omp-conductor 0.17.1 → 0.18.0

package/src/setup-install.ts

@@ -30,12 +30,17 @@ import {
   type UpgradeScope,
 } from "./upgrade.ts";
 import {
+  graphConflictMessage,
   graphRepos,
   formatGraphSetup,
+  legacyReindexFiles,
+  legacyReindexNote,
   mcpEntry,
+  planGraphSetup,
   reindexScriptPath,
+  reindexUnitName,
   resolvePrereqs,
-  REINDEX_UNIT,
+  stagingConflict,
   unitPaths,
   writeGraphSetup,
   type GraphPrereqs,
@@ -131,16 +136,18 @@ function linuxOnly(deps: InstallDeps): string | undefined {
 }
 
 /**
- * Whether two files hold identical bytes. The "keep" side of setup-host.ts's
- * `actionFor`: a unit systemd already reads that matches what would be written
- * needs no reinstall. Reads can fail (permissions, vanished mid-flight) — a
- * read error is a mismatch, never silently "matches", because the whole point
- * is to make the plan only claim a unit install is redundant when it can see
- * the installed copy.
+ * Whether a file holds exactly the rendered bytes. The "keep" side of
+ * setup-host.ts's `actionFor`: a unit systemd already reads that matches what
+ * would be written needs no reinstall. Reads can fail (permissions, vanished
+ * mid-flight) — a read error is a mismatch, never silently "matches", because
+ * the whole point is to make the plan only claim a unit install is redundant
+ * when it can see the installed copy. Comparing against the rendered content
+ * rather than the staged file keeps the comparison read-only: staging now
+ * happens only after consent (#720), so nothing may be written to compare.
  */
-function sameFile(a: string, b: string): boolean {
+function sameContent(path: string, content: string): boolean {
   try {
-    return readFileSync(a, "utf8") === readFileSync(b, "utf8");
+    return readFileSync(path, "utf8") === content;
   } catch {
     return false;
   }
@@ -450,9 +457,10 @@ export interface GraphInstallOptions extends InstallDeps {
  * Staging and enabling alone installs a service that fails on every run: the
  * generated script runs under `set -euo pipefail` and `cd "<graphProject>"` as
  * its first act per repo, so a missing clone is a `cd` failure at 03:00 rather
- * than a graph. That is why `writeGraphSetup` already refused to call the old
- * install a finished job. So: prerequisites, then clones, then install, then
- * seed and verify — one preview, one confirm.
+ * than a graph. That is why staging was never allowed to call the install a
+ * finished job. So: prerequisites, then a conflict check, then clones, then
+ * install, then seed and verify — one preview, one confirm, and nothing
+ * staged before the confirm (#720).
  */
 export async function runGraphInstall(
   project: ProjectConfig,
@@ -494,7 +502,38 @@ export async function runGraphInstall(
     return { kind: "refused", reason: missing };
   }
 
-  const staged = writeGraphSetup(project, options.unitDir ?? SYSTEMD_UNIT_DIR);
+  const unitDir = options.unitDir ?? SYSTEMD_UNIT_DIR;
+  // The plan is computed eagerly — `planGraphSetup` renders every byte, so the
+  // prompt can print exactly what would be written and the unitsCurrent gate
+  // below can decide a re-run installs nothing. But rendering is read-only: no
+  // file is written here. Staging happens only after consent (#720), so the
+  // prompt's "stages once you confirm" is true of the staged tree when it is
+  // printed, and a declined run leaves every staged file byte-identical.
+  const plan = planGraphSetup(project, unitDir);
+  // Never overwrite another project's staged artefact: the stems derive from
+  // the project name, and two names can fold to one stem ("My Project" vs
+  // "my_project"), so an existing file's generated-for marker is checked
+  // before the consent prompt — a collision is refused before anything is
+  // asked, let alone written (#720).
+  const conflict = stagingConflict(project, [
+    plan.script.path,
+    plan.service.path,
+    plan.timer.path,
+    ...Object.values(unitPaths(project, unitDir)),
+  ]);
+  if (conflict !== undefined) {
+    const message = graphConflictMessage(conflict);
+    ui.notify(message, "error");
+    return { kind: "refused", reason: message };
+  }
+  // A host that ran the pre-#720 project-less version keeps its old files:
+  // their timer refreshes whichever project generated it last, forever. Name
+  // the remediation before the consent prompt — deleting files outside this
+  // command's own names is exactly how the overwrite happened in the first
+  // place, so it is host action, not install action.
+  const legacy = legacyReindexFiles();
+  if (legacy.length > 0) ui.notify(legacyReindexNote(legacy), "warning");
+
   const absent = repos.filter((r) => !existsSync(r.graphProject));
 
   // 2. Missing clones, as the operator. A root-owned index-only clone under the
@@ -507,17 +546,18 @@ export async function runGraphInstall(
   }));
 
   const blocked = linuxOnly(options);
-  const { service, timer } = unitPaths(options.unitDir ?? SYSTEMD_UNIT_DIR);
-  const from = unitPaths(stateDir());
-  // The units systemd already reads, compared to what staging just wrote — the
+  const stem = reindexUnitName(project);
+  const { service, timer } = unitPaths(project, unitDir);
+  // The units systemd already reads, compared to the rendered content — the
   // same distinction setup-host.ts draws between `installedAction` and
   // `service.action` (read the installed file, compare to the fresh content,
   // "keep" vs "update"). "Installed" is not enough: a green timer serving a
   // stale unit is the older bug, so when they differ the install runs. Only
   // when both units already match does the plan omit them — then just the
-  // outstanding clone and seed remain.
+  // outstanding clone and seed remain. Nothing is written to compare: staging
+  // is post-consent now, so the comparison is against the rendered bytes.
   const unitsCurrent =
-    blocked === undefined && sameFile(service, from.service) && sameFile(timer, from.timer);
+    blocked === undefined && sameContent(service, plan.service.content) && sameContent(timer, plan.timer.content);
   // 3. Install and enable, privileged. 4. Seed, in the SAME batch: the contract is
   //    one preview and one confirm, and a second confirm here also invented a
   //    third outcome — a declined seed — that neither the caller nor the
@@ -525,32 +565,52 @@ export async function runGraphInstall(
   const seed: PrivilegedStep[] =
     options.noSeed === true
       ? []
-      : [{ title: `seed the indexes (runs ${REINDEX_UNIT}.service once, minutes per repo)`, argv: ["systemctl", "start", `${REINDEX_UNIT}.service`] }];
+      : [{ title: `seed the indexes (runs ${stem}.service once, minutes per repo)`, argv: ["systemctl", "start", `${stem}.service`] }];
   const install: PrivilegedStep[] =
     blocked === undefined
       ? [
           ...(unitsCurrent
             ? []
             : [
-                { title: "install the reindex unit and timer", argv: ["install", "-m", "0644", from.service, from.timer, join(options.unitDir ?? SYSTEMD_UNIT_DIR, "")] },
+                { title: "install the reindex unit and timer", argv: ["install", "-m", "0644", plan.service.path, plan.timer.path, join(unitDir, "")] },
                 { title: "reload systemd", argv: ["systemctl", "daemon-reload"] },
-                { title: `enable ${REINDEX_UNIT}.timer`, argv: ["systemctl", "enable", "--now", `${REINDEX_UNIT}.timer`] },
+                { title: `enable ${stem}.timer`, argv: ["systemctl", "enable", "--now", `${stem}.timer`] },
               ]),
           ...seed,
         ]
       : [];
 
   if (blocked !== undefined) {
+    // A non-Linux host cannot run systemd, so staging IS the deliverable: the
+    // rendered files are written for the operator to copy to the box that will
+    // run them, and only the systemctl half is refused. There is no consent
+    // prompt on this path — nothing privileged to approve — so the write lands
+    // here, not in the (never reached) post-consent hook (#720, as #510).
+    const staged = writeGraphSetup(project, unitDir);
     ui.notify(`${blocked} ${service} and ${timer}`, "warning");
     return { kind: "staged", wrote: staged.written, reason: `${blocked} ${service}` };
   }
 
+  // What the post-consent staging actually wrote, surfaced by the outcomes
+  // that report it. Empty on a decline — the hook never ran.
+  let wrote: readonly string[] = [];
+  const beforeRun = async (): Promise<void> => {
+    // Consent has been given; this project's files may now land. Staging here —
+    // post-confirm, pre-step, under the same confirm that authorised the batch
+    // — is what makes the prompt's plan true of the staged tree when it is
+    // printed: a declined prompt never reaches this hook, so nothing is staged
+    // and a re-run still plans an install (#720). `writeGraphSetup`'s ownership
+    // backstop throws here with nothing written if a collision raced the
+    // pre-consent check.
+    wrote = writeGraphSetup(project, unitDir).written;
+  };
+
   const outcome = await runPrivileged([...clones, ...install], ui, {
     ...(options.privileged === undefined ? {} : { deps: options.privileged }),
     title: unitsCurrent ? "Clone the code-graph checkouts and seed them?" : "Clone, install and enable the code-graph timer?",
     answerKey: `install-code-graph.${project.name}`,
     preamble: [
-      `Staged: ${staged.written.join(", ")}.`,
+      `Stages ${[plan.script.path, plan.service.path, plan.timer.path].join(", ")} once you confirm — nothing is written before that.`,
       ...(clones.length === 0
         ? ["Every indexed clone already exists."]
         : [
@@ -561,8 +621,9 @@ export async function runGraphInstall(
       ...(unitsCurrent ? ["The reindex units are already installed and current — nothing to install."] : []),
       `Indexer: ${prereqs.indexer ?? "on PATH"}.`,
     ],
+    beforeRun,
   });
-  if (outcome.kind === "declined") return { kind: "declined", wrote: staged.written };
+  if (outcome.kind === "declined") return { kind: "declined", wrote };
   if (outcome.kind === "failed") {
     return { kind: "failed", reason: `${outcome.step.title} exited ${outcome.exitCode}` };
   }
@@ -571,10 +632,10 @@ export async function runGraphInstall(
   // answer: an unseeded graph is not usable until the timer first fires.
   if (options.noSeed === true) {
     ui.notify(
-      `Timer enabled; skipped the seeding run. The graph is NOT usable until ${REINDEX_UNIT}.timer first fires.`,
+      `Timer enabled; skipped the seeding run. The graph is NOT usable until ${stem}.timer first fires.`,
       "warning",
     );
-    return { kind: "installed", wrote: staged.written };
+    return { kind: "installed", wrote };
   }
 
   const health = await (options.probe ?? probeCodeGraph)(project);
@@ -583,13 +644,13 @@ export async function runGraphInstall(
     // Staged but not trusted. Reporting success here is how an operator learns
     // months later that no worker ever read an index.
     ui.notify(
-      [`Installed, but ${unhealthy.length} repo(s) did not verify: ${unhealthy.join(", ")}.`, "", staged.next].join("\n"),
+      [`Installed, but ${unhealthy.length} repo(s) did not verify: ${unhealthy.join(", ")}.`, "", plan.next].join("\n"),
       "error",
     );
     return { kind: "failed", reason: `unverified: ${unhealthy.join(", ")}` };
   }
   ui.notify(`Code graph installed and verified for ${repos.map((r) => r.name).join(", ")}.`, "info");
-  return { kind: "installed", wrote: staged.written };
+  return { kind: "installed", wrote };
 }
 
 /** The two prerequisites that make an enabled timer meaningful, or `undefined`. */
@@ -618,7 +679,7 @@ export function graphInstallable(project: ProjectConfig): GraphRepo[] {
   return graphRepos(project);
 }
 
-/** Where the reindex script lands, for the wizard's tail to name. */
-export function reindexScriptLocation(): string {
-  return reindexScriptPath();
+/** Where this project's reindex script lands, for the wizard's tail to name. */
+export function reindexScriptLocation(project: ProjectConfig): string {
+  return reindexScriptPath(project);
 }

package/src/setup-wizard.ts

@@ -93,6 +93,7 @@ import {
   POLICY_BRIEF_NAME,
   RELEASE_REQUIREMENT_CHOICES,
   REPORT_SCOPE_CHOICES,
+  REVIEW_STRICTNESS_CHOICES,
   SETUP_DEFAULTS,
   amendChoices,
   answersFromProject,
@@ -125,11 +126,16 @@ import {
   BASE_FRESHNESS,
   BEHIND_BASE_ACTIONS,
   DEFAULT_CAPS,
+  DEFAULT_REVIEW_MAX_ROUNDS,
+  DEFAULT_REVIEW_STRICTNESS,
   DENIED_RELEASE_GRANTS,
   DRAFT_POLICIES,
   RELEASE_REQUIREMENTS,
   INTERRUPT_CATEGORIES,
   RELEASE_SHAPES,
+  REVIEW_MAX_ROUNDS_MAX,
+  REVIEW_MAX_ROUNDS_MIN,
+  REVIEW_STRICTNESS,
   WEEKDAYS,
   type AuthorityHolder,
   type Caps,
@@ -142,6 +148,7 @@ import {
   type ReleaseRequirement,
   type ReportScopeChoice,
   type ResolvedGrants,
+  type ReviewPolicy,
 } from "./types.ts";
 import { withProgress } from "./ui/progress.ts";
 import type { WizardUi } from "./wizard-ui.ts";
@@ -1379,6 +1386,73 @@ const askAuthorityArea: AreaAsker = async (ui, a, _probes, discovered) => {
  * and `claim-only` means anything that can invoke it can start dispatch once
  * the live claim and poller pass.
  */
+/**
+ * How many review rounds one PR lifecycle may be returned at most — the hard
+ * bound against endless polishing (#678). Validated in the dialog against the
+ * same integer range the loader validates against, so an out-of-range answer
+ * is re-asked rather than written for the daemon to reject. The consequence of
+ * the ceiling is stated in the title: at it, the PR is left open and escalated
+ * once, never returned again.
+ */
+async function askReviewRounds(ui: WizardUi, current: number): Promise<number> {
+  // Bounded like askValid above: a dialog that cannot be escaped is worse than
+  // one that gives up and leaves the config alone. The `--answers` path
+  // matters here specifically — answersUi is a map, not a consumer, so every
+  // retry reads the same value and an out-of-range file used to recurse
+  // forever instead of failing closed (#678).
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const raw = await ask(
+      ui,
+      "review-max-rounds",
+      `Review rounds per PR lifecycle — an integer ${REVIEW_MAX_ROUNDS_MIN} to ${REVIEW_MAX_ROUNDS_MAX}; ` +
+        `at the ceiling the PR is left open and escalated once`,
+      String(current),
+    );
+    const value = Number(raw);
+    if (Number.isInteger(value) && value >= REVIEW_MAX_ROUNDS_MIN && value <= REVIEW_MAX_ROUNDS_MAX) {
+      return value;
+    }
+    ui.notify(
+      `Review rounds must be an integer between ${REVIEW_MAX_ROUNDS_MIN} and ${REVIEW_MAX_ROUNDS_MAX} ` +
+        `— shown the current value again.`,
+      "warning",
+    );
+  }
+  throw new Cancelled();
+}
+
+/**
+ * How green PRs are reviewed (#678), asked with the merge preconditions and
+ * the arming proof: they are the same kind of declared policy — a typed,
+ * mechanical boundary on what may happen to a PR — so they ride the same area.
+ *
+ * The three levels and their bars are shown before the select, with the
+ * recommended level marked, so an operator chooses between named thresholds
+ * rather than between three words. The select cursor opens on the current
+ * answer (the configured level on a re-run, the recommended default on a
+ * first run); the rounds are a validated integer within the same range the
+ * loader enforces.
+ */
+async function askReviewPolicy(ui: WizardUi, a: SetupAnswers): Promise<ReviewPolicy> {
+  ui.notify(
+    REVIEW_STRICTNESS.map((level) => `${level}${level === DEFAULT_REVIEW_STRICTNESS ? " (recommended)" : ""} — ${REVIEW_STRICTNESS_CHOICES[level]}`).join(
+      "\n",
+    ),
+    "info",
+  );
+  return {
+    strictness: await askLiteral(
+      ui,
+      "review-strictness",
+      "Review strictness for green PRs",
+      REVIEW_STRICTNESS,
+      REVIEW_STRICTNESS_CHOICES,
+      a.review.strictness,
+    ),
+    maxRounds: await askReviewRounds(ui, a.review.maxRounds),
+  };
+}
+
 const askPolicy: AreaAsker = async (ui, a) => ({
   ...a,
   policy: await askPolicyPreconditions(ui, a.policy, a.authority.release),
@@ -1390,6 +1464,7 @@ const askPolicy: AreaAsker = async (ui, a) => ({
     ARM_PROOF_CHOICES,
     a.armProof,
   ),
+  review: await askReviewPolicy(ui, a),
 });
 
 /** How a stuck run reaches a human, and who triages it when it does. */

package/src/setup.ts

@@ -39,12 +39,14 @@ import {
 import {
   clonePolicy,
   configPath,
+  DEFAULT_STATE_LABELS,
   defaultMirrorRoot,
   defaultWorkspaceRoot,
   resolveArmProof,
   resolveCaps,
   resolvePolicy,
   resolveReleaseGrants,
+  resolveReview,
   SCOPE_PRESETS,
   stateDir,
 } from "./config.ts";
@@ -57,8 +59,10 @@ import {
   DEFAULT_CAPS,
   DEFAULT_PROJECT_POLICY,
   DEFAULT_REPORT_SCOPE,
+  DEFAULT_REVIEW_POLICY,
   DENIED_RELEASE_GRANTS,
   RELEASE_SHAPES,
+  REVIEW_STRICTNESS,
   WEEKDAYS,
   type ArmProof,
   type BaseFreshness,
@@ -75,6 +79,8 @@ import {
   type ReleaseRequirement,
   type ReportScopeChoice,
   type ReportingPolicy,
+  type ReviewPolicy,
+  type ReviewStrictness,
   type Weekday,
   type WeeklyAvailability,
   type RepoTarget,
@@ -215,6 +221,13 @@ export interface SetupAnswers {
    * leave it to be defaulted by whichever reader gets there first.
    */
   armProof: ArmProof;
+  /**
+   * How green PRs are reviewed and returned (#678): the strictness level and
+   * the hard ceiling on review rounds per PR lifecycle. Always complete: the
+   * wizard asks about it in the policy area, so an answers object can never
+   * leave it to be defaulted by whichever reader gets there first.
+   */
+  review: ReviewPolicy;
   /**
    * Hand-edited recovery merge authorizations carried through setup unchanged.
    * The wizard never grants one; forgetting them during an unrelated amend
@@ -314,6 +327,8 @@ export const SETUP_DEFAULTS = {
   releaseGrants: DENIED_RELEASE_GRANTS,
   /** The strictest reading of the prose these conditions replaced (#129). */
   policy: DEFAULT_PROJECT_POLICY,
+  /** The recommended review strictness and its default ceiling (#678). */
+  review: DEFAULT_REVIEW_POLICY,
   /** The daemon runs its own triage session unless an operator already runs one. */
   orchestratorMode: "embedded",
 } as const;
@@ -405,6 +420,35 @@ export const ARM_PROOF_CHOICES: { readonly [K in ArmProof]: string } = {
   "claim-only": "anyone who can invoke the already-privileged `omp-conductor arm` command can start dispatch once the live claim and poller pass",
 };
 
+/**
+ * What each review strictness blocks, in the operator's words, and the single
+ * canonical phrasing of the three bars (#678).
+ *
+ * Mapped over the closed union for the reason {@link MERGE_DUTY} is: a fourth
+ * level fails to compile here instead of reaching a wizard with no question for
+ * it, an amend row that cannot describe it, and a rendered brief that shows it
+ * blank. Each sentence is self-contained — "Low's bar" would reference prose
+ * the brief may not be rendering — and it is the *same* text the wizard shows
+ * one level at a time and the composed orchestrator brief carries for the
+ * configured level, so the definition an operator chose is the threshold a
+ * session enforces.
+ *
+ * The two consumers read this map rather than their own prose: the setup
+ * dialog explains every level from it, and {@link reviewDuty} renders the
+ * effective one from it. "One canonical implementation, not duplicated prose
+ * branches" is this object.
+ */
+export const REVIEW_STRICTNESS_CHOICES: { readonly [K in ReviewStrictness]: string } = {
+  low: "correctness, security, data-loss or explicit acceptance-criteria failures — anything else stays a review comment",
+  medium:
+    "correctness, security, data-loss or explicit acceptance-criteria failures, plus material maintainability or " +
+    "reliability defects likely to become incidents within six months — anything else stays a review comment",
+  high:
+    "correctness, security, data-loss or explicit acceptance-criteria failures, plus material maintainability or " +
+    "reliability defects likely to become incidents within six months, plus concrete quality defects — never " +
+    "subjective style churn or unbounded refactoring",
+};
+
 export const RELEASE_REQUIREMENT_CHOICES: { readonly [K in ReleaseRequirement]: string } = {
   "runs-settled": "every run of the released repo actually merged, not merely reached a green PR",
   "fleet-runs-settled": "every run in the project actually merged — suite-wide strictness for shapes that consume several repos",
@@ -465,6 +509,34 @@ export const MERGE_DUTY: { readonly [K in ProjectConfig["authority"]["merge"]]:
     "  one is a hard boundary, not a preference.",
 };
 
+/**
+ * Duty 1's review-return contract, worded from `project.review` (#678).
+ *
+ * One canonical implementation rather than prose branches in the template: the
+ * configured level's bar is the same {@link REVIEW_STRICTNESS_CHOICES} text
+ * the setup dialog explains each level with, and the ceiling is the configured
+ * number — so the strictness an operator chose in setup and the threshold this
+ * session enforces cannot diverge. The paragraph names `conductor_pr_review`
+ * (the #677 verb) as the only return path and states the three ceiling
+ * behaviours: leave the PR open, record the unresolved findings, escalate once.
+ */
+export function reviewDuty(p: ProjectConfig): string {
+  const { strictness, maxRounds } = resolveReview(p);
+  return (
+    "\n" +
+    "**Review policy:** before you merge (or settle) a green PR, review it at\n" +
+    `this project's strictness. The level is **${strictness}**: ` +
+    `${REVIEW_STRICTNESS_CHOICES[strictness]}. ` +
+    "`conductor_pr_review` is the verb for findings at or above that bar, and\n" +
+    "for nothing else — anything below it stays a review comment on the PR,\n" +
+    "never a return. Every corrected head gets a fresh review, up to a hard\n" +
+    `ceiling of ${maxRounds} ${maxRounds === 1 ? "round" : "rounds"} per PR lifecycle, visible in ` +
+    "`omp-conductor status` as `review-revision N`. At the ceiling\n" +
+    "`conductor_pr_review` refuses: leave the PR open, record the unresolved\n" +
+    "findings, and escalate once — never a further round."
+  );
+}
+
 /**
  * The Promotion paragraph, worded from `authority.promotion`.
  *
@@ -901,7 +973,7 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
     name: a.projectName,
     tracker: { kind: "github", repo: a.trackerRepo },
     queueLabel: a.queueLabel,
-    stateLabels: { ...a.stateLabels },
+    stateLabels: { ...a.stateLabels, backlog: DEFAULT_STATE_LABELS.backlog },
     routing: { labelPrefix: a.routingLabelPrefix, repos },
     caps,
     ...(a.workerModel !== undefined && a.workerModel.trim().length > 0
@@ -928,6 +1000,10 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
     // policy has a line in the file to point at — and the recovery playbook
     // can read which proof the project opted into (#613).
     arm: { proof: a.armProof },
+    // Written out in full for the same reason as `arm`: the file then carries
+    // the strictness and the ceiling an operator chose, without anyone having
+    // to know a migration rule (#678).
+    review: { ...a.review },
     ...(a.recoveryMerges === undefined
       ? {}
       : { recoveryMerges: a.recoveryMerges.map((entry) => ({ ...entry })) }),
@@ -1018,6 +1094,10 @@ export function defaultAnswers(projectName: string, opts: { added?: boolean } =
     // The strict reading, matching the loader's absent-key default: a project
     // that never answered keeps today's authenticated challenge round-trip.
     armProof: DEFAULT_ARM_PROOF,
+    // First-run default: the recommended strictness and its ceiling, so a
+    // fresh project opens on the answer the issue recommends — and the loader
+    // materialises the same value for a config that has no key at all.
+    review: { ...SETUP_DEFAULTS.review },
     orchestratorMode: SETUP_DEFAULTS.orchestratorMode,
     reportScope: SETUP_DEFAULT_REPORT_SCOPE,
     writeOrchestratorBrief: false,
@@ -1117,6 +1197,10 @@ export function answersFromProject(p: ProjectConfig): SetupAnswers {
     // The loader materialises `arm` complete, so this is the answer the project
     // actually has — never a default guessed at the amend prompt.
     armProof: resolveArmProof(p),
+    // Same reason as `armProof`: the loader materialises `review` complete, so
+    // a re-run preserves the configured strictness and ceiling rather than
+    // opening on a default the operator already answered.
+    review: resolveReview(p),
     orchestratorMode: p.escalation.orchestrator,
     reportScope: reportScopeFromPolicy(p.reporting),
     writeOrchestratorBrief: false,
@@ -1184,6 +1268,7 @@ function briefVarsForProject(p: ProjectConfig): Record<string, string> {
     QUEUE_LABEL: p.queueLabel,
     RELEASES_DEFAULT: RELEASES_DEFAULTS[`${p.authority.merge}/${p.authority.release}`],
     MERGE_DUTY: MERGE_DUTY[p.authority.merge],
+    REVIEW_DUTY: reviewDuty(p),
     PROMOTION_DUTY: PROMOTION_DUTIES[p.authority.promotion ?? DEFAULT_AUTHORITY.promotion],
     POLICY_SOURCE: policySourceLine(p),
   };
@@ -1693,6 +1778,9 @@ export function summarisePlan(
     `  environments ${a.policy.release.environments.join(", ") || "none declared — every deploy target is refused"}`,
   );
 
+  lines.push("", "review", `  strictness     ${a.review.strictness} — ${REVIEW_STRICTNESS_CHOICES[a.review.strictness]}`);
+  lines.push(`  max rounds/PR  ${a.review.maxRounds} — at the ceiling the PR is left open, the findings recorded, and it is escalated once`);
+
   const reporting = project.reporting as ReportingPolicy;
   const briefPath = orchestratorBriefPath(a);
   lines.push(
@@ -1909,16 +1997,18 @@ export const AMEND_AREAS: {
   },
   policy: {
     name: "merge & release preconditions",
-    asks: "the checks, base freshness, draft rule and behind-base action for a merge, then what a release requires and what it ships",
+    asks: "the checks, base freshness, draft rule and behind-base action for a merge, then what a release requires and what it ships — and how green PRs are reviewed, and how many rounds a PR may be returned",
     describe: (p) => {
       const policy = resolvePolicy(p);
+      const review = resolveReview(p);
       // Counted rather than listed: this row is elided at 96 characters, and the
       // full table is in the plan summary the consent screen shows next.
       return (
         `merge: ${policy.merge.requiredChecks.length === 0 ? "every check" : `${policy.merge.requiredChecks.length} check(s)`}, ` +
         `base ${policy.merge.baseFreshness}, drafts ${policy.merge.drafts}, behind → ${policy.merge.whenBehindBase}; ` +
         `release: ${policy.release.requires.length} must-land, ${policy.release.artefacts.length} artefact(s), ` +
-        `${policy.release.environments.length} env(s)`
+        `${policy.release.environments.length} env(s); ` +
+        `review ${review.strictness} ×${review.maxRounds}`
       );
     },
   },

package/src/status-render.ts

@@ -22,7 +22,7 @@ import type { DaemonStop } from "./types.ts";
 import { settlementFlagSummary } from "./diff-flags.ts";
 import type { CodeGraphHealth } from "./graph-health.ts";
 import { formatDigestBacklog, formatOpenReports } from "./reports.ts";
-import { formatOrchestratorDown } from "./orchestrator-down.ts";
+import { formatDownDuration, formatOrchestratorDown } from "./orchestrator-down.ts";
 import { planUsageLine } from "./usage.ts";
 import { SYSTEMD_UNIT, type UnitOwnership } from "./lifecycle.ts";
 import type { WorkerPausePhase } from "./worker.ts";
@@ -32,12 +32,12 @@ import {
   formatDispatchSummary,
   formatFreezes,
   formatReleaseGrants,
-  formatSalvagedRuns,
   isPaused,
   pausedAt,
   pauseProvenance,
   type StatusSnapshot,
 } from "./daemon.ts";
+import { formatQuarantinedRuns, formatSalvagedRuns } from "./settlement.ts";
 
 // layered status
 // ---------------------------------------------------------------------------
@@ -405,6 +405,13 @@ function formatProjectBody(
     `  continuations      ${s.caps.maxContinuationsPerIssue}`,
     "",
     ...formatReleaseGrants(s.releaseGrants),
+    // The effective review policy (#678), read from the same snapshot surface
+    // as the grants: the level is what Duty 1 judges findings against, and the
+    // ceiling is its hard bound — an orchestrator reading `review-revision N`
+    // below has to see both without opening the config.
+    "review",
+    `  strictness       ${s.review.strictness}`,
+    `  max rounds/PR    ${s.review.maxRounds}`,
     "",
     formatDispatchSummary(s.dispatch),
     "",
@@ -419,16 +426,30 @@ function formatProjectBody(
       // a failure and from an ordinary continuation, with the round number
       // from the durable revision row (#692). The live pause overlay still
       // wins: an operator pause is the newer fact about the same session.
+      const paused = phase === "pausing" || phase === "paused";
       const round = s.reviewRounds?.[r.id];
-      const state =
-        phase === "pausing" || phase === "paused"
-          ? phase
-          : round !== undefined
-            ? `review-revision ${round}`
-            : r.state;
+      const state = paused
+        ? phase
+        : round !== undefined
+          ? `review-revision ${round}`
+          : r.state;
+      // Turn rate (#730): a stalled run and a fast one used to render
+      // identically as a bare turn count. The rate is the lifetime average
+      // over the elapsed shown — the snapshot carries no checkpoint from
+      // which a recent-interval rate could be derived — so it is labelled
+      // `avg`, and `elapsed` is elapsed since claim, never "remaining wall
+      // clock": a paused worker banks its budget, which the snapshot cannot
+      // know. A paused run gets neither number, because its elapsed includes
+      // banked pause time and its state already says `paused`.
+      const elapsedMs = Math.max(0, now - r.startedAt);
+      const progress = paused
+        ? ""
+        : `  ${formatDownDuration(elapsedMs)} elapsed  ${(
+            (r.turns * 60_000) / Math.max(elapsedMs, 1_000)
+          ).toFixed(1)} turns/min avg`;
       lines.push(
         `  #${r.issue}  ${r.repo}  ${state}  attempt ${r.attempt}  ` +
-          `${r.turns}/${r.maxTurns} turns  ${r.spendUsd.toFixed(2)}  ${r.branch}` +
+          `${r.turns}/${r.maxTurns} turns${progress}  ${r.spendUsd.toFixed(2)}  ${r.branch}` +
           (r.prUrl ? `  ${r.prUrl}` : ""),
       );
       // The orchestrator's Duty 1 reads this command, and a flagged run's
@@ -441,6 +462,7 @@ function formatProjectBody(
   lines.push(...formatBaseHealth(s.baseHealth));
   lines.push(...formatFreezes(s.freezes));
   lines.push(...formatSalvagedRuns(s.salvagedRuns));
+  lines.push(...formatQuarantinedRuns(s.quarantinedRuns));
   lines.push(...formatOpenReports(s.openReports));
   lines.push(...formatDigestBacklog(s.digestBacklog));
   if (s.liveWorkers > 0) {