omp-conductor 0.18.1 → 0.18.2

package/src/daemon.ts

@@ -36,13 +36,7 @@ import {
 import { createEscalator, escalationIssueRef } from "./escalate.ts";
 import { pendingCodeGraph, probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
 import { graphHint } from "./graph.ts";
-import {
-  hostConstraintsNotice,
-  resolveWorkerIdentity,
-  WORKER_ACCOUNT,
-  type WorkerIdentity,
-  type WorkerIdentityResolution,
-} from "./host.ts";
+import { hostConstraintsNotice } from "./host.ts";
 import { acquireOnceLease, healthCheck, livingDaemon, probeUnit, SYSTEMD_UNIT } from "./lifecycle.ts";
 import { requestImmediateTick, resolveTickConfigCwd, STALL_MARKER_FILE } from "./orchestrator-tick.ts";
 import { runDoctor } from "./doctor.ts";
@@ -286,33 +280,6 @@ interface Deps {
   workerControls: WorkerControlRegistry;
   /** Session seam for lifecycle integration tests; production uses the real harness. */
   workerDeps?: RunWorkerDeps;
-  /**
-   * Resolves the dedicated worker identity (#798) — the account worker sessions
-   * run under, with its uid/gid/home, the transition launcher and a live harness
-   * binding (#828).
-   *
-   * Called **at every worker launch**, never cached: every input is host state
-   * that can change under a running daemon. A reboot can start this service
-   * before systemd has mounted the harness binding, and an operator can install
-   * the account or re-run `setup host` at any time — a verdict taken once at
-   * startup would hold the whole fleet closed until somebody thought to restart
-   * the daemon, which is the outage #828 exists to end rather than relocate.
-   * Resolution is a handful of `stat` calls and one `/etc/passwd` read; a
-   * dispatch does far more than that before it reaches this gate.
-   *
-   * Every worker dispatch refuses to launch on an unresolved identity (fail
-   * closed — an unbound worker is indistinguishable from an operator shell),
-   * and this is how the dispatcher secures the run's sockets and grants the
-   * run's paths to the account. Absent entirely, dispatch fails closed naming
-   * the missing account.
-   */
-  workerIdentity?: () => WorkerIdentityResolution;
-  /**
-   * Re-owns a run's working paths (worktree + session dir) under the worker
-   * identity before the session launches. Wired by `runDaemon` to the
-   * recursive chown; a test fixture leaves it unset so no test chowns.
-   */
-  grantWorkerPaths?: (identity: WorkerIdentity, worktreePath: string, sessionDir: string) => void;
   integrity: IntegrityGate;
   stall: StallGate;
   /**
@@ -500,121 +467,6 @@ export function checkStall(gate: StallGate, marker: string, now = Date.now()): S
  * could destroy work an operator would rather read first — the same refusal to
  * guess that the recovery plugin is built on.
  */
-// --------------------------------------------------------- worker identity (#798) --
-
-/**
- * Re-own a run's working paths (worktree, session dir) under the worker
- * identity before the session launches. The daemon runs this as root; the
- * worker identity is granted its own run paths by ownership, never by
- * loosened modes on the daemon's.
- *
- * The walk never re-owns through a path a worker-uid process could
- * re-resolve: every ownership change is `fchownSync` on a descriptor opened
- * with `O_NOFOLLOW`, and every descriptor is verified — via `/proc/self/fd`'s
- * kernel-resolved path — to still sit under the directory the walk opened.
- * A directory entry raced into a symlink therefore either fails `O_NOFOLLOW`
- * at the final component or resolves outside the verified parent and is
- * skipped; it can never carry the chown to an external target. Symlinks
- * within the tree are left untouched (the worker manages entries through its
- * parent directories, and git recreates links on checkout), as are anything
- * unopenable — fifos, sockets, devices — which git never creates. A missing
- * or racing entry is not this dispatch's problem — the next dispatch re-owns
- * whatever survives; a tree already owned by the worker identity — the
- * resume and review-revision re-ownership of a tree a prior dispatch granted
- * — is the only tree a worker-uid process could have modified, and is
- * skipped outright rather than walked.
- */
-export function chownRecursive(root: string, uid: number, gid: number): void {
-  try {
-    const current = lstatSync(root);
-    if (current.uid === uid && current.gid === gid) return;
-  } catch {
-    // A missing or racing root is the caller's own existence check; the next
-    // dispatch re-owns whatever survives.
-    return;
-  }
-  const rootFd = openNoFollowDir(root);
-  try {
-    walkDir(rootFd, root, uid, gid);
-  } finally {
-    try {
-      closeSync(rootFd);
-    } catch {
-      // Already closed by a raced-away walk; nothing to do.
-    }
-  }
-}
-
-/** Open a directory without following a final-component symlink. */
-function openNoFollowDir(path: string): number {
-  return openSync(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
-}
-
-/** The kernel-resolved path of an open descriptor: what the object actually is. */
-function fdRealPath(fd: number): string | undefined {
-  try {
-    return readlinkSync(`/proc/self/fd/${fd}`);
-  } catch {
-    return undefined;
-  }
-}
-
-function walkDir(dirFd: number, dirPath: string, uid: number, gid: number): void {
-  try {
-    fchownSync(dirFd, uid, gid);
-  } catch {
-    // Raced away; the next dispatch re-owns what survives.
-  }
-  const dirReal = fdRealPath(dirFd);
-  if (dirReal === undefined) return;
-  let entries: Dirent[];
-  try {
-    entries = readdirSync(dirPath, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    const childPath = join(dirPath, entry.name);
-    try {
-      if (entry.isDirectory()) {
-        const childFd = openNoFollowDir(childPath);
-        try {
-          // The entry is genuinely beneath the directory this fd owns only
-          // when the kernel resolves the opened object to a path under it.
-          // Anything else — a name swapped to a symlink, a foreign listing
-          // read through a replaced parent — is refused, never re-resolved.
-          const childReal = fdRealPath(childFd);
-          if (childReal === undefined || !childReal.startsWith(`${dirReal}/`)) continue;
-          walkDir(childFd, childPath, uid, gid);
-        } finally {
-          try {
-            closeSync(childFd);
-          } catch {
-            // Raced away; nothing to close.
-          }
-        }
-        continue;
-      }
-      // Symlinks stay untouched (never followed, never chowned), and so do
-      // entries a read-only open cannot name safely (fifos, sockets, devices).
-      if (entry.isSymbolicLink() || !entry.isFile()) continue;
-      const fd = openSync(childPath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-      try {
-        const real = fdRealPath(fd);
-        if (real !== undefined && real.startsWith(`${dirReal}/`)) fchownSync(fd, uid, gid);
-      } finally {
-        try {
-          closeSync(fd);
-        } catch {
-          // Raced away; nothing to close.
-        }
-      }
-    } catch {
-      // O_NOFOLLOW refusal (a symlink swapped onto the name), or gone: nothing to chown.
-    }
-  }
-}
-
 export async function watchOrchestrator(d: Deps, now = Date.now()): Promise<void> {
   const marker = join(stateDir(), STALL_MARKER_FILE);
   const repeat = d.stall.paged;
@@ -1768,17 +1620,147 @@ export function createWorkerControlRegistry(): WorkerControlRegistry {
   };
 }
 
+/**
+ * The daemon half of a worker's `pushed-green` claim (#85's contact with
+ * reality; #782's publication attribution).
+ *
+ * A yield is a transport, not proof of GitHub side effects: `claim` is
+ * caller-supplied text and the worker adapter turns it into a green result
+ * without the daemon ever having seen a mediated publication verb for it — the
+ * shape that let the #777 incident guess a non-existent PR. The tracker read
+ * at the end proves the PR is open and green at the exact head; the evidence
+ * gate here proves that PR is *this run's own mediated work* first.
+ *
+ * Two things are asked, in cost order:
+ *
+ *  - the claimed URL must equal the one this run's row records, which is never
+ *    a worker-supplied string at the moment a live run is verified —
+ *    conductor_pr_create (create or adoption) writes it on the run, the daemon
+ *    seeds it at claim from a terminal predecessor on the same branch (#434),
+ *    and orchestrator-only recovery writes it for settled runs;
+ *  - and the claimed head must have a mediated publisher: an allowed
+ *    `conductor_push` on this exact run that published it on this run's branch
+ *    (the verb only ever pushes `refs/heads/<branch>`), an allowed
+ *    `conductor_pr_create` on this run for this exact PR, or — for a run that
+ *    published nothing new — the live tip of this run's own branch.
+ *
+ * That last path is the one the row cannot supply. It used to be served by
+ * comparing the claim against `run.prUrl`/`run.headSha`, and both are
+ * worker-tainted upstream: terminal settlement writes a worker's reported pair
+ * onto the row *before* any verification, and continuation inheritance
+ * validates only the predecessor's metadata and open state — so a turn-capped
+ * attempt that reported someone else's real green PR had that pair inherited
+ * and re-presented as its own evidence. Asking the tracker for the branch tip
+ * removes the worker from the loop entirely: `refs/heads/<branch>` is a ref
+ * only a mediated `conductor_push` or a mediated `conductor_pr_update_branch`
+ * can move, so its live commit is daemon provenance no reported string can
+ * forge. It is also why a legitimate mediated base-branch update now passes:
+ * that server-side merge creates a head no `conductor_push` ever published and
+ * the row still carries the older one, which the recorded-pair test rejected.
+ *
+ * Binding to the *exact current run* is what makes an old attempt, a different
+ * branch, or #806's orchestrator-only settled-run recovery invisible here: the
+ * ledger query is run-scoped by `runId`, and recoveries store no runId at all.
+ * That query asks for the run's complete history rather than the ledger's
+ * newest rows — publication evidence sits at the *start* of a run, and a
+ * review-revision round or a burst of refused mutations pushed it past the
+ * default page, turning a verified push into a definitive false failure.
+ *
+ * A claim that fails this gate is a definitive failure — never a retryable
+ * `pushed-pending` — because a guessed URL is not something a later tick is
+ * waiting on. A claim the gate could not *read* is the opposite: an unreadable
+ * branch tip is #781's transient outage, so it stays retryable rather than
+ * burning an attempt on a flaky read.
+ */
 export async function verifyPushedGreenClaim(
-  tracker: Pick<Tracker, "verifyPr">,
+  tracker: Pick<Tracker, "verifyPr" | "branchHead">,
   claim: Pick<WorkerResult, "prUrl" | "headSha">,
+  publication: {
+    project: string;
+    issue: number;
+    runId: string;
+    /** The branch conductor routed this run onto. `conductor_push` publishes
+     *  exactly `refs/heads/<branch>` and refuses any other ref. */
+    branch: string;
+    /** The identity `tracker.branchHead` reads the live tip with: the
+     *  canonical `owner/repo` when the routed clone URL carries one, else the
+     *  routed repository name. A tracker that cannot resolve it answers
+     *  undefined, which stays retryable rather than definitive. */
+    repo: string;
+    store: Pick<Store, "verbLedger" | "getRun">;
+  },
 ): Promise<{
   state: "pushed-green" | "pushed-pending" | "failed";
   reason?: string;
 }> {
-  if (claim.prUrl === undefined || claim.headSha === undefined) {
+  const { prUrl, headSha } = claim;
+  if (prUrl === undefined || headSha === undefined) {
     return { state: "failed", reason: "Worker did not report a PR URL and observed head SHA" };
   }
-  const verification = await tracker.verifyPr(claim.prUrl, claim.headSha);
+  // Exact current run, never "some publication for the issue": the query is
+  // scoped to this runId plus project/issue, so a previous attempt's verbs and
+  // the orchestrator's recovery verbs are invisible here. Unbounded on
+  // purpose — see the note above about evidence ageing off the newest page.
+  const ledger = publication.store.verbLedger(publication.project, {
+    runId: publication.runId,
+    issue: publication.issue,
+    limit: Number.MAX_SAFE_INTEGER,
+  });
+  const run = publication.store.getRun(publication.runId);
+  const branchRef = `refs/heads/${publication.branch}`;
+  if (run?.prUrl !== prUrl) {
+    return {
+      state: "failed",
+      reason:
+        "Pushed-green claim has no mediated publication evidence: the claimed PR is not this run's " +
+        "recorded PR",
+    };
+  }
+  const pushedThisHead = ledger.some(
+    (entry) =>
+      entry.decision === "allowed" &&
+      entry.verb === "conductor_push" &&
+      entry.sha === headSha &&
+      entry.detail.includes(branchRef),
+  );
+  // Bound to the claimed PR, not merely to "a create happened": both allowed
+  // details name the URL they produced (`opened <url> …`, `adopted <url> …`),
+  // so an unrelated create on this run cannot vouch for another PR.
+  const createdHere = ledger.some(
+    (entry) =>
+      entry.decision === "allowed" &&
+      entry.verb === "conductor_pr_create" &&
+      entry.detail.includes(prUrl),
+  );
+
+  if (!pushedThisHead && !createdHere) {
+    // Nothing this run published carries the claimed head, so the only
+    // remaining evidence is the branch itself: a continuation or review round
+    // that pushed nothing, or a head a mediated base-branch update produced.
+    let tip: string | undefined;
+    try {
+      tip = await tracker.branchHead(publication.repo, publication.branch);
+    } catch {
+      tip = undefined;
+    }
+    if (tip === undefined) {
+      return {
+        state: "pushed-pending",
+        reason: `Live head of ${branchRef} unavailable; retrying`,
+      };
+    }
+    if (tip !== headSha) {
+      return {
+        state: "failed",
+        reason:
+          "Pushed-green claim has no mediated publication evidence: this run's conductor_push / " +
+          `conductor_pr_create ledger does not cover the claimed head, and ${branchRef} is at ${tip}, ` +
+          "not the claimed head",
+      };
+    }
+  }
+
+  const verification = await tracker.verifyPr(prUrl, headSha);
   if (verification === undefined) {
     return { state: "pushed-pending", reason: "GitHub PR verification unavailable; retrying" };
   }
@@ -1932,33 +1914,6 @@ function orphanResumeVerdict(
   return { kind: "resume", prior };
 }
 
-/**
- * The worker identity for one launch, resolved now — or a throw naming the host
- * change that is missing (#798/#828).
- *
- * Every input is host state a running daemon does not control: the account can
- * be created after startup, and systemd can bring this service up before it has
- * mounted the harness binding a worker resolves through. So the verdict is taken
- * per launch. A daemon that cached one at startup would hold the whole fleet
- * closed on a boot race until somebody restarted it by hand — the outage #828
- * exists to end, not to relocate.
- *
- * The throw lands in the caller's dispatch catch, which settles the run failed
- * with this reason and escalates. It classifies as a start failure, so a host
- * fault charges the issue no implementation attempt.
- */
-function launchIdentity(d: Pick<Deps, "workerIdentity">, launching: string): WorkerIdentity {
-  const resolution: WorkerIdentityResolution = d.workerIdentity?.() ?? {
-    ok: false,
-    reason: `the ${WORKER_ACCOUNT} account is not installed on this host`,
-  };
-  if (resolution.ok) return resolution.identity;
-  throw new Error(
-    `worker identity unavailable: ${resolution.reason} — refusing to launch an unbound ${launching}; ` +
-      "run `omp-conductor setup host` to install the dedicated worker identity",
-  );
-}
-
 export async function handleIssue(
   d: Deps,
   r: Routed,
@@ -2276,13 +2231,6 @@ export async function handleIssue(
     if (await settleStopBeforeSession()) return;
     if (await settleDrainBeforeSession()) return;
 
-    // The worker identity is this run's launch gate (#798): a worker session
-    // that cannot be launched under the dedicated unprivileged account is
-    // indistinguishable from an operator shell, so dispatch refuses before any
-    // tree or session is created. Resolved here rather than read off a startup
-    // verdict, so a host that gained its account — or its harness binding
-    // (#828) — after the daemon came up dispatches on the next tick.
-    const identity = launchIdentity(d, "worker session");
 
     // A run's tree is <workspaceRoot>/<issue> and addRunRepo refuses to reuse
     // an existing path, so a retry — or a tree kept from a failed attempt — has
@@ -2366,10 +2314,6 @@ export async function handleIssue(
       },
       {
         ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }),
-        // A worker-run channel is secured to the worker identity (#798): the
-        // child that must connect to it runs as that uid, and the peer verdict
-        // expects that uid on the wire rather than the daemon's.
-        channelOwner: { uid: identity.uid, gid: identity.gid },
       },
     );
     if (await settleStopBeforeSession()) return;
@@ -2436,12 +2380,6 @@ export async function handleIssue(
 
     const repoSlug = githubRepo(r.repo.cloneUrl);
 
-    // The run's working paths are granted to the worker identity by ownership
-    // (#798) — the worktree the session edits and the session directory it
-    // writes its transcript and settings into. The chown lands here, after
-    // provisioning and the verb socket, so the session starts on a tree it
-    // owns; the worker identity never inherits anything from root's trees.
-    d.grantWorkerPaths?.(identity, worktreePath, sessionDir);
 
     let result: WorkerResult;
     try {
@@ -2472,7 +2410,6 @@ export async function handleIssue(
         onChildLog: (line) => {
           log(`#${issue} ${line}`);
         },
-        workerIdentity: identity,
         ...(choice.model === undefined ? {} : { model: choice.model }),
         // The fleet-owned omp settings overlay (#537): the staged YAML the
         // session loads through `Settings.init({ configFiles: [<path>] })` —
@@ -2530,7 +2467,14 @@ export async function handleIssue(
 
     const verified: { state: RunState; reason?: string } =
       result.state === "pushed-green"
-        ? await verifyPushedGreenClaim(tracker, result)
+        ? await verifyPushedGreenClaim(tracker, result, {
+            project: project.name,
+            issue,
+            runId,
+            branch,
+            repo: repoSlug ?? r.repo.name,
+            store,
+          })
         : { state: result.state };
     const state = verified.state;
 
@@ -3215,14 +3159,7 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
   if (await settleStopBeforeSession()) return;
   if (await settleDrainBeforeSession()) return;
 
-  // The same launch gate as a fresh claim (#798): a revision worker is a
-  // worker, and an unbound one is an operator shell — refuse before any tree
-  // or session is created. Thrown inside the try so the ordinary dispatch
-  // catch settles it: the run row is returned to terminal `failed` with the
-  // reason, the revision row is settled with it, and the still-green PR stays
-  // open for a healthy retry.
   try {
-    const identity = launchIdentity(d, "review-revision worker");
     // Reattach the run's own branch at the same per-issue path the run used:
     // a `pushed-green` settle removed the worktree, so provisioning is the
     // same continuation reattach as a normal re-claim. A capped/failed run's
@@ -3337,7 +3274,6 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
       },
       {
         ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }),
-        channelOwner: { uid: identity.uid, gid: identity.gid },
       },
     );
     if (await settleStopBeforeSession()) return;
@@ -3353,10 +3289,6 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
 
     log(`#${issue} review round ${revision.round} → resuming ${branch} (${priorSessionFile})`);
 
-    // The revision worker gets its own tree ownership, exactly as a fresh
-    // claim does (#798): the resumed worktree and session directory belong to
-    // the worker identity before its session starts.
-    d.grantWorkerPaths?.(identity, worktreePath, sessionDir);
 
     let result: WorkerResult;
     try {
@@ -3382,7 +3314,6 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
         onChildLog: (line) => {
           log(`#${issue} ${line}`);
         },
-        workerIdentity: identity,
         // The continuation stays on the model the green run used (#286).
         ...(run.model === undefined ? {} : { model: run.model }),
         ...(ompSettingsFile === undefined ? {} : { ompSettingsFile }),
@@ -3418,7 +3349,14 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
 
     const verified: { state: RunState; reason?: string } =
       result.state === "pushed-green"
-        ? await verifyPushedGreenClaim(tracker, result)
+        ? await verifyPushedGreenClaim(tracker, result, {
+            project: project.name,
+            issue,
+            runId,
+            branch,
+            repo: repoSlug ?? repo.name,
+            store,
+          })
         : { state: result.state };
     const state = verified.state;
 
@@ -6250,25 +6188,6 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   const store = openStore(dbPath());
   const verbPeerReader = peerCredentialReader();
   const verbDir = ensureVerbSocketDir(stateDir());
-  // The worker identity (#798). Probed once here for the startup banner only —
-  // every dispatch re-resolves it through {@link launchIdentity}, because the
-  // account, setpriv and the harness binding (#828) are all host state that can
-  // arrive after this process did. A host that cannot establish it keeps its
-  // control plane running and fails each worker launch closed with the reason,
-  // so the operator hears a concrete host change instead of a fleet that
-  // silently ran workers as root.
-  const identityAtStartup = resolveWorkerIdentity();
-  if (identityAtStartup.ok) {
-    log(
-      `worker identity: ${identityAtStartup.identity.account} uid=${identityAtStartup.identity.uid} ` +
-        `gid=${identityAtStartup.identity.gid} home=${identityAtStartup.identity.home}`,
-    );
-  } else {
-    log(
-      "worker identity unavailable — worker dispatch fails closed until the host provides it " +
-        `(re-checked at every launch, so no restart is needed once it does): ${identityAtStartup.reason}`,
-    );
-  }
   const integrity: IntegrityGate = { baseline: packageManifest(), paged: false };
   const usage = sharedUsageSource();
   const turnLimits = createTurnLimitRegistry((runId, maxTurns) => {
@@ -6447,16 +6366,6 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
       probeCriticalBase: (repo, markers, branch) =>
         probeCriticalBase(project, repo, branch, markers),
       probeWorktreeLane: (input) => probeRunLane(input),
-      // The live host, per launch — never the startup verdict above.
-      workerIdentity: () => resolveWorkerIdentity(),
-      // Grant each run's paths to the worker identity by ownership, before the
-      // session that must edit them starts (#798). The recursive chown runs as
-      // root from the dispatch path; the worker identity owns its checkout and
-      // transcript and nothing else.
-      grantWorkerPaths: (identity, worktreePath, sessionDir) => {
-        chownRecursive(worktreePath, identity.uid, identity.gid);
-        chownRecursive(sessionDir, identity.uid, identity.gid);
-      },
       // A cross-repo Depends-on prerequisite reads through the same GitHub
       // credential/accounting seams as the project tracker — a fresh tracker
       // scoped to the referenced repo, reusing the daemon's gh hooks so API

package/src/decisions.ts

@@ -79,14 +79,21 @@ export const PR_LOOKUP_WINDOW_MS = 30 * 24 * 60 * 60_000;
  * read by both `conductor_pr_review` and the `pr-review-ready` watch so they
  * cannot drift.
  *
- * Ownership is the same newest-first resolution the review verb uses: the
- * newest attempt of this project that recorded the PR within the
- * recent-history window (`runsForProjectPr`), never the issue's newest row —
- * a requeued continuation must not hide the PR its predecessor opened
- * (#434), and a newer live owner hides an older settled one. That older
- * settled row is exactly the shape dogfood #844 started from: PR #838 was
- * green while its newest owner was still `running`, and a watch keyed only to
- * checks woke the orchestrator before `conductor_pr_review` was actionable.
+ * Ownership is the newest attempt of this project that recorded the PR within
+ * the recent-history window (`runsForProjectPr`), never the issue's newest
+ * row — a requeued continuation must not hide the PR its predecessor opened
+ * (#434). A `stopped` row is transparent to that selection (#870): stopping
+ * is terminal and the attempt will never touch the PR again, so a stopped
+ * duplicate must not shadow the older revisable owner of the same PR — the
+ * row ordering that stranded PR #870's blocking findings. Every other
+ * non-revisable state still decides as the newest owner: a live row
+ * (`running` / `claimed`) hides an older settled one because a worker is in
+ * flight (#844 — PR #838 was green while its newest owner was still
+ * `running`, and a watch keyed only to checks woke the orchestrator before
+ * `conductor_pr_review` was actionable), `pushed-pending` checks are still
+ * settling, `blocked` may resume, `orphaned` is reconciled back to live at
+ * startup, and `merged` means the PR lifecycle is over. When every row is
+ * `stopped`, the newest one answers and the predicate fails closed.
  *
  * `no-owner` and `not-revisable` both fail closed: a review can never act, so
  * a watch must not wake, even when the checks are green.
@@ -97,9 +104,10 @@ export type PrReviewReadiness =
   | { kind: "not-revisable"; run: RunRecord };
 
 export function prReviewReadiness(store: Store, project: string, prUrl: string, now: number): PrReviewReadiness {
-  const run = store.runsForProjectPr(project, prUrl, now - PR_LOOKUP_WINDOW_MS)[0];
-  if (run === undefined) return { kind: "no-owner" };
-  return REVISABLE_RUN_STATES[run.state] === true ? { kind: "ready", run } : { kind: "not-revisable", run };
+  const runs = store.runsForProjectPr(project, prUrl, now - PR_LOOKUP_WINDOW_MS);
+  const owner = runs.find((attempt) => attempt.state !== "stopped") ?? runs.at(0);
+  if (owner === undefined) return { kind: "no-owner" };
+  return REVISABLE_RUN_STATES[owner.state] === true ? { kind: "ready", run: owner } : { kind: "not-revisable", run: owner };
 }
 
 /**