omp-conductor 0.18.0 → 0.18.1

package/src/daemon.ts

@@ -8,7 +8,7 @@
  * here and enforced before anything is claimed.
  */
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, constants, existsSync, fchownSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, readlinkSync, renameSync, rmSync, statSync, writeFileSync, type Dirent } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import {
   configPath,
@@ -36,12 +36,20 @@ import {
 import { createEscalator, escalationIssueRef } from "./escalate.ts";
 import { pendingCodeGraph, probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
 import { graphHint } from "./graph.ts";
+import {
+  hostConstraintsNotice,
+  resolveWorkerIdentity,
+  WORKER_ACCOUNT,
+  type WorkerIdentity,
+  type WorkerIdentityResolution,
+} from "./host.ts";
 import { acquireOnceLease, healthCheck, livingDaemon, probeUnit, SYSTEMD_UNIT } from "./lifecycle.ts";
 import { requestImmediateTick, resolveTickConfigCwd, STALL_MARKER_FILE } from "./orchestrator-tick.ts";
 import { runDoctor } from "./doctor.ts";
 import { appendJournal, launchTransientUnit, readUpgradeJournal } from "./upgrade-journal.ts";
 import { runCommand, verifyPendingUpgrade, type UpgradeVerifyDeps } from "./upgrade-verify.ts";
-import { fleetLayers } from "./fleet.ts";
+import { processStartTimeMs } from "./upgrade-verify.ts";
+import { fleetLayers, herdrPaneOmpStarts, resolveHerdrSession } from "./fleet.ts";
 import { startOrchestrator } from "./orchestrator.ts";
 import type { OrchestratorHandle } from "./orchestrator.ts";
 import {
@@ -66,11 +74,13 @@ import type { Routed, UnroutableReason } from "./routing.ts";
 import {
   admitCandidates,
   effectiveLane,
+  effectiveModel,
   hasContinuationBudget,
   hasFailedAttemptBudget,
   laneEcho,
 } from "./admission.ts";
-import type { Admission, AdmissionHold, FileLane } from "./admission.ts";
+import type { Admission, AdmissionHold } from "./admission.ts";
+import type { EffectiveModel, FileLane } from "./types.ts";
 import { log, errText, safeEscalate } from "./log.ts";
 import {
   adoptSalvagedPrs,
@@ -107,7 +117,7 @@ import {
   snapshotDb,
   utcDay,
 } from "./store.ts";
-import { GraphqlBreaker, makeTracker, type RateLimitStatus } from "./tracker/github.ts";
+import { GhPrMissingError, GraphqlBreaker, makeTracker, type RateLimitStatus } from "./tracker/github.ts";
 import { DEFAULT_REPORT_POLICY, RELEASE_SHAPES } from "./types.ts";
 import type {
   BaseFreeze,
@@ -118,6 +128,7 @@ import type {
   DispatchSummary,
   DigestBacklog,
   Escalation,
+  InterruptCategory,
   IssueComment,
   IssueSnapshot,
   MergedPrInfo,
@@ -125,13 +136,16 @@ import type {
   ReleaseShape,
   OrchestratorIncident,
   PrState,
+  PrVerification,
   ProjectConfig,
   ReadyIssue,
+  ReportScope,
   ReportingPolicy,
   RepoTarget,
   ReportRecord,
   ResolvedGrants,
   FailureClass,
+  HostConstraints,
   RecoveryAction,
   ReviewPolicy,
   ReviewRevisionOutcome,
@@ -170,6 +184,7 @@ import {
 import { githubVerbActions } from "./verbs/actions.ts";
 import { formatVerbLedger, STATUS_LEDGER_SCAN } from "./verbs/ledger.ts";
 import {
+  isHeadMismatch,
   listenVerbChannel,
   type VerbActions,
   type VerbDeps,
@@ -244,6 +259,10 @@ export interface DrainSignal {
 interface Deps {
   project: ProjectConfig;
   caps: Caps;
+  /** The typed host-constraints block (#721), re-resolved at the tick
+   *  boundary like `project`/`caps`, and rendered into every brief the tick
+   *  dispatches. Optional so tests that never exercise it can omit it. */
+  host?: HostConstraints;
   tracker: Tracker;
   store: Store;
   /**
@@ -267,6 +286,33 @@ interface Deps {
   workerControls: WorkerControlRegistry;
   /** Session seam for lifecycle integration tests; production uses the real harness. */
   workerDeps?: RunWorkerDeps;
+  /**
+   * Resolves the dedicated worker identity (#798) — the account worker sessions
+   * run under, with its uid/gid/home, the transition launcher and a live harness
+   * binding (#828).
+   *
+   * Called **at every worker launch**, never cached: every input is host state
+   * that can change under a running daemon. A reboot can start this service
+   * before systemd has mounted the harness binding, and an operator can install
+   * the account or re-run `setup host` at any time — a verdict taken once at
+   * startup would hold the whole fleet closed until somebody thought to restart
+   * the daemon, which is the outage #828 exists to end rather than relocate.
+   * Resolution is a handful of `stat` calls and one `/etc/passwd` read; a
+   * dispatch does far more than that before it reaches this gate.
+   *
+   * Every worker dispatch refuses to launch on an unresolved identity (fail
+   * closed — an unbound worker is indistinguishable from an operator shell),
+   * and this is how the dispatcher secures the run's sockets and grants the
+   * run's paths to the account. Absent entirely, dispatch fails closed naming
+   * the missing account.
+   */
+  workerIdentity?: () => WorkerIdentityResolution;
+  /**
+   * Re-owns a run's working paths (worktree + session dir) under the worker
+   * identity before the session launches. Wired by `runDaemon` to the
+   * recursive chown; a test fixture leaves it unset so no test chowns.
+   */
+  grantWorkerPaths?: (identity: WorkerIdentity, worktreePath: string, sessionDir: string) => void;
   integrity: IntegrityGate;
   stall: StallGate;
   /**
@@ -454,6 +500,121 @@ export function checkStall(gate: StallGate, marker: string, now = Date.now()): S
  * could destroy work an operator would rather read first — the same refusal to
  * guess that the recovery plugin is built on.
  */
+// --------------------------------------------------------- worker identity (#798) --
+
+/**
+ * Re-own a run's working paths (worktree, session dir) under the worker
+ * identity before the session launches. The daemon runs this as root; the
+ * worker identity is granted its own run paths by ownership, never by
+ * loosened modes on the daemon's.
+ *
+ * The walk never re-owns through a path a worker-uid process could
+ * re-resolve: every ownership change is `fchownSync` on a descriptor opened
+ * with `O_NOFOLLOW`, and every descriptor is verified — via `/proc/self/fd`'s
+ * kernel-resolved path — to still sit under the directory the walk opened.
+ * A directory entry raced into a symlink therefore either fails `O_NOFOLLOW`
+ * at the final component or resolves outside the verified parent and is
+ * skipped; it can never carry the chown to an external target. Symlinks
+ * within the tree are left untouched (the worker manages entries through its
+ * parent directories, and git recreates links on checkout), as are anything
+ * unopenable — fifos, sockets, devices — which git never creates. A missing
+ * or racing entry is not this dispatch's problem — the next dispatch re-owns
+ * whatever survives; a tree already owned by the worker identity — the
+ * resume and review-revision re-ownership of a tree a prior dispatch granted
+ * — is the only tree a worker-uid process could have modified, and is
+ * skipped outright rather than walked.
+ */
+export function chownRecursive(root: string, uid: number, gid: number): void {
+  try {
+    const current = lstatSync(root);
+    if (current.uid === uid && current.gid === gid) return;
+  } catch {
+    // A missing or racing root is the caller's own existence check; the next
+    // dispatch re-owns whatever survives.
+    return;
+  }
+  const rootFd = openNoFollowDir(root);
+  try {
+    walkDir(rootFd, root, uid, gid);
+  } finally {
+    try {
+      closeSync(rootFd);
+    } catch {
+      // Already closed by a raced-away walk; nothing to do.
+    }
+  }
+}
+
+/** Open a directory without following a final-component symlink. */
+function openNoFollowDir(path: string): number {
+  return openSync(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
+}
+
+/** The kernel-resolved path of an open descriptor: what the object actually is. */
+function fdRealPath(fd: number): string | undefined {
+  try {
+    return readlinkSync(`/proc/self/fd/${fd}`);
+  } catch {
+    return undefined;
+  }
+}
+
+function walkDir(dirFd: number, dirPath: string, uid: number, gid: number): void {
+  try {
+    fchownSync(dirFd, uid, gid);
+  } catch {
+    // Raced away; the next dispatch re-owns what survives.
+  }
+  const dirReal = fdRealPath(dirFd);
+  if (dirReal === undefined) return;
+  let entries: Dirent[];
+  try {
+    entries = readdirSync(dirPath, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    const childPath = join(dirPath, entry.name);
+    try {
+      if (entry.isDirectory()) {
+        const childFd = openNoFollowDir(childPath);
+        try {
+          // The entry is genuinely beneath the directory this fd owns only
+          // when the kernel resolves the opened object to a path under it.
+          // Anything else — a name swapped to a symlink, a foreign listing
+          // read through a replaced parent — is refused, never re-resolved.
+          const childReal = fdRealPath(childFd);
+          if (childReal === undefined || !childReal.startsWith(`${dirReal}/`)) continue;
+          walkDir(childFd, childPath, uid, gid);
+        } finally {
+          try {
+            closeSync(childFd);
+          } catch {
+            // Raced away; nothing to close.
+          }
+        }
+        continue;
+      }
+      // Symlinks stay untouched (never followed, never chowned), and so do
+      // entries a read-only open cannot name safely (fifos, sockets, devices).
+      if (entry.isSymbolicLink() || !entry.isFile()) continue;
+      const fd = openSync(childPath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+      try {
+        const real = fdRealPath(fd);
+        if (real !== undefined && real.startsWith(`${dirReal}/`)) fchownSync(fd, uid, gid);
+      } finally {
+        try {
+          closeSync(fd);
+        } catch {
+          // Raced away; nothing to close.
+        }
+      }
+    } catch {
+      // O_NOFOLLOW refusal (a symlink swapped onto the name), or gone: nothing to chown.
+    }
+  }
+}
+
 export async function watchOrchestrator(d: Deps, now = Date.now()): Promise<void> {
   const marker = join(stateDir(), STALL_MARKER_FILE);
   const repeat = d.stall.paged;
@@ -572,6 +733,29 @@ export function pauseProvenance(
   }
 }
 
+/**
+ * One pause sentinel FILE read as an instance identity: who set it, why, and
+ * the creation instant, all from that exact file. An unreadable or malformed
+ * file is undefined — the caller may treat it as absence.
+ */
+function pauseInstanceAt(
+  path: string,
+): { source: string; reason?: string; since: number } | undefined {
+  try {
+    const [line1, line2] = readFileSync(path, "utf8").split("\n");
+    const since = Date.parse(line1?.trim() ?? "");
+    if (!Number.isFinite(since)) return undefined;
+    if (line2 === undefined) return undefined;
+    const match = /^source=(\S+)(?: reason="(.*)")?$/.exec(line2.trim());
+    if (match === null) return undefined;
+    const source = match[1]!;
+    const reason = match[2];
+    return { source, since, ...(reason === undefined ? {} : { reason }) };
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * One pause sentinel read as a single identity: who set it, why, and the
  * creation instant, all from the SAME file that was selected. Unlike pairing
@@ -591,19 +775,34 @@ export function pauseInstance(
       : [pausedPath(project), pausedPath()];
   const path = paths.find((candidate) => existsSync(candidate));
   if (path === undefined) return undefined;
-  try {
-    const [line1, line2] = readFileSync(path, "utf8").split("\n");
-    const since = Date.parse(line1?.trim() ?? "");
-    if (!Number.isFinite(since)) return undefined;
-    if (line2 === undefined) return undefined;
-    const match = /^source=(\S+)(?: reason="(.*)")?$/.exec(line2.trim());
-    if (match === null) return undefined;
-    const source = match[1]!;
-    const reason = match[2];
-    return { source, since, ...(reason === undefined ? {} : { reason }) };
-  } catch {
-    return undefined;
+  return pauseInstanceAt(path);
+}
+
+/**
+ * Compare-and-clear one pause sentinel (#780 review): remove `path` only while
+ * it still holds exactly the `expected` instance — same source, same reason,
+ * same creation instant — as read by {@link pauseInstance}. A hold or pause
+ * that replaced or recreated the sentinel between the read and the clear is a
+ * newer instance (writes always re-stamp `since`), so it is never destroyed:
+ * returning false keeps the newer fence in force. Scoped strictly to one
+ * caller-provided path, so auto-expiry can clear the per-project spend-cap
+ * sentinel without ever touching the legacy global sentinel.
+ */
+export function clearPauseIfUnchanged(
+  path: string,
+  expected: { source: string; reason?: string; since: number },
+): boolean {
+  const current = pauseInstanceAt(path);
+  if (current === undefined) return false;
+  if (
+    current.source !== expected.source ||
+    current.since !== expected.since ||
+    current.reason !== expected.reason
+  ) {
+    return false;
   }
+  rmSync(path, { force: true });
+  return true;
 }
 
 /**
@@ -640,6 +839,173 @@ export function setPaused(
   }
 }
 
+// ------------------------------------------------------------------- drain
+// (#484 slice 1) A project drain is a durable, self-expiring admission fence:
+// the same boundary as a pause — settlement above it, nothing claimed below —
+// but recorded with an absolute deadline, so an orchestrator crash can never
+// strand admission. The record is a JSON file under the state directory (like
+// the pause sentinel), scoped to exactly one configured project, and replaced
+// atomically on create. Human CLI wording and release-verb coupling are later
+// #484 children.
+
+/** The persisted shape of one project drain. Every field is validated when a
+ *  record is read — a record that cannot be trusted is never a fence. */
+export interface DrainRecord {
+  /** The configured project this drain fences; must match the reader. */
+  project: string;
+  /** ISO instant the drain intent was recorded. */
+  createdAt: string;
+  /** Absolute ISO deadline: admission resumes automatically at or after it. */
+  expiresAt: string;
+  /** Purpose recorded at creation (release window, maintenance…). */
+  reason?: string;
+}
+
+/** Create-time options for {@link createDrain}. */
+export interface CreateDrainOptions {
+  /** Absolute epoch-ms deadline — a drain must always expire on its own. */
+  expiresAt: number;
+  /** Purpose, persisted on the record and shown in structured status. */
+  reason?: string;
+}
+
+/** Why a drain record could not be trusted, named deterministically. */
+export type DrainProblem =
+  | "unparseable-json"
+  | "invalid-record"
+  | "invalid-project"
+  | "invalid-created-at"
+  | "invalid-expires-at"
+  | "expiry-not-future"
+  | "invalid-reason";
+
+/** The verdict of one drain read. `error` is the malformed-record case: the
+ *  caller may fail its pass closed, and the dispatch-side
+ *  {@link consumeDrain} removes the record in the same transition, so it can
+ *  never become a permanent drain. */
+export type DrainVerdict =
+  | { kind: "active"; drain: DrainRecord }
+  | { kind: "inactive" }
+  | { kind: "error"; problem: DrainProblem };
+
+/** Where this project's drain record lives. Project-scoped by construction:
+ *  a record present at one project's path never fences another project. */
+export function drainPath(project: string): string {
+  return join(stateDir(), `drain-${project}.json`);
+}
+
+/**
+ * Records a bounded drain intent for `project`, replacing any prior drain of
+ * the same project atomically (tmp + rename, exactly like the admission ack).
+ * The record is a file, so it survives orchestrator and daemon loss; the
+ * absolute `expiresAt` is what stops it from ever stranding admission.
+ */
+export function createDrain(
+  project: string,
+  opts: CreateDrainOptions,
+  now = Date.now(),
+): void {
+  if (project === "") {
+    throw new Error("drain project must not be empty");
+  }
+  if (!Number.isFinite(opts.expiresAt) || opts.expiresAt <= now) {
+    throw new Error("drain expiresAt must be a finite epoch-ms timestamp in the future");
+  }
+  if (opts.reason !== undefined && typeof opts.reason !== "string") {
+    throw new Error("drain reason must be a string");
+  }
+  const record: DrainRecord = {
+    project,
+    createdAt: new Date(now).toISOString(),
+    expiresAt: new Date(opts.expiresAt).toISOString(),
+    ...(opts.reason === undefined ? {} : { reason: opts.reason }),
+  };
+  const path = drainPath(project);
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid.toString(36)}.${Date.now().toString(36)}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(record, null, 2)}\n`);
+  renameSync(tmp, path);
+}
+
+/**
+ * One drained state read with no side effects — this never touches the record
+ * on disk. That purity is what lets observational surfaces live off it: a
+ * status/dashboard/health read must not consume a malformed record before a
+ * dispatch pass fails closed on it, or the pass would read absent and admit.
+ * The dispatch side performs the actual cleanup transition through
+ * {@link consumeDrain}. Callers that only need to *see* the state (including
+ * the claim path, which refuses but must not unbind its own pass) use this.
+ */
+export function readDrain(project: string, now = Date.now()): DrainVerdict {
+  const path = drainPath(project);
+  if (!existsSync(path)) return { kind: "inactive" };
+  let raw: unknown;
+  try {
+    raw = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return { kind: "error", problem: "unparseable-json" };
+  }
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    return { kind: "error", problem: "invalid-record" };
+  }
+  const rec = raw as Record<string, unknown>;
+  if (typeof rec["project"] !== "string" || rec["project"] === "") {
+    return { kind: "error", problem: "invalid-project" };
+  }
+  if (typeof rec["createdAt"] !== "string" || Number.isNaN(Date.parse(rec["createdAt"]))) {
+    return { kind: "error", problem: "invalid-created-at" };
+  }
+  if (typeof rec["expiresAt"] !== "string" || Number.isNaN(Date.parse(rec["expiresAt"]))) {
+    return { kind: "error", problem: "invalid-expires-at" };
+  }
+  if (Date.parse(rec["expiresAt"] as string) <= Date.parse(rec["createdAt"] as string)) {
+    return { kind: "error", problem: "expiry-not-future" };
+  }
+  const reason = rec["reason"];
+  if (reason !== undefined && typeof reason !== "string") {
+    return { kind: "error", problem: "invalid-reason" };
+  }
+  if (rec["project"] !== project) {
+    // A record persisted at this project's path but naming another project is
+    // either a copy or a rename mishap; it fences nobody (that project's drain
+    // lives at its own path).
+    return { kind: "inactive" };
+  }
+  if (Date.parse(rec["expiresAt"] as string) <= now) {
+    return { kind: "inactive" };
+  }
+  const drain: DrainRecord = {
+    project: rec["project"],
+    createdAt: rec["createdAt"],
+    expiresAt: rec["expiresAt"],
+    ...(reason === undefined ? {} : { reason }),
+  };
+  return { kind: "active", drain };
+}
+
+/**
+ * The dispatch-side drain read: the same verdict as {@link readDrain}, and the
+ * one place a stale or untrustworthy record is cleared as a side effect —
+ * expired and wrong-project records are removed (bounded stale-state cleanup
+ * on the next pass), and a malformed record is removed in the very transition
+ * that fails the pass closed, so it can never become an unbounded permanent
+ * drain. Only dispatch callers use this: an observational read here would let
+ * a status/health reader consume the malformed marker before the pass that
+ * must fail closed on it ever ran.
+ */
+export function consumeDrain(project: string, now = Date.now()): DrainVerdict {
+  const verdict = readDrain(project, now);
+  if (verdict.kind !== "active") {
+    rmSync(drainPath(project), { force: true });
+  }
+  return verdict;
+}
+
+/** Removes this project's drain, idempotently — a second cancel is a no-op. */
+export function cancelDrain(project: string): void {
+  rmSync(drainPath(project), { force: true });
+}
+
 // ----------------------------------------------------------------- admission
 // acknowledgement (#651, review #3)
 //
@@ -1023,6 +1389,22 @@ function laneBlock(lane: FileLane | undefined): string {
   return ["## File lane (as parsed)", "", body, "", ""].join("\n");
 }
 
+/**
+ * The declared model as a brief section (#535): the selector the dispatch
+ * will launch on — the same parse admission carried, never a second read —
+ * or the explicit fail-open note, so the worker reads the run's model on the
+ * brief itself rather than inferring it. Deliberately only the selector,
+ * never the source line: the declaration's prose already renders in the body
+ * or Discussion.
+ */
+function modelBlock(model: EffectiveModel | undefined): string {
+  const body =
+    model === undefined
+      ? "_no model declared — the project's workerModel (or harness default) is in effect_"
+      : `\`${model.model}\``;
+  return ["## Model (as parsed)", "", body, "", ""].join("\n");
+}
+
 /**
  * What an orphan-resumed worker is told about the file lane on top of the
  * continuation notice (#608). The original brief already in the transcript
@@ -1100,6 +1482,22 @@ export async function buildBrief(
      * resolved from the rendered thread itself.
      */
     lane?: FileLane;
+    /**
+     * The effective `Model:` declaration admission resolved for this
+     * candidate (#535). When carried, the brief echoes exactly this
+     * selector — the same value dispatch launches on — instead of
+     * recomputing from the dispatch-time comment read, so the run's model is
+     * one value on every surface. Absent (unit-level callers), the model is
+     * resolved from the rendered thread itself.
+     */
+    model?: EffectiveModel;
+    /**
+     * The typed host-constraints block the brief renders (#721), re-read with
+     * the config at the tick boundary so an operator edit applies on the next
+     * dispatch. Absent renders no host-constraints section at all — the
+     * brief is byte-for-byte what it always was.
+     */
+    host?: HostConstraints;
   } = {},
 ): Promise<string> {
   // Read per dispatch rather than caching: editing the brief then takes effect
@@ -1149,6 +1547,11 @@ export async function buildBrief(
   // itself. Both the discussion renderer and the parsed-lane section draw on
   // the same value, so the brief shows one lane on every surface (#608, #724).
   const lane = opts.lane ?? (comments === "unread" ? undefined : effectiveLane(r.issue.body, comments));
+  // The effective model declaration admission resolved (or resolves) for this
+  // candidate: the carried admission snapshot when dispatch has one, else the
+  // thread itself. Dispatch launches on the same value, so the brief shows
+  // one model on every surface (#535).
+  const model = opts.model ?? (comments === "unread" ? undefined : effectiveModel(r.issue.body, comments));
   return renderBrief(template, {
     ISSUE_NUMBER: String(r.issue.number),
     ISSUE_TITLE: r.issue.title,
@@ -1159,12 +1562,18 @@ export async function buildBrief(
     ACCEPTANCE_CRITERIA: acceptanceCriteria(r.issue),
     ISSUE_COMMENTS: renderDiscussion(comments, lane),
     FILE_LANE: laneBlock(lane),
+    MODEL: modelBlock(model),
     GATES: gatesBlock(r.repo),
     // The guarded shell suites and their sanctioned parse-only check, derived
     // from SHARED_HOST_SCRIPTS so the brief and the refusal share one list
     // (#687). Non-empty whenever the guard has paths, so the placeholder line
     // always renders to a line.
     SHARED_HOST_NOTICE: sharedHostBriefNotice(),
+    // The typed host-constraints paragraph (#721): derived cores/RAM folded
+    // into the operator's description, the non-interactive PATH, and the
+    // routed repo's convention. Empty when the config names none — no
+    // section, no placeholder text.
+    HOST_CONSTRAINTS: hostConstraintsNotice(opts.host, repoSlug(r.repo)),
     // The brief's code-graph paragraph: the exact `project` key for a
     // configured repo, or an explicit "no graph" statement for an
     // unconfigured one — never silence, because a worker that knows there is
@@ -1523,11 +1932,39 @@ function orphanResumeVerdict(
   return { kind: "resume", prior };
 }
 
+/**
+ * The worker identity for one launch, resolved now — or a throw naming the host
+ * change that is missing (#798/#828).
+ *
+ * Every input is host state a running daemon does not control: the account can
+ * be created after startup, and systemd can bring this service up before it has
+ * mounted the harness binding a worker resolves through. So the verdict is taken
+ * per launch. A daemon that cached one at startup would hold the whole fleet
+ * closed on a boot race until somebody restarted it by hand — the outage #828
+ * exists to end, not to relocate.
+ *
+ * The throw lands in the caller's dispatch catch, which settles the run failed
+ * with this reason and escalates. It classifies as a start failure, so a host
+ * fault charges the issue no implementation attempt.
+ */
+function launchIdentity(d: Pick<Deps, "workerIdentity">, launching: string): WorkerIdentity {
+  const resolution: WorkerIdentityResolution = d.workerIdentity?.() ?? {
+    ok: false,
+    reason: `the ${WORKER_ACCOUNT} account is not installed on this host`,
+  };
+  if (resolution.ok) return resolution.identity;
+  throw new Error(
+    `worker identity unavailable: ${resolution.reason} — refusing to launch an unbound ${launching}; ` +
+      "run `omp-conductor setup host` to install the dedicated worker identity",
+  );
+}
+
 export async function handleIssue(
   d: Deps,
   r: Routed,
   attempt: number,
   admittedLane?: FileLane,
+  admittedModel?: EffectiveModel,
 ): Promise<void> {
   const { project, caps, tracker, store } = d;
   const issue = r.issue.number;
@@ -1689,6 +2126,24 @@ export async function handleIssue(
       return;
     }
 
+    // The claim-side of the project drain fence (#484): the tick's gate sits
+    // above routing, so a drain created after that gate can still land
+    // mid-pass — the claim re-checks and refuses while a fresh drain is in
+    // force. An invalid record fails closed the same way. The read here is
+    // observational on purpose: the claim refuses but must not consume the
+    // marker, or the first refused claim would unbind the rest of its own
+    // pass; the tick's consumeDrain removes it on the next pass, so no claim
+    // path can ever be blocked permanently by it.
+    const claimDrain = readDrain(d.project.name);
+    if (claimDrain.kind === "active" || claimDrain.kind === "error") {
+      log(
+        claimDrain.kind === "error"
+          ? `#${issue} not claimed: drain record invalid (${claimDrain.problem})`
+          : `#${issue} not claimed: project drain in effect`,
+      );
+      return;
+    }
+
     // Claim on the STORE first, before anything that can fail. The run row —
     // not the label — is the crash-safe guard against double dispatch: rows
     // are local, written before any network call, and the startup orphan
@@ -1716,13 +2171,21 @@ export async function handleIssue(
     // unconfigured project — and today's dispatch is byte for byte what it
     // has always been.
     const chainConfigured = (project.modelFallbacks?.length ?? 0) > 0;
+    // A `Model:` declaration admission resolved for this candidate (#535) is
+    // this issue's workerModel: the orchestrator names a tier when it
+    // promotes, and dispatch launches on that selector exactly as if the
+    // project's `workerModel` were the declared value. Absent a declaration,
+    // today's `project.workerModel` is unchanged, and the failover chain
+    // (#286) keeps its semantics in both cases — it is the same resolution,
+    // one different primary.
+    const declaredModel = admittedModel?.model;
     const choice = resolveDispatchModel({
-      workerModel: project.workerModel,
+      workerModel: declaredModel ?? project.workerModel,
       modelFallbacks: project.modelFallbacks,
       threshold: project.modelFallbackThreshold ?? DEFAULT_MODEL_FALLBACK_THRESHOLD,
       streak: chainFacts.streak,
     });
-    const clause = fallbackClause(choice, chainFacts, project.workerModel);
+    const clause = fallbackClause(choice, chainFacts, declaredModel ?? project.workerModel);
 
     // #536: an orphan-clean requeue resumes the interrupted session instead of
     // re-reading the repo from zero. Decided here, before this attempt's row
@@ -1768,6 +2231,13 @@ export async function handleIssue(
       // above fired. `undefined` for a fresh dispatch — the store maps that to
       // NULL, so a fresh row simply never carries the field.
       resumedFromRunId: resuming?.id,
+      // #744: the file-lane declaration admission resolved for this candidate
+      // is persisted on the row, so lane occupancy survives across dispatch
+      // passes — a later pass knows what this run *intends* to touch, not only
+      // what it has touched so far. This is the exact `Admission.lane` the gate
+      // enforced and the brief rendered, never a re-parse. Absent for a run
+      // with no declaration (fail open), exactly as it was admitted.
+      lane: admittedLane,
     });
     // #434: carry a terminal predecessor's open PR onto the continuation row.
     // The claim itself stays synchronous — `handleIssue` claims at the top of
@@ -1806,6 +2276,14 @@ export async function handleIssue(
     if (await settleStopBeforeSession()) return;
     if (await settleDrainBeforeSession()) return;
 
+    // The worker identity is this run's launch gate (#798): a worker session
+    // that cannot be launched under the dedicated unprivileged account is
+    // indistinguishable from an operator shell, so dispatch refuses before any
+    // tree or session is created. Resolved here rather than read off a startup
+    // verdict, so a host that gained its account — or its harness binding
+    // (#828) — after the daemon came up dispatches on the next tick.
+    const identity = launchIdentity(d, "worker session");
+
     // A run's tree is <workspaceRoot>/<issue> and addRunRepo refuses to reuse
     // an existing path, so a retry — or a tree kept from a failed attempt — has
     // to be cleared first. Both helpers are pure path math, and removeWorktree
@@ -1886,7 +2364,13 @@ export async function handleIssue(
         runRepoPath: worktreePath,
         branch,
       },
-      { ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }) },
+      {
+        ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }),
+        // A worker-run channel is secured to the worker identity (#798): the
+        // child that must connect to it runs as that uid, and the peer verdict
+        // expects that uid on the wire rather than the daemon's.
+        channelOwner: { uid: identity.uid, gid: identity.gid },
+      },
     );
     if (await settleStopBeforeSession()) return;
     if (await settleDrainBeforeSession()) return;
@@ -1943,6 +2427,8 @@ export async function handleIssue(
           : {}),
         comments,
         lane: admittedLane,
+        model: admittedModel,
+        host: d.host,
       });
     }
     if (await settleStopBeforeSession()) return;
@@ -1950,6 +2436,13 @@ export async function handleIssue(
 
     const repoSlug = githubRepo(r.repo.cloneUrl);
 
+    // The run's working paths are granted to the worker identity by ownership
+    // (#798) — the worktree the session edits and the session directory it
+    // writes its transcript and settings into. The chown lands here, after
+    // provisioning and the verb socket, so the session starts on a tree it
+    // owns; the worker identity never inherits anything from root's trees.
+    d.grantWorkerPaths?.(identity, worktreePath, sessionDir);
+
     let result: WorkerResult;
     try {
       result = await runWorker({
@@ -1979,6 +2472,7 @@ export async function handleIssue(
         onChildLog: (line) => {
           log(`#${issue} ${line}`);
         },
+        workerIdentity: identity,
         ...(choice.model === undefined ? {} : { model: choice.model }),
         // The fleet-owned omp settings overlay (#537): the staged YAML the
         // session loads through `Settings.init({ configFiles: [<path>] })` —
@@ -2061,6 +2555,12 @@ export async function handleIssue(
             // The claimed-proof check compares the PR's Verified commands
             // against what this run's session actually recorded.
             sessionFile: result.sessionFile,
+            // The effective file lane admission resolved for this run at
+            // dispatch — the same value the brief rendered, pre-dispatch
+            // comment declarations included (#608, #744). The audit flags a
+            // diff that escapes it, so a widened lane is named on evidence
+            // rather than found by reading the PR's file list by hand (#739).
+            lane: admittedLane,
           })
         : undefined;
     if (result.state === "pushed-green" && audit?.truncated) {
@@ -2170,6 +2670,10 @@ export async function handleIssue(
       ...(result.prUrl === undefined ? {} : { prUrl: result.prUrl }),
       ...(result.headSha === undefined ? {} : { headSha: result.headSha }),
       sessionFile: result.sessionFile,
+      // The code-graph session observation (#726): what the run's own session
+      // registry held at start, persisted with the rest of the run's facts.
+      // Absent only when the session surface did not record one.
+      ...(result.graphTools === undefined ? {} : { graphTools: result.graphTools }),
       // Every terminal state persists the worker's report — with the `changed:`
       // file list derived from the PR's diff where one could be read — not
       // just a green push: a stopped attempt's partial report is still part of
@@ -2441,6 +2945,91 @@ export async function dispatchReviewRevisions(d: Deps, pool?: WorkerPool): Promi
       );
       break;
     }
+    // A capped/failed run has no pushed-green settle sweep keeping its row
+    // honest (#795 review round 1): nothing transitions a `failed` / `killed`
+    // row when its PR merges or closes, so a PR that changed after the verb
+    // recorded the round would otherwise be claimed and a worker resumed
+    // against a dead PR. The settled-green origin keeps its own interlock
+    // (the settle sweep flips the row and the claim below refuses it), so
+    // only terminal-origin rounds re-read the reviewed PR fact here: the
+    // round dispatches only while the PR is still open at the exact reviewed
+    // head.
+    //
+    // The skip decision is decisive-fact only (review round 2): a definitively
+    // missing PR (`GhPrMissingError` — a corroborated 404, #779), a PR that
+    // is definitively not open, and a head that has definitively MOVED are
+    // settled skipped, exactly like any other row that moved. Everything
+    // transient or unreadable — a bare 404 that could not be corroborated, an
+    // undefined answer, a pending check run, a same-head red check that a
+    // rerun may clear, a throwing tracker — stays PENDING for the next tick:
+    // settling it would permanently discard the orchestrator's findings and
+    // consume the round.
+    const origin = d.store.getRun(revision.runId)?.state;
+    if (origin === "failed" || origin === "killed") {
+      let prState: PrState | undefined;
+      try {
+        prState = await d.tracker.prState(revision.prUrl);
+      } catch (err) {
+        if (err instanceof GhPrMissingError) {
+          d.store.settleReviewRevision(revision.id, "skipped", Date.now());
+          log(
+            `#${revision.issue} review round ${revision.round} skipped: ${revision.prUrl} does not exist — the reviewed PR is gone`,
+          );
+          continue;
+        }
+        log(
+          `#${revision.issue} review round ${revision.round} held: PR state re-check failed (${errText(err)}) — retrying next tick`,
+        );
+        continue;
+      }
+      if (prState === undefined) {
+        log(
+          `#${revision.issue} review round ${revision.round} held: ${revision.prUrl} state could not be re-read — retrying next tick`,
+        );
+        continue;
+      }
+      if (prState !== "open") {
+        d.store.settleReviewRevision(revision.id, "skipped", Date.now());
+        log(
+          `#${revision.issue} review round ${revision.round} skipped: ${revision.prUrl} is ${prState}, not open — a review round resumes an open PR only`,
+        );
+        continue;
+      }
+      let verification: PrVerification | undefined;
+      try {
+        verification = await d.tracker.verifyPr(revision.prUrl, revision.headSha);
+      } catch (err) {
+        log(
+          `#${revision.issue} review round ${revision.round} held: the reviewed-head check failed (${errText(err)}) — retrying next tick`,
+        );
+        continue;
+      }
+      if (verification === undefined || verification.status === "pending") {
+        log(
+          `#${revision.issue} review round ${revision.round} held: ${revision.prUrl} at ${revision.headSha} is ` +
+            `${verification?.status ?? "unverifiable"} — retrying next tick`,
+        );
+        continue;
+      }
+      if (verification.status === "failed" && isHeadMismatch(verification.reason)) {
+        d.store.settleReviewRevision(revision.id, "skipped", Date.now());
+        log(
+          `#${revision.issue} review round ${revision.round} skipped: ${revision.prUrl} no longer stands at ` +
+            `${revision.headSha} (${verification.reason}) — the reviewed head moved`,
+        );
+        continue;
+      }
+      // Anything else — a same-head red check a rerun may clear, an unknown
+      // verdict — is not definitive: the round stays pending for the next
+      // tick rather than discarding the findings.
+      if (verification.status !== "green") {
+        log(
+          `#${revision.issue} review round ${revision.round} held: ${revision.prUrl} at ${revision.headSha} is ` +
+            `${verification.status} — retrying next tick`,
+        );
+        continue;
+      }
+    }
     if (!d.store.claimRunForReview(revision.runId)) {
       d.store.settleReviewRevision(revision.id, "skipped", Date.now());
       log(
@@ -2601,18 +3190,84 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
   // and shutdown fences cover the whole wake window, exactly as they do for a
   // fresh claim in `handleIssue` (#374). The original run's entries were
   // closed at its settle, so reopening by issue is safe.
+  //
+  // #747: the round gets its own bounded allowance instead of the original
+  // attempt's remainder. The resumed session continues the run's own counter
+  // — the attempt's spent turns travel with the session — so a ceiling of
+  // `run.maxTurns` would leave the round only `run.maxTurns - run.turns`,
+  // and returning a PR from a near-cap run could not finish. Open at the
+  // run's ceiling, then raise it by the round's own allowance — the run's
+  // ceiling again, capped by the project's hard ceiling — through the same
+  // override path `omp-conductor extend` uses, so the raise is persisted on
+  // the row (the run's budget stays explainable in status) while `turns`
+  // keeps accumulating the run's true cost: nothing is reset.
   turnLimit = d.turnLimits.open(project.name, issue, runId, run.maxTurns);
+  const revisionAllowance = Math.min(run.maxTurns, caps.workerMaxTurnsCeiling);
+  const revisionCeiling = run.turns + revisionAllowance;
+  const revisionRaise = d.turnLimits.extend(project.name, issue, revisionCeiling);
+  if (revisionRaise.kind === "extended") {
+    log(
+      `#${issue} review round ${revision.round} turn ceiling ${run.maxTurns} → ${revisionCeiling} ` +
+        `(+${revisionAllowance} round allowance on ${run.turns} spent)`,
+    );
+  }
   workerControl = d.workerControls.open(project.name, issue, runId);
   if (await settleStopBeforeSession()) return;
   if (await settleDrainBeforeSession()) return;
 
+  // The same launch gate as a fresh claim (#798): a revision worker is a
+  // worker, and an unbound one is an operator shell — refuse before any tree
+  // or session is created. Thrown inside the try so the ordinary dispatch
+  // catch settles it: the run row is returned to terminal `failed` with the
+  // reason, the revision row is settled with it, and the still-green PR stays
+  // open for a healthy retry.
   try {
+    const identity = launchIdentity(d, "review-revision worker");
     // Reattach the run's own branch at the same per-issue path the run used:
-    // the worktree was removed at the pushed-green settle and the branch was
-    // published, so provisioning is the same continuation reattach as a
-    // normal re-claim. A provisioning failure restores the row — the PR is
-    // still green and still open, and only the wake failed — and says so.
+    // a `pushed-green` settle removed the worktree, so provisioning is the
+    // same continuation reattach as a normal re-claim. A capped/failed run's
+    // tree was RETAINED at its terminal settle (`tree: "keep"`, #795) — the
+    // reviewed PR is green, so the branch already holds the work and the kept
+    // tree holds nothing the branch does not, unless its salvage failed. Clear
+    // it the way restart recovery does (#692): re-attempt the salvage through
+    // `tree: "remove"`, and refuse the removal if that still fails — the tree
+    // is then the only copy of work and is never destroyed. A provisioning
+    // failure restores the row — the PR is still green and still open, and
+    // only the wake failed — and says so.
     try {
+      if (run.worktree !== "" && existsSync(run.worktree)) {
+        const keptSettlement = await settleWorktree({
+          issue: run.issue,
+          attempt: run.attempt,
+          ending: `review round ${revision.round} resume`,
+          worktree: run.worktree,
+          branch: run.branch,
+          publish: (branch) => pushRunBranch(project, { repo, runRepoPath: run.worktree, branch }),
+          tree: "remove",
+          mirrorPath,
+        });
+        if (keptSettlement.retained) {
+          log(
+            `#${issue} review round ${revision.round} retained worktree ${run.worktree}: ` +
+              "its salvage failed, so the tree is the only copy of work and will not be removed",
+          );
+          store.updateRun(runId, {
+            state: "pushed-green",
+            endedAt: Date.now(),
+            lastError: `review round ${revision.round} could not clear the run's retained worktree: ${keptSettlement.lines.join(" ")}`,
+          });
+          store.settleReviewRevision(revision.id, "skipped", Date.now());
+          await safeEscalate(d, {
+            tier: 1,
+            project: project.name,
+            issue,
+            runId,
+            summary: `#${issue} review round ${revision.round} could not be dispatched — the run's retained worktree is the only copy of work`,
+            detail: [revision.prUrl, "", ...keptSettlement.lines].join("\n"),
+          });
+          return;
+        }
+      }
       const provisioned = await addRunRepo(repo, project.mirrorRoot, project.workspaceRoot, issue, branch);
       worktreePath = provisioned.path;
       runRepo = { repo, runRepoPath: worktreePath, branch };
@@ -2680,7 +3335,10 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
         runRepoPath: worktreePath,
         branch,
       },
-      { ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }) },
+      {
+        ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }),
+        channelOwner: { uid: identity.uid, gid: identity.gid },
+      },
     );
     if (await settleStopBeforeSession()) return;
     if (await settleDrainBeforeSession()) return;
@@ -2695,6 +3353,11 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
 
     log(`#${issue} review round ${revision.round} → resuming ${branch} (${priorSessionFile})`);
 
+    // The revision worker gets its own tree ownership, exactly as a fresh
+    // claim does (#798): the resumed worktree and session directory belong to
+    // the worker identity before its session starts.
+    d.grantWorkerPaths?.(identity, worktreePath, sessionDir);
+
     let result: WorkerResult;
     try {
       result = await runWorker({
@@ -2719,6 +3382,7 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
         onChildLog: (line) => {
           log(`#${issue} ${line}`);
         },
+        workerIdentity: identity,
         // The continuation stays on the model the green run used (#286).
         ...(run.model === undefined ? {} : { model: run.model }),
         ...(ompSettingsFile === undefined ? {} : { ompSettingsFile }),
@@ -2813,6 +3477,7 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
       ...(result.prUrl === undefined ? {} : { prUrl: result.prUrl }),
       ...(result.headSha === undefined ? {} : { headSha: result.headSha }),
       sessionFile: result.sessionFile,
+      ...(result.graphTools === undefined ? {} : { graphTools: result.graphTools }),
       report: finalReport,
       ...settlement?.patch,
     };
@@ -3021,8 +3686,12 @@ export async function reconcileCrashedReviewRevisions(d: Deps): Promise<ReviewRe
     }
     // A revision the previous daemon never claimed: the run is still a
     // settled green row and the round is still pending, so the ordinary
-    // dispatch pass wakes it on the next tick untouched.
-    if (run.state === "pushed-green") continue;
+    // dispatch pass wakes it on the next tick untouched. Same for a
+    // capped/failed run whose review round is pending (#795): a `failed` /
+    // `killed` row is terminal too — no process died on this round, the
+    // revision was never claimed, and the ordinary dispatch pass claims it
+    // exactly like a pending round on a pushed-green row.
+    if (run.state === "pushed-green" || run.state === "failed" || run.state === "killed") continue;
     // The run a previous daemon claimed for this round and died on: the
     // orphan sweep just marked it `orphaned` (salvaging the tree to the
     // branch), so restore it to the reviewable state the verb recorded.
@@ -3609,6 +4278,7 @@ export function summarizeDispatch(
   holds: readonly AdmissionHold[],
   completedAt = Date.now(),
   settled = 0,
+  parked = 0,
 ): DispatchSummary {
   const groups = new Map<AdmissionHoldReason, { count: number; issues: number[]; details: string[] }>();
   for (const hold of holds) {
@@ -3638,6 +4308,10 @@ export function summarizeDispatch(
         ...(group.details.length === 0 ? {} : { details: group.details }),
       })),
     settled,
+    // Omitted at zero so a pass with nothing parked keeps the pre-#507 record
+    // shape byte for byte — old persisted rows lack the key and readers use
+    // `?? 0` either way.
+    ...(parked === 0 ? {} : { parked }),
   };
 }
 
@@ -3770,6 +4444,13 @@ export function upgradeVerifyDepsFor(d: Pick<Deps, "project" | "store">): Upgrad
       );
       return launched.ok === true ? { ok: true, unit: launched.unit } : { ok: false, stderr: launched.stderr };
     },
+    herdrSession: resolveHerdrSession(process.env),
+    // The durable pane probe for the post-restart verifier (#832): every omp
+    // process the fleet pane currently claims by herdr, resolved to its start
+    // time — the evidence an external (pane-owned) orchestrator actually
+    // restarted after the install began, through the same shared probe as the
+    // in-process upgrade.
+    probePaneOmp: (session) => herdrPaneOmpStarts(runCommand, session, processStartTimeMs),
     log,
     now: () => Date.now(),
   };
@@ -3870,6 +4551,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     }
     d.project = fresh;
     d.caps = freshCaps;
+    d.host = cfg.host;
     d.deliveryPolicyValid = true;
   } catch (err) {
     log(`config reload failed (${errText(err)}) — retaining boot values but blocking autonomous delivery`);
@@ -4030,6 +4712,37 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
       log(`decision condition pass failed: ${errText(err)}`);
     });
 
+  // A spend-cap pause is self-expiring (#780). The spend gate below persists a
+  // pause once today's spend reaches the cap, but once that latch is on disk
+  // every later pass returns at the pause gate and never reaches the spend
+  // check again — so the fleet stayed stopped after the rolling window reset
+  // until an operator ran `resume`. The same measurement that closed the gate
+  // reopens it: clear a per-project spend-cap pause when the current
+  // rolling-window spend is below the cap (or no cap is configured at all —
+  // the gate that justified the pause is gone). Two guards keep the clear from
+  // ever overriding another stop: only the exact instance that was read is
+  // removed (a hold that replaced the sentinel meanwhile is untouched, review
+  // #780), and only the per-project sentinel is ever considered — the legacy
+  // global sentinel, which may carry an operator/integrity/setup hold, is
+  // never removed, so the pause gate below still observes it.
+  const spendPausePath = pausedPath(d.project.name);
+  const spendPause = pauseInstanceAt(spendPausePath);
+  if (spendPause?.source === "spend-cap") {
+    const spent = d.store.spendSince(d.project.name, startOfToday());
+    if (
+      (d.caps.dailySpendUsd === null || spent < d.caps.dailySpendUsd) &&
+      clearPauseIfUnchanged(spendPausePath, spendPause)
+    ) {
+      log(
+        `spend-cap pause cleared: $${spent.toFixed(2)} ` +
+          (d.caps.dailySpendUsd === null
+            ? "(no daily cap configured)"
+            : `below the $${d.caps.dailySpendUsd.toFixed(2)} daily cap`) +
+          " — dispatch resumes",
+      );
+    }
+  }
+
   // A paused fleet claims nothing. Checked first so pausing takes effect on the
   // next tick without signalling the process. But the pass still ran, and the
   // operator has to be able to see it: record it as a held pass — the work the
@@ -4050,6 +4763,37 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     return;
   }
 
+  // The project drain is the self-expiring sibling of the pause fence (#484):
+  // the same admission boundary — settlement above it, nothing claimed below —
+  // but the intent is durable (it survives orchestrator loss) and bounded (the
+  // record carries an absolute deadline, so a crash can never strand
+  // admission). Three shapes, three behaviours:
+  //   - fresh drain with live runs → a held pass, exactly like a pause;
+  //   - fresh drain with nothing left to wait for → the drain is satisfied
+  //     and clears itself, so a completed drain never needs a second operator
+  //     action and this pass proceeds normally;
+  //   - malformed record → fails closed for THIS pass (it might be a fresh
+  //     fence we cannot read), and the same consume removed it, so it can
+  //     never become an unbounded permanent drain.
+  const drain = consumeDrain(d.project.name);
+  if (drain.kind === "active") {
+    // Completion is the ACTIVE set, not the live-worker set: pushed-pending
+    // and pushed-green PRs still make the `runs-settled` release gate fail, so
+    // a drain that cleared while one remained would admit work on top of a
+    // batch the releases still see as unfinished (#776 review #2).
+    if (d.store.activeRuns(d.project.name).length === 0) {
+      cancelDrain(d.project.name);
+      log("project drain completed: no active runs remain — drain cleared");
+    } else {
+      d.store.recordDispatch(d.project.name, summarizeHeldPass(settled));
+      return;
+    }
+  } else if (drain.kind === "error") {
+    log(`project drain record invalid (${drain.problem}) — removed; this pass admits nothing`);
+    d.store.recordDispatch(d.project.name, summarizeHeldPass(settled));
+    return;
+  }
+
   const { project, caps, store } = d;
 
   // "Nobody patches the running conductor" is a hard boundary in both briefs —
@@ -4154,12 +4898,28 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   const dropped = effective.filter(
     (issue) => !isEligible(issue, project) && issue.labels.some((l) => stateLabels.has(l)),
   );
+  // The operator's park label is not a stale lifecycle label: the queue query
+  // still returns a parked-and-queued issue, route() drops it as ineligible,
+  // and the claim gate holds it as `issue-parked` when the park lands mid-pass
+  // (#734). Counting it as stale-lifecycle below would summon the orchestrator
+  // to reconcile a deliberate decision. Parked is its own population, derived
+  // from the same isEligible read the gate uses, so the number status renders
+  // cannot disagree with what admission would hold (#507).
+  const parkedCandidates = effective.filter(
+    (issue) => !isEligible(issue, project) && issue.labels.includes(project.stateLabels.backlog),
+  );
+  const parkedNumbers = new Set(parkedCandidates.map((issue) => issue.number));
   let claimed = 0;
+  let parked = 0;
   const lifecycleHolds: AdmissionHold[] = [];
   for (const issue of dropped) {
     const newest = store.latestRun(project.name, issue.number);
     if (newest !== undefined && ACTIVE_STATES.includes(newest.state)) {
       claimed += 1;
+    } else if (parkedNumbers.has(issue.number)) {
+      // A park never kills a live run; a parked issue with no run is inventory
+      // the operator is deliberately holding, not reconciliation work.
+      parked += 1;
     } else {
       lifecycleHolds.push({ issue: issue.number, reason: "stale-lifecycle" });
     }
@@ -4173,7 +4933,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   const recordDispatch = (admitted: number, holds: readonly AdmissionHold[]): void => {
     store.recordDispatch(
       project.name,
-      summarizeDispatch(ready.length, routed.length, claimed, admitted, holds, Date.now(), settled),
+      summarizeDispatch(ready.length, routed.length, claimed, admitted, holds, Date.now(), settled, parked),
     );
   };
 
@@ -4218,7 +4978,8 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
       summary: `Daily spend cap reached on ${new Date().toISOString().slice(0, 10)} — ${project.name} is paused`,
       detail: [
         `Spent $${spent.toFixed(2)} of the $${caps.dailySpendUsd.toFixed(2)} daily cap.`,
-        "No further work will be claimed until `omp-conductor resume`.",
+        "Dispatch stays paused until today's spend falls below the cap, then resumes",
+        "automatically on the next pass — `omp-conductor resume` only speeds that up.",
       ].join("\n"),
     });
     recordDispatch(0, [
@@ -4266,7 +5027,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   log(`dispatching ${pass.admitted.map((a) => `#${a.r.issue.number}`).join(" ")}`);
   await dispatchAdmissions(
     pass.admitted,
-    (a) => handleIssue(d, a.r, a.attempt, a.lane),
+    (a) => handleIssue(d, a.r, a.attempt, a.lane, a.model),
     workers,
   );
 
@@ -4294,6 +5055,23 @@ export interface DaemonHealthSnapshot {
   codeGraph?: CodeGraphHealth;
   /** Live workers in a non-running pause phase; absent/empty = nothing paused. */
   workers?: { issue: number; runId: string; phase: WorkerPausePhase }[];
+  /**
+   * The live orchestrator surface, attested by the running daemon (#832):
+   * which mode this project's fleet is in, and — when the daemon hosts the
+   * orchestrator session itself — the extension version that session *loaded*
+   * and the transcript it resumed. This is the read the upgrade's
+   * session-reload verification checks: a restarted daemon whose orchestrator
+   * child came up on the installed release answers `loaded` equal to that
+   * release; one that never reloaded answers an older version; one that
+   * failed to start answers `mode: "failed"`. `external` means the pane owns
+   * the session and the daemon cannot attest it from here.
+   */
+  orchestrator?: {
+    mode: "embedded" | "external" | "failed";
+    loaded?: string;
+    sessionFile?: string;
+    alive?: boolean;
+  };
 }
 
 export interface DaemonHealth {
@@ -4309,6 +5087,7 @@ export function daemonHealthSnapshot(
   paused = isPaused(project),
   codeGraph?: CodeGraphHealth,
   workerControls?: WorkerControlRegistry,
+  orchestrator?: DaemonHealthSnapshot["orchestrator"],
 ): DaemonHealthSnapshot {
   const dispatch = store.latestDispatch(project);
   return {
@@ -4320,6 +5099,7 @@ export function daemonHealthSnapshot(
     ...(dispatch === undefined ? {} : { dispatch }),
     ...(codeGraph?.configured === true ? { codeGraph } : {}),
     ...(workerControls === undefined ? {} : { workers: workerControls.snapshot(project) }),
+    ...(orchestrator === undefined ? {} : { orchestrator }),
   };
 }
 
@@ -4637,6 +5417,55 @@ export async function daemonHttpResponse(req: Request, d: DaemonHttpDeps): Promi
   return workerControl ?? new Response("not found\n", { status: 404 });
 }
 
+/**
+ * The effective reporting surface, derived from the configured policy — never
+ * from the legacy preset name alone: an explicit policy without the
+ * `scopePreset` back-annotation must present the same truth from `interruptOn`
+ * and the digest cadence (#633).
+ */
+export interface ReportingSummary {
+  /** The legacy preset this policy came from, when the config back-annotates one. */
+  scopePreset?: ReportScope;
+  /** Categories allowed to interrupt the operator's phone. */
+  interruptOn: InterruptCategory[];
+  /** Where non-interrupting outcomes accumulate: the effective digest config. */
+  digest: ReportingPolicy["digest"];
+}
+
+/**
+ * The effective reporting summary. The loader always materialises the policy,
+ * so `undefined` means the default (`DEFAULT_REPORT_POLICY`); the preset name
+ * is carried only when the policy actually back-annotates one, so a rendered
+ * status names the preset without ever letting a stale or absent preset
+ * misstate what the policy does (#633).
+ */
+export function reportingSummary(policy: ReportingPolicy | undefined): ReportingSummary {
+  const effective = policy ?? DEFAULT_REPORT_POLICY;
+  return {
+    ...(effective.scopePreset === undefined ? {} : { scopePreset: effective.scopePreset }),
+    interruptOn: [...effective.interruptOn],
+    digest: { ...effective.digest },
+  };
+}
+
+/**
+ * The active drain as structured status exposes it: the creation instant, the
+ * absolute deadline, the purpose, and the live-run count the drain is waiting
+ * to reach zero. Only present on the snapshot while the record is fresh.
+ */
+export interface DrainStatus {
+  /** Epoch-ms instant the drain intent was recorded. */
+  since: number;
+  /** Absolute epoch-ms deadline — admission resumes automatically after it. */
+  expiresAt: number;
+  /** Purpose recorded at creation. */
+  reason?: string;
+  /** Runs still in the active set (live workers plus pushed-state PRs) — the
+   *  count a drain waits to reach zero, matching the `runs-settled` release
+   *  gate (#776 review #2). */
+  remainingRuns: number;
+}
+
 export interface StatusSnapshot {
   project: string;
   configPath: string;
@@ -4648,10 +5477,27 @@ export interface StatusSnapshot {
    * reading like a mistake (#220).
    */
   pauseReason?: string;
+  /**
+   * The project's active self-expiring drain (#484): present only while a
+   * fresh, valid drain record exists. Paused and drained are deliberately two
+   * fields — a drain is bounded and self-clearing where a pause is not, and
+   * the structured surface has to tell them apart without reading the pass
+   * history. Human CLI wording over it is a later #484 child.
+   */
+  drain?: DrainStatus;
   /** Mechanical operator availability at the moment this snapshot was read. */
   availability?: AvailabilityState;
   /** Next digest opportunity under the same predicate that gates submission. */
   digestSchedule?: DigestScheduleState;
+  /**
+   * The effective reporting policy: what interrupts, where everything else
+   * goes, and the legacy preset name when one is back-annotated. On the
+   * snapshot so the human `status`, the dashboard API and the CLI all read
+   * the same truth about the reporting surface without opening config — a
+   * routine outcome that reads as "Telegram is broken" unless the policy says
+   * it is digest-only (#633).
+   */
+  reporting?: ReportingSummary;
   caps: Caps;
   /**
    * The effective per-shape release grants. On the snapshot rather than re-read
@@ -4773,6 +5619,19 @@ export function statusSnapshotFromStore(
   // Read once: the provenance read touches the filesystem, and the renderer
   // should never pay for it twice per status.
   const reason = pauseProvenance(p.name)?.reason;
+  // Same cost discipline as the pause read: the drain record is a file read,
+  // and the active-drain view is only built when one is actually fresh. The
+  // read is observational — it never mutates the record — so a status read
+  // cannot consume a malformed marker the next dispatch pass still has to fail
+  // closed on; the dispatch consume owns cleanup (#776 review #2).
+  const drain = readDrain(p.name);
+  // The live run list feeds the worker-capacity row; the drain's
+  // remaining-runs count waits on the ACTIVE set (live workers plus
+  // pushed-state PRs), the same population the `runs-settled` release gate
+  // reads, so the two can never disagree about when a batch is finished
+  // (#776 review #2).
+  const live = store.liveRuns(p.name);
+  const active = store.activeRuns(p.name);
   // The live review-revision rounds, read from the same durable rows the
   // restart recovery uses: a run whose revision is dispatched is read as
   // `review-revision N` while its worker is live (#692).
@@ -4786,12 +5645,23 @@ export function statusSnapshotFromStore(
     stateDir: stateDir(),
     paused: isPaused(p.name),
     ...(reason === undefined ? {} : { pauseReason: reason }),
+    ...(drain.kind === "active"
+      ? {
+          drain: {
+            since: Date.parse(drain.drain.createdAt),
+            expiresAt: Date.parse(drain.drain.expiresAt),
+            ...(drain.drain.reason === undefined ? {} : { reason: drain.drain.reason }),
+            remainingRuns: active.length,
+          } satisfies DrainStatus,
+        }
+      : {}),
     availability: availabilityState(p.reporting, now),
     digestSchedule: digestScheduleState(p.reporting ?? DEFAULT_REPORT_POLICY, lastDigestDay, now),
+    reporting: reportingSummary(p.reporting ?? DEFAULT_REPORT_POLICY),
     caps,
     releaseGrants: resolveReleaseGrants(p),
     review: resolveReview(p),
-    activeRuns: store.activeRuns(p.name),
+    activeRuns: active,
     reviewRounds,
     salvagedRuns: store.salvagedRuns(p.name),
     quarantinedRuns: store.quarantinedRuns(p.name),
@@ -4799,7 +5669,7 @@ export function statusSnapshotFromStore(
     openReports: store.openReports(p.name),
     digestBacklog: store.digestBacklog(p.name),
     verbLedger: store.verbLedger(p.name, { limit: STATUS_LEDGER_SCAN }),
-    liveWorkers: store.liveRuns(p.name).length,
+    liveWorkers: live.length,
     runsToday: store.runsStartedSince(p.name, since),
     spendTodayUsd: store.spendSince(p.name, since),
     ...(dispatch === undefined ? {} : { dispatch }),
@@ -4846,6 +5716,14 @@ export function formatDispatchSummary(summary?: DispatchSummary): string {
       `  candidates    ${summary.ready} ready / ${summary.claimed ?? 0} in flight / ${summary.routed} spare`,
       `  admitted      ${summary.admitted}`,
     );
+    // The operator's park label, counted from the same eligibility read the
+    // claim gate uses (#507): "0 claimable, 12 parked" and "0 claimable,
+    // nothing to do" demand opposite orchestrator responses and must not
+    // render alike. Omitted at zero so an empty queue stays the old shape.
+    const parked = summary.parked ?? 0;
+    if (parked > 0) {
+      lines.push(`  parked        ${parked} — operator-held, never claimed`);
+    }
     if (summary.holds.length === 0) {
       lines.push("  held          0");
     } else {
@@ -5372,6 +6250,25 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   const store = openStore(dbPath());
   const verbPeerReader = peerCredentialReader();
   const verbDir = ensureVerbSocketDir(stateDir());
+  // The worker identity (#798). Probed once here for the startup banner only —
+  // every dispatch re-resolves it through {@link launchIdentity}, because the
+  // account, setpriv and the harness binding (#828) are all host state that can
+  // arrive after this process did. A host that cannot establish it keeps its
+  // control plane running and fails each worker launch closed with the reason,
+  // so the operator hears a concrete host change instead of a fleet that
+  // silently ran workers as root.
+  const identityAtStartup = resolveWorkerIdentity();
+  if (identityAtStartup.ok) {
+    log(
+      `worker identity: ${identityAtStartup.identity.account} uid=${identityAtStartup.identity.uid} ` +
+        `gid=${identityAtStartup.identity.gid} home=${identityAtStartup.identity.home}`,
+    );
+  } else {
+    log(
+      "worker identity unavailable — worker dispatch fails closed until the host provides it " +
+        `(re-checked at every launch, so no restart is needed once it does): ${identityAtStartup.reason}`,
+    );
+  }
   const integrity: IntegrityGate = { baseline: packageManifest(), paged: false };
   const usage = sharedUsageSource();
   const turnLimits = createTurnLimitRegistry((runId, maxTurns) => {
@@ -5398,6 +6295,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
       log(projects.length === 1 ? message : `[${project.name}] ${message}`);
     };
     const caps = resolveCaps(project, cfg.defaults);
+    const host = cfg.host;
     // One transient-server-error breaker per project (#642): admission's
     // GraphQL checks and the orchestrator mutation commands share it, so a 503
     // observed by either side gates both instead of one provider outage being
@@ -5476,7 +6374,11 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
             recordReleaseBlock(project.name, "orchestrator", shape, context),
         });
         const transcript = orchestrator.sessionFile();
-        projectLog(`orchestrator session ready${transcript === undefined ? "" : ` · ${transcript}`}`);
+        const loaded = orchestrator.extensionVersion();
+        projectLog(
+          `orchestrator session ready${transcript === undefined ? "" : ` · ${transcript}`}` +
+            `${loaded === undefined ? "" : ` · loaded omp-conductor ${loaded}`}`,
+        );
       } catch (err) {
         orchestratorStartError = errText(err);
         projectLog(
@@ -5529,6 +6431,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     const d: Deps = {
       project,
       caps,
+      host,
       tracker,
       store,
       drain,
@@ -5544,6 +6447,16 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
       probeCriticalBase: (repo, markers, branch) =>
         probeCriticalBase(project, repo, branch, markers),
       probeWorktreeLane: (input) => probeRunLane(input),
+      // The live host, per launch — never the startup verdict above.
+      workerIdentity: () => resolveWorkerIdentity(),
+      // Grant each run's paths to the worker identity by ownership, before the
+      // session that must edit them starts (#798). The recursive chown runs as
+      // root from the dispatch path; the worker identity owns its checkout and
+      // transcript and nothing else.
+      grantWorkerPaths: (identity, worktreePath, sessionDir) => {
+        chownRecursive(worktreePath, identity.uid, identity.gid);
+        chownRecursive(sessionDir, identity.uid, identity.gid);
+      },
       // A cross-repo Depends-on prerequisite reads through the same GitHub
       // credential/accounting seams as the project tracker — a fresh tracker
       // scoped to the referenced repo, reusing the daemon's gh hooks so API
@@ -5718,15 +6631,31 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
         },
         health: () =>
           daemonHealth(
-            runtimes.map((runtime) =>
-              daemonHealthSnapshot(
+            runtimes.map((runtime) => {
+              const orch = runtime.orchestrator;
+              const mode = runtime.d.project.escalation.orchestrator;
+              return daemonHealthSnapshot(
                 store,
                 runtime.d.project.name,
                 isPaused(runtime.d.project.name),
                 runtime.codeGraph,
                 workerControls,
-              ),
-            ),
+                orch === undefined
+                  ? // External mode is the pane's session: the daemon hosts no
+                    // child to attest. An embedded orchestrator that failed to
+                    // start is a live outage of the surface the upgrade must
+                    // promise reloaded (#832) — say so out loud.
+                    { mode: mode === "external" ? "external" : "failed" }
+                  : {
+                      mode: "embedded",
+                      ...(orch.extensionVersion() === undefined
+                        ? {}
+                        : { loaded: orch.extensionVersion() }),
+                      ...(orch.sessionFile() === undefined ? {} : { sessionFile: orch.sessionFile() }),
+                      alive: orch.alive(),
+                    },
+              );
+            }),
           ),
       }),
   });