condition that is still true.
- */
-
-async function reactToProviderCredit(
-  d: Deps,
-  issue: number,
-  message: string,
-  sessionFile: string | undefined,
-): Promise<void> {
-  const { project } = d;
-  const alreadyPaused = isPaused(project.name);
-  if (!alreadyPaused) setPaused(true, { source: "provider-credit", reason: message }, project.name);
-  log(
-    `#${issue} provider refused for credit — dispatch ${alreadyPaused ? "remains paused" : "paused"}: ${message}`,
-  );
-  // Fleet-scoped and run-independent on purpose. The notification ledger
-  // dedupes on `project:issue:tier:summary`, so `NO_ISSUE` plus a summary
-  // carrying no run or attempt pages once for the fleet, not once per run.
-  await safeEscalate(d, {
-    tier: 2,
-    category: "fleet-stopped",
-    project: project.name,
-    issue: NO_ISSUE,
-    summary: `Model provider refused for credit — ${project.name} is paused`,
-    detail: [
-      message,
-      "",
-      "No implementation attempt was charged: this is a billing state, not a",
-      "failed implementation. Each affected issue keeps its queue label and",
-      "re-dispatches on `omp-conductor resume` once the provider has credit.",
-      `Session: ${sessionFile ?? "(no transcript)"}`,
-    ].join("\n"),
-  });
-}
-
-/**
- * What a salvage attempt contributes to the escalation: where the work went, or
- * that it went nowhere. Split from the effects below for the same reason
- * `checkIntegrity` is — this wording is the whole thing a human acts on, so it
- * is worth a test holding it, and the sha in it is the only pointer to work
- * that no longer has any other copy.
- *
- * `retained` is not cosmetic. These lines used to promise a tree "kept for
- * inspection" unconditionally, which was true only because salvage ran only on
- * the paths that keep one. A blocked run's tree is removed the moment its work
- * is safely on the branch, and sending an operator to a path this process just
- * deleted is the same class of mistake as #118 itself.
- */
-export function salvageLines(
-  outcome: SalvageOutcome,
-  worktree: string,
-  retained: boolean,
-): string[] {
-  const fate = retained
-    ? `Worktree kept for inspection: ${worktree}`
-    : `Worktree removed: ${worktree}`;
-
-  if (outcome.kind === "nothing") return [`${fate} — nothing uncommitted to salvage`];
-
-  if (outcome.kind === "failed") {
-    return [
-      `WIP SALVAGE FAILED: ${outcome.error}`,
-      `Uncommitted work in ${worktree} is the only copy of it, so the tree was kept.`,
-      "This issue is held out of dispatch until the tree is recovered by hand and",
-      "`omp-conductor unblock <n> --force` records that you accepted it.",
-    ];
-  }
-
-  const where =
-    `WIP committed to ${outcome.branch} @ ${outcome.sha}` +
-    (outcome.pushed
-      ? " and pushed — the work outlives this worktree"
-      : ` but NOT pushed (${outcome.pushError ?? "no reason given"}) — it lives only in this host's mirror`);
-  // Manifest belongs in the escalation too: opening the commit is how the
-  // orchestrator talked itself into scrubbing a worker tree (#38).
-  const n = outcome.files.length;
-  const count = `${n} file${n === 1 ? "" : "s"}`;
-  const manifest =
-    outcome.newPaths.length === 0
-      ? `${count} (all modifications to tracked paths)`
-      : `${count}; new: ${outcome.newPaths.slice(0, 12).join(", ")}${
-          outcome.newPaths.length > 12 ? `, … +${outcome.newPaths.length - 12} more` : ""
-        }`;
-  return [where, manifest, fate];
-}
-
-/** Everything a settled run has to record and say about its worktree. */
-export interface WorktreeSettlement {
-  outcome: SalvageOutcome;
-  /** Whether the tree still exists now the run is over. */
-  retained: boolean;
-  /** Escalation lines naming where the work went. */
-  lines: string[];
-  /** Row fields recording the durable ref, or the failure that blocks a re-claim. */
-  patch: Pick<RunRecord, "salvageSha" | "salvageError">;
-}
-
-/**
- * Decides what becomes of a finished run's worktree: save the work, then keep
- * or remove the tree, then say which.
- *
- * One function because the two halves are one decision and splitting them is
- * how #118 happened — the removal at the end of dispatch had no idea whether
- * anything had been saved, and the salvage at the top of the failure branch had
- * no idea the blocked branch fell through to a `--force` removal.
- *
- * A salvage that *fails* retains the tree whatever the caller asked for. There
- * was real work, git refused to commit it, and the tree is now the only copy in
- * existence: deleting it on schedule would be the data loss this whole path
- * exists to prevent. The issue is held out of dispatch until an operator says
- * otherwise, because the next attempt's `worktree remove --force` would finish
- * the job (see `admitCandidates`).
- *
- * Exported so a test can drive the real decision against a real git tree.
- */
-export async function settleWorktree(
-  args: {
-    issue: number;
-    attempt: number;
-    /** Clause for the commit subject: "killed by the turns cap", "blocked …". */
-    ending: string;
-    worktree: string;
-    /** The run's branch, so the pre-removal publish names the right ref. */
-    branch: string;
-    /**
-     * Publishes the run branch on the privileged side. Required rather than
-     * optional: the run's commits live in a repository of its own,
-     * so a removal that did not publish first would delete the only copy —
-     * which is #121's data loss with one extra step. `undefined` is a visible
-     * decision at the call site, never an omission.
-     */
-    publish: RunPublisher | undefined;
-  } & (
-    | /** Terminal-failure and orphan trees are evidence, and are kept even when clean. */
-    { tree: "keep" }
-    | { tree: "remove"; mirrorPath: string }
-  ),
-): Promise<WorktreeSettlement> {
-  const { issue, attempt, ending, worktree, branch, publish } = args;
-  const outcome = await salvageWip(worktree, issue, attempt, ending, publish);
-  const retained = args.tree === "keep" || outcome.kind === "failed";
-  if (!retained && args.tree === "remove") {
-    // Before the removal, always — not only when salvage found something. A run
-    // that *committed* and could not publish has its work in its own repository
-    // and nowhere else, and salvage never sees a committed tree because it is
-    // clean. The mirror fetch inside `publish` is what preserves it; the push
-    // to GitHub can fail (no network, protected ref) and the work still lives.
-    const published = await publish?.(branch);
-    if (published !== undefined && !published.ok) {
-      log(`#${issue} publish before removal failed, work is preserved in the mirror: ${published.stderr}`);
-    }
-    await removeWorktree(args.mirrorPath, worktree);
-  }
-
-  const lines = salvageLines(outcome, worktree, retained);
-  log(`#${issue} salvage: ${lines.join(" ")}`);
-  return {
-    outcome,
-    retained,
-    lines,
-    patch:
-      outcome.kind === "salvaged"
-        ? { salvageSha: outcome.sha }
-        : outcome.kind === "failed"
-          ? { salvageError: outcome.error }
-          : {},
-  };
-}
-
-
 /**
  * How a run's end is named — in the salvage commit, and to whoever reads it.
  * The whole clause, not a bare reason: a graceful block was not killed by
@@ -1066,6 +1091,15 @@ export async function buildBrief(
      *  when the tracker refused at dispatch — rare, but it must never read as
      *  "no comments" (the #517 failure mode). Absent means an empty list. */
     comments?: IssueComment[] | "unread";
+    /**
+     * The effective file lane admission resolved for this candidate (#608).
+     * When carried, the brief renders exactly this value — the gate's own
+     * snapshot — instead of recomputing from the dispatch-time comment read,
+     * so a changed or failed second read can neither hide nor reword the
+     * lane admission enforced. Absent (unit-level callers), the lane is
+     * resolved from the rendered thread itself.
+     */
+    lane?: FileLane;
   } = {},
 ): Promise<string> {
   // Read per dispatch rather than caching: editing the brief then takes effect
@@ -1103,6 +1137,18 @@ export async function buildBrief(
           "",
         ].join("\n")
       : "";
+  // The comments as rendered, and the effective file lane the brief must show
+  // — the admission-carried value when dispatch has one, else the lane the
+  // thread itself resolves to — passed to the renderer so a winning
+  // declaration can be reproduced verbatim even when it sits beyond the
+  // discussion budget, keeping the gate and the worker-visible brief on one
+  // lane (#608).
+  const comments = opts.comments ?? [];
+  // The effective lane admission resolved (or resolves) for this candidate:
+  // the carried admission snapshot when dispatch has one, else the thread
+  // itself. Both the discussion renderer and the parsed-lane section draw on
+  // the same value, so the brief shows one lane on every surface (#608, #724).
+  const lane = opts.lane ?? (comments === "unread" ? undefined : effectiveLane(r.issue.body, comments));
   return renderBrief(template, {
     ISSUE_NUMBER: String(r.issue.number),
     ISSUE_TITLE: r.issue.title,
@@ -1111,11 +1157,18 @@ export async function buildBrief(
     BRANCH: branch,
     WORKTREE: worktree,
     ACCEPTANCE_CRITERIA: acceptanceCriteria(r.issue),
-    ISSUE_COMMENTS: renderDiscussion(opts.comments ?? []),
+    ISSUE_COMMENTS: renderDiscussion(comments, lane),
+    FILE_LANE: laneBlock(lane),
     GATES: gatesBlock(r.repo),
-    // Empty for a repo with no `graphProject`, and empty means *nothing*: the
-    // placeholder sits flush against the next list item in the template, so an
-    // unconfigured render leaves no blank line where a hint would have gone.
+    // The guarded shell suites and their sanctioned parse-only check, derived
+    // from SHARED_HOST_SCRIPTS so the brief and the refusal share one list
+    // (#687). Non-empty whenever the guard has paths, so the placeholder line
+    // always renders to a line.
+    SHARED_HOST_NOTICE: sharedHostBriefNotice(),
+    // The brief's code-graph paragraph: the exact `project` key for a
+    // configured repo, or an explicit "no graph" statement for an
+    // unconfigured one — never silence, because a worker that knows there is
+    // no graph stops looking for it.
     GRAPH_HINT: graphHint(r.repo),
     CONTINUATION: continuation,
   });
@@ -1124,178 +1177,6 @@ export async function buildBrief(
 // ------------------------------------------------------------------- one issue
 
 
-/** The failure classes `countContinuations` deliberately does not charge — the
- *  inverted copy of its exclusions, kept beside the breakdown that consumes it
- *  so the two can only drift together (#439). `orphan-clean` is absent on
- *  purpose: daemon orphans consume the continuation budget, which is exactly
- *  why the requeue side has to respect the ceiling instead of racing it. */
-const NON_CONTINUATION_CLASSES: Partial<Record<FailureClass, true>> = {
-  "admin-kill": true,
-  "settlement-stuck": true,
-  "env-start-failure": true,
-  "dispatch-infra": true,
-  "provider-credit": true,
-  "provider-transient": true,
-  "provider-capacity": true,
-};
-
-/** How one issue spent its continuation budget, grouped by failure class —
- *  the exact rows `continuationsFor` charges, so an exhaustion escalation
- *  reports the same budget it says is spent. `unclassified` groups rows that
- *  charged before the class was written (a pre-upgrade NULL). */
-function continuationBreakdown(runs: readonly RunRecord[]): Map<string, number> {
-  const perClass = new Map<string, number>();
-  for (const r of runs) {
-    const chargedAsKilledOrOrphaned =
-      (r.state === "killed" || r.state === "orphaned" || r.state === "blocked") &&
-      (r.failureClass === undefined || NON_CONTINUATION_CLASSES[r.failureClass] === undefined);
-    const chargedAsReturned = r.state === "failed" && r.failureClass === "returned-for-revision";
-    if (!chargedAsKilledOrOrphaned && !chargedAsReturned) continue;
-    const cls = r.failureClass ?? "unclassified";
-    perClass.set(cls, (perClass.get(cls) ?? 0) + 1);
-  }
-  return perClass;
-}
-
-/** The newest attempt's preserved work, if any, so an exhaustion escalation can
- *  say whether continuing is worthwhile: `salvageSha`/`headSha`/`prUrl` are the
- *  three artifacts a run can leave, and all null on a branch nothing reached. */
-function newestContinuableRun(runs: readonly RunRecord[]): RunRecord | undefined {
-  const newestFirst = [...runs].reverse();
-  return newestFirst.find(
-    (r) => r.salvageSha !== undefined || r.headSha !== undefined || r.prUrl !== undefined,
-  );
-}
-
-/** The fenced-block info string that marks an exhaustion postmortem comment, so
- *  a grooming scout re-slicing the issue can find and parse the whole block by
- *  grepping for it. */
-export const POSTMORTEM_MARKER = "conductor-postmortem";
-
-/** How one issue's attempt chain failed, as "3× ci-deterministic, 1× …" — the
- *  digest shape for naming what the exhaustion was. Groups every row by its
- *  failure class, whether or not it charged the continuation budget, because
- *  the postmortem tells the whole story and not just the budget half (#290). */
-export function attemptClassBreakdown(runs: readonly RunRecord[]): string {
-  const perClass = new Map<string, number>();
-  for (const r of runs) {
-    const cls = r.failureClass ?? "unclassified";
-    perClass.set(cls, (perClass.get(cls) ?? 0) + 1);
-  }
-  if (perClass.size === 0) return "unclassified";
-  return Array.from(perClass, ([cls, n]) => `${n}× ${cls}`).join(", ");
-}
-
-/** Wall-clock duration of one run as a compact human string ("45m", "1h30m"). */
-export function humanDuration(ms: number): string {
-  const seconds = Math.max(0, Math.round(ms / 1_000));
-  if (seconds < 60) return `${seconds}s`;
-  const minutes = Math.round(seconds / 60);
-  if (minutes < 60) return `${minutes}m`;
-  const hours = Math.floor(minutes / 60);
-  const rest = minutes % 60;
-  return rest === 0 ? `${hours}h` : `${hours}h${rest}m`;
-}
-
-/** Flatten and bound a run's last error to one greppable table line. */
-export function oneLineBrief(text: string | undefined): string | undefined {
-  if (text === undefined || text.trim() === "") return undefined;
-  const flat = text.replace(/\s+/g, " ").trim();
-  return flat.length > 90 ? `${flat.slice(0, 89)}…` : flat;
-}
-
-/**
- * The exhaustion postmortem block: one greppable fenced block covering every
- * attempt in the chain — continuation rows included — with per-attempt turns,
- * wall clock, failure class and a one-line last error, the explicit salvage
- * state, the spend total and the transcript paths for local inspection.
- *
- * Pure so the tests hold the shape, not the transport: the writer below owns
- * the once-only guarantee, this owns what "once" looks like.
- */
-export function formatExhaustionPostmortem(args: {
-  issue: number;
-  runs: readonly RunRecord[];
-  reason: string;
-}): string {
-  const { issue, runs, reason } = args;
-  const artifact = newestContinuableRun(runs);
-  const totalSpend = runs.reduce((sum, r) => sum + r.spendUsd, 0);
-  const spend = `$${totalSpend.toFixed(2)}`;
-  const attemptLines = runs.map((r) => {
-    const wall = r.endedAt === undefined ? "—" : humanDuration(r.endedAt - r.startedAt);
-    const cls = r.failureClass ?? "unclassified";
-    const error = oneLineBrief(r.lastError) ?? "—";
-    return (
-      `  attempt ${r.attempt}  ${r.state.padEnd(12)}  turns ${r.turns}/${r.maxTurns}  ` +
-      `${cls.padEnd(24)}  ${wall.padStart(4)}  last error: ${error}`
-    );
-  });
-  const salvage =
-    artifact === undefined
-      ? "Salvaged WIP: absent — no attempt preserved a branch, head SHA or pull request."
-      : `Salvaged WIP: present — branch ${artifact.branch} at ${artifact.headSha ?? artifact.salvageSha}` +
-        `${artifact.prUrl === undefined ? "" : ` (PR ${artifact.prUrl})`}.`;
-  return [
-    `\`\`\`${POSTMORTEM_MARKER}`,
-    `#${issue} exhausted: ${attemptClassBreakdown(runs)}`,
-    reason,
-    "",
-    `Attempts (${runs.length} total, ${spend} spend):`,
-    ...attemptLines,
-    salvage,
-    `Spend total: ${spend} across ${runs.length} attempts.`,
-    "Transcripts:",
-    ...runs.map((r) => (r.sessionFile === undefined ? "  (none)" : `  ${r.sessionFile}`)),
-    "```",
-  ].join("\n");
-}
-
-/** Dedupe key prefix for the exhaustion postmortem comment, per issue. */
-function postmortemDedupeKey(project: string, issue: number): string {
-  return `${project}:postmortem:${issue}`;
-}
-
-/**
- * The exhaustion postmortem: written exactly once per issue, at the point the
- * continuation budget is spent and the issue is settled toward a human.
- *
- * The comment and the material event are both gated by the store's notification
- * ledger — the same idempotence guard the escalator uses — so re-settling an
- * already-postmortemed issue posts nothing and records nothing. A body-string
- * match on the issue would be the wrong guard: an issue re-scoped and re-run
- * would still carry the old block, and the guarantee asked of this is "decided
- * once", not "deduped against what is already written".
- *
- * The digest must name the exhaustion even if the comment write fails, so the
- * material event is recorded before the write and unconditionally (the ledger
- * is append-only, and the gate above already ran once). The comment failure is
- * logged rather than taking the sweep down with it.
- */
-async function postExhaustionPostmortem(d: Deps, run: RunRecord, reason: string): Promise<void> {
-  const { project, tracker, store } = d;
-  const key = postmortemDedupeKey(project.name, run.issue);
-  if (store.wasNotified(key)) return;
-  const runs = store.runsForIssue(project.name, run.issue);
-  const body = formatExhaustionPostmortem({ issue: run.issue, runs, reason });
-  const occurredAt = Date.now();
-  store.recordMaterialEvent({
-    project: project.name,
-    category: "exhaustion",
-    summary: `#${run.issue} exhausted: ${attemptClassBreakdown(runs)}`,
-    evidence: body,
-    occurredAt,
-    recordedAt: occurredAt,
-  });
-  try {
-    await tracker.comment(run.issue, body);
-    store.markNotified(key);
-    log(`#${run.issue} posted exhaustion postmortem (${runs.length} attempts)`);
-  } catch (err) {
-    log(`#${run.issue} postmortem comment could not be posted (${errText(err)})`);
-  }
-}
-
 export type ExtendTurnLimitResult =
   | { kind: "extended"; runId: string; maxTurns: number }
   | { kind: "not-increase"; runId: string; maxTurns: number }
@@ -1499,45 +1380,6 @@ export async function verifyPushedGreenClaim(
   };
 }
 
-/** What the settlement audit of one green run produced: the advisory flags
- *  (test weakening only — the file-list disclosure is derived, not flagged),
- *  whether the diff was cut short, and the `changed:` line composed from the
- *  PR's own diff. */
-export interface SettlementAuditResult {
-  flags: SettlementFlag[];
-  truncated: boolean;
-  /** The `changed:` file list derived from the PR's diff, present whenever the
-   *  diff could be read. Absent means the tree could not be read, and `flags`
-   *  then carries exactly {@link UNREADABLE_TREE_FLAG}. */
-  changedLine?: string;
-}
-
-/**
- * Audit a worker's own account of its work against the pull request it pushed.
- *
- * The thin half of the split #85 established: this fetches, {@link
- * analyseSettlement} decides. It runs beside {@link verifyPushedGreenClaim} and
- * shares none of its authority — that function decides a run's state, this one
- * cannot, by construction. It returns evidence and the caller appends it.
- *
- * A diff that cannot be read is a finding (`changed-line-missing`), never an
- * empty flag list: nothing was derived and nothing was checked, and that must
- * not read as a clean bill.
- */
-export async function collectSettlementFlags(
-  tracker: Pick<Tracker, "prDiff">,
-  claim: { prUrl?: string; issueText: string },
-): Promise<SettlementAuditResult> {
-  if (claim.prUrl === undefined) return { flags: [UNREADABLE_TREE_FLAG], truncated: false };
-  const diff = await tracker.prDiff(claim.prUrl);
-  if (diff === undefined) return { flags: [UNREADABLE_TREE_FLAG], truncated: false };
-  return {
-    flags: analyseSettlement({ issueText: claim.issueText, diff }),
-    truncated: diff.truncated,
-    changedLine: deriveChangedLine(diff),
-  };
-}
-
 /**
  * One attempt at one issue, from claim to terminal state. Everything is inside
  * a single try/catch so that a bad issue costs its own run and nothing else.
@@ -1681,7 +1523,12 @@ function orphanResumeVerdict(
   return { kind: "resume", prior };
 }
 
-export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<void> {
+export async function handleIssue(
+  d: Deps,
+  r: Routed,
+  attempt: number,
+  admittedLane?: FileLane,
+): Promise<void> {
   const { project, caps, tracker, store } = d;
   const issue = r.issue.number;
   const branch = branchName(r.issue);
@@ -1824,6 +1671,24 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
       return;
     }
 
+    // The claim-side of the pause fence (#651 review #3): the tick's pause
+    // gate sits above routing, so a tick that passed that gate before an
+    // operator wrote the freeze can still be mid-routing when the fence lands
+    // — it would claim after the setup barrier's acknowledgement and before
+    // its first mutation. The claim itself re-checks the pause and refuses,
+    // writing the durable admission acknowledgement the barrier waits for.
+    // A claim observed under the fence is the last admission boundary there
+    // is: nothing may create a run row beside a held fleet.
+    if (isPaused(d.project.name)) {
+      try {
+        writeAdmissionAck(d.project.name);
+      } catch (err) {
+        log(`admission acknowledgement write failed: ${errText(err)}`);
+      }
+      log(`#${issue} not claimed: dispatch is paused at claim time`);
+      return;
+    }
+
     // Claim on the STORE first, before anything that can fail. The run row —
     // not the label — is the crash-safe guard against double dispatch: rows
     // are local, written before any network call, and the startup orphan
@@ -1899,6 +1764,10 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
       spendUsd: 0,
       maxTurns: caps.workerMaxTurns,
       startedAt: Date.now(),
+      // #567: the orphan-clean attempt this claim continues, when the verdict
+      // above fired. `undefined` for a fresh dispatch — the store maps that to
+      // NULL, so a fresh row simply never carries the field.
+      resumedFromRunId: resuming?.id,
     });
     // #434: carry a terminal predecessor's open PR onto the continuation row.
     // The claim itself stays synchronous — `handleIssue` claims at the top of
@@ -2043,10 +1912,15 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
     // The continuation notice replaces the brief for a resumed attempt (#536).
     // The original brief is already in the resumed transcript; re-sending it is
     // how a resumed worker ends up re-doing the work it just did. Everything
-    // below the brief is fresh-dispatch-only, exactly as today.
+    // below the brief is fresh-dispatch-only, exactly as today — except the
+    // file lane admission enforced for this continuation, which rides the
+    // notice itself: the retained transcript's brief may show an earlier
+    // declaration, and a worker continuing under a stale lane is the collision
+    // the gate exists to stop (#608).
     let brief: string;
     if (resuming !== undefined) {
-      brief = ORPHAN_RESUME_PROMPT;
+      brief =
+        ORPHAN_RESUME_PROMPT + (admittedLane === undefined ? "" : resumeLaneBlock(admittedLane));
     } else {
       // The discussion is rendered at dispatch so a worker never depends on a
       // runtime `gh` read to see the orchestrator's grooming (#517). The read is
@@ -2068,6 +1942,7 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
           ? { salvagedSha: priorSalvage }
           : {}),
         comments,
+        lane: admittedLane,
       });
     }
     if (await settleStopBeforeSession()) return;
@@ -2183,6 +2058,9 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
         ? await collectSettlementFlags(tracker, {
             prUrl: result.prUrl,
             issueText: `${r.issue.title}\n${r.issue.body}`,
+            // The claimed-proof check compares the PR's Verified commands
+            // against what this run's session actually recorded.
+            sessionFile: result.sessionFile,
           })
         : undefined;
     if (result.state === "pushed-green" && audit?.truncated) {
@@ -2369,7 +2247,7 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
       });
 
       if (providerCredit !== undefined) {
-        await reactToProviderCredit(d, issue, providerCredit, result.sessionFile);
+        await reactToProviderCredit({ project: d.project, escalate: (e) => d.escalate(e), isPaused, setPaused }, issue, providerCredit, result.sessionFile);
         swapToQueue(d, issue, inProgress);
       } else if (continueTurns) {
         // Requeue as one ordered pair: the in-progress removal before the
@@ -2535,141 +2413,771 @@ export async function handleIssue(d: Deps, r: Routed, attempt: number): Promise<
   }
 }
 
-// ------------------------------------------------------------------- settlement
-
-/** What a resolved PR turns its `pushed-green` row into. */
-export interface Settlement {
-  state: "merged" | "failed";
-  /** The log line after `#<n> settled: `, and — for a rejection — the row's own
-   *  `lastError`, because a `failed` row whose worker succeeded has to say so. */
-  reason: string;
-}
-
-/**
- * What one `pushed-green` row becomes now its PR has an answer, or undefined to
- * leave the row exactly as it is.
- *
- * A `pushed-green` row is the only one nothing ever revisited: the worker is
- * finished, `reconcileOrphanedRuns` only settles rows that held a process, and
- * `merged` went unwritten from day one. So they accumulated — three of them on
- * the reference fleet on 2026-08-07, every PR merged and every issue closed,
- * with `/healthz` still reporting three active runs and their issues
- * permanently unclaimable, because the busy set *is* the active set (#18).
- *
- * The mapping, and why each answer is the only honest one:
- *
- * - `merged` — the work landed. That is what `merged` was reserved for.
- * - `closed` — a human read the work and said no. Leaving it `pushed-green`
- *   forever is a lie; `failed` records that it did not land and releases the
- *   busy guard, so an issue a human re-queues can be attempted again. A row
- *   that had reached `pushed-green` or `pushed-pending` is classified
- *   `returned-for-revision` at settlement. A review decision asks for another
- *   implementation pass, not a failure, so it consumes the continuation budget
- *   instead of the failed-attempt budget.
- * - `open`, and undefined — nothing changes. Undefined is "could not tell": a
- *   flaky network, a revoked token, a deleted PR. Settling on it would record a
- *   merge that never happened, and the next tick asks again for free. An
- *   ambiguous answer must never settle a row.
- */
-export function settlementFor(pr: PrState | undefined, prUrl: string): Settlement | undefined {
-  if (pr === "merged") return { state: "merged", reason: `${prUrl} merged` };
-  if (pr === "closed") return { state: "failed", reason: `${prUrl} closed without merging` };
-  return undefined;
-}
+// ------------------------------------------------------------ review revisions
 
 /**
- * Records the in-progress label's release as a projection op (#201).
+ * The daemon half of the review-revision transport (#677): wake every pending
+ * revision the orchestrator's verb recorded, on the tick, exactly like
+ * admission — the verb has no handle on the worker machinery, and the CLI path
+ * must behave like the embedded one. Bounded by the same worker slots, so a
+ * queued revision can never push the fleet past `maxConcurrentWorkers`; the
+ * remaining rows stay pending for the next tick.
  *
- * Settlement used to write only half of what it knew. On 2026-08-09 that cost
- * the reference fleet two issues in one night: veltro#331 settled to `failed`
- * at 23:53Z once the orchestrator closed veltro#332 unmerged, and veltro#344
- * settled to `merged` at 05:54Z once chad#452 squash-merged. Both rows left the
- * active set correctly; an authoritative `gh issue view` on each afterwards
- * still showed `agent:in-progress` — permanently unclaimable with no supported
- * way back (#18).
- *
- * The outbox makes the row transition and the label one fact again: the
- * removal is enqueued in the same breath as the row is terminalised, the
- * projector applies it with unbounded retry, and while it is pending the
- * eligibility overlay treats the label as already gone. A tracker that refuses
- * the write (403, rate limit) can no longer strand the row — that is `#184`
- * and `#198` closed. No `pushed-*` row is ever written terminal with its
- * label release owed but unrecorded, because enqueueing is a local store write
- * that cannot fail on the tracker.
- *
- * Synchronous. The op is durable the moment this returns.
+ * The claim (`pushed-green` → `running`) is synchronous and atomic per row;
+ * only the resumed worker runs in the pool. A row that moved since the verb
+ * recorded it — merged after all, settled, re-claimed — fails the claim and is
+ * settled `skipped` rather than woken on stale identity.
  */
-export function releaseInProgress(
-  d: Pick<Deps, "project" | "store">,
-  issue: number,
-  why: string,
-): void {
-  const label = d.project.stateLabels.inProgress;
-  d.store.enqueueLabelOps(d.project.name, [{ issue, op: "remove", label }]);
-  log(`#${issue} released ${label} (queued): ${why}`);
+export async function dispatchReviewRevisions(d: Deps, pool?: WorkerPool): Promise<void> {
+  const pending = d.store.pendingReviewRevisions(d.project.name);
+  if (pending.length === 0) return;
+  const slots = Math.max(0, d.caps.maxConcurrentWorkers - d.store.liveRuns(d.project.name).length);
+  const batch = pending.slice(0, slots);
+  const launches: Promise<void>[] = [];
+  for (const revision of batch) {
+    if (d.drain?.draining === true) {
+      log(
+        `review revisions held: the daemon is draining (${batch.length - launches.length} of ${batch.length} not launched)`,
+      );
+      break;
+    }
+    if (!d.store.claimRunForReview(revision.runId)) {
+      d.store.settleReviewRevision(revision.id, "skipped", Date.now());
+      log(
+        `#${revision.issue} review round ${revision.round} skipped: run ${revision.runId} is no longer pushed-green`,
+      );
+      continue;
+    }
+    d.store.markReviewRevisionDispatched(revision.id, Date.now());
+    log(`#${revision.issue} review round ${revision.round} → resuming run ${revision.runId}`);
+    launches.push(handleReviewRevision(d, revision));
+  }
+  if (pool !== undefined) {
+    for (const launch of launches) pool.launch(launch);
+    return;
+  }
+  // `--once`: like admissions, the tick waits for the workers it launched.
+  await Promise.allSettled(launches);
 }
 
 /**
- * Asks the tracker about every `pushed-green` PR and settles the ones that
- * resolved.
+ * Resume one review-revision worker: the run row is already claimed
+ * (`pushed-green` → `running` by the dispatch pass), so this resumes the SAME
+ * OMP session — same session directory, `resume: true` at the harness, and the
+ * `sessionFile` lineage compared at dispatch time — on the SAME branch and PR,
+ * then settles the row back the way {@link handleIssue} settles any worker.
  *
- * Effects at the call site, decision in {@link settlementFor} — the same split
- * as `checkIntegrity`/`watchOrchestrator`. Exported like `admitCandidates`
- * rather than kept private, because half of what has to hold is about the sweep
- * and not the mapping: that a row without a PR costs no API call, and that one
- * unreachable PR does not stop the others from settling.
- *
- * The label is released too, which reverses what this function first promised.
- * It used to leave tracker labels alone exactly as {@link reconcileOrphanedRuns}
- * does, reasoning that a merge closes the issue anyway and that deciding what an
- * issue's labels should say next is the orchestrator's drain duty. There turned
- * out to be no such path: on 2026-08-09 two settled rows left their issues
- * carrying `agent:in-progress` forever, with the brief forbidding the
- * orchestrator from touching it and `unblock` declining to (see
- * {@link releaseInProgress}). The row transition and the label are one fact, and
- * writing half of it is the whole of that bug.
- *
- * Releasing it is safe here specifically because of what these rows are. A
- * `pushed-green` or `pushed-pending` row has no process behind it — its worker
- * exited and its worktree is gone — so a terminal answer about its PR proves no
- * worker owns the issue, and the duplicate-dispatch interlock the label exists
- * for is spent. {@link reconcileOrphanedRuns} still leaves labels alone for the
- * opposite reason: an orphaned `running` row is work nobody has read yet. And
- * the brief's rule stays absolute, because this is a daemon-owned write through
- * the same Tracker port the dispatcher claimed the issue with — orphan detection
- * is only trustworthy while every state label on the tracker came from this
- * package.
- *
- * The two writes are ordered label-then-row, and the order is load-bearing. This
- * sweep is the only thing that revisits a `pushed-*` row, so the terminal state
- * is also the row's exit from it: written first, a tracker that then failed on
- * the label would leave `agent:in-progress` with nothing left to retry it — #18
- * exactly, in the last window able to reach it. Writing the label first makes
- * failure cost a repeated `gh` call on the next tick instead, and the row stays
- * in the busy set throughout, so no second worker can be sent at the issue while
- * it waits.
+ * The run row is reused, never cloned: same attempt number, same prUrl, same
+ * transcript. That is what keeps a revision round off both budgets — the round
+ * is a state transition of one already-green row, green → running → green, and
+ * no new row exists for either counter to count. Only a revision worker that
+ * genuinely settles terminal falls through to the ordinary failure handling,
+ * budgets and all, exactly as today.
  */
-const BASE_CHECK_BATCH = 20;
-const BASE_CHECK_WINDOW_MS = 24 * 60 * 60 * 1_000;
-const BASE_STATUS_WINDOW_MS = 7 * 24 * 60 * 60 * 1_000;
-
-const SUCCESSFUL_WORKFLOW_CONCLUSIONS = new Set(["success", "neutral", "skipped"]);
+export async function handleReviewRevision(d: Deps, revision: ReviewRevisionRecord): Promise<void> {
+  const { project, caps, tracker, store } = d;
+  const run = store.getRun(revision.runId);
+  if (run === undefined || run.state !== "running") {
+    log(
+      `#${revision.issue} review round ${revision.round} skipped: run ${revision.runId} is ${run?.state ?? "gone"} — ` +
+        "the row moved between the dispatch claim and the resume.",
+    );
+    store.settleReviewRevision(revision.id, "skipped", Date.now());
+    return;
+  }
+  const issue = run.issue;
+  const branch = run.branch;
+  const runId = run.id;
+  const inProgress = project.stateLabels.inProgress;
+  const repo = Object.values(project.routing.repos).find((candidate) => candidate.name === run.repo);
+  if (repo === undefined) {
+    log(`#${issue} review round ${revision.round} cannot dispatch: repo ${run.repo} is no longer routed`);
+    store.updateRun(runId, { state: "pushed-green", endedAt: Date.now() });
+    store.settleReviewRevision(revision.id, "skipped", Date.now());
+    return;
+  }
+  const mirrorPath = mirrorPathFor(repo, project.mirrorRoot);
+
+  // The session being resumed is the one the pushed-green row recorded. A
+  // revision without that transcript cannot continue the same session — the
+  // exact fake this feature exists to prevent — so fail loudly instead of
+  // silently starting a fresh one.
+  const priorSessionFile = run.sessionFile;
+  if (priorSessionFile === undefined || !existsSync(priorSessionFile)) {
+    log(
+      `#${issue} review round ${revision.round} cannot resume: the recorded transcript ` +
+        `${priorSessionFile ?? "(none)"} is gone`,
+    );
+    store.updateRun(runId, {
+      state: "pushed-green",
+      endedAt: Date.now(),
+      lastError: `review round ${revision.round} could not resume: the run's transcript is gone`,
+    });
+    store.settleReviewRevision(revision.id, "skipped", Date.now());
+    await safeEscalate(d, {
+      tier: 1,
+      project: project.name,
+      issue,
+      runId,
+      summary: `#${issue} review round ${revision.round} could not resume — the transcript is missing`,
+      detail: [
+        revision.prUrl,
+        "",
+        "The PR is still open and green; the run row was returned to pushed-green.",
+        "Resume the manual path (close + unblock + continuation) or merge it as it stands.",
+      ].join("\n"),
+    });
+    return;
+  }
+  const sessionDir = dirname(priorSessionFile);
 
-const FAILING_WORKFLOW_CONCLUSIONS = new Set([
-  "failure",
-  "cancelled",
-  "timed_out",
-  "action_required",
-  "startup_failure",
-  "stale",
-]);
+  let worktreePath: string | undefined;
+  let runRepo: RunRepoRef | undefined;
+  let turnLimit: TurnLimitController | undefined;
+  let workerControl: WorkerControlSlot | undefined;
+  let workerSessionInstalled = false;
+  let verbListener: VerbListener | undefined;
+  const repoSlug = githubRepo(repo.cloneUrl);
 
-function appendSettlementFlag(run: RunRecord, flag: SettlementFlag): SettlementFlag[] {
-  const flags = run.settlementFlags ?? [];
-  return flags.some((existing) => existing.kind === flag.kind && existing.detail === flag.detail)
-    ? flags
-    : [...flags, flag];
-}
+  /**
+   * Publishes the run's branch on the privileged side: run repo → mirror →
+   * GitHub, fast-forward only — the same route `handleIssue` uses, so the
+   * revised head the worker pushed through its own `conductor_push` is
+   * re-verified against the remote before the tree dies.
+   */
+  const publish: RunPublisher = async () => {
+    if (runRepo === undefined) return { ok: false, stderr: "the run repository was never provisioned" };
+    return pushRunBranch(project, runRepo);
+  };
+
+  const settleStopBeforeSession = async (): Promise<boolean> => {
+    const reason = workerControl?.requestedStop();
+    if (reason === undefined || workerSessionInstalled) return false;
+    turnLimit?.close();
+    turnLimit = undefined;
+    recordOperatorStop(store, {
+      project: project.name,
+      issue,
+      runId,
+      inProgress,
+      reason,
+      patch: {
+        endedAt: Date.now(),
+        report: ["Operator stopped the review revision before its session started.", `Reason: ${reason}`].join("\n"),
+      },
+    });
+    store.settleReviewRevision(revision.id, "skipped", Date.now());
+    log(`#${issue} review round ${revision.round} stopped by operator before its session started: ${reason}`);
+    return true;
+  };
+
+  const settleDrainBeforeSession = async (): Promise<boolean> => {
+    if (d.drain?.draining !== true || workerSessionInstalled) return false;
+    turnLimit?.close();
+    turnLimit = undefined;
+    // A shutdown that interrupts the wake is the same situation as the
+    // provisioning-failure branch below, not an operator stop — nobody
+    // stopped anything, the PR is still green and still open, and only the
+    // wake failed; `settleStopBeforeSession` immediately above covers the
+    // case where an operator genuinely did. So mirror that branch: restore
+    // `pushed-green` naming the shutdown, settle the revision `skipped` so
+    // the round is not double-counted, and leave the in-progress label alone
+    // — the ordinary settle sweep releases it in the same breath it
+    // terminalises the row when the PR resolves. Stopping the row here would
+    // strand it: `settlePushedGreen` sweeps only pushed-* rows and
+    // classification excludes `stopped`, so the issue would carry neither
+    // label and nothing would ever revisit the still-green PR.
+    store.updateRun(runId, {
+      state: "pushed-green",
+      endedAt: Date.now(),
+      lastError: "daemon shutdown began after the review revision claim; the round was not launched",
+    });
+    store.settleReviewRevision(revision.id, "skipped", Date.now());
+    log(`#${issue} review round ${revision.round} not launched: daemon shutdown began after the claim`);
+    return true;
+  };
+
+  // Live-run controls, opened before any provisioning so the operator stop
+  // and shutdown fences cover the whole wake window, exactly as they do for a
+  // fresh claim in `handleIssue` (#374). The original run's entries were
+  // closed at its settle, so reopening by issue is safe.
+  turnLimit = d.turnLimits.open(project.name, issue, runId, run.maxTurns);
+  workerControl = d.workerControls.open(project.name, issue, runId);
+  if (await settleStopBeforeSession()) return;
+  if (await settleDrainBeforeSession()) return;
+
+  try {
+    // Reattach the run's own branch at the same per-issue path the run used:
+    // the worktree was removed at the pushed-green settle and the branch was
+    // published, so provisioning is the same continuation reattach as a
+    // normal re-claim. A provisioning failure restores the row — the PR is
+    // still green and still open, and only the wake failed — and says so.
+    try {
+      const provisioned = await addRunRepo(repo, project.mirrorRoot, project.workspaceRoot, issue, branch);
+      worktreePath = provisioned.path;
+      runRepo = { repo, runRepoPath: worktreePath, branch };
+    } catch (err) {
+      const detail = errText(err);
+      log(`#${issue} review round ${revision.round} cannot provision ${branch}: ${detail}`);
+      // An operator stop that landed during provisioning wins over restoration —
+      // it is a newer, explicit action, and the fences above already honoured
+      // one that landed earlier.
+      const pendingStop = workerControl?.requestedStop();
+      if (pendingStop === undefined) {
+        store.updateRun(runId, {
+          state: "pushed-green",
+          endedAt: Date.now(),
+          lastError: `review round ${revision.round} could not provision the worktree: ${detail}`,
+        });
+        store.settleReviewRevision(revision.id, "skipped", Date.now());
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue,
+          runId,
+          summary: `#${issue} review round ${revision.round} could not be dispatched — worktree provisioning failed`,
+          detail: [revision.prUrl, "", detail].join("\n"),
+        });
+      } else {
+        recordOperatorStop(store, {
+          project: project.name,
+          issue,
+          runId,
+          inProgress,
+          reason: pendingStop,
+          patch: {
+            endedAt: Date.now(),
+            report: [
+              `Operator stopped the review revision before its session started: ${pendingStop}`,
+              `(worktree provisioning also failed: ${detail})`,
+            ].join("\n"),
+          },
+        });
+        store.settleReviewRevision(revision.id, "skipped", Date.now());
+      }
+      return;
+    }
+    if (await settleStopBeforeSession()) return;
+    if (await settleDrainBeforeSession()) return;
+
+    // The fleet-owned omp settings overlay, staged under the SAME session
+    // directory the transcript lives in — a resumed session loads it exactly
+    // as the original run did (#537).
+    const ompSettingsFile = materializeOmpSettings(project, sessionDir);
+
+    // The run's mutation channel (#126): same run id, same issue, same repo —
+    // so `conductor_push` publishes the run's own branch and nothing else.
+    verbListener = await listenVerbChannel(
+      verbDeps(d),
+      {
+        kind: "run",
+        path: verbSocketPath(ensureVerbSocketDir(stateDir()), `run-${String(issue)}`),
+        project: project.name,
+        role: "worker",
+        runId,
+        issue,
+        repo,
+        runRepoPath: worktreePath,
+        branch,
+      },
+      { ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }) },
+    );
+    if (await settleStopBeforeSession()) return;
+    if (await settleDrainBeforeSession()) return;
+
+    store.updateRun(runId, { worktree: worktreePath });
+
+    // The row's own counters are cumulative across the revision: the revision
+    // worker meters its own session from zero, so its deltas are added to the
+    // totals the run already recorded.
+    const baseTurns = run.turns;
+    const baseSpend = run.spendUsd;
+
+    log(`#${issue} review round ${revision.round} → resuming ${branch} (${priorSessionFile})`);
+
+    let result: WorkerResult;
+    try {
+      result = await runWorker({
+        brief: renderReviewRevisionPrompt(revision.findings, revision.round),
+        cwd: worktreePath,
+        caps,
+        ...(repoSlug === undefined ? {} : { repoSlug }),
+        maxTurns: () => turnLimit?.maxTurns() ?? run.maxTurns,
+        onPauseControl: (control) => {
+          workerSessionInstalled = true;
+          workerControl?.install(control);
+        },
+        sessionDir,
+        // The same-session half of the transport: `continueRecent` on the run's
+        // own session directory, never a fresh `run-<uuid>` transcript.
+        resume: true,
+        socketPath: join(sessionDir, "ipc.sock"),
+        verbSocketPath: verbListener.path,
+        onSpawn: (pid) => {
+          verbListener?.bindPid(pid);
+        },
+        onChildLog: (line) => {
+          log(`#${issue} ${line}`);
+        },
+        // The continuation stays on the model the green run used (#286).
+        ...(run.model === undefined ? {} : { model: run.model }),
+        ...(ompSettingsFile === undefined ? {} : { ompSettingsFile }),
+        releaseGrants: resolveReleaseGrants(project),
+        onReleaseBlocked: workerReleaseBlockRecorder(project.name, issue, runId),
+        onTurn: (n) => store.updateRun(runId, { turns: baseTurns + n }),
+        onSpend: (usd) => store.updateRun(runId, { spendUsd: baseSpend + usd }),
+        onKilled: () => {
+          turnLimit?.close();
+          turnLimit = undefined;
+        },
+        onSessionFile: (f) => {
+          store.updateRun(runId, { sessionFile: f });
+          // Same-file lineage is the proof the resume happened: a revision
+          // that opened a different transcript fell back to a fresh session.
+          if (f !== priorSessionFile) {
+            log(
+              `#${issue} review round ${revision.round} resume fell back to a fresh session: opened ${f} ` +
+                `instead of ${priorSessionFile}`,
+            );
+          }
+        },
+        maySpawn: () => d.drain?.draining !== true,
+      }, d.workerDeps);
+    } finally {
+      turnLimit?.close();
+      turnLimit = undefined;
+    }
+
+    if (result.modelFallbackMessage !== undefined) {
+      log(`#${issue} review round ${revision.round} model fallback: ${result.modelFallbackMessage}`);
+    }
+
+    const verified: { state: RunState; reason?: string } =
+      result.state === "pushed-green"
+        ? await verifyPushedGreenClaim(tracker, result)
+        : { state: result.state };
+    const state = verified.state;
+
+    const settlement =
+      state === "pushed-green" || state === "pushed-pending" || state === "merged"
+        ? undefined
+        : await settleWorktree({
+            issue,
+            attempt: run.attempt,
+            ending:
+              state === "blocked"
+                ? "blocked for an operator decision"
+                : state === "stopped"
+                  ? `stopped by the operator: ${result.stoppedReason ?? "no reason recorded"}`
+                  : endedBy(result.killedBy),
+            worktree: worktreePath,
+            branch,
+            publish,
+            ...(state === "failed" || state === "killed"
+              ? ({ tree: "keep" } as const)
+              : ({ tree: "remove", mirrorPath } as const)),
+          });
+    if (settlement === undefined) {
+      const published = await publish(branch);
+      if (!published.ok) {
+        log(`#${issue} publish before removal failed, work is preserved in the mirror: ${published.stderr}`);
+      }
+      await removeWorktree(mirrorPath, worktreePath);
+    }
+
+    // The settlement report names the review round first (#692): a run that
+    // reaches green again after a round must read as a revision outcome, not
+    // as a fresh run's first push, and a round that failed must still say the
+    // round — the state and classification below carry the failure itself.
+    const finalReport = [
+      `review round ${revision.round}: ${state}`,
+      ...(verified.reason === undefined ? [] : ["", verified.reason]),
+      result.report,
+    ].join("\n");
+
+    const terminalPatch: Partial<RunRecord> = {
+      endedAt: Date.now(),
+      turns: baseTurns + result.turns,
+      spendUsd: baseSpend + result.spendUsd,
+      provider429Count: result.provider429Count,
+      ...(result.model === undefined ? {} : { resolvedModel: result.model }),
+      ...(result.provider === undefined ? {} : { resolvedProvider: result.provider }),
+      retryFallbacks: result.retryFallbacks,
+      retryFallbackSucceeded: result.retryFallbackSucceeded,
+      modelRecoveries: result.modelRecoveries,
+      autoRetryCount: result.autoRetryCount,
+      autoCompactionCount: result.autoCompactionCount,
+      // The worker only reports these when it actually established them; a
+      // failure whose report named no PR must not wipe what the row already
+      // owns (#468).
+      ...(result.prUrl === undefined ? {} : { prUrl: result.prUrl }),
+      ...(result.headSha === undefined ? {} : { headSha: result.headSha }),
+      sessionFile: result.sessionFile,
+      report: finalReport,
+      ...settlement?.patch,
+    };
+    if (state === "stopped") {
+      recordOperatorStop(store, {
+        project: project.name,
+        issue,
+        runId,
+        inProgress,
+        reason: result.stoppedReason ?? "no reason recorded",
+        patch: terminalPatch,
+      });
+    } else {
+      const sessionErr = state === "failed" || state === "killed" ? readSessionError(result.sessionFile) : undefined;
+      const providerCredit = sessionErr === undefined ? undefined : providerCreditRefusal(sessionErr);
+      const providerTransient =
+        providerCredit !== undefined || sessionErr === undefined ? undefined : providerTransientFault(sessionErr);
+      const lastError = completionLastError(providerCredit, providerTransient, verified.reason, sessionErr);
+      store.updateRun(runId, {
+        ...terminalPatch,
+        state,
+        ...(lastError === undefined ? {} : { lastError }),
+      });
+    }
+
+    const outcome: ReviewRevisionOutcome =
+      state === "pushed-green" ? "revised" : state === "pushed-pending" ? "pending" : "failed";
+    store.settleReviewRevision(revision.id, outcome, Date.now());
+    log(`#${issue} review round ${revision.round} ${state}${result.prUrl ? ` ${result.prUrl}` : ""}`);
+
+    // Post-settle outcomes, mirroring handleIssue: a failed or killed revision
+    // worker falls through to exactly the same label, requeue and escalation
+    // handling as any failed run — budgets included — and a blocked one pages
+    // the orchestrator for a decision.
+    if (state === "stopped") {
+      log(`#${issue} review round ${revision.round} stopped by operator: ${result.stoppedReason}`);
+    } else if (state === "blocked") {
+      swapLabel(store, project.name, issue, inProgress, project.stateLabels.blocked);
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue,
+        runId,
+        summary: `#${issue} is blocked on review round ${revision.round} and needs a decision`,
+        detail: [`${result.prUrl ?? "(no PR URL)"}`, "", result.report].join("\n"),
+      });
+    } else if (state === "failed" || state === "killed") {
+      const continuation = store.continuationsFor(project.name, issue);
+      const continueTurns = shouldContinueAfterTurnsCap({
+        killedBy: result.killedBy,
+        prUrl: result.prUrl,
+        headSha: result.headSha,
+        salvageSha: settlement?.patch?.salvageSha,
+        continuation,
+        maxContinuations: caps.maxContinuationsPerIssue,
+      });
+      if (continueTurns) {
+        store.enqueueLabelOps(project.name, [
+          { issue, op: "remove", label: inProgress },
+          { issue, op: "add", label: project.queueLabel },
+        ]);
+        log(
+          `#${issue} review round ${revision.round} turns-cap, continuation ` +
+            `${continuation}/${caps.maxContinuationsPerIssue} — salvaged and re-queued`,
+        );
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue,
+          runId,
+          summary: `#${issue} hit the turns cap on review round ${revision.round} — auto-requeued for continuation`,
+          detail: [
+            `${result.prUrl ?? "(no PR URL)"}`,
+            "",
+            "The queue label is back on; the next tick should reattach the branch",
+            "and open a continuation brief. No failed label was applied.",
+            "",
+            result.report,
+          ].join("\n"),
+        });
+      } else {
+        swapLabel(store, project.name, issue, inProgress, project.stateLabels.failed);
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue,
+          runId,
+          summary: result.killedBy
+            ? `#${issue} was killed on review round ${revision.round} by the ${result.killedBy} cap`
+            : `#${issue} failed on review round ${revision.round}`,
+          detail: [`${result.prUrl ?? "(no PR URL)"}`, "", result.report].join("\n"),
+        });
+      }
+    }
+  } catch (err) {
+    // A crash anywhere after the worker ran settles like any run's dispatch
+    // error: the row is terminal, the tree is kept, and the issue is relabelled
+    // so nobody silently re-claims it.
+    turnLimit?.close();
+    turnLimit = undefined;
+    const detail = errText(err);
+    log(`#${issue} review round ${revision.round} errored: ${detail}`);
+    const settlement =
+      worktreePath === undefined
+        ? undefined
+        : await settleWorktree({
+            issue,
+            attempt: run.attempt,
+            ending: "killed by a dispatch error",
+            worktree: worktreePath,
+            branch,
+            publish,
+            tree: "keep",
+          });
+    store.updateRun(runId, {
+      state: "failed",
+      endedAt: Date.now(),
+      lastError: detail,
+      ...settlement?.patch,
+    });
+    store.settleReviewRevision(revision.id, "failed", Date.now());
+    swapLabel(store, project.name, issue, inProgress, project.stateLabels.failed);
+    await safeEscalate(d, {
+      tier: 1,
+      project: project.name,
+      issue,
+      runId,
+      summary: `#${issue} review round ${revision.round} could not be dispatched`,
+      detail: [
+        `${revision.prUrl}`,
+        "",
+        detail,
+        ...(settlement?.lines ?? []),
+      ].join("\n"),
+    });
+  } finally {
+    turnLimit?.close();
+    if (verbListener !== undefined) {
+      try {
+        await verbListener.close();
+      } catch (err) {
+        log(`#${issue} verb socket ${verbListener.path} did not close cleanly: ${errText(err)}`);
+      }
+      verbListener = undefined;
+    }
+    workerControl?.close();
+    workerControl = undefined;
+  }
+}
+
+/**
+ * Restart recovery for in-flight review revisions (#692): a revision the
+ * previous daemon claimed (`pushed-green` → `running`) and lost when it died
+ * is restored to the exact state the orchestrator's verb left it in — same
+ * run, same PR, same findings, same round, same session file — so the next
+ * dispatch pass resumes the SAME OMP session rather than leaving the run to
+ * the failure classifier.
+ *
+ * Runs AFTER the startup orphan sweep, on purpose: the sweep has already
+ * salvaged the crashed revision's worktree to the branch (so no work is lost)
+ * and marked the row `orphaned` — and this reconcile then restores that row
+ * to `pushed-green` and re-queues the round before the first tick, so the
+ * failure classifier never sees it. That ordering matters twice over: an
+ * orphaned row would charge the continuation budget for a round that must
+ * stay off it (#677), and the `review_revisions` row is the only place the
+ * findings and round live. A revision the previous daemon never claimed (its
+ * run is still `pushed-green`, its row still pending) needs no restoration —
+ * the ordinary dispatch pass wakes it on the next tick, exactly as #677
+ * already guarantees.
+ *
+ * A round whose run cannot be restored — the run is gone, settled terminal,
+ * or its repo is no longer routed — fails closed instead: the revision is
+ * settled `skipped` with the findings still on the row, ONE escalation names
+ * what could not be restored, and no worker is started against a PR that may
+ * already have one.
+ */
+export async function reconcileCrashedReviewRevisions(d: Deps): Promise<ReviewRevisionRecord[]> {
+  const { project, store } = d;
+  const revisions = store.unsettledReviewRevisions(project.name);
+  if (revisions.length === 0) return [];
+  const recovered: ReviewRevisionRecord[] = [];
+  for (const revision of revisions) {
+    const run = store.getRun(revision.runId);
+    if (run === undefined) {
+      log(
+        `#${revision.issue} review round ${revision.round} cannot be restored across the restart: ` +
+          `run ${revision.runId} no longer exists`,
+      );
+      store.settleReviewRevision(revision.id, "skipped", Date.now());
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue: revision.issue,
+        runId: revision.runId,
+        summary: `#${revision.issue} review round ${revision.round} could not be restored across the restart`,
+        detail: [
+          revision.prUrl,
+          "",
+          "The daemon restarted while this review round was in flight and the round cannot be re-dispatched:",
+          `the run row ${revision.runId} no longer exists.`,
+          "The round was settled skipped; the findings stay on this revision's durable row.",
+          "Re-review the PR (it is still open and green) or merge it as it stands.",
+        ].join("\n"),
+      });
+      continue;
+    }
+    // A revision the previous daemon never claimed: the run is still a
+    // settled green row and the round is still pending, so the ordinary
+    // dispatch pass wakes it on the next tick untouched.
+    if (run.state === "pushed-green") continue;
+    // The run a previous daemon claimed for this round and died on: the
+    // orphan sweep just marked it `orphaned` (salvaging the tree to the
+    // branch), so restore it to the reviewable state the verb recorded.
+    const crashed =
+      run.state === "claimed" || run.state === "running" || run.state === "orphaned";
+    if (!crashed) {
+      log(
+        `#${revision.issue} review round ${revision.round} cannot be restored across the restart: run ` +
+          `${revision.runId} is ${run.state}`,
+      );
+      store.settleReviewRevision(revision.id, "skipped", Date.now());
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue: revision.issue,
+        runId: revision.runId,
+        summary: `#${revision.issue} review round ${revision.round} could not be restored across the restart`,
+        detail: [
+          revision.prUrl,
+          "",
+          "The daemon restarted while this review round was in flight and the round cannot be re-dispatched:",
+          `the run row is ${run.state}, not a state a review round resumes from.`,
+          "The round was settled skipped; the findings stay on this revision's durable row.",
+          "Re-review the PR (it is still open and green) or merge it as it stands.",
+        ].join("\n"),
+      });
+      continue;
+    }
+    try {
+      // The crashed revision's worktree — salvaged and published by the orphan
+      // sweep that just ran, so the branch in the mirror has every committed
+      // byte — must be gone before the next dispatch, or `addRunRepo` refuses
+      // the reattach as possibly holding a previous attempt's work (#692).
+      // `settleWorktree` with `tree: "remove"` re-attempts the salvage instead
+      // of trusting it (a tree whose salvage failed is the only copy of work
+      // and is NEVER removed), and refuses the removal if that re-attempt
+      // fails — the fail-closed half of this recovery.
+      if (run.worktree !== "" && existsSync(run.worktree)) {
+        const repo = Object.values(project.routing.repos).find((candidate) => candidate.name === run.repo);
+        if (repo === undefined) {
+          log(
+            `#${revision.issue} review round ${revision.round} cannot clear worktree ${run.worktree}: ` +
+              `repo ${run.repo} is no longer routed — the tree may hold the only copy of work`,
+          );
+          store.settleReviewRevision(revision.id, "skipped", Date.now());
+          await safeEscalate(d, {
+            tier: 1,
+            project: project.name,
+            issue: revision.issue,
+            runId: revision.runId,
+            summary: `#${revision.issue} review round ${revision.round} could not be restored across the restart`,
+            detail: [
+              revision.prUrl,
+              "",
+              "The daemon restarted while this review round was in flight and the round cannot be re-dispatched:",
+              `repo ${run.repo} is no longer routed, so the crashed revision's worktree cannot be published and removed.`,
+              `The worktree is retained for recovery: ${run.worktree}`,
+              "Recover it by hand (it may hold the round's last work), then re-review or merge the PR.",
+            ].join("\n"),
+          });
+          continue;
+        }
+        const settlement = await settleWorktree({
+          issue: run.issue,
+          attempt: run.attempt,
+          ending: "interrupted by a daemon restart during a review round",
+          worktree: run.worktree,
+          branch: run.branch,
+          publish: (branch) => pushRunBranch(project, { repo, runRepoPath: run.worktree, branch }),
+          tree: "remove",
+          mirrorPath: mirrorPathFor(repo, project.mirrorRoot),
+        });
+        if (settlement.retained) {
+          log(
+            `#${revision.issue} review round ${revision.round} worktree ${run.worktree} retained: ` +
+              "its salvage failed, so the tree is the only copy of work and will not be removed",
+          );
+          store.settleReviewRevision(revision.id, "skipped", Date.now());
+          await safeEscalate(d, {
+            tier: 1,
+            project: project.name,
+            issue: revision.issue,
+            runId: revision.runId,
+            summary: `#${revision.issue} review round ${revision.round} could not be restored across the restart`,
+            detail: [
+              revision.prUrl,
+              "",
+              "The daemon restarted while this review round was in flight and the round cannot be re-dispatched:",
+              "the crashed revision's worktree could not be salvaged, so it is the only copy of work and was retained.",
+              `Recover the tree by hand: ${run.worktree}`,
+              "Then re-review the PR (still open and green) or merge it as it stands.",
+            ].join("\n"),
+          });
+          continue;
+        }
+      }
+    } catch (err) {
+      // A settleWorktree throw (mirror unreachable, git refused) must not take
+      // the whole startup reconcile down with one run's tree: fail this round
+      // closed and let the next one try.
+      const detail = errText(err);
+      log(`#${revision.issue} review round ${revision.round} restore errored: ${detail}`);
+      store.settleReviewRevision(revision.id, "skipped", Date.now());
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue: revision.issue,
+        runId: revision.runId,
+        summary: `#${revision.issue} review round ${revision.round} could not be restored across the restart`,
+        detail: [revision.prUrl, "", detail].join("\n"),
+      });
+      continue;
+    }
+    // The exact state the verb recorded: a pushed-green row plus a pending
+    // revision whose durable row still carries the findings, reviewed head,
+    // round and target session. The next tick's dispatch pass claims and
+    // wakes it exactly like a revision that was never dispatched.
+    store.updateRun(revision.runId, {
+      state: "pushed-green",
+      endedAt: Date.now(),
+      worktree: "",
+      lastError: `review round ${revision.round} was restored across a daemon restart; the round is re-queued`,
+    });
+    store.requeueReviewRevision(revision.id);
+    log(
+      `#${revision.issue} review round ${revision.round} restored across restart: run ${revision.runId} ` +
+        "is pushed-green again and the round is re-queued — the next dispatch pass resumes the same session",
+    );
+    recovered.push(revision);
+  }
+  return recovered;
+}
+
+// ------------------------------------------------------------------- settlement
+const BASE_CHECK_BATCH = 20;
+const BASE_CHECK_WINDOW_MS = 24 * 60 * 60 * 1_000;
+const BASE_STATUS_WINDOW_MS = 7 * 24 * 60 * 60 * 1_000;
+
+const SUCCESSFUL_WORKFLOW_CONCLUSIONS = new Set(["success", "neutral", "skipped"]);
+
+const FAILING_WORKFLOW_CONCLUSIONS = new Set([
+  "failure",
+  "cancelled",
+  "timed_out",
+  "action_required",
+  "startup_failure",
+  "stale",
+]);
+
+function appendSettlementFlag(run: RunRecord, flag: SettlementFlag): SettlementFlag[] {
+  const flags = run.settlementFlags ?? [];
+  return flags.some((existing) => existing.kind === flag.kind && existing.detail === flag.detail)
+    ? flags
+    : [...flags, flag];
+}
 
 /**
  * Observe Actions on exact merge commits for up to one day. A running workflow
@@ -2956,220 +3464,6 @@ export async function watchBaseHealth(
   }
 }
 
-export async function settlePushedGreen(
-  d: Pick<Deps, "project" | "tracker" | "store">,
-): Promise<number> {
-  const { project, tracker, store } = d;
-  // Runs the sweep resolved by terminalising the row. Every terminal write
-  // below increments it; the tick attributes it as `settled` on the pass's
-  // dispatch record, so a held pass is visible as work done, not just as a
-  // clock that moved (#497).
-  let settled = 0;
-  // Filtered from the active set rather than asked for with a new query: active
-  // is live workers plus these, so the list is bounded by the worker cap plus
-  // the number of PRs awaiting a merge — a handful, by construction. A fleet
-  // where that is not a handful has a merge problem, not a dispatch one.
-  const pending = store
-    .activeRuns(project.name)
-    .filter((r) => r.state === "pushed-green" || r.state === "pushed-pending");
-
-  for (const run of pending) {
-    // Nothing to ask about. A pushed result requires a PR, so a malformed row
-    // must not buy a `gh` call every five minutes forever.
-    if (run.prUrl === undefined) continue;
-
-    let pr: PrState | undefined;
-    try {
-      pr = await tracker.prState(run.prUrl);
-    } catch (err) {
-      // Per row, like admission's held candidate. The GitHub adapter already
-      // answers undefined instead of throwing, so this catch is the port's
-      // contract rather than that adapter's behaviour — and a tracker that does
-      // throw must cost its own row, not the whole sweep.
-      log(`#${run.issue} not settled: PR state lookup failed (${errText(err)}) — retrying next tick`);
-      continue;
-    }
-
-    const settlement = settlementFor(pr, run.prUrl);
-    if (settlement !== undefined) {
-      // A mediated merge enters a second, bounded observation phase. Record the
-      // exact merge commit before the row leaves the active set; if GitHub cannot
-      // supply it yet, retry this settlement next tick rather than create a
-      // merged row whose base result can never be attributed.
-      let merged: MergedPrInfo | undefined;
-      if (settlement.state === "merged") {
-        try {
-          merged = await tracker.mergedPrInfo(run.prUrl);
-        } catch (err) {
-          log(`#${run.issue} not settled: merge identity lookup failed (${errText(err)}) — retrying next tick`);
-          continue;
-        }
-        if (merged === undefined) {
-          log(`#${run.issue} not settled: merge identity unavailable — retrying next tick`);
-          continue;
-        }
-      }
-
-      // The label removal and the terminal row are one fact again (#201): the
-      // release is enqueued — a durable local write that cannot fail on the
-      // tracker — in the same breath as the row is terminalised.
-      releaseInProgress(d, run.issue, settlement.reason);
-      const patch: Partial<RunRecord> = {
-        state: settlement.state,
-        endedAt: Date.now(),
-        ...(merged === undefined
-          ? {}
-          : {
-              mergeSha: merged.mergeSha,
-              baseRef: merged.baseRef,
-              baseCheck: "pending",
-            }),
-      };
-      if (settlement.state === "failed") {
-        patch.lastError = settlement.reason;
-        patch.failureClass = "returned-for-revision";
-        patch.recoveryAction = "none";
-      }
-      store.updateRun(run.id, patch);
-      settled += 1;
-      log(`#${run.issue} settled: ${settlement.reason}`);
-      continue;
-    }
-
-    if (run.state !== "pushed-pending" || pr !== "open" || run.headSha === undefined) continue;
-    let verification;
-    try {
-      verification = await tracker.verifyPr(run.prUrl, run.headSha);
-    } catch (err) {
-      log(`#${run.issue} checks not settled (${errText(err)}) — retrying next tick`);
-      continue;
-    }
-    if (verification === undefined) continue;
-    if (verification.status === "green") {
-      store.updateRun(run.id, { state: "pushed-green", lastError: null });
-      log(`#${run.issue} checks settled: ${verification.reason}`);
-    } else if (verification.status === "failed") {
-      // Equally terminal, so the release is enqueued before the row writes,
-      // for the same reason as the settlement branch above (see there). The
-      // green branch releases nothing — that row is still awaiting a merge,
-      // and its live PR is exactly the work the label must keep guarding.
-      releaseInProgress(d, run.issue, verification.reason);
-      store.updateRun(run.id, { state: "failed", lastError: verification.reason });
-      settled += 1;
-      log(`#${run.issue} checks failed: ${verification.reason}`);
-    } else {
-      store.updateRun(run.id, { lastError: verification.reason });
-    }
-  }
-  return settled;
-}
-
-const ADOPTABLE_PR_STATES: Partial<Record<RunState, true>> = {
-  failed: true,
-  killed: true,
-  orphaned: true,
-  blocked: true,
-};
-
-/**
- * Reattaches a recovered PR to the terminal run that owns it (#245).
- *
- * A worker can fail before its completion report records `prUrl`, then have its
- * dirty tree committed and pushed by salvage. If that branch already has a PR,
- * the orchestrator otherwise has no policy-compliant path to inspect or merge
- * it: ownership is store-backed. Adoption is deliberately stricter than
- * admission. The tracker query proves the PR closes this run's issue; exact
- * branch and canonical repository matches prove it is this run's recovered
- * work, not an unrelated closer. Missing identity is refusal, never a guess.
- *
- * The newest run per issue is inspected, at most ten per tick and only inside
- * the same 30-day window as mediated PR verbs. The cursor advances through the
- * full eligible set so persistent non-matches cannot starve older recovered
- * work. Successful adoption is idempotent because the row gains `prUrl`;
- * non-matches are logged once per daemon process.
- */
-const rejectedSalvagedPrRuns = new Set<string>();
-const salvagedPrCursor = new Map<string, string>();
-
-export async function adoptSalvagedPrs(
-  d: Pick<Deps, "project" | "tracker" | "store">,
-  now = Date.now(),
-): Promise<void> {
-  const { project, tracker, store } = d;
-  const eligible = store
-    .recentRuns(project.name, now - PR_LOOKUP_WINDOW_MS)
-    .filter(
-      (run) =>
-        ADOPTABLE_PR_STATES[run.state] === true &&
-        run.prUrl === undefined &&
-        run.branch.trim() !== "",
-    );
-  const previous = salvagedPrCursor.get(project.name);
-  const previousIndex =
-    previous === undefined ? -1 : eligible.findIndex((run) => run.id === previous);
-  const start = previousIndex === -1 ? 0 : (previousIndex + 1) % eligible.length;
-  const candidates = Array.from(
-    { length: Math.min(SALVAGED_PR_ADOPTION_BATCH, eligible.length) },
-    (_, offset) => eligible[(start + offset) % eligible.length]!,
-  );
-  const last = candidates.at(-1);
-  if (last !== undefined) salvagedPrCursor.set(project.name, last.id);
-
-  for (const run of candidates) {
-    const repo = project.routing.repos[run.repo];
-    const repoIdentity = repo === undefined ? undefined : githubRepo(repo.cloneUrl);
-    let closers: OpenCloser[];
-    try {
-      closers = await tracker.openClosersFor(run.issue);
-    } catch (err) {
-      log(`#${run.issue} PR adoption lookup failed (${errText(err)}) — retrying next tick`);
-      continue;
-    }
-
-    const closer = closers.find(
-      (candidate) =>
-        candidate.headRefName !== "" &&
-        candidate.headRefName === run.branch &&
-        repo !== undefined &&
-        candidate.repo !== "" &&
-        candidate.repo === repoIdentity,
-    );
-    if (closer === undefined) {
-      if (!rejectedSalvagedPrRuns.has(run.id)) {
-        const observed = closers[0];
-        const reason =
-          observed === undefined
-            ? "no open closing PR"
-            : observed.headRefName === ""
-              ? "closer has no head branch identity"
-              : observed.headRefName !== run.branch
-                ? `closer head ${observed.headRefName} does not match retained branch ${run.branch}`
-                : observed.repo === ""
-                  ? "closer has no repository identity"
-                  : `closer repository ${observed.repo} does not match routed repository`;
-        log(`#${run.issue} PR not adopted onto attempt ${run.attempt}: ${reason}`);
-        rejectedSalvagedPrRuns.add(run.id);
-      }
-      continue;
-    }
-
-    const flag: SettlementFlag = {
-      kind: "pr-adopted",
-      file: "(recovery)",
-      detail: `${closer.url} matched retained branch ${run.branch} in ${closer.repo}`,
-    };
-    store.updateRun(run.id, {
-      prUrl: closer.url,
-      settlementFlags: [...(run.settlementFlags ?? []), flag],
-    });
-    rejectedSalvagedPrRuns.delete(run.id);
-    log(
-      `#${run.issue} adopted PR ${closer.url} onto attempt ${run.attempt}` +
-        (run.salvageSha === undefined ? "" : ` (salvaged head ${run.salvageSha})`),
-    );
-  }
-}
-
 /** Canonical `owner/repo` identity from a configured network clone URL. */
 function githubRepo(cloneUrl: string): string | undefined {
   const normalized = cloneUrl.replace(/\/$/, "").replace(/\.git$/, "");
@@ -3197,7 +3491,7 @@ type CleanupRetainedWorktree = (
  * dirty or uniquely unpushed work.
  */
 export async function cleanupRetainedRuns(
-  d: Pick<Deps, "project" | "tracker" | "store">,
+  d: Pick<Deps, "project" | "tracker" | "store" | "escalate">,
   queuedIssues: ReadonlySet<number>,
   cursor: RetainedCleanupCursor,
   cleanup: CleanupRetainedWorktree = cleanupRetainedWorktree,
@@ -3262,9 +3556,35 @@ export async function cleanupRetainedRuns(
 
     const outcome = await cleanup(mirrorPathFor(repo, project.mirrorRoot), run.worktree, run.branch);
     if (outcome.kind === "removed") {
-      store.updateRun(run.id, { worktree: "" });
+      store.updateRun(run.id, {
+        worktree: "",
+        ...(run.quarantineDetail === undefined ? {} : { quarantineDetail: null }),
+      });
       log(`#${run.issue} retained worktree reaped: ${run.worktree} (${run.branch})`);
+    } else if (outcome.reason === "quarantined") {
+      // A tree whose object store cannot be made sound is potentially
+      // stranded work: the daemon refuses to fetch into it, so its commits
+      // cannot be verified against any remote. The row records the condition
+      // so the status snapshot can name the tree, and the escalation ledger
+      // dedupes on the stable summary below — a pass that keeps seeing the
+      // same broken tree reports it once, never once per dispatch pass.
+      store.updateRun(run.id, { quarantineDetail: outcome.detail });
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue: run.issue,
+        summary: `#${run.issue} quarantined retained worktree — potentially stranded work`,
+        detail: `${run.worktree} (${run.branch})\n${outcome.detail}`,
+      });
     } else {
+      // Any other retained reason means the tree is back under ordinary
+      // retention: its alternates were repaired (or never needed it), so the
+      // quarantine — if one was marked — is over and the snapshot must not
+      // keep naming it as quarantined.
+      if (run.quarantineDetail !== undefined) {
+        store.updateRun(run.id, { quarantineDetail: null });
+        log(`#${run.issue} retained worktree no longer quarantined: ${outcome.detail}`);
+      }
       log(`#${run.issue} retained worktree kept (${outcome.reason}): ${outcome.detail}`);
     }
   }
@@ -3277,6 +3597,7 @@ const DEGRADED_HOLDS: ReadonlySet<AdmissionHoldReason> = new Set([
   "parent-lookup-error",
   "open-pr-lookup-error",
   "issue-state-lookup-error",
+  "critical-base-verify-error",
 ]);
 
 /** Groups transient decisions into the bounded record exposed by status. */
@@ -3471,10 +3792,63 @@ async function verifyPendingUpgradeTick(
       );
     }
   } catch (err) {
-    // A torn journal must not take the tick down: the operator still reads it
-    // through `status`, and the next tick retries the same pass.
-    log(`upgrade verification pass failed: ${errText(err)}`);
+    // A torn journal must not take the tick down: the operator still reads it
+    // through `status`, and the next tick retries the same pass.
+    log(`upgrade verification pass failed: ${errText(err)}`);
+  }
+}
+
+/**
+ * The daemon's conductor.db snapshot cadence (#289) — the ledger's only
+ * durable copy, taken on the digest-aligned {@link dbSnapshotDue} window:
+ * once per local day, at/after the digest's configured `at` when it has one.
+ *
+ * Host-global, like the store itself: one snapshot per day for every project,
+ * so whichever project's daemon wins the day first publishes it and the
+ * others no-op on the same durable marker. The marker is written through the
+ * store's existing notification ledger (a one-row idempotence guard, the same
+ * primitive escalations use not to act twice) *after* the snapshot is
+ * published — a crash between publish and mark re-snapshots the next tick
+ * instead of skipping the day, and a restored store that predates today's
+ * marker takes a fresh snapshot on the next tick.
+ *
+ * Returns true when a snapshot was published. A store that does not exist
+ * yet is a silent no-op: there is nothing to back up, and `doctor`'s
+ * `db-backup` probe already treats that as a pass.
+ */
+export function runDbSnapshotCadence(args: {
+  digestPolicy: ReportingPolicy["digest"];
+  store: Pick<Store, "wasNotified" | "markNotified">;
+  source: string;
+  backupDir: string;
+  now?: number;
+  keep?: number;
+  log?: (line: string) => void;
+}): boolean {
+  const { digestPolicy, store, source, backupDir } = args;
+  // No store yet (first boot before any run persisted) → nothing to back up;
+  // `doctor`'s `db-backup` probe already treats that as a pass.
+  if (!existsSync(source)) return false;
+  const now = args.now ?? Date.now();
+  const today = localDayKey(now, digestPolicy.timezone);
+  const alreadyToday = store.wasNotified(dbSnapshotMarkerKey(today));
+  if (!dbSnapshotDue({ digest: digestPolicy }, alreadyToday ? today : undefined, now)) {
+    return false;
+  }
+  const published = snapshotDb(source, backupDir, now);
+  (args.log ?? log)(`conductor.db snapshot published: ${published}`);
+  store.markNotified(dbSnapshotMarkerKey(today));
+  try {
+    const removed = pruneDbSnapshots(backupDir, args.keep ?? DB_SNAPSHOT_RETENTION);
+    if (removed > 0) {
+      (args.log ?? log)(`db snapshot retention pruned ${removed} file(s) beyond the retained ${args.keep ?? DB_SNAPSHOT_RETENTION}`);
+    }
+  } catch (err) {
+    // The snapshot is already published and marked; an over-bound directory
+    // costs disk until the next due day retries the prune, never the backup.
+    (args.log ?? log)(`db snapshot retention prune failed: ${errText(err)}`);
   }
+  return true;
 }
 
 export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
@@ -3482,9 +3856,13 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // (#170). Re-resolve the project and its caps at the tick boundary so a tick
   // and every run it admits see one consistent snapshot; a failed read keeps
   // the boot values rather than wedging the tick, and the next tick tries
-  // again.
+  // again. The same reloaded config feeds the db-snapshot backup dir: when it
+  // is unreadable the cadence falls back to the state-root default, matching
+  // `doctor`'s probe of an absent field.
+  let reloadedConfig: ConductorConfig | undefined;
   try {
     const cfg = loadConfig();
+    reloadedConfig = cfg;
     const fresh = findProject(cfg, d.project.name);
     const freshCaps = resolveCaps(fresh, cfg.defaults);
     if (JSON.stringify(fresh) !== JSON.stringify(d.project) || JSON.stringify(freshCaps) !== JSON.stringify(d.caps)) {
@@ -3566,6 +3944,25 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     log(`salvaged PR adoption sweep failed: ${errText(err)}`);
   }
 
+  // The conductor.db snapshot cadence (#289) is durability, not dispatch:
+  // the verb ledger, the decision rows and the run history have no other
+  // copy, so they are snapshotted once per day on the digest-aligned window.
+  // Above the pause gate on purpose — a parked fleet still accumulates ledger
+  // rows and still deserves a backup — and a failure costs the day's snapshot
+  // placeholder, never the tick: failed cadence steps are logged and retried
+  // by the five-minute loop, exactly like the sweeps above it.
+  try {
+    runDbSnapshotCadence({
+      digestPolicy: (d.project.reporting ?? DEFAULT_REPORT_POLICY).digest,
+      store: d.store,
+      source: dbPath(),
+      backupDir: dbBackupDirFor(reloadedConfig),
+      log,
+    });
+  } catch (err) {
+    log(`db snapshot cadence failed: ${errText(err)}`);
+  }
+
   // Immediately after settlement and before any routing, so a class is on the
   // row before the next dispatch decision reads its budgets (#132). Above the
   // pause gate deliberately: classification and label reconciliation are
@@ -3575,7 +3972,15 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // Each is guarded on its own: a tracker that fails mid-classification must not
   // stop the label reconcile, and neither may stop the tick.
   try {
-    settled += await classifyAndRecover(d);
+    settled += await classifyAndRecover({
+      project: d.project,
+      caps: d.caps,
+      tracker: d.tracker,
+      store: d.store,
+      escalate: (e) => d.escalate(e),
+      isPaused,
+      setPaused,
+    });
   } catch (err) {
     log(`classification sweep failed: ${errText(err)}`);
   }
@@ -3632,6 +4037,15 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // so `last dispatch` keeps moving while the fleet is deliberately parked. A
   // frozen clock is then a stall report, not a hold (#497).
   if (isPaused(d.project.name)) {
+    // The held pass is the daemon-side admission acknowledgement: the daemon
+    // has reached its admission boundary under the fence and claims nothing.
+    // Written durably so the setup barrier can prove the fence was observed
+    // (#651 review #3) — a pause cannot acknowledge itself.
+    try {
+      writeAdmissionAck(d.project.name);
+    } catch (err) {
+      log(`admission acknowledgement write failed: ${errText(err)}`);
+    }
     d.store.recordDispatch(d.project.name, summarizeHeldPass(settled));
     return;
   }
@@ -3694,6 +4108,18 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     return;
   }
 
+  // Review revisions are dispatch, not admission (#677): the orchestrator's
+  // verb recorded them durably and the run row already occupies its issue, so
+  // they bypass the ready queue and the claim path entirely — this pass wakes
+  // them (bounded by the same worker slots) BEFORE the queue's capacity gate
+  // reads live runs, so a claimed revision counts against capacity exactly like
+  // the worker it is about to spawn.
+  try {
+    await dispatchReviewRevisions(d, workers);
+  } catch (err) {
+    log(`review revision dispatch failed: ${errText(err)}`);
+  }
+
   // route() filters the queue through isEligible() itself, so anything already
   // carrying a state label is gone before it gets here.
   const ready = await d.tracker.listReady();
@@ -3713,14 +4139,37 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     return pending.length === 0 ? issue : { ...issue, labels: effectiveLabels(issue.labels, pending) };
   });
   const { routed, unroutable } = route(effective, project);
-  // Ready issues that route() dropped without a reason carry a state label —
-  // claimed by a live or settling run — so the claimed count is subtraction
-  // rather than a routed-state signal (#228).
-  const claimed = effective.length - routed.length - unroutable.length;
-  const routingHolds: AdmissionHold[] = unroutable.map((u) => ({
-    issue: u.issue.number,
-    reason: `unroutable:${u.reason}`,
-  }));
+  // route() drops a candidate for two reasons, only one of which is a claim
+  // question. A lifecycle state label (agent:in-progress/blocked/failed)
+  // marks a run-owned issue: it is genuinely in flight while its newest run
+  // is live or settling, and a terminal newest run — or no run at all — means
+  // the label is residual, the footprint of a settled run nobody cleared,
+  // which is Duty 1 reconciliation work, not occupied capacity. A missing
+  // queue label instead marks an issue the outbox is withdrawing (a pending
+  // queue-label removal, e.g. releaseQueueLabel after a merge the PR did not
+  // close), which belongs in none of the three populations. So `claimed` is
+  // defined from actual ownership over genuinely lifecycle-labelled candidates
+  // rather than as the residual of routing (#228, #611).
+  const stateLabels = new Set(Object.values(project.stateLabels));
+  const dropped = effective.filter(
+    (issue) => !isEligible(issue, project) && issue.labels.some((l) => stateLabels.has(l)),
+  );
+  let claimed = 0;
+  const lifecycleHolds: AdmissionHold[] = [];
+  for (const issue of dropped) {
+    const newest = store.latestRun(project.name, issue.number);
+    if (newest !== undefined && ACTIVE_STATES.includes(newest.state)) {
+      claimed += 1;
+    } else {
+      lifecycleHolds.push({ issue: issue.number, reason: "stale-lifecycle" });
+    }
+  }
+  const routingHolds: AdmissionHold[] = [
+    ...unroutable.map(
+      (u): AdmissionHold => ({ issue: u.issue.number, reason: `unroutable:${u.reason}` }),
+    ),
+    ...lifecycleHolds,
+  ];
   const recordDispatch = (admitted: number, holds: readonly AdmissionHold[]): void => {
     store.recordDispatch(
       project.name,
@@ -3817,7 +4266,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   log(`dispatching ${pass.admitted.map((a) => `#${a.r.issue.number}`).join(" ")}`);
   await dispatchAdmissions(
     pass.admitted,
-    (a) => handleIssue(d, a.r, a.attempt),
+    (a) => handleIssue(d, a.r, a.attempt, a.lane),
     workers,
   );
 
@@ -4211,11 +4660,33 @@ export interface StatusSnapshot {
    * the config or the brief.
    */
   releaseGrants: ResolvedGrants;
+  /**
+   * The effective review policy (#678). On the snapshot for the reason
+   * `releaseGrants` is: the orchestrator's Duty 1 has to act on it every
+   * tick, and a stale level or ceiling sitting only in a config file nobody
+   * opens is exactly the drift this field exists to surface. The loader always
+   * materialises it, so this is never absent on a real daemon.
+   */
+  review: ReviewPolicy;
   /** Occupied issues: live workers plus green PRs awaiting a human merge. */
   activeRuns: RunRecord[];
+  /**
+   * runId → live review-revision round, for runs whose revision worker is
+   * currently dispatched (#692). Derived from the durable `review_revisions`
+   * rows, so the rendered `review-revision N` state rests on the same facts
+   * the restart recovery reads — never on a label or a guess. A plain object
+   * (not a Map) so the dashboard's JSON round-trip of the snapshot preserves
+   * it byte for byte.
+   */
+  reviewRounds?: Readonly<Record<string, number>>;
   /** Newest attempts holding a preserved WIP tip, or a tree that is still the
    *  only copy of work the daemon could not save. */
   salvagedRuns: RunRecord[];
+  /** Retained trees whose object store could not be made sound, so the daemon
+   *  refused to fetch into them and their commits cannot be verified against
+   *  any remote (#737). Distinguished from ordinary retention on purpose —
+   *  quarantine is "potentially stranded work", not routine housekeeping. */
+  quarantinedRuns: RunRecord[];
   /** One-shot issue ceilings waiting for the next claim. */
   turnOverrides: TurnOverride[];
   /** Reports the operator has not provably received: pending, in-flight with an
@@ -4302,6 +4773,13 @@ export function statusSnapshotFromStore(
   // Read once: the provenance read touches the filesystem, and the renderer
   // should never pay for it twice per status.
   const reason = pauseProvenance(p.name)?.reason;
+  // The live review-revision rounds, read from the same durable rows the
+  // restart recovery uses: a run whose revision is dispatched is read as
+  // `review-revision N` while its worker is live (#692).
+  const reviewRounds: Record<string, number> = {};
+  for (const revision of store.unsettledReviewRevisions(p.name)) {
+    if (revision.dispatchedAt !== undefined) reviewRounds[revision.runId] = revision.round;
+  }
   return {
     project: p.name,
     configPath: configPath(),
@@ -4312,8 +4790,11 @@ export function statusSnapshotFromStore(
     digestSchedule: digestScheduleState(p.reporting ?? DEFAULT_REPORT_POLICY, lastDigestDay, now),
     caps,
     releaseGrants: resolveReleaseGrants(p),
+    review: resolveReview(p),
     activeRuns: store.activeRuns(p.name),
+    reviewRounds,
     salvagedRuns: store.salvagedRuns(p.name),
+    quarantinedRuns: store.quarantinedRuns(p.name),
     turnOverrides: store.listTurnOverrides(p.name),
     openReports: store.openReports(p.name),
     digestBacklog: store.digestBacklog(p.name),
@@ -4387,32 +4868,6 @@ export function formatDispatchSummary(summary?: DispatchSummary): string {
   return lines.join("\n");
 }
 
-/**
- * The WIP block: every issue whose newest attempt left work behind, and
- * whether that work is safe.
- *
- * Blocked runs used to be invisible here, which is exactly how #118 stayed
- * invisible for a full attempt cycle — the operator saw a blocked issue and had
- * no way to tell "stopped with 34 uncommitted files" from "stopped clean".
- * A preserved line is informational; an UNSALVAGED line is an alarm, and it
- * names the directory because that directory is the work.
- */
-export function formatSalvagedRuns(runs: readonly RunRecord[]): string[] {
-  if (runs.length === 0) return [];
-  const lines = ["", "wip"];
-  for (const r of runs) {
-    lines.push(
-      r.salvageError !== undefined && r.salvageAckAt === undefined
-        ? `  #${r.issue}  UNSALVAGED  ${r.worktree === "" ? "(path not recorded)" : r.worktree} — ` +
-          `only copy, dispatch held (${r.salvageError})`
-        : r.salvageError !== undefined
-          ? `  #${r.issue}  accepted as lost  attempt ${r.attempt} (${r.salvageError})`
-          : `  #${r.issue}  preserved  ${r.salvageSha ?? "?"} on ${r.branch} (attempt ${r.attempt}, ${r.state})`,
-    );
-  }
-  return lines;
-}
-
 /**
  * The grant table, named shape by shape.
  *
@@ -4430,6 +4885,7 @@ export function formatReleaseGrants(grants: ResolvedGrants): string[] {
     ...RELEASE_SHAPES.map((shape) => `  ${shape.padEnd(19)}${grants[shape]}`),
   ];
 }
+
 export function formatBaseHealth(rows: readonly BaseHealth[]): string[] {
   return rows.map((row) => {
     const head = row.headSha.slice(0, 8);
@@ -4519,6 +4975,7 @@ export function formatStatus(s: StatusSnapshot): string {
   lines.push(...formatBaseHealth(s.baseHealth));
   lines.push(...formatFreezes(s.freezes));
   lines.push(...formatSalvagedRuns(s.salvagedRuns));
+  lines.push(...formatQuarantinedRuns(s.quarantinedRuns));
   lines.push(...formatOpenReports(s.openReports));
   lines.push(...formatVerbLedger(s.verbLedger));
   // Deploy hint: a restart while workers are live orphans them (salvage runs
@@ -4592,61 +5049,6 @@ export function prepareConductor(project?: string): void {
   setPaused(true, { source: "setup" }, project);
 }
 
-/** Bounded per tick: each row costs tracker calls to gather facts for. */
-const CLASSIFY_BATCH = 20;
-
-/** Tool calls quoted as evidence for a run that spun to its turn cap. */
-const SPIN_EVIDENCE_CALLS = 10;
-
-/**
- * The last few tool names a transcript recorded, newest last.
- *
- * `turn-cap-spinning` escalates rather than requeueing, and the acceptance
- * criterion is that the escalation carries evidence of what the worker was doing
- * when it hit the cap — otherwise the orchestrator opens the transcript and
- * re-derives it, which is the manual triage this whole sweep removes.
- */
-export function lastToolCalls(sessionFile: string | undefined, limit = SPIN_EVIDENCE_CALLS): string[] {
-  if (sessionFile === undefined) return [];
-  let text: string;
-  try {
-    text = readFileSync(sessionFile, "utf8");
-  } catch {
-    return [];
-  }
-  const names: string[] = [];
-  for (const line of text.split("\n")) {
-    if (line.length === 0) continue;
-    let row: unknown;
-    try {
-      row = JSON.parse(line) as unknown;
-    } catch {
-      continue;
-    }
-    if (row === null || typeof row !== "object") continue;
-    const rec = row as { readonly [key: string]: unknown };
-    // Both shapes the harness has written: a top-level tool event, and a tool
-    // block inside an assistant message.
-    const direct = rec["toolName"];
-    if (typeof direct === "string") {
-      names.push(direct);
-      continue;
-    }
-    const message = rec["message"];
-    if (message === null || typeof message !== "object") continue;
-    const content = (message as { readonly [key: string]: unknown })["content"];
-    if (!Array.isArray(content)) continue;
-    for (const part of content) {
-      if (part === null || typeof part !== "object") continue;
-      const p = part as { readonly [key: string]: unknown };
-      if (p["type"] !== "tool_use") continue;
-      const name = p["name"];
-      if (typeof name === "string") names.push(name);
-    }
-  }
-  return names.slice(-limit);
-}
-
 /** A provider refusal a session recorded before dying, or undefined for none. */
 export interface SessionError {
   status?: number;
@@ -4663,608 +5065,154 @@ export function completionLastError(
 }
 
 /**
- * The last error a transcript recorded, or undefined when it recorded none.
- *
- * The harness writes `{"stopReason":"error","errorStatus":402,"errorId":402,
- * "errorMessage":"402 This request requires more credits, ..."}`. The daemon
- * read none of it, so three runs died `unknown` with an empty `lastError` and
- * charged an attempt each for a billing state (#220).
- *
- * Scanned newest-first: a session that recovered from an early error and then
- * died of something else must report the something else, and a session that
- * recovered from its only error and finished cleanly reports the error anyway
- * because there is no terminal verdict to outrank it (#220).
+ * How many settled `ci-deterministic` rows one reconciliation pass may
+ * re-examine beyond the persisted review cursor. Each candidate costs GitHub
+ * calls to re-fetch the evidence its check log carried, so a fleet with a
+ * long misclassified history works through it over several daemon starts
+ * rather than spending one boot's budget on all of it (#638).
  */
-export function readSessionError(sessionFile: string | undefined): SessionError | undefined {
-  if (sessionFile === undefined) return undefined;
-  let text: string;
-  try {
-    text = readFileSync(sessionFile, "utf8");
-  } catch {
-    return undefined;
-  }
-  const lines = text.split("\n");
-  for (let i = lines.length - 1; i >= 0; i -= 1) {
-    const line = lines[i];
-    if (line === undefined || line.length === 0) continue;
-    let row: unknown;
-    try {
-      row = JSON.parse(line) as unknown;
-    } catch {
-      continue;
-    }
-    if (row === null || typeof row !== "object") continue;
-    const rec = row as { readonly [key: string]: unknown };
-    if (rec["stopReason"] !== "error") continue;
-    const message = rec["errorMessage"];
-    if (typeof message !== "string" || message.trim() === "") continue;
-    const status = rec["errorStatus"];
-    return {
-      ...(typeof status === "number" && Number.isFinite(status) ? { status } : {}),
-      message: message.trim(),
-    };
-  }
-  return undefined;
-}
+const HISTORICAL_INFRA_BATCH = 20;
+
+/** How many workflow runs for the head commit one row's evidence pass reads —
+ *  and the ceiling past which the row is refused as undecided rather than
+ *  decided from a prefix of its head-pinned runs (review #654). */
+const HISTORICAL_INFRA_RUNS = 3;
+
+/** How many attempts of one workflow run may be read for the failed log — and
+ *  the ceiling past which the run is refused as undecided rather than read as
+ *  a prefix that could hide a later attempt's real failure (review #654). A
+ *  failed job rerun to green leaves the failure in an earlier attempt; the
+ *  bound keeps one pathological run from costing the whole pass. */
+const HISTORICAL_INFRA_ATTEMPTS = 5;
 
 /**
- * Classify every unclassified terminal run, persist the verdict, and perform the
- * one recovery its class names (#132).
+ * Repair settled `ci-deterministic` rows whose re-fetched check log carries a
+ * closed infrastructure signature (#638). The forward classifier now names
+ * the codeload setup 429 of #177 `ci-infra`, but a row already classified
+ * `ci-deterministic`/`escalate` never re-enters the classification sweep, so
+ * the old verdict charges an implementation attempt forever. Re-fetching the
+ * head-pinned workflow-run attempt logs through the tracker, matching the
+ * classifier's own closed signature list, and reclassifying `failureClass`
+ * alone returns the attempt without re-animating a months-old run into
+ * recovery.
  *
- * Half this fleet's spend produced no merged PR, and every one of those runs
- * ended at a human who re-derived the same triage by hand and then threw the
- * conclusion away. The mechanical classes — a cancelled runner, a kill from a
- * daemon restart, a green PR whose base moved, a row whose PR had already merged
- * — need no judgement at all; the genuinely human ones are worth a person's
- * attention only if they arrive with their evidence already gathered.
+ * Bounded, idempotent and resumable: one batch per call, reclassifications
+ * only, and the store's update is guarded by the row still reading
+ * `ci-deterministic`, so a second pass touches nothing it already repaired.
+ * The batch resumes below a persisted review cursor, so each row is evaluated
+ * once rather than rescanning the newest non-matches forever and starving
+ * older repairable rows. A row whose evidence could not be read is a
+ * no-mutation refusal: the cursor never advances past it, so the next pass
+ * asks again; a row that was read and shown *not* to be infrastructure
+ * advances the cursor. Every repair requires *all* gathered failed logs to
+ * carry an infra signature — a setup 429 in one attempt must not waive a
+ * compile/test failure in a sibling attempt.
  *
- * Facts are fetched per row and only the ones that row needs: a `killed` row
- * costs nothing, a `failed` row with a PR costs a state read and a check read.
- * A `pushed-green` row that classifies to nothing is left completely untouched —
- * it is healthy, and writing a class onto it would take it out of this sweep for
- * good.
+ * Returns how many rows it repaired, for the boot log.
  */
-export async function classifyAndRecover(d: Deps): Promise<number> {
-  const { project, caps, tracker, store } = d;
-  // Settle recoveries, counted for the pass's dispatch record — a row whose PR
-  // merged is settled here when the settle sweep could not establish identity
-  // (#497). Every other exit returns 0.
-  let settled = 0;
-  for (const run of store.runsNeedingClassification(project.name, CLASSIFY_BATCH)) {
-    const facts: ClassifyFacts = {};
-    let classifiedRun = run;
-    if (run.state === "failed" || run.state === "killed") {
-      const sessionError = readSessionError(run.sessionFile);
-      if (sessionError !== undefined) {
-        if (run.lastError === undefined || run.lastError === sessionError.message) {
-          facts.sessionError = sessionError;
-        }
-        if (run.lastError === undefined) {
-          store.updateRun(run.id, { lastError: sessionError.message });
-          classifiedRun = { ...run, lastError: sessionError.message };
-        }
-      }
-    }
-    try {
-      if (run.prUrl !== undefined) {
-        const pr = await tracker.prState(run.prUrl);
-        if (pr !== undefined) facts.pr = pr;
-        if (run.state === "pushed-green" && facts.pr === "open") {
-          facts.mergeable = await tracker.mergeable(run.prUrl);
-        }
-        if (run.state === "failed" && facts.pr === "open") {
-          facts.checks = await tracker.checkConclusions(run.prUrl);
-          // When a check failed with a reachable log, pull its tail so the
-          // table can tell an infra outage (#177) from a real test failure by
-          // the log's own words. First failure wins; a log that cannot be
-          // fetched is left undefined and classification stays conservative.
-          const firstFailure = facts.checks.find((c) => c.state === "failure" && c.link !== undefined);
-          if (firstFailure?.link !== undefined) {
-            facts.failingLog = await tracker.checkLog(firstFailure.link);
-          }
-        }
-      }
-    } catch (err) {
-      // Per row, like every other sweep here: one unreachable PR must not stop
-      // the rest from being classified. The next tick asks again for free.
-      log(`#${run.issue} not classified: fact gathering failed (${errText(err)}) — retrying next tick`);
-      continue;
-    }
-
-    const { cls, recovery, evidence } = classifyRun(classifiedRun, facts, caps);
-
-    // A healthy green PR is not a failure of any class. Leaving the row
-    // unclassified is what keeps it eligible for the sweep on the tick where its
-    // base does move under it.
-    if (run.state === "pushed-green" && cls === "unknown") continue;
-
-    const retry = run.failureClass !== undefined;
-    store.updateRun(run.id, { failureClass: cls, recoveryAction: recovery });
-    log(
-      retry
-        ? `#${run.issue} retrying ${recovery} for ${cls}: ${evidence}`
-        : `#${run.issue} classified ${cls} → ${recovery}: ${evidence}`,
-    );
-    if (recovery === "settle") settled += 1;
-    await recoverRun(d, classifiedRun, cls, recovery, evidence);
-  }
-  return settled;
-}
-
-/** Performs the one action a class names. Never chooses one of its own. */
-async function recoverRun(
-  d: Deps,
-  run: RunRecord,
-  cls: FailureClass,
-  recovery: RecoveryAction,
-  evidence: string,
-): Promise<void> {
-  const { project, caps, tracker, store } = d;
-  const inProgress = project.stateLabels.inProgress;
-
-  if (recovery === "settle") {
-    // Enqueue the release with the terminal write (see `settlePushedGreen`):
-    // the outbox keeps the label and the row one fact, so a tracker refusal
-    // can no longer strand `agent:in-progress` with nothing left to retry it
-    // (#18, #201).
-    releaseInProgress(d, run.issue, `PR merged: ${evidence}`);
-    store.updateRun(run.id, { state: "merged", endedAt: Date.now(), recoveredAt: Date.now() });
-    log(`#${run.issue} settled from ${cls}: ${evidence}`);
-    return;
-  }
-
-  if (recovery === "continue") {
-    // Two classes recover by continuing, and only one of them has anything left
-    // to do here.
-    //
-    // `turn-cap-progress` was already handed back by the completion path, which
-    // swapped its labels and left the branch retained. There is nothing to
-    // perform, and writing anything would be actively wrong: overwriting
-    // `lastError` with a rebase brief tells the continuation worker to rebase a
-    // run that simply ran out of turns, and re-swapping labels the completion
-    // path already swapped is a pair of no-op `gh` calls. Record-only, so the
-    // sweep stops re-offering it.
-    if (cls === "turn-cap-progress") {
-      store.updateRun(run.id, { recoveredAt: Date.now() });
-      log(`#${run.issue} already continuing from ${cls}: ${evidence}`);
-      return;
-    }
-
-    // `wall-clock-cap-progress`: the completion path only auto-continues
-    // turn-cap kills, so a wall-clock kill with work to show reaches this
-    // sweep still holding the failed label. Swap it for the queue — the branch
-    // is retained, so the next dispatch reattaches it and briefs a resume from
-    // the recorded work. Killed rows gathered no tracker facts, so the
-    // issue-open guard mirrors the requeue path's. The continuation gate is
-    // the same one the turns path applies at kill time
-    // (`shouldContinueAfterTurnsCap`): the row is already charged, and once
-    // the ceiling is spent, handing back the queue label would offer a
-    // candidate admission can never accept — only the failed label comes off,
-    // and the exhaustion reaches a human (#490, #348).
-    if (cls === "wall-clock-cap-progress") {
-      const state = await tracker.issueState(run.issue).catch(() => undefined);
-      if (state !== "open") {
-        log(`#${run.issue} not continued from ${cls}: issue is ${state ?? "unreadable"}`);
-        return;
-      }
-      const continuation = store.continuationsFor(project.name, run.issue);
-      if (hasContinuationBudget(continuation, caps.maxContinuationsPerIssue)) {
-        swapToQueue(d, run.issue, project.stateLabels.failed);
-        store.updateRun(run.id, { recoveredAt: Date.now() });
-        log(`#${run.issue} requeued for a wall-clock continuation: ${evidence}`);
-      } else {
-        store.enqueueLabelOps(project.name, [
-          { issue: run.issue, op: "remove", label: project.stateLabels.failed },
-        ]);
-        store.updateRun(run.id, { recoveredAt: Date.now() });
-        await safeEscalate(d, {
-          tier: 1,
-          project: project.name,
-          issue: run.issue,
-          summary: `#${run.issue} exhausted its continuation budget on wall-clock cap kills`,
-          detail: [
-            `Attempt ${run.attempt} hit the wall-clock cap with work to continue from, but ${continuation} continuation(s) are already charged against a cap of ${caps.maxContinuationsPerIssue}.`,
-            evidence,
-            `Work to continue: branch ${run.branch} at ${run.headSha ?? run.salvageSha}${run.prUrl === undefined ? "" : ` — ${run.prUrl}`}.`,
-            "The issue cannot finish inside the wall-clock cap, so another run would burn a worker slot for the same outcome. Re-scope it, raise maxContinuationsPerIssue for it, or finish the remaining work by hand.",
-          ].join("\n"),
-        });
-        await postExhaustionPostmortem(
-          d,
-          run,
-          `Attempt ${run.attempt} hit the wall-clock cap with work to continue from, but ${continuation} continuation(s) are already charged against a cap of ${caps.maxContinuationsPerIssue}.`,
-        );
-        log(`#${run.issue} not continued from ${cls}: continuation budget exhausted`);
-      }
-      return;
-    }
-
-    // `merge-conflict`: the branch is retained and its PR is open, so #50's
-    // continuation guard admits it and the next tick briefs a rebase.
-    //
-    // The outbox makes the retry contract one-sided: the swap is enqueued — a
-    // durable local write that cannot fail on the tracker — before
-    // `recoveredAt` is written, so the row can never again be taken out of
-    // `runsNeedingClassification` with its label swap still owed. That was
-    // the defect 0.4.4 claimed to have fixed and did not, for this one
-    // recovery; the projector retries until the tracker takes the swap, and
-    // while it is pending the eligibility overlay keeps the issue coherent
-    // (#201).
-    swapToQueue(d, run.issue, inProgress);
-    store.updateRun(run.id, {
-      state: "killed",
-      lastError:
-        "merge-conflict: base moved under a green PR — rebase, regenerate recorded artifacts, push without force",
-      recoveredAt: Date.now(),
-    });
-    log(`#${run.issue} requeued for a rebase continuation: ${evidence}`);
-    return;
-  }
-
-  if (recovery === "requeue") {
-    if (cls === "provider-credit") {
-      await reactToProviderCredit(d, run.issue, evidence, run.sessionFile);
-    }
-    // A dispatch-infra requeue that keeps landing on the same issue means the
-    // mirror for its repo is persistently broken — a ref-lock that retry already
-    // exhausted, a dead remote. Requeueing forever spends a turn-0 run per tick
-    // with no chance of success, so after a bounded number of strikes this
-    // escalates to a human instead (#168, #177).
-    if (cls === "dispatch-infra" && store.classCountFor(project.name, run.issue, "dispatch-infra") >= DISPATCH_INFRA_MAX_STRIKES) {
-      await safeEscalate(d, {
-        tier: 1,
-        project: project.name,
-        issue: run.issue,
-        summary: `[dispatch-infra] #${run.issue}: the mirror for ${run.repo} is failing persistently — ${evidence}`,
-        detail: [
-          `The dispatcher could not provision a worktree for #${run.issue} ${DISPATCH_INFRA_MAX_STRIKES} times in a row, all before the worker's first turn.`,
-          "The mirror on this host needs attention (check disk, SSH/HTTPS credentials, and the mirror root).",
-        ].join("\n"),
-      });
-      store.updateRun(run.id, { recoveredAt: Date.now() });
-      log(`#${run.issue} escalated from persistent ${cls}: ${evidence}`);
-      return;
-    }
-    // Same bound for provider-transient: an issue whose stream keeps stalling
-    // mid-run is requeued free (no attempt, no continuation charged) — but a
-    // provider that aborts three times for one issue is down, and a human has
-    // to check its status before hand-requeueing (#220). The escalation names
-    // every model the chain tried, so a merged branch built on a different
-    // model is attributable (#286).
-    if (
-      cls === "provider-transient" &&
-      store.classCountFor(project.name, run.issue, "provider-transient") >= PROVIDER_TRANSIENT_MAX_STRIKES
-    ) {
-      const tried = formatModelsTried(modelsTried(store.runsForIssue(project.name, run.issue)));
-      await safeEscalate(d, {
-        tier: 1,
-        project: project.name,
-        issue: run.issue,
-        summary: `[provider-transient] #${run.issue}: the provider keeps aborting mid-stream — ${evidence}`,
-        detail: [
-          `The provider aborted the stream for #${run.issue} ${PROVIDER_TRANSIENT_MAX_STRIKES} times without the run ever producing a verdict (0 tokens billed each time).`,
-          ...(tried === ""
-            ? []
-            : [`Models tried: ${tried}.`]),
-          "Check provider status before requeueing by hand.",
-        ].join("\n"),
-      });
-      store.updateRun(run.id, { recoveredAt: Date.now() });
-      log(`#${run.issue} escalated from persistent ${cls}: ${evidence}`);
-      return;
-    }
-    // Same bound for provider-capacity: a run the provider throttled into the
-    // ground is requeued free (no attempt charged) — but a provider that
-    // throttles the same issue three times is at capacity, and a human has to
-    // check its status before hand-requeueing (#573). On a chain-configured
-    // project each requeue already moved the next attempt to the next chain
-    // model, so this escalation is what catches the no-chain case and the
-    // exhausted chain; it names every model the chain tried.
-    if (
-      cls === "provider-capacity" &&
-      store.classCountFor(project.name, run.issue, "provider-capacity") >= PROVIDER_CAPACITY_MAX_STRIKES
-    ) {
-      const tried = formatModelsTried(modelsTried(store.runsForIssue(project.name, run.issue)));
-      await safeEscalate(d, {
-        tier: 1,
-        project: project.name,
-        issue: run.issue,
-        summary: `[provider-capacity] #${run.issue}: the model provider is throttling this run into the ground — ${evidence}`,
-        detail: [
-          `The provider answered #${run.issue} with sustained in-session rate limits ${PROVIDER_CAPACITY_MAX_STRIKES} times in a row; the harness retried each and was exhausted.`,
-          ...(tried === ""
-            ? []
-            : [`Models tried: ${tried}.`]),
-          "Check the provider's rate-limit status (and its throughput-oriented routes) before requeueing by hand.",
-        ].join("\n"),
-      });
-      store.updateRun(run.id, { recoveredAt: Date.now() });
-      log(`#${run.issue} escalated from persistent ${cls}: ${evidence}`);
-      return;
-    }
-    // Only when the tracker still shows this issue as ours to hand back. An
-    // issue that is closed, or has no state label, was resolved by another route
-    // and requeueing it would dispatch work nobody asked for.
-    const state = await tracker.issueState(run.issue).catch(() => undefined);
-    if (state !== "open") {
-      log(`#${run.issue} not requeued from ${cls}: issue is ${state ?? "unreadable"}`);
-      return;
-    }
-    // A clean orphan whose queue label is already absent is a deliberate
-    // withdrawal — the operator took the issue out of the queue (e.g. so a
-    // daemon restart could not re-dispatch work known to be unsafe) — and
-    // recovery must not recreate that intent (#423). Read the live label set;
-    // when the queue label is gone, release the dispatcher-owned in-progress
-    // label and stop, leaving the operator's withdrawal to survive recovery.
-    if (cls === "orphan-clean") {
-      const snapshot = await tracker.issueSnapshot(run.issue).catch(() => undefined);
-      if (snapshot === undefined) {
-        log(`#${run.issue} not requeued from orphan-clean: cannot confirm ${project.queueLabel} (unreadable, retrying)`);
-        return;
-      }
-      if (!snapshot.labels.includes(project.queueLabel)) {
-        store.enqueueLabelOps(project.name, [{ issue: run.issue, op: "remove", label: inProgress }]);
-        store.updateRun(run.id, { recoveredAt: Date.now() });
-        log(`#${run.issue} not requeued from orphan-clean: ${project.queueLabel} removed before recovery (operator withdrawal)`);
-        return;
-      }
-      // #439: an orphan-clean row charges the continuation budget, so once
-      // `hasContinuationBudget` is spent — exactly the predicate `admitCandidates`
-      // holds the issue on — requeueing re-adds a queue label for a candidate the
-      // dispatcher can never admit. Stop handing it back and hold it instead: the
-      // queue label comes off (so admission never re-holds on every dispatch),
-      // the in-progress label is released, and a single diagnosis escalates once.
-      // `orphan-clean` is deliberately NOT a global exclusion from the budget (a
-      // worker that genuinely keeps dying mid-work must still be bounded); this is
-      // the missing ceiling check this path never had (#348's invariant).
-      const continuations = store.continuationsFor(project.name, run.issue);
-      if (!hasContinuationBudget(continuations, caps.maxContinuationsPerIssue)) {
-        const runs = store.runsForIssue(project.name, run.issue);
-        const breakdown = continuationBreakdown(runs);
-        const artifact = newestContinuableRun(runs);
-        const onlyDaemonStops = breakdown.size === 1 && breakdown.get("orphan-clean") === continuations;
-        const classLine = Array.from(breakdown, ([cls, n]) => `${n} ${cls}`).join(", ");
-        const artifactLine =
-          artifact === undefined
-            ? "The attempts left no salvage commit, head SHA or PR — the branch is empty, so start clean from a re-scope rather than continuing from nothing."
-            : `Work to continue: branch ${artifact.branch} at ${artifact.headSha ?? artifact.salvageSha}${artifact.prUrl === undefined ? "" : ` — ${artifact.prUrl}`}.`;
-        store.enqueueLabelOps(project.name, [
-          { issue: run.issue, op: "remove", label: inProgress },
-          { issue: run.issue, op: "remove", label: project.queueLabel },
-        ]);
-        store.updateRun(run.id, { recoveredAt: Date.now() });
-        await safeEscalate(d, {
-          tier: 1,
-          project: project.name,
-          issue: run.issue,
-          summary: `#${run.issue} exhausted its ${caps.maxContinuationsPerIssue}-continuation budget on ${cls}`,
-          detail: [
-            `Attempt ${run.attempt} is not requeued: ${continuations} continuation(s) charged against a cap of ${caps.maxContinuationsPerIssue}.`,
-            `Continuations by failure class: ${classLine}.`,
-            onlyDaemonStops
-              ? "Every continuation was a daemon stop — the work never failed; the budget was spent by daemon deaths, not the issue."
-              : "Continuations span real work — inspect what each attempt left behind before continuing.",
-            artifactLine,
-            "What you can do: raise maxContinuationsPerIssue for this issue, re-scope it, or continue from the preserved work (or start clean if none).",
-          ].join("\n"),
-        });
-        await postExhaustionPostmortem(
-          d,
-          run,
-          `Attempt ${run.attempt} is not requeued: ${continuations} continuation(s) charged against a cap of ${caps.maxContinuationsPerIssue}.`,
-        );
-        log(`#${run.issue} not requeued from orphan-clean: continuation budget exhausted`);
-        return;
-      }
-    }
-    const label = cls === "orphan-clean" ? inProgress : project.stateLabels.failed;
-    swapToQueue(d, run.issue, label);
-    store.updateRun(run.id, { recoveredAt: Date.now() });
-    log(`#${run.issue} requeued from ${cls}: ${evidence}`);
-    return;
-  }
-
-  if (recovery === "rerun-checks") {
-    if (run.prUrl === undefined) return;
-    try {
-      await tracker.rerunFailedChecks(run.prUrl);
-    } catch (err) {
-      log(`#${run.issue} check re-run failed (${errText(err)}) — retrying next tick`);
-      return;
-    }
-    // Back to pending rather than green: the existing settle sweep re-verifies
-    // it against the recorded head on a later tick, so nothing here has to guess
-    // whether the re-run passed.
-    store.updateRun(run.id, { state: "pushed-pending", lastError: null, recoveredAt: Date.now() });
-    log(`#${run.issue} re-ran infrastructure checks: ${evidence}`);
-    return;
-  }
-
-  if (recovery === "escalate") {
-    const detail = [evidence];
-    if (cls === "turn-cap-spinning" || cls === "wall-clock-cap-spinning") {
-      const calls = lastToolCalls(run.sessionFile);
-      detail.push(
-        calls.length === 0
-          ? "transcript unreadable — no tool calls could be recovered"
-          : `Last ${calls.length} tool calls: ${calls.join(" → ")}`,
+export async function reconcileHistoricalInfra(d: Deps): Promise<number> {
+  const { project, store } = d;
+  const version = infraSignatureVersion();
+  const persisted = store.historicalInfraCursor(project.name);
+  // A cursor stamped by an older signature list is stale: the classifier now
+  // recognises more evidence, so the pass restarts from the newest row rather
+  // than skipping past newly repairable history (#638).
+  const cursor =
+    persisted !== undefined && persisted.classifierVersion === version
+      ? { startedAt: persisted.startedAt, rowid: persisted.rowid }
+      : undefined;
+  const candidates = store.historicalInfraCandidates(project.name, HISTORICAL_INFRA_BATCH, cursor);
+  let repaired = 0;
+  let lastDecided: { startedAt: number; rowid: number } | undefined;
+  for (const run of candidates) {
+    const chunks = await historicalInfraEvidence(d, run);
+    // Unreachable evidence is undecided exactly like a fresh classifier is: a
+    // no-mutation refusal the next pass asks again, and the cursor stops here
+    // so the row is re-offered rather than being skipped past.
+    if (chunks === undefined) break;
+    lastDecided = { startedAt: run.startedAt, rowid: run.rowid };
+    // The head's runs were read and none holds a failing log — determinately
+    // not infrastructure, so an old misclassified verdict stays charged.
+    if (chunks.length === 0) continue;
+    // Mixed guard: anything gathered that is not itself a closed infra
+    // signature (a compile/test failure in a sibling attempt, a product 429)
+    // refuses the whole row. One setup 429 is not permission to waive a real
+    // implementation failure.
+    if (!chunks.every((chunk) => infraLogSignature(chunk) !== undefined)) continue;
+    if (store.reclassifyInfra(run.id)) {
+      repaired += 1;
+      // The every-guard above guarantees a signature and a first chunk; the
+      // non-null assertions make the same fact readable to the type checker.
+      log(
+        `#${run.issue} repaired historical ${run.failureClass ?? "ci-deterministic"} → ci-infra (run ${run.id}): ` +
+          `"${infraLogSignature(chunks[0]!)}" in the failed check log`,
       );
     }
-    if (run.lastError !== undefined && cls !== "question") detail.push(run.lastError);
-    // #172: an unwritten transcript is "the run died before it flushed", not a
-    // link to a file the operator will open and find missing.
-    detail.push(
-      run.sessionFile === undefined
-        ? "Session: (no transcript)"
-        : existsSync(run.sessionFile)
-          ? `Session: ${run.sessionFile}`
-          : `Session: ${run.sessionFile} (file was never written — the run died before its transcript was flushed)`,
+  }
+  if (lastDecided !== undefined) {
+    store.setHistoricalInfraCursor(
+      project.name,
+      lastDecided.startedAt,
+      lastDecided.rowid,
+      version,
     );
-    // The class and the run are in the summary, which is what the notifications
-    // ledger dedupes on — so one class escalates once per run rather than every
-    // five minutes.
-    await safeEscalate(d, {
-      tier: 1,
-      project: project.name,
-      issue: run.issue,
-      runId: run.id,
-      summary: `[${cls}] #${run.issue} attempt ${run.attempt}: ${evidence}`,
-      detail: detail.join("\n"),
-    });
-    // The hand-off IS the recovery for these classes: there is nothing else this
-    // package can do, and leaving the row unrecovered would re-escalate forever.
-    store.updateRun(run.id, { recoveredAt: Date.now() });
-    return;
   }
-
-  // `hold` (orphan-dirty) and `none`: recorded, nothing performed. The existing
-  // unsalvaged-WIP admission hold already fails dispatch closed until an
-  // operator acknowledges the tree, which is the only safe move when the
-  // worktree holds the only copy of real work.
-}
-
-/**
- * Enqueue a state-label → queue-label swap for projection (#201).
- *
- * The swap is two ops in id order — remove first, then add — which is the
- * atomicity the projector guarantees: the issue never sits newly eligible
- * without a queue label on its way back, and the add never lands before the
- * remove when GitHub fails between them. Enqueueing is a durable local write
- * that cannot fail on the tracker, so the caller records its recovery
- * immediately and the projector retries the swap until the tracker takes it —
- * that closes the 0.4.4 hole where a refused label swap stranded the row
- * permanently under a log line promising a retry.
- */
-function swapToQueue(d: Pick<Deps, "project" | "store">, issue: number, label: string): void {
-  d.store.enqueueLabelOps(d.project.name, [
-    { issue, op: "remove", label },
-    { issue, op: "add", label: d.project.queueLabel },
-  ]);
+  return repaired;
 }
 
-/** Bounded listing per state label, so one reconcile cannot walk a whole repo. */
-const RECONCILE_LIMIT = 50;
-
 /**
- * Clear state labels from issues that no longer need them (#132's `superseded`).
- *
- * Two structural signals, both cheap and both observed on this fleet: an issue
- * that is closed but still carries `agent:*`, and an open issue carrying
- * `failed` whose sub-issues have all closed. On 2026-08-09 four issues (#307,
- * #297, #140, #82) carried `agent:failed` while every one of them was already
- * complete — the label was residue of a turns-cap kill from two days earlier,
- * and nothing in the loop ever revisited it. The board counted four phantom
- * failures while the genuinely stuck issues were invisible.
+ * The failed check logs of a settled `ci-deterministic` row, head-pinned to
+ * the exact commit the row ran against, or `undefined` when the evidence is
+ * unreachable (#638). Only the workflow-run history at `run.headSha` is
+ * evidence: the PR's *current* check rollup is not, because a later push's
+ * checks must never classify an earlier run's row. `workflowRunsAt` is itself
+ * head-scoped, and each run's failed attempts are read through the tracker's
+ * guarded runner (call/refusal accounting and the rate-limit breaker apply).
  *
- * Positive evidence only. A tracker that cannot list answers empty, and an empty
- * answer removes nothing: a reconcile that guessed would strip the interlock
- * that keeps two workers off one issue.
+ * Returns the per-failed-job failed logs gathered across the head's runs (one
+ * chunk per failed job, full and untruncated), or `undefined` when any read
+ * could not be made — the run register, an attempt's job register, a failed
+ * job's log, or the head-run list itself — or when a bounded evidence set
+ * exceeded its limit (more head-pinned runs than `HISTORICAL_INFRA_RUNS`, or
+ * more attempts than `HISTORICAL_INFRA_ATTEMPTS`). Undefined is a no-mutation
+ * refusal the next pass asks again; the cursor never advances past it. `[]`
+ * means the head's runs were read and none holds a failing log — a
+ * determinately non-infrastructure answer.
  */
-export async function reconcileStaleLabels(d: Deps): Promise<void> {
-  const { project, tracker, store } = d;
-  const labels = [project.stateLabels.failed, project.stateLabels.blocked, project.stateLabels.inProgress];
-
-  for (const label of labels) {
-    const carrying = await tracker.listLabeled(label, RECONCILE_LIMIT).catch(() => []);
-    for (const issue of carrying) {
-      if (issue.state === "closed") {
-        // Never retain an `agent:*` label on a closed issue: the work is done by
-        // some route, and the label only makes the board lie about it. Enqueue
-        // rather than call — a refused write must not lose the decision; the
-        // projector retries the removal until the tracker takes it (#201).
-        store.enqueueLabelOps(project.name, [{ issue: issue.number, op: "remove", label }]);
-        log(`#${issue.number} reconciled: closed issue no longer carries ${label} (queued)`);
-        continue;
-      }
-
-      if (label !== project.stateLabels.failed) continue;
-      const children = await tracker.childrenOf(issue.number).catch(() => []);
-      if (children.length === 0 || children.some((c) => c.state !== "closed")) continue;
-
-      const key = `${project.name}:superseded:${issue.number}`;
-      if (store.wasNotified(key)) continue;
-      const list = children.map((c) => `#${c.number}`).join(", ");
-      store.enqueueLabelOps(project.name, [{ issue: issue.number, op: "remove", label }]);
-      try {
-        await tracker.comment(
-          issue.number,
-          `superseded: all sub-issues closed (${list}) — this label was stale; propose closing if the ` +
-            `acceptance criteria are met on the default branch.`,
-        );
-        store.markNotified(key);
-        log(`#${issue.number} reconciled: superseded by ${list}`);
-      } catch (err) {
-        // The label removal is already queued and will land regardless; the
-        // comment is the only half that can fail here (#201).
-        log(`#${issue.number} could not comment the superseded note (${errText(err)}) — retrying next tick`);
-      }
-    }
+async function historicalInfraEvidence(d: Deps, run: RunRecord): Promise<string[] | undefined> {
+  // Without a head SHA there is no safe way to pin evidence to this row; a
+  // head-less row is determinately not a repair candidate, so it advances the
+  // cursor rather than stalling the pass.
+  if (run.headSha === undefined) return [];
+  const target = d.project.routing.repos[run.repo];
+  const repoIdentity = target === undefined ? undefined : githubRepo(target.cloneUrl);
+  if (repoIdentity === undefined) return [];
+  let runs: WorkflowRun[] | undefined;
+  try {
+    runs = await d.tracker.workflowRunsAt(repoIdentity, run.headSha);
+  } catch {
+    return undefined;
   }
-}
-
-/**
- * Settles `claimed`/`running` rows left by a dead daemon process and, before
- * marking each one `orphaned`, salvages any dirty worktree.
- *
- * Found live after a host restart killed two workers mid-run, and again on
- * every package deploy that restarted while workers were live (#35): without
- * the salvage call the next attempt's `worktree remove --force` destroyed
- * uncommitted edits that had no other copy. Cap-kills already salvaged (#27);
- * this is the same call site for the restart path.
- *
- * Only the rows change. The issue keeps its in-progress label — that label is
- * the crash guard against double-dispatch, and deciding what a dead worker's
- * remains are worth (an open PR? a salvaged sha? a clean tree?) is the
- * orchestrator's drain-duty judgement, not something to automate here. The
- * rows also keep counting toward `maxAttemptsPerIssue`, so a loop of deaths
- * still escalates instead of retrying forever.
- *
- * `pushed-green` rows are deliberately left alone: they hold no process — they
- * are finished work waiting on a human merge, and they must keep occupying the
- * issue so a second attempt cannot land on a live PR. What eventually settles
- * them is {@link settlePushedGreen}, on the tick, by asking the tracker what
- * became of the PR — the one question a restart cannot answer by inference.
- */
-export async function reconcileOrphanedRuns(
-  store: Store,
-  project: string,
-  /**
-   * Resolves the privileged publisher for one orphaned run. Optional because a
-   * test driving the row transitions has no repo to publish to; production
-   * always passes it, and without it a salvaged WIP commit stays local — which
-   * is the half of #121 that reaches a human.
-   */
-  publish?: (run: RunRecord) => RunPublisher,
-): Promise<RunRecord[]> {
-  // Live runs only: `pushed-green` holds no process, so it cannot be orphaned by
-  // a process dying — it is finished work waiting on a human merge.
-  const stale = store.liveRuns(project);
-  const endedAt = Date.now();
-  for (const r of stale) {
-    // Salvage before the row flips: the worktree path is on the record, and
-    // salvageWip is a no-op for a missing/clean tree. The clause matches the
-    // cap-kill wording so triage reads the same either way, and the tree is
-    // kept because an orphan's remains are the orchestrator's drain-duty call.
-    const settlement =
-      r.worktree === ""
-        ? undefined
-        : await settleWorktree({
-            issue: r.issue,
-            attempt: r.attempt,
-            ending: "killed by a daemon restart",
-            worktree: r.worktree,
-            branch: r.branch,
-            // An orphan's tree is kept, so its commits are not about to be
-            // deleted — but a WIP salvage still has to reach GitHub, which is
-            // #121's whole point and is now the daemon's hop to make.
-            publish: publish?.(r),
-            tree: "keep",
-          });
-    store.updateRun(r.id, { state: "orphaned", endedAt, ...settlement?.patch });
+  if (runs === undefined) return undefined;
+  // Refuse rather than decide from the first `HISTORICAL_INFRA_RUNS`: three
+  // setup-429 runs must not waive a row whose fourth head-pinned run carries
+  // the real compile/test failure (review #654). Undecided means the cursor
+  // never advances past this row, so the next pass asks again.
+  if (runs.length > HISTORICAL_INFRA_RUNS) return undefined;
+  const chunks: string[] = [];
+  for (const wf of runs) {
+    const logs = await d.tracker.runFailedAttemptLogs(
+      repoIdentity,
+      wf.url,
+      HISTORICAL_INFRA_ATTEMPTS,
+    );
+    if (logs === undefined) return undefined;
+    chunks.push(...logs);
   }
-  return stale;
+  return chunks;
 }
 
+
 // ------------------------------------------------------------------- the daemon
 
 interface ProjectRuntime {
@@ -5450,12 +5398,17 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
       log(projects.length === 1 ? message : `[${project.name}] ${message}`);
     };
     const caps = resolveCaps(project, cfg.defaults);
+    // One transient-server-error breaker per project (#642): admission's
+    // GraphQL checks and the orchestrator mutation commands share it, so a 503
+    // observed by either side gates both instead of one provider outage being
+    // re-asked by every candidate AND every mutation.
+    const graphqlBreaker = new GraphqlBreaker();
     const tracker = makeTracker(project, undefined, {
       onCall: () => store.bumpGhCalls?.(utcDay(), "daemon"),
       onRefusal: (at) => store.recordGhRefusal?.(at),
       onNotModified: () => store.bumpGhCalls?.(utcDay(), "daemon-304"),
-    });
-    const verbActions = githubVerbActions(project);
+    }, { graphqlBreaker });
+    const verbActions = githubVerbActions(project, undefined, undefined, graphqlBreaker);
 
     if (alive === undefined || alive.pid === process.pid) {
       const orphanPublisher = (run: RunRecord): RunPublisher => {
@@ -5600,10 +5553,38 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
           onCall: () => store.bumpGhCalls?.(utcDay(), "daemon"),
           onRefusal: (at) => store.recordGhRefusal?.(at),
         }).issueSnapshot(issue),
+      // The body twin of `probeIssueIn`, for the dependency-graph cycle pass
+      // (#421): reads a reachable routed prerequisite's body through the same
+      // per-repo tracker/credential/accounting seams.
+      probeBodyIn: (ownerRepo, issue) =>
+        makeTracker({ ...project, tracker: { kind: "github", repo: ownerRepo } }, undefined, {
+          onCall: () => store.bumpGhCalls?.(utcDay(), "daemon"),
+          onRefusal: (at) => store.recordGhRefusal?.(at),
+        }).issueBody(issue),
       ...(verbPeerReader === undefined ? {} : { verbPeerReader }),
       verbActions,
     };
     runtimeDeps = d;
+    // Review-revision restart recovery (#692): a revision the previous daemon
+    // claimed and lost — its run is `running`/`orphaned` by the orphan sweep
+    // above — is restored to `pushed-green` and re-queued so this process's
+    // first dispatch pass resumes the exact session. Runs under the same
+    // dead-daemon guard as `reconcileOrphanedRuns`, and after it, so the
+    // revision's worktree has already been salvaged to the branch before it is
+    // cleared for a fresh reattach. A round that cannot be restored was
+    // settled and escalated by the reconcile itself.
+    if (alive === undefined || alive.pid === process.pid) {
+      try {
+        for (const revision of await reconcileCrashedReviewRevisions(d)) {
+          projectLog(
+            `#${revision.issue} review round ${revision.round} recovered across restart — ` +
+              `run ${revision.runId} is pushed-green again and awaits its next dispatch pass`,
+          );
+        }
+      } catch (err) {
+        projectLog(`review revision restart recovery failed: ${errText(err)}`);
+      }
+    }
     // Startup reconciliation: close an incident carried over from a previous
     // process when the orchestrator is up (one recovery notice), or open one
     // when it failed to start (one down page). A daemon restarted while still
@@ -5625,6 +5606,21 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     });
   }
 
+  // Historical budget repair (#638): one bounded pass per daemon process,
+  // before the first tick, so admission and `unblock` read the repaired counts
+  // from the moment the daemon starts. A classifier fix changes future
+  // verdicts but not rows already settled under the old one; re-fetching their
+  // failed check logs and reclassifying the exact closed infrastructure
+  // signature returns those attempts without re-animating the runs. Best-effort
+  // per project — one unreachable project must not stop the rest from booting.
+  for (const runtime of runtimes) {
+    try {
+      await reconcileHistoricalInfra(runtime.d);
+    } catch (err) {
+      log(`historical infra reconciliation failed: ${errText(err)}`);
+    }
+  }
+
   if (o.once) {
     try {
       for (const runtime of runtimes) await tick(runtime.d, workers);