omp-conductor 0.17.1 → 0.18.0

package/src/store.ts

@@ -11,7 +11,7 @@
 
 import { Database } from "bun:sqlite";
 import { randomUUID } from "node:crypto";
-import { existsSync, mkdirSync, rmSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, rmSync, unlinkSync } from "node:fs";
 import { dirname, join } from "node:path";
 
 import { backupTimestamp, publishTempFile } from "./backups.ts";
@@ -146,6 +146,7 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   autoRetryCount: true,
   autoCompactionCount: true,
   sessionFile: true,
+  resumedFromRunId: true,
   prUrl: true,
   headSha: true,
   mergeSha: true,
@@ -155,6 +156,7 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   salvageSha: true,
   salvageError: true,
   salvageAckAt: true,
+  quarantineDetail: true,
   startedAt: true,
   endedAt: true,
   lastError: true,
@@ -191,6 +193,7 @@ interface RunRow {
   autoRetryCount: number | null;
   autoCompactionCount: number | null;
   sessionFile: string | null;
+  resumedFromRunId: string | null;
   prUrl: string | null;
   headSha: string | null;
   mergeSha: string | null;
@@ -200,6 +203,7 @@ interface RunRow {
   salvageSha: string | null;
   salvageError: string | null;
   salvageAckAt: number | null;
+  quarantineDetail: string | null;
   startedAt: number;
   endedAt: number | null;
   lastError: string | null;
@@ -517,6 +521,7 @@ CREATE TABLE IF NOT EXISTS runs (
   autoRetryCount INTEGER,
   autoCompactionCount INTEGER,
   sessionFile TEXT,
+  resumedFromRunId TEXT,
   prUrl       TEXT,
   headSha     TEXT,
   mergeSha    TEXT,
@@ -991,6 +996,7 @@ function toRecord(row: RunRow): RunRecord {
     startedAt: row.startedAt,
   };
   if (row.sessionFile !== null) record.sessionFile = row.sessionFile;
+  if (row.resumedFromRunId !== null) record.resumedFromRunId = row.resumedFromRunId;
   if (row.prUrl !== null) record.prUrl = row.prUrl;
   if (row.headSha !== null) record.headSha = row.headSha;
   if (row.mergeSha !== null) record.mergeSha = row.mergeSha;
@@ -1000,6 +1006,7 @@ function toRecord(row: RunRow): RunRecord {
   if (row.salvageSha !== null) record.salvageSha = row.salvageSha;
   if (row.salvageError !== null) record.salvageError = row.salvageError;
   if (row.salvageAckAt !== null) record.salvageAckAt = row.salvageAckAt;
+  if (row.quarantineDetail !== null) record.quarantineDetail = row.quarantineDetail;
   if (row.endedAt !== null) record.endedAt = row.endedAt;
   if (row.lastError !== null) record.lastError = row.lastError;
   if (row.settlementFlags !== null) {
@@ -1318,9 +1325,13 @@ export function vacuumInto(source: string, target: string): void {
  * A fresh, restorable copy of the store at `source`, published under `destDir`
  * with the same temp-then-atomic-publish convention as the config backups.
  *
+ * The stem carries `at` (default now) so the filename's timestamp is the
+ * snapshot's logical instant — the cadence passes its tick time, keeping the
+ * name, the day marker and the retention ordering in one timeline.
+ *
  * Returns the published snapshot path.
  */
-export function snapshotDb(source: string, destDir: string): string {
+export function snapshotDb(source: string, destDir: string, at: number = Date.now()): string {
   if (source === ":memory:") throw new Error("cannot snapshot an in-memory store");
   if (!existsSync(source)) {
     throw new Error(`cannot snapshot ${source}: the store does not exist`);
@@ -1334,7 +1345,34 @@ export function snapshotDb(source: string, destDir: string): string {
     rmSync(temporary, { force: true });
     throw err;
   }
-  return publishTempFile(temporary, destDir, `${DB_SNAPSHOT_STEM}-${backupTimestamp()}`);
+  return publishTempFile(temporary, destDir, `${DB_SNAPSHOT_STEM}-${backupTimestamp(at)}`);
+}
+
+/**
+ * How many conductor.db snapshots the daemon's daily cadence keeps — a week
+ * of ledger history at one snapshot per day. Deliberately a fixed count, not
+ * an age or space policy: the store's ledger is append-only and the issue
+ * forbids inventing a fleet-wide retention policy, so pruning is
+ * configured-count only (#289).
+ */
+export const DB_SNAPSHOT_RETENTION = 7;
+
+/**
+ * Prune a snapshot directory to the newest `keep` conductor.db snapshots.
+ *
+ * Snapshot stems embed the publish timestamp (`YYYY-MM-DDTHH-MM-SS…`), so
+ * lexicographic order is chronological; only files named with the shared
+ * `DB_SNAPSHOT_STEM` prefix are considered, never unrelated backups next to
+ * them. Idempotent: a directory already at or under the bound removes
+ * nothing. Returns the number of files removed.
+ */
+export function pruneDbSnapshots(dir: string, keep: number): number {
+  const names = readdirSync(dir)
+    .filter((name) => name.startsWith(DB_SNAPSHOT_STEM))
+    .sort();
+  const stale = names.length > keep ? names.slice(0, names.length - keep) : [];
+  for (const name of stale) unlinkSync(join(dir, name));
+  return stale.length;
 }
 
 /** The UTC calendar day (`YYYY-MM-DD`) a moment falls on — the partition key
@@ -1421,6 +1459,14 @@ export function openStore(dbPath: string): Store {
       db.exec(`ALTER TABLE runs ADD COLUMN ${name} ${type}`);
     }
   }
+  // Rows written before #737 were never asked whether their tree was
+  // quarantined, and a NULL means exactly that: the pre-quarantine passes
+  // reaped the same trees they always had, so nothing before this release
+  // needs backfilling — the column starts null and only a post-release pass
+  // that actually refuses a broken store writes it.
+  if (!columns.some((column) => column.name === "quarantineDetail")) {
+    db.exec("ALTER TABLE runs ADD COLUMN quarantineDetail TEXT");
+  }
   // Rows written before the settlement audit existed (#128) were never audited,
   // so a NULL here means "no audit ran" and reads the same as "found nothing".
   // That conflation is deliberate and harmless: the flags are advisory, and no
@@ -1455,6 +1501,13 @@ export function openStore(dbPath: string): Store {
   if (!columns.some((column) => column.name === "model")) {
     db.exec("ALTER TABLE runs ADD COLUMN model TEXT");
   }
+  // Resume provenance (#567): rows written before #564 landed were never
+  // resumed, so NULL is the honest reading of "no resume happened" — never
+  // "resumed from unknown". No backfill: the identity existed only in the
+  // dispatch decision, and deriving it now would guess at history.
+  if (!columns.some((column) => column.name === "resumedFromRunId")) {
+    db.exec("ALTER TABLE runs ADD COLUMN resumedFromRunId TEXT");
+  }
   // The count of in-session provider 429s a run recorded was first written by
   // the worker (#573). Rows predating the column are NULL, which is the honest
   // reading: the count was not recorded, so the classifier must not treat the
@@ -1614,10 +1667,10 @@ export function openStore(dbPath: string): Store {
   const insertRun = db.query<unknown, SqlValue[]>(
     `INSERT INTO runs (
        id, project, issue, repo, branch, worktree, state, attempt, turns,
-       maxTurns, spendUsd, sessionFile, prUrl, headSha, mergeSha, baseRef,
+       maxTurns, spendUsd, sessionFile, resumedFromRunId, prUrl, headSha, mergeSha, baseRef,
        baseCheck, baseCheckAt, salvageSha, salvageError, salvageAckAt, startedAt,
        endedAt, lastError, settlementFlags, report
-     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   );
   const selectRun = db.query<RunRow, [string]>(`SELECT * FROM runs WHERE id = ?`);
   const selectActive = db.query<RunRow, SqlValue[]>(
@@ -1870,6 +1923,21 @@ export function openStore(dbPath: string): Store {
         AND (salvageSha IS NOT NULL OR salvageError IS NOT NULL)
       ORDER BY issue ASC`,
   );
+  // Quarantined retained trees (#737), newest attempt per issue — the same
+  // shape as `selectSalvaged` because the same change can land twice: a row
+  // long since reaped must not keep its issue looking quarantined, and an
+  // older quarantined attempt must not claim the issue while a newer,
+  // healthy one replaced it.
+  const selectQuarantined = db.query<RunRow, [string]>(
+    `SELECT * FROM runs
+      WHERE rowid IN (
+        SELECT MAX(rowid) FROM runs
+        WHERE project = ?
+        GROUP BY issue
+      )
+        AND quarantineDetail IS NOT NULL
+      ORDER BY issue ASC`,
+  );
   // Newest attempt for one issue. `startedAt` is millisecond-resolution and two
   // attempts could in principle share one, so rowid breaks the tie by insertion
   // order — a `tail` that attached to the older of two same-millisecond attempts
@@ -2708,6 +2776,7 @@ export function openStore(dbPath: string): Store {
       record.maxTurns,
       record.spendUsd,
       toSql(record.sessionFile),
+      toSql(record.resumedFromRunId),
       toSql(record.prUrl),
       toSql(record.headSha),
       toSql(record.mergeSha),
@@ -2885,6 +2954,10 @@ export function openStore(dbPath: string): Store {
       return selectSalvaged.all(project).map(toRecord);
     },
 
+    quarantinedRuns(project: string): RunRecord[] {
+      return selectQuarantined.all(project).map(toRecord);
+    },
+
     attemptsFor(project: string, issue: number): number {
       return countAttempts.get(project, issue)?.n ?? 0;
     },

package/src/tracker/github.ts

@@ -1603,6 +1603,18 @@ export function makeTracker(
       );
     },
 
+    async getIssue(issue: number): Promise<ReadyIssue | undefined> {
+      try {
+        // The single-issue REST answer is that one object alone; it is wrapped
+        // so the shared parser stays the single mapping of a GitHub row onto
+        // ReadyIssue. A missing issue or an unreadable API answers undefined,
+        // never a guessed or partial row.
+        return readyIssuesFromRest(`[${await runGh(["api", `repos/${repo}/issues/${issue}`])}]`)[0];
+      } catch {
+        return undefined;
+      }
+    },
+
     async addLabel(issue: number, label: string): Promise<void> {
       try {
         // REST POST is natively idempotent: re-adding a label the issue already
@@ -1691,6 +1703,21 @@ export function makeTracker(
 
     issueSnapshot: readIssueSnapshot,
 
+    async issueBody(issue: number): Promise<string | undefined> {
+      try {
+        // Same single-issue REST read as `issueSnapshot`, projected onto the
+        // body alone for the dependency-graph cycle pass (#421).
+        return await runGh([
+          "api",
+          `repos/${repo}/issues/${issue}`,
+          "--jq",
+          ".body // \"\"",
+        ]);
+      } catch {
+        return undefined;
+      }
+    },
+
     async prState(url: string): Promise<PrState | undefined> {
       // No `--repo`: the full URL names the repository, and the daemon runs
       // from its own state directory rather than a checkout — so the REST path
@@ -1925,6 +1952,25 @@ export function makeTracker(
       }
     },
 
+    async prBody(url: string): Promise<string | undefined> {
+      // Same guarded REST read as `issueBody`, projected onto the PR: the
+      // settlement audit's claimed-proof check is advisory, so an unreadable
+      // body costs one unaudited flag family and never a run's state.
+      if (!PR_URL.test(url)) return undefined;
+      const parts = prUrlParts(url);
+      if (parts === undefined) return undefined;
+      try {
+        return await runGh([
+          "api",
+          `repos/${parts.owner}/${parts.repo}/pulls/${parts.number}`,
+          "--jq",
+          ".body // \"\"",
+        ]);
+      } catch {
+        return undefined;
+      }
+    },
+
     async prDiff(url: string): Promise<PrDiff | undefined> {
       if (!PR_URL.test(url)) return undefined;
       try {

package/src/types.ts

@@ -95,7 +95,8 @@ export interface RepoTarget {
   /**
    * Absolute path of the **conductor-owned, index-only clone** of this repo
    * whose code-graph index workers query. Optional: absent means this repo has
-   * no graph, and the worker brief says nothing about one.
+   * no graph, and the worker brief says so explicitly rather than staying
+   * silent — a worker that knows there is no graph stops looking for one.
    *
    * Two things it deliberately is not, and both were paid for:
    *
@@ -609,6 +610,54 @@ export const REVIEW_REVISION_OUTCOMES = ["revised", "pending", "failed", "skippe
 
 export type ReviewRevisionOutcome = (typeof REVIEW_REVISION_OUTCOMES)[number];
 
+/**
+ * How strictly this project's green PRs are reviewed before they merge
+ * (#678). One of three typed levels; each level's bar is documented once in
+ * {@link REVIEW_STRICTNESS_CHOICES} (setup.ts), which is the same single text
+ * the rendered orchestrator brief carries, so the level a config declares and
+ * the threshold a session actually enforces cannot disagree.
+ *
+ * `low` blocks only correctness, security, data-loss or explicit
+ * acceptance-criteria failures. `medium` (the recommended default for a new
+ * project) adds material maintainability or reliability defects likely to
+ * become incidents within six months. `high` adds concrete quality defects —
+ * never subjective style churn or unbounded refactoring.
+ */
+export const REVIEW_STRICTNESS = ["low", "medium", "high"] as const;
+
+export type ReviewStrictness = (typeof REVIEW_STRICTNESS)[number];
+
+/** The recommended strictness for a project that has never answered. */
+export const DEFAULT_REVIEW_STRICTNESS: ReviewStrictness = "medium";
+
+/** The small validated range a project's own review-round ceiling may sit in. */
+export const REVIEW_MAX_ROUNDS_MIN = 1;
+export const REVIEW_MAX_ROUNDS_MAX = 6;
+
+/** The typed default ceiling: three corrected heads per PR lifecycle — enough
+ *  for real correction cycles, and a hard stop against endless polishing. */
+export const DEFAULT_REVIEW_MAX_ROUNDS = 3;
+
+/**
+ * One project's review policy (#678): the strictness its orchestrator applies
+ * when deciding whether a green PR is returned to its worker, and the hard
+ * ceiling on how many such rounds one PR lifecycle may consume. The ceiling is
+ * enforced by the dispatch side, never left to the session's reading of the
+ * brief: at the ceiling `conductor_pr_review` refuses, the orchestrator leaves
+ * the PR open, records the unresolved findings and escalates once.
+ */
+export interface ReviewPolicy {
+  strictness: ReviewStrictness;
+  maxRounds: number;
+}
+
+/** The documented migration default: what a config written before the key
+ *  existed loads as, deterministically, until the operator answers setup. */
+export const DEFAULT_REVIEW_POLICY: ReviewPolicy = {
+  strictness: DEFAULT_REVIEW_STRICTNESS,
+  maxRounds: DEFAULT_REVIEW_MAX_ROUNDS,
+};
+
 /**
  * One durable review-revision request (#677): the orchestrator returned a
  * green, run-owned pull request to its worker with blocking findings, and
@@ -716,8 +765,11 @@ export interface ProjectConfig {
    *  orchestrator-tick.ts. */
   groomBelow?: number;
   /** Labels the dispatcher writes back so the tracker alone shows live state
-   *  to a human who never opens the daemon's logs. */
-  stateLabels: { inProgress: string; blocked: string; failed: string };
+   *  to a human who never opens the daemon's logs. `backlog` is the
+   *  operator's own park gesture (#507) — not dispatcher-written, but read by
+   *  eligibility so a parked issue can never be claimed while its queue label
+   *  is still physically present. */
+  stateLabels: { inProgress: string; blocked: string; failed: string; backlog: string };
   /** Maps a `${labelPrefix}${name}` label on an issue to the checkout it
    *  belongs in, so routing is declared by humans, not guessed. */
   routing: { labelPrefix: string; repos: Record<string, RepoTarget> };
@@ -811,6 +863,16 @@ export interface ProjectConfig {
    * reaching for `.merge` on a project some test hand-built.
    */
   policy?: ProjectPolicy;
+  /**
+   * How green PRs are reviewed and returned (#678): the strictness level and
+   * the hard ceiling on review rounds per PR lifecycle. Optional only for
+   * configs written before the key existed — the loader always materialises a
+   * complete value, so read it through `resolveReview` rather than reaching
+   * for `.review` on a project some test hand-built. A config that never
+   * answered migrates to {@link DEFAULT_REVIEW_POLICY} deterministically, and
+   * the schema's bounds agree with the runtime ones.
+   */
+  review?: ReviewPolicy;
   /**
    * Exact operator-authored exceptions for recovery PRs that no run recorded.
    * Optional and hand-edited: setup preserves entries but never invents them.
@@ -963,6 +1025,12 @@ export const SETTLEMENT_FLAG_KINDS = [
   "assertions-removed",
   /** A named timeout in a test file went up. */
   "test-timeout-raised",
+  /** A command the PR body claims as proof, with no matching command in the
+   *  run's transcript — the claim has no attempt behind it at all. */
+  "claimed-proof-missing",
+  /** A claimed proof command was attempted, but the shared-host guard refused
+   *  it — the honest blocked shape, told apart from a claim with no attempt. */
+  "claimed-proof-blocked",
   /** A terminal run recovered an OPEN PR by exact issue, repo and branch identity. */
   "pr-adopted",
   /** A workflow on the merge commit's base branch failed after settlement. */
@@ -1063,6 +1131,14 @@ export interface Tracker {
    * read exists to prevent (#517).
    */
   listComments(issue: number): Promise<IssueComment[]>;
+  /**
+   * One issue's body, or undefined when the tracker could not produce it.
+   * The promotion echo (#724) renders the parsed file lane exactly where the
+   * author asserts the claim; the queue label is being added to an issue the
+   * `listReady` filter would have excluded by definition, so the verb needs
+   * this read rather than a list the issue is not on.
+   */
+  getIssue(issue: number): Promise<ReadyIssue | undefined>;
   addLabel(issue: number, label: string): Promise<void>;
   removeLabel(issue: number, label: string): Promise<void>;
   comment(issue: number, body: string): Promise<void>;
@@ -1109,6 +1185,12 @@ export interface Tracker {
    * when either fact cannot be read safely.
    */
   issueSnapshot(issue: number): Promise<IssueSnapshot | undefined>;
+  /**
+   * An issue's raw body, or undefined when it cannot be read. Used only by the
+   * dependency-graph cycle pass (#421) to follow a reachable prerequisite's
+   * own `Depends-on:` declarations; never a "no body" claim.
+   */
+  issueBody(issue: number): Promise<string | undefined>;
   /**
    * The state of one specific pull request, or undefined when this adapter
    * could not tell — a network failure, a deleted PR, a URL it cannot parse.
@@ -1175,6 +1257,13 @@ export interface Tracker {
    * better answer on a later tick.
    */
   prDiff(url: string): Promise<PrDiff | undefined>;
+  /**
+   * The pull request's body, or undefined when this adapter could not produce
+   * one — the same advisory contract as {@link Tracker.prDiff}. Its only
+   * consumer is the settlement audit's claimed-proof check (#582): a claim
+   * extracted from a body this port could not read is no claim at all.
+   */
+  prBody(url: string): Promise<string | undefined>;
   /**
    * Every check on a PR with the state the tracker reports for it (#132).
    *
@@ -1397,6 +1486,12 @@ export interface RunRecord {
   autoCompactionCount?: number;
   /** omp session transcript, so a human can read what the worker actually did. */
   sessionFile?: string;
+  /** The run id of the orphan-clean attempt whose session this row resumes
+   *  (#536, #567). Set only when the dispatch-time resume verdict fired;
+   *  absent means a fresh dispatch, never "resumed from unknown". Readable
+   *  without opening the transcript, so "how often did resume fire and did it
+   *  save turns" is a query, not a file walk. */
+  resumedFromRunId?: string;
   prUrl?: string;
   /** Pull request head the worker observed after its deterministic CI watcher exited. */
   headSha?: string;
@@ -1427,6 +1522,14 @@ export interface RunRecord {
   /** When an operator accepted the loss or recovered the tree by hand
    *  (`unblock --force`). Clears the hold without erasing what happened. */
   salvageAckAt?: number;
+  /** Why the retained tree is under quarantine (#737): the cleanup pass could
+   *  not make its object store sound (`repairAlternates`), so fetching into it
+   *  was refused and the tree's commits cannot be verified against any remote.
+   *  Present means the tree is quarantined right now; the pass clears it the
+   *  moment it reaps the tree or re-verifies the store on a later pass.
+   *  Absent means never quarantined, or no longer — never "quarantine not
+   *  checked", because every retained-tree pass checks. */
+  quarantineDetail?: string;
   startedAt: number;
   endedAt?: number;
   /** Last failure text, surfaced verbatim in escalations. */
@@ -1479,6 +1582,10 @@ export type AdmissionHoldReason =
   | "issue-closed"
   | "issue-state-lookup-error"
   | "issue-dequeued"
+  /** An operator-parked issue: the park label beat the queue label at claim
+   *  time (#734). Unlike `issue-dequeued` it is an operator gesture, not a
+   *  queue edit — the queue label may still be physically present. */
+  | "issue-parked"
   | "parent-lookup-error"
   | "sibling-active"
   | "repo-active"
@@ -1489,9 +1596,14 @@ export type AdmissionHoldReason =
   | "plan-usage-cap"
   | "shutting-down"
   | "stale-base"
+  /** A ready issue whose lifecycle state label is residual: its newest run is
+   *  terminal (or absent), so nobody owns it — Duty 1 reconciliation work, not
+   *  occupied capacity (#611). */
+  | "stale-lifecycle"
   | "critical-base-verify-error"
   | "file-lane"
   | "depends-on"
+  | "dependency-cycle"
   | "unroutable:no-repo-label"
   | "unroutable:multiple-repo-labels"
   | "unroutable:unknown-repo";
@@ -1962,6 +2074,11 @@ export interface Store {
    *  can name every WIP tip a re-claim would build on and every tree that is
    *  still the only copy. */
   salvagedRuns(project: string): RunRecord[];
+  /** Newest attempt per issue whose retained tree is under quarantine: the
+   *  object store could not be made sound, so the tree's commits cannot be
+   *  verified against any remote and the daemon refused to fetch into it
+   *  (#737). Newest-attempt-only for the same reason the board is. */
+  quarantinedRuns(project: string): RunRecord[];
   /** Total run segments, used only for the monotonically increasing run number. */
   attemptsFor(project: string, issue: number): number;
   /** Terminal implementation failures that consume `maxAttemptsPerIssue`. */
@@ -2559,6 +2676,13 @@ export const VERB_REFUSALS = [
    * running on it, or the run settled otherwise. The detail names the state.
    */
   "review-in-flight",
+  /**
+   * The PR has already been through the configured review-round ceiling
+   * (#678): the policy's hard bound against endless polishing. Refused rather
+   * than recorded — the orchestrator leaves the PR open, records the
+   * unresolved findings and escalates once instead of spending a worker round.
+   */
+  "review-round-ceiling",
   /**
    * The routed repository's base branch is frozen because a watched merge (or
    * live base observation) turned it red — a base-red-freeze. Further merges to

package/src/verbs/server.ts

@@ -41,12 +41,14 @@
 import { randomUUID } from "node:crypto";
 import { createServer, type Server, type Socket } from "node:net";
 
-import { resolvePolicy, resolveReleaseGrants } from "../config.ts";
+import { resolvePolicy, resolveReleaseGrants, resolveReview } from "../config.ts";
+import { effectiveLane, laneEcho } from "../admission.ts";
 import { chainEntriesFromDiff, chainViolations } from "../chain-check.ts";
 import { repoSlugFor, type readBaseChain as readBaseChainType } from "../gitops.ts";
 import { releaseRefusal } from "../release-policy.ts";
 import { LIVE_STATES } from "../store.ts";
 import type {
+  IssueComment,
   OpenCloser,
   PrState,
   PrVerification,
@@ -1104,7 +1106,43 @@ async function labelVerb(
     const why = err instanceof Error ? err.message : String(err);
     return refuse("action-failed", `refused: the tracker rejected the label change:\n${why}`, ref.issue);
   }
-  return allow(`${action === "add" ? "added" : "removed"} ${label} on #${ref.issue}.`, undefined, ref.issue);
+
+  const outcome = `${action === "add" ? "added" : "removed"} ${label} on #${ref.issue}.`;
+  // Adding the queue label is the promotion: the author is asserting the file
+  // lane right now, so the verb echoes the one admission will enforce — the
+  // parsed file list, or the explicit fail-open note (#724). Best-effort: an
+  // unreadable issue or thread must never block the promotion itself (the
+  // label is the point), so a failed read falls back to the plain message.
+  let echo: string | undefined;
+  if (action === "add" && label === project.queueLabel) {
+    echo = await laneEchoForIssue(deps, ref.issue);
+  }
+  return allow(
+    echo === undefined ? outcome : `${outcome} File lane: ${echo}.`,
+    undefined,
+    ref.issue,
+  );
+}
+
+/**
+ * The effective file lane admission will enforce for one issue, as the
+ * one-line echo (#724): the body plus the whole comment thread, the same
+ * inputs `effectiveLane` reads at admission. `undefined` when either read
+ * fails or the tracker cannot produce the issue — the promotion is never
+ * blocked by its own feedback.
+ */
+async function laneEchoForIssue(deps: VerbDeps, issue: number): Promise<string | undefined> {
+  let body: string;
+  let comments: IssueComment[];
+  try {
+    const row = await deps.tracker.getIssue(issue);
+    if (row === undefined) return undefined;
+    body = row.body;
+    comments = await deps.tracker.listComments(issue);
+  } catch {
+    return undefined;
+  }
+  return laneEcho(effectiveLane(body, comments));
 }
 
 async function releaseVerb(
@@ -1678,6 +1716,24 @@ async function prReviewVerb(
     );
   }
 
+  // The hard bound (#678): the round ceiling is the dispatcher's, not the
+  // orchestrator's to re-read from prose. A PR may be returned at most
+  // `maxRounds` times per lifecycle; at the ceiling this refuses, and the
+  // refusal states the two non-actions that replace a further round — leave
+  // the PR open, record the unresolved findings and escalate once. The same
+  // count `latestReviewRound` drives the renderer's `review-revision N`, so
+  // the bound and the visible round can never disagree.
+  const review = resolveReview(project);
+  if (deps.store.latestReviewRound(project.name, target.id) >= review.maxRounds) {
+    return refuse(
+      "review-round-ceiling",
+      `refused: ${prUrl} has already been through ${review.maxRounds} review round(s) ` +
+        `(project "${project.name}" is ${review.strictness} strictness, ceiling ${review.maxRounds}). ` +
+        "Leave the PR open, record the unresolved findings, and escalate once — a further revision round is not available.",
+      issue,
+    );
+  }
+
   // Durable, and refused atomically against a concurrent duplicate: the row is
   // persisted before any wake, and a second request for the same run bumps
   // into the pending row rather than racing it.