omp-conductor 0.18.0 → 0.18.2

package/src/daemon.ts

@@ -8,7 +8,7 @@
  * here and enforced before anything is claimed.
  */
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { chmodSync, closeSync, constants, existsSync, fchownSync, lstatSync, mkdirSync, openSync, readdirSync, readFileSync, readlinkSync, renameSync, rmSync, statSync, writeFileSync, type Dirent } from "node:fs";
 import { dirname, join, relative } from "node:path";
 import {
   configPath,
@@ -36,12 +36,14 @@ import {
 import { createEscalator, escalationIssueRef } from "./escalate.ts";
 import { pendingCodeGraph, probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
 import { graphHint } from "./graph.ts";
+import { hostConstraintsNotice } from "./host.ts";
 import { acquireOnceLease, healthCheck, livingDaemon, probeUnit, SYSTEMD_UNIT } from "./lifecycle.ts";
 import { requestImmediateTick, resolveTickConfigCwd, STALL_MARKER_FILE } from "./orchestrator-tick.ts";
 import { runDoctor } from "./doctor.ts";
 import { appendJournal, launchTransientUnit, readUpgradeJournal } from "./upgrade-journal.ts";
 import { runCommand, verifyPendingUpgrade, type UpgradeVerifyDeps } from "./upgrade-verify.ts";
-import { fleetLayers } from "./fleet.ts";
+import { processStartTimeMs } from "./upgrade-verify.ts";
+import { fleetLayers, herdrPaneOmpStarts, resolveHerdrSession } from "./fleet.ts";
 import { startOrchestrator } from "./orchestrator.ts";
 import type { OrchestratorHandle } from "./orchestrator.ts";
 import {
@@ -66,11 +68,13 @@ import type { Routed, UnroutableReason } from "./routing.ts";
 import {
   admitCandidates,
   effectiveLane,
+  effectiveModel,
   hasContinuationBudget,
   hasFailedAttemptBudget,
   laneEcho,
 } from "./admission.ts";
-import type { Admission, AdmissionHold, FileLane } from "./admission.ts";
+import type { Admission, AdmissionHold } from "./admission.ts";
+import type { EffectiveModel, FileLane } from "./types.ts";
 import { log, errText, safeEscalate } from "./log.ts";
 import {
   adoptSalvagedPrs,
@@ -107,7 +111,7 @@ import {
   snapshotDb,
   utcDay,
 } from "./store.ts";
-import { GraphqlBreaker, makeTracker, type RateLimitStatus } from "./tracker/github.ts";
+import { GhPrMissingError, GraphqlBreaker, makeTracker, type RateLimitStatus } from "./tracker/github.ts";
 import { DEFAULT_REPORT_POLICY, RELEASE_SHAPES } from "./types.ts";
 import type {
   BaseFreeze,
@@ -118,6 +122,7 @@ import type {
   DispatchSummary,
   DigestBacklog,
   Escalation,
+  InterruptCategory,
   IssueComment,
   IssueSnapshot,
   MergedPrInfo,
@@ -125,13 +130,16 @@ import type {
   ReleaseShape,
   OrchestratorIncident,
   PrState,
+  PrVerification,
   ProjectConfig,
   ReadyIssue,
+  ReportScope,
   ReportingPolicy,
   RepoTarget,
   ReportRecord,
   ResolvedGrants,
   FailureClass,
+  HostConstraints,
   RecoveryAction,
   ReviewPolicy,
   ReviewRevisionOutcome,
@@ -170,6 +178,7 @@ import {
 import { githubVerbActions } from "./verbs/actions.ts";
 import { formatVerbLedger, STATUS_LEDGER_SCAN } from "./verbs/ledger.ts";
 import {
+  isHeadMismatch,
   listenVerbChannel,
   type VerbActions,
   type VerbDeps,
@@ -244,6 +253,10 @@ export interface DrainSignal {
 interface Deps {
   project: ProjectConfig;
   caps: Caps;
+  /** The typed host-constraints block (#721), re-resolved at the tick
+   *  boundary like `project`/`caps`, and rendered into every brief the tick
+   *  dispatches. Optional so tests that never exercise it can omit it. */
+  host?: HostConstraints;
   tracker: Tracker;
   store: Store;
   /**
@@ -572,6 +585,29 @@ export function pauseProvenance(
   }
 }
 
+/**
+ * One pause sentinel FILE read as an instance identity: who set it, why, and
+ * the creation instant, all from that exact file. An unreadable or malformed
+ * file is undefined — the caller may treat it as absence.
+ */
+function pauseInstanceAt(
+  path: string,
+): { source: string; reason?: string; since: number } | undefined {
+  try {
+    const [line1, line2] = readFileSync(path, "utf8").split("\n");
+    const since = Date.parse(line1?.trim() ?? "");
+    if (!Number.isFinite(since)) return undefined;
+    if (line2 === undefined) return undefined;
+    const match = /^source=(\S+)(?: reason="(.*)")?$/.exec(line2.trim());
+    if (match === null) return undefined;
+    const source = match[1]!;
+    const reason = match[2];
+    return { source, since, ...(reason === undefined ? {} : { reason }) };
+  } catch {
+    return undefined;
+  }
+}
+
 /**
  * One pause sentinel read as a single identity: who set it, why, and the
  * creation instant, all from the SAME file that was selected. Unlike pairing
@@ -591,19 +627,34 @@ export function pauseInstance(
       : [pausedPath(project), pausedPath()];
   const path = paths.find((candidate) => existsSync(candidate));
   if (path === undefined) return undefined;
-  try {
-    const [line1, line2] = readFileSync(path, "utf8").split("\n");
-    const since = Date.parse(line1?.trim() ?? "");
-    if (!Number.isFinite(since)) return undefined;
-    if (line2 === undefined) return undefined;
-    const match = /^source=(\S+)(?: reason="(.*)")?$/.exec(line2.trim());
-    if (match === null) return undefined;
-    const source = match[1]!;
-    const reason = match[2];
-    return { source, since, ...(reason === undefined ? {} : { reason }) };
-  } catch {
-    return undefined;
+  return pauseInstanceAt(path);
+}
+
+/**
+ * Compare-and-clear one pause sentinel (#780 review): remove `path` only while
+ * it still holds exactly the `expected` instance — same source, same reason,
+ * same creation instant — as read by {@link pauseInstance}. A hold or pause
+ * that replaced or recreated the sentinel between the read and the clear is a
+ * newer instance (writes always re-stamp `since`), so it is never destroyed:
+ * returning false keeps the newer fence in force. Scoped strictly to one
+ * caller-provided path, so auto-expiry can clear the per-project spend-cap
+ * sentinel without ever touching the legacy global sentinel.
+ */
+export function clearPauseIfUnchanged(
+  path: string,
+  expected: { source: string; reason?: string; since: number },
+): boolean {
+  const current = pauseInstanceAt(path);
+  if (current === undefined) return false;
+  if (
+    current.source !== expected.source ||
+    current.since !== expected.since ||
+    current.reason !== expected.reason
+  ) {
+    return false;
   }
+  rmSync(path, { force: true });
+  return true;
 }
 
 /**
@@ -640,6 +691,173 @@ export function setPaused(
   }
 }
 
+// ------------------------------------------------------------------- drain
+// (#484 slice 1) A project drain is a durable, self-expiring admission fence:
+// the same boundary as a pause — settlement above it, nothing claimed below —
+// but recorded with an absolute deadline, so an orchestrator crash can never
+// strand admission. The record is a JSON file under the state directory (like
+// the pause sentinel), scoped to exactly one configured project, and replaced
+// atomically on create. Human CLI wording and release-verb coupling are later
+// #484 children.
+
+/** The persisted shape of one project drain. Every field is validated when a
+ *  record is read — a record that cannot be trusted is never a fence. */
+export interface DrainRecord {
+  /** The configured project this drain fences; must match the reader. */
+  project: string;
+  /** ISO instant the drain intent was recorded. */
+  createdAt: string;
+  /** Absolute ISO deadline: admission resumes automatically at or after it. */
+  expiresAt: string;
+  /** Purpose recorded at creation (release window, maintenance…). */
+  reason?: string;
+}
+
+/** Create-time options for {@link createDrain}. */
+export interface CreateDrainOptions {
+  /** Absolute epoch-ms deadline — a drain must always expire on its own. */
+  expiresAt: number;
+  /** Purpose, persisted on the record and shown in structured status. */
+  reason?: string;
+}
+
+/** Why a drain record could not be trusted, named deterministically. */
+export type DrainProblem =
+  | "unparseable-json"
+  | "invalid-record"
+  | "invalid-project"
+  | "invalid-created-at"
+  | "invalid-expires-at"
+  | "expiry-not-future"
+  | "invalid-reason";
+
+/** The verdict of one drain read. `error` is the malformed-record case: the
+ *  caller may fail its pass closed, and the dispatch-side
+ *  {@link consumeDrain} removes the record in the same transition, so it can
+ *  never become a permanent drain. */
+export type DrainVerdict =
+  | { kind: "active"; drain: DrainRecord }
+  | { kind: "inactive" }
+  | { kind: "error"; problem: DrainProblem };
+
+/** Where this project's drain record lives. Project-scoped by construction:
+ *  a record present at one project's path never fences another project. */
+export function drainPath(project: string): string {
+  return join(stateDir(), `drain-${project}.json`);
+}
+
+/**
+ * Records a bounded drain intent for `project`, replacing any prior drain of
+ * the same project atomically (tmp + rename, exactly like the admission ack).
+ * The record is a file, so it survives orchestrator and daemon loss; the
+ * absolute `expiresAt` is what stops it from ever stranding admission.
+ */
+export function createDrain(
+  project: string,
+  opts: CreateDrainOptions,
+  now = Date.now(),
+): void {
+  if (project === "") {
+    throw new Error("drain project must not be empty");
+  }
+  if (!Number.isFinite(opts.expiresAt) || opts.expiresAt <= now) {
+    throw new Error("drain expiresAt must be a finite epoch-ms timestamp in the future");
+  }
+  if (opts.reason !== undefined && typeof opts.reason !== "string") {
+    throw new Error("drain reason must be a string");
+  }
+  const record: DrainRecord = {
+    project,
+    createdAt: new Date(now).toISOString(),
+    expiresAt: new Date(opts.expiresAt).toISOString(),
+    ...(opts.reason === undefined ? {} : { reason: opts.reason }),
+  };
+  const path = drainPath(project);
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid.toString(36)}.${Date.now().toString(36)}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(record, null, 2)}\n`);
+  renameSync(tmp, path);
+}
+
+/**
+ * One drained state read with no side effects — this never touches the record
+ * on disk. That purity is what lets observational surfaces live off it: a
+ * status/dashboard/health read must not consume a malformed record before a
+ * dispatch pass fails closed on it, or the pass would read absent and admit.
+ * The dispatch side performs the actual cleanup transition through
+ * {@link consumeDrain}. Callers that only need to *see* the state (including
+ * the claim path, which refuses but must not unbind its own pass) use this.
+ */
+export function readDrain(project: string, now = Date.now()): DrainVerdict {
+  const path = drainPath(project);
+  if (!existsSync(path)) return { kind: "inactive" };
+  let raw: unknown;
+  try {
+    raw = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return { kind: "error", problem: "unparseable-json" };
+  }
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    return { kind: "error", problem: "invalid-record" };
+  }
+  const rec = raw as Record<string, unknown>;
+  if (typeof rec["project"] !== "string" || rec["project"] === "") {
+    return { kind: "error", problem: "invalid-project" };
+  }
+  if (typeof rec["createdAt"] !== "string" || Number.isNaN(Date.parse(rec["createdAt"]))) {
+    return { kind: "error", problem: "invalid-created-at" };
+  }
+  if (typeof rec["expiresAt"] !== "string" || Number.isNaN(Date.parse(rec["expiresAt"]))) {
+    return { kind: "error", problem: "invalid-expires-at" };
+  }
+  if (Date.parse(rec["expiresAt"] as string) <= Date.parse(rec["createdAt"] as string)) {
+    return { kind: "error", problem: "expiry-not-future" };
+  }
+  const reason = rec["reason"];
+  if (reason !== undefined && typeof reason !== "string") {
+    return { kind: "error", problem: "invalid-reason" };
+  }
+  if (rec["project"] !== project) {
+    // A record persisted at this project's path but naming another project is
+    // either a copy or a rename mishap; it fences nobody (that project's drain
+    // lives at its own path).
+    return { kind: "inactive" };
+  }
+  if (Date.parse(rec["expiresAt"] as string) <= now) {
+    return { kind: "inactive" };
+  }
+  const drain: DrainRecord = {
+    project: rec["project"],
+    createdAt: rec["createdAt"],
+    expiresAt: rec["expiresAt"],
+    ...(reason === undefined ? {} : { reason }),
+  };
+  return { kind: "active", drain };
+}
+
+/**
+ * The dispatch-side drain read: the same verdict as {@link readDrain}, and the
+ * one place a stale or untrustworthy record is cleared as a side effect —
+ * expired and wrong-project records are removed (bounded stale-state cleanup
+ * on the next pass), and a malformed record is removed in the very transition
+ * that fails the pass closed, so it can never become an unbounded permanent
+ * drain. Only dispatch callers use this: an observational read here would let
+ * a status/health reader consume the malformed marker before the pass that
+ * must fail closed on it ever ran.
+ */
+export function consumeDrain(project: string, now = Date.now()): DrainVerdict {
+  const verdict = readDrain(project, now);
+  if (verdict.kind !== "active") {
+    rmSync(drainPath(project), { force: true });
+  }
+  return verdict;
+}
+
+/** Removes this project's drain, idempotently — a second cancel is a no-op. */
+export function cancelDrain(project: string): void {
+  rmSync(drainPath(project), { force: true });
+}
+
 // ----------------------------------------------------------------- admission
 // acknowledgement (#651, review #3)
 //
@@ -1023,6 +1241,22 @@ function laneBlock(lane: FileLane | undefined): string {
   return ["## File lane (as parsed)", "", body, "", ""].join("\n");
 }
 
+/**
+ * The declared model as a brief section (#535): the selector the dispatch
+ * will launch on — the same parse admission carried, never a second read —
+ * or the explicit fail-open note, so the worker reads the run's model on the
+ * brief itself rather than inferring it. Deliberately only the selector,
+ * never the source line: the declaration's prose already renders in the body
+ * or Discussion.
+ */
+function modelBlock(model: EffectiveModel | undefined): string {
+  const body =
+    model === undefined
+      ? "_no model declared — the project's workerModel (or harness default) is in effect_"
+      : `\`${model.model}\``;
+  return ["## Model (as parsed)", "", body, "", ""].join("\n");
+}
+
 /**
  * What an orphan-resumed worker is told about the file lane on top of the
  * continuation notice (#608). The original brief already in the transcript
@@ -1100,6 +1334,22 @@ export async function buildBrief(
      * resolved from the rendered thread itself.
      */
     lane?: FileLane;
+    /**
+     * The effective `Model:` declaration admission resolved for this
+     * candidate (#535). When carried, the brief echoes exactly this
+     * selector — the same value dispatch launches on — instead of
+     * recomputing from the dispatch-time comment read, so the run's model is
+     * one value on every surface. Absent (unit-level callers), the model is
+     * resolved from the rendered thread itself.
+     */
+    model?: EffectiveModel;
+    /**
+     * The typed host-constraints block the brief renders (#721), re-read with
+     * the config at the tick boundary so an operator edit applies on the next
+     * dispatch. Absent renders no host-constraints section at all — the
+     * brief is byte-for-byte what it always was.
+     */
+    host?: HostConstraints;
   } = {},
 ): Promise<string> {
   // Read per dispatch rather than caching: editing the brief then takes effect
@@ -1149,6 +1399,11 @@ export async function buildBrief(
   // itself. Both the discussion renderer and the parsed-lane section draw on
   // the same value, so the brief shows one lane on every surface (#608, #724).
   const lane = opts.lane ?? (comments === "unread" ? undefined : effectiveLane(r.issue.body, comments));
+  // The effective model declaration admission resolved (or resolves) for this
+  // candidate: the carried admission snapshot when dispatch has one, else the
+  // thread itself. Dispatch launches on the same value, so the brief shows
+  // one model on every surface (#535).
+  const model = opts.model ?? (comments === "unread" ? undefined : effectiveModel(r.issue.body, comments));
   return renderBrief(template, {
     ISSUE_NUMBER: String(r.issue.number),
     ISSUE_TITLE: r.issue.title,
@@ -1159,12 +1414,18 @@ export async function buildBrief(
     ACCEPTANCE_CRITERIA: acceptanceCriteria(r.issue),
     ISSUE_COMMENTS: renderDiscussion(comments, lane),
     FILE_LANE: laneBlock(lane),
+    MODEL: modelBlock(model),
     GATES: gatesBlock(r.repo),
     // The guarded shell suites and their sanctioned parse-only check, derived
     // from SHARED_HOST_SCRIPTS so the brief and the refusal share one list
     // (#687). Non-empty whenever the guard has paths, so the placeholder line
     // always renders to a line.
     SHARED_HOST_NOTICE: sharedHostBriefNotice(),
+    // The typed host-constraints paragraph (#721): derived cores/RAM folded
+    // into the operator's description, the non-interactive PATH, and the
+    // routed repo's convention. Empty when the config names none — no
+    // section, no placeholder text.
+    HOST_CONSTRAINTS: hostConstraintsNotice(opts.host, repoSlug(r.repo)),
     // The brief's code-graph paragraph: the exact `project` key for a
     // configured repo, or an explicit "no graph" statement for an
     // unconfigured one — never silence, because a worker that knows there is
@@ -1359,17 +1620,147 @@ export function createWorkerControlRegistry(): WorkerControlRegistry {
   };
 }
 
+/**
+ * The daemon half of a worker's `pushed-green` claim (#85's contact with
+ * reality; #782's publication attribution).
+ *
+ * A yield is a transport, not proof of GitHub side effects: `claim` is
+ * caller-supplied text and the worker adapter turns it into a green result
+ * without the daemon ever having seen a mediated publication verb for it — the
+ * shape that let the #777 incident guess a non-existent PR. The tracker read
+ * at the end proves the PR is open and green at the exact head; the evidence
+ * gate here proves that PR is *this run's own mediated work* first.
+ *
+ * Two things are asked, in cost order:
+ *
+ *  - the claimed URL must equal the one this run's row records, which is never
+ *    a worker-supplied string at the moment a live run is verified —
+ *    conductor_pr_create (create or adoption) writes it on the run, the daemon
+ *    seeds it at claim from a terminal predecessor on the same branch (#434),
+ *    and orchestrator-only recovery writes it for settled runs;
+ *  - and the claimed head must have a mediated publisher: an allowed
+ *    `conductor_push` on this exact run that published it on this run's branch
+ *    (the verb only ever pushes `refs/heads/<branch>`), an allowed
+ *    `conductor_pr_create` on this run for this exact PR, or — for a run that
+ *    published nothing new — the live tip of this run's own branch.
+ *
+ * That last path is the one the row cannot supply. It used to be served by
+ * comparing the claim against `run.prUrl`/`run.headSha`, and both are
+ * worker-tainted upstream: terminal settlement writes a worker's reported pair
+ * onto the row *before* any verification, and continuation inheritance
+ * validates only the predecessor's metadata and open state — so a turn-capped
+ * attempt that reported someone else's real green PR had that pair inherited
+ * and re-presented as its own evidence. Asking the tracker for the branch tip
+ * removes the worker from the loop entirely: `refs/heads/<branch>` is a ref
+ * only a mediated `conductor_push` or a mediated `conductor_pr_update_branch`
+ * can move, so its live commit is daemon provenance no reported string can
+ * forge. It is also why a legitimate mediated base-branch update now passes:
+ * that server-side merge creates a head no `conductor_push` ever published and
+ * the row still carries the older one, which the recorded-pair test rejected.
+ *
+ * Binding to the *exact current run* is what makes an old attempt, a different
+ * branch, or #806's orchestrator-only settled-run recovery invisible here: the
+ * ledger query is run-scoped by `runId`, and recoveries store no runId at all.
+ * That query asks for the run's complete history rather than the ledger's
+ * newest rows — publication evidence sits at the *start* of a run, and a
+ * review-revision round or a burst of refused mutations pushed it past the
+ * default page, turning a verified push into a definitive false failure.
+ *
+ * A claim that fails this gate is a definitive failure — never a retryable
+ * `pushed-pending` — because a guessed URL is not something a later tick is
+ * waiting on. A claim the gate could not *read* is the opposite: an unreadable
+ * branch tip is #781's transient outage, so it stays retryable rather than
+ * burning an attempt on a flaky read.
+ */
 export async function verifyPushedGreenClaim(
-  tracker: Pick<Tracker, "verifyPr">,
+  tracker: Pick<Tracker, "verifyPr" | "branchHead">,
   claim: Pick<WorkerResult, "prUrl" | "headSha">,
+  publication: {
+    project: string;
+    issue: number;
+    runId: string;
+    /** The branch conductor routed this run onto. `conductor_push` publishes
+     *  exactly `refs/heads/<branch>` and refuses any other ref. */
+    branch: string;
+    /** The identity `tracker.branchHead` reads the live tip with: the
+     *  canonical `owner/repo` when the routed clone URL carries one, else the
+     *  routed repository name. A tracker that cannot resolve it answers
+     *  undefined, which stays retryable rather than definitive. */
+    repo: string;
+    store: Pick<Store, "verbLedger" | "getRun">;
+  },
 ): Promise<{
   state: "pushed-green" | "pushed-pending" | "failed";
   reason?: string;
 }> {
-  if (claim.prUrl === undefined || claim.headSha === undefined) {
+  const { prUrl, headSha } = claim;
+  if (prUrl === undefined || headSha === undefined) {
     return { state: "failed", reason: "Worker did not report a PR URL and observed head SHA" };
   }
-  const verification = await tracker.verifyPr(claim.prUrl, claim.headSha);
+  // Exact current run, never "some publication for the issue": the query is
+  // scoped to this runId plus project/issue, so a previous attempt's verbs and
+  // the orchestrator's recovery verbs are invisible here. Unbounded on
+  // purpose — see the note above about evidence ageing off the newest page.
+  const ledger = publication.store.verbLedger(publication.project, {
+    runId: publication.runId,
+    issue: publication.issue,
+    limit: Number.MAX_SAFE_INTEGER,
+  });
+  const run = publication.store.getRun(publication.runId);
+  const branchRef = `refs/heads/${publication.branch}`;
+  if (run?.prUrl !== prUrl) {
+    return {
+      state: "failed",
+      reason:
+        "Pushed-green claim has no mediated publication evidence: the claimed PR is not this run's " +
+        "recorded PR",
+    };
+  }
+  const pushedThisHead = ledger.some(
+    (entry) =>
+      entry.decision === "allowed" &&
+      entry.verb === "conductor_push" &&
+      entry.sha === headSha &&
+      entry.detail.includes(branchRef),
+  );
+  // Bound to the claimed PR, not merely to "a create happened": both allowed
+  // details name the URL they produced (`opened <url> …`, `adopted <url> …`),
+  // so an unrelated create on this run cannot vouch for another PR.
+  const createdHere = ledger.some(
+    (entry) =>
+      entry.decision === "allowed" &&
+      entry.verb === "conductor_pr_create" &&
+      entry.detail.includes(prUrl),
+  );
+
+  if (!pushedThisHead && !createdHere) {
+    // Nothing this run published carries the claimed head, so the only
+    // remaining evidence is the branch itself: a continuation or review round
+    // that pushed nothing, or a head a mediated base-branch update produced.
+    let tip: string | undefined;
+    try {
+      tip = await tracker.branchHead(publication.repo, publication.branch);
+    } catch {
+      tip = undefined;
+    }
+    if (tip === undefined) {
+      return {
+        state: "pushed-pending",
+        reason: `Live head of ${branchRef} unavailable; retrying`,
+      };
+    }
+    if (tip !== headSha) {
+      return {
+        state: "failed",
+        reason:
+          "Pushed-green claim has no mediated publication evidence: this run's conductor_push / " +
+          `conductor_pr_create ledger does not cover the claimed head, and ${branchRef} is at ${tip}, ` +
+          "not the claimed head",
+      };
+    }
+  }
+
+  const verification = await tracker.verifyPr(prUrl, headSha);
   if (verification === undefined) {
     return { state: "pushed-pending", reason: "GitHub PR verification unavailable; retrying" };
   }
@@ -1528,6 +1919,7 @@ export async function handleIssue(
   r: Routed,
   attempt: number,
   admittedLane?: FileLane,
+  admittedModel?: EffectiveModel,
 ): Promise<void> {
   const { project, caps, tracker, store } = d;
   const issue = r.issue.number;
@@ -1689,6 +2081,24 @@ export async function handleIssue(
       return;
     }
 
+    // The claim-side of the project drain fence (#484): the tick's gate sits
+    // above routing, so a drain created after that gate can still land
+    // mid-pass — the claim re-checks and refuses while a fresh drain is in
+    // force. An invalid record fails closed the same way. The read here is
+    // observational on purpose: the claim refuses but must not consume the
+    // marker, or the first refused claim would unbind the rest of its own
+    // pass; the tick's consumeDrain removes it on the next pass, so no claim
+    // path can ever be blocked permanently by it.
+    const claimDrain = readDrain(d.project.name);
+    if (claimDrain.kind === "active" || claimDrain.kind === "error") {
+      log(
+        claimDrain.kind === "error"
+          ? `#${issue} not claimed: drain record invalid (${claimDrain.problem})`
+          : `#${issue} not claimed: project drain in effect`,
+      );
+      return;
+    }
+
     // Claim on the STORE first, before anything that can fail. The run row —
     // not the label — is the crash-safe guard against double dispatch: rows
     // are local, written before any network call, and the startup orphan
@@ -1716,13 +2126,21 @@ export async function handleIssue(
     // unconfigured project — and today's dispatch is byte for byte what it
     // has always been.
     const chainConfigured = (project.modelFallbacks?.length ?? 0) > 0;
+    // A `Model:` declaration admission resolved for this candidate (#535) is
+    // this issue's workerModel: the orchestrator names a tier when it
+    // promotes, and dispatch launches on that selector exactly as if the
+    // project's `workerModel` were the declared value. Absent a declaration,
+    // today's `project.workerModel` is unchanged, and the failover chain
+    // (#286) keeps its semantics in both cases — it is the same resolution,
+    // one different primary.
+    const declaredModel = admittedModel?.model;
     const choice = resolveDispatchModel({
-      workerModel: project.workerModel,
+      workerModel: declaredModel ?? project.workerModel,
       modelFallbacks: project.modelFallbacks,
       threshold: project.modelFallbackThreshold ?? DEFAULT_MODEL_FALLBACK_THRESHOLD,
       streak: chainFacts.streak,
     });
-    const clause = fallbackClause(choice, chainFacts, project.workerModel);
+    const clause = fallbackClause(choice, chainFacts, declaredModel ?? project.workerModel);
 
     // #536: an orphan-clean requeue resumes the interrupted session instead of
     // re-reading the repo from zero. Decided here, before this attempt's row
@@ -1768,6 +2186,13 @@ export async function handleIssue(
       // above fired. `undefined` for a fresh dispatch — the store maps that to
       // NULL, so a fresh row simply never carries the field.
       resumedFromRunId: resuming?.id,
+      // #744: the file-lane declaration admission resolved for this candidate
+      // is persisted on the row, so lane occupancy survives across dispatch
+      // passes — a later pass knows what this run *intends* to touch, not only
+      // what it has touched so far. This is the exact `Admission.lane` the gate
+      // enforced and the brief rendered, never a re-parse. Absent for a run
+      // with no declaration (fail open), exactly as it was admitted.
+      lane: admittedLane,
     });
     // #434: carry a terminal predecessor's open PR onto the continuation row.
     // The claim itself stays synchronous — `handleIssue` claims at the top of
@@ -1806,6 +2231,7 @@ export async function handleIssue(
     if (await settleStopBeforeSession()) return;
     if (await settleDrainBeforeSession()) return;
 
+
     // A run's tree is <workspaceRoot>/<issue> and addRunRepo refuses to reuse
     // an existing path, so a retry — or a tree kept from a failed attempt — has
     // to be cleared first. Both helpers are pure path math, and removeWorktree
@@ -1886,7 +2312,9 @@ export async function handleIssue(
         runRepoPath: worktreePath,
         branch,
       },
-      { ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }) },
+      {
+        ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }),
+      },
     );
     if (await settleStopBeforeSession()) return;
     if (await settleDrainBeforeSession()) return;
@@ -1943,6 +2371,8 @@ export async function handleIssue(
           : {}),
         comments,
         lane: admittedLane,
+        model: admittedModel,
+        host: d.host,
       });
     }
     if (await settleStopBeforeSession()) return;
@@ -1950,6 +2380,7 @@ export async function handleIssue(
 
     const repoSlug = githubRepo(r.repo.cloneUrl);
 
+
     let result: WorkerResult;
     try {
       result = await runWorker({
@@ -2036,7 +2467,14 @@ export async function handleIssue(
 
     const verified: { state: RunState; reason?: string } =
       result.state === "pushed-green"
-        ? await verifyPushedGreenClaim(tracker, result)
+        ? await verifyPushedGreenClaim(tracker, result, {
+            project: project.name,
+            issue,
+            runId,
+            branch,
+            repo: repoSlug ?? r.repo.name,
+            store,
+          })
         : { state: result.state };
     const state = verified.state;
 
@@ -2061,6 +2499,12 @@ export async function handleIssue(
             // The claimed-proof check compares the PR's Verified commands
             // against what this run's session actually recorded.
             sessionFile: result.sessionFile,
+            // The effective file lane admission resolved for this run at
+            // dispatch — the same value the brief rendered, pre-dispatch
+            // comment declarations included (#608, #744). The audit flags a
+            // diff that escapes it, so a widened lane is named on evidence
+            // rather than found by reading the PR's file list by hand (#739).
+            lane: admittedLane,
           })
         : undefined;
     if (result.state === "pushed-green" && audit?.truncated) {
@@ -2170,6 +2614,10 @@ export async function handleIssue(
       ...(result.prUrl === undefined ? {} : { prUrl: result.prUrl }),
       ...(result.headSha === undefined ? {} : { headSha: result.headSha }),
       sessionFile: result.sessionFile,
+      // The code-graph session observation (#726): what the run's own session
+      // registry held at start, persisted with the rest of the run's facts.
+      // Absent only when the session surface did not record one.
+      ...(result.graphTools === undefined ? {} : { graphTools: result.graphTools }),
       // Every terminal state persists the worker's report — with the `changed:`
       // file list derived from the PR's diff where one could be read — not
       // just a green push: a stopped attempt's partial report is still part of
@@ -2441,6 +2889,91 @@ export async function dispatchReviewRevisions(d: Deps, pool?: WorkerPool): Promi
       );
       break;
     }
+    // A capped/failed run has no pushed-green settle sweep keeping its row
+    // honest (#795 review round 1): nothing transitions a `failed` / `killed`
+    // row when its PR merges or closes, so a PR that changed after the verb
+    // recorded the round would otherwise be claimed and a worker resumed
+    // against a dead PR. The settled-green origin keeps its own interlock
+    // (the settle sweep flips the row and the claim below refuses it), so
+    // only terminal-origin rounds re-read the reviewed PR fact here: the
+    // round dispatches only while the PR is still open at the exact reviewed
+    // head.
+    //
+    // The skip decision is decisive-fact only (review round 2): a definitively
+    // missing PR (`GhPrMissingError` — a corroborated 404, #779), a PR that
+    // is definitively not open, and a head that has definitively MOVED are
+    // settled skipped, exactly like any other row that moved. Everything
+    // transient or unreadable — a bare 404 that could not be corroborated, an
+    // undefined answer, a pending check run, a same-head red check that a
+    // rerun may clear, a throwing tracker — stays PENDING for the next tick:
+    // settling it would permanently discard the orchestrator's findings and
+    // consume the round.
+    const origin = d.store.getRun(revision.runId)?.state;
+    if (origin === "failed" || origin === "killed") {
+      let prState: PrState | undefined;
+      try {
+        prState = await d.tracker.prState(revision.prUrl);
+      } catch (err) {
+        if (err instanceof GhPrMissingError) {
+          d.store.settleReviewRevision(revision.id, "skipped", Date.now());
+          log(
+            `#${revision.issue} review round ${revision.round} skipped: ${revision.prUrl} does not exist — the reviewed PR is gone`,
+          );
+          continue;
+        }
+        log(
+          `#${revision.issue} review round ${revision.round} held: PR state re-check failed (${errText(err)}) — retrying next tick`,
+        );
+        continue;
+      }
+      if (prState === undefined) {
+        log(
+          `#${revision.issue} review round ${revision.round} held: ${revision.prUrl} state could not be re-read — retrying next tick`,
+        );
+        continue;
+      }
+      if (prState !== "open") {
+        d.store.settleReviewRevision(revision.id, "skipped", Date.now());
+        log(
+          `#${revision.issue} review round ${revision.round} skipped: ${revision.prUrl} is ${prState}, not open — a review round resumes an open PR only`,
+        );
+        continue;
+      }
+      let verification: PrVerification | undefined;
+      try {
+        verification = await d.tracker.verifyPr(revision.prUrl, revision.headSha);
+      } catch (err) {
+        log(
+          `#${revision.issue} review round ${revision.round} held: the reviewed-head check failed (${errText(err)}) — retrying next tick`,
+        );
+        continue;
+      }
+      if (verification === undefined || verification.status === "pending") {
+        log(
+          `#${revision.issue} review round ${revision.round} held: ${revision.prUrl} at ${revision.headSha} is ` +
+            `${verification?.status ?? "unverifiable"} — retrying next tick`,
+        );
+        continue;
+      }
+      if (verification.status === "failed" && isHeadMismatch(verification.reason)) {
+        d.store.settleReviewRevision(revision.id, "skipped", Date.now());
+        log(
+          `#${revision.issue} review round ${revision.round} skipped: ${revision.prUrl} no longer stands at ` +
+            `${revision.headSha} (${verification.reason}) — the reviewed head moved`,
+        );
+        continue;
+      }
+      // Anything else — a same-head red check a rerun may clear, an unknown
+      // verdict — is not definitive: the round stays pending for the next
+      // tick rather than discarding the findings.
+      if (verification.status !== "green") {
+        log(
+          `#${revision.issue} review round ${revision.round} held: ${revision.prUrl} at ${revision.headSha} is ` +
+            `${verification.status} — retrying next tick`,
+        );
+        continue;
+      }
+    }
     if (!d.store.claimRunForReview(revision.runId)) {
       d.store.settleReviewRevision(revision.id, "skipped", Date.now());
       log(
@@ -2601,18 +3134,77 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
   // and shutdown fences cover the whole wake window, exactly as they do for a
   // fresh claim in `handleIssue` (#374). The original run's entries were
   // closed at its settle, so reopening by issue is safe.
+  //
+  // #747: the round gets its own bounded allowance instead of the original
+  // attempt's remainder. The resumed session continues the run's own counter
+  // — the attempt's spent turns travel with the session — so a ceiling of
+  // `run.maxTurns` would leave the round only `run.maxTurns - run.turns`,
+  // and returning a PR from a near-cap run could not finish. Open at the
+  // run's ceiling, then raise it by the round's own allowance — the run's
+  // ceiling again, capped by the project's hard ceiling — through the same
+  // override path `omp-conductor extend` uses, so the raise is persisted on
+  // the row (the run's budget stays explainable in status) while `turns`
+  // keeps accumulating the run's true cost: nothing is reset.
   turnLimit = d.turnLimits.open(project.name, issue, runId, run.maxTurns);
+  const revisionAllowance = Math.min(run.maxTurns, caps.workerMaxTurnsCeiling);
+  const revisionCeiling = run.turns + revisionAllowance;
+  const revisionRaise = d.turnLimits.extend(project.name, issue, revisionCeiling);
+  if (revisionRaise.kind === "extended") {
+    log(
+      `#${issue} review round ${revision.round} turn ceiling ${run.maxTurns} → ${revisionCeiling} ` +
+        `(+${revisionAllowance} round allowance on ${run.turns} spent)`,
+    );
+  }
   workerControl = d.workerControls.open(project.name, issue, runId);
   if (await settleStopBeforeSession()) return;
   if (await settleDrainBeforeSession()) return;
 
   try {
     // Reattach the run's own branch at the same per-issue path the run used:
-    // the worktree was removed at the pushed-green settle and the branch was
-    // published, so provisioning is the same continuation reattach as a
-    // normal re-claim. A provisioning failure restores the row — the PR is
-    // still green and still open, and only the wake failed — and says so.
+    // a `pushed-green` settle removed the worktree, so provisioning is the
+    // same continuation reattach as a normal re-claim. A capped/failed run's
+    // tree was RETAINED at its terminal settle (`tree: "keep"`, #795) — the
+    // reviewed PR is green, so the branch already holds the work and the kept
+    // tree holds nothing the branch does not, unless its salvage failed. Clear
+    // it the way restart recovery does (#692): re-attempt the salvage through
+    // `tree: "remove"`, and refuse the removal if that still fails — the tree
+    // is then the only copy of work and is never destroyed. A provisioning
+    // failure restores the row — the PR is still green and still open, and
+    // only the wake failed — and says so.
     try {
+      if (run.worktree !== "" && existsSync(run.worktree)) {
+        const keptSettlement = await settleWorktree({
+          issue: run.issue,
+          attempt: run.attempt,
+          ending: `review round ${revision.round} resume`,
+          worktree: run.worktree,
+          branch: run.branch,
+          publish: (branch) => pushRunBranch(project, { repo, runRepoPath: run.worktree, branch }),
+          tree: "remove",
+          mirrorPath,
+        });
+        if (keptSettlement.retained) {
+          log(
+            `#${issue} review round ${revision.round} retained worktree ${run.worktree}: ` +
+              "its salvage failed, so the tree is the only copy of work and will not be removed",
+          );
+          store.updateRun(runId, {
+            state: "pushed-green",
+            endedAt: Date.now(),
+            lastError: `review round ${revision.round} could not clear the run's retained worktree: ${keptSettlement.lines.join(" ")}`,
+          });
+          store.settleReviewRevision(revision.id, "skipped", Date.now());
+          await safeEscalate(d, {
+            tier: 1,
+            project: project.name,
+            issue,
+            runId,
+            summary: `#${issue} review round ${revision.round} could not be dispatched — the run's retained worktree is the only copy of work`,
+            detail: [revision.prUrl, "", ...keptSettlement.lines].join("\n"),
+          });
+          return;
+        }
+      }
       const provisioned = await addRunRepo(repo, project.mirrorRoot, project.workspaceRoot, issue, branch);
       worktreePath = provisioned.path;
       runRepo = { repo, runRepoPath: worktreePath, branch };
@@ -2680,7 +3272,9 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
         runRepoPath: worktreePath,
         branch,
       },
-      { ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }) },
+      {
+        ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }),
+      },
     );
     if (await settleStopBeforeSession()) return;
     if (await settleDrainBeforeSession()) return;
@@ -2695,6 +3289,7 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
 
     log(`#${issue} review round ${revision.round} → resuming ${branch} (${priorSessionFile})`);
 
+
     let result: WorkerResult;
     try {
       result = await runWorker({
@@ -2754,7 +3349,14 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
 
     const verified: { state: RunState; reason?: string } =
       result.state === "pushed-green"
-        ? await verifyPushedGreenClaim(tracker, result)
+        ? await verifyPushedGreenClaim(tracker, result, {
+            project: project.name,
+            issue,
+            runId,
+            branch,
+            repo: repoSlug ?? repo.name,
+            store,
+          })
         : { state: result.state };
     const state = verified.state;
 
@@ -2813,6 +3415,7 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
       ...(result.prUrl === undefined ? {} : { prUrl: result.prUrl }),
       ...(result.headSha === undefined ? {} : { headSha: result.headSha }),
       sessionFile: result.sessionFile,
+      ...(result.graphTools === undefined ? {} : { graphTools: result.graphTools }),
       report: finalReport,
       ...settlement?.patch,
     };
@@ -3021,8 +3624,12 @@ export async function reconcileCrashedReviewRevisions(d: Deps): Promise<ReviewRe
     }
     // A revision the previous daemon never claimed: the run is still a
     // settled green row and the round is still pending, so the ordinary
-    // dispatch pass wakes it on the next tick untouched.
-    if (run.state === "pushed-green") continue;
+    // dispatch pass wakes it on the next tick untouched. Same for a
+    // capped/failed run whose review round is pending (#795): a `failed` /
+    // `killed` row is terminal too — no process died on this round, the
+    // revision was never claimed, and the ordinary dispatch pass claims it
+    // exactly like a pending round on a pushed-green row.
+    if (run.state === "pushed-green" || run.state === "failed" || run.state === "killed") continue;
     // The run a previous daemon claimed for this round and died on: the
     // orphan sweep just marked it `orphaned` (salvaging the tree to the
     // branch), so restore it to the reviewable state the verb recorded.
@@ -3609,6 +4216,7 @@ export function summarizeDispatch(
   holds: readonly AdmissionHold[],
   completedAt = Date.now(),
   settled = 0,
+  parked = 0,
 ): DispatchSummary {
   const groups = new Map<AdmissionHoldReason, { count: number; issues: number[]; details: string[] }>();
   for (const hold of holds) {
@@ -3638,6 +4246,10 @@ export function summarizeDispatch(
         ...(group.details.length === 0 ? {} : { details: group.details }),
       })),
     settled,
+    // Omitted at zero so a pass with nothing parked keeps the pre-#507 record
+    // shape byte for byte — old persisted rows lack the key and readers use
+    // `?? 0` either way.
+    ...(parked === 0 ? {} : { parked }),
   };
 }
 
@@ -3770,6 +4382,13 @@ export function upgradeVerifyDepsFor(d: Pick<Deps, "project" | "store">): Upgrad
       );
       return launched.ok === true ? { ok: true, unit: launched.unit } : { ok: false, stderr: launched.stderr };
     },
+    herdrSession: resolveHerdrSession(process.env),
+    // The durable pane probe for the post-restart verifier (#832): every omp
+    // process the fleet pane currently claims by herdr, resolved to its start
+    // time — the evidence an external (pane-owned) orchestrator actually
+    // restarted after the install began, through the same shared probe as the
+    // in-process upgrade.
+    probePaneOmp: (session) => herdrPaneOmpStarts(runCommand, session, processStartTimeMs),
     log,
     now: () => Date.now(),
   };
@@ -3870,6 +4489,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     }
     d.project = fresh;
     d.caps = freshCaps;
+    d.host = cfg.host;
     d.deliveryPolicyValid = true;
   } catch (err) {
     log(`config reload failed (${errText(err)}) — retaining boot values but blocking autonomous delivery`);
@@ -4030,6 +4650,37 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
       log(`decision condition pass failed: ${errText(err)}`);
     });
 
+  // A spend-cap pause is self-expiring (#780). The spend gate below persists a
+  // pause once today's spend reaches the cap, but once that latch is on disk
+  // every later pass returns at the pause gate and never reaches the spend
+  // check again — so the fleet stayed stopped after the rolling window reset
+  // until an operator ran `resume`. The same measurement that closed the gate
+  // reopens it: clear a per-project spend-cap pause when the current
+  // rolling-window spend is below the cap (or no cap is configured at all —
+  // the gate that justified the pause is gone). Two guards keep the clear from
+  // ever overriding another stop: only the exact instance that was read is
+  // removed (a hold that replaced the sentinel meanwhile is untouched, review
+  // #780), and only the per-project sentinel is ever considered — the legacy
+  // global sentinel, which may carry an operator/integrity/setup hold, is
+  // never removed, so the pause gate below still observes it.
+  const spendPausePath = pausedPath(d.project.name);
+  const spendPause = pauseInstanceAt(spendPausePath);
+  if (spendPause?.source === "spend-cap") {
+    const spent = d.store.spendSince(d.project.name, startOfToday());
+    if (
+      (d.caps.dailySpendUsd === null || spent < d.caps.dailySpendUsd) &&
+      clearPauseIfUnchanged(spendPausePath, spendPause)
+    ) {
+      log(
+        `spend-cap pause cleared: $${spent.toFixed(2)} ` +
+          (d.caps.dailySpendUsd === null
+            ? "(no daily cap configured)"
+            : `below the $${d.caps.dailySpendUsd.toFixed(2)} daily cap`) +
+          " — dispatch resumes",
+      );
+    }
+  }
+
   // A paused fleet claims nothing. Checked first so pausing takes effect on the
   // next tick without signalling the process. But the pass still ran, and the
   // operator has to be able to see it: record it as a held pass — the work the
@@ -4050,6 +4701,37 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     return;
   }
 
+  // The project drain is the self-expiring sibling of the pause fence (#484):
+  // the same admission boundary — settlement above it, nothing claimed below —
+  // but the intent is durable (it survives orchestrator loss) and bounded (the
+  // record carries an absolute deadline, so a crash can never strand
+  // admission). Three shapes, three behaviours:
+  //   - fresh drain with live runs → a held pass, exactly like a pause;
+  //   - fresh drain with nothing left to wait for → the drain is satisfied
+  //     and clears itself, so a completed drain never needs a second operator
+  //     action and this pass proceeds normally;
+  //   - malformed record → fails closed for THIS pass (it might be a fresh
+  //     fence we cannot read), and the same consume removed it, so it can
+  //     never become an unbounded permanent drain.
+  const drain = consumeDrain(d.project.name);
+  if (drain.kind === "active") {
+    // Completion is the ACTIVE set, not the live-worker set: pushed-pending
+    // and pushed-green PRs still make the `runs-settled` release gate fail, so
+    // a drain that cleared while one remained would admit work on top of a
+    // batch the releases still see as unfinished (#776 review #2).
+    if (d.store.activeRuns(d.project.name).length === 0) {
+      cancelDrain(d.project.name);
+      log("project drain completed: no active runs remain — drain cleared");
+    } else {
+      d.store.recordDispatch(d.project.name, summarizeHeldPass(settled));
+      return;
+    }
+  } else if (drain.kind === "error") {
+    log(`project drain record invalid (${drain.problem}) — removed; this pass admits nothing`);
+    d.store.recordDispatch(d.project.name, summarizeHeldPass(settled));
+    return;
+  }
+
   const { project, caps, store } = d;
 
   // "Nobody patches the running conductor" is a hard boundary in both briefs —
@@ -4154,12 +4836,28 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   const dropped = effective.filter(
     (issue) => !isEligible(issue, project) && issue.labels.some((l) => stateLabels.has(l)),
   );
+  // The operator's park label is not a stale lifecycle label: the queue query
+  // still returns a parked-and-queued issue, route() drops it as ineligible,
+  // and the claim gate holds it as `issue-parked` when the park lands mid-pass
+  // (#734). Counting it as stale-lifecycle below would summon the orchestrator
+  // to reconcile a deliberate decision. Parked is its own population, derived
+  // from the same isEligible read the gate uses, so the number status renders
+  // cannot disagree with what admission would hold (#507).
+  const parkedCandidates = effective.filter(
+    (issue) => !isEligible(issue, project) && issue.labels.includes(project.stateLabels.backlog),
+  );
+  const parkedNumbers = new Set(parkedCandidates.map((issue) => issue.number));
   let claimed = 0;
+  let parked = 0;
   const lifecycleHolds: AdmissionHold[] = [];
   for (const issue of dropped) {
     const newest = store.latestRun(project.name, issue.number);
     if (newest !== undefined && ACTIVE_STATES.includes(newest.state)) {
       claimed += 1;
+    } else if (parkedNumbers.has(issue.number)) {
+      // A park never kills a live run; a parked issue with no run is inventory
+      // the operator is deliberately holding, not reconciliation work.
+      parked += 1;
     } else {
       lifecycleHolds.push({ issue: issue.number, reason: "stale-lifecycle" });
     }
@@ -4173,7 +4871,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   const recordDispatch = (admitted: number, holds: readonly AdmissionHold[]): void => {
     store.recordDispatch(
       project.name,
-      summarizeDispatch(ready.length, routed.length, claimed, admitted, holds, Date.now(), settled),
+      summarizeDispatch(ready.length, routed.length, claimed, admitted, holds, Date.now(), settled, parked),
     );
   };
 
@@ -4218,7 +4916,8 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
       summary: `Daily spend cap reached on ${new Date().toISOString().slice(0, 10)} — ${project.name} is paused`,
       detail: [
         `Spent $${spent.toFixed(2)} of the $${caps.dailySpendUsd.toFixed(2)} daily cap.`,
-        "No further work will be claimed until `omp-conductor resume`.",
+        "Dispatch stays paused until today's spend falls below the cap, then resumes",
+        "automatically on the next pass — `omp-conductor resume` only speeds that up.",
       ].join("\n"),
     });
     recordDispatch(0, [
@@ -4266,7 +4965,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   log(`dispatching ${pass.admitted.map((a) => `#${a.r.issue.number}`).join(" ")}`);
   await dispatchAdmissions(
     pass.admitted,
-    (a) => handleIssue(d, a.r, a.attempt, a.lane),
+    (a) => handleIssue(d, a.r, a.attempt, a.lane, a.model),
     workers,
   );
 
@@ -4294,6 +4993,23 @@ export interface DaemonHealthSnapshot {
   codeGraph?: CodeGraphHealth;
   /** Live workers in a non-running pause phase; absent/empty = nothing paused. */
   workers?: { issue: number; runId: string; phase: WorkerPausePhase }[];
+  /**
+   * The live orchestrator surface, attested by the running daemon (#832):
+   * which mode this project's fleet is in, and — when the daemon hosts the
+   * orchestrator session itself — the extension version that session *loaded*
+   * and the transcript it resumed. This is the read the upgrade's
+   * session-reload verification checks: a restarted daemon whose orchestrator
+   * child came up on the installed release answers `loaded` equal to that
+   * release; one that never reloaded answers an older version; one that
+   * failed to start answers `mode: "failed"`. `external` means the pane owns
+   * the session and the daemon cannot attest it from here.
+   */
+  orchestrator?: {
+    mode: "embedded" | "external" | "failed";
+    loaded?: string;
+    sessionFile?: string;
+    alive?: boolean;
+  };
 }
 
 export interface DaemonHealth {
@@ -4309,6 +5025,7 @@ export function daemonHealthSnapshot(
   paused = isPaused(project),
   codeGraph?: CodeGraphHealth,
   workerControls?: WorkerControlRegistry,
+  orchestrator?: DaemonHealthSnapshot["orchestrator"],
 ): DaemonHealthSnapshot {
   const dispatch = store.latestDispatch(project);
   return {
@@ -4320,6 +5037,7 @@ export function daemonHealthSnapshot(
     ...(dispatch === undefined ? {} : { dispatch }),
     ...(codeGraph?.configured === true ? { codeGraph } : {}),
     ...(workerControls === undefined ? {} : { workers: workerControls.snapshot(project) }),
+    ...(orchestrator === undefined ? {} : { orchestrator }),
   };
 }
 
@@ -4637,6 +5355,55 @@ export async function daemonHttpResponse(req: Request, d: DaemonHttpDeps): Promi
   return workerControl ?? new Response("not found\n", { status: 404 });
 }
 
+/**
+ * The effective reporting surface, derived from the configured policy — never
+ * from the legacy preset name alone: an explicit policy without the
+ * `scopePreset` back-annotation must present the same truth from `interruptOn`
+ * and the digest cadence (#633).
+ */
+export interface ReportingSummary {
+  /** The legacy preset this policy came from, when the config back-annotates one. */
+  scopePreset?: ReportScope;
+  /** Categories allowed to interrupt the operator's phone. */
+  interruptOn: InterruptCategory[];
+  /** Where non-interrupting outcomes accumulate: the effective digest config. */
+  digest: ReportingPolicy["digest"];
+}
+
+/**
+ * The effective reporting summary. The loader always materialises the policy,
+ * so `undefined` means the default (`DEFAULT_REPORT_POLICY`); the preset name
+ * is carried only when the policy actually back-annotates one, so a rendered
+ * status names the preset without ever letting a stale or absent preset
+ * misstate what the policy does (#633).
+ */
+export function reportingSummary(policy: ReportingPolicy | undefined): ReportingSummary {
+  const effective = policy ?? DEFAULT_REPORT_POLICY;
+  return {
+    ...(effective.scopePreset === undefined ? {} : { scopePreset: effective.scopePreset }),
+    interruptOn: [...effective.interruptOn],
+    digest: { ...effective.digest },
+  };
+}
+
+/**
+ * The active drain as structured status exposes it: the creation instant, the
+ * absolute deadline, the purpose, and the live-run count the drain is waiting
+ * to reach zero. Only present on the snapshot while the record is fresh.
+ */
+export interface DrainStatus {
+  /** Epoch-ms instant the drain intent was recorded. */
+  since: number;
+  /** Absolute epoch-ms deadline — admission resumes automatically after it. */
+  expiresAt: number;
+  /** Purpose recorded at creation. */
+  reason?: string;
+  /** Runs still in the active set (live workers plus pushed-state PRs) — the
+   *  count a drain waits to reach zero, matching the `runs-settled` release
+   *  gate (#776 review #2). */
+  remainingRuns: number;
+}
+
 export interface StatusSnapshot {
   project: string;
   configPath: string;
@@ -4648,10 +5415,27 @@ export interface StatusSnapshot {
    * reading like a mistake (#220).
    */
   pauseReason?: string;
+  /**
+   * The project's active self-expiring drain (#484): present only while a
+   * fresh, valid drain record exists. Paused and drained are deliberately two
+   * fields — a drain is bounded and self-clearing where a pause is not, and
+   * the structured surface has to tell them apart without reading the pass
+   * history. Human CLI wording over it is a later #484 child.
+   */
+  drain?: DrainStatus;
   /** Mechanical operator availability at the moment this snapshot was read. */
   availability?: AvailabilityState;
   /** Next digest opportunity under the same predicate that gates submission. */
   digestSchedule?: DigestScheduleState;
+  /**
+   * The effective reporting policy: what interrupts, where everything else
+   * goes, and the legacy preset name when one is back-annotated. On the
+   * snapshot so the human `status`, the dashboard API and the CLI all read
+   * the same truth about the reporting surface without opening config — a
+   * routine outcome that reads as "Telegram is broken" unless the policy says
+   * it is digest-only (#633).
+   */
+  reporting?: ReportingSummary;
   caps: Caps;
   /**
    * The effective per-shape release grants. On the snapshot rather than re-read
@@ -4773,6 +5557,19 @@ export function statusSnapshotFromStore(
   // Read once: the provenance read touches the filesystem, and the renderer
   // should never pay for it twice per status.
   const reason = pauseProvenance(p.name)?.reason;
+  // Same cost discipline as the pause read: the drain record is a file read,
+  // and the active-drain view is only built when one is actually fresh. The
+  // read is observational — it never mutates the record — so a status read
+  // cannot consume a malformed marker the next dispatch pass still has to fail
+  // closed on; the dispatch consume owns cleanup (#776 review #2).
+  const drain = readDrain(p.name);
+  // The live run list feeds the worker-capacity row; the drain's
+  // remaining-runs count waits on the ACTIVE set (live workers plus
+  // pushed-state PRs), the same population the `runs-settled` release gate
+  // reads, so the two can never disagree about when a batch is finished
+  // (#776 review #2).
+  const live = store.liveRuns(p.name);
+  const active = store.activeRuns(p.name);
   // The live review-revision rounds, read from the same durable rows the
   // restart recovery uses: a run whose revision is dispatched is read as
   // `review-revision N` while its worker is live (#692).
@@ -4786,12 +5583,23 @@ export function statusSnapshotFromStore(
     stateDir: stateDir(),
     paused: isPaused(p.name),
     ...(reason === undefined ? {} : { pauseReason: reason }),
+    ...(drain.kind === "active"
+      ? {
+          drain: {
+            since: Date.parse(drain.drain.createdAt),
+            expiresAt: Date.parse(drain.drain.expiresAt),
+            ...(drain.drain.reason === undefined ? {} : { reason: drain.drain.reason }),
+            remainingRuns: active.length,
+          } satisfies DrainStatus,
+        }
+      : {}),
     availability: availabilityState(p.reporting, now),
     digestSchedule: digestScheduleState(p.reporting ?? DEFAULT_REPORT_POLICY, lastDigestDay, now),
+    reporting: reportingSummary(p.reporting ?? DEFAULT_REPORT_POLICY),
     caps,
     releaseGrants: resolveReleaseGrants(p),
     review: resolveReview(p),
-    activeRuns: store.activeRuns(p.name),
+    activeRuns: active,
     reviewRounds,
     salvagedRuns: store.salvagedRuns(p.name),
     quarantinedRuns: store.quarantinedRuns(p.name),
@@ -4799,7 +5607,7 @@ export function statusSnapshotFromStore(
     openReports: store.openReports(p.name),
     digestBacklog: store.digestBacklog(p.name),
     verbLedger: store.verbLedger(p.name, { limit: STATUS_LEDGER_SCAN }),
-    liveWorkers: store.liveRuns(p.name).length,
+    liveWorkers: live.length,
     runsToday: store.runsStartedSince(p.name, since),
     spendTodayUsd: store.spendSince(p.name, since),
     ...(dispatch === undefined ? {} : { dispatch }),
@@ -4846,6 +5654,14 @@ export function formatDispatchSummary(summary?: DispatchSummary): string {
       `  candidates    ${summary.ready} ready / ${summary.claimed ?? 0} in flight / ${summary.routed} spare`,
       `  admitted      ${summary.admitted}`,
     );
+    // The operator's park label, counted from the same eligibility read the
+    // claim gate uses (#507): "0 claimable, 12 parked" and "0 claimable,
+    // nothing to do" demand opposite orchestrator responses and must not
+    // render alike. Omitted at zero so an empty queue stays the old shape.
+    const parked = summary.parked ?? 0;
+    if (parked > 0) {
+      lines.push(`  parked        ${parked} — operator-held, never claimed`);
+    }
     if (summary.holds.length === 0) {
       lines.push("  held          0");
     } else {
@@ -5398,6 +6214,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
       log(projects.length === 1 ? message : `[${project.name}] ${message}`);
     };
     const caps = resolveCaps(project, cfg.defaults);
+    const host = cfg.host;
     // One transient-server-error breaker per project (#642): admission's
     // GraphQL checks and the orchestrator mutation commands share it, so a 503
     // observed by either side gates both instead of one provider outage being
@@ -5476,7 +6293,11 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
             recordReleaseBlock(project.name, "orchestrator", shape, context),
         });
         const transcript = orchestrator.sessionFile();
-        projectLog(`orchestrator session ready${transcript === undefined ? "" : ` · ${transcript}`}`);
+        const loaded = orchestrator.extensionVersion();
+        projectLog(
+          `orchestrator session ready${transcript === undefined ? "" : ` · ${transcript}`}` +
+            `${loaded === undefined ? "" : ` · loaded omp-conductor ${loaded}`}`,
+        );
       } catch (err) {
         orchestratorStartError = errText(err);
         projectLog(
@@ -5529,6 +6350,7 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
     const d: Deps = {
       project,
       caps,
+      host,
       tracker,
       store,
       drain,
@@ -5718,15 +6540,31 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
         },
         health: () =>
           daemonHealth(
-            runtimes.map((runtime) =>
-              daemonHealthSnapshot(
+            runtimes.map((runtime) => {
+              const orch = runtime.orchestrator;
+              const mode = runtime.d.project.escalation.orchestrator;
+              return daemonHealthSnapshot(
                 store,
                 runtime.d.project.name,
                 isPaused(runtime.d.project.name),
                 runtime.codeGraph,
                 workerControls,
-              ),
-            ),
+                orch === undefined
+                  ? // External mode is the pane's session: the daemon hosts no
+                    // child to attest. An embedded orchestrator that failed to
+                    // start is a live outage of the surface the upgrade must
+                    // promise reloaded (#832) — say so out loud.
+                    { mode: mode === "external" ? "external" : "failed" }
+                  : {
+                      mode: "embedded",
+                      ...(orch.extensionVersion() === undefined
+                        ? {}
+                        : { loaded: orch.extensionVersion() }),
+                      ...(orch.sessionFile() === undefined ? {} : { sessionFile: orch.sessionFile() }),
+                      alive: orch.alive(),
+                    },
+              );
+            }),
           ),
       }),
   });