omp-conductor 0.17.1 → 0.18.1

package/src/daemon.ts

@@ -8,35 +8,48 @@
  * here and enforced before anything is claimed.
  */
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, constants, existsSync, fchownSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, readlinkSync, renameSync, rmSync, statSync, writeFileSync, type Dirent } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import {
   configPath,
+  dbBackupDirFor,
   findProject,
   loadConfig,
   resolveCaps,
   resolveReleaseGrants,
+  resolveReview,
   stateDir,
 } from "./config.ts";
 import { availabilityState, type AvailabilityState } from "./availability.ts";
 import {
-  UNREADABLE_TREE_FLAG,
-  analyseSettlement,
-  deriveChangedLine,
   formatSettlementFlags,
   settlementFlagSummary,
   withDerivedChangedLine,
 } from "./diff-flags.ts";
-import { digestScheduleState, type DigestScheduleState } from "./digest-schedule.ts";
+import {
+  dbSnapshotDue,
+  dbSnapshotMarkerKey,
+  digestScheduleState,
+  localDayKey,
+  type DigestScheduleState,
+} from "./digest-schedule.ts";
 import { createEscalator, escalationIssueRef } from "./escalate.ts";
 import { pendingCodeGraph, probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
 import { graphHint } from "./graph.ts";
+import {
+  hostConstraintsNotice,
+  resolveWorkerIdentity,
+  WORKER_ACCOUNT,
+  type WorkerIdentity,
+  type WorkerIdentityResolution,
+} from "./host.ts";
 import { acquireOnceLease, healthCheck, livingDaemon, probeUnit, SYSTEMD_UNIT } from "./lifecycle.ts";
 import { requestImmediateTick, resolveTickConfigCwd, STALL_MARKER_FILE } from "./orchestrator-tick.ts";
 import { runDoctor } from "./doctor.ts";
 import { appendJournal, launchTransientUnit, readUpgradeJournal } from "./upgrade-journal.ts";
 import { runCommand, verifyPendingUpgrade, type UpgradeVerifyDeps } from "./upgrade-verify.ts";
-import { fleetLayers } from "./fleet.ts";
+import { processStartTimeMs } from "./upgrade-verify.ts";
+import { fleetLayers, herdrPaneOmpStarts, resolveHerdrSession } from "./fleet.ts";
 import { startOrchestrator } from "./orchestrator.ts";
 import type { OrchestratorHandle } from "./orchestrator.ts";
 import {
@@ -56,39 +69,66 @@ import {
   type GateShape,
   type ReleaseBlockContext,
 } from "./release-policy.ts";
-import { branchName, effectiveLabels, route } from "./routing.ts";
+import { branchName, effectiveLabels, isEligible, route } from "./routing.ts";
 import type { Routed, UnroutableReason } from "./routing.ts";
 import {
   admitCandidates,
   effectiveLane,
+  effectiveModel,
   hasContinuationBudget,
   hasFailedAttemptBudget,
+  laneEcho,
 } from "./admission.ts";
-import type { Admission, AdmissionHold, FileLane } from "./admission.ts";
+import type { Admission, AdmissionHold } from "./admission.ts";
+import type { EffectiveModel, FileLane } from "./types.ts";
 import { log, errText, safeEscalate } from "./log.ts";
+import {
+  adoptSalvagedPrs,
+  classifyAndRecover,
+  collectSettlementFlags,
+  formatQuarantinedRuns,
+  formatSalvagedRuns,
+  reactToProviderCredit,
+  readSessionError,
+  reconcileOrphanedRuns,
+  reconcileStaleLabels,
+  recordOperatorStop,
+  settlePushedGreen,
+  settleWorktree,
+  swapToQueue,
+} from "./settlement.ts";
 import { materializeOmpSettings } from "./omp-settings.ts";
 import { evaluateDecisionConditions, probeNpmVersion, probeRateLimitReset } from "./decisions.ts";
-import { classifyRun, infraLogSignature, infraSignatureVersion, normalise, providerCreditRefusal, providerTransientFault, type ClassifyFacts } from "./failure-class.ts";
+import { infraLogSignature, infraSignatureVersion, providerCreditRefusal, providerTransientFault } from "./failure-class.ts";
 import {
   DEFAULT_MODEL_FALLBACK_THRESHOLD,
   fallbackClause,
-  formatModelsTried,
-  modelsTried,
   providerFailureFacts,
   resolveDispatchModel,
 } from "./model-fallback.ts";
 import { projectLabels } from "./label-projection.ts";
-import { dbPath, LIVE_STATES, openStore, utcDay } from "./store.ts";
-import { GraphqlBreaker, makeTracker, type RateLimitStatus } from "./tracker/github.ts";
+import {
+  DB_SNAPSHOT_RETENTION,
+  ACTIVE_STATES,
+  dbPath,
+  LIVE_STATES,
+  openStore,
+  pruneDbSnapshots,
+  snapshotDb,
+  utcDay,
+} from "./store.ts";
+import { GhPrMissingError, GraphqlBreaker, makeTracker, type RateLimitStatus } from "./tracker/github.ts";
 import { DEFAULT_REPORT_POLICY, RELEASE_SHAPES } from "./types.ts";
 import type {
   BaseFreeze,
   BaseHealth,
   AdmissionHoldReason,
   Caps,
+  ConductorConfig,
   DispatchSummary,
   DigestBacklog,
   Escalation,
+  InterruptCategory,
   IssueComment,
   IssueSnapshot,
   MergedPrInfo,
@@ -96,13 +136,18 @@ import type {
   ReleaseShape,
   OrchestratorIncident,
   PrState,
+  PrVerification,
   ProjectConfig,
   ReadyIssue,
+  ReportScope,
+  ReportingPolicy,
   RepoTarget,
   ReportRecord,
   ResolvedGrants,
   FailureClass,
+  HostConstraints,
   RecoveryAction,
+  ReviewPolicy,
   ReviewRevisionOutcome,
   ReviewRevisionRecord,
   RunRecord,
@@ -139,8 +184,8 @@ import {
 import { githubVerbActions } from "./verbs/actions.ts";
 import { formatVerbLedger, STATUS_LEDGER_SCAN } from "./verbs/ledger.ts";
 import {
+  isHeadMismatch,
   listenVerbChannel,
-  PR_LOOKUP_WINDOW_MS,
   type VerbActions,
   type VerbDeps,
   type VerbListener,
@@ -180,26 +225,7 @@ const GRAPH_HEALTH_INTERVAL_MS = 60_000;
  *  report an operator is waiting on must not sit in the outbox for the length of
  *  a poll interval, and delivery is owed even while claiming is paused (#123). */
 const REPORT_DELIVERY_INTERVAL_MS = 30_000;
-/** A dispatch-infra run (turn-0 git failure) is requeued so the next tick
- *  retries — but only a bounded number of times. Three strikes for one issue
- *  means the mirror itself is broken, not unlucky, and the sweep escalates
- *  instead of burning a turn-0 run per tick forever (#168, #177). */
-const DISPATCH_INFRA_MAX_STRIKES = 3;
-/** A provider-transient requeue (stream stalled mid-run) is retried, but only a
- *  bounded number of times: three aborted streams for one issue means the
- *  provider itself is degraded, not unlucky, and the sweep escalates to a
- *  human instead of requeueing into a down provider forever (#220). */
-const PROVIDER_TRANSIENT_MAX_STRIKES = 3;
-/** A provider-capacity requeue (sustained in-session rate limiting) is retried,
- *  but only a bounded number of times: three throttled runs for one issue mean
- *  the provider is at capacity, not unlucky, and the sweep escalates to a human
- *  instead of requeueing into a throttled provider forever (#573). The issue's
- *  own chain moves onto its next model per strike (via {@link FAILOVER_CLASSES}),
- *  so a bounded chain is exhaustible; this caps the unbounded no-chain case. */
-const PROVIDER_CAPACITY_MAX_STRIKES = 3;
-/** Terminal rows inspected for a salvaged PR per tick. GitHub provenance reads
- *  are maintenance, but a backlog must not turn one tick into an API burst. */
-const SALVAGED_PR_ADOPTION_BATCH = 10;
+
 const DEFAULT_PORT = 8787;
 const BRIEF_TEMPLATE_PATH = join(import.meta.dir, "briefs", "worker.md");
 
@@ -233,6 +259,10 @@ export interface DrainSignal {
 interface Deps {
   project: ProjectConfig;
   caps: Caps;
+  /** The typed host-constraints block (#721), re-resolved at the tick
+   *  boundary like `project`/`caps`, and rendered into every brief the tick
+   *  dispatches. Optional so tests that never exercise it can omit it. */
+  host?: HostConstraints;
   tracker: Tracker;
   store: Store;
   /**
@@ -256,6 +286,33 @@ interface Deps {
   workerControls: WorkerControlRegistry;
   /** Session seam for lifecycle integration tests; production uses the real harness. */
   workerDeps?: RunWorkerDeps;
+  /**
+   * Resolves the dedicated worker identity (#798) — the account worker sessions
+   * run under, with its uid/gid/home, the transition launcher and a live harness
+   * binding (#828).
+   *
+   * Called **at every worker launch**, never cached: every input is host state
+   * that can change under a running daemon. A reboot can start this service
+   * before systemd has mounted the harness binding, and an operator can install
+   * the account or re-run `setup host` at any time — a verdict taken once at
+   * startup would hold the whole fleet closed until somebody thought to restart
+   * the daemon, which is the outage #828 exists to end rather than relocate.
+   * Resolution is a handful of `stat` calls and one `/etc/passwd` read; a
+   * dispatch does far more than that before it reaches this gate.
+   *
+   * Every worker dispatch refuses to launch on an unresolved identity (fail
+   * closed — an unbound worker is indistinguishable from an operator shell),
+   * and this is how the dispatcher secures the run's sockets and grants the
+   * run's paths to the account. Absent entirely, dispatch fails closed naming
+   * the missing account.
+   */
+  workerIdentity?: () => WorkerIdentityResolution;
+  /**
+   * Re-owns a run's working paths (worktree + session dir) under the worker
+   * identity before the session launches. Wired by `runDaemon` to the
+   * recursive chown; a test fixture leaves it unset so no test chowns.
+   */
+  grantWorkerPaths?: (identity: WorkerIdentity, worktreePath: string, sessionDir: string) => void;
   integrity: IntegrityGate;
   stall: StallGate;
   /**
@@ -315,6 +372,13 @@ interface Deps {
    * admission fails a routed cross-repo prerequisite closed.
    */
   probeIssueIn?: (repo: string, issue: number) => Promise<IssueSnapshot | undefined>;
+  /**
+   * Reads one issue's BODY in a repository the admission tracker is not bound
+   * to — the dependency-graph cycle pass (#421). Wired by `runDaemon` to a
+   * repo-scoped tracker; a test injects a fake. Absent, a routed reachable
+   * body fails that branch closed rather than synthesising a cycle.
+   */
+  probeBodyIn?: (repo: string, issue: number) => Promise<string | undefined>;
 }
 
 /**
@@ -436,6 +500,121 @@ export function checkStall(gate: StallGate, marker: string, now = Date.now()): S
  * could destroy work an operator would rather read first — the same refusal to
  * guess that the recovery plugin is built on.
  */
+// --------------------------------------------------------- worker identity (#798) --
+
+/**
+ * Re-own a run's working paths (worktree, session dir) under the worker
+ * identity before the session launches. The daemon runs this as root; the
+ * worker identity is granted its own run paths by ownership, never by
+ * loosened modes on the daemon's.
+ *
+ * The walk never re-owns through a path a worker-uid process could
+ * re-resolve: every ownership change is `fchownSync` on a descriptor opened
+ * with `O_NOFOLLOW`, and every descriptor is verified — via `/proc/self/fd`'s
+ * kernel-resolved path — to still sit under the directory the walk opened.
+ * A directory entry raced into a symlink therefore either fails `O_NOFOLLOW`
+ * at the final component or resolves outside the verified parent and is
+ * skipped; it can never carry the chown to an external target. Symlinks
+ * within the tree are left untouched (the worker manages entries through its
+ * parent directories, and git recreates links on checkout), as are anything
+ * unopenable — fifos, sockets, devices — which git never creates. A missing
+ * or racing entry is not this dispatch's problem — the next dispatch re-owns
+ * whatever survives; a tree already owned by the worker identity — the
+ * resume and review-revision re-ownership of a tree a prior dispatch granted
+ * — is the only tree a worker-uid process could have modified, and is
+ * skipped outright rather than walked.
+ */
+export function chownRecursive(root: string, uid: number, gid: number): void {
+  try {
+    const current = lstatSync(root);
+    if (current.uid === uid && current.gid === gid) return;
+  } catch {
+    // A missing or racing root is the caller's own existence check; the next
+    // dispatch re-owns whatever survives.
+    return;
+  }
+  const rootFd = openNoFollowDir(root);
+  try {
+    walkDir(rootFd, root, uid, gid);
+  } finally {
+    try {
+      closeSync(rootFd);
+    } catch {
+      // Already closed by a raced-away walk; nothing to do.
+    }
+  }
+}
+
+/** Open a directory without following a final-component symlink. */
+function openNoFollowDir(path: string): number {
+  return openSync(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+}
+
+/** The kernel-resolved path of an open descriptor: what the object actually is. */
+function fdRealPath(fd: number): string | undefined {
+  try {
+    return readlinkSync(`/proc/self/fd/${fd}`);
+  } catch {
+    return undefined;
+  }
+}
+
+function walkDir(dirFd: number, dirPath: string, uid: number, gid: number): void {
+  try {
+    fchownSync(dirFd, uid, gid);
+  } catch {
+    // Raced away; the next dispatch re-owns what survives.
+  }
+  const dirReal = fdRealPath(dirFd);
+  if (dirReal === undefined) return;
+  let entries: Dirent[];
+  try {
+    entries = readdirSync(dirPath, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const childPath = join(dirPath, entry.name);
+    try {
+      if (entry.isDirectory()) {
+        const childFd = openNoFollowDir(childPath);
+        try {
+          // The entry is genuinely beneath the directory this fd owns only
+          // when the kernel resolves the opened object to a path under it.
+          // Anything else — a name swapped to a symlink, a foreign listing
+          // read through a replaced parent — is refused, never re-resolved.
+          const childReal = fdRealPath(childFd);
+          if (childReal === undefined || !childReal.startsWith(`${dirReal}/`)) continue;
+          walkDir(childFd, childPath, uid, gid);
+        } finally {
+          try {
+            closeSync(childFd);
+          } catch {
+            // Raced away; nothing to close.
+          }
+        }
+        continue;
+      }
+      // Symlinks stay untouched (never followed, never chowned), and so do
+      // entries a read-only open cannot name safely (fifos, sockets, devices).
+      if (entry.isSymbolicLink() || !entry.isFile()) continue;
+      const fd = openSync(childPath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+      try {
+        const real = fdRealPath(fd);
+        if (real !== undefined && real.startsWith(`${dirReal}/`)) fchownSync(fd, uid, gid);
+      } finally {
+        try {
+          closeSync(fd);
+        } catch {
+          // Raced away; nothing to close.
+        }
+      }
+    } catch {
+      // O_NOFOLLOW refusal (a symlink swapped onto the name), or gone: nothing to chown.
+    }
+  }
+}
+
 export async function watchOrchestrator(d: Deps, now = Date.now()): Promise<void> {
   const marker = join(stateDir(), STALL_MARKER_FILE);
   const repeat = d.stall.paged;
@@ -554,6 +733,29 @@ export function pauseProvenance(
   }
 }
 
+/**
+ * One pause sentinel FILE read as an instance identity: who set it, why, and
+ * the creation instant, all from that exact file. An unreadable or malformed
+ * file is undefined — the caller may treat it as absence.
+ */
+function pauseInstanceAt(
+  path: string,
+): { source: string; reason?: string; since: number } | undefined {
+  try {
+    const [line1, line2] = readFileSync(path, "utf8").split("\n");
+    const since = Date.parse(line1?.trim() ?? "");
+    if (!Number.isFinite(since)) return undefined;
+    if (line2 === undefined) return undefined;
+    const match = /^source=(\S+)(?: reason="(.*)")?$/.exec(line2.trim());
+    if (match === null) return undefined;
+    const source = match[1]!;
+    const reason = match[2];
+    return { source, since, ...(reason === undefined ? {} : { reason }) };
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * One pause sentinel read as a single identity: who set it, why, and the
  * creation instant, all from the SAME file that was selected. Unlike pairing
@@ -573,19 +775,34 @@ export function pauseInstance(
       : [pausedPath(project), pausedPath()];
   const path = paths.find((candidate) => existsSync(candidate));
   if (path === undefined) return undefined;
-  try {
-    const [line1, line2] = readFileSync(path, "utf8").split("\n");
-    const since = Date.parse(line1?.trim() ?? "");
-    if (!Number.isFinite(since)) return undefined;
-    if (line2 === undefined) return undefined;
-    const match = /^source=(\S+)(?: reason="(.*)")?$/.exec(line2.trim());
-    if (match === null) return undefined;
-    const source = match[1]!;
-    const reason = match[2];
-    return { source, since, ...(reason === undefined ? {} : { reason }) };
-  } catch {
-    return undefined;
+  return pauseInstanceAt(path);
+}
+
+/**
+ * Compare-and-clear one pause sentinel (#780 review): remove `path` only while
+ * it still holds exactly the `expected` instance — same source, same reason,
+ * same creation instant — as read by {@link pauseInstance}. A hold or pause
+ * that replaced or recreated the sentinel between the read and the clear is a
+ * newer instance (writes always re-stamp `since`), so it is never destroyed:
+ * returning false keeps the newer fence in force. Scoped strictly to one
+ * caller-provided path, so auto-expiry can clear the per-project spend-cap
+ * sentinel without ever touching the legacy global sentinel.
+ */
+export function clearPauseIfUnchanged(
+  path: string,
+  expected: { source: string; reason?: string; since: number },
+): boolean {
+  const current = pauseInstanceAt(path);
+  if (current === undefined) return false;
+  if (
+    current.source !== expected.source ||
+    current.since !== expected.since ||
+    current.reason !== expected.reason
+  ) {
+    return false;
   }
+  rmSync(path, { force: true });
+  return true;
 }
 
 /**
@@ -622,6 +839,173 @@ export function setPaused(
   }
 }
 
+// ------------------------------------------------------------------- drain
+// (#484 slice 1) A project drain is a durable, self-expiring admission fence:
+// the same boundary as a pause — settlement above it, nothing claimed below —
+// but recorded with an absolute deadline, so an orchestrator crash can never
+// strand admission. The record is a JSON file under the state directory (like
+// the pause sentinel), scoped to exactly one configured project, and replaced
+// atomically on create. Human CLI wording and release-verb coupling are later
+// #484 children.
+
+/** The persisted shape of one project drain. Every field is validated when a
+ *  record is read — a record that cannot be trusted is never a fence. */
+export interface DrainRecord {
+  /** The configured project this drain fences; must match the reader. */
+  project: string;
+  /** ISO instant the drain intent was recorded. */
+  createdAt: string;
+  /** Absolute ISO deadline: admission resumes automatically at or after it. */
+  expiresAt: string;
+  /** Purpose recorded at creation (release window, maintenance…). */
+  reason?: string;
+}
+
+/** Create-time options for {@link createDrain}. */
+export interface CreateDrainOptions {
+  /** Absolute epoch-ms deadline — a drain must always expire on its own. */
+  expiresAt: number;
+  /** Purpose, persisted on the record and shown in structured status. */
+  reason?: string;
+}
+
+/** Why a drain record could not be trusted, named deterministically. */
+export type DrainProblem =
+  | "unparseable-json"
+  | "invalid-record"
+  | "invalid-project"
+  | "invalid-created-at"
+  | "invalid-expires-at"
+  | "expiry-not-future"
+  | "invalid-reason";
+
+/** The verdict of one drain read. `error` is the malformed-record case: the
+ *  caller may fail its pass closed, and the dispatch-side
+ *  {@link consumeDrain} removes the record in the same transition, so it can
+ *  never become a permanent drain. */
+export type DrainVerdict =
+  | { kind: "active"; drain: DrainRecord }
+  | { kind: "inactive" }
+  | { kind: "error"; problem: DrainProblem };
+
+/** Where this project's drain record lives. Project-scoped by construction:
+ *  a record present at one project's path never fences another project. */
+export function drainPath(project: string): string {
+  return join(stateDir(), `drain-${project}.json`);
+}
+
+/**
+ * Records a bounded drain intent for `project`, replacing any prior drain of
+ * the same project atomically (tmp + rename, exactly like the admission ack).
+ * The record is a file, so it survives orchestrator and daemon loss; the
+ * absolute `expiresAt` is what stops it from ever stranding admission.
+ */
+export function createDrain(
+  project: string,
+  opts: CreateDrainOptions,
+  now = Date.now(),
+): void {
+  if (project === "") {
+    throw new Error("drain project must not be empty");
+  }
+  if (!Number.isFinite(opts.expiresAt) || opts.expiresAt <= now) {
+    throw new Error("drain expiresAt must be a finite epoch-ms timestamp in the future");
+  }
+  if (opts.reason !== undefined && typeof opts.reason !== "string") {
+    throw new Error("drain reason must be a string");
+  }
+  const record: DrainRecord = {
+    project,
+    createdAt: new Date(now).toISOString(),
+    expiresAt: new Date(opts.expiresAt).toISOString(),
+    ...(opts.reason === undefined ? {} : { reason: opts.reason }),
+  };
+  const path = drainPath(project);
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid.toString(36)}.${Date.now().toString(36)}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(record, null, 2)}\n`);
+  renameSync(tmp, path);
+}
+
+/**
+ * One drained state read with no side effects — this never touches the record
+ * on disk. That purity is what lets observational surfaces live off it: a
+ * status/dashboard/health read must not consume a malformed record before a
+ * dispatch pass fails closed on it, or the pass would read absent and admit.
+ * The dispatch side performs the actual cleanup transition through
+ * {@link consumeDrain}. Callers that only need to *see* the state (including
+ * the claim path, which refuses but must not unbind its own pass) use this.
+ */
+export function readDrain(project: string, now = Date.now()): DrainVerdict {
+  const path = drainPath(project);
+  if (!existsSync(path)) return { kind: "inactive" };
+  let raw: unknown;
+  try {
+    raw = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return { kind: "error", problem: "unparseable-json" };
+  }
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    return { kind: "error", problem: "invalid-record" };
+  }
+  const rec = raw as Record<string, unknown>;
+  if (typeof rec["project"] !== "string" || rec["project"] === "") {
+    return { kind: "error", problem: "invalid-project" };
+  }
+  if (typeof rec["createdAt"] !== "string" || Number.isNaN(Date.parse(rec["createdAt"]))) {
+    return { kind: "error", problem: "invalid-created-at" };
+  }
+  if (typeof rec["expiresAt"] !== "string" || Number.isNaN(Date.parse(rec["expiresAt"]))) {
+    return { kind: "error", problem: "invalid-expires-at" };
+  }
+  if (Date.parse(rec["expiresAt"] as string) <= Date.parse(rec["createdAt"] as string)) {
+    return { kind: "error", problem: "expiry-not-future" };
+  }
+  const reason = rec["reason"];
+  if (reason !== undefined && typeof reason !== "string") {
+    return { kind: "error", problem: "invalid-reason" };
+  }
+  if (rec["project"] !== project) {
+    // A record persisted at this project's path but naming another project is
+    // either a copy or a rename mishap; it fences nobody (that project's drain
+    // lives at its own path).
+    return { kind: "inactive" };
+  }
+  if (Date.parse(rec["expiresAt"] as string) <= now) {
+    return { kind: "inactive" };
+  }
+  const drain: DrainRecord = {
+    project: rec["project"],
+    createdAt: rec["createdAt"],
+    expiresAt: rec["expiresAt"],
+    ...(reason === undefined ? {} : { reason }),
+  };
+  return { kind: "active", drain };
+}
+
+/**
+ * The dispatch-side drain read: the same verdict as {@link readDrain}, and the
+ * one place a stale or untrustworthy record is cleared as a side effect —
+ * expired and wrong-project records are removed (bounded stale-state cleanup
+ * on the next pass), and a malformed record is removed in the very transition
+ * that fails the pass closed, so it can never become an unbounded permanent
+ * drain. Only dispatch callers use this: an observational read here would let
+ * a status/health reader consume the malformed marker before the pass that
+ * must fail closed on it ever ran.
+ */
+export function consumeDrain(project: string, now = Date.now()): DrainVerdict {
+  const verdict = readDrain(project, now);
+  if (verdict.kind !== "active") {
+    rmSync(drainPath(project), { force: true });
+  }
+  return verdict;
+}
+
+/** Removes this project's drain, idempotently — a second cancel is a no-op. */
+export function cancelDrain(project: string): void {
+  rmSync(drainPath(project), { force: true });
+}
+
 // ----------------------------------------------------------------- admission
 // acknowledgement (#651, review #3)
 //
@@ -991,6 +1375,36 @@ function renderDiscussion(comments: IssueComment[] | "unread", lane?: FileLane):
   return lines.join("\n");
 }
 
+/**
+ * The parsed file lane as a brief section (#724): the file list the gate will
+ * enforce, or the explicit fail-open note — the same `laneEcho` the promotion
+ * verb prints, so the author and the worker read one parse. Deliberately only
+ * the parse, never the source line: the prose already renders in the body or
+ * the discussion, and in #720's case the prose is exactly what looked
+ * reasonable to a human while parsed greedily.
+ */
+function laneBlock(lane: FileLane | undefined): string {
+  const echo = laneEcho(lane);
+  const body = lane === undefined ? `_${echo}_` : `\`${echo}\``;
+  return ["## File lane (as parsed)", "", body, "", ""].join("\n");
+}
+
+/**
+ * The declared model as a brief section (#535): the selector the dispatch
+ * will launch on — the same parse admission carried, never a second read —
+ * or the explicit fail-open note, so the worker reads the run's model on the
+ * brief itself rather than inferring it. Deliberately only the selector,
+ * never the source line: the declaration's prose already renders in the body
+ * or Discussion.
+ */
+function modelBlock(model: EffectiveModel | undefined): string {
+  const body =
+    model === undefined
+      ? "_no model declared — the project's workerModel (or harness default) is in effect_"
+      : `\`${model.model}\``;
+  return ["## Model (as parsed)", "", body, "", ""].join("\n");
+}
+
 /**
  * What an orphan-resumed worker is told about the file lane on top of the
  * continuation notice (#608). The original brief already in the transcript
@@ -1008,6 +1422,8 @@ function resumeLaneBlock(lane: FileLane): string {
     "",
     lane.source,
     "",
+    `Parsed files: ${laneEcho(lane)}.`,
+    "",
   ].join("\n");
 }
 
@@ -1024,211 +1440,6 @@ function swapLabel(store: Store, projectName: string, issue: number, from: strin
     { issue, op: "remove", label: from },
   ]);
 }
-/**
- * Persist the operator-stop transition before releasing its live controller.
- * The row is terminal first, then its in-progress label is removed through the
- * same durable projection outbox as every other lifecycle transition.
- */
-export function recordOperatorStop(
-  store: Pick<Store, "updateRun" | "enqueueLabelOps">,
-  args: {
-    project: string;
-    issue: number;
-    runId: string;
-    inProgress: string;
-    reason: string;
-    patch: Partial<RunRecord>;
-  },
-): void {
-  store.updateRun(args.runId, {
-    ...args.patch,
-    state: "stopped",
-    lastError: `operator stopped: ${args.reason}`,
-  });
-  store.enqueueLabelOps(args.project, [
-    { issue: args.issue, op: "remove", label: args.inProgress },
-  ]);
-}
-
-
-/**
- * The escalator throws when no transport is configured or Telegram rejects, and
- * only records the dedup marker on success. A page that cannot be delivered
- * must not take the tick down with it — log it and let the next tick retry.
- *
- * Returns whether it actually went out, because "page once" and "page once
- * *successfully*" are different promises: a caller that latches a once-only
- * gate on the attempt turns one failed delivery into permanent silence about a
- * condition that is still true.
- */
-
-async function reactToProviderCredit(
-  d: Deps,
-  issue: number,
-  message: string,
-  sessionFile: string | undefined,
-): Promise<void> {
-  const { project } = d;
-  const alreadyPaused = isPaused(project.name);
-  if (!alreadyPaused) setPaused(true, { source: "provider-credit", reason: message }, project.name);
-  log(
-    `#${issue} provider refused for credit — dispatch ${alreadyPaused ? "remains paused" : "paused"}: ${message}`,
-  );
-  // Fleet-scoped and run-independent on purpose. The notification ledger
-  // dedupes on `project:issue:tier:summary`, so `NO_ISSUE` plus a summary
-  // carrying no run or attempt pages once for the fleet, not once per run.
-  await safeEscalate(d, {
-    tier: 2,
-    category: "fleet-stopped",
-    project: project.name,
-    issue: NO_ISSUE,
-    summary: `Model provider refused for credit — ${project.name} is paused`,
-    detail: [
-      message,
-      "",
-      "No implementation attempt was charged: this is a billing state, not a",
-      "failed implementation. Each affected issue keeps its queue label and",
-      "re-dispatches on `omp-conductor resume` once the provider has credit.",
-      `Session: ${sessionFile ?? "(no transcript)"}`,
-    ].join("\n"),
-  });
-}
-
-/**
- * What a salvage attempt contributes to the escalation: where the work went, or
- * that it went nowhere. Split from the effects below for the same reason
- * `checkIntegrity` is — this wording is the whole thing a human acts on, so it
- * is worth a test holding it, and the sha in it is the only pointer to work
- * that no longer has any other copy.
- *
- * `retained` is not cosmetic. These lines used to promise a tree "kept for
- * inspection" unconditionally, which was true only because salvage ran only on
- * the paths that keep one. A blocked run's tree is removed the moment its work
- * is safely on the branch, and sending an operator to a path this process just
- * deleted is the same class of mistake as #118 itself.
- */
-export function salvageLines(
-  outcome: SalvageOutcome,
-  worktree: string,
-  retained: boolean,
-): string[] {
-  const fate = retained
-    ? `Worktree kept for inspection: ${worktree}`
-    : `Worktree removed: ${worktree}`;
-
-  if (outcome.kind === "nothing") return [`${fate} — nothing uncommitted to salvage`];
-
-  if (outcome.kind === "failed") {
-    return [
-      `WIP SALVAGE FAILED: ${outcome.error}`,
-      `Uncommitted work in ${worktree} is the only copy of it, so the tree was kept.`,
-      "This issue is held out of dispatch until the tree is recovered by hand and",
-      "`omp-conductor unblock <n> --force` records that you accepted it.",
-    ];
-  }
-
-  const where =
-    `WIP committed to ${outcome.branch} @ ${outcome.sha}` +
-    (outcome.pushed
-      ? " and pushed — the work outlives this worktree"
-      : ` but NOT pushed (${outcome.pushError ?? "no reason given"}) — it lives only in this host's mirror`);
-  // Manifest belongs in the escalation too: opening the commit is how the
-  // orchestrator talked itself into scrubbing a worker tree (#38).
-  const n = outcome.files.length;
-  const count = `${n} file${n === 1 ? "" : "s"}`;
-  const manifest =
-    outcome.newPaths.length === 0
-      ? `${count} (all modifications to tracked paths)`
-      : `${count}; new: ${outcome.newPaths.slice(0, 12).join(", ")}${
-          outcome.newPaths.length > 12 ? `, … +${outcome.newPaths.length - 12} more` : ""
-        }`;
-  return [where, manifest, fate];
-}
-
-/** Everything a settled run has to record and say about its worktree. */
-export interface WorktreeSettlement {
-  outcome: SalvageOutcome;
-  /** Whether the tree still exists now the run is over. */
-  retained: boolean;
-  /** Escalation lines naming where the work went. */
-  lines: string[];
-  /** Row fields recording the durable ref, or the failure that blocks a re-claim. */
-  patch: Pick<RunRecord, "salvageSha" | "salvageError">;
-}
-
-/**
- * Decides what becomes of a finished run's worktree: save the work, then keep
- * or remove the tree, then say which.
- *
- * One function because the two halves are one decision and splitting them is
- * how #118 happened — the removal at the end of dispatch had no idea whether
- * anything had been saved, and the salvage at the top of the failure branch had
- * no idea the blocked branch fell through to a `--force` removal.
- *
- * A salvage that *fails* retains the tree whatever the caller asked for. There
- * was real work, git refused to commit it, and the tree is now the only copy in
- * existence: deleting it on schedule would be the data loss this whole path
- * exists to prevent. The issue is held out of dispatch until an operator says
- * otherwise, because the next attempt's `worktree remove --force` would finish
- * the job (see `admitCandidates`).
- *
- * Exported so a test can drive the real decision against a real git tree.
- */
-export async function settleWorktree(
-  args: {
-    issue: number;
-    attempt: number;
-    /** Clause for the commit subject: "killed by the turns cap", "blocked …". */
-    ending: string;
-    worktree: string;
-    /** The run's branch, so the pre-removal publish names the right ref. */
-    branch: string;
-    /**
-     * Publishes the run branch on the privileged side. Required rather than
-     * optional: the run's commits live in a repository of its own,
-     * so a removal that did not publish first would delete the only copy —
-     * which is #121's data loss with one extra step. `undefined` is a visible
-     * decision at the call site, never an omission.
-     */
-    publish: RunPublisher | undefined;
-  } & (
-    | /** Terminal-failure and orphan trees are evidence, and are kept even when clean. */
-    { tree: "keep" }
-    | { tree: "remove"; mirrorPath: string }
-  ),
-): Promise<WorktreeSettlement> {
-  const { issue, attempt, ending, worktree, branch, publish } = args;
-  const outcome = await salvageWip(worktree, issue, attempt, ending, publish);
-  const retained = args.tree === "keep" || outcome.kind === "failed";
-  if (!retained && args.tree === "remove") {
-    // Before the removal, always — not only when salvage found something. A run
-    // that *committed* and could not publish has its work in its own repository
-    // and nowhere else, and salvage never sees a committed tree because it is
-    // clean. The mirror fetch inside `publish` is what preserves it; the push
-    // to GitHub can fail (no network, protected ref) and the work still lives.
-    const published = await publish?.(branch);
-    if (published !== undefined && !published.ok) {
-      log(`#${issue} publish before removal failed, work is preserved in the mirror: ${published.stderr}`);
-    }
-    await removeWorktree(args.mirrorPath, worktree);
-  }
-
-  const lines = salvageLines(outcome, worktree, retained);
-  log(`#${issue} salvage: ${lines.join(" ")}`);
-  return {
-    outcome,
-    retained,
-    lines,
-    patch:
-      outcome.kind === "salvaged"
-        ? { salvageSha: outcome.sha }
-        : outcome.kind === "failed"
-          ? { salvageError: outcome.error }
-          : {},
-  };
-}
-
-
 /**
  * How a run's end is named — in the salvage commit, and to whoever reads it.
  * The whole clause, not a bare reason: a graceful block was not killed by
@@ -1271,6 +1482,22 @@ export async function buildBrief(
      * resolved from the rendered thread itself.
      */
     lane?: FileLane;
+    /**
+     * The effective `Model:` declaration admission resolved for this
+     * candidate (#535). When carried, the brief echoes exactly this
+     * selector — the same value dispatch launches on — instead of
+     * recomputing from the dispatch-time comment read, so the run's model is
+     * one value on every surface. Absent (unit-level callers), the model is
+     * resolved from the rendered thread itself.
+     */
+    model?: EffectiveModel;
+    /**
+     * The typed host-constraints block the brief renders (#721), re-read with
+     * the config at the tick boundary so an operator edit applies on the next
+     * dispatch. Absent renders no host-constraints section at all — the
+     * brief is byte-for-byte what it always was.
+     */
+    host?: HostConstraints;
   } = {},
 ): Promise<string> {
   // Read per dispatch rather than caching: editing the brief then takes effect
@@ -1315,6 +1542,16 @@ export async function buildBrief(
   // discussion budget, keeping the gate and the worker-visible brief on one
   // lane (#608).
   const comments = opts.comments ?? [];
+  // The effective lane admission resolved (or resolves) for this candidate:
+  // the carried admission snapshot when dispatch has one, else the thread
+  // itself. Both the discussion renderer and the parsed-lane section draw on
+  // the same value, so the brief shows one lane on every surface (#608, #724).
+  const lane = opts.lane ?? (comments === "unread" ? undefined : effectiveLane(r.issue.body, comments));
+  // The effective model declaration admission resolved (or resolves) for this
+  // candidate: the carried admission snapshot when dispatch has one, else the
+  // thread itself. Dispatch launches on the same value, so the brief shows
+  // one model on every surface (#535).
+  const model = opts.model ?? (comments === "unread" ? undefined : effectiveModel(r.issue.body, comments));
   return renderBrief(template, {
     ISSUE_NUMBER: String(r.issue.number),
     ISSUE_TITLE: r.issue.title,
@@ -1323,19 +1560,24 @@ export async function buildBrief(
     BRANCH: branch,
     WORKTREE: worktree,
     ACCEPTANCE_CRITERIA: acceptanceCriteria(r.issue),
-    ISSUE_COMMENTS: renderDiscussion(
-      comments,
-      opts.lane ?? (comments === "unread" ? undefined : effectiveLane(r.issue.body, comments)),
-    ),
+    ISSUE_COMMENTS: renderDiscussion(comments, lane),
+    FILE_LANE: laneBlock(lane),
+    MODEL: modelBlock(model),
     GATES: gatesBlock(r.repo),
     // The guarded shell suites and their sanctioned parse-only check, derived
     // from SHARED_HOST_SCRIPTS so the brief and the refusal share one list
     // (#687). Non-empty whenever the guard has paths, so the placeholder line
     // always renders to a line.
     SHARED_HOST_NOTICE: sharedHostBriefNotice(),
-    // Empty for a repo with no `graphProject`, and empty means *nothing*: the
-    // placeholder sits flush against the next list item in the template, so an
-    // unconfigured render leaves no blank line where a hint would have gone.
+    // The typed host-constraints paragraph (#721): derived cores/RAM folded
+    // into the operator's description, the non-interactive PATH, and the
+    // routed repo's convention. Empty when the config names none — no
+    // section, no placeholder text.
+    HOST_CONSTRAINTS: hostConstraintsNotice(opts.host, repoSlug(r.repo)),
+    // The brief's code-graph paragraph: the exact `project` key for a
+    // configured repo, or an explicit "no graph" statement for an
+    // unconfigured one — never silence, because a worker that knows there is
+    // no graph stops looking for it.
     GRAPH_HINT: graphHint(r.repo),
     CONTINUATION: continuation,
   });
@@ -1344,178 +1586,6 @@ export async function buildBrief(
 // ------------------------------------------------------------------- one issue
 
 
-/** The failure classes `countContinuations` deliberately does not charge — the
- *  inverted copy of its exclusions, kept beside the breakdown that consumes it
- *  so the two can only drift together (#439). `orphan-clean` is absent on
- *  purpose: daemon orphans consume the continuation budget, which is exactly
- *  why the requeue side has to respect the ceiling instead of racing it. */
-const NON_CONTINUATION_CLASSES: Partial<Record<FailureClass, true>> = {
-  "admin-kill": true,
-  "settlement-stuck": true,
-  "env-start-failure": true,
-  "dispatch-infra": true,
-  "provider-credit": true,
-  "provider-transient": true,
-  "provider-capacity": true,
-};
-
-/** How one issue spent its continuation budget, grouped by failure class —
- *  the exact rows `continuationsFor` charges, so an exhaustion escalation
- *  reports the same budget it says is spent. `unclassified` groups rows that
- *  charged before the class was written (a pre-upgrade NULL). */
-function continuationBreakdown(runs: readonly RunRecord[]): Map<string, number> {
-  const perClass = new Map<string, number>();
-  for (const r of runs) {
-    const chargedAsKilledOrOrphaned =
-      (r.state === "killed" || r.state === "orphaned" || r.state === "blocked") &&
-      (r.failureClass === undefined || NON_CONTINUATION_CLASSES[r.failureClass] === undefined);
-    const chargedAsReturned = r.state === "failed" && r.failureClass === "returned-for-revision";
-    if (!chargedAsKilledOrOrphaned && !chargedAsReturned) continue;
-    const cls = r.failureClass ?? "unclassified";
-    perClass.set(cls, (perClass.get(cls) ?? 0) + 1);
-  }
-  return perClass;
-}
-
-/** The newest attempt's preserved work, if any, so an exhaustion escalation can
- *  say whether continuing is worthwhile: `salvageSha`/`headSha`/`prUrl` are the
- *  three artifacts a run can leave, and all null on a branch nothing reached. */
-function newestContinuableRun(runs: readonly RunRecord[]): RunRecord | undefined {
-  const newestFirst = [...runs].reverse();
-  return newestFirst.find(
-    (r) => r.salvageSha !== undefined || r.headSha !== undefined || r.prUrl !== undefined,
-  );
-}
-
-/** The fenced-block info string that marks an exhaustion postmortem comment, so
- *  a grooming scout re-slicing the issue can find and parse the whole block by
- *  grepping for it. */
-export const POSTMORTEM_MARKER = "conductor-postmortem";
-
-/** How one issue's attempt chain failed, as "3× ci-deterministic, 1× …" — the
- *  digest shape for naming what the exhaustion was. Groups every row by its
- *  failure class, whether or not it charged the continuation budget, because
- *  the postmortem tells the whole story and not just the budget half (#290). */
-export function attemptClassBreakdown(runs: readonly RunRecord[]): string {
-  const perClass = new Map<string, number>();
-  for (const r of runs) {
-    const cls = r.failureClass ?? "unclassified";
-    perClass.set(cls, (perClass.get(cls) ?? 0) + 1);
-  }
-  if (perClass.size === 0) return "unclassified";
-  return Array.from(perClass, ([cls, n]) => `${n}× ${cls}`).join(", ");
-}
-
-/** Wall-clock duration of one run as a compact human string ("45m", "1h30m"). */
-export function humanDuration(ms: number): string {
-  const seconds = Math.max(0, Math.round(ms / 1_000));
-  if (seconds < 60) return `${seconds}s`;
-  const minutes = Math.round(seconds / 60);
-  if (minutes < 60) return `${minutes}m`;
-  const hours = Math.floor(minutes / 60);
-  const rest = minutes % 60;
-  return rest === 0 ? `${hours}h` : `${hours}h${rest}m`;
-}
-
-/** Flatten and bound a run's last error to one greppable table line. */
-export function oneLineBrief(text: string | undefined): string | undefined {
-  if (text === undefined || text.trim() === "") return undefined;
-  const flat = text.replace(/\s+/g, " ").trim();
-  return flat.length > 90 ? `${flat.slice(0, 89)}…` : flat;
-}
-
-/**
- * The exhaustion postmortem block: one greppable fenced block covering every
- * attempt in the chain — continuation rows included — with per-attempt turns,
- * wall clock, failure class and a one-line last error, the explicit salvage
- * state, the spend total and the transcript paths for local inspection.
- *
- * Pure so the tests hold the shape, not the transport: the writer below owns
- * the once-only guarantee, this owns what "once" looks like.
- */
-export function formatExhaustionPostmortem(args: {
-  issue: number;
-  runs: readonly RunRecord[];
-  reason: string;
-}): string {
-  const { issue, runs, reason } = args;
-  const artifact = newestContinuableRun(runs);
-  const totalSpend = runs.reduce((sum, r) => sum + r.spendUsd, 0);
-  const spend = `$${totalSpend.toFixed(2)}`;
-  const attemptLines = runs.map((r) => {
-    const wall = r.endedAt === undefined ? "—" : humanDuration(r.endedAt - r.startedAt);
-    const cls = r.failureClass ?? "unclassified";
-    const error = oneLineBrief(r.lastError) ?? "—";
-    return (
-      `  attempt ${r.attempt}  ${r.state.padEnd(12)}  turns ${r.turns}/${r.maxTurns}  ` +
-      `${cls.padEnd(24)}  ${wall.padStart(4)}  last error: ${error}`
-    );
-  });
-  const salvage =
-    artifact === undefined
-      ? "Salvaged WIP: absent — no attempt preserved a branch, head SHA or pull request."
-      : `Salvaged WIP: present — branch ${artifact.branch} at ${artifact.headSha ?? artifact.salvageSha}` +
-        `${artifact.prUrl === undefined ? "" : ` (PR ${artifact.prUrl})`}.`;
-  return [
-    `\`\`\`${POSTMORTEM_MARKER}`,
-    `#${issue} exhausted: ${attemptClassBreakdown(runs)}`,
-    reason,
-    "",
-    `Attempts (${runs.length} total, ${spend} spend):`,
-    ...attemptLines,
-    salvage,
-    `Spend total: ${spend} across ${runs.length} attempts.`,
-    "Transcripts:",
-    ...runs.map((r) => (r.sessionFile === undefined ? "  (none)" : `  ${r.sessionFile}`)),
-    "```",
-  ].join("\n");
-}
-
-/** Dedupe key prefix for the exhaustion postmortem comment, per issue. */
-function postmortemDedupeKey(project: string, issue: number): string {
-  return `${project}:postmortem:${issue}`;
-}
-
-/**
- * The exhaustion postmortem: written exactly once per issue, at the point the
- * continuation budget is spent and the issue is settled toward a human.
- *
- * The comment and the material event are both gated by the store's notification
- * ledger — the same idempotence guard the escalator uses — so re-settling an
- * already-postmortemed issue posts nothing and records nothing. A body-string
- * match on the issue would be the wrong guard: an issue re-scoped and re-run
- * would still carry the old block, and the guarantee asked of this is "decided
- * once", not "deduped against what is already written".
- *
- * The digest must name the exhaustion even if the comment write fails, so the
- * material event is recorded before the write and unconditionally (the ledger
- * is append-only, and the gate above already ran once). The comment failure is
- * logged rather than taking the sweep down with it.
- */
-async function postExhaustionPostmortem(d: Deps, run: RunRecord, reason: string): Promise<void> {
-  const { project, tracker, store } = d;
-  const key = postmortemDedupeKey(project.name, run.issue);
-  if (store.wasNotified(key)) return;
-  const runs = store.runsForIssue(project.name, run.issue);
-  const body = formatExhaustionPostmortem({ issue: run.issue, runs, reason });
-  const occurredAt = Date.now();
-  store.recordMaterialEvent({
-    project: project.name,
-    category: "exhaustion",
-    summary: `#${run.issue} exhausted: ${attemptClassBreakdown(runs)}`,
-    evidence: body,
-    occurredAt,
-    recordedAt: occurredAt,
-  });
-  try {
-    await tracker.comment(run.issue, body);
-    store.markNotified(key);
-    log(`#${run.issue} posted exhaustion postmortem (${runs.length} attempts)`);
-  } catch (err) {
-    log(`#${run.issue} postmortem comment could not be posted (${errText(err)})`);
-  }
-}
-
 export type ExtendTurnLimitResult =
   | { kind: "extended"; runId: string; maxTurns: number }
   | { kind: "not-increase"; runId: string; maxTurns: number }
@@ -1719,48 +1789,9 @@ export async function verifyPushedGreenClaim(
   };
 }
 
-/** What the settlement audit of one green run produced: the advisory flags
- *  (test weakening only — the file-list disclosure is derived, not flagged),
- *  whether the diff was cut short, and the `changed:` line composed from the
- *  PR's own diff. */
-export interface SettlementAuditResult {
-  flags: SettlementFlag[];
-  truncated: boolean;
-  /** The `changed:` file list derived from the PR's diff, present whenever the
-   *  diff could be read. Absent means the tree could not be read, and `flags`
-   *  then carries exactly {@link UNREADABLE_TREE_FLAG}. */
-  changedLine?: string;
-}
-
 /**
- * Audit a worker's own account of its work against the pull request it pushed.
- *
- * The thin half of the split #85 established: this fetches, {@link
- * analyseSettlement} decides. It runs beside {@link verifyPushedGreenClaim} and
- * shares none of its authority — that function decides a run's state, this one
- * cannot, by construction. It returns evidence and the caller appends it.
- *
- * A diff that cannot be read is a finding (`changed-line-missing`), never an
- * empty flag list: nothing was derived and nothing was checked, and that must
- * not read as a clean bill.
- */
-export async function collectSettlementFlags(
-  tracker: Pick<Tracker, "prDiff">,
-  claim: { prUrl?: string; issueText: string },
-): Promise<SettlementAuditResult> {
-  if (claim.prUrl === undefined) return { flags: [UNREADABLE_TREE_FLAG], truncated: false };
-  const diff = await tracker.prDiff(claim.prUrl);
-  if (diff === undefined) return { flags: [UNREADABLE_TREE_FLAG], truncated: false };
-  return {
-    flags: analyseSettlement({ issueText: claim.issueText, diff }),
-    truncated: diff.truncated,
-    changedLine: deriveChangedLine(diff),
-  };
-}
-
-/**
- * One attempt at one issue, from claim to terminal state. Everything is inside
- * a single try/catch so that a bad issue costs its own run and nothing else.
+ * One attempt at one issue, from claim to terminal state. Everything is inside
+ * a single try/catch so that a bad issue costs its own run and nothing else.
  */
 /**
  * Whether a turns-cap kill is handed straight back to the queue.
@@ -1901,11 +1932,39 @@ function orphanResumeVerdict(
   return { kind: "resume", prior };
 }
 
+/**
+ * The worker identity for one launch, resolved now — or a throw naming the host
+ * change that is missing (#798/#828).
+ *
+ * Every input is host state a running daemon does not control: the account can
+ * be created after startup, and systemd can bring this service up before it has
+ * mounted the harness binding a worker resolves through. So the verdict is taken
+ * per launch. A daemon that cached one at startup would hold the whole fleet
+ * closed on a boot race until somebody restarted it by hand — the outage #828
+ * exists to end, not to relocate.
+ *
+ * The throw lands in the caller's dispatch catch, which settles the run failed
+ * with this reason and escalates. It classifies as a start failure, so a host
+ * fault charges the issue no implementation attempt.
+ */
+function launchIdentity(d: Pick<Deps, "workerIdentity">, launching: string): WorkerIdentity {
+  const resolution: WorkerIdentityResolution = d.workerIdentity?.() ?? {
+    ok: false,
+    reason: `the ${WORKER_ACCOUNT} account is not installed on this host`,
+  };
+  if (resolution.ok) return resolution.identity;
+  throw new Error(
+    `worker identity unavailable: ${resolution.reason} — refusing to launch an unbound ${launching}; ` +
+      "run `omp-conductor setup host` to install the dedicated worker identity",
+  );
+}
+
 export async function handleIssue(
   d: Deps,
   r: Routed,
   attempt: number,
   admittedLane?: FileLane,
+  admittedModel?: EffectiveModel,
 ): Promise<void> {
   const { project, caps, tracker, store } = d;
   const issue = r.issue.number;
@@ -2067,6 +2126,24 @@ export async function handleIssue(
       return;
     }
 
+    // The claim-side of the project drain fence (#484): the tick's gate sits
+    // above routing, so a drain created after that gate can still land
+    // mid-pass — the claim re-checks and refuses while a fresh drain is in
+    // force. An invalid record fails closed the same way. The read here is
+    // observational on purpose: the claim refuses but must not consume the
+    // marker, or the first refused claim would unbind the rest of its own
+    // pass; the tick's consumeDrain removes it on the next pass, so no claim
+    // path can ever be blocked permanently by it.
+    const claimDrain = readDrain(d.project.name);
+    if (claimDrain.kind === "active" || claimDrain.kind === "error") {
+      log(
+        claimDrain.kind === "error"
+          ? `#${issue} not claimed: drain record invalid (${claimDrain.problem})`
+          : `#${issue} not claimed: project drain in effect`,
+      );
+      return;
+    }
+
     // Claim on the STORE first, before anything that can fail. The run row —
     // not the label — is the crash-safe guard against double dispatch: rows
     // are local, written before any network call, and the startup orphan
@@ -2094,13 +2171,21 @@ export async function handleIssue(
     // unconfigured project — and today's dispatch is byte for byte what it
     // has always been.
     const chainConfigured = (project.modelFallbacks?.length ?? 0) > 0;
+    // A `Model:` declaration admission resolved for this candidate (#535) is
+    // this issue's workerModel: the orchestrator names a tier when it
+    // promotes, and dispatch launches on that selector exactly as if the
+    // project's `workerModel` were the declared value. Absent a declaration,
+    // today's `project.workerModel` is unchanged, and the failover chain
+    // (#286) keeps its semantics in both cases — it is the same resolution,
+    // one different primary.
+    const declaredModel = admittedModel?.model;
     const choice = resolveDispatchModel({
-      workerModel: project.workerModel,
+      workerModel: declaredModel ?? project.workerModel,
       modelFallbacks: project.modelFallbacks,
       threshold: project.modelFallbackThreshold ?? DEFAULT_MODEL_FALLBACK_THRESHOLD,
       streak: chainFacts.streak,
     });
-    const clause = fallbackClause(choice, chainFacts, project.workerModel);
+    const clause = fallbackClause(choice, chainFacts, declaredModel ?? project.workerModel);
 
     // #536: an orphan-clean requeue resumes the interrupted session instead of
     // re-reading the repo from zero. Decided here, before this attempt's row
@@ -2142,6 +2227,17 @@ export async function handleIssue(
       spendUsd: 0,
       maxTurns: caps.workerMaxTurns,
       startedAt: Date.now(),
+      // #567: the orphan-clean attempt this claim continues, when the verdict
+      // above fired. `undefined` for a fresh dispatch — the store maps that to
+      // NULL, so a fresh row simply never carries the field.
+      resumedFromRunId: resuming?.id,
+      // #744: the file-lane declaration admission resolved for this candidate
+      // is persisted on the row, so lane occupancy survives across dispatch
+      // passes — a later pass knows what this run *intends* to touch, not only
+      // what it has touched so far. This is the exact `Admission.lane` the gate
+      // enforced and the brief rendered, never a re-parse. Absent for a run
+      // with no declaration (fail open), exactly as it was admitted.
+      lane: admittedLane,
     });
     // #434: carry a terminal predecessor's open PR onto the continuation row.
     // The claim itself stays synchronous — `handleIssue` claims at the top of
@@ -2180,6 +2276,14 @@ export async function handleIssue(
     if (await settleStopBeforeSession()) return;
     if (await settleDrainBeforeSession()) return;
 
+    // The worker identity is this run's launch gate (#798): a worker session
+    // that cannot be launched under the dedicated unprivileged account is
+    // indistinguishable from an operator shell, so dispatch refuses before any
+    // tree or session is created. Resolved here rather than read off a startup
+    // verdict, so a host that gained its account — or its harness binding
+    // (#828) — after the daemon came up dispatches on the next tick.
+    const identity = launchIdentity(d, "worker session");
+
     // A run's tree is <workspaceRoot>/<issue> and addRunRepo refuses to reuse
     // an existing path, so a retry — or a tree kept from a failed attempt — has
     // to be cleared first. Both helpers are pure path math, and removeWorktree
@@ -2260,7 +2364,13 @@ export async function handleIssue(
         runRepoPath: worktreePath,
         branch,
       },
-      { ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }) },
+      {
+        ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }),
+        // A worker-run channel is secured to the worker identity (#798): the
+        // child that must connect to it runs as that uid, and the peer verdict
+        // expects that uid on the wire rather than the daemon's.
+        channelOwner: { uid: identity.uid, gid: identity.gid },
+      },
     );
     if (await settleStopBeforeSession()) return;
     if (await settleDrainBeforeSession()) return;
@@ -2317,6 +2427,8 @@ export async function handleIssue(
           : {}),
         comments,
         lane: admittedLane,
+        model: admittedModel,
+        host: d.host,
       });
     }
     if (await settleStopBeforeSession()) return;
@@ -2324,6 +2436,13 @@ export async function handleIssue(
 
     const repoSlug = githubRepo(r.repo.cloneUrl);
 
+    // The run's working paths are granted to the worker identity by ownership
+    // (#798) — the worktree the session edits and the session directory it
+    // writes its transcript and settings into. The chown lands here, after
+    // provisioning and the verb socket, so the session starts on a tree it
+    // owns; the worker identity never inherits anything from root's trees.
+    d.grantWorkerPaths?.(identity, worktreePath, sessionDir);
+
     let result: WorkerResult;
     try {
       result = await runWorker({
@@ -2353,6 +2472,7 @@ export async function handleIssue(
         onChildLog: (line) => {
           log(`#${issue} ${line}`);
         },
+        workerIdentity: identity,
         ...(choice.model === undefined ? {} : { model: choice.model }),
         // The fleet-owned omp settings overlay (#537): the staged YAML the
         // session loads through `Settings.init({ configFiles: [<path>] })` —
@@ -2432,6 +2552,15 @@ export async function handleIssue(
         ? await collectSettlementFlags(tracker, {
             prUrl: result.prUrl,
             issueText: `${r.issue.title}\n${r.issue.body}`,
+            // The claimed-proof check compares the PR's Verified commands
+            // against what this run's session actually recorded.
+            sessionFile: result.sessionFile,
+            // The effective file lane admission resolved for this run at
+            // dispatch — the same value the brief rendered, pre-dispatch
+            // comment declarations included (#608, #744). The audit flags a
+            // diff that escapes it, so a widened lane is named on evidence
+            // rather than found by reading the PR's file list by hand (#739).
+            lane: admittedLane,
           })
         : undefined;
     if (result.state === "pushed-green" && audit?.truncated) {
@@ -2541,6 +2670,10 @@ export async function handleIssue(
       ...(result.prUrl === undefined ? {} : { prUrl: result.prUrl }),
       ...(result.headSha === undefined ? {} : { headSha: result.headSha }),
       sessionFile: result.sessionFile,
+      // The code-graph session observation (#726): what the run's own session
+      // registry held at start, persisted with the rest of the run's facts.
+      // Absent only when the session surface did not record one.
+      ...(result.graphTools === undefined ? {} : { graphTools: result.graphTools }),
       // Every terminal state persists the worker's report — with the `changed:`
       // file list derived from the PR's diff where one could be read — not
       // just a green push: a stopped attempt's partial report is still part of
@@ -2618,7 +2751,7 @@ export async function handleIssue(
       });
 
       if (providerCredit !== undefined) {
-        await reactToProviderCredit(d, issue, providerCredit, result.sessionFile);
+        await reactToProviderCredit({ project: d.project, escalate: (e) => d.escalate(e), isPaused, setPaused }, issue, providerCredit, result.sessionFile);
         swapToQueue(d, issue, inProgress);
       } else if (continueTurns) {
         // Requeue as one ordered pair: the in-progress removal before the
@@ -2812,6 +2945,91 @@ export async function dispatchReviewRevisions(d: Deps, pool?: WorkerPool): Promi
       );
       break;
     }
+    // A capped/failed run has no pushed-green settle sweep keeping its row
+    // honest (#795 review round 1): nothing transitions a `failed` / `killed`
+    // row when its PR merges or closes, so a PR that changed after the verb
+    // recorded the round would otherwise be claimed and a worker resumed
+    // against a dead PR. The settled-green origin keeps its own interlock
+    // (the settle sweep flips the row and the claim below refuses it), so
+    // only terminal-origin rounds re-read the reviewed PR fact here: the
+    // round dispatches only while the PR is still open at the exact reviewed
+    // head.
+    //
+    // The skip decision is decisive-fact only (review round 2): a definitively
+    // missing PR (`GhPrMissingError` — a corroborated 404, #779), a PR that
+    // is definitively not open, and a head that has definitively MOVED are
+    // settled skipped, exactly like any other row that moved. Everything
+    // transient or unreadable — a bare 404 that could not be corroborated, an
+    // undefined answer, a pending check run, a same-head red check that a
+    // rerun may clear, a throwing tracker — stays PENDING for the next tick:
+    // settling it would permanently discard the orchestrator's findings and
+    // consume the round.
+    const origin = d.store.getRun(revision.runId)?.state;
+    if (origin === "failed" || origin === "killed") {
+      let prState: PrState | undefined;
+      try {
+        prState = await d.tracker.prState(revision.prUrl);
+      } catch (err) {
+        if (err instanceof GhPrMissingError) {
+          d.store.settleReviewRevision(revision.id, "skipped", Date.now());
+          log(
+            `#${revision.issue} review round ${revision.round} skipped: ${revision.prUrl} does not exist — the reviewed PR is gone`,
+          );
+          continue;
+        }
+        log(
+          `#${revision.issue} review round ${revision.round} held: PR state re-check failed (${errText(err)}) — retrying next tick`,
+        );
+        continue;
+      }
+      if (prState === undefined) {
+        log(
+          `#${revision.issue} review round ${revision.round} held: ${revision.prUrl} state could not be re-read — retrying next tick`,
+        );
+        continue;
+      }
+      if (prState !== "open") {
+        d.store.settleReviewRevision(revision.id, "skipped", Date.now());
+        log(
+          `#${revision.issue} review round ${revision.round} skipped: ${revision.prUrl} is ${prState}, not open — a review round resumes an open PR only`,
+        );
+        continue;
+      }
+      let verification: PrVerification | undefined;
+      try {
+        verification = await d.tracker.verifyPr(revision.prUrl, revision.headSha);
+      } catch (err) {
+        log(
+          `#${revision.issue} review round ${revision.round} held: the reviewed-head check failed (${errText(err)}) — retrying next tick`,
+        );
+        continue;
+      }
+      if (verification === undefined || verification.status === "pending") {
+        log(
+          `#${revision.issue} review round ${revision.round} held: ${revision.prUrl} at ${revision.headSha} is ` +
+            `${verification?.status ?? "unverifiable"} — retrying next tick`,
+        );
+        continue;
+      }
+      if (verification.status === "failed" && isHeadMismatch(verification.reason)) {
+        d.store.settleReviewRevision(revision.id, "skipped", Date.now());
+        log(
+          `#${revision.issue} review round ${revision.round} skipped: ${revision.prUrl} no longer stands at ` +
+            `${revision.headSha} (${verification.reason}) — the reviewed head moved`,
+        );
+        continue;
+      }
+      // Anything else — a same-head red check a rerun may clear, an unknown
+      // verdict — is not definitive: the round stays pending for the next
+      // tick rather than discarding the findings.
+      if (verification.status !== "green") {
+        log(
+          `#${revision.issue} review round ${revision.round} held: ${revision.prUrl} at ${revision.headSha} is ` +
+            `${verification.status} — retrying next tick`,
+        );
+        continue;
+      }
+    }
     if (!d.store.claimRunForReview(revision.runId)) {
       d.store.settleReviewRevision(revision.id, "skipped", Date.now());
       log(
@@ -2972,18 +3190,84 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
   // and shutdown fences cover the whole wake window, exactly as they do for a
   // fresh claim in `handleIssue` (#374). The original run's entries were
   // closed at its settle, so reopening by issue is safe.
+  //
+  // #747: the round gets its own bounded allowance instead of the original
+  // attempt's remainder. The resumed session continues the run's own counter
+  // — the attempt's spent turns travel with the session — so a ceiling of
+  // `run.maxTurns` would leave the round only `run.maxTurns - run.turns`,
+  // and returning a PR from a near-cap run could not finish. Open at the
+  // run's ceiling, then raise it by the round's own allowance — the run's
+  // ceiling again, capped by the project's hard ceiling — through the same
+  // override path `omp-conductor extend` uses, so the raise is persisted on
+  // the row (the run's budget stays explainable in status) while `turns`
+  // keeps accumulating the run's true cost: nothing is reset.
   turnLimit = d.turnLimits.open(project.name, issue, runId, run.maxTurns);
+  const revisionAllowance = Math.min(run.maxTurns, caps.workerMaxTurnsCeiling);
+  const revisionCeiling = run.turns + revisionAllowance;
+  const revisionRaise = d.turnLimits.extend(project.name, issue, revisionCeiling);
+  if (revisionRaise.kind === "extended") {
+    log(
+      `#${issue} review round ${revision.round} turn ceiling ${run.maxTurns} → ${revisionCeiling} ` +
+        `(+${revisionAllowance} round allowance on ${run.turns} spent)`,
+    );
+  }
   workerControl = d.workerControls.open(project.name, issue, runId);
   if (await settleStopBeforeSession()) return;
   if (await settleDrainBeforeSession()) return;
 
+  // The same launch gate as a fresh claim (#798): a revision worker is a
+  // worker, and an unbound one is an operator shell — refuse before any tree
+  // or session is created. Thrown inside the try so the ordinary dispatch
+  // catch settles it: the run row is returned to terminal `failed` with the
+  // reason, the revision row is settled with it, and the still-green PR stays
+  // open for a healthy retry.
   try {
+    const identity = launchIdentity(d, "review-revision worker");
     // Reattach the run's own branch at the same per-issue path the run used:
-    // the worktree was removed at the pushed-green settle and the branch was
-    // published, so provisioning is the same continuation reattach as a
-    // normal re-claim. A provisioning failure restores the row — the PR is
-    // still green and still open, and only the wake failed — and says so.
+    // a `pushed-green` settle removed the worktree, so provisioning is the
+    // same continuation reattach as a normal re-claim. A capped/failed run's
+    // tree was RETAINED at its terminal settle (`tree: "keep"`, #795) — the
+    // reviewed PR is green, so the branch already holds the work and the kept
+    // tree holds nothing the branch does not, unless its salvage failed. Clear
+    // it the way restart recovery does (#692): re-attempt the salvage through
+    // `tree: "remove"`, and refuse the removal if that still fails — the tree
+    // is then the only copy of work and is never destroyed. A provisioning
+    // failure restores the row — the PR is still green and still open, and
+    // only the wake failed — and says so.
     try {
+      if (run.worktree !== "" && existsSync(run.worktree)) {
+        const keptSettlement = await settleWorktree({
+          issue: run.issue,
+          attempt: run.attempt,
+          ending: `review round ${revision.round} resume`,
+          worktree: run.worktree,
+          branch: run.branch,
+          publish: (branch) => pushRunBranch(project, { repo, runRepoPath: run.worktree, branch }),
+          tree: "remove",
+          mirrorPath,
+        });
+        if (keptSettlement.retained) {
+          log(
+            `#${issue} review round ${revision.round} retained worktree ${run.worktree}: ` +
+              "its salvage failed, so the tree is the only copy of work and will not be removed",
+          );
+          store.updateRun(runId, {
+            state: "pushed-green",
+            endedAt: Date.now(),
+            lastError: `review round ${revision.round} could not clear the run's retained worktree: ${keptSettlement.lines.join(" ")}`,
+          });
+          store.settleReviewRevision(revision.id, "skipped", Date.now());
+          await safeEscalate(d, {
+            tier: 1,
+            project: project.name,
+            issue,
+            runId,
+            summary: `#${issue} review round ${revision.round} could not be dispatched — the run's retained worktree is the only copy of work`,
+            detail: [revision.prUrl, "", ...keptSettlement.lines].join("\n"),
+          });
+          return;
+        }
+      }
       const provisioned = await addRunRepo(repo, project.mirrorRoot, project.workspaceRoot, issue, branch);
       worktreePath = provisioned.path;
       runRepo = { repo, runRepoPath: worktreePath, branch };
@@ -3051,7 +3335,10 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
         runRepoPath: worktreePath,
         branch,
       },
-      { ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }) },
+      {
+        ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }),
+        channelOwner: { uid: identity.uid, gid: identity.gid },
+      },
     );
     if (await settleStopBeforeSession()) return;
     if (await settleDrainBeforeSession()) return;
@@ -3066,6 +3353,11 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
 
     log(`#${issue} review round ${revision.round} → resuming ${branch} (${priorSessionFile})`);
 
+    // The revision worker gets its own tree ownership, exactly as a fresh
+    // claim does (#798): the resumed worktree and session directory belong to
+    // the worker identity before its session starts.
+    d.grantWorkerPaths?.(identity, worktreePath, sessionDir);
+
     let result: WorkerResult;
     try {
       result = await runWorker({
@@ -3090,6 +3382,7 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
         onChildLog: (line) => {
           log(`#${issue} ${line}`);
         },
+        workerIdentity: identity,
         // The continuation stays on the model the green run used (#286).
         ...(run.model === undefined ? {} : { model: run.model }),
         ...(ompSettingsFile === undefined ? {} : { ompSettingsFile }),
@@ -3184,6 +3477,7 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
       ...(result.prUrl === undefined ? {} : { prUrl: result.prUrl }),
       ...(result.headSha === undefined ? {} : { headSha: result.headSha }),
       sessionFile: result.sessionFile,
+      ...(result.graphTools === undefined ? {} : { graphTools: result.graphTools }),
       report: finalReport,
       ...settlement?.patch,
     };
@@ -3392,8 +3686,12 @@ export async function reconcileCrashedReviewRevisions(d: Deps): Promise<ReviewRe
     }
     // A revision the previous daemon never claimed: the run is still a
     // settled green row and the round is still pending, so the ordinary
-    // dispatch pass wakes it on the next tick untouched.
-    if (run.state === "pushed-green") continue;
+    // dispatch pass wakes it on the next tick untouched. Same for a
+    // capped/failed run whose review round is pending (#795): a `failed` /
+    // `killed` row is terminal too — no process died on this round, the
+    // revision was never claimed, and the ordinary dispatch pass claims it
+    // exactly like a pending round on a pushed-green row.
+    if (run.state === "pushed-green" || run.state === "failed" || run.state === "killed") continue;
     // The run a previous daemon claimed for this round and died on: the
     // orphan sweep just marked it `orphaned` (salvaging the tree to the
     // branch), so restore it to the reviewable state the verb recorded.
@@ -3528,119 +3826,6 @@ export async function reconcileCrashedReviewRevisions(d: Deps): Promise<ReviewRe
 }
 
 // ------------------------------------------------------------------- settlement
-
-/** What a resolved PR turns its `pushed-green` row into. */
-export interface Settlement {
-  state: "merged" | "failed";
-  /** The log line after `#<n> settled: `, and — for a rejection — the row's own
-   *  `lastError`, because a `failed` row whose worker succeeded has to say so. */
-  reason: string;
-}
-
-/**
- * What one `pushed-green` row becomes now its PR has an answer, or undefined to
- * leave the row exactly as it is.
- *
- * A `pushed-green` row is the only one nothing ever revisited: the worker is
- * finished, `reconcileOrphanedRuns` only settles rows that held a process, and
- * `merged` went unwritten from day one. So they accumulated — three of them on
- * the reference fleet on 2026-08-07, every PR merged and every issue closed,
- * with `/healthz` still reporting three active runs and their issues
- * permanently unclaimable, because the busy set *is* the active set (#18).
- *
- * The mapping, and why each answer is the only honest one:
- *
- * - `merged` — the work landed. That is what `merged` was reserved for.
- * - `closed` — a human read the work and said no. Leaving it `pushed-green`
- *   forever is a lie; `failed` records that it did not land and releases the
- *   busy guard, so an issue a human re-queues can be attempted again. A row
- *   that had reached `pushed-green` or `pushed-pending` is classified
- *   `returned-for-revision` at settlement. A review decision asks for another
- *   implementation pass, not a failure, so it consumes the continuation budget
- *   instead of the failed-attempt budget.
- * - `open`, and undefined — nothing changes. Undefined is "could not tell": a
- *   flaky network, a revoked token, a deleted PR. Settling on it would record a
- *   merge that never happened, and the next tick asks again for free. An
- *   ambiguous answer must never settle a row.
- */
-export function settlementFor(pr: PrState | undefined, prUrl: string): Settlement | undefined {
-  if (pr === "merged") return { state: "merged", reason: `${prUrl} merged` };
-  if (pr === "closed") return { state: "failed", reason: `${prUrl} closed without merging` };
-  return undefined;
-}
-
-/**
- * Records the in-progress label's release as a projection op (#201).
- *
- * Settlement used to write only half of what it knew. On 2026-08-09 that cost
- * the reference fleet two issues in one night: veltro#331 settled to `failed`
- * at 23:53Z once the orchestrator closed veltro#332 unmerged, and veltro#344
- * settled to `merged` at 05:54Z once chad#452 squash-merged. Both rows left the
- * active set correctly; an authoritative `gh issue view` on each afterwards
- * still showed `agent:in-progress` — permanently unclaimable with no supported
- * way back (#18).
- *
- * The outbox makes the row transition and the label one fact again: the
- * removal is enqueued in the same breath as the row is terminalised, the
- * projector applies it with unbounded retry, and while it is pending the
- * eligibility overlay treats the label as already gone. A tracker that refuses
- * the write (403, rate limit) can no longer strand the row — that is `#184`
- * and `#198` closed. No `pushed-*` row is ever written terminal with its
- * label release owed but unrecorded, because enqueueing is a local store write
- * that cannot fail on the tracker.
- *
- * Synchronous. The op is durable the moment this returns.
- */
-export function releaseInProgress(
-  d: Pick<Deps, "project" | "store">,
-  issue: number,
-  why: string,
-): void {
-  const label = d.project.stateLabels.inProgress;
-  d.store.enqueueLabelOps(d.project.name, [{ issue, op: "remove", label }]);
-  log(`#${issue} released ${label} (queued): ${why}`);
-}
-
-/**
- * Asks the tracker about every `pushed-green` PR and settles the ones that
- * resolved.
- *
- * Effects at the call site, decision in {@link settlementFor} — the same split
- * as `checkIntegrity`/`watchOrchestrator`. Exported like `admitCandidates`
- * rather than kept private, because half of what has to hold is about the sweep
- * and not the mapping: that a row without a PR costs no API call, and that one
- * unreachable PR does not stop the others from settling.
- *
- * The label is released too, which reverses what this function first promised.
- * It used to leave tracker labels alone exactly as {@link reconcileOrphanedRuns}
- * does, reasoning that a merge closes the issue anyway and that deciding what an
- * issue's labels should say next is the orchestrator's drain duty. There turned
- * out to be no such path: on 2026-08-09 two settled rows left their issues
- * carrying `agent:in-progress` forever, with the brief forbidding the
- * orchestrator from touching it and `unblock` declining to (see
- * {@link releaseInProgress}). The row transition and the label are one fact, and
- * writing half of it is the whole of that bug.
- *
- * Releasing it is safe here specifically because of what these rows are. A
- * `pushed-green` or `pushed-pending` row has no process behind it — its worker
- * exited and its worktree is gone — so a terminal answer about its PR proves no
- * worker owns the issue, and the duplicate-dispatch interlock the label exists
- * for is spent. {@link reconcileOrphanedRuns} still leaves labels alone for the
- * opposite reason: an orphaned `running` row is work nobody has read yet. And
- * the brief's rule stays absolute, because this is a daemon-owned write through
- * the same Tracker port the dispatcher claimed the issue with — orphan detection
- * is only trustworthy while every state label on the tracker came from this
- * package.
- *
- * The two writes are ordered label-then-row, and the order is load-bearing. This
- * sweep is the only thing that revisits a `pushed-*` row, so the terminal state
- * is also the row's exit from it: written first, a tracker that then failed on
- * the label would leave `agent:in-progress` with nothing left to retry it — #18
- * exactly, in the last window able to reach it. Writing the label first makes
- * failure cost a repeated `gh` call on the next tick instead, and the row stays
- * in the busy set throughout, so no second worker can be sent at the issue while
- * it waits.
- */
 const BASE_CHECK_BATCH = 20;
 const BASE_CHECK_WINDOW_MS = 24 * 60 * 60 * 1_000;
 const BASE_STATUS_WINDOW_MS = 7 * 24 * 60 * 60 * 1_000;
@@ -3948,220 +4133,6 @@ export async function watchBaseHealth(
   }
 }
 
-export async function settlePushedGreen(
-  d: Pick<Deps, "project" | "tracker" | "store">,
-): Promise<number> {
-  const { project, tracker, store } = d;
-  // Runs the sweep resolved by terminalising the row. Every terminal write
-  // below increments it; the tick attributes it as `settled` on the pass's
-  // dispatch record, so a held pass is visible as work done, not just as a
-  // clock that moved (#497).
-  let settled = 0;
-  // Filtered from the active set rather than asked for with a new query: active
-  // is live workers plus these, so the list is bounded by the worker cap plus
-  // the number of PRs awaiting a merge — a handful, by construction. A fleet
-  // where that is not a handful has a merge problem, not a dispatch one.
-  const pending = store
-    .activeRuns(project.name)
-    .filter((r) => r.state === "pushed-green" || r.state === "pushed-pending");
-
-  for (const run of pending) {
-    // Nothing to ask about. A pushed result requires a PR, so a malformed row
-    // must not buy a `gh` call every five minutes forever.
-    if (run.prUrl === undefined) continue;
-
-    let pr: PrState | undefined;
-    try {
-      pr = await tracker.prState(run.prUrl);
-    } catch (err) {
-      // Per row, like admission's held candidate. The GitHub adapter already
-      // answers undefined instead of throwing, so this catch is the port's
-      // contract rather than that adapter's behaviour — and a tracker that does
-      // throw must cost its own row, not the whole sweep.
-      log(`#${run.issue} not settled: PR state lookup failed (${errText(err)}) — retrying next tick`);
-      continue;
-    }
-
-    const settlement = settlementFor(pr, run.prUrl);
-    if (settlement !== undefined) {
-      // A mediated merge enters a second, bounded observation phase. Record the
-      // exact merge commit before the row leaves the active set; if GitHub cannot
-      // supply it yet, retry this settlement next tick rather than create a
-      // merged row whose base result can never be attributed.
-      let merged: MergedPrInfo | undefined;
-      if (settlement.state === "merged") {
-        try {
-          merged = await tracker.mergedPrInfo(run.prUrl);
-        } catch (err) {
-          log(`#${run.issue} not settled: merge identity lookup failed (${errText(err)}) — retrying next tick`);
-          continue;
-        }
-        if (merged === undefined) {
-          log(`#${run.issue} not settled: merge identity unavailable — retrying next tick`);
-          continue;
-        }
-      }
-
-      // The label removal and the terminal row are one fact again (#201): the
-      // release is enqueued — a durable local write that cannot fail on the
-      // tracker — in the same breath as the row is terminalised.
-      releaseInProgress(d, run.issue, settlement.reason);
-      const patch: Partial<RunRecord> = {
-        state: settlement.state,
-        endedAt: Date.now(),
-        ...(merged === undefined
-          ? {}
-          : {
-              mergeSha: merged.mergeSha,
-              baseRef: merged.baseRef,
-              baseCheck: "pending",
-            }),
-      };
-      if (settlement.state === "failed") {
-        patch.lastError = settlement.reason;
-        patch.failureClass = "returned-for-revision";
-        patch.recoveryAction = "none";
-      }
-      store.updateRun(run.id, patch);
-      settled += 1;
-      log(`#${run.issue} settled: ${settlement.reason}`);
-      continue;
-    }
-
-    if (run.state !== "pushed-pending" || pr !== "open" || run.headSha === undefined) continue;
-    let verification;
-    try {
-      verification = await tracker.verifyPr(run.prUrl, run.headSha);
-    } catch (err) {
-      log(`#${run.issue} checks not settled (${errText(err)}) — retrying next tick`);
-      continue;
-    }
-    if (verification === undefined) continue;
-    if (verification.status === "green") {
-      store.updateRun(run.id, { state: "pushed-green", lastError: null });
-      log(`#${run.issue} checks settled: ${verification.reason}`);
-    } else if (verification.status === "failed") {
-      // Equally terminal, so the release is enqueued before the row writes,
-      // for the same reason as the settlement branch above (see there). The
-      // green branch releases nothing — that row is still awaiting a merge,
-      // and its live PR is exactly the work the label must keep guarding.
-      releaseInProgress(d, run.issue, verification.reason);
-      store.updateRun(run.id, { state: "failed", lastError: verification.reason });
-      settled += 1;
-      log(`#${run.issue} checks failed: ${verification.reason}`);
-    } else {
-      store.updateRun(run.id, { lastError: verification.reason });
-    }
-  }
-  return settled;
-}
-
-const ADOPTABLE_PR_STATES: Partial<Record<RunState, true>> = {
-  failed: true,
-  killed: true,
-  orphaned: true,
-  blocked: true,
-};
-
-/**
- * Reattaches a recovered PR to the terminal run that owns it (#245).
- *
- * A worker can fail before its completion report records `prUrl`, then have its
- * dirty tree committed and pushed by salvage. If that branch already has a PR,
- * the orchestrator otherwise has no policy-compliant path to inspect or merge
- * it: ownership is store-backed. Adoption is deliberately stricter than
- * admission. The tracker query proves the PR closes this run's issue; exact
- * branch and canonical repository matches prove it is this run's recovered
- * work, not an unrelated closer. Missing identity is refusal, never a guess.
- *
- * The newest run per issue is inspected, at most ten per tick and only inside
- * the same 30-day window as mediated PR verbs. The cursor advances through the
- * full eligible set so persistent non-matches cannot starve older recovered
- * work. Successful adoption is idempotent because the row gains `prUrl`;
- * non-matches are logged once per daemon process.
- */
-const rejectedSalvagedPrRuns = new Set<string>();
-const salvagedPrCursor = new Map<string, string>();
-
-export async function adoptSalvagedPrs(
-  d: Pick<Deps, "project" | "tracker" | "store">,
-  now = Date.now(),
-): Promise<void> {
-  const { project, tracker, store } = d;
-  const eligible = store
-    .recentRuns(project.name, now - PR_LOOKUP_WINDOW_MS)
-    .filter(
-      (run) =>
-        ADOPTABLE_PR_STATES[run.state] === true &&
-        run.prUrl === undefined &&
-        run.branch.trim() !== "",
-    );
-  const previous = salvagedPrCursor.get(project.name);
-  const previousIndex =
-    previous === undefined ? -1 : eligible.findIndex((run) => run.id === previous);
-  const start = previousIndex === -1 ? 0 : (previousIndex + 1) % eligible.length;
-  const candidates = Array.from(
-    { length: Math.min(SALVAGED_PR_ADOPTION_BATCH, eligible.length) },
-    (_, offset) => eligible[(start + offset) % eligible.length]!,
-  );
-  const last = candidates.at(-1);
-  if (last !== undefined) salvagedPrCursor.set(project.name, last.id);
-
-  for (const run of candidates) {
-    const repo = project.routing.repos[run.repo];
-    const repoIdentity = repo === undefined ? undefined : githubRepo(repo.cloneUrl);
-    let closers: OpenCloser[];
-    try {
-      closers = await tracker.openClosersFor(run.issue);
-    } catch (err) {
-      log(`#${run.issue} PR adoption lookup failed (${errText(err)}) — retrying next tick`);
-      continue;
-    }
-
-    const closer = closers.find(
-      (candidate) =>
-        candidate.headRefName !== "" &&
-        candidate.headRefName === run.branch &&
-        repo !== undefined &&
-        candidate.repo !== "" &&
-        candidate.repo === repoIdentity,
-    );
-    if (closer === undefined) {
-      if (!rejectedSalvagedPrRuns.has(run.id)) {
-        const observed = closers[0];
-        const reason =
-          observed === undefined
-            ? "no open closing PR"
-            : observed.headRefName === ""
-              ? "closer has no head branch identity"
-              : observed.headRefName !== run.branch
-                ? `closer head ${observed.headRefName} does not match retained branch ${run.branch}`
-                : observed.repo === ""
-                  ? "closer has no repository identity"
-                  : `closer repository ${observed.repo} does not match routed repository`;
-        log(`#${run.issue} PR not adopted onto attempt ${run.attempt}: ${reason}`);
-        rejectedSalvagedPrRuns.add(run.id);
-      }
-      continue;
-    }
-
-    const flag: SettlementFlag = {
-      kind: "pr-adopted",
-      file: "(recovery)",
-      detail: `${closer.url} matched retained branch ${run.branch} in ${closer.repo}`,
-    };
-    store.updateRun(run.id, {
-      prUrl: closer.url,
-      settlementFlags: [...(run.settlementFlags ?? []), flag],
-    });
-    rejectedSalvagedPrRuns.delete(run.id);
-    log(
-      `#${run.issue} adopted PR ${closer.url} onto attempt ${run.attempt}` +
-        (run.salvageSha === undefined ? "" : ` (salvaged head ${run.salvageSha})`),
-    );
-  }
-}
-
 /** Canonical `owner/repo` identity from a configured network clone URL. */
 function githubRepo(cloneUrl: string): string | undefined {
   const normalized = cloneUrl.replace(/\/$/, "").replace(/\.git$/, "");
@@ -4189,7 +4160,7 @@ type CleanupRetainedWorktree = (
  * dirty or uniquely unpushed work.
  */
 export async function cleanupRetainedRuns(
-  d: Pick<Deps, "project" | "tracker" | "store">,
+  d: Pick<Deps, "project" | "tracker" | "store" | "escalate">,
   queuedIssues: ReadonlySet<number>,
   cursor: RetainedCleanupCursor,
   cleanup: CleanupRetainedWorktree = cleanupRetainedWorktree,
@@ -4254,9 +4225,35 @@ export async function cleanupRetainedRuns(
 
     const outcome = await cleanup(mirrorPathFor(repo, project.mirrorRoot), run.worktree, run.branch);
     if (outcome.kind === "removed") {
-      store.updateRun(run.id, { worktree: "" });
+      store.updateRun(run.id, {
+        worktree: "",
+        ...(run.quarantineDetail === undefined ? {} : { quarantineDetail: null }),
+      });
       log(`#${run.issue} retained worktree reaped: ${run.worktree} (${run.branch})`);
+    } else if (outcome.reason === "quarantined") {
+      // A tree whose object store cannot be made sound is potentially
+      // stranded work: the daemon refuses to fetch into it, so its commits
+      // cannot be verified against any remote. The row records the condition
+      // so the status snapshot can name the tree, and the escalation ledger
+      // dedupes on the stable summary below — a pass that keeps seeing the
+      // same broken tree reports it once, never once per dispatch pass.
+      store.updateRun(run.id, { quarantineDetail: outcome.detail });
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue: run.issue,
+        summary: `#${run.issue} quarantined retained worktree — potentially stranded work`,
+        detail: `${run.worktree} (${run.branch})\n${outcome.detail}`,
+      });
     } else {
+      // Any other retained reason means the tree is back under ordinary
+      // retention: its alternates were repaired (or never needed it), so the
+      // quarantine — if one was marked — is over and the snapshot must not
+      // keep naming it as quarantined.
+      if (run.quarantineDetail !== undefined) {
+        store.updateRun(run.id, { quarantineDetail: null });
+        log(`#${run.issue} retained worktree no longer quarantined: ${outcome.detail}`);
+      }
       log(`#${run.issue} retained worktree kept (${outcome.reason}): ${outcome.detail}`);
     }
   }
@@ -4281,6 +4278,7 @@ export function summarizeDispatch(
   holds: readonly AdmissionHold[],
   completedAt = Date.now(),
   settled = 0,
+  parked = 0,
 ): DispatchSummary {
   const groups = new Map<AdmissionHoldReason, { count: number; issues: number[]; details: string[] }>();
   for (const hold of holds) {
@@ -4310,6 +4308,10 @@ export function summarizeDispatch(
         ...(group.details.length === 0 ? {} : { details: group.details }),
       })),
     settled,
+    // Omitted at zero so a pass with nothing parked keeps the pre-#507 record
+    // shape byte for byte — old persisted rows lack the key and readers use
+    // `?? 0` either way.
+    ...(parked === 0 ? {} : { parked }),
   };
 }
 
@@ -4442,6 +4444,13 @@ export function upgradeVerifyDepsFor(d: Pick<Deps, "project" | "store">): Upgrad
       );
       return launched.ok === true ? { ok: true, unit: launched.unit } : { ok: false, stderr: launched.stderr };
     },
+    herdrSession: resolveHerdrSession(process.env),
+    // The durable pane probe for the post-restart verifier (#832): every omp
+    // process the fleet pane currently claims by herdr, resolved to its start
+    // time — the evidence an external (pane-owned) orchestrator actually
+    // restarted after the install began, through the same shared probe as the
+    // in-process upgrade.
+    probePaneOmp: (session) => herdrPaneOmpStarts(runCommand, session, processStartTimeMs),
     log,
     now: () => Date.now(),
   };
@@ -4470,14 +4479,71 @@ async function verifyPendingUpgradeTick(
   }
 }
 
+/**
+ * The daemon's conductor.db snapshot cadence (#289) — the ledger's only
+ * durable copy, taken on the digest-aligned {@link dbSnapshotDue} window:
+ * once per local day, at/after the digest's configured `at` when it has one.
+ *
+ * Host-global, like the store itself: one snapshot per day for every project,
+ * so whichever project's daemon wins the day first publishes it and the
+ * others no-op on the same durable marker. The marker is written through the
+ * store's existing notification ledger (a one-row idempotence guard, the same
+ * primitive escalations use not to act twice) *after* the snapshot is
+ * published — a crash between publish and mark re-snapshots the next tick
+ * instead of skipping the day, and a restored store that predates today's
+ * marker takes a fresh snapshot on the next tick.
+ *
+ * Returns true when a snapshot was published. A store that does not exist
+ * yet is a silent no-op: there is nothing to back up, and `doctor`'s
+ * `db-backup` probe already treats that as a pass.
+ */
+export function runDbSnapshotCadence(args: {
+  digestPolicy: ReportingPolicy["digest"];
+  store: Pick<Store, "wasNotified" | "markNotified">;
+  source: string;
+  backupDir: string;
+  now?: number;
+  keep?: number;
+  log?: (line: string) => void;
+}): boolean {
+  const { digestPolicy, store, source, backupDir } = args;
+  // No store yet (first boot before any run persisted) → nothing to back up;
+  // `doctor`'s `db-backup` probe already treats that as a pass.
+  if (!existsSync(source)) return false;
+  const now = args.now ?? Date.now();
+  const today = localDayKey(now, digestPolicy.timezone);
+  const alreadyToday = store.wasNotified(dbSnapshotMarkerKey(today));
+  if (!dbSnapshotDue({ digest: digestPolicy }, alreadyToday ? today : undefined, now)) {
+    return false;
+  }
+  const published = snapshotDb(source, backupDir, now);
+  (args.log ?? log)(`conductor.db snapshot published: ${published}`);
+  store.markNotified(dbSnapshotMarkerKey(today));
+  try {
+    const removed = pruneDbSnapshots(backupDir, args.keep ?? DB_SNAPSHOT_RETENTION);
+    if (removed > 0) {
+      (args.log ?? log)(`db snapshot retention pruned ${removed} file(s) beyond the retained ${args.keep ?? DB_SNAPSHOT_RETENTION}`);
+    }
+  } catch (err) {
+    // The snapshot is already published and marked; an over-bound directory
+    // costs disk until the next due day retries the prune, never the backup.
+    (args.log ?? log)(`db snapshot retention prune failed: ${errText(err)}`);
+  }
+  return true;
+}
+
 export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // A config edit takes effect on the next tick, not the next daemon restart
   // (#170). Re-resolve the project and its caps at the tick boundary so a tick
   // and every run it admits see one consistent snapshot; a failed read keeps
   // the boot values rather than wedging the tick, and the next tick tries
-  // again.
+  // again. The same reloaded config feeds the db-snapshot backup dir: when it
+  // is unreadable the cadence falls back to the state-root default, matching
+  // `doctor`'s probe of an absent field.
+  let reloadedConfig: ConductorConfig | undefined;
   try {
     const cfg = loadConfig();
+    reloadedConfig = cfg;
     const fresh = findProject(cfg, d.project.name);
     const freshCaps = resolveCaps(fresh, cfg.defaults);
     if (JSON.stringify(fresh) !== JSON.stringify(d.project) || JSON.stringify(freshCaps) !== JSON.stringify(d.caps)) {
@@ -4485,6 +4551,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     }
     d.project = fresh;
     d.caps = freshCaps;
+    d.host = cfg.host;
     d.deliveryPolicyValid = true;
   } catch (err) {
     log(`config reload failed (${errText(err)}) — retaining boot values but blocking autonomous delivery`);
@@ -4559,6 +4626,25 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     log(`salvaged PR adoption sweep failed: ${errText(err)}`);
   }
 
+  // The conductor.db snapshot cadence (#289) is durability, not dispatch:
+  // the verb ledger, the decision rows and the run history have no other
+  // copy, so they are snapshotted once per day on the digest-aligned window.
+  // Above the pause gate on purpose — a parked fleet still accumulates ledger
+  // rows and still deserves a backup — and a failure costs the day's snapshot
+  // placeholder, never the tick: failed cadence steps are logged and retried
+  // by the five-minute loop, exactly like the sweeps above it.
+  try {
+    runDbSnapshotCadence({
+      digestPolicy: (d.project.reporting ?? DEFAULT_REPORT_POLICY).digest,
+      store: d.store,
+      source: dbPath(),
+      backupDir: dbBackupDirFor(reloadedConfig),
+      log,
+    });
+  } catch (err) {
+    log(`db snapshot cadence failed: ${errText(err)}`);
+  }
+
   // Immediately after settlement and before any routing, so a class is on the
   // row before the next dispatch decision reads its budgets (#132). Above the
   // pause gate deliberately: classification and label reconciliation are
@@ -4568,7 +4654,15 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // Each is guarded on its own: a tracker that fails mid-classification must not
   // stop the label reconcile, and neither may stop the tick.
   try {
-    settled += await classifyAndRecover(d);
+    settled += await classifyAndRecover({
+      project: d.project,
+      caps: d.caps,
+      tracker: d.tracker,
+      store: d.store,
+      escalate: (e) => d.escalate(e),
+      isPaused,
+      setPaused,
+    });
   } catch (err) {
     log(`classification sweep failed: ${errText(err)}`);
   }
@@ -4618,6 +4712,37 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
       log(`decision condition pass failed: ${errText(err)}`);
     });
 
+  // A spend-cap pause is self-expiring (#780). The spend gate below persists a
+  // pause once today's spend reaches the cap, but once that latch is on disk
+  // every later pass returns at the pause gate and never reaches the spend
+  // check again — so the fleet stayed stopped after the rolling window reset
+  // until an operator ran `resume`. The same measurement that closed the gate
+  // reopens it: clear a per-project spend-cap pause when the current
+  // rolling-window spend is below the cap (or no cap is configured at all —
+  // the gate that justified the pause is gone). Two guards keep the clear from
+  // ever overriding another stop: only the exact instance that was read is
+  // removed (a hold that replaced the sentinel meanwhile is untouched, review
+  // #780), and only the per-project sentinel is ever considered — the legacy
+  // global sentinel, which may carry an operator/integrity/setup hold, is
+  // never removed, so the pause gate below still observes it.
+  const spendPausePath = pausedPath(d.project.name);
+  const spendPause = pauseInstanceAt(spendPausePath);
+  if (spendPause?.source === "spend-cap") {
+    const spent = d.store.spendSince(d.project.name, startOfToday());
+    if (
+      (d.caps.dailySpendUsd === null || spent < d.caps.dailySpendUsd) &&
+      clearPauseIfUnchanged(spendPausePath, spendPause)
+    ) {
+      log(
+        `spend-cap pause cleared: $${spent.toFixed(2)} ` +
+          (d.caps.dailySpendUsd === null
+            ? "(no daily cap configured)"
+            : `below the $${d.caps.dailySpendUsd.toFixed(2)} daily cap`) +
+          " — dispatch resumes",
+      );
+    }
+  }
+
   // A paused fleet claims nothing. Checked first so pausing takes effect on the
   // next tick without signalling the process. But the pass still ran, and the
   // operator has to be able to see it: record it as a held pass — the work the
@@ -4638,6 +4763,37 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     return;
   }
 
+  // The project drain is the self-expiring sibling of the pause fence (#484):
+  // the same admission boundary — settlement above it, nothing claimed below —
+  // but the intent is durable (it survives orchestrator loss) and bounded (the
+  // record carries an absolute deadline, so a crash can never strand
+  // admission). Three shapes, three behaviours:
+  //   - fresh drain with live runs → a held pass, exactly like a pause;
+  //   - fresh drain with nothing left to wait for → the drain is satisfied
+  //     and clears itself, so a completed drain never needs a second operator
+  //     action and this pass proceeds normally;
+  //   - malformed record → fails closed for THIS pass (it might be a fresh
+  //     fence we cannot read), and the same consume removed it, so it can
+  //     never become an unbounded permanent drain.
+  const drain = consumeDrain(d.project.name);
+  if (drain.kind === "active") {
+    // Completion is the ACTIVE set, not the live-worker set: pushed-pending
+    // and pushed-green PRs still make the `runs-settled` release gate fail, so
+    // a drain that cleared while one remained would admit work on top of a
+    // batch the releases still see as unfinished (#776 review #2).
+    if (d.store.activeRuns(d.project.name).length === 0) {
+      cancelDrain(d.project.name);
+      log("project drain completed: no active runs remain — drain cleared");
+    } else {
+      d.store.recordDispatch(d.project.name, summarizeHeldPass(settled));
+      return;
+    }
+  } else if (drain.kind === "error") {
+    log(`project drain record invalid (${drain.problem}) — removed; this pass admits nothing`);
+    d.store.recordDispatch(d.project.name, summarizeHeldPass(settled));
+    return;
+  }
+
   const { project, caps, store } = d;
 
   // "Nobody patches the running conductor" is a hard boundary in both briefs —
@@ -4727,18 +4883,57 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     return pending.length === 0 ? issue : { ...issue, labels: effectiveLabels(issue.labels, pending) };
   });
   const { routed, unroutable } = route(effective, project);
-  // Ready issues that route() dropped without a reason carry a state label —
-  // claimed by a live or settling run — so the claimed count is subtraction
-  // rather than a routed-state signal (#228).
-  const claimed = effective.length - routed.length - unroutable.length;
-  const routingHolds: AdmissionHold[] = unroutable.map((u) => ({
-    issue: u.issue.number,
-    reason: `unroutable:${u.reason}`,
-  }));
+  // route() drops a candidate for two reasons, only one of which is a claim
+  // question. A lifecycle state label (agent:in-progress/blocked/failed)
+  // marks a run-owned issue: it is genuinely in flight while its newest run
+  // is live or settling, and a terminal newest run — or no run at all — means
+  // the label is residual, the footprint of a settled run nobody cleared,
+  // which is Duty 1 reconciliation work, not occupied capacity. A missing
+  // queue label instead marks an issue the outbox is withdrawing (a pending
+  // queue-label removal, e.g. releaseQueueLabel after a merge the PR did not
+  // close), which belongs in none of the three populations. So `claimed` is
+  // defined from actual ownership over genuinely lifecycle-labelled candidates
+  // rather than as the residual of routing (#228, #611).
+  const stateLabels = new Set(Object.values(project.stateLabels));
+  const dropped = effective.filter(
+    (issue) => !isEligible(issue, project) && issue.labels.some((l) => stateLabels.has(l)),
+  );
+  // The operator's park label is not a stale lifecycle label: the queue query
+  // still returns a parked-and-queued issue, route() drops it as ineligible,
+  // and the claim gate holds it as `issue-parked` when the park lands mid-pass
+  // (#734). Counting it as stale-lifecycle below would summon the orchestrator
+  // to reconcile a deliberate decision. Parked is its own population, derived
+  // from the same isEligible read the gate uses, so the number status renders
+  // cannot disagree with what admission would hold (#507).
+  const parkedCandidates = effective.filter(
+    (issue) => !isEligible(issue, project) && issue.labels.includes(project.stateLabels.backlog),
+  );
+  const parkedNumbers = new Set(parkedCandidates.map((issue) => issue.number));
+  let claimed = 0;
+  let parked = 0;
+  const lifecycleHolds: AdmissionHold[] = [];
+  for (const issue of dropped) {
+    const newest = store.latestRun(project.name, issue.number);
+    if (newest !== undefined && ACTIVE_STATES.includes(newest.state)) {
+      claimed += 1;
+    } else if (parkedNumbers.has(issue.number)) {
+      // A park never kills a live run; a parked issue with no run is inventory
+      // the operator is deliberately holding, not reconciliation work.
+      parked += 1;
+    } else {
+      lifecycleHolds.push({ issue: issue.number, reason: "stale-lifecycle" });
+    }
+  }
+  const routingHolds: AdmissionHold[] = [
+    ...unroutable.map(
+      (u): AdmissionHold => ({ issue: u.issue.number, reason: `unroutable:${u.reason}` }),
+    ),
+    ...lifecycleHolds,
+  ];
   const recordDispatch = (admitted: number, holds: readonly AdmissionHold[]): void => {
     store.recordDispatch(
       project.name,
-      summarizeDispatch(ready.length, routed.length, claimed, admitted, holds, Date.now(), settled),
+      summarizeDispatch(ready.length, routed.length, claimed, admitted, holds, Date.now(), settled, parked),
     );
   };
 
@@ -4783,7 +4978,8 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
       summary: `Daily spend cap reached on ${new Date().toISOString().slice(0, 10)} — ${project.name} is paused`,
       detail: [
         `Spent $${spent.toFixed(2)} of the $${caps.dailySpendUsd.toFixed(2)} daily cap.`,
-        "No further work will be claimed until `omp-conductor resume`.",
+        "Dispatch stays paused until today's spend falls below the cap, then resumes",
+        "automatically on the next pass — `omp-conductor resume` only speeds that up.",
       ].join("\n"),
     });
     recordDispatch(0, [
@@ -4831,7 +5027,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   log(`dispatching ${pass.admitted.map((a) => `#${a.r.issue.number}`).join(" ")}`);
   await dispatchAdmissions(
     pass.admitted,
-    (a) => handleIssue(d, a.r, a.attempt, a.lane),
+    (a) => handleIssue(d, a.r, a.attempt, a.lane, a.model),
     workers,
   );
 
@@ -4859,6 +5055,23 @@ export interface DaemonHealthSnapshot {
   codeGraph?: CodeGraphHealth;
   /** Live workers in a non-running pause phase; absent/empty = nothing paused. */
   workers?: { issue: number; runId: string; phase: WorkerPausePhase }[];
+  /**
+   * The live orchestrator surface, attested by the running daemon (#832):
+   * which mode this project's fleet is in, and — when the daemon hosts the
+   * orchestrator session itself — the extension version that session *loaded*
+   * and the transcript it resumed. This is the read the upgrade's
+   * session-reload verification checks: a restarted daemon whose orchestrator
+   * child came up on the installed release answers `loaded` equal to that
+   * release; one that never reloaded answers an older version; one that
+   * failed to start answers `mode: "failed"`. `external` means the pane owns
+   * the session and the daemon cannot attest it from here.
+   */
+  orchestrator?: {
+    mode: "embedded" | "external" | "failed";
+    loaded?: string;
+    sessionFile?: string;
+    alive?: boolean;
+  };
 }
 
 export interface DaemonHealth {
@@ -4874,6 +5087,7 @@ export function daemonHealthSnapshot(
   paused = isPaused(project),
   codeGraph?: CodeGraphHealth,
   workerControls?: WorkerControlRegistry,
+  orchestrator?: DaemonHealthSnapshot["orchestrator"],
 ): DaemonHealthSnapshot {
   const dispatch = store.latestDispatch(project);
   return {
@@ -4885,6 +5099,7 @@ export function daemonHealthSnapshot(
     ...(dispatch === undefined ? {} : { dispatch }),
     ...(codeGraph?.configured === true ? { codeGraph } : {}),
     ...(workerControls === undefined ? {} : { workers: workerControls.snapshot(project) }),
+    ...(orchestrator === undefined ? {} : { orchestrator }),
   };
 }
 
@@ -5202,6 +5417,55 @@ export async function daemonHttpResponse(req: Request, d: DaemonHttpDeps): Promi
   return workerControl ?? new Response("not found\n", { status: 404 });
 }
 
+/**
+ * The effective reporting surface, derived from the configured policy — never
+ * from the legacy preset name alone: an explicit policy without the
+ * `scopePreset` back-annotation must present the same truth from `interruptOn`
+ * and the digest cadence (#633).
+ */
+export interface ReportingSummary {
+  /** The legacy preset this policy came from, when the config back-annotates one. */
+  scopePreset?: ReportScope;
+  /** Categories allowed to interrupt the operator's phone. */
+  interruptOn: InterruptCategory[];
+  /** Where non-interrupting outcomes accumulate: the effective digest config. */
+  digest: ReportingPolicy["digest"];
+}
+
+/**
+ * The effective reporting summary. The loader always materialises the policy,
+ * so `undefined` means the default (`DEFAULT_REPORT_POLICY`); the preset name
+ * is carried only when the policy actually back-annotates one, so a rendered
+ * status names the preset without ever letting a stale or absent preset
+ * misstate what the policy does (#633).
+ */
+export function reportingSummary(policy: ReportingPolicy | undefined): ReportingSummary {
+  const effective = policy ?? DEFAULT_REPORT_POLICY;
+  return {
+    ...(effective.scopePreset === undefined ? {} : { scopePreset: effective.scopePreset }),
+    interruptOn: [...effective.interruptOn],
+    digest: { ...effective.digest },
+  };
+}
+
+/**
+ * The active drain as structured status exposes it: the creation instant, the
+ * absolute deadline, the purpose, and the live-run count the drain is waiting
+ * to reach zero. Only present on the snapshot while the record is fresh.
+ */
+export interface DrainStatus {
+  /** Epoch-ms instant the drain intent was recorded. */
+  since: number;
+  /** Absolute epoch-ms deadline — admission resumes automatically after it. */
+  expiresAt: number;
+  /** Purpose recorded at creation. */
+  reason?: string;
+  /** Runs still in the active set (live workers plus pushed-state PRs) — the
+   *  count a drain waits to reach zero, matching the `runs-settled` release
+   *  gate (#776 review #2). */
+  remainingRuns: number;
+}
+
 export interface StatusSnapshot {
   project: string;
   configPath: string;
@@ -5213,10 +5477,27 @@ export interface StatusSnapshot {
    * reading like a mistake (#220).
    */
   pauseReason?: string;
+  /**
+   * The project's active self-expiring drain (#484): present only while a
+   * fresh, valid drain record exists. Paused and drained are deliberately two
+   * fields — a drain is bounded and self-clearing where a pause is not, and
+   * the structured surface has to tell them apart without reading the pass
+   * history. Human CLI wording over it is a later #484 child.
+   */
+  drain?: DrainStatus;
   /** Mechanical operator availability at the moment this snapshot was read. */
   availability?: AvailabilityState;
   /** Next digest opportunity under the same predicate that gates submission. */
   digestSchedule?: DigestScheduleState;
+  /**
+   * The effective reporting policy: what interrupts, where everything else
+   * goes, and the legacy preset name when one is back-annotated. On the
+   * snapshot so the human `status`, the dashboard API and the CLI all read
+   * the same truth about the reporting surface without opening config — a
+   * routine outcome that reads as "Telegram is broken" unless the policy says
+   * it is digest-only (#633).
+   */
+  reporting?: ReportingSummary;
   caps: Caps;
   /**
    * The effective per-shape release grants. On the snapshot rather than re-read
@@ -5225,6 +5506,14 @@ export interface StatusSnapshot {
    * the config or the brief.
    */
   releaseGrants: ResolvedGrants;
+  /**
+   * The effective review policy (#678). On the snapshot for the reason
+   * `releaseGrants` is: the orchestrator's Duty 1 has to act on it every
+   * tick, and a stale level or ceiling sitting only in a config file nobody
+   * opens is exactly the drift this field exists to surface. The loader always
+   * materialises it, so this is never absent on a real daemon.
+   */
+  review: ReviewPolicy;
   /** Occupied issues: live workers plus green PRs awaiting a human merge. */
   activeRuns: RunRecord[];
   /**
@@ -5239,6 +5528,11 @@ export interface StatusSnapshot {
   /** Newest attempts holding a preserved WIP tip, or a tree that is still the
    *  only copy of work the daemon could not save. */
   salvagedRuns: RunRecord[];
+  /** Retained trees whose object store could not be made sound, so the daemon
+   *  refused to fetch into them and their commits cannot be verified against
+   *  any remote (#737). Distinguished from ordinary retention on purpose —
+   *  quarantine is "potentially stranded work", not routine housekeeping. */
+  quarantinedRuns: RunRecord[];
   /** One-shot issue ceilings waiting for the next claim. */
   turnOverrides: TurnOverride[];
   /** Reports the operator has not provably received: pending, in-flight with an
@@ -5325,6 +5619,19 @@ export function statusSnapshotFromStore(
   // Read once: the provenance read touches the filesystem, and the renderer
   // should never pay for it twice per status.
   const reason = pauseProvenance(p.name)?.reason;
+  // Same cost discipline as the pause read: the drain record is a file read,
+  // and the active-drain view is only built when one is actually fresh. The
+  // read is observational — it never mutates the record — so a status read
+  // cannot consume a malformed marker the next dispatch pass still has to fail
+  // closed on; the dispatch consume owns cleanup (#776 review #2).
+  const drain = readDrain(p.name);
+  // The live run list feeds the worker-capacity row; the drain's
+  // remaining-runs count waits on the ACTIVE set (live workers plus
+  // pushed-state PRs), the same population the `runs-settled` release gate
+  // reads, so the two can never disagree about when a batch is finished
+  // (#776 review #2).
+  const live = store.liveRuns(p.name);
+  const active = store.activeRuns(p.name);
   // The live review-revision rounds, read from the same durable rows the
   // restart recovery uses: a run whose revision is dispatched is read as
   // `review-revision N` while its worker is live (#692).
@@ -5338,18 +5645,31 @@ export function statusSnapshotFromStore(
     stateDir: stateDir(),
     paused: isPaused(p.name),
     ...(reason === undefined ? {} : { pauseReason: reason }),
+    ...(drain.kind === "active"
+      ? {
+          drain: {
+            since: Date.parse(drain.drain.createdAt),
+            expiresAt: Date.parse(drain.drain.expiresAt),
+            ...(drain.drain.reason === undefined ? {} : { reason: drain.drain.reason }),
+            remainingRuns: active.length,
+          } satisfies DrainStatus,
+        }
+      : {}),
     availability: availabilityState(p.reporting, now),
     digestSchedule: digestScheduleState(p.reporting ?? DEFAULT_REPORT_POLICY, lastDigestDay, now),
+    reporting: reportingSummary(p.reporting ?? DEFAULT_REPORT_POLICY),
     caps,
     releaseGrants: resolveReleaseGrants(p),
-    activeRuns: store.activeRuns(p.name),
+    review: resolveReview(p),
+    activeRuns: active,
     reviewRounds,
     salvagedRuns: store.salvagedRuns(p.name),
+    quarantinedRuns: store.quarantinedRuns(p.name),
     turnOverrides: store.listTurnOverrides(p.name),
     openReports: store.openReports(p.name),
     digestBacklog: store.digestBacklog(p.name),
     verbLedger: store.verbLedger(p.name, { limit: STATUS_LEDGER_SCAN }),
-    liveWorkers: store.liveRuns(p.name).length,
+    liveWorkers: live.length,
     runsToday: store.runsStartedSince(p.name, since),
     spendTodayUsd: store.spendSince(p.name, since),
     ...(dispatch === undefined ? {} : { dispatch }),
@@ -5396,6 +5716,14 @@ export function formatDispatchSummary(summary?: DispatchSummary): string {
       `  candidates    ${summary.ready} ready / ${summary.claimed ?? 0} in flight / ${summary.routed} spare`,
       `  admitted      ${summary.admitted}`,
     );
+    // The operator's park label, counted from the same eligibility read the
+    // claim gate uses (#507): "0 claimable, 12 parked" and "0 claimable,
+    // nothing to do" demand opposite orchestrator responses and must not
+    // render alike. Omitted at zero so an empty queue stays the old shape.
+    const parked = summary.parked ?? 0;
+    if (parked > 0) {
+      lines.push(`  parked        ${parked} — operator-held, never claimed`);
+    }
     if (summary.holds.length === 0) {
       lines.push("  held          0");
     } else {
@@ -5418,32 +5746,6 @@ export function formatDispatchSummary(summary?: DispatchSummary): string {
   return lines.join("\n");
 }
 
-/**
- * The WIP block: every issue whose newest attempt left work behind, and
- * whether that work is safe.
- *
- * Blocked runs used to be invisible here, which is exactly how #118 stayed
- * invisible for a full attempt cycle — the operator saw a blocked issue and had
- * no way to tell "stopped with 34 uncommitted files" from "stopped clean".
- * A preserved line is informational; an UNSALVAGED line is an alarm, and it
- * names the directory because that directory is the work.
- */
-export function formatSalvagedRuns(runs: readonly RunRecord[]): string[] {
-  if (runs.length === 0) return [];
-  const lines = ["", "wip"];
-  for (const r of runs) {
-    lines.push(
-      r.salvageError !== undefined && r.salvageAckAt === undefined
-        ? `  #${r.issue}  UNSALVAGED  ${r.worktree === "" ? "(path not recorded)" : r.worktree} — ` +
-          `only copy, dispatch held (${r.salvageError})`
-        : r.salvageError !== undefined
-          ? `  #${r.issue}  accepted as lost  attempt ${r.attempt} (${r.salvageError})`
-          : `  #${r.issue}  preserved  ${r.salvageSha ?? "?"} on ${r.branch} (attempt ${r.attempt}, ${r.state})`,
-    );
-  }
-  return lines;
-}
-
 /**
  * The grant table, named shape by shape.
  *
@@ -5461,6 +5763,7 @@ export function formatReleaseGrants(grants: ResolvedGrants): string[] {
     ...RELEASE_SHAPES.map((shape) => `  ${shape.padEnd(19)}${grants[shape]}`),
   ];
 }
+
 export function formatBaseHealth(rows: readonly BaseHealth[]): string[] {
   return rows.map((row) => {
     const head = row.headSha.slice(0, 8);
@@ -5550,6 +5853,7 @@ export function formatStatus(s: StatusSnapshot): string {
   lines.push(...formatBaseHealth(s.baseHealth));
   lines.push(...formatFreezes(s.freezes));
   lines.push(...formatSalvagedRuns(s.salvagedRuns));
+  lines.push(...formatQuarantinedRuns(s.quarantinedRuns));
   lines.push(...formatOpenReports(s.openReports));
   lines.push(...formatVerbLedger(s.verbLedger));
   // Deploy hint: a restart while workers are live orphans them (salvage runs
@@ -5623,61 +5927,6 @@ export function prepareConductor(project?: string): void {
   setPaused(true, { source: "setup" }, project);
 }
 
-/** Bounded per tick: each row costs tracker calls to gather facts for. */
-const CLASSIFY_BATCH = 20;
-
-/** Tool calls quoted as evidence for a run that spun to its turn cap. */
-const SPIN_EVIDENCE_CALLS = 10;
-
-/**
- * The last few tool names a transcript recorded, newest last.
- *
- * `turn-cap-spinning` escalates rather than requeueing, and the acceptance
- * criterion is that the escalation carries evidence of what the worker was doing
- * when it hit the cap — otherwise the orchestrator opens the transcript and
- * re-derives it, which is the manual triage this whole sweep removes.
- */
-export function lastToolCalls(sessionFile: string | undefined, limit = SPIN_EVIDENCE_CALLS): string[] {
-  if (sessionFile === undefined) return [];
-  let text: string;
-  try {
-    text = readFileSync(sessionFile, "utf8");
-  } catch {
-    return [];
-  }
-  const names: string[] = [];
-  for (const line of text.split("\n")) {
-    if (line.length === 0) continue;
-    let row: unknown;
-    try {
-      row = JSON.parse(line) as unknown;
-    } catch {
-      continue;
-    }
-    if (row === null || typeof row !== "object") continue;
-    const rec = row as { readonly [key: string]: unknown };
-    // Both shapes the harness has written: a top-level tool event, and a tool
-    // block inside an assistant message.
-    const direct = rec["toolName"];
-    if (typeof direct === "string") {
-      names.push(direct);
-      continue;
-    }
-    const message = rec["message"];
-    if (message === null || typeof message !== "object") continue;
-    const content = (message as { readonly [key: string]: unknown })["content"];
-    if (!Array.isArray(content)) continue;
-    for (const part of content) {
-      if (part === null || typeof part !== "object") continue;
-      const p = part as { readonly [key: string]: unknown };
-      if (p["type"] !== "tool_use") continue;
-      const name = p["name"];
-      if (typeof name === "string") names.push(name);
-    }
-  }
-  return names.slice(-limit);
-}
-
 /** A provider refusal a session recorded before dying, or undefined for none. */
 export interface SessionError {
   status?: number;
@@ -5693,138 +5942,6 @@ export function completionLastError(
   return providerCredit ?? providerTransient ?? verifiedReason ?? sessionErr?.message;
 }
 
-/**
- * The last error a transcript recorded, or undefined when it recorded none.
- *
- * The harness writes `{"stopReason":"error","errorStatus":402,"errorId":402,
- * "errorMessage":"402 This request requires more credits, ..."}`. The daemon
- * read none of it, so three runs died `unknown` with an empty `lastError` and
- * charged an attempt each for a billing state (#220).
- *
- * Scanned newest-first: a session that recovered from an early error and then
- * died of something else must report the something else, and a session that
- * recovered from its only error and finished cleanly reports the error anyway
- * because there is no terminal verdict to outrank it (#220).
- */
-export function readSessionError(sessionFile: string | undefined): SessionError | undefined {
-  if (sessionFile === undefined) return undefined;
-  let text: string;
-  try {
-    text = readFileSync(sessionFile, "utf8");
-  } catch {
-    return undefined;
-  }
-  const lines = text.split("\n");
-  for (let i = lines.length - 1; i >= 0; i -= 1) {
-    const line = lines[i];
-    if (line === undefined || line.length === 0) continue;
-    let row: unknown;
-    try {
-      row = JSON.parse(line) as unknown;
-    } catch {
-      continue;
-    }
-    if (row === null || typeof row !== "object") continue;
-    const rec = row as { readonly [key: string]: unknown };
-    if (rec["stopReason"] !== "error") continue;
-    const message = rec["errorMessage"];
-    if (typeof message !== "string" || message.trim() === "") continue;
-    const status = rec["errorStatus"];
-    return {
-      ...(typeof status === "number" && Number.isFinite(status) ? { status } : {}),
-      message: message.trim(),
-    };
-  }
-  return undefined;
-}
-
-/**
- * Classify every unclassified terminal run, persist the verdict, and perform the
- * one recovery its class names (#132).
- *
- * Half this fleet's spend produced no merged PR, and every one of those runs
- * ended at a human who re-derived the same triage by hand and then threw the
- * conclusion away. The mechanical classes — a cancelled runner, a kill from a
- * daemon restart, a green PR whose base moved, a row whose PR had already merged
- * — need no judgement at all; the genuinely human ones are worth a person's
- * attention only if they arrive with their evidence already gathered.
- *
- * Facts are fetched per row and only the ones that row needs: a `killed` row
- * costs nothing, a `failed` row with a PR costs a state read and a check read.
- * A `pushed-green` row that classifies to nothing is left completely untouched —
- * it is healthy, and writing a class onto it would take it out of this sweep for
- * good.
- */
-export async function classifyAndRecover(d: Deps): Promise<number> {
-  const { project, caps, tracker, store } = d;
-  // Settle recoveries, counted for the pass's dispatch record — a row whose PR
-  // merged is settled here when the settle sweep could not establish identity
-  // (#497). Every other exit returns 0.
-  let settled = 0;
-  for (const run of store.runsNeedingClassification(project.name, CLASSIFY_BATCH)) {
-    const facts: ClassifyFacts = {};
-    let classifiedRun = run;
-    if (run.state === "failed" || run.state === "killed") {
-      const sessionError = readSessionError(run.sessionFile);
-      if (sessionError !== undefined) {
-        if (run.lastError === undefined || run.lastError === sessionError.message) {
-          facts.sessionError = sessionError;
-        }
-        if (run.lastError === undefined) {
-          store.updateRun(run.id, { lastError: sessionError.message });
-          classifiedRun = { ...run, lastError: sessionError.message };
-        }
-      }
-    }
-    try {
-      if (run.prUrl !== undefined) {
-        const pr = await tracker.prState(run.prUrl);
-        if (pr !== undefined) facts.pr = pr;
-        if (run.state === "pushed-green" && facts.pr === "open") {
-          facts.mergeable = await tracker.mergeable(run.prUrl);
-        }
-        if (run.state === "failed" && facts.pr === "open") {
-          facts.checks = await tracker.checkConclusions(run.prUrl);
-          // When a check failed with a reachable log, pull its tail so the
-          // table can tell an infra outage (#177) from a real test failure by
-          // the log's own words. First failure wins; a log that cannot be
-          // fetched is left undefined and classification stays conservative.
-          // GitHub reports check states as `FAILURE` while the classifier reads
-          // them lowercased — normalise so the live seam and the table agree on
-          // which check is the failure whose log we pull (#177).
-          const firstFailure = facts.checks.find((c) => normalise(c.state) === "failure" && c.link !== undefined);
-          if (firstFailure?.link !== undefined) {
-            facts.failingLog = await tracker.checkLog(firstFailure.link);
-          }
-        }
-      }
-    } catch (err) {
-      // Per row, like every other sweep here: one unreachable PR must not stop
-      // the rest from being classified. The next tick asks again for free.
-      log(`#${run.issue} not classified: fact gathering failed (${errText(err)}) — retrying next tick`);
-      continue;
-    }
-
-    const { cls, recovery, evidence } = classifyRun(classifiedRun, facts, caps);
-
-    // A healthy green PR is not a failure of any class. Leaving the row
-    // unclassified is what keeps it eligible for the sweep on the tick where its
-    // base does move under it.
-    if (run.state === "pushed-green" && cls === "unknown") continue;
-
-    const retry = run.failureClass !== undefined;
-    store.updateRun(run.id, { failureClass: cls, recoveryAction: recovery });
-    log(
-      retry
-        ? `#${run.issue} retrying ${recovery} for ${cls}: ${evidence}`
-        : `#${run.issue} classified ${cls} → ${recovery}: ${evidence}`,
-    );
-    if (recovery === "settle") settled += 1;
-    await recoverRun(d, classifiedRun, cls, recovery, evidence);
-  }
-  return settled;
-}
-
 /**
  * How many settled `ci-deterministic` rows one reconciliation pass may
  * re-examine beyond the persisted review cursor. Each candidate costs GitHub
@@ -5973,479 +6090,6 @@ async function historicalInfraEvidence(d: Deps, run: RunRecord): Promise<string[
   return chunks;
 }
 
-/** Performs the one action a class names. Never chooses one of its own. */
-async function recoverRun(
-  d: Deps,
-  run: RunRecord,
-  cls: FailureClass,
-  recovery: RecoveryAction,
-  evidence: string,
-): Promise<void> {
-  const { project, caps, tracker, store } = d;
-  const inProgress = project.stateLabels.inProgress;
-
-  if (recovery === "settle") {
-    // Enqueue the release with the terminal write (see `settlePushedGreen`):
-    // the outbox keeps the label and the row one fact, so a tracker refusal
-    // can no longer strand `agent:in-progress` with nothing left to retry it
-    // (#18, #201).
-    releaseInProgress(d, run.issue, `PR merged: ${evidence}`);
-    store.updateRun(run.id, { state: "merged", endedAt: Date.now(), recoveredAt: Date.now() });
-    log(`#${run.issue} settled from ${cls}: ${evidence}`);
-    return;
-  }
-
-  if (recovery === "continue") {
-    // Two classes recover by continuing, and only one of them has anything left
-    // to do here.
-    //
-    // `turn-cap-progress` was already handed back by the completion path, which
-    // swapped its labels and left the branch retained. There is nothing to
-    // perform, and writing anything would be actively wrong: overwriting
-    // `lastError` with a rebase brief tells the continuation worker to rebase a
-    // run that simply ran out of turns, and re-swapping labels the completion
-    // path already swapped is a pair of no-op `gh` calls. Record-only, so the
-    // sweep stops re-offering it.
-    if (cls === "turn-cap-progress") {
-      store.updateRun(run.id, { recoveredAt: Date.now() });
-      log(`#${run.issue} already continuing from ${cls}: ${evidence}`);
-      return;
-    }
-
-    // `wall-clock-cap-progress`: the completion path only auto-continues
-    // turn-cap kills, so a wall-clock kill with work to show reaches this
-    // sweep still holding the failed label. Swap it for the queue — the branch
-    // is retained, so the next dispatch reattaches it and briefs a resume from
-    // the recorded work. Killed rows gathered no tracker facts, so the
-    // issue-open guard mirrors the requeue path's. The continuation gate is
-    // the same one the turns path applies at kill time
-    // (`shouldContinueAfterTurnsCap`): the row is already charged, and once
-    // the ceiling is spent, handing back the queue label would offer a
-    // candidate admission can never accept — only the failed label comes off,
-    // and the exhaustion reaches a human (#490, #348).
-    if (cls === "wall-clock-cap-progress") {
-      const state = await tracker.issueState(run.issue).catch(() => undefined);
-      if (state !== "open") {
-        log(`#${run.issue} not continued from ${cls}: issue is ${state ?? "unreadable"}`);
-        return;
-      }
-      const continuation = store.continuationsFor(project.name, run.issue);
-      if (hasContinuationBudget(continuation, caps.maxContinuationsPerIssue)) {
-        swapToQueue(d, run.issue, project.stateLabels.failed);
-        store.updateRun(run.id, { recoveredAt: Date.now() });
-        log(`#${run.issue} requeued for a wall-clock continuation: ${evidence}`);
-      } else {
-        store.enqueueLabelOps(project.name, [
-          { issue: run.issue, op: "remove", label: project.stateLabels.failed },
-        ]);
-        store.updateRun(run.id, { recoveredAt: Date.now() });
-        await safeEscalate(d, {
-          tier: 1,
-          project: project.name,
-          issue: run.issue,
-          summary: `#${run.issue} exhausted its continuation budget on wall-clock cap kills`,
-          detail: [
-            `Attempt ${run.attempt} hit the wall-clock cap with work to continue from, but ${continuation} continuation(s) are already charged against a cap of ${caps.maxContinuationsPerIssue}.`,
-            evidence,
-            `Work to continue: branch ${run.branch} at ${run.headSha ?? run.salvageSha}${run.prUrl === undefined ? "" : ` — ${run.prUrl}`}.`,
-            "The issue cannot finish inside the wall-clock cap, so another run would burn a worker slot for the same outcome. Re-scope it, raise maxContinuationsPerIssue for it, or finish the remaining work by hand.",
-          ].join("\n"),
-        });
-        await postExhaustionPostmortem(
-          d,
-          run,
-          `Attempt ${run.attempt} hit the wall-clock cap with work to continue from, but ${continuation} continuation(s) are already charged against a cap of ${caps.maxContinuationsPerIssue}.`,
-        );
-        log(`#${run.issue} not continued from ${cls}: continuation budget exhausted`);
-      }
-      return;
-    }
-
-    // `merge-conflict`: the branch is retained and its PR is open, so #50's
-    // continuation guard admits it and the next tick briefs a rebase.
-    //
-    // The outbox makes the retry contract one-sided: the swap is enqueued — a
-    // durable local write that cannot fail on the tracker — before
-    // `recoveredAt` is written, so the row can never again be taken out of
-    // `runsNeedingClassification` with its label swap still owed. That was
-    // the defect 0.4.4 claimed to have fixed and did not, for this one
-    // recovery; the projector retries until the tracker takes the swap, and
-    // while it is pending the eligibility overlay keeps the issue coherent
-    // (#201).
-    swapToQueue(d, run.issue, inProgress);
-    store.updateRun(run.id, {
-      state: "killed",
-      lastError:
-        "merge-conflict: base moved under a green PR — rebase, regenerate recorded artifacts, push without force",
-      recoveredAt: Date.now(),
-    });
-    log(`#${run.issue} requeued for a rebase continuation: ${evidence}`);
-    return;
-  }
-
-  if (recovery === "requeue") {
-    if (cls === "provider-credit") {
-      await reactToProviderCredit(d, run.issue, evidence, run.sessionFile);
-    }
-    // A dispatch-infra requeue that keeps landing on the same issue means the
-    // mirror for its repo is persistently broken — a ref-lock that retry already
-    // exhausted, a dead remote. Requeueing forever spends a turn-0 run per tick
-    // with no chance of success, so after a bounded number of strikes this
-    // escalates to a human instead (#168, #177).
-    if (cls === "dispatch-infra" && store.classCountFor(project.name, run.issue, "dispatch-infra") >= DISPATCH_INFRA_MAX_STRIKES) {
-      await safeEscalate(d, {
-        tier: 1,
-        project: project.name,
-        issue: run.issue,
-        summary: `[dispatch-infra] #${run.issue}: the mirror for ${run.repo} is failing persistently — ${evidence}`,
-        detail: [
-          `The dispatcher could not provision a worktree for #${run.issue} ${DISPATCH_INFRA_MAX_STRIKES} times in a row, all before the worker's first turn.`,
-          "The mirror on this host needs attention (check disk, SSH/HTTPS credentials, and the mirror root).",
-        ].join("\n"),
-      });
-      store.updateRun(run.id, { recoveredAt: Date.now() });
-      log(`#${run.issue} escalated from persistent ${cls}: ${evidence}`);
-      return;
-    }
-    // Same bound for provider-transient: an issue whose stream keeps stalling
-    // mid-run is requeued free (no attempt, no continuation charged) — but a
-    // provider that aborts three times for one issue is down, and a human has
-    // to check its status before hand-requeueing (#220). The escalation names
-    // every model the chain tried, so a merged branch built on a different
-    // model is attributable (#286).
-    if (
-      cls === "provider-transient" &&
-      store.classCountFor(project.name, run.issue, "provider-transient") >= PROVIDER_TRANSIENT_MAX_STRIKES
-    ) {
-      const tried = formatModelsTried(modelsTried(store.runsForIssue(project.name, run.issue)));
-      await safeEscalate(d, {
-        tier: 1,
-        project: project.name,
-        issue: run.issue,
-        summary: `[provider-transient] #${run.issue}: the provider keeps aborting mid-stream — ${evidence}`,
-        detail: [
-          `The provider aborted the stream for #${run.issue} ${PROVIDER_TRANSIENT_MAX_STRIKES} times without the run ever producing a verdict (0 tokens billed each time).`,
-          ...(tried === ""
-            ? []
-            : [`Models tried: ${tried}.`]),
-          "Check provider status before requeueing by hand.",
-        ].join("\n"),
-      });
-      store.updateRun(run.id, { recoveredAt: Date.now() });
-      log(`#${run.issue} escalated from persistent ${cls}: ${evidence}`);
-      return;
-    }
-    // Same bound for provider-capacity: a run the provider throttled into the
-    // ground is requeued free (no attempt charged) — but a provider that
-    // throttles the same issue three times is at capacity, and a human has to
-    // check its status before hand-requeueing (#573). On a chain-configured
-    // project each requeue already moved the next attempt to the next chain
-    // model, so this escalation is what catches the no-chain case and the
-    // exhausted chain; it names every model the chain tried.
-    if (
-      cls === "provider-capacity" &&
-      store.classCountFor(project.name, run.issue, "provider-capacity") >= PROVIDER_CAPACITY_MAX_STRIKES
-    ) {
-      const tried = formatModelsTried(modelsTried(store.runsForIssue(project.name, run.issue)));
-      await safeEscalate(d, {
-        tier: 1,
-        project: project.name,
-        issue: run.issue,
-        summary: `[provider-capacity] #${run.issue}: the model provider is throttling this run into the ground — ${evidence}`,
-        detail: [
-          `The provider answered #${run.issue} with sustained in-session rate limits ${PROVIDER_CAPACITY_MAX_STRIKES} times in a row; the harness retried each and was exhausted.`,
-          ...(tried === ""
-            ? []
-            : [`Models tried: ${tried}.`]),
-          "Check the provider's rate-limit status (and its throughput-oriented routes) before requeueing by hand.",
-        ].join("\n"),
-      });
-      store.updateRun(run.id, { recoveredAt: Date.now() });
-      log(`#${run.issue} escalated from persistent ${cls}: ${evidence}`);
-      return;
-    }
-    // Only when the tracker still shows this issue as ours to hand back. An
-    // issue that is closed, or has no state label, was resolved by another route
-    // and requeueing it would dispatch work nobody asked for.
-    const state = await tracker.issueState(run.issue).catch(() => undefined);
-    if (state !== "open") {
-      log(`#${run.issue} not requeued from ${cls}: issue is ${state ?? "unreadable"}`);
-      return;
-    }
-    // A clean orphan whose queue label is already absent is a deliberate
-    // withdrawal — the operator took the issue out of the queue (e.g. so a
-    // daemon restart could not re-dispatch work known to be unsafe) — and
-    // recovery must not recreate that intent (#423). Read the live label set;
-    // when the queue label is gone, release the dispatcher-owned in-progress
-    // label and stop, leaving the operator's withdrawal to survive recovery.
-    if (cls === "orphan-clean") {
-      const snapshot = await tracker.issueSnapshot(run.issue).catch(() => undefined);
-      if (snapshot === undefined) {
-        log(`#${run.issue} not requeued from orphan-clean: cannot confirm ${project.queueLabel} (unreadable, retrying)`);
-        return;
-      }
-      if (!snapshot.labels.includes(project.queueLabel)) {
-        store.enqueueLabelOps(project.name, [{ issue: run.issue, op: "remove", label: inProgress }]);
-        store.updateRun(run.id, { recoveredAt: Date.now() });
-        log(`#${run.issue} not requeued from orphan-clean: ${project.queueLabel} removed before recovery (operator withdrawal)`);
-        return;
-      }
-      // #439: an orphan-clean row charges the continuation budget, so once
-      // `hasContinuationBudget` is spent — exactly the predicate `admitCandidates`
-      // holds the issue on — requeueing re-adds a queue label for a candidate the
-      // dispatcher can never admit. Stop handing it back and hold it instead: the
-      // queue label comes off (so admission never re-holds on every dispatch),
-      // the in-progress label is released, and a single diagnosis escalates once.
-      // `orphan-clean` is deliberately NOT a global exclusion from the budget (a
-      // worker that genuinely keeps dying mid-work must still be bounded); this is
-      // the missing ceiling check this path never had (#348's invariant).
-      const continuations = store.continuationsFor(project.name, run.issue);
-      if (!hasContinuationBudget(continuations, caps.maxContinuationsPerIssue)) {
-        const runs = store.runsForIssue(project.name, run.issue);
-        const breakdown = continuationBreakdown(runs);
-        const artifact = newestContinuableRun(runs);
-        const onlyDaemonStops = breakdown.size === 1 && breakdown.get("orphan-clean") === continuations;
-        const classLine = Array.from(breakdown, ([cls, n]) => `${n} ${cls}`).join(", ");
-        const artifactLine =
-          artifact === undefined
-            ? "The attempts left no salvage commit, head SHA or PR — the branch is empty, so start clean from a re-scope rather than continuing from nothing."
-            : `Work to continue: branch ${artifact.branch} at ${artifact.headSha ?? artifact.salvageSha}${artifact.prUrl === undefined ? "" : ` — ${artifact.prUrl}`}.`;
-        store.enqueueLabelOps(project.name, [
-          { issue: run.issue, op: "remove", label: inProgress },
-          { issue: run.issue, op: "remove", label: project.queueLabel },
-        ]);
-        store.updateRun(run.id, { recoveredAt: Date.now() });
-        await safeEscalate(d, {
-          tier: 1,
-          project: project.name,
-          issue: run.issue,
-          summary: `#${run.issue} exhausted its ${caps.maxContinuationsPerIssue}-continuation budget on ${cls}`,
-          detail: [
-            `Attempt ${run.attempt} is not requeued: ${continuations} continuation(s) charged against a cap of ${caps.maxContinuationsPerIssue}.`,
-            `Continuations by failure class: ${classLine}.`,
-            onlyDaemonStops
-              ? "Every continuation was a daemon stop — the work never failed; the budget was spent by daemon deaths, not the issue."
-              : "Continuations span real work — inspect what each attempt left behind before continuing.",
-            artifactLine,
-            "What you can do: raise maxContinuationsPerIssue for this issue, re-scope it, or continue from the preserved work (or start clean if none).",
-          ].join("\n"),
-        });
-        await postExhaustionPostmortem(
-          d,
-          run,
-          `Attempt ${run.attempt} is not requeued: ${continuations} continuation(s) charged against a cap of ${caps.maxContinuationsPerIssue}.`,
-        );
-        log(`#${run.issue} not requeued from orphan-clean: continuation budget exhausted`);
-        return;
-      }
-    }
-    const label = cls === "orphan-clean" ? inProgress : project.stateLabels.failed;
-    swapToQueue(d, run.issue, label);
-    store.updateRun(run.id, { recoveredAt: Date.now() });
-    log(`#${run.issue} requeued from ${cls}: ${evidence}`);
-    return;
-  }
-
-  if (recovery === "rerun-checks") {
-    if (run.prUrl === undefined) return;
-    try {
-      await tracker.rerunFailedChecks(run.prUrl);
-    } catch (err) {
-      log(`#${run.issue} check re-run failed (${errText(err)}) — retrying next tick`);
-      return;
-    }
-    // Back to pending rather than green: the existing settle sweep re-verifies
-    // it against the recorded head on a later tick, so nothing here has to guess
-    // whether the re-run passed.
-    store.updateRun(run.id, { state: "pushed-pending", lastError: null, recoveredAt: Date.now() });
-    log(`#${run.issue} re-ran infrastructure checks: ${evidence}`);
-    return;
-  }
-
-  if (recovery === "escalate") {
-    const detail = [evidence];
-    if (cls === "turn-cap-spinning" || cls === "wall-clock-cap-spinning") {
-      const calls = lastToolCalls(run.sessionFile);
-      detail.push(
-        calls.length === 0
-          ? "transcript unreadable — no tool calls could be recovered"
-          : `Last ${calls.length} tool calls: ${calls.join(" → ")}`,
-      );
-    }
-    if (run.lastError !== undefined && cls !== "question") detail.push(run.lastError);
-    // #172: an unwritten transcript is "the run died before it flushed", not a
-    // link to a file the operator will open and find missing.
-    detail.push(
-      run.sessionFile === undefined
-        ? "Session: (no transcript)"
-        : existsSync(run.sessionFile)
-          ? `Session: ${run.sessionFile}`
-          : `Session: ${run.sessionFile} (file was never written — the run died before its transcript was flushed)`,
-    );
-    // The class and the run are in the summary, which is what the notifications
-    // ledger dedupes on — so one class escalates once per run rather than every
-    // five minutes.
-    await safeEscalate(d, {
-      tier: 1,
-      project: project.name,
-      issue: run.issue,
-      runId: run.id,
-      summary: `[${cls}] #${run.issue} attempt ${run.attempt}: ${evidence}`,
-      detail: detail.join("\n"),
-    });
-    // The hand-off IS the recovery for these classes: there is nothing else this
-    // package can do, and leaving the row unrecovered would re-escalate forever.
-    store.updateRun(run.id, { recoveredAt: Date.now() });
-    return;
-  }
-
-  // `hold` (orphan-dirty) and `none`: recorded, nothing performed. The existing
-  // unsalvaged-WIP admission hold already fails dispatch closed until an
-  // operator acknowledges the tree, which is the only safe move when the
-  // worktree holds the only copy of real work.
-}
-
-/**
- * Enqueue a state-label → queue-label swap for projection (#201).
- *
- * The swap is two ops in id order — remove first, then add — which is the
- * atomicity the projector guarantees: the issue never sits newly eligible
- * without a queue label on its way back, and the add never lands before the
- * remove when GitHub fails between them. Enqueueing is a durable local write
- * that cannot fail on the tracker, so the caller records its recovery
- * immediately and the projector retries the swap until the tracker takes it —
- * that closes the 0.4.4 hole where a refused label swap stranded the row
- * permanently under a log line promising a retry.
- */
-function swapToQueue(d: Pick<Deps, "project" | "store">, issue: number, label: string): void {
-  d.store.enqueueLabelOps(d.project.name, [
-    { issue, op: "remove", label },
-    { issue, op: "add", label: d.project.queueLabel },
-  ]);
-}
-
-/** Bounded listing per state label, so one reconcile cannot walk a whole repo. */
-const RECONCILE_LIMIT = 50;
-
-/**
- * Clear state labels from issues that no longer need them (#132's `superseded`).
- *
- * Two structural signals, both cheap and both observed on this fleet: an issue
- * that is closed but still carries `agent:*`, and an open issue carrying
- * `failed` whose sub-issues have all closed. On 2026-08-09 four issues (#307,
- * #297, #140, #82) carried `agent:failed` while every one of them was already
- * complete — the label was residue of a turns-cap kill from two days earlier,
- * and nothing in the loop ever revisited it. The board counted four phantom
- * failures while the genuinely stuck issues were invisible.
- *
- * Positive evidence only. A tracker that cannot list answers empty, and an empty
- * answer removes nothing: a reconcile that guessed would strip the interlock
- * that keeps two workers off one issue.
- */
-export async function reconcileStaleLabels(d: Deps): Promise<void> {
-  const { project, tracker, store } = d;
-  const labels = [project.stateLabels.failed, project.stateLabels.blocked, project.stateLabels.inProgress];
-
-  for (const label of labels) {
-    const carrying = await tracker.listLabeled(label, RECONCILE_LIMIT).catch(() => []);
-    for (const issue of carrying) {
-      if (issue.state === "closed") {
-        // Never retain an `agent:*` label on a closed issue: the work is done by
-        // some route, and the label only makes the board lie about it. Enqueue
-        // rather than call — a refused write must not lose the decision; the
-        // projector retries the removal until the tracker takes it (#201).
-        store.enqueueLabelOps(project.name, [{ issue: issue.number, op: "remove", label }]);
-        log(`#${issue.number} reconciled: closed issue no longer carries ${label} (queued)`);
-        continue;
-      }
-
-      if (label !== project.stateLabels.failed) continue;
-      const children = await tracker.childrenOf(issue.number).catch(() => []);
-      if (children.length === 0 || children.some((c) => c.state !== "closed")) continue;
-
-      const key = `${project.name}:superseded:${issue.number}`;
-      if (store.wasNotified(key)) continue;
-      const list = children.map((c) => `#${c.number}`).join(", ");
-      store.enqueueLabelOps(project.name, [{ issue: issue.number, op: "remove", label }]);
-      try {
-        await tracker.comment(
-          issue.number,
-          `superseded: all sub-issues closed (${list}) — this label was stale; propose closing if the ` +
-            `acceptance criteria are met on the default branch.`,
-        );
-        store.markNotified(key);
-        log(`#${issue.number} reconciled: superseded by ${list}`);
-      } catch (err) {
-        // The label removal is already queued and will land regardless; the
-        // comment is the only half that can fail here (#201).
-        log(`#${issue.number} could not comment the superseded note (${errText(err)}) — retrying next tick`);
-      }
-    }
-  }
-}
-
-/**
- * Settles `claimed`/`running` rows left by a dead daemon process and, before
- * marking each one `orphaned`, salvages any dirty worktree.
- *
- * Found live after a host restart killed two workers mid-run, and again on
- * every package deploy that restarted while workers were live (#35): without
- * the salvage call the next attempt's `worktree remove --force` destroyed
- * uncommitted edits that had no other copy. Cap-kills already salvaged (#27);
- * this is the same call site for the restart path.
- *
- * Only the rows change. The issue keeps its in-progress label — that label is
- * the crash guard against double-dispatch, and deciding what a dead worker's
- * remains are worth (an open PR? a salvaged sha? a clean tree?) is the
- * orchestrator's drain-duty judgement, not something to automate here. The
- * rows also keep counting toward `maxAttemptsPerIssue`, so a loop of deaths
- * still escalates instead of retrying forever.
- *
- * `pushed-green` rows are deliberately left alone: they hold no process — they
- * are finished work waiting on a human merge, and they must keep occupying the
- * issue so a second attempt cannot land on a live PR. What eventually settles
- * them is {@link settlePushedGreen}, on the tick, by asking the tracker what
- * became of the PR — the one question a restart cannot answer by inference.
- */
-export async function reconcileOrphanedRuns(
-  store: Store,
-  project: string,
-  /**
-   * Resolves the privileged publisher for one orphaned run. Optional because a
-   * test driving the row transitions has no repo to publish to; production
-   * always passes it, and without it a salvaged WIP commit stays local — which
-   * is the half of #121 that reaches a human.
-   */
-  publish?: (run: RunRecord) => RunPublisher,
-): Promise<RunRecord[]> {
-  // Live runs only: `pushed-green` holds no process, so it cannot be orphaned by
-  // a process dying — it is finished work waiting on a human merge.
-  const stale = store.liveRuns(project);
-  const endedAt = Date.now();
-  for (const r of stale) {
-    // Salvage before the row flips: the worktree path is on the record, and
-    // salvageWip is a no-op for a missing/clean tree. The clause matches the
-    // cap-kill wording so triage reads the same either way, and the tree is
-    // kept because an orphan's remains are the orchestrator's drain-duty call.
-    const settlement =
-      r.worktree === ""
-        ? undefined
-        : await settleWorktree({
-            issue: r.issue,
-            attempt: r.attempt,
-            ending: "killed by a daemon restart",
-            worktree: r.worktree,
-            branch: r.branch,
-            // An orphan's tree is kept, so its commits are not about to be
-            // deleted — but a WIP salvage still has to reach GitHub, which is
-            // #121's whole point and is now the daemon's hop to make.
-            publish: publish?.(r),
-            tree: "keep",
-          });
-    store.updateRun(r.id, { state: "orphaned", endedAt, ...settlement?.patch });
-  }
-  return stale;
-}
 
 // ------------------------------------------------------------------- the daemon
 
@@ -6606,6 +6250,25 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   const store = openStore(dbPath());
   const verbPeerReader = peerCredentialReader();
   const verbDir = ensureVerbSocketDir(stateDir());
+  // The worker identity (#798). Probed once here for the startup banner only —
+  // every dispatch re-resolves it through {@link launchIdentity}, because the
+  // account, setpriv and the harness binding (#828) are all host state that can
+  // arrive after this process did. A host that cannot establish it keeps its
+  // control plane running and fails each worker launch closed with the reason,
+  // so the operator hears a concrete host change instead of a fleet that
+  // silently ran workers as root.
+  const identityAtStartup = resolveWorkerIdentity();
+  if (identityAtStartup.ok) {
+    log(
+      `worker identity: ${identityAtStartup.identity.account} uid=${identityAtStartup.identity.uid} ` +
+        `gid=${identityAtStartup.identity.gid} home=${identityAtStartup.identity.home}`,
+    );
+  } else {
+    log(
+      "worker identity unavailable — worker dispatch fails closed until the host provides it " +
+        `(re-checked at every launch, so no restart is needed once it does): ${identityAtStartup.reason}`,
+    );
+  }
   const integrity: IntegrityGate = { baseline: packageManifest(), paged: false };
   const usage = sharedUsageSource();
   const turnLimits = createTurnLimitRegistry((runId, maxTurns) => {
@@ -6632,6 +6295,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
       log(projects.length === 1 ? message : `[${project.name}] ${message}`);
     };
     const caps = resolveCaps(project, cfg.defaults);
+    const host = cfg.host;
     // One transient-server-error breaker per project (#642): admission's
     // GraphQL checks and the orchestrator mutation commands share it, so a 503
     // observed by either side gates both instead of one provider outage being
@@ -6710,7 +6374,11 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
             recordReleaseBlock(project.name, "orchestrator", shape, context),
         });
         const transcript = orchestrator.sessionFile();
-        projectLog(`orchestrator session ready${transcript === undefined ? "" : ` · ${transcript}`}`);
+        const loaded = orchestrator.extensionVersion();
+        projectLog(
+          `orchestrator session ready${transcript === undefined ? "" : ` · ${transcript}`}` +
+            `${loaded === undefined ? "" : ` · loaded omp-conductor ${loaded}`}`,
+        );
       } catch (err) {
         orchestratorStartError = errText(err);
         projectLog(
@@ -6763,6 +6431,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     const d: Deps = {
       project,
       caps,
+      host,
       tracker,
       store,
       drain,
@@ -6778,6 +6447,16 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
       probeCriticalBase: (repo, markers, branch) =>
         probeCriticalBase(project, repo, branch, markers),
       probeWorktreeLane: (input) => probeRunLane(input),
+      // The live host, per launch — never the startup verdict above.
+      workerIdentity: () => resolveWorkerIdentity(),
+      // Grant each run's paths to the worker identity by ownership, before the
+      // session that must edit them starts (#798). The recursive chown runs as
+      // root from the dispatch path; the worker identity owns its checkout and
+      // transcript and nothing else.
+      grantWorkerPaths: (identity, worktreePath, sessionDir) => {
+        chownRecursive(worktreePath, identity.uid, identity.gid);
+        chownRecursive(sessionDir, identity.uid, identity.gid);
+      },
       // A cross-repo Depends-on prerequisite reads through the same GitHub
       // credential/accounting seams as the project tracker — a fresh tracker
       // scoped to the referenced repo, reusing the daemon's gh hooks so API
@@ -6787,6 +6466,14 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
           onCall: () => store.bumpGhCalls?.(utcDay(), "daemon"),
           onRefusal: (at) => store.recordGhRefusal?.(at),
         }).issueSnapshot(issue),
+      // The body twin of `probeIssueIn`, for the dependency-graph cycle pass
+      // (#421): reads a reachable routed prerequisite's body through the same
+      // per-repo tracker/credential/accounting seams.
+      probeBodyIn: (ownerRepo, issue) =>
+        makeTracker({ ...project, tracker: { kind: "github", repo: ownerRepo } }, undefined, {
+          onCall: () => store.bumpGhCalls?.(utcDay(), "daemon"),
+          onRefusal: (at) => store.recordGhRefusal?.(at),
+        }).issueBody(issue),
       ...(verbPeerReader === undefined ? {} : { verbPeerReader }),
       verbActions,
     };
@@ -6944,15 +6631,31 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
         },
         health: () =>
           daemonHealth(
-            runtimes.map((runtime) =>
-              daemonHealthSnapshot(
+            runtimes.map((runtime) => {
+              const orch = runtime.orchestrator;
+              const mode = runtime.d.project.escalation.orchestrator;
+              return daemonHealthSnapshot(
                 store,
                 runtime.d.project.name,
                 isPaused(runtime.d.project.name),
                 runtime.codeGraph,
                 workerControls,
-              ),
-            ),
+                orch === undefined
+                  ? // External mode is the pane's session: the daemon hosts no
+                    // child to attest. An embedded orchestrator that failed to
+                    // start is a live outage of the surface the upgrade must
+                    // promise reloaded (#832) — say so out loud.
+                    { mode: mode === "external" ? "external" : "failed" }
+                  : {
+                      mode: "embedded",
+                      ...(orch.extensionVersion() === undefined
+                        ? {}
+                        : { loaded: orch.extensionVersion() }),
+                      ...(orch.sessionFile() === undefined ? {} : { sessionFile: orch.sessionFile() }),
+                      alive: orch.alive(),
+                    },
+              );
+            }),
           ),
       }),
   });