omp-conductor 0.17.1 → 0.18.0

package/src/daemon.ts

@@ -12,22 +12,27 @@ import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync
 import { dirname, join, relative } from "node:path";
 import {
   configPath,
+  dbBackupDirFor,
   findProject,
   loadConfig,
   resolveCaps,
   resolveReleaseGrants,
+  resolveReview,
   stateDir,
 } from "./config.ts";
 import { availabilityState, type AvailabilityState } from "./availability.ts";
 import {
-  UNREADABLE_TREE_FLAG,
-  analyseSettlement,
-  deriveChangedLine,
   formatSettlementFlags,
   settlementFlagSummary,
   withDerivedChangedLine,
 } from "./diff-flags.ts";
-import { digestScheduleState, type DigestScheduleState } from "./digest-schedule.ts";
+import {
+  dbSnapshotDue,
+  dbSnapshotMarkerKey,
+  digestScheduleState,
+  localDayKey,
+  type DigestScheduleState,
+} from "./digest-schedule.ts";
 import { createEscalator, escalationIssueRef } from "./escalate.ts";
 import { pendingCodeGraph, probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
 import { graphHint } from "./graph.ts";
@@ -56,29 +61,52 @@ import {
   type GateShape,
   type ReleaseBlockContext,
 } from "./release-policy.ts";
-import { branchName, effectiveLabels, route } from "./routing.ts";
+import { branchName, effectiveLabels, isEligible, route } from "./routing.ts";
 import type { Routed, UnroutableReason } from "./routing.ts";
 import {
   admitCandidates,
   effectiveLane,
   hasContinuationBudget,
   hasFailedAttemptBudget,
+  laneEcho,
 } from "./admission.ts";
 import type { Admission, AdmissionHold, FileLane } from "./admission.ts";
 import { log, errText, safeEscalate } from "./log.ts";
+import {
+  adoptSalvagedPrs,
+  classifyAndRecover,
+  collectSettlementFlags,
+  formatQuarantinedRuns,
+  formatSalvagedRuns,
+  reactToProviderCredit,
+  readSessionError,
+  reconcileOrphanedRuns,
+  reconcileStaleLabels,
+  recordOperatorStop,
+  settlePushedGreen,
+  settleWorktree,
+  swapToQueue,
+} from "./settlement.ts";
 import { materializeOmpSettings } from "./omp-settings.ts";
 import { evaluateDecisionConditions, probeNpmVersion, probeRateLimitReset } from "./decisions.ts";
-import { classifyRun, infraLogSignature, infraSignatureVersion, normalise, providerCreditRefusal, providerTransientFault, type ClassifyFacts } from "./failure-class.ts";
+import { infraLogSignature, infraSignatureVersion, providerCreditRefusal, providerTransientFault } from "./failure-class.ts";
 import {
   DEFAULT_MODEL_FALLBACK_THRESHOLD,
   fallbackClause,
-  formatModelsTried,
-  modelsTried,
   providerFailureFacts,
   resolveDispatchModel,
 } from "./model-fallback.ts";
 import { projectLabels } from "./label-projection.ts";
-import { dbPath, LIVE_STATES, openStore, utcDay } from "./store.ts";
+import {
+  DB_SNAPSHOT_RETENTION,
+  ACTIVE_STATES,
+  dbPath,
+  LIVE_STATES,
+  openStore,
+  pruneDbSnapshots,
+  snapshotDb,
+  utcDay,
+} from "./store.ts";
 import { GraphqlBreaker, makeTracker, type RateLimitStatus } from "./tracker/github.ts";
 import { DEFAULT_REPORT_POLICY, RELEASE_SHAPES } from "./types.ts";
 import type {
@@ -86,6 +114,7 @@ import type {
   BaseHealth,
   AdmissionHoldReason,
   Caps,
+  ConductorConfig,
   DispatchSummary,
   DigestBacklog,
   Escalation,
@@ -98,11 +127,13 @@ import type {
   PrState,
   ProjectConfig,
   ReadyIssue,
+  ReportingPolicy,
   RepoTarget,
   ReportRecord,
   ResolvedGrants,
   FailureClass,
   RecoveryAction,
+  ReviewPolicy,
   ReviewRevisionOutcome,
   ReviewRevisionRecord,
   RunRecord,
@@ -140,7 +171,6 @@ import { githubVerbActions } from "./verbs/actions.ts";
 import { formatVerbLedger, STATUS_LEDGER_SCAN } from "./verbs/ledger.ts";
 import {
   listenVerbChannel,
-  PR_LOOKUP_WINDOW_MS,
   type VerbActions,
   type VerbDeps,
   type VerbListener,
@@ -180,26 +210,7 @@ const GRAPH_HEALTH_INTERVAL_MS = 60_000;
  *  report an operator is waiting on must not sit in the outbox for the length of
  *  a poll interval, and delivery is owed even while claiming is paused (#123). */
 const REPORT_DELIVERY_INTERVAL_MS = 30_000;
-/** A dispatch-infra run (turn-0 git failure) is requeued so the next tick
- *  retries — but only a bounded number of times. Three strikes for one issue
- *  means the mirror itself is broken, not unlucky, and the sweep escalates
- *  instead of burning a turn-0 run per tick forever (#168, #177). */
-const DISPATCH_INFRA_MAX_STRIKES = 3;
-/** A provider-transient requeue (stream stalled mid-run) is retried, but only a
- *  bounded number of times: three aborted streams for one issue means the
- *  provider itself is degraded, not unlucky, and the sweep escalates to a
- *  human instead of requeueing into a down provider forever (#220). */
-const PROVIDER_TRANSIENT_MAX_STRIKES = 3;
-/** A provider-capacity requeue (sustained in-session rate limiting) is retried,
- *  but only a bounded number of times: three throttled runs for one issue mean
- *  the provider is at capacity, not unlucky, and the sweep escalates to a human
- *  instead of requeueing into a throttled provider forever (#573). The issue's
- *  own chain moves onto its next model per strike (via {@link FAILOVER_CLASSES}),
- *  so a bounded chain is exhaustible; this caps the unbounded no-chain case. */
-const PROVIDER_CAPACITY_MAX_STRIKES = 3;
-/** Terminal rows inspected for a salvaged PR per tick. GitHub provenance reads
- *  are maintenance, but a backlog must not turn one tick into an API burst. */
-const SALVAGED_PR_ADOPTION_BATCH = 10;
+
 const DEFAULT_PORT = 8787;
 const BRIEF_TEMPLATE_PATH = join(import.meta.dir, "briefs", "worker.md");
 
@@ -315,6 +326,13 @@ interface Deps {
    * admission fails a routed cross-repo prerequisite closed.
    */
   probeIssueIn?: (repo: string, issue: number) => Promise<IssueSnapshot | undefined>;
+  /**
+   * Reads one issue's BODY in a repository the admission tracker is not bound
+   * to — the dependency-graph cycle pass (#421). Wired by `runDaemon` to a
+   * repo-scoped tracker; a test injects a fake. Absent, a routed reachable
+   * body fails that branch closed rather than synthesising a cycle.
+   */
+  probeBodyIn?: (repo: string, issue: number) => Promise<string | undefined>;
 }
 
 /**
@@ -991,6 +1009,20 @@ function renderDiscussion(comments: IssueComment[] | "unread", lane?: FileLane):
   return lines.join("\n");
 }
 
+/**
+ * The parsed file lane as a brief section (#724): the file list the gate will
+ * enforce, or the explicit fail-open note — the same `laneEcho` the promotion
+ * verb prints, so the author and the worker read one parse. Deliberately only
+ * the parse, never the source line: the prose already renders in the body or
+ * the discussion, and in #720's case the prose is exactly what looked
+ * reasonable to a human while parsed greedily.
+ */
+function laneBlock(lane: FileLane | undefined): string {
+  const echo = laneEcho(lane);
+  const body = lane === undefined ? `_${echo}_` : `\`${echo}\``;
+  return ["## File lane (as parsed)", "", body, "", ""].join("\n");
+}
+
 /**
  * What an orphan-resumed worker is told about the file lane on top of the
  * continuation notice (#608). The original brief already in the transcript
@@ -1008,6 +1040,8 @@ function resumeLaneBlock(lane: FileLane): string {
     "",
     lane.source,
     "",
+    `Parsed files: ${laneEcho(lane)}.`,
+    "",
   ].join("\n");
 }
 
@@ -1024,211 +1058,6 @@ function swapLabel(store: Store, projectName: string, issue: number, from: strin
     { issue, op: "remove", label: from },
   ]);
 }
-/**
- * Persist the operator-stop transition before releasing its live controller.
- * The row is terminal first, then its in-progress label is removed through the
- * same durable projection outbox as every other lifecycle transition.
- */
-export function recordOperatorStop(
-  store: Pick<Store, "updateRun" | "enqueueLabelOps">,
-  args: {
-    project: string;
-    issue: number;
-    runId: string;
-    inProgress: string;
-    reason: string;
-    patch: Partial<RunRecord>;
-  },
-): void {
-  store.updateRun(args.runId, {
-    ...args.patch,
-    state: "stopped",
-    lastError: `operator stopped: ${args.reason}`,
-  });
-  store.enqueueLabelOps(args.project, [
-    { issue: args.issue, op: "remove", label: args.inProgress },
-  ]);
-}
-
-
-/**
- * The escalator throws when no transport is configured or Telegram rejects, and
- * only records the dedup marker on success. A page that cannot be delivered
- * must not take the tick down with it — log it and let the next tick retry.
- *
- * Returns whether it actually went out, because "page once" and "page once
- * *successfully*" are different promises: a caller that latches a once-only
- * gate on the attempt turns one failed delivery into permanent silence about a
- * condition that is still true.
- */
-
-async function reactToProviderCredit(
-  d: Deps,
-  issue: number,
-  message: string,
-  sessionFile: string | undefined,
-): Promise<void> {
-  const { project } = d;
-  const alreadyPaused = isPaused(project.name);
-  if (!alreadyPaused) setPaused(true, { source: "provider-credit", reason: message }, project.name);
-  log(
-    `#${issue} provider refused for credit — dispatch ${alreadyPaused ? "remains paused" : "paused"}: ${message}`,
-  );
-  // Fleet-scoped and run-independent on purpose. The notification ledger
-  // dedupes on `project:issue:tier:summary`, so `NO_ISSUE` plus a summary
-  // carrying no run or attempt pages once for the fleet, not once per run.
-  await safeEscalate(d, {
-    tier: 2,
-    category: "fleet-stopped",
-    project: project.name,
-    issue: NO_ISSUE,
-    summary: `Model provider refused for credit — ${project.name} is paused`,
-    detail: [
-      message,
-      "",
-      "No implementation attempt was charged: this is a billing state, not a",
-      "failed implementation. Each affected issue keeps its queue label and",
-      "re-dispatches on `omp-conductor resume` once the provider has credit.",
-      `Session: ${sessionFile ?? "(no transcript)"}`,
-    ].join("\n"),
-  });
-}
-
-/**
- * What a salvage attempt contributes to the escalation: where the work went, or
- * that it went nowhere. Split from the effects below for the same reason
- * `checkIntegrity` is — this wording is the whole thing a human acts on, so it
- * is worth a test holding it, and the sha in it is the only pointer to work
- * that no longer has any other copy.
- *
- * `retained` is not cosmetic. These lines used to promise a tree "kept for
- * inspection" unconditionally, which was true only because salvage ran only on
- * the paths that keep one. A blocked run's tree is removed the moment its work
- * is safely on the branch, and sending an operator to a path this process just
- * deleted is the same class of mistake as #118 itself.
- */
-export function salvageLines(
-  outcome: SalvageOutcome,
-  worktree: string,
-  retained: boolean,
-): string[] {
-  const fate = retained
-    ? `Worktree kept for inspection: ${worktree}`
-    : `Worktree removed: ${worktree}`;
-
-  if (outcome.kind === "nothing") return [`${fate} — nothing uncommitted to salvage`];
-
-  if (outcome.kind === "failed") {
-    return [
-      `WIP SALVAGE FAILED: ${outcome.error}`,
-      `Uncommitted work in ${worktree} is the only copy of it, so the tree was kept.`,
-      "This issue is held out of dispatch until the tree is recovered by hand and",
-      "`omp-conductor unblock <n> --force` records that you accepted it.",
-    ];
-  }
-
-  const where =
-    `WIP committed to ${outcome.branch} @ ${outcome.sha}` +
-    (outcome.pushed
-      ? " and pushed — the work outlives this worktree"
-      : ` but NOT pushed (${outcome.pushError ?? "no reason given"}) — it lives only in this host's mirror`);
-  // Manifest belongs in the escalation too: opening the commit is how the
-  // orchestrator talked itself into scrubbing a worker tree (#38).
-  const n = outcome.files.length;
-  const count = `${n} file${n === 1 ? "" : "s"}`;
-  const manifest =
-    outcome.newPaths.length === 0
-      ? `${count} (all modifications to tracked paths)`
-      : `${count}; new: ${outcome.newPaths.slice(0, 12).join(", ")}${
-          outcome.newPaths.length > 12 ? `, … +${outcome.newPaths.length - 12} more` : ""
-        }`;
-  return [where, manifest, fate];
-}
-
-/** Everything a settled run has to record and say about its worktree. */
-export interface WorktreeSettlement {
-  outcome: SalvageOutcome;
-  /** Whether the tree still exists now the run is over. */
-  retained: boolean;
-  /** Escalation lines naming where the work went. */
-  lines: string[];
-  /** Row fields recording the durable ref, or the failure that blocks a re-claim. */
-  patch: Pick<RunRecord, "salvageSha" | "salvageError">;
-}
-
-/**
- * Decides what becomes of a finished run's worktree: save the work, then keep
- * or remove the tree, then say which.
- *
- * One function because the two halves are one decision and splitting them is
- * how #118 happened — the removal at the end of dispatch had no idea whether
- * anything had been saved, and the salvage at the top of the failure branch had
- * no idea the blocked branch fell through to a `--force` removal.
- *
- * A salvage that *fails* retains the tree whatever the caller asked for. There
- * was real work, git refused to commit it, and the tree is now the only copy in
- * existence: deleting it on schedule would be the data loss this whole path
- * exists to prevent. The issue is held out of dispatch until an operator says
- * otherwise, because the next attempt's `worktree remove --force` would finish
- * the job (see `admitCandidates`).
- *
- * Exported so a test can drive the real decision against a real git tree.
- */
-export async function settleWorktree(
-  args: {
-    issue: number;
-    attempt: number;
-    /** Clause for the commit subject: "killed by the turns cap", "blocked …". */
-    ending: string;
-    worktree: string;
-    /** The run's branch, so the pre-removal publish names the right ref. */
-    branch: string;
-    /**
-     * Publishes the run branch on the privileged side. Required rather than
-     * optional: the run's commits live in a repository of its own,
-     * so a removal that did not publish first would delete the only copy —
-     * which is #121's data loss with one extra step. `undefined` is a visible
-     * decision at the call site, never an omission.
-     */
-    publish: RunPublisher | undefined;
-  } & (
-    | /** Terminal-failure and orphan trees are evidence, and are kept even when clean. */
-    { tree: "keep" }
-    | { tree: "remove"; mirrorPath: string }
-  ),
-): Promise<WorktreeSettlement> {
-  const { issue, attempt, ending, worktree, branch, publish } = args;
-  const outcome = await salvageWip(worktree, issue, attempt, ending, publish);
-  const retained = args.tree === "keep" || outcome.kind === "failed";
-  if (!retained && args.tree === "remove") {
-    // Before the removal, always — not only when salvage found something. A run
-    // that *committed* and could not publish has its work in its own repository
-    // and nowhere else, and salvage never sees a committed tree because it is
-    // clean. The mirror fetch inside `publish` is what preserves it; the push
-    // to GitHub can fail (no network, protected ref) and the work still lives.
-    const published = await publish?.(branch);
-    if (published !== undefined && !published.ok) {
-      log(`#${issue} publish before removal failed, work is preserved in the mirror: ${published.stderr}`);
-    }
-    await removeWorktree(args.mirrorPath, worktree);
-  }
-
-  const lines = salvageLines(outcome, worktree, retained);
-  log(`#${issue} salvage: ${lines.join(" ")}`);
-  return {
-    outcome,
-    retained,
-    lines,
-    patch:
-      outcome.kind === "salvaged"
-        ? { salvageSha: outcome.sha }
-        : outcome.kind === "failed"
-          ? { salvageError: outcome.error }
-          : {},
-  };
-}
-
-
 /**
  * How a run's end is named — in the salvage commit, and to whoever reads it.
  * The whole clause, not a bare reason: a graceful block was not killed by
@@ -1315,6 +1144,11 @@ export async function buildBrief(
   // discussion budget, keeping the gate and the worker-visible brief on one
   // lane (#608).
   const comments = opts.comments ?? [];
+  // The effective lane admission resolved (or resolves) for this candidate:
+  // the carried admission snapshot when dispatch has one, else the thread
+  // itself. Both the discussion renderer and the parsed-lane section draw on
+  // the same value, so the brief shows one lane on every surface (#608, #724).
+  const lane = opts.lane ?? (comments === "unread" ? undefined : effectiveLane(r.issue.body, comments));
   return renderBrief(template, {
     ISSUE_NUMBER: String(r.issue.number),
     ISSUE_TITLE: r.issue.title,
@@ -1323,19 +1157,18 @@ export async function buildBrief(
     BRANCH: branch,
     WORKTREE: worktree,
     ACCEPTANCE_CRITERIA: acceptanceCriteria(r.issue),
-    ISSUE_COMMENTS: renderDiscussion(
-      comments,
-      opts.lane ?? (comments === "unread" ? undefined : effectiveLane(r.issue.body, comments)),
-    ),
+    ISSUE_COMMENTS: renderDiscussion(comments, lane),
+    FILE_LANE: laneBlock(lane),
     GATES: gatesBlock(r.repo),
     // The guarded shell suites and their sanctioned parse-only check, derived
     // from SHARED_HOST_SCRIPTS so the brief and the refusal share one list
     // (#687). Non-empty whenever the guard has paths, so the placeholder line
     // always renders to a line.
     SHARED_HOST_NOTICE: sharedHostBriefNotice(),
-    // Empty for a repo with no `graphProject`, and empty means *nothing*: the
-    // placeholder sits flush against the next list item in the template, so an
-    // unconfigured render leaves no blank line where a hint would have gone.
+    // The brief's code-graph paragraph: the exact `project` key for a
+    // configured repo, or an explicit "no graph" statement for an
+    // unconfigured one — never silence, because a worker that knows there is
+    // no graph stops looking for it.
     GRAPH_HINT: graphHint(r.repo),
     CONTINUATION: continuation,
   });
@@ -1344,178 +1177,6 @@ export async function buildBrief(
 // ------------------------------------------------------------------- one issue
 
 
-/** The failure classes `countContinuations` deliberately does not charge — the
- *  inverted copy of its exclusions, kept beside the breakdown that consumes it
- *  so the two can only drift together (#439). `orphan-clean` is absent on
- *  purpose: daemon orphans consume the continuation budget, which is exactly
- *  why the requeue side has to respect the ceiling instead of racing it. */
-const NON_CONTINUATION_CLASSES: Partial<Record<FailureClass, true>> = {
-  "admin-kill": true,
-  "settlement-stuck": true,
-  "env-start-failure": true,
-  "dispatch-infra": true,
-  "provider-credit": true,
-  "provider-transient": true,
-  "provider-capacity": true,
-};
-
-/** How one issue spent its continuation budget, grouped by failure class —
- *  the exact rows `continuationsFor` charges, so an exhaustion escalation
- *  reports the same budget it says is spent. `unclassified` groups rows that
- *  charged before the class was written (a pre-upgrade NULL). */
-function continuationBreakdown(runs: readonly RunRecord[]): Map<string, number> {
-  const perClass = new Map<string, number>();
-  for (const r of runs) {
-    const chargedAsKilledOrOrphaned =
-      (r.state === "killed" || r.state === "orphaned" || r.state === "blocked") &&
-      (r.failureClass === undefined || NON_CONTINUATION_CLASSES[r.failureClass] === undefined);
-    const chargedAsReturned = r.state === "failed" && r.failureClass === "returned-for-revision";
-    if (!chargedAsKilledOrOrphaned && !chargedAsReturned) continue;
-    const cls = r.failureClass ?? "unclassified";
-    perClass.set(cls, (perClass.get(cls) ?? 0) + 1);
-  }
-  return perClass;
-}
-
-/** The newest attempt's preserved work, if any, so an exhaustion escalation can
- *  say whether continuing is worthwhile: `salvageSha`/`headSha`/`prUrl` are the
- *  three artifacts a run can leave, and all null on a branch nothing reached. */
-function newestContinuableRun(runs: readonly RunRecord[]): RunRecord | undefined {
-  const newestFirst = [...runs].reverse();
-  return newestFirst.find(
-    (r) => r.salvageSha !== undefined || r.headSha !== undefined || r.prUrl !== undefined,
-  );
-}
-
-/** The fenced-block info string that marks an exhaustion postmortem comment, so
- *  a grooming scout re-slicing the issue can find and parse the whole block by
- *  grepping for it. */
-export const POSTMORTEM_MARKER = "conductor-postmortem";
-
-/** How one issue's attempt chain failed, as "3× ci-deterministic, 1× …" — the
- *  digest shape for naming what the exhaustion was. Groups every row by its
- *  failure class, whether or not it charged the continuation budget, because
- *  the postmortem tells the whole story and not just the budget half (#290). */
-export function attemptClassBreakdown(runs: readonly RunRecord[]): string {
-  const perClass = new Map<string, number>();
-  for (const r of runs) {
-    const cls = r.failureClass ?? "unclassified";
-    perClass.set(cls, (perClass.get(cls) ?? 0) + 1);
-  }
-  if (perClass.size === 0) return "unclassified";
-  return Array.from(perClass, ([cls, n]) => `${n}× ${cls}`).join(", ");
-}
-
-/** Wall-clock duration of one run as a compact human string ("45m", "1h30m"). */
-export function humanDuration(ms: number): string {
-  const seconds = Math.max(0, Math.round(ms / 1_000));
-  if (seconds < 60) return `${seconds}s`;
-  const minutes = Math.round(seconds / 60);
-  if (minutes < 60) return `${minutes}m`;
-  const hours = Math.floor(minutes / 60);
-  const rest = minutes % 60;
-  return rest === 0 ? `${hours}h` : `${hours}h${rest}m`;
-}
-
-/** Flatten and bound a run's last error to one greppable table line. */
-export function oneLineBrief(text: string | undefined): string | undefined {
-  if (text === undefined || text.trim() === "") return undefined;
-  const flat = text.replace(/\s+/g, " ").trim();
-  return flat.length > 90 ? `${flat.slice(0, 89)}…` : flat;
-}
-
-/**
- * The exhaustion postmortem block: one greppable fenced block covering every
- * attempt in the chain — continuation rows included — with per-attempt turns,
- * wall clock, failure class and a one-line last error, the explicit salvage
- * state, the spend total and the transcript paths for local inspection.
- *
- * Pure so the tests hold the shape, not the transport: the writer below owns
- * the once-only guarantee, this owns what "once" looks like.
- */
-export function formatExhaustionPostmortem(args: {
-  issue: number;
-  runs: readonly RunRecord[];
-  reason: string;
-}): string {
-  const { issue, runs, reason } = args;
-  const artifact = newestContinuableRun(runs);
-  const totalSpend = runs.reduce((sum, r) => sum + r.spendUsd, 0);
-  const spend = `$${totalSpend.toFixed(2)}`;
-  const attemptLines = runs.map((r) => {
-    const wall = r.endedAt === undefined ? "—" : humanDuration(r.endedAt - r.startedAt);
-    const cls = r.failureClass ?? "unclassified";
-    const error = oneLineBrief(r.lastError) ?? "—";
-    return (
-      `  attempt ${r.attempt}  ${r.state.padEnd(12)}  turns ${r.turns}/${r.maxTurns}  ` +
-      `${cls.padEnd(24)}  ${wall.padStart(4)}  last error: ${error}`
-    );
-  });
-  const salvage =
-    artifact === undefined
-      ? "Salvaged WIP: absent — no attempt preserved a branch, head SHA or pull request."
-      : `Salvaged WIP: present — branch ${artifact.branch} at ${artifact.headSha ?? artifact.salvageSha}` +
-        `${artifact.prUrl === undefined ? "" : ` (PR ${artifact.prUrl})`}.`;
-  return [
-    `\`\`\`${POSTMORTEM_MARKER}`,
-    `#${issue} exhausted: ${attemptClassBreakdown(runs)}`,
-    reason,
-    "",
-    `Attempts (${runs.length} total, ${spend} spend):`,
-    ...attemptLines,
-    salvage,
-    `Spend total: ${spend} across ${runs.length} attempts.`,
-    "Transcripts:",
-    ...runs.map((r) => (r.sessionFile === undefined ? "  (none)" : `  ${r.sessionFile}`)),
-    "```",
-  ].join("\n");
-}
-
-/** Dedupe key prefix for the exhaustion postmortem comment, per issue. */
-function postmortemDedupeKey(project: string, issue: number): string {
-  return `${project}:postmortem:${issue}`;
-}
-
-/**
- * The exhaustion postmortem: written exactly once per issue, at the point the
- * continuation budget is spent and the issue is settled toward a human.
- *
- * The comment and the material event are both gated by the store's notification
- * ledger — the same idempotence guard the escalator uses — so re-settling an
- * already-postmortemed issue posts nothing and records nothing. A body-string
- * match on the issue would be the wrong guard: an issue re-scoped and re-run
- * would still carry the old block, and the guarantee asked of this is "decided
- * once", not "deduped against what is already written".
- *
- * The digest must name the exhaustion even if the comment write fails, so the
- * material event is recorded before the write and unconditionally (the ledger
- * is append-only, and the gate above already ran once). The comment failure is
- * logged rather than taking the sweep down with it.
- */
-async function postExhaustionPostmortem(d: Deps, run: RunRecord, reason: string): Promise<void> {
-  const { project, tracker, store } = d;
-  const key = postmortemDedupeKey(project.name, run.issue);
-  if (store.wasNotified(key)) return;
-  const runs = store.runsForIssue(project.name, run.issue);
-  const body = formatExhaustionPostmortem({ issue: run.issue, runs, reason });
-  const occurredAt = Date.now();
-  store.recordMaterialEvent({
-    project: project.name,
-    category: "exhaustion",
-    summary: `#${run.issue} exhausted: ${attemptClassBreakdown(runs)}`,
-    evidence: body,
-    occurredAt,
-    recordedAt: occurredAt,
-  });
-  try {
-    await tracker.comment(run.issue, body);
-    store.markNotified(key);
-    log(`#${run.issue} posted exhaustion postmortem (${runs.length} attempts)`);
-  } catch (err) {
-    log(`#${run.issue} postmortem comment could not be posted (${errText(err)})`);
-  }
-}
-
 export type ExtendTurnLimitResult =
   | { kind: "extended"; runId: string; maxTurns: number }
   | { kind: "not-increase"; runId: string; maxTurns: number }
@@ -1719,45 +1380,6 @@ export async function verifyPushedGreenClaim(
   };
 }
 
-/** What the settlement audit of one green run produced: the advisory flags
- *  (test weakening only — the file-list disclosure is derived, not flagged),
- *  whether the diff was cut short, and the `changed:` line composed from the
- *  PR's own diff. */
-export interface SettlementAuditResult {
-  flags: SettlementFlag[];
-  truncated: boolean;
-  /** The `changed:` file list derived from the PR's diff, present whenever the
-   *  diff could be read. Absent means the tree could not be read, and `flags`
-   *  then carries exactly {@link UNREADABLE_TREE_FLAG}. */
-  changedLine?: string;
-}
-
-/**
- * Audit a worker's own account of its work against the pull request it pushed.
- *
- * The thin half of the split #85 established: this fetches, {@link
- * analyseSettlement} decides. It runs beside {@link verifyPushedGreenClaim} and
- * shares none of its authority — that function decides a run's state, this one
- * cannot, by construction. It returns evidence and the caller appends it.
- *
- * A diff that cannot be read is a finding (`changed-line-missing`), never an
- * empty flag list: nothing was derived and nothing was checked, and that must
- * not read as a clean bill.
- */
-export async function collectSettlementFlags(
-  tracker: Pick<Tracker, "prDiff">,
-  claim: { prUrl?: string; issueText: string },
-): Promise<SettlementAuditResult> {
-  if (claim.prUrl === undefined) return { flags: [UNREADABLE_TREE_FLAG], truncated: false };
-  const diff = await tracker.prDiff(claim.prUrl);
-  if (diff === undefined) return { flags: [UNREADABLE_TREE_FLAG], truncated: false };
-  return {
-    flags: analyseSettlement({ issueText: claim.issueText, diff }),
-    truncated: diff.truncated,
-    changedLine: deriveChangedLine(diff),
-  };
-}
-
 /**
  * One attempt at one issue, from claim to terminal state. Everything is inside
  * a single try/catch so that a bad issue costs its own run and nothing else.
@@ -2142,6 +1764,10 @@ export async function handleIssue(
       spendUsd: 0,
       maxTurns: caps.workerMaxTurns,
       startedAt: Date.now(),
+      // #567: the orphan-clean attempt this claim continues, when the verdict
+      // above fired. `undefined` for a fresh dispatch — the store maps that to
+      // NULL, so a fresh row simply never carries the field.
+      resumedFromRunId: resuming?.id,
     });
     // #434: carry a terminal predecessor's open PR onto the continuation row.
     // The claim itself stays synchronous — `handleIssue` claims at the top of
@@ -2432,6 +2058,9 @@ export async function handleIssue(
         ? await collectSettlementFlags(tracker, {
             prUrl: result.prUrl,
             issueText: `${r.issue.title}\n${r.issue.body}`,
+            // The claimed-proof check compares the PR's Verified commands
+            // against what this run's session actually recorded.
+            sessionFile: result.sessionFile,
           })
         : undefined;
     if (result.state === "pushed-green" && audit?.truncated) {
@@ -2618,7 +2247,7 @@ export async function handleIssue(
       });
 
       if (providerCredit !== undefined) {
-        await reactToProviderCredit(d, issue, providerCredit, result.sessionFile);
+        await reactToProviderCredit({ project: d.project, escalate: (e) => d.escalate(e), isPaused, setPaused }, issue, providerCredit, result.sessionFile);
         swapToQueue(d, issue, inProgress);
       } else if (continueTurns) {
         // Requeue as one ordered pair: the in-progress removal before the
@@ -3528,119 +3157,6 @@ export async function reconcileCrashedReviewRevisions(d: Deps): Promise<ReviewRe
 }
 
 // ------------------------------------------------------------------- settlement
-
-/** What a resolved PR turns its `pushed-green` row into. */
-export interface Settlement {
-  state: "merged" | "failed";
-  /** The log line after `#<n> settled: `, and — for a rejection — the row's own
-   *  `lastError`, because a `failed` row whose worker succeeded has to say so. */
-  reason: string;
-}
-
-/**
- * What one `pushed-green` row becomes now its PR has an answer, or undefined to
- * leave the row exactly as it is.
- *
- * A `pushed-green` row is the only one nothing ever revisited: the worker is
- * finished, `reconcileOrphanedRuns` only settles rows that held a process, and
- * `merged` went unwritten from day one. So they accumulated — three of them on
- * the reference fleet on 2026-08-07, every PR merged and every issue closed,
- * with `/healthz` still reporting three active runs and their issues
- * permanently unclaimable, because the busy set *is* the active set (#18).
- *
- * The mapping, and why each answer is the only honest one:
- *
- * - `merged` — the work landed. That is what `merged` was reserved for.
- * - `closed` — a human read the work and said no. Leaving it `pushed-green`
- *   forever is a lie; `failed` records that it did not land and releases the
- *   busy guard, so an issue a human re-queues can be attempted again. A row
- *   that had reached `pushed-green` or `pushed-pending` is classified
- *   `returned-for-revision` at settlement. A review decision asks for another
- *   implementation pass, not a failure, so it consumes the continuation budget
- *   instead of the failed-attempt budget.
- * - `open`, and undefined — nothing changes. Undefined is "could not tell": a
- *   flaky network, a revoked token, a deleted PR. Settling on it would record a
- *   merge that never happened, and the next tick asks again for free. An
- *   ambiguous answer must never settle a row.
- */
-export function settlementFor(pr: PrState | undefined, prUrl: string): Settlement | undefined {
-  if (pr === "merged") return { state: "merged", reason: `${prUrl} merged` };
-  if (pr === "closed") return { state: "failed", reason: `${prUrl} closed without merging` };
-  return undefined;
-}
-
-/**
- * Records the in-progress label's release as a projection op (#201).
- *
- * Settlement used to write only half of what it knew. On 2026-08-09 that cost
- * the reference fleet two issues in one night: veltro#331 settled to `failed`
- * at 23:53Z once the orchestrator closed veltro#332 unmerged, and veltro#344
- * settled to `merged` at 05:54Z once chad#452 squash-merged. Both rows left the
- * active set correctly; an authoritative `gh issue view` on each afterwards
- * still showed `agent:in-progress` — permanently unclaimable with no supported
- * way back (#18).
- *
- * The outbox makes the row transition and the label one fact again: the
- * removal is enqueued in the same breath as the row is terminalised, the
- * projector applies it with unbounded retry, and while it is pending the
- * eligibility overlay treats the label as already gone. A tracker that refuses
- * the write (403, rate limit) can no longer strand the row — that is `#184`
- * and `#198` closed. No `pushed-*` row is ever written terminal with its
- * label release owed but unrecorded, because enqueueing is a local store write
- * that cannot fail on the tracker.
- *
- * Synchronous. The op is durable the moment this returns.
- */
-export function releaseInProgress(
-  d: Pick<Deps, "project" | "store">,
-  issue: number,
-  why: string,
-): void {
-  const label = d.project.stateLabels.inProgress;
-  d.store.enqueueLabelOps(d.project.name, [{ issue, op: "remove", label }]);
-  log(`#${issue} released ${label} (queued): ${why}`);
-}
-
-/**
- * Asks the tracker about every `pushed-green` PR and settles the ones that
- * resolved.
- *
- * Effects at the call site, decision in {@link settlementFor} — the same split
- * as `checkIntegrity`/`watchOrchestrator`. Exported like `admitCandidates`
- * rather than kept private, because half of what has to hold is about the sweep
- * and not the mapping: that a row without a PR costs no API call, and that one
- * unreachable PR does not stop the others from settling.
- *
- * The label is released too, which reverses what this function first promised.
- * It used to leave tracker labels alone exactly as {@link reconcileOrphanedRuns}
- * does, reasoning that a merge closes the issue anyway and that deciding what an
- * issue's labels should say next is the orchestrator's drain duty. There turned
- * out to be no such path: on 2026-08-09 two settled rows left their issues
- * carrying `agent:in-progress` forever, with the brief forbidding the
- * orchestrator from touching it and `unblock` declining to (see
- * {@link releaseInProgress}). The row transition and the label are one fact, and
- * writing half of it is the whole of that bug.
- *
- * Releasing it is safe here specifically because of what these rows are. A
- * `pushed-green` or `pushed-pending` row has no process behind it — its worker
- * exited and its worktree is gone — so a terminal answer about its PR proves no
- * worker owns the issue, and the duplicate-dispatch interlock the label exists
- * for is spent. {@link reconcileOrphanedRuns} still leaves labels alone for the
- * opposite reason: an orphaned `running` row is work nobody has read yet. And
- * the brief's rule stays absolute, because this is a daemon-owned write through
- * the same Tracker port the dispatcher claimed the issue with — orphan detection
- * is only trustworthy while every state label on the tracker came from this
- * package.
- *
- * The two writes are ordered label-then-row, and the order is load-bearing. This
- * sweep is the only thing that revisits a `pushed-*` row, so the terminal state
- * is also the row's exit from it: written first, a tracker that then failed on
- * the label would leave `agent:in-progress` with nothing left to retry it — #18
- * exactly, in the last window able to reach it. Writing the label first makes
- * failure cost a repeated `gh` call on the next tick instead, and the row stays
- * in the busy set throughout, so no second worker can be sent at the issue while
- * it waits.
- */
 const BASE_CHECK_BATCH = 20;
 const BASE_CHECK_WINDOW_MS = 24 * 60 * 60 * 1_000;
 const BASE_STATUS_WINDOW_MS = 7 * 24 * 60 * 60 * 1_000;
@@ -3948,220 +3464,6 @@ export async function watchBaseHealth(
   }
 }
 
-export async function settlePushedGreen(
-  d: Pick<Deps, "project" | "tracker" | "store">,
-): Promise<number> {
-  const { project, tracker, store } = d;
-  // Runs the sweep resolved by terminalising the row. Every terminal write
-  // below increments it; the tick attributes it as `settled` on the pass's
-  // dispatch record, so a held pass is visible as work done, not just as a
-  // clock that moved (#497).
-  let settled = 0;
-  // Filtered from the active set rather than asked for with a new query: active
-  // is live workers plus these, so the list is bounded by the worker cap plus
-  // the number of PRs awaiting a merge — a handful, by construction. A fleet
-  // where that is not a handful has a merge problem, not a dispatch one.
-  const pending = store
-    .activeRuns(project.name)
-    .filter((r) => r.state === "pushed-green" || r.state === "pushed-pending");
-
-  for (const run of pending) {
-    // Nothing to ask about. A pushed result requires a PR, so a malformed row
-    // must not buy a `gh` call every five minutes forever.
-    if (run.prUrl === undefined) continue;
-
-    let pr: PrState | undefined;
-    try {
-      pr = await tracker.prState(run.prUrl);
-    } catch (err) {
-      // Per row, like admission's held candidate. The GitHub adapter already
-      // answers undefined instead of throwing, so this catch is the port's
-      // contract rather than that adapter's behaviour — and a tracker that does
-      // throw must cost its own row, not the whole sweep.
-      log(`#${run.issue} not settled: PR state lookup failed (${errText(err)}) — retrying next tick`);
-      continue;
-    }
-
-    const settlement = settlementFor(pr, run.prUrl);
-    if (settlement !== undefined) {
-      // A mediated merge enters a second, bounded observation phase. Record the
-      // exact merge commit before the row leaves the active set; if GitHub cannot
-      // supply it yet, retry this settlement next tick rather than create a
-      // merged row whose base result can never be attributed.
-      let merged: MergedPrInfo | undefined;
-      if (settlement.state === "merged") {
-        try {
-          merged = await tracker.mergedPrInfo(run.prUrl);
-        } catch (err) {
-          log(`#${run.issue} not settled: merge identity lookup failed (${errText(err)}) — retrying next tick`);
-          continue;
-        }
-        if (merged === undefined) {
-          log(`#${run.issue} not settled: merge identity unavailable — retrying next tick`);
-          continue;
-        }
-      }
-
-      // The label removal and the terminal row are one fact again (#201): the
-      // release is enqueued — a durable local write that cannot fail on the
-      // tracker — in the same breath as the row is terminalised.
-      releaseInProgress(d, run.issue, settlement.reason);
-      const patch: Partial<RunRecord> = {
-        state: settlement.state,
-        endedAt: Date.now(),
-        ...(merged === undefined
-          ? {}
-          : {
-              mergeSha: merged.mergeSha,
-              baseRef: merged.baseRef,
-              baseCheck: "pending",
-            }),
-      };
-      if (settlement.state === "failed") {
-        patch.lastError = settlement.reason;
-        patch.failureClass = "returned-for-revision";
-        patch.recoveryAction = "none";
-      }
-      store.updateRun(run.id, patch);
-      settled += 1;
-      log(`#${run.issue} settled: ${settlement.reason}`);
-      continue;
-    }
-
-    if (run.state !== "pushed-pending" || pr !== "open" || run.headSha === undefined) continue;
-    let verification;
-    try {
-      verification = await tracker.verifyPr(run.prUrl, run.headSha);
-    } catch (err) {
-      log(`#${run.issue} checks not settled (${errText(err)}) — retrying next tick`);
-      continue;
-    }
-    if (verification === undefined) continue;
-    if (verification.status === "green") {
-      store.updateRun(run.id, { state: "pushed-green", lastError: null });
-      log(`#${run.issue} checks settled: ${verification.reason}`);
-    } else if (verification.status === "failed") {
-      // Equally terminal, so the release is enqueued before the row writes,
-      // for the same reason as the settlement branch above (see there). The
-      // green branch releases nothing — that row is still awaiting a merge,
-      // and its live PR is exactly the work the label must keep guarding.
-      releaseInProgress(d, run.issue, verification.reason);
-      store.updateRun(run.id, { state: "failed", lastError: verification.reason });
-      settled += 1;
-      log(`#${run.issue} checks failed: ${verification.reason}`);
-    } else {
-      store.updateRun(run.id, { lastError: verification.reason });
-    }
-  }
-  return settled;
-}
-
-const ADOPTABLE_PR_STATES: Partial<Record<RunState, true>> = {
-  failed: true,
-  killed: true,
-  orphaned: true,
-  blocked: true,
-};
-
-/**
- * Reattaches a recovered PR to the terminal run that owns it (#245).
- *
- * A worker can fail before its completion report records `prUrl`, then have its
- * dirty tree committed and pushed by salvage. If that branch already has a PR,
- * the orchestrator otherwise has no policy-compliant path to inspect or merge
- * it: ownership is store-backed. Adoption is deliberately stricter than
- * admission. The tracker query proves the PR closes this run's issue; exact
- * branch and canonical repository matches prove it is this run's recovered
- * work, not an unrelated closer. Missing identity is refusal, never a guess.
- *
- * The newest run per issue is inspected, at most ten per tick and only inside
- * the same 30-day window as mediated PR verbs. The cursor advances through the
- * full eligible set so persistent non-matches cannot starve older recovered
- * work. Successful adoption is idempotent because the row gains `prUrl`;
- * non-matches are logged once per daemon process.
- */
-const rejectedSalvagedPrRuns = new Set<string>();
-const salvagedPrCursor = new Map<string, string>();
-
-export async function adoptSalvagedPrs(
-  d: Pick<Deps, "project" | "tracker" | "store">,
-  now = Date.now(),
-): Promise<void> {
-  const { project, tracker, store } = d;
-  const eligible = store
-    .recentRuns(project.name, now - PR_LOOKUP_WINDOW_MS)
-    .filter(
-      (run) =>
-        ADOPTABLE_PR_STATES[run.state] === true &&
-        run.prUrl === undefined &&
-        run.branch.trim() !== "",
-    );
-  const previous = salvagedPrCursor.get(project.name);
-  const previousIndex =
-    previous === undefined ? -1 : eligible.findIndex((run) => run.id === previous);
-  const start = previousIndex === -1 ? 0 : (previousIndex + 1) % eligible.length;
-  const candidates = Array.from(
-    { length: Math.min(SALVAGED_PR_ADOPTION_BATCH, eligible.length) },
-    (_, offset) => eligible[(start + offset) % eligible.length]!,
-  );
-  const last = candidates.at(-1);
-  if (last !== undefined) salvagedPrCursor.set(project.name, last.id);
-
-  for (const run of candidates) {
-    const repo = project.routing.repos[run.repo];
-    const repoIdentity = repo === undefined ? undefined : githubRepo(repo.cloneUrl);
-    let closers: OpenCloser[];
-    try {
-      closers = await tracker.openClosersFor(run.issue);
-    } catch (err) {
-      log(`#${run.issue} PR adoption lookup failed (${errText(err)}) — retrying next tick`);
-      continue;
-    }
-
-    const closer = closers.find(
-      (candidate) =>
-        candidate.headRefName !== "" &&
-        candidate.headRefName === run.branch &&
-        repo !== undefined &&
-        candidate.repo !== "" &&
-        candidate.repo === repoIdentity,
-    );
-    if (closer === undefined) {
-      if (!rejectedSalvagedPrRuns.has(run.id)) {
-        const observed = closers[0];
-        const reason =
-          observed === undefined
-            ? "no open closing PR"
-            : observed.headRefName === ""
-              ? "closer has no head branch identity"
-              : observed.headRefName !== run.branch
-                ? `closer head ${observed.headRefName} does not match retained branch ${run.branch}`
-                : observed.repo === ""
-                  ? "closer has no repository identity"
-                  : `closer repository ${observed.repo} does not match routed repository`;
-        log(`#${run.issue} PR not adopted onto attempt ${run.attempt}: ${reason}`);
-        rejectedSalvagedPrRuns.add(run.id);
-      }
-      continue;
-    }
-
-    const flag: SettlementFlag = {
-      kind: "pr-adopted",
-      file: "(recovery)",
-      detail: `${closer.url} matched retained branch ${run.branch} in ${closer.repo}`,
-    };
-    store.updateRun(run.id, {
-      prUrl: closer.url,
-      settlementFlags: [...(run.settlementFlags ?? []), flag],
-    });
-    rejectedSalvagedPrRuns.delete(run.id);
-    log(
-      `#${run.issue} adopted PR ${closer.url} onto attempt ${run.attempt}` +
-        (run.salvageSha === undefined ? "" : ` (salvaged head ${run.salvageSha})`),
-    );
-  }
-}
-
 /** Canonical `owner/repo` identity from a configured network clone URL. */
 function githubRepo(cloneUrl: string): string | undefined {
   const normalized = cloneUrl.replace(/\/$/, "").replace(/\.git$/, "");
@@ -4189,7 +3491,7 @@ type CleanupRetainedWorktree = (
  * dirty or uniquely unpushed work.
  */
 export async function cleanupRetainedRuns(
-  d: Pick<Deps, "project" | "tracker" | "store">,
+  d: Pick<Deps, "project" | "tracker" | "store" | "escalate">,
   queuedIssues: ReadonlySet<number>,
   cursor: RetainedCleanupCursor,
   cleanup: CleanupRetainedWorktree = cleanupRetainedWorktree,
@@ -4254,9 +3556,35 @@ export async function cleanupRetainedRuns(
 
     const outcome = await cleanup(mirrorPathFor(repo, project.mirrorRoot), run.worktree, run.branch);
     if (outcome.kind === "removed") {
-      store.updateRun(run.id, { worktree: "" });
+      store.updateRun(run.id, {
+        worktree: "",
+        ...(run.quarantineDetail === undefined ? {} : { quarantineDetail: null }),
+      });
       log(`#${run.issue} retained worktree reaped: ${run.worktree} (${run.branch})`);
+    } else if (outcome.reason === "quarantined") {
+      // A tree whose object store cannot be made sound is potentially
+      // stranded work: the daemon refuses to fetch into it, so its commits
+      // cannot be verified against any remote. The row records the condition
+      // so the status snapshot can name the tree, and the escalation ledger
+      // dedupes on the stable summary below — a pass that keeps seeing the
+      // same broken tree reports it once, never once per dispatch pass.
+      store.updateRun(run.id, { quarantineDetail: outcome.detail });
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue: run.issue,
+        summary: `#${run.issue} quarantined retained worktree — potentially stranded work`,
+        detail: `${run.worktree} (${run.branch})\n${outcome.detail}`,
+      });
     } else {
+      // Any other retained reason means the tree is back under ordinary
+      // retention: its alternates were repaired (or never needed it), so the
+      // quarantine — if one was marked — is over and the snapshot must not
+      // keep naming it as quarantined.
+      if (run.quarantineDetail !== undefined) {
+        store.updateRun(run.id, { quarantineDetail: null });
+        log(`#${run.issue} retained worktree no longer quarantined: ${outcome.detail}`);
+      }
       log(`#${run.issue} retained worktree kept (${outcome.reason}): ${outcome.detail}`);
     }
   }
@@ -4470,14 +3798,71 @@ async function verifyPendingUpgradeTick(
   }
 }
 
+/**
+ * The daemon's conductor.db snapshot cadence (#289) — the ledger's only
+ * durable copy, taken on the digest-aligned {@link dbSnapshotDue} window:
+ * once per local day, at/after the digest's configured `at` when it has one.
+ *
+ * Host-global, like the store itself: one snapshot per day for every project,
+ * so whichever project's daemon wins the day first publishes it and the
+ * others no-op on the same durable marker. The marker is written through the
+ * store's existing notification ledger (a one-row idempotence guard, the same
+ * primitive escalations use not to act twice) *after* the snapshot is
+ * published — a crash between publish and mark re-snapshots the next tick
+ * instead of skipping the day, and a restored store that predates today's
+ * marker takes a fresh snapshot on the next tick.
+ *
+ * Returns true when a snapshot was published. A store that does not exist
+ * yet is a silent no-op: there is nothing to back up, and `doctor`'s
+ * `db-backup` probe already treats that as a pass.
+ */
+export function runDbSnapshotCadence(args: {
+  digestPolicy: ReportingPolicy["digest"];
+  store: Pick<Store, "wasNotified" | "markNotified">;
+  source: string;
+  backupDir: string;
+  now?: number;
+  keep?: number;
+  log?: (line: string) => void;
+}): boolean {
+  const { digestPolicy, store, source, backupDir } = args;
+  // No store yet (first boot before any run persisted) → nothing to back up;
+  // `doctor`'s `db-backup` probe already treats that as a pass.
+  if (!existsSync(source)) return false;
+  const now = args.now ?? Date.now();
+  const today = localDayKey(now, digestPolicy.timezone);
+  const alreadyToday = store.wasNotified(dbSnapshotMarkerKey(today));
+  if (!dbSnapshotDue({ digest: digestPolicy }, alreadyToday ? today : undefined, now)) {
+    return false;
+  }
+  const published = snapshotDb(source, backupDir, now);
+  (args.log ?? log)(`conductor.db snapshot published: ${published}`);
+  store.markNotified(dbSnapshotMarkerKey(today));
+  try {
+    const removed = pruneDbSnapshots(backupDir, args.keep ?? DB_SNAPSHOT_RETENTION);
+    if (removed > 0) {
+      (args.log ?? log)(`db snapshot retention pruned ${removed} file(s) beyond the retained ${args.keep ?? DB_SNAPSHOT_RETENTION}`);
+    }
+  } catch (err) {
+    // The snapshot is already published and marked; an over-bound directory
+    // costs disk until the next due day retries the prune, never the backup.
+    (args.log ?? log)(`db snapshot retention prune failed: ${errText(err)}`);
+  }
+  return true;
+}
+
 export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // A config edit takes effect on the next tick, not the next daemon restart
   // (#170). Re-resolve the project and its caps at the tick boundary so a tick
   // and every run it admits see one consistent snapshot; a failed read keeps
   // the boot values rather than wedging the tick, and the next tick tries
-  // again.
+  // again. The same reloaded config feeds the db-snapshot backup dir: when it
+  // is unreadable the cadence falls back to the state-root default, matching
+  // `doctor`'s probe of an absent field.
+  let reloadedConfig: ConductorConfig | undefined;
   try {
     const cfg = loadConfig();
+    reloadedConfig = cfg;
     const fresh = findProject(cfg, d.project.name);
     const freshCaps = resolveCaps(fresh, cfg.defaults);
     if (JSON.stringify(fresh) !== JSON.stringify(d.project) || JSON.stringify(freshCaps) !== JSON.stringify(d.caps)) {
@@ -4559,6 +3944,25 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     log(`salvaged PR adoption sweep failed: ${errText(err)}`);
   }
 
+  // The conductor.db snapshot cadence (#289) is durability, not dispatch:
+  // the verb ledger, the decision rows and the run history have no other
+  // copy, so they are snapshotted once per day on the digest-aligned window.
+  // Above the pause gate on purpose — a parked fleet still accumulates ledger
+  // rows and still deserves a backup — and a failure costs the day's snapshot
+  // placeholder, never the tick: failed cadence steps are logged and retried
+  // by the five-minute loop, exactly like the sweeps above it.
+  try {
+    runDbSnapshotCadence({
+      digestPolicy: (d.project.reporting ?? DEFAULT_REPORT_POLICY).digest,
+      store: d.store,
+      source: dbPath(),
+      backupDir: dbBackupDirFor(reloadedConfig),
+      log,
+    });
+  } catch (err) {
+    log(`db snapshot cadence failed: ${errText(err)}`);
+  }
+
   // Immediately after settlement and before any routing, so a class is on the
   // row before the next dispatch decision reads its budgets (#132). Above the
   // pause gate deliberately: classification and label reconciliation are
@@ -4568,7 +3972,15 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // Each is guarded on its own: a tracker that fails mid-classification must not
   // stop the label reconcile, and neither may stop the tick.
   try {
-    settled += await classifyAndRecover(d);
+    settled += await classifyAndRecover({
+      project: d.project,
+      caps: d.caps,
+      tracker: d.tracker,
+      store: d.store,
+      escalate: (e) => d.escalate(e),
+      isPaused,
+      setPaused,
+    });
   } catch (err) {
     log(`classification sweep failed: ${errText(err)}`);
   }
@@ -4727,14 +4139,37 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     return pending.length === 0 ? issue : { ...issue, labels: effectiveLabels(issue.labels, pending) };
   });
   const { routed, unroutable } = route(effective, project);
-  // Ready issues that route() dropped without a reason carry a state label —
-  // claimed by a live or settling run — so the claimed count is subtraction
-  // rather than a routed-state signal (#228).
-  const claimed = effective.length - routed.length - unroutable.length;
-  const routingHolds: AdmissionHold[] = unroutable.map((u) => ({
-    issue: u.issue.number,
-    reason: `unroutable:${u.reason}`,
-  }));
+  // route() drops a candidate for two reasons, only one of which is a claim
+  // question. A lifecycle state label (agent:in-progress/blocked/failed)
+  // marks a run-owned issue: it is genuinely in flight while its newest run
+  // is live or settling, and a terminal newest run — or no run at all — means
+  // the label is residual, the footprint of a settled run nobody cleared,
+  // which is Duty 1 reconciliation work, not occupied capacity. A missing
+  // queue label instead marks an issue the outbox is withdrawing (a pending
+  // queue-label removal, e.g. releaseQueueLabel after a merge the PR did not
+  // close), which belongs in none of the three populations. So `claimed` is
+  // defined from actual ownership over genuinely lifecycle-labelled candidates
+  // rather than as the residual of routing (#228, #611).
+  const stateLabels = new Set(Object.values(project.stateLabels));
+  const dropped = effective.filter(
+    (issue) => !isEligible(issue, project) && issue.labels.some((l) => stateLabels.has(l)),
+  );
+  let claimed = 0;
+  const lifecycleHolds: AdmissionHold[] = [];
+  for (const issue of dropped) {
+    const newest = store.latestRun(project.name, issue.number);
+    if (newest !== undefined && ACTIVE_STATES.includes(newest.state)) {
+      claimed += 1;
+    } else {
+      lifecycleHolds.push({ issue: issue.number, reason: "stale-lifecycle" });
+    }
+  }
+  const routingHolds: AdmissionHold[] = [
+    ...unroutable.map(
+      (u): AdmissionHold => ({ issue: u.issue.number, reason: `unroutable:${u.reason}` }),
+    ),
+    ...lifecycleHolds,
+  ];
   const recordDispatch = (admitted: number, holds: readonly AdmissionHold[]): void => {
     store.recordDispatch(
       project.name,
@@ -5225,6 +4660,14 @@ export interface StatusSnapshot {
    * the config or the brief.
    */
   releaseGrants: ResolvedGrants;
+  /**
+   * The effective review policy (#678). On the snapshot for the reason
+   * `releaseGrants` is: the orchestrator's Duty 1 has to act on it every
+   * tick, and a stale level or ceiling sitting only in a config file nobody
+   * opens is exactly the drift this field exists to surface. The loader always
+   * materialises it, so this is never absent on a real daemon.
+   */
+  review: ReviewPolicy;
   /** Occupied issues: live workers plus green PRs awaiting a human merge. */
   activeRuns: RunRecord[];
   /**
@@ -5239,6 +4682,11 @@ export interface StatusSnapshot {
   /** Newest attempts holding a preserved WIP tip, or a tree that is still the
    *  only copy of work the daemon could not save. */
   salvagedRuns: RunRecord[];
+  /** Retained trees whose object store could not be made sound, so the daemon
+   *  refused to fetch into them and their commits cannot be verified against
+   *  any remote (#737). Distinguished from ordinary retention on purpose —
+   *  quarantine is "potentially stranded work", not routine housekeeping. */
+  quarantinedRuns: RunRecord[];
   /** One-shot issue ceilings waiting for the next claim. */
   turnOverrides: TurnOverride[];
   /** Reports the operator has not provably received: pending, in-flight with an
@@ -5342,9 +4790,11 @@ export function statusSnapshotFromStore(
     digestSchedule: digestScheduleState(p.reporting ?? DEFAULT_REPORT_POLICY, lastDigestDay, now),
     caps,
     releaseGrants: resolveReleaseGrants(p),
+    review: resolveReview(p),
     activeRuns: store.activeRuns(p.name),
     reviewRounds,
     salvagedRuns: store.salvagedRuns(p.name),
+    quarantinedRuns: store.quarantinedRuns(p.name),
     turnOverrides: store.listTurnOverrides(p.name),
     openReports: store.openReports(p.name),
     digestBacklog: store.digestBacklog(p.name),
@@ -5418,32 +4868,6 @@ export function formatDispatchSummary(summary?: DispatchSummary): string {
   return lines.join("\n");
 }
 
-/**
- * The WIP block: every issue whose newest attempt left work behind, and
- * whether that work is safe.
- *
- * Blocked runs used to be invisible here, which is exactly how #118 stayed
- * invisible for a full attempt cycle — the operator saw a blocked issue and had
- * no way to tell "stopped with 34 uncommitted files" from "stopped clean".
- * A preserved line is informational; an UNSALVAGED line is an alarm, and it
- * names the directory because that directory is the work.
- */
-export function formatSalvagedRuns(runs: readonly RunRecord[]): string[] {
-  if (runs.length === 0) return [];
-  const lines = ["", "wip"];
-  for (const r of runs) {
-    lines.push(
-      r.salvageError !== undefined && r.salvageAckAt === undefined
-        ? `  #${r.issue}  UNSALVAGED  ${r.worktree === "" ? "(path not recorded)" : r.worktree} — ` +
-          `only copy, dispatch held (${r.salvageError})`
-        : r.salvageError !== undefined
-          ? `  #${r.issue}  accepted as lost  attempt ${r.attempt} (${r.salvageError})`
-          : `  #${r.issue}  preserved  ${r.salvageSha ?? "?"} on ${r.branch} (attempt ${r.attempt}, ${r.state})`,
-    );
-  }
-  return lines;
-}
-
 /**
  * The grant table, named shape by shape.
  *
@@ -5461,6 +4885,7 @@ export function formatReleaseGrants(grants: ResolvedGrants): string[] {
     ...RELEASE_SHAPES.map((shape) => `  ${shape.padEnd(19)}${grants[shape]}`),
   ];
 }
+
 export function formatBaseHealth(rows: readonly BaseHealth[]): string[] {
   return rows.map((row) => {
     const head = row.headSha.slice(0, 8);
@@ -5550,6 +4975,7 @@ export function formatStatus(s: StatusSnapshot): string {
   lines.push(...formatBaseHealth(s.baseHealth));
   lines.push(...formatFreezes(s.freezes));
   lines.push(...formatSalvagedRuns(s.salvagedRuns));
+  lines.push(...formatQuarantinedRuns(s.quarantinedRuns));
   lines.push(...formatOpenReports(s.openReports));
   lines.push(...formatVerbLedger(s.verbLedger));
   // Deploy hint: a restart while workers are live orphans them (salvage runs
@@ -5623,61 +5049,6 @@ export function prepareConductor(project?: string): void {
   setPaused(true, { source: "setup" }, project);
 }
 
-/** Bounded per tick: each row costs tracker calls to gather facts for. */
-const CLASSIFY_BATCH = 20;
-
-/** Tool calls quoted as evidence for a run that spun to its turn cap. */
-const SPIN_EVIDENCE_CALLS = 10;
-
-/**
- * The last few tool names a transcript recorded, newest last.
- *
- * `turn-cap-spinning` escalates rather than requeueing, and the acceptance
- * criterion is that the escalation carries evidence of what the worker was doing
- * when it hit the cap — otherwise the orchestrator opens the transcript and
- * re-derives it, which is the manual triage this whole sweep removes.
- */
-export function lastToolCalls(sessionFile: string | undefined, limit = SPIN_EVIDENCE_CALLS): string[] {
-  if (sessionFile === undefined) return [];
-  let text: string;
-  try {
-    text = readFileSync(sessionFile, "utf8");
-  } catch {
-    return [];
-  }
-  const names: string[] = [];
-  for (const line of text.split("\n")) {
-    if (line.length === 0) continue;
-    let row: unknown;
-    try {
-      row = JSON.parse(line) as unknown;
-    } catch {
-      continue;
-    }
-    if (row === null || typeof row !== "object") continue;
-    const rec = row as { readonly [key: string]: unknown };
-    // Both shapes the harness has written: a top-level tool event, and a tool
-    // block inside an assistant message.
-    const direct = rec["toolName"];
-    if (typeof direct === "string") {
-      names.push(direct);
-      continue;
-    }
-    const message = rec["message"];
-    if (message === null || typeof message !== "object") continue;
-    const content = (message as { readonly [key: string]: unknown })["content"];
-    if (!Array.isArray(content)) continue;
-    for (const part of content) {
-      if (part === null || typeof part !== "object") continue;
-      const p = part as { readonly [key: string]: unknown };
-      if (p["type"] !== "tool_use") continue;
-      const name = p["name"];
-      if (typeof name === "string") names.push(name);
-    }
-  }
-  return names.slice(-limit);
-}
-
 /** A provider refusal a session recorded before dying, or undefined for none. */
 export interface SessionError {
   status?: number;
@@ -5693,138 +5064,6 @@ export function completionLastError(
   return providerCredit ?? providerTransient ?? verifiedReason ?? sessionErr?.message;
 }
 
-/**
- * The last error a transcript recorded, or undefined when it recorded none.
- *
- * The harness writes `{"stopReason":"error","errorStatus":402,"errorId":402,
- * "errorMessage":"402 This request requires more credits, ..."}`. The daemon
- * read none of it, so three runs died `unknown` with an empty `lastError` and
- * charged an attempt each for a billing state (#220).
- *
- * Scanned newest-first: a session that recovered from an early error and then
- * died of something else must report the something else, and a session that
- * recovered from its only error and finished cleanly reports the error anyway
- * because there is no terminal verdict to outrank it (#220).
- */
-export function readSessionError(sessionFile: string | undefined): SessionError | undefined {
-  if (sessionFile === undefined) return undefined;
-  let text: string;
-  try {
-    text = readFileSync(sessionFile, "utf8");
-  } catch {
-    return undefined;
-  }
-  const lines = text.split("\n");
-  for (let i = lines.length - 1; i >= 0; i -= 1) {
-    const line = lines[i];
-    if (line === undefined || line.length === 0) continue;
-    let row: unknown;
-    try {
-      row = JSON.parse(line) as unknown;
-    } catch {
-      continue;
-    }
-    if (row === null || typeof row !== "object") continue;
-    const rec = row as { readonly [key: string]: unknown };
-    if (rec["stopReason"] !== "error") continue;
-    const message = rec["errorMessage"];
-    if (typeof message !== "string" || message.trim() === "") continue;
-    const status = rec["errorStatus"];
-    return {
-      ...(typeof status === "number" && Number.isFinite(status) ? { status } : {}),
-      message: message.trim(),
-    };
-  }
-  return undefined;
-}
-
-/**
- * Classify every unclassified terminal run, persist the verdict, and perform the
- * one recovery its class names (#132).
- *
- * Half this fleet's spend produced no merged PR, and every one of those runs
- * ended at a human who re-derived the same triage by hand and then threw the
- * conclusion away. The mechanical classes — a cancelled runner, a kill from a
- * daemon restart, a green PR whose base moved, a row whose PR had already merged
- * — need no judgement at all; the genuinely human ones are worth a person's
- * attention only if they arrive with their evidence already gathered.
- *
- * Facts are fetched per row and only the ones that row needs: a `killed` row
- * costs nothing, a `failed` row with a PR costs a state read and a check read.
- * A `pushed-green` row that classifies to nothing is left completely untouched —
- * it is healthy, and writing a class onto it would take it out of this sweep for
- * good.
- */
-export async function classifyAndRecover(d: Deps): Promise<number> {
-  const { project, caps, tracker, store } = d;
-  // Settle recoveries, counted for the pass's dispatch record — a row whose PR
-  // merged is settled here when the settle sweep could not establish identity
-  // (#497). Every other exit returns 0.
-  let settled = 0;
-  for (const run of store.runsNeedingClassification(project.name, CLASSIFY_BATCH)) {
-    const facts: ClassifyFacts = {};
-    let classifiedRun = run;
-    if (run.state === "failed" || run.state === "killed") {
-      const sessionError = readSessionError(run.sessionFile);
-      if (sessionError !== undefined) {
-        if (run.lastError === undefined || run.lastError === sessionError.message) {
-          facts.sessionError = sessionError;
-        }
-        if (run.lastError === undefined) {
-          store.updateRun(run.id, { lastError: sessionError.message });
-          classifiedRun = { ...run, lastError: sessionError.message };
-        }
-      }
-    }
-    try {
-      if (run.prUrl !== undefined) {
-        const pr = await tracker.prState(run.prUrl);
-        if (pr !== undefined) facts.pr = pr;
-        if (run.state === "pushed-green" && facts.pr === "open") {
-          facts.mergeable = await tracker.mergeable(run.prUrl);
-        }
-        if (run.state === "failed" && facts.pr === "open") {
-          facts.checks = await tracker.checkConclusions(run.prUrl);
-          // When a check failed with a reachable log, pull its tail so the
-          // table can tell an infra outage (#177) from a real test failure by
-          // the log's own words. First failure wins; a log that cannot be
-          // fetched is left undefined and classification stays conservative.
-          // GitHub reports check states as `FAILURE` while the classifier reads
-          // them lowercased — normalise so the live seam and the table agree on
-          // which check is the failure whose log we pull (#177).
-          const firstFailure = facts.checks.find((c) => normalise(c.state) === "failure" && c.link !== undefined);
-          if (firstFailure?.link !== undefined) {
-            facts.failingLog = await tracker.checkLog(firstFailure.link);
-          }
-        }
-      }
-    } catch (err) {
-      // Per row, like every other sweep here: one unreachable PR must not stop
-      // the rest from being classified. The next tick asks again for free.
-      log(`#${run.issue} not classified: fact gathering failed (${errText(err)}) — retrying next tick`);
-      continue;
-    }
-
-    const { cls, recovery, evidence } = classifyRun(classifiedRun, facts, caps);
-
-    // A healthy green PR is not a failure of any class. Leaving the row
-    // unclassified is what keeps it eligible for the sweep on the tick where its
-    // base does move under it.
-    if (run.state === "pushed-green" && cls === "unknown") continue;
-
-    const retry = run.failureClass !== undefined;
-    store.updateRun(run.id, { failureClass: cls, recoveryAction: recovery });
-    log(
-      retry
-        ? `#${run.issue} retrying ${recovery} for ${cls}: ${evidence}`
-        : `#${run.issue} classified ${cls} → ${recovery}: ${evidence}`,
-    );
-    if (recovery === "settle") settled += 1;
-    await recoverRun(d, classifiedRun, cls, recovery, evidence);
-  }
-  return settled;
-}
-
 /**
  * How many settled `ci-deterministic` rows one reconciliation pass may
  * re-examine beyond the persisted review cursor. Each candidate costs GitHub
@@ -5973,479 +5212,6 @@ async function historicalInfraEvidence(d: Deps, run: RunRecord): Promise<string[
   return chunks;
 }
 
-/** Performs the one action a class names. Never chooses one of its own. */
-async function recoverRun(
-  d: Deps,
-  run: RunRecord,
-  cls: FailureClass,
-  recovery: RecoveryAction,
-  evidence: string,
-): Promise<void> {
-  const { project, caps, tracker, store } = d;
-  const inProgress = project.stateLabels.inProgress;
-
-  if (recovery === "settle") {
-    // Enqueue the release with the terminal write (see `settlePushedGreen`):
-    // the outbox keeps the label and the row one fact, so a tracker refusal
-    // can no longer strand `agent:in-progress` with nothing left to retry it
-    // (#18, #201).
-    releaseInProgress(d, run.issue, `PR merged: ${evidence}`);
-    store.updateRun(run.id, { state: "merged", endedAt: Date.now(), recoveredAt: Date.now() });
-    log(`#${run.issue} settled from ${cls}: ${evidence}`);
-    return;
-  }
-
-  if (recovery === "continue") {
-    // Two classes recover by continuing, and only one of them has anything left
-    // to do here.
-    //
-    // `turn-cap-progress` was already handed back by the completion path, which
-    // swapped its labels and left the branch retained. There is nothing to
-    // perform, and writing anything would be actively wrong: overwriting
-    // `lastError` with a rebase brief tells the continuation worker to rebase a
-    // run that simply ran out of turns, and re-swapping labels the completion
-    // path already swapped is a pair of no-op `gh` calls. Record-only, so the
-    // sweep stops re-offering it.
-    if (cls === "turn-cap-progress") {
-      store.updateRun(run.id, { recoveredAt: Date.now() });
-      log(`#${run.issue} already continuing from ${cls}: ${evidence}`);
-      return;
-    }
-
-    // `wall-clock-cap-progress`: the completion path only auto-continues
-    // turn-cap kills, so a wall-clock kill with work to show reaches this
-    // sweep still holding the failed label. Swap it for the queue — the branch
-    // is retained, so the next dispatch reattaches it and briefs a resume from
-    // the recorded work. Killed rows gathered no tracker facts, so the
-    // issue-open guard mirrors the requeue path's. The continuation gate is
-    // the same one the turns path applies at kill time
-    // (`shouldContinueAfterTurnsCap`): the row is already charged, and once
-    // the ceiling is spent, handing back the queue label would offer a
-    // candidate admission can never accept — only the failed label comes off,
-    // and the exhaustion reaches a human (#490, #348).
-    if (cls === "wall-clock-cap-progress") {
-      const state = await tracker.issueState(run.issue).catch(() => undefined);
-      if (state !== "open") {
-        log(`#${run.issue} not continued from ${cls}: issue is ${state ?? "unreadable"}`);
-        return;
-      }
-      const continuation = store.continuationsFor(project.name, run.issue);
-      if (hasContinuationBudget(continuation, caps.maxContinuationsPerIssue)) {
-        swapToQueue(d, run.issue, project.stateLabels.failed);
-        store.updateRun(run.id, { recoveredAt: Date.now() });
-        log(`#${run.issue} requeued for a wall-clock continuation: ${evidence}`);
-      } else {
-        store.enqueueLabelOps(project.name, [
-          { issue: run.issue, op: "remove", label: project.stateLabels.failed },
-        ]);
-        store.updateRun(run.id, { recoveredAt: Date.now() });
-        await safeEscalate(d, {
-          tier: 1,
-          project: project.name,
-          issue: run.issue,
-          summary: `#${run.issue} exhausted its continuation budget on wall-clock cap kills`,
-          detail: [
-            `Attempt ${run.attempt} hit the wall-clock cap with work to continue from, but ${continuation} continuation(s) are already charged against a cap of ${caps.maxContinuationsPerIssue}.`,
-            evidence,
-            `Work to continue: branch ${run.branch} at ${run.headSha ?? run.salvageSha}${run.prUrl === undefined ? "" : ` — ${run.prUrl}`}.`,
-            "The issue cannot finish inside the wall-clock cap, so another run would burn a worker slot for the same outcome. Re-scope it, raise maxContinuationsPerIssue for it, or finish the remaining work by hand.",
-          ].join("\n"),
-        });
-        await postExhaustionPostmortem(
-          d,
-          run,
-          `Attempt ${run.attempt} hit the wall-clock cap with work to continue from, but ${continuation} continuation(s) are already charged against a cap of ${caps.maxContinuationsPerIssue}.`,
-        );
-        log(`#${run.issue} not continued from ${cls}: continuation budget exhausted`);
-      }
-      return;
-    }
-
-    // `merge-conflict`: the branch is retained and its PR is open, so #50's
-    // continuation guard admits it and the next tick briefs a rebase.
-    //
-    // The outbox makes the retry contract one-sided: the swap is enqueued — a
-    // durable local write that cannot fail on the tracker — before
-    // `recoveredAt` is written, so the row can never again be taken out of
-    // `runsNeedingClassification` with its label swap still owed. That was
-    // the defect 0.4.4 claimed to have fixed and did not, for this one
-    // recovery; the projector retries until the tracker takes the swap, and
-    // while it is pending the eligibility overlay keeps the issue coherent
-    // (#201).
-    swapToQueue(d, run.issue, inProgress);
-    store.updateRun(run.id, {
-      state: "killed",
-      lastError:
-        "merge-conflict: base moved under a green PR — rebase, regenerate recorded artifacts, push without force",
-      recoveredAt: Date.now(),
-    });
-    log(`#${run.issue} requeued for a rebase continuation: ${evidence}`);
-    return;
-  }
-
-  if (recovery === "requeue") {
-    if (cls === "provider-credit") {
-      await reactToProviderCredit(d, run.issue, evidence, run.sessionFile);
-    }
-    // A dispatch-infra requeue that keeps landing on the same issue means the
-    // mirror for its repo is persistently broken — a ref-lock that retry already
-    // exhausted, a dead remote. Requeueing forever spends a turn-0 run per tick
-    // with no chance of success, so after a bounded number of strikes this
-    // escalates to a human instead (#168, #177).
-    if (cls === "dispatch-infra" && store.classCountFor(project.name, run.issue, "dispatch-infra") >= DISPATCH_INFRA_MAX_STRIKES) {
-      await safeEscalate(d, {
-        tier: 1,
-        project: project.name,
-        issue: run.issue,
-        summary: `[dispatch-infra] #${run.issue}: the mirror for ${run.repo} is failing persistently — ${evidence}`,
-        detail: [
-          `The dispatcher could not provision a worktree for #${run.issue} ${DISPATCH_INFRA_MAX_STRIKES} times in a row, all before the worker's first turn.`,
-          "The mirror on this host needs attention (check disk, SSH/HTTPS credentials, and the mirror root).",
-        ].join("\n"),
-      });
-      store.updateRun(run.id, { recoveredAt: Date.now() });
-      log(`#${run.issue} escalated from persistent ${cls}: ${evidence}`);
-      return;
-    }
-    // Same bound for provider-transient: an issue whose stream keeps stalling
-    // mid-run is requeued free (no attempt, no continuation charged) — but a
-    // provider that aborts three times for one issue is down, and a human has
-    // to check its status before hand-requeueing (#220). The escalation names
-    // every model the chain tried, so a merged branch built on a different
-    // model is attributable (#286).
-    if (
-      cls === "provider-transient" &&
-      store.classCountFor(project.name, run.issue, "provider-transient") >= PROVIDER_TRANSIENT_MAX_STRIKES
-    ) {
-      const tried = formatModelsTried(modelsTried(store.runsForIssue(project.name, run.issue)));
-      await safeEscalate(d, {
-        tier: 1,
-        project: project.name,
-        issue: run.issue,
-        summary: `[provider-transient] #${run.issue}: the provider keeps aborting mid-stream — ${evidence}`,
-        detail: [
-          `The provider aborted the stream for #${run.issue} ${PROVIDER_TRANSIENT_MAX_STRIKES} times without the run ever producing a verdict (0 tokens billed each time).`,
-          ...(tried === ""
-            ? []
-            : [`Models tried: ${tried}.`]),
-          "Check provider status before requeueing by hand.",
-        ].join("\n"),
-      });
-      store.updateRun(run.id, { recoveredAt: Date.now() });
-      log(`#${run.issue} escalated from persistent ${cls}: ${evidence}`);
-      return;
-    }
-    // Same bound for provider-capacity: a run the provider throttled into the
-    // ground is requeued free (no attempt charged) — but a provider that
-    // throttles the same issue three times is at capacity, and a human has to
-    // check its status before hand-requeueing (#573). On a chain-configured
-    // project each requeue already moved the next attempt to the next chain
-    // model, so this escalation is what catches the no-chain case and the
-    // exhausted chain; it names every model the chain tried.
-    if (
-      cls === "provider-capacity" &&
-      store.classCountFor(project.name, run.issue, "provider-capacity") >= PROVIDER_CAPACITY_MAX_STRIKES
-    ) {
-      const tried = formatModelsTried(modelsTried(store.runsForIssue(project.name, run.issue)));
-      await safeEscalate(d, {
-        tier: 1,
-        project: project.name,
-        issue: run.issue,
-        summary: `[provider-capacity] #${run.issue}: the model provider is throttling this run into the ground — ${evidence}`,
-        detail: [
-          `The provider answered #${run.issue} with sustained in-session rate limits ${PROVIDER_CAPACITY_MAX_STRIKES} times in a row; the harness retried each and was exhausted.`,
-          ...(tried === ""
-            ? []
-            : [`Models tried: ${tried}.`]),
-          "Check the provider's rate-limit status (and its throughput-oriented routes) before requeueing by hand.",
-        ].join("\n"),
-      });
-      store.updateRun(run.id, { recoveredAt: Date.now() });
-      log(`#${run.issue} escalated from persistent ${cls}: ${evidence}`);
-      return;
-    }
-    // Only when the tracker still shows this issue as ours to hand back. An
-    // issue that is closed, or has no state label, was resolved by another route
-    // and requeueing it would dispatch work nobody asked for.
-    const state = await tracker.issueState(run.issue).catch(() => undefined);
-    if (state !== "open") {
-      log(`#${run.issue} not requeued from ${cls}: issue is ${state ?? "unreadable"}`);
-      return;
-    }
-    // A clean orphan whose queue label is already absent is a deliberate
-    // withdrawal — the operator took the issue out of the queue (e.g. so a
-    // daemon restart could not re-dispatch work known to be unsafe) — and
-    // recovery must not recreate that intent (#423). Read the live label set;
-    // when the queue label is gone, release the dispatcher-owned in-progress
-    // label and stop, leaving the operator's withdrawal to survive recovery.
-    if (cls === "orphan-clean") {
-      const snapshot = await tracker.issueSnapshot(run.issue).catch(() => undefined);
-      if (snapshot === undefined) {
-        log(`#${run.issue} not requeued from orphan-clean: cannot confirm ${project.queueLabel} (unreadable, retrying)`);
-        return;
-      }
-      if (!snapshot.labels.includes(project.queueLabel)) {
-        store.enqueueLabelOps(project.name, [{ issue: run.issue, op: "remove", label: inProgress }]);
-        store.updateRun(run.id, { recoveredAt: Date.now() });
-        log(`#${run.issue} not requeued from orphan-clean: ${project.queueLabel} removed before recovery (operator withdrawal)`);
-        return;
-      }
-      // #439: an orphan-clean row charges the continuation budget, so once
-      // `hasContinuationBudget` is spent — exactly the predicate `admitCandidates`
-      // holds the issue on — requeueing re-adds a queue label for a candidate the
-      // dispatcher can never admit. Stop handing it back and hold it instead: the
-      // queue label comes off (so admission never re-holds on every dispatch),
-      // the in-progress label is released, and a single diagnosis escalates once.
-      // `orphan-clean` is deliberately NOT a global exclusion from the budget (a
-      // worker that genuinely keeps dying mid-work must still be bounded); this is
-      // the missing ceiling check this path never had (#348's invariant).
-      const continuations = store.continuationsFor(project.name, run.issue);
-      if (!hasContinuationBudget(continuations, caps.maxContinuationsPerIssue)) {
-        const runs = store.runsForIssue(project.name, run.issue);
-        const breakdown = continuationBreakdown(runs);
-        const artifact = newestContinuableRun(runs);
-        const onlyDaemonStops = breakdown.size === 1 && breakdown.get("orphan-clean") === continuations;
-        const classLine = Array.from(breakdown, ([cls, n]) => `${n} ${cls}`).join(", ");
-        const artifactLine =
-          artifact === undefined
-            ? "The attempts left no salvage commit, head SHA or PR — the branch is empty, so start clean from a re-scope rather than continuing from nothing."
-            : `Work to continue: branch ${artifact.branch} at ${artifact.headSha ?? artifact.salvageSha}${artifact.prUrl === undefined ? "" : ` — ${artifact.prUrl}`}.`;
-        store.enqueueLabelOps(project.name, [
-          { issue: run.issue, op: "remove", label: inProgress },
-          { issue: run.issue, op: "remove", label: project.queueLabel },
-        ]);
-        store.updateRun(run.id, { recoveredAt: Date.now() });
-        await safeEscalate(d, {
-          tier: 1,
-          project: project.name,
-          issue: run.issue,
-          summary: `#${run.issue} exhausted its ${caps.maxContinuationsPerIssue}-continuation budget on ${cls}`,
-          detail: [
-            `Attempt ${run.attempt} is not requeued: ${continuations} continuation(s) charged against a cap of ${caps.maxContinuationsPerIssue}.`,
-            `Continuations by failure class: ${classLine}.`,
-            onlyDaemonStops
-              ? "Every continuation was a daemon stop — the work never failed; the budget was spent by daemon deaths, not the issue."
-              : "Continuations span real work — inspect what each attempt left behind before continuing.",
-            artifactLine,
-            "What you can do: raise maxContinuationsPerIssue for this issue, re-scope it, or continue from the preserved work (or start clean if none).",
-          ].join("\n"),
-        });
-        await postExhaustionPostmortem(
-          d,
-          run,
-          `Attempt ${run.attempt} is not requeued: ${continuations} continuation(s) charged against a cap of ${caps.maxContinuationsPerIssue}.`,
-        );
-        log(`#${run.issue} not requeued from orphan-clean: continuation budget exhausted`);
-        return;
-      }
-    }
-    const label = cls === "orphan-clean" ? inProgress : project.stateLabels.failed;
-    swapToQueue(d, run.issue, label);
-    store.updateRun(run.id, { recoveredAt: Date.now() });
-    log(`#${run.issue} requeued from ${cls}: ${evidence}`);
-    return;
-  }
-
-  if (recovery === "rerun-checks") {
-    if (run.prUrl === undefined) return;
-    try {
-      await tracker.rerunFailedChecks(run.prUrl);
-    } catch (err) {
-      log(`#${run.issue} check re-run failed (${errText(err)}) — retrying next tick`);
-      return;
-    }
-    // Back to pending rather than green: the existing settle sweep re-verifies
-    // it against the recorded head on a later tick, so nothing here has to guess
-    // whether the re-run passed.
-    store.updateRun(run.id, { state: "pushed-pending", lastError: null, recoveredAt: Date.now() });
-    log(`#${run.issue} re-ran infrastructure checks: ${evidence}`);
-    return;
-  }
-
-  if (recovery === "escalate") {
-    const detail = [evidence];
-    if (cls === "turn-cap-spinning" || cls === "wall-clock-cap-spinning") {
-      const calls = lastToolCalls(run.sessionFile);
-      detail.push(
-        calls.length === 0
-          ? "transcript unreadable — no tool calls could be recovered"
-          : `Last ${calls.length} tool calls: ${calls.join(" → ")}`,
-      );
-    }
-    if (run.lastError !== undefined && cls !== "question") detail.push(run.lastError);
-    // #172: an unwritten transcript is "the run died before it flushed", not a
-    // link to a file the operator will open and find missing.
-    detail.push(
-      run.sessionFile === undefined
-        ? "Session: (no transcript)"
-        : existsSync(run.sessionFile)
-          ? `Session: ${run.sessionFile}`
-          : `Session: ${run.sessionFile} (file was never written — the run died before its transcript was flushed)`,
-    );
-    // The class and the run are in the summary, which is what the notifications
-    // ledger dedupes on — so one class escalates once per run rather than every
-    // five minutes.
-    await safeEscalate(d, {
-      tier: 1,
-      project: project.name,
-      issue: run.issue,
-      runId: run.id,
-      summary: `[${cls}] #${run.issue} attempt ${run.attempt}: ${evidence}`,
-      detail: detail.join("\n"),
-    });
-    // The hand-off IS the recovery for these classes: there is nothing else this
-    // package can do, and leaving the row unrecovered would re-escalate forever.
-    store.updateRun(run.id, { recoveredAt: Date.now() });
-    return;
-  }
-
-  // `hold` (orphan-dirty) and `none`: recorded, nothing performed. The existing
-  // unsalvaged-WIP admission hold already fails dispatch closed until an
-  // operator acknowledges the tree, which is the only safe move when the
-  // worktree holds the only copy of real work.
-}
-
-/**
- * Enqueue a state-label → queue-label swap for projection (#201).
- *
- * The swap is two ops in id order — remove first, then add — which is the
- * atomicity the projector guarantees: the issue never sits newly eligible
- * without a queue label on its way back, and the add never lands before the
- * remove when GitHub fails between them. Enqueueing is a durable local write
- * that cannot fail on the tracker, so the caller records its recovery
- * immediately and the projector retries the swap until the tracker takes it —
- * that closes the 0.4.4 hole where a refused label swap stranded the row
- * permanently under a log line promising a retry.
- */
-function swapToQueue(d: Pick<Deps, "project" | "store">, issue: number, label: string): void {
-  d.store.enqueueLabelOps(d.project.name, [
-    { issue, op: "remove", label },
-    { issue, op: "add", label: d.project.queueLabel },
-  ]);
-}
-
-/** Bounded listing per state label, so one reconcile cannot walk a whole repo. */
-const RECONCILE_LIMIT = 50;
-
-/**
- * Clear state labels from issues that no longer need them (#132's `superseded`).
- *
- * Two structural signals, both cheap and both observed on this fleet: an issue
- * that is closed but still carries `agent:*`, and an open issue carrying
- * `failed` whose sub-issues have all closed. On 2026-08-09 four issues (#307,
- * #297, #140, #82) carried `agent:failed` while every one of them was already
- * complete — the label was residue of a turns-cap kill from two days earlier,
- * and nothing in the loop ever revisited it. The board counted four phantom
- * failures while the genuinely stuck issues were invisible.
- *
- * Positive evidence only. A tracker that cannot list answers empty, and an empty
- * answer removes nothing: a reconcile that guessed would strip the interlock
- * that keeps two workers off one issue.
- */
-export async function reconcileStaleLabels(d: Deps): Promise<void> {
-  const { project, tracker, store } = d;
-  const labels = [project.stateLabels.failed, project.stateLabels.blocked, project.stateLabels.inProgress];
-
-  for (const label of labels) {
-    const carrying = await tracker.listLabeled(label, RECONCILE_LIMIT).catch(() => []);
-    for (const issue of carrying) {
-      if (issue.state === "closed") {
-        // Never retain an `agent:*` label on a closed issue: the work is done by
-        // some route, and the label only makes the board lie about it. Enqueue
-        // rather than call — a refused write must not lose the decision; the
-        // projector retries the removal until the tracker takes it (#201).
-        store.enqueueLabelOps(project.name, [{ issue: issue.number, op: "remove", label }]);
-        log(`#${issue.number} reconciled: closed issue no longer carries ${label} (queued)`);
-        continue;
-      }
-
-      if (label !== project.stateLabels.failed) continue;
-      const children = await tracker.childrenOf(issue.number).catch(() => []);
-      if (children.length === 0 || children.some((c) => c.state !== "closed")) continue;
-
-      const key = `${project.name}:superseded:${issue.number}`;
-      if (store.wasNotified(key)) continue;
-      const list = children.map((c) => `#${c.number}`).join(", ");
-      store.enqueueLabelOps(project.name, [{ issue: issue.number, op: "remove", label }]);
-      try {
-        await tracker.comment(
-          issue.number,
-          `superseded: all sub-issues closed (${list}) — this label was stale; propose closing if the ` +
-            `acceptance criteria are met on the default branch.`,
-        );
-        store.markNotified(key);
-        log(`#${issue.number} reconciled: superseded by ${list}`);
-      } catch (err) {
-        // The label removal is already queued and will land regardless; the
-        // comment is the only half that can fail here (#201).
-        log(`#${issue.number} could not comment the superseded note (${errText(err)}) — retrying next tick`);
-      }
-    }
-  }
-}
-
-/**
- * Settles `claimed`/`running` rows left by a dead daemon process and, before
- * marking each one `orphaned`, salvages any dirty worktree.
- *
- * Found live after a host restart killed two workers mid-run, and again on
- * every package deploy that restarted while workers were live (#35): without
- * the salvage call the next attempt's `worktree remove --force` destroyed
- * uncommitted edits that had no other copy. Cap-kills already salvaged (#27);
- * this is the same call site for the restart path.
- *
- * Only the rows change. The issue keeps its in-progress label — that label is
- * the crash guard against double-dispatch, and deciding what a dead worker's
- * remains are worth (an open PR? a salvaged sha? a clean tree?) is the
- * orchestrator's drain-duty judgement, not something to automate here. The
- * rows also keep counting toward `maxAttemptsPerIssue`, so a loop of deaths
- * still escalates instead of retrying forever.
- *
- * `pushed-green` rows are deliberately left alone: they hold no process — they
- * are finished work waiting on a human merge, and they must keep occupying the
- * issue so a second attempt cannot land on a live PR. What eventually settles
- * them is {@link settlePushedGreen}, on the tick, by asking the tracker what
- * became of the PR — the one question a restart cannot answer by inference.
- */
-export async function reconcileOrphanedRuns(
-  store: Store,
-  project: string,
-  /**
-   * Resolves the privileged publisher for one orphaned run. Optional because a
-   * test driving the row transitions has no repo to publish to; production
-   * always passes it, and without it a salvaged WIP commit stays local — which
-   * is the half of #121 that reaches a human.
-   */
-  publish?: (run: RunRecord) => RunPublisher,
-): Promise<RunRecord[]> {
-  // Live runs only: `pushed-green` holds no process, so it cannot be orphaned by
-  // a process dying — it is finished work waiting on a human merge.
-  const stale = store.liveRuns(project);
-  const endedAt = Date.now();
-  for (const r of stale) {
-    // Salvage before the row flips: the worktree path is on the record, and
-    // salvageWip is a no-op for a missing/clean tree. The clause matches the
-    // cap-kill wording so triage reads the same either way, and the tree is
-    // kept because an orphan's remains are the orchestrator's drain-duty call.
-    const settlement =
-      r.worktree === ""
-        ? undefined
-        : await settleWorktree({
-            issue: r.issue,
-            attempt: r.attempt,
-            ending: "killed by a daemon restart",
-            worktree: r.worktree,
-            branch: r.branch,
-            // An orphan's tree is kept, so its commits are not about to be
-            // deleted — but a WIP salvage still has to reach GitHub, which is
-            // #121's whole point and is now the daemon's hop to make.
-            publish: publish?.(r),
-            tree: "keep",
-          });
-    store.updateRun(r.id, { state: "orphaned", endedAt, ...settlement?.patch });
-  }
-  return stale;
-}
 
 // ------------------------------------------------------------------- the daemon
 
@@ -6787,6 +5553,14 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
           onCall: () => store.bumpGhCalls?.(utcDay(), "daemon"),
           onRefusal: (at) => store.recordGhRefusal?.(at),
         }).issueSnapshot(issue),
+      // The body twin of `probeIssueIn`, for the dependency-graph cycle pass
+      // (#421): reads a reachable routed prerequisite's body through the same
+      // per-repo tracker/credential/accounting seams.
+      probeBodyIn: (ownerRepo, issue) =>
+        makeTracker({ ...project, tracker: { kind: "github", repo: ownerRepo } }, undefined, {
+          onCall: () => store.bumpGhCalls?.(utcDay(), "daemon"),
+          onRefusal: (at) => store.recordGhRefusal?.(at),
+        }).issueBody(issue),
       ...(verbPeerReader === undefined ? {} : { verbPeerReader }),
       verbActions,
     };