omp-conductor 0.17.1 → 0.18.1

package/src/store.ts

@@ -11,7 +11,7 @@
 
 import { Database } from "bun:sqlite";
 import { randomUUID } from "node:crypto";
-import { existsSync, mkdirSync, rmSync } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, rmSync, unlinkSync } from "node:fs";
 import { dirname, join } from "node:path";
 
 import { backupTimestamp, publishTempFile } from "./backups.ts";
@@ -27,10 +27,12 @@ import { DECISION_TTL_MS, DEFAULT_CAPS, DIGEST_BACKLOG_LIMIT } from "./types.ts"
 const DECISION_WATCH_NEVER_EXPIRES = Number.MAX_SAFE_INTEGER;
 import { dispatchInfra, neverStarted } from "./failure-class.ts";
 import type {
+  AdmissionHoldReason,
   BaseFreeze,
   BaseHealth,
   DecisionDraft,
   FailureClass,
+  FileLane,
   DecisionRecord,
   DecisionState,
   DigestBacklog,
@@ -41,6 +43,10 @@ import type {
   FrictionKind,
   FrictionObservation,
   FrictionSignal,
+  GraphToolsObservation,
+  GroomingDraft,
+  GroomingRecord,
+  GroomingVerdict,
   HistoricalInfraCandidate,
   HeldNotice,
   InterruptCategory,
@@ -62,6 +68,7 @@ import type {
   ReportRecord,
   RecoveryAction,
   ReviewReason,
+  ReviewRevisionEnqueue,
   ReviewRevisionOutcome,
   ReviewRevisionRecord,
   RunPatch,
@@ -120,6 +127,18 @@ function isFrictionHoldReason(reason: string): reason is FrictionAdmissionReason
   return FRICTION_HOLD_REASONS.has(reason as FrictionAdmissionReason);
 }
 
+/**
+ * The admission hold reasons the grooming store persists as `blocked` verdicts
+ * (#735): the mechanical holds that will clear by themselves once the lane
+ * frees or the dependency closes. Every other hold reason is flow control of
+ * the moment (capacity, spend, parking) rather than durable per-issue
+ * inventory, so admission's reconcile records and clears exactly these.
+ */
+const BLOCKED_GROOMING_HOLDS: Record<string, true> = {
+  "file-lane": true,
+  "depends-on": true,
+};
+
 /**
  * Allowlist for `updateRun`'s dynamic SET clause. Column names cannot be bound
  * as parameters, so they are matched against this table rather than
@@ -146,6 +165,8 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   autoRetryCount: true,
   autoCompactionCount: true,
   sessionFile: true,
+  resumedFromRunId: true,
+  lane: true,
   prUrl: true,
   headSha: true,
   mergeSha: true,
@@ -155,6 +176,7 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   salvageSha: true,
   salvageError: true,
   salvageAckAt: true,
+  quarantineDetail: true,
   startedAt: true,
   endedAt: true,
   lastError: true,
@@ -164,6 +186,9 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   recoveryAction: true,
   recoveredAt: true,
   model: true,
+  graphTools: true,
+  failureCharges: true,
+  continuationCharges: true,
 };
 
 /** Everything SQLite will accept from us. */
@@ -191,6 +216,8 @@ interface RunRow {
   autoRetryCount: number | null;
   autoCompactionCount: number | null;
   sessionFile: string | null;
+  resumedFromRunId: string | null;
+  lane: string | null;
   prUrl: string | null;
   headSha: string | null;
   mergeSha: string | null;
@@ -200,6 +227,7 @@ interface RunRow {
   salvageSha: string | null;
   salvageError: string | null;
   salvageAckAt: number | null;
+  quarantineDetail: string | null;
   startedAt: number;
   endedAt: number | null;
   lastError: string | null;
@@ -209,6 +237,9 @@ interface RunRow {
   recoveryAction: string | null;
   recoveredAt: number | null;
   model: string | null;
+  graphTools: string | null;
+  failureCharges: number | null;
+  continuationCharges: number | null;
 }
 
 /** The `base_health` table exactly as SQLite hands it back. */
@@ -436,6 +467,27 @@ function toIntakeItem(row: IntakeRow): IntakeItem {
   return item;
 }
 
+/** The `grooming` table exactly as SQLite hands it back (#735). */
+interface GroomingRow {
+  project: string;
+  issue: number;
+  verdict: string;
+  reason: string;
+  evidence: string;
+  recordedAt: number;
+}
+
+function toGrooming(row: GroomingRow): GroomingRecord {
+  return {
+    project: row.project,
+    issue: row.issue,
+    verdict: row.verdict as GroomingVerdict,
+    reason: row.reason,
+    evidence: row.evidence,
+    recordedAt: row.recordedAt,
+  };
+}
+
 /** The `orchestrator_incidents` table exactly as SQLite hands it back (#288). */
 interface OrchestratorIncidentRow {
   project: string;
@@ -517,6 +569,8 @@ CREATE TABLE IF NOT EXISTS runs (
   autoRetryCount INTEGER,
   autoCompactionCount INTEGER,
   sessionFile TEXT,
+  resumedFromRunId TEXT,
+  lane        TEXT,
   prUrl       TEXT,
   headSha     TEXT,
   mergeSha    TEXT,
@@ -534,7 +588,10 @@ CREATE TABLE IF NOT EXISTS runs (
   failureClass TEXT,
   recoveryAction TEXT,
   recoveredAt INTEGER,
-  model       TEXT
+  model       TEXT,
+  graphTools  TEXT,
+  failureCharges INTEGER,
+  continuationCharges INTEGER
 );
 CREATE INDEX IF NOT EXISTS runs_project_issue ON runs (project, issue);
 CREATE INDEX IF NOT EXISTS runs_project_state ON runs (project, state);
@@ -780,6 +837,15 @@ CREATE TABLE IF NOT EXISTS review_revisions (
 );
 CREATE INDEX IF NOT EXISTS review_revisions_pending
   ON review_revisions (project, dispatchedAt, runId);
+-- One pending revision per run, enforced in the schema itself: the
+-- schema-level backstop for the enqueue transaction (#786). The transaction
+-- begins IMMEDIATE, so two connections serialize on the write lock before
+-- either reads — this index makes a second pending row for one run
+-- structurally impossible even if some other write path ever bypassed that
+-- transaction.
+CREATE UNIQUE INDEX IF NOT EXISTS review_revisions_one_pending_per_run
+  ON review_revisions (runId)
+  WHERE dispatchedAt IS NULL AND settledAt IS NULL;
 
 -- Questions the orchestrator has put to its operator, and their answers (#136).
 --
@@ -794,6 +860,12 @@ CREATE INDEX IF NOT EXISTS review_revisions_pending
 -- stored as the raw string an operator or session wrote, parsed on read. Once
 -- met, 'conditionMetAt' is what turns a parked question into one the tick digest
 -- pushes at the session.
+--
+-- 'conditionHead' binds a pr-checks-green / pr-review-ready verdict to the
+-- exact PR head it was observed at (#808). The checks surface answers per
+-- commit, so once the head changes the old verdict says nothing about the new
+-- head: the evaluator clears the met state on a head move and the row returns
+-- to pending.
 CREATE TABLE IF NOT EXISTS decisions (
   id             TEXT    PRIMARY KEY,
   project        TEXT    NOT NULL,
@@ -804,12 +876,32 @@ CREATE TABLE IF NOT EXISTS decisions (
   expiresAt      INTEGER NOT NULL,
   condition      TEXT,
   conditionMetAt INTEGER,
+  conditionHead  TEXT,
   state          TEXT    NOT NULL,
   resolvedAt     INTEGER,
   resolution     TEXT
 );
 CREATE INDEX IF NOT EXISTS decisions_project_state ON decisions (project, state);
 
+-- One issue's current grooming verdict (#735), the durable answer to "has
+-- this been groomed, and what was decided" that the tick reads instead of
+-- re-deriving why a runway cannot move. Admission's lane/dependency holds land
+-- here as blocked (self-clearing on the next pass when the hold no longer
+-- applies); #679's scout loop writes promotable and considered into the
+-- same table. Keyed by project + issue, one row per issue, replaced in place.
+-- Deliberately separate from decisions (operator questions, 7-day expiry) and
+-- material_events (append-only digest outbox).
+CREATE TABLE IF NOT EXISTS grooming (
+  project    TEXT    NOT NULL,
+  issue      INTEGER NOT NULL CHECK (issue > 0),
+  verdict    TEXT    NOT NULL,
+  reason     TEXT    NOT NULL,
+  evidence   TEXT    NOT NULL,
+  recordedAt INTEGER NOT NULL CHECK (recordedAt >= 0),
+  PRIMARY KEY (project, issue)
+);
+CREATE INDEX IF NOT EXISTS grooming_project_verdict ON grooming (project, verdict);
+
 -- GitHub rate-limit refusals the tracker observed (#198). Written by the
 -- daemon's tracker hook, not polled, so status can show what GitHub actually
 -- refused next to the polled budget that might still look healthy. Only one
@@ -913,12 +1005,14 @@ CREATE INDEX IF NOT EXISTS daemon_stops_at ON daemon_stops (at);
 function toSql(value: unknown): SqlValue {
   if (value === undefined || value === null) return null;
   if (typeof value === "boolean") return value ? 1 : 0;
-  // `RunRecord.settlementFlags` is the only structured field on a run row, and
-  // it is JSON in one TEXT column rather than a table of its own: the flags are
-  // 1:1 with the run, written once at settlement, and never read except beside
-  // the row they belong to. A join per `status` render would buy a query nobody
-  // makes (#128).
-  if (Array.isArray(value)) return JSON.stringify(value);
+  // `RunRecord.settlementFlags` and `RunRecord.lane` are the structured fields
+  // on a run row, and each is JSON in one TEXT column rather than a table of
+  // its own: the flags are 1:1 with the run, written once at settlement, and
+  // never read except beside the row they belong to (#128); the lane is the
+  // enforced declaration, written once at dispatch and read by the admission
+  // gate beside the row that owns it (#744). A join per read would buy a query
+  // nobody makes.
+  if (typeof value === "object") return JSON.stringify(value);
   return value as SqlValue;
 }
 
@@ -971,6 +1065,55 @@ function toSettlementFlags(text: string): SettlementFlag[] | undefined {
   }
 }
 
+/**
+ * The persisted file lane out of its JSON column, or undefined for anything
+ * that is not a `FileLane`-shaped object. Same defensive posture as
+ * {@link toSettlementFlags}: a row hand-edited or written by a future version
+ * drops its lane rather than throwing, and a dropped lane reads as "no
+ * declaration" — the fail-open admission, never a refusal (#744).
+ */
+function toLane(text: string): FileLane | undefined {
+  try {
+    const value: unknown = JSON.parse(text);
+    const files = (value as { files?: unknown }).files;
+    const source = (value as { source?: unknown }).source;
+    const at = (value as { at?: unknown }).at;
+    if (
+      typeof value !== "object" ||
+      value === null ||
+      !Array.isArray(files) ||
+      files.some((file) => typeof file !== "string") ||
+      typeof source !== "string" ||
+      (at !== "body" && typeof at !== "number")
+    ) {
+      return undefined;
+    }
+    return value as FileLane;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * A run's graph-tools session observation out of its JSON column, or
+ * undefined for anything that is not a `{ present, at }` object. Same
+ * defensive posture as {@link toSettlementFlags}: a row hand-edited or written
+ * by a future version drops its observation rather than throwing, and a
+ * dropped observation reads as "no observation recorded" — never "graph tools
+ * absent", which is the `present: false` truth value (#726).
+ */
+function toGraphTools(text: string): GraphToolsObservation | undefined {
+  try {
+    const value: unknown = JSON.parse(text);
+    const present = (value as { present?: unknown } | null | undefined)?.present;
+    const at = (value as { at?: unknown } | null | undefined)?.at;
+    if (typeof present !== "boolean" || typeof at !== "number") return undefined;
+    return { present, at };
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * A NULL column becomes an absent property rather than an `undefined` one, so
  * a record read back out of the store deep-equals the one that went in.
@@ -991,6 +1134,11 @@ function toRecord(row: RunRow): RunRecord {
     startedAt: row.startedAt,
   };
   if (row.sessionFile !== null) record.sessionFile = row.sessionFile;
+  if (row.resumedFromRunId !== null) record.resumedFromRunId = row.resumedFromRunId;
+  if (row.lane !== null) {
+    const lane = toLane(row.lane);
+    if (lane !== undefined) record.lane = lane;
+  }
   if (row.prUrl !== null) record.prUrl = row.prUrl;
   if (row.headSha !== null) record.headSha = row.headSha;
   if (row.mergeSha !== null) record.mergeSha = row.mergeSha;
@@ -1000,6 +1148,7 @@ function toRecord(row: RunRow): RunRecord {
   if (row.salvageSha !== null) record.salvageSha = row.salvageSha;
   if (row.salvageError !== null) record.salvageError = row.salvageError;
   if (row.salvageAckAt !== null) record.salvageAckAt = row.salvageAckAt;
+  if (row.quarantineDetail !== null) record.quarantineDetail = row.quarantineDetail;
   if (row.endedAt !== null) record.endedAt = row.endedAt;
   if (row.lastError !== null) record.lastError = row.lastError;
   if (row.settlementFlags !== null) {
@@ -1021,7 +1170,15 @@ function toRecord(row: RunRow): RunRecord {
   if (row.failureClass !== null) record.failureClass = row.failureClass as FailureClass;
   if (row.recoveryAction !== null) record.recoveryAction = row.recoveryAction as RecoveryAction;
   if (row.recoveredAt !== null) record.recoveredAt = row.recoveredAt;
+  if (row.failureCharges !== null && row.failureCharges > 0) record.failureCharges = row.failureCharges;
+  if (row.continuationCharges !== null && row.continuationCharges > 0) {
+    record.continuationCharges = row.continuationCharges;
+  }
   if (row.model !== null) record.model = row.model;
+  if (row.graphTools !== null) {
+    const observed = toGraphTools(row.graphTools);
+    if (observed !== undefined) record.graphTools = observed;
+  }
   return record;
 }
 
@@ -1085,6 +1242,7 @@ interface DecisionRow {
   expiresAt: number;
   condition: string | null;
   conditionMetAt: number | null;
+  conditionHead: string | null;
   state: string;
   resolvedAt: number | null;
   resolution: string | null;
@@ -1107,6 +1265,7 @@ function toDecision(row: DecisionRow): DecisionRecord {
   if (row.blocks !== null) record.blocks = row.blocks;
   if (row.condition !== null) record.condition = row.condition;
   if (row.conditionMetAt !== null) record.conditionMetAt = row.conditionMetAt;
+  if (row.conditionHead !== null) record.conditionHead = row.conditionHead;
   if (row.resolvedAt !== null) record.resolvedAt = row.resolvedAt;
   if (row.resolution !== null) record.resolution = row.resolution;
   return record;
@@ -1318,9 +1477,13 @@ export function vacuumInto(source: string, target: string): void {
  * A fresh, restorable copy of the store at `source`, published under `destDir`
  * with the same temp-then-atomic-publish convention as the config backups.
  *
+ * The stem carries `at` (default now) so the filename's timestamp is the
+ * snapshot's logical instant — the cadence passes its tick time, keeping the
+ * name, the day marker and the retention ordering in one timeline.
+ *
  * Returns the published snapshot path.
  */
-export function snapshotDb(source: string, destDir: string): string {
+export function snapshotDb(source: string, destDir: string, at: number = Date.now()): string {
   if (source === ":memory:") throw new Error("cannot snapshot an in-memory store");
   if (!existsSync(source)) {
     throw new Error(`cannot snapshot ${source}: the store does not exist`);
@@ -1334,7 +1497,34 @@ export function snapshotDb(source: string, destDir: string): string {
     rmSync(temporary, { force: true });
     throw err;
   }
-  return publishTempFile(temporary, destDir, `${DB_SNAPSHOT_STEM}-${backupTimestamp()}`);
+  return publishTempFile(temporary, destDir, `${DB_SNAPSHOT_STEM}-${backupTimestamp(at)}`);
+}
+
+/**
+ * How many conductor.db snapshots the daemon's daily cadence keeps — a week
+ * of ledger history at one snapshot per day. Deliberately a fixed count, not
+ * an age or space policy: the store's ledger is append-only and the issue
+ * forbids inventing a fleet-wide retention policy, so pruning is
+ * configured-count only (#289).
+ */
+export const DB_SNAPSHOT_RETENTION = 7;
+
+/**
+ * Prune a snapshot directory to the newest `keep` conductor.db snapshots.
+ *
+ * Snapshot stems embed the publish timestamp (`YYYY-MM-DDTHH-MM-SS…`), so
+ * lexicographic order is chronological; only files named with the shared
+ * `DB_SNAPSHOT_STEM` prefix are considered, never unrelated backups next to
+ * them. Idempotent: a directory already at or under the bound removes
+ * nothing. Returns the number of files removed.
+ */
+export function pruneDbSnapshots(dir: string, keep: number): number {
+  const names = readdirSync(dir)
+    .filter((name) => name.startsWith(DB_SNAPSHOT_STEM))
+    .sort();
+  const stale = names.length > keep ? names.slice(0, names.length - keep) : [];
+  for (const name of stale) unlinkSync(join(dir, name));
+  return stale.length;
 }
 
 /** The UTC calendar day (`YYYY-MM-DD`) a moment falls on — the partition key
@@ -1421,6 +1611,14 @@ export function openStore(dbPath: string): Store {
       db.exec(`ALTER TABLE runs ADD COLUMN ${name} ${type}`);
     }
   }
+  // Rows written before #737 were never asked whether their tree was
+  // quarantined, and a NULL means exactly that: the pre-quarantine passes
+  // reaped the same trees they always had, so nothing before this release
+  // needs backfilling — the column starts null and only a post-release pass
+  // that actually refuses a broken store writes it.
+  if (!columns.some((column) => column.name === "quarantineDetail")) {
+    db.exec("ALTER TABLE runs ADD COLUMN quarantineDetail TEXT");
+  }
   // Rows written before the settlement audit existed (#128) were never audited,
   // so a NULL here means "no audit ran" and reads the same as "found nothing".
   // That conflation is deliberate and harmless: the flags are advisory, and no
@@ -1455,6 +1653,29 @@ export function openStore(dbPath: string): Store {
   if (!columns.some((column) => column.name === "model")) {
     db.exec("ALTER TABLE runs ADD COLUMN model TEXT");
   }
+  // The code-graph session observation (#726): rows written before the column
+  // existed were never observed, so NULL is the honest reading of "no
+  // observation recorded" — never "graph tools absent", which is the
+  // `present: false` truth value of a run that did record one.
+  if (!columns.some((column) => column.name === "graphTools")) {
+    db.exec("ALTER TABLE runs ADD COLUMN graphTools TEXT");
+  }
+  // Resume provenance (#567): rows written before #564 landed were never
+  // resumed, so NULL is the honest reading of "no resume happened" — never
+  // "resumed from unknown". No backfill: the identity existed only in the
+  // dispatch decision, and deriving it now would guess at history.
+  if (!columns.some((column) => column.name === "resumedFromRunId")) {
+    db.exec("ALTER TABLE runs ADD COLUMN resumedFromRunId TEXT");
+  }
+  // The declared file lane (#744): rows written before the column existed were
+  // admitted before the declaration was persisted, so NULL is the honest
+  // reading of "no declaration survives on this row" — the same fail-open as
+  // a run admitted without a lane today. No backfill: re-parsing issue bodies
+  // now would re-derive a snapshot admission no longer enforces, which is
+  // exactly the #288 shape the gate exists to avoid.
+  if (!columns.some((column) => column.name === "lane")) {
+    db.exec("ALTER TABLE runs ADD COLUMN lane TEXT");
+  }
   // The count of in-session provider 429s a run recorded was first written by
   // the worker (#573). Rows predating the column are NULL, which is the honest
   // reading: the count was not recorded, so the classifier must not treat the
@@ -1479,6 +1700,18 @@ export function openStore(dbPath: string): Store {
       db.exec(`ALTER TABLE runs ADD COLUMN ${name} ${type}`);
     }
   }
+  // The preserved budget charges (#795 review round 2): rows written before the
+  // columns existed were never returned for revision from a terminal state, so
+  // NULL is the honest reading of "no review claim preserved a charge on this
+  // row", and the counters treat it as zero.
+  for (const [name, type] of [
+    ["failureCharges", "INTEGER"],
+    ["continuationCharges", "INTEGER"],
+  ] as const) {
+    if (!columns.some((column) => column.name === name)) {
+      db.exec(`ALTER TABLE runs ADD COLUMN ${name} ${type}`);
+    }
+  }
   // Existing held-notice rows predate exact digest ownership (#274). A NULL
   // report id is truthful for already-digested history and means "still owed"
   // only while digestedAt is also NULL.
@@ -1521,6 +1754,14 @@ export function openStore(dbPath: string): Store {
   if (!decisionColumns.some((column) => column.name === "kind")) {
     db.exec("ALTER TABLE decisions ADD COLUMN kind TEXT NOT NULL DEFAULT 'question'");
   }
+  // The head binding (#808): rows written before it existed — met or not —
+  // carry no binding and read back without one. Nothing is backfilled: fabricating
+  // a head for an observation made before heads were recorded would be guessing
+  // at history. The evaluator re-binds such a row on the next pass from a live
+  // read, never from a migration guess.
+  if (!decisionColumns.some((column) => column.name === "conditionHead")) {
+    db.exec("ALTER TABLE decisions ADD COLUMN conditionHead TEXT");
+  }
 
   // One-time repair, and the reason it lives here rather than in the classifier:
   // a turn-0 environment fault that was ALREADY classified `unknown` and
@@ -1614,12 +1855,15 @@ export function openStore(dbPath: string): Store {
   const insertRun = db.query<unknown, SqlValue[]>(
     `INSERT INTO runs (
        id, project, issue, repo, branch, worktree, state, attempt, turns,
-       maxTurns, spendUsd, sessionFile, prUrl, headSha, mergeSha, baseRef,
+       maxTurns, spendUsd, sessionFile, resumedFromRunId, lane, prUrl, headSha, mergeSha, baseRef,
        baseCheck, baseCheckAt, salvageSha, salvageError, salvageAckAt, startedAt,
-       endedAt, lastError, settlementFlags, report
-     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       endedAt, lastError, settlementFlags, report, graphTools
+     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   );
   const selectRun = db.query<RunRow, [string]>(`SELECT * FROM runs WHERE id = ?`);
+  const selectGraphToolsObs = db.query<{ graphTools: string }, [string]>(
+    `SELECT graphTools FROM runs WHERE project = ? AND graphTools IS NOT NULL`,
+  );
   const selectActive = db.query<RunRow, SqlValue[]>(
     `SELECT * FROM runs
       WHERE project = ? AND state IN (${ACTIVE_PLACEHOLDERS})
@@ -1752,19 +1996,43 @@ export function openStore(dbPath: string): Store {
   // fleet #350 spent its whole continuation budget on causes like those and then
   // sat in admission hold for six dispatch cycles. An unclassified row (NULL) is
   // counted exactly as before, so upgrading changes no existing budget.
-  const countFailures = db.query<{ n: number }, [string, number]>(
-    `SELECT COUNT(*) AS n FROM runs
-      WHERE project = ? AND issue = ? AND state = 'failed'
-        AND (failureClass IS NULL OR failureClass NOT IN ('ci-infra', 'settlement-stuck', 'env-start-failure', 'dispatch-infra', 'provider-credit', 'provider-transient', 'provider-capacity', 'returned-for-revision'))`,
-  );
-  const countContinuations = db.query<{ n: number }, [string, number]>(
-    `SELECT COUNT(*) AS n FROM runs
-      WHERE project = ? AND issue = ?
-        AND (
-          (state IN ('killed', 'orphaned', 'blocked')
-            AND (failureClass IS NULL OR failureClass NOT IN ('admin-kill', 'settlement-stuck', 'env-start-failure', 'dispatch-infra', 'provider-credit', 'provider-transient', 'provider-capacity')))
-          OR (state = 'failed' AND failureClass = 'returned-for-revision')
-        )`,
+  // The classes a terminal row must NOT carry to count as a charged failed
+  // attempt or continuation — the budget counters' exclusions, shared verbatim
+  // with the review claim that preserves a charge (#795): the claim evaluates
+  // the same predicate against the pre-claim row, so a preserved charge can
+  // never disagree with what the counters would have counted.
+  const CHARGEABLE_FAILURE_EXCLUSIONS =
+    "'ci-infra', 'settlement-stuck', 'env-start-failure', 'dispatch-infra', 'provider-credit', 'provider-transient', 'provider-capacity', 'returned-for-revision'";
+  const CHARGEABLE_CONTINUATION_EXCLUSIONS =
+    "'admin-kill', 'settlement-stuck', 'env-start-failure', 'dispatch-infra', 'provider-credit', 'provider-transient', 'provider-capacity'";
+
+  // A row whose review revision preserved a charge (#795 review round 2) keeps
+  // counting after the claim leaves it `pushed-green`. The preserved columns
+  // are per-category INTEGER totals, summed here — not a single enum over
+  // rows — so repeated same-category terminal events across consecutive review
+  // rounds each keep their charge: a killed run contributes one continuation,
+  // its review claim moves that charge into `continuationCharges`, and a
+  // second cap on the resumed round is counted by the state branch on top of
+  // it. The two sums can never double-count one event: a terminal event is
+  // counted by the state branch only while the row is still terminal, and the
+  // claim that flips it to `running` is the same atomic statement that adds it
+  // to the preserved column.
+  const countFailures = db.query<{ n: number }, SqlValue[]>(
+    `SELECT
+       (SELECT COALESCE(SUM(failureCharges), 0) FROM runs WHERE project = ? AND issue = ?)
+       + (SELECT COUNT(*) FROM runs WHERE project = ? AND issue = ?
+            AND state = 'failed'
+            AND (failureClass IS NULL OR failureClass NOT IN (${CHARGEABLE_FAILURE_EXCLUSIONS}))) AS n`,
+  );
+  const countContinuations = db.query<{ n: number }, SqlValue[]>(
+    `SELECT
+       (SELECT COALESCE(SUM(continuationCharges), 0) FROM runs WHERE project = ? AND issue = ?)
+       + (SELECT COUNT(*) FROM runs WHERE project = ? AND issue = ?
+            AND (
+              (state IN ('killed', 'orphaned', 'blocked')
+                AND (failureClass IS NULL OR failureClass NOT IN (${CHARGEABLE_CONTINUATION_EXCLUSIONS})))
+              OR (state = 'failed' AND failureClass = 'returned-for-revision')
+            )) AS n`,
   );
   // How many times one issue reached a given class. Recovery uses it to bound a
   // retry loop whose cause is persistent (e.g. a mirror that will not refresh):
@@ -1870,6 +2138,21 @@ export function openStore(dbPath: string): Store {
         AND (salvageSha IS NOT NULL OR salvageError IS NOT NULL)
       ORDER BY issue ASC`,
   );
+  // Quarantined retained trees (#737), newest attempt per issue — the same
+  // shape as `selectSalvaged` because the same change can land twice: a row
+  // long since reaped must not keep its issue looking quarantined, and an
+  // older quarantined attempt must not claim the issue while a newer,
+  // healthy one replaced it.
+  const selectQuarantined = db.query<RunRow, [string]>(
+    `SELECT * FROM runs
+      WHERE rowid IN (
+        SELECT MAX(rowid) FROM runs
+        WHERE project = ?
+        GROUP BY issue
+      )
+        AND quarantineDetail IS NOT NULL
+      ORDER BY issue ASC`,
+  );
   // Newest attempt for one issue. `startedAt` is millisecond-resolution and two
   // attempts could in principle share one, so rowid breaks the tie by insertion
   // order — a `tail` that attached to the older of two same-millisecond attempts
@@ -1961,6 +2244,44 @@ export function openStore(dbPath: string): Store {
   const selectDispatch = db.query<{ summary: string }, [string]>(
     `SELECT summary FROM dispatch_summaries WHERE project = ?`,
   );
+  const selectGrooming = db.query<GroomingRow, [string, number]>(
+    `SELECT project, issue, verdict, reason, evidence, recordedAt
+       FROM grooming WHERE project = ? AND issue = ?`,
+  );
+  const selectGroomingAll = db.query<GroomingRow, [string]>(
+    `SELECT project, issue, verdict, reason, evidence, recordedAt
+       FROM grooming WHERE project = ? ORDER BY issue ASC`,
+  );
+  const selectGroomingByVerdict = db.query<GroomingRow, [string, string]>(
+    `SELECT project, issue, verdict, reason, evidence, recordedAt
+       FROM grooming WHERE project = ? AND verdict = ? ORDER BY issue ASC`,
+  );
+  const upsertGroomingRow = db.query<unknown, [string, number, string, string, string, number]>(
+    `INSERT INTO grooming (project, issue, verdict, reason, evidence, recordedAt)
+     VALUES (?, ?, ?, ?, ?, ?)
+     ON CONFLICT(project, issue) DO UPDATE SET
+       verdict = excluded.verdict,
+       reason = excluded.reason,
+       evidence = excluded.evidence,
+       recordedAt = excluded.recordedAt`,
+  );
+  const clearGroomedBlocked = db.query<unknown, [string]>(
+    `DELETE FROM grooming
+      WHERE project = ? AND verdict = 'blocked'
+        AND reason IN ('file-lane', 'depends-on')`,
+  );
+  // One transaction, so a pass can never leave the blocked inventory half
+  // written: the stale rows are cleared (the hold no longer applies) and the
+  // current holds re-recorded atomically.
+  const reconcileGroomingTx = db.transaction(
+    (project: string, holds: readonly { issue: number; reason: AdmissionHoldReason; detail?: string }[]): void => {
+      clearGroomedBlocked.run(project);
+      for (const hold of holds) {
+        if (BLOCKED_GROOMING_HOLDS[hold.reason] !== true) continue;
+        upsertGroomingRow.run(project, hold.issue, "blocked", hold.reason, hold.detail ?? hold.reason, Date.now());
+      }
+    },
+  );
   const selectFrictionRollup = db.query<FrictionRollupRow, [string, string, string]>(
     `SELECT * FROM friction_rollups WHERE project = ? AND day = ? AND kind = ?`,
   );
@@ -2467,12 +2788,24 @@ export function openStore(dbPath: string): Store {
     `UPDATE decisions SET state = 'expired', resolvedAt = ?, resolution = 'expired unanswered'
       WHERE project = ? AND state = 'open' AND expiresAt <= ?`,
   );
-  // Set once: a condition that flickers must not keep moving its own timestamp,
-  // or the digest's "act on this now" would reset to looking new every tick.
-  const markConditionMetRow = db.query<never, [number, string]>(
-    `UPDATE decisions SET conditionMetAt = ?
+  // Set once per head: a condition that flickers must not keep moving its own
+  // timestamp, or the digest's "act on this now" would reset to looking new
+  // every tick. A `pr-checks-green` / `pr-review-ready` row whose PR head
+  // moved is cleared first and re-marks here against the new head (`head`
+  // binds the verdict to the exact commit it was observed at, #808).
+  const markConditionMetRow = db.query<never, [number, SqlValue, string]>(
+    `UPDATE decisions SET conditionMetAt = ?, conditionHead = ?
       WHERE id = ? AND state = 'open' AND conditionMetAt IS NULL`,
   );
+  // The inverse of the mark, for the two conditions whose observation goes
+  // stale: a `pr-checks-green` / `pr-review-ready` binding is about a commit,
+  // so a head change drops both the timestamp and the binding and the row
+  // returns to pending (#808). Returns false when no met state existed to
+  // drop, so re-runs are a no-op.
+  const clearConditionMetRow = db.query<never, [string]>(
+    `UPDATE decisions SET conditionMetAt = NULL, conditionHead = NULL
+      WHERE id = ? AND state = 'open' AND conditionMetAt IS NOT NULL`,
+  );
 
   const insertVerbLedger = db.query<unknown, SqlValue[]>(
     `INSERT INTO verb_ledger
@@ -2556,16 +2889,97 @@ export function openStore(dbPath: string): Store {
   const requeueReviewRevisionRow = db.query<unknown, [string]>(
     `UPDATE review_revisions SET dispatchedAt = NULL WHERE id = ?`,
   );
-  const claimRunForReviewRow = db.query<unknown, [string]>(
+  // The states the review verb admits and the dispatch pass may therefore
+  // claim (#795): a settled green run, or a capped/failed run that pushed one
+  // (`failed` / `killed`). The terminal set is closed on purpose — a live row
+  // (`running` / `claimed`) is already doing its own work, a `pushed-pending`
+  // PR is not green yet, and a `blocked` / `orphaned` / `stopped` / `merged`
+  // row is not work the orchestrator returned for revision.
+  //
+  // The terminal leg does two things in the same atomic statement (#795 review
+  // rounds 1-2): it PRESERVES the budget charge the row's terminal event was
+  // charging — added to a per-category INTEGER column, so repeated
+  // same-category terminal events across consecutive review rounds each keep
+  // their charge and `maxAttemptsPerIssue` / `maxContinuationsPerIssue` keep
+  // bounding the lifecycle — and it CLEARS the lifecycle recovery metadata
+  // (`failureClass` / `recoveryAction` / `recoveredAt`), so the resumed
+  // execution's own terminal failure is classified and recovered fresh instead
+  // of being excluded from the classification sweep by the original terminal's
+  // recovered state. The state branch stops counting the row the instant this
+  // statement flips it to `running`, and the preserved column starts counting
+  // it in the same statement: one event, one count, never both.
+  const claimRunForReviewTerminal = db.query<unknown, [string]>(
+    `UPDATE runs SET
+       state = 'running',
+       endedAt = NULL,
+       failureClass = NULL,
+       recoveryAction = NULL,
+       recoveredAt = NULL,
+       failureCharges = COALESCE(failureCharges, 0) + CASE
+         WHEN state = 'failed' AND (failureClass IS NULL OR failureClass NOT IN (${CHARGEABLE_FAILURE_EXCLUSIONS})) THEN 1
+         ELSE 0
+       END,
+       continuationCharges = COALESCE(continuationCharges, 0) + CASE
+         WHEN state = 'failed' AND failureClass = 'returned-for-revision' THEN 1
+         WHEN state = 'killed' AND (failureClass IS NULL OR failureClass NOT IN (${CHARGEABLE_CONTINUATION_EXCLUSIONS})) THEN 1
+         ELSE 0
+       END
+     WHERE id = ? AND state IN ('failed', 'killed')`,
+  );
+  // The settled-green leg: a pushed row carries no charge and no recovery
+  // metadata, so the claim stays exactly what it always was.
+  const claimRunForReviewGreen = db.query<unknown, [string]>(
     `UPDATE runs SET state = 'running', endedAt = NULL WHERE id = ? AND state = 'pushed-green'`,
   );
+  // Exactly one leg can match (the row is either terminal or pushed-green at
+  // the moment of the claim), a repeated claim matches neither, and the two
+  // statements plus the read of `changes` are one transaction — the dispatch
+  // pass can never see a half-claimed row.
+  const claimRunForReviewTx = db.transaction((runId: string): boolean => {
+    if (claimRunForReviewTerminal.run(runId).changes > 0) return true;
+    return claimRunForReviewGreen.run(runId).changes > 0;
+  });
 
-  // The claim and the insert share a transaction so two concurrent revision
-  // requests for one run cannot both win: the second sees the first's pending
-  // row and returns undefined, which the verb turns into the in-flight refusal.
-  const claimReviewRevision = db.transaction(
-    (draft: Omit<ReviewRevisionRecord, "id">): ReviewRevisionRecord | undefined => {
-      if (selectPendingReviewForRun.get(draft.project, draft.runId) !== null) return undefined;
+  // Appending is a single-statement concatenation so even a write from a
+  // second connection cannot lose one side of the merge: SQLite holds the
+  // row's write lock for the whole UPDATE and re-reads the current value, so
+  // the second append lands on the first's result rather than on the read it
+  // took before the first committed.
+  const appendReviewFindingsRow = db.query<unknown, [string, string]>(
+    `UPDATE review_revisions SET findings = findings || ? WHERE id = ?`,
+  );
+
+  // The decision and the write share one transaction (#677, #786): a same-run,
+  // same-head finding folds into the revision still waiting to dispatch
+  // (appended — one round, one row, one worker attempt, and the resumed
+  // session reads both findings), while a revision already pending at a
+  // different head — a review of a moved PR — is refused rather than amended.
+  // Two concurrent same-head requests therefore cannot both create a row or
+  // overwrite each other: whichever commits first, the other sees its pending
+  // row inside this transaction and appends to it. The verb turns the `refused`
+  // outcome into the in-flight refusal.
+  //
+  // The transaction is begun IMMEDIATE — the write lock is taken BEFORE the
+  // pending-row read. The CLI and the daemon are separate processes with
+  // separate SQLite connections; under a deferred read-then-write both could
+  // read "no pending row" before either wrote, and the second INSERT would
+  // then fail with SQLITE_BUSY_SNAPSHOT instead of re-reading the winner's
+  // committed row — losing the second finding as an untyped verb error. With
+  // IMMEDIATE, the losing connection blocks on the write lock (bounded by the
+  // 5s busy timeout) and, once the winner commits, reads the fresh state and
+  // appends to the winner's row. The unique pending-per-run index remains as
+  // the schema-level backstop.
+  const enqueueReviewRevisionTx = db.transaction(
+    (draft: Omit<ReviewRevisionRecord, "id">): ReviewRevisionEnqueue => {
+      const pending = selectPendingReviewForRun.get(draft.project, draft.runId);
+      if (pending !== null) {
+        if (pending.headSha !== draft.headSha) {
+          return { kind: "refused", block: "pending-different-head" };
+        }
+        const merged = `${pending.findings}\n\n${draft.findings}`;
+        appendReviewFindingsRow.run(`\n\n${draft.findings}`, pending.id);
+        return { kind: "appended", record: { ...toReviewRevision(pending), findings: merged } };
+      }
       const record: ReviewRevisionRecord = { ...draft, id: crypto.randomUUID() };
       insertReviewRevision.run(
         record.id,
@@ -2580,7 +2994,7 @@ export function openStore(dbPath: string): Store {
         record.sessionFile ?? null,
         record.requestedAt,
       );
-      return record;
+      return { kind: "created", record };
     },
   );
 
@@ -2708,6 +3122,8 @@ export function openStore(dbPath: string): Store {
       record.maxTurns,
       record.spendUsd,
       toSql(record.sessionFile),
+      toSql(record.resumedFromRunId),
+      toSql(record.lane),
       toSql(record.prUrl),
       toSql(record.headSha),
       toSql(record.mergeSha),
@@ -2722,6 +3138,7 @@ export function openStore(dbPath: string): Store {
       toSql(record.lastError),
       toSql(record.settlementFlags),
       toSql(record.report),
+      toSql(record.graphTools),
     );
     return record;
   };
@@ -2773,6 +3190,20 @@ export function openStore(dbPath: string): Store {
       return row ? toRecord(row) : undefined;
     },
 
+    graphToolsObservationCounts(project: string): { recorded: number; present: number; absent: number } {
+      // Counted in JS through the same defensive converter `toRecord` uses, so
+      // a hand-edited row can never move a truth-value count (#726).
+      let present = 0;
+      let absent = 0;
+      for (const row of selectGraphToolsObs.all(project)) {
+        const observed = toGraphTools(row.graphTools);
+        if (observed === undefined) continue;
+        if (observed.present) present += 1;
+        else absent += 1;
+      }
+      return { recorded: present + absent, present, absent };
+    },
+
     activeRuns(project: string): RunRecord[] {
       return selectActive.all(project, ...ACTIVE_STATES).map(toRecord);
     },
@@ -2791,8 +3222,15 @@ export function openStore(dbPath: string): Store {
     runsForProjectPr(project: string, prUrl: string, mergedSinceEpochMs: number): RunRecord[] {
       return selectRunsForPr.all(project, prUrl, mergedSinceEpochMs).map(toRecord);
     },
-    createReviewRevision(draft: Omit<ReviewRevisionRecord, "id">): ReviewRevisionRecord | undefined {
-      return claimReviewRevision(draft);
+    enqueueReviewRevision(draft: Omit<ReviewRevisionRecord, "id">): ReviewRevisionEnqueue {
+      // `immediate` = BEGIN IMMEDIATE: the write lock is acquired before the
+      // pending-row read, so a second connection's transaction cannot observe
+      // a snapshot older than the first connection's commit (#786).
+      return enqueueReviewRevisionTx.immediate(draft);
+    },
+    pendingReviewForRun(project: string, runId: string): ReviewRevisionRecord | undefined {
+      const row = selectPendingReviewForRun.get(project, runId);
+      return row === null ? undefined : toReviewRevision(row);
     },
     pendingReviewRevisions(project: string): ReviewRevisionRecord[] {
       return selectPendingReviewRevisions.all(project).map(toReviewRevision);
@@ -2813,7 +3251,7 @@ export function openStore(dbPath: string): Store {
       requeueReviewRevisionRow.run(id);
     },
     claimRunForReview(runId: string): boolean {
-      return claimRunForReviewRow.run(runId).changes > 0;
+      return claimRunForReviewTx(runId);
     },
     runsNeedingBaseCheck(project: string, limit = 20): RunRecord[] {
       return selectPendingBaseChecks.all(project, limit).map(toRecord);
@@ -2885,16 +3323,20 @@ export function openStore(dbPath: string): Store {
       return selectSalvaged.all(project).map(toRecord);
     },
 
+    quarantinedRuns(project: string): RunRecord[] {
+      return selectQuarantined.all(project).map(toRecord);
+    },
+
     attemptsFor(project: string, issue: number): number {
       return countAttempts.get(project, issue)?.n ?? 0;
     },
 
     failuresFor(project: string, issue: number): number {
-      return countFailures.get(project, issue)?.n ?? 0;
+      return countFailures.get(project, issue, project, issue)?.n ?? 0;
     },
 
     continuationsFor(project: string, issue: number): number {
-      return countContinuations.get(project, issue)?.n ?? 0;
+      return countContinuations.get(project, issue, project, issue)?.n ?? 0;
     },
 
     classCountFor(project: string, issue: number, cls: FailureClass): number {
@@ -3441,8 +3883,12 @@ export function openStore(dbPath: string): Store {
       return resolveDecisionRow.run(state, resolution, at, id).changes > 0;
     },
 
-    markDecisionConditionMet(id: string, at: number): boolean {
-      return markConditionMetRow.run(at, id).changes > 0;
+    markDecisionConditionMet(id: string, at: number, head?: string): boolean {
+      return markConditionMetRow.run(at, toSql(head), id).changes > 0;
+    },
+
+    clearDecisionConditionMet(id: string): boolean {
+      return clearConditionMetRow.run(id).changes > 0;
     },
 
     expireDueDecisions(project: string, now: number): DecisionRecord[] {
@@ -3572,6 +4018,34 @@ export function openStore(dbPath: string): Store {
       return result.changes > 0;
     },
 
+    upsertGrooming(draft: GroomingDraft): void {
+      upsertGroomingRow.run(
+        draft.project,
+        draft.issue,
+        draft.verdict,
+        draft.reason,
+        draft.evidence,
+        draft.at,
+      );
+    },
+
+    grooming(project: string, issue: number): GroomingRecord | undefined {
+      const row = selectGrooming.get(project, issue);
+      return row === null ? undefined : toGrooming(row);
+    },
+
+    groomingVerdicts(project: string, verdict?: GroomingVerdict): GroomingRecord[] {
+      const rows = verdict === undefined ? selectGroomingAll.all(project) : selectGroomingByVerdict.all(project, verdict);
+      return rows.map(toGrooming);
+    },
+
+    reconcileGrooming(
+      project: string,
+      holds: readonly { issue: number; reason: AdmissionHoldReason; detail?: string }[],
+    ): void {
+      reconcileGroomingTx(project, holds);
+    },
+
     close(): void {
       db.close(false);
     },