omp-conductor 0.18.1 → 0.19.0

package/src/daemon.ts

@@ -36,20 +36,38 @@ import {
 import { createEscalator, escalationIssueRef } from "./escalate.ts";
 import { pendingCodeGraph, probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
 import { graphHint } from "./graph.ts";
-import {
-  hostConstraintsNotice,
-  resolveWorkerIdentity,
-  WORKER_ACCOUNT,
-  type WorkerIdentity,
-  type WorkerIdentityResolution,
-} from "./host.ts";
+import { hostConstraintsNotice } from "./host.ts";
 import { acquireOnceLease, healthCheck, livingDaemon, probeUnit, SYSTEMD_UNIT } from "./lifecycle.ts";
 import { requestImmediateTick, resolveTickConfigCwd, STALL_MARKER_FILE } from "./orchestrator-tick.ts";
-import { runDoctor } from "./doctor.ts";
+import { SPEND_SAMPLE_ROWS, SPEND_SAMPLE_RUNS, runDoctor } from "./doctor.ts";
+import { judgeSpendTelemetry, type SpendTelemetryVerdict } from "./spend-telemetry.ts";
+import {
+  clearPauseIfUnchanged,
+  isPaused,
+  pausedAt,
+  pausedPath,
+  pauseInstance,
+  pauseInstanceAt,
+  pauseProvenance,
+  pauseSourceToken,
+  setPaused,
+} from "./pause.ts";
 import { appendJournal, launchTransientUnit, readUpgradeJournal } from "./upgrade-journal.ts";
 import { runCommand, verifyPendingUpgrade, type UpgradeVerifyDeps } from "./upgrade-verify.ts";
+import { inspectSurfaces, type InstalledSurfaces } from "./upgrade.ts";
+import { checkTelegramFreshness, type TelegramFreshness } from "./telegram-freshness.ts";
 import { processStartTimeMs } from "./upgrade-verify.ts";
-import { fleetLayers, herdrPaneOmpStarts, resolveHerdrSession } from "./fleet.ts";
+import {
+  fleetLayers,
+  herdrPaneOmpStarts,
+  openWorkerPane,
+  reconcileWorkerPanes,
+  releaseOrphanedWorkerPane,
+  releaseWorkerPane,
+  reportWorkerPaneState,
+  resolveHerdrSession,
+  type WorkerPaneOutcome,
+} from "./fleet.ts";
 import { startOrchestrator } from "./orchestrator.ts";
 import type { OrchestratorHandle } from "./orchestrator.ts";
 import {
@@ -77,11 +95,18 @@ import {
   effectiveModel,
   hasContinuationBudget,
   hasFailedAttemptBudget,
+  runSpendAllowanceUsd,
+  startOfToday,
   laneEcho,
 } from "./admission.ts";
 import type { Admission, AdmissionHold } from "./admission.ts";
 import type { EffectiveModel, FileLane } from "./types.ts";
 import { log, errText, safeEscalate } from "./log.ts";
+import {
+  oauthFenceVerdict,
+  probeCredentialClass,
+  type CredentialClassProbeResult,
+} from "./credential-class.ts";
 import {
   adoptSalvagedPrs,
   classifyAndRecover,
@@ -91,6 +116,7 @@ import {
   reactToProviderCredit,
   readSessionError,
   reconcileOrphanedRuns,
+  reconcileGroomingClosures,
   reconcileStaleLabels,
   recordOperatorStop,
   settlePushedGreen,
@@ -99,7 +125,13 @@ import {
 } from "./settlement.ts";
 import { materializeOmpSettings } from "./omp-settings.ts";
 import { evaluateDecisionConditions, probeNpmVersion, probeRateLimitReset } from "./decisions.ts";
-import { infraLogSignature, infraSignatureVersion, providerCreditRefusal, providerTransientFault } from "./failure-class.ts";
+import {
+  infraLogSignature,
+  infraSignatureVersion,
+  providerCreditRefusal,
+  providerTransientFault,
+  reviewRoundNeverWorked,
+} from "./failure-class.ts";
 import {
   DEFAULT_MODEL_FALLBACK_THRESHOLD,
   fallbackClause,
@@ -118,10 +150,11 @@ import {
   utcDay,
 } from "./store.ts";
 import { GhPrMissingError, GraphqlBreaker, makeTracker, type RateLimitStatus } from "./tracker/github.ts";
-import { DEFAULT_REPORT_POLICY, RELEASE_SHAPES } from "./types.ts";
+import { DEFAULT_REPORT_POLICY, RELEASE_SHAPES, REVIEW_ROUND_INFRA_MAX_RETRIES } from "./types.ts";
 import type {
   BaseFreeze,
   BaseHealth,
+  InstallSurfaceObservation,
   AdmissionHoldReason,
   Caps,
   ConductorConfig,
@@ -131,6 +164,8 @@ import type {
   InterruptCategory,
   IssueComment,
   IssueSnapshot,
+  PrDiff,
+  ReviewAdjudicationRecord,
   MergedPrInfo,
   OpenCloser,
   ReleaseShape,
@@ -147,6 +182,7 @@ import type {
   FailureClass,
   HostConstraints,
   RecoveryAction,
+  ReviewHeadBlocker,
   ReviewPolicy,
   ReviewRevisionOutcome,
   ReviewRevisionRecord,
@@ -160,14 +196,19 @@ import type {
   WorkflowRun,
 } from "./types.ts";
 import {
+  type AdjudicationRound,
+  type AdjudicatorOpts,
+  type AdjudicationResult,
   type KilledBy,
   type WorkerPauseControl,
   type WorkerPausePhase,
   type WorkerResult,
   type RunWorkerDeps,
   ORPHAN_RESUME_PROMPT,
+  renderAdjudicationBrief,
   renderBrief,
   renderReviewRevisionPrompt,
+  runAdjudicator,
   runWorker,
 } from "./worker.ts";
 import {
@@ -286,33 +327,6 @@ interface Deps {
   workerControls: WorkerControlRegistry;
   /** Session seam for lifecycle integration tests; production uses the real harness. */
   workerDeps?: RunWorkerDeps;
-  /**
-   * Resolves the dedicated worker identity (#798) — the account worker sessions
-   * run under, with its uid/gid/home, the transition launcher and a live harness
-   * binding (#828).
-   *
-   * Called **at every worker launch**, never cached: every input is host state
-   * that can change under a running daemon. A reboot can start this service
-   * before systemd has mounted the harness binding, and an operator can install
-   * the account or re-run `setup host` at any time — a verdict taken once at
-   * startup would hold the whole fleet closed until somebody thought to restart
-   * the daemon, which is the outage #828 exists to end rather than relocate.
-   * Resolution is a handful of `stat` calls and one `/etc/passwd` read; a
-   * dispatch does far more than that before it reaches this gate.
-   *
-   * Every worker dispatch refuses to launch on an unresolved identity (fail
-   * closed — an unbound worker is indistinguishable from an operator shell),
-   * and this is how the dispatcher secures the run's sockets and grants the
-   * run's paths to the account. Absent entirely, dispatch fails closed naming
-   * the missing account.
-   */
-  workerIdentity?: () => WorkerIdentityResolution;
-  /**
-   * Re-owns a run's working paths (worktree + session dir) under the worker
-   * identity before the session launches. Wired by `runDaemon` to the
-   * recursive chown; a test fixture leaves it unset so no test chowns.
-   */
-  grantWorkerPaths?: (identity: WorkerIdentity, worktreePath: string, sessionDir: string) => void;
   integrity: IntegrityGate;
   stall: StallGate;
   /**
@@ -365,6 +379,17 @@ interface Deps {
    * probe the way `criticalBase` does.
    */
   probeWorktreeLane?: RunLaneProbe;
+  /**
+   * Reads one provider's current credential class from the harness, out of
+   * process (#852). Wired by `runDaemon` to {@link probeCredentialClass}; a test
+   * injects a fake.
+   *
+   * Absent, both fences refuse a project that declares `requireOauthProviders` —
+   * this one fails CLOSED, unlike `probeWorktreeLane`, because an unverified
+   * credential class costs exactly what a wrong one costs. A project declaring
+   * nothing never calls it, so an unwired test dispatches as it always has.
+   */
+  probeCredentialClass?: (provider: string) => Promise<CredentialClassProbeResult>;
   /**
    * Reads one issue's tracker state in a repository the admission tracker is
    * not bound to — the cross-repo Depends-on interlock (#420). Wired by
@@ -379,6 +404,24 @@ interface Deps {
    * body fails that branch closed rather than synthesising a cycle.
    */
   probeBodyIn?: (repo: string, issue: number) => Promise<string | undefined>;
+  /**
+   * Reads the three install identities this host carries (#919). Wired by
+   * `runDaemon` to `inspectSurfaces`, the same seam `doctor` and `upgrade`
+   * read, so nothing re-implements the probe. A test injects its own; absent,
+   * the pass records nothing and every cheap surface honestly says "not
+   * observed yet" rather than claiming agreement.
+   */
+  probeInstallSurfaces?: () => Promise<InstalledSurfaces>;
+  /** The `omp-telegram` install/daemon/published triple, read on the same
+   *  periodic pass as the surfaces above (#961). */
+  probeTelegramFreshness?: () => Promise<TelegramFreshness>;
+  /**
+   * Runs one review-ceiling adjudication (#932). Production is
+   * {@link runAdjudicator}; a test injects a fake so the assertion can be the
+   * launch arguments and the assembled brief — which is what this pass actually
+   * produces — rather than a stored flag.
+   */
+  runAdjudicatorImpl?: (opts: AdjudicatorOpts) => Promise<AdjudicationResult>;
 }
 
 /**
@@ -408,6 +451,7 @@ export function verbDeps(d: Pick<Deps, "project" | "store" | "tracker" | "verbAc
     log,
     now: () => Date.now(),
     chain: { readBaseChain },
+    lane: { probeRunLane },
   };
 }
 
@@ -500,121 +544,6 @@ export function checkStall(gate: StallGate, marker: string, now = Date.now()): S
  * could destroy work an operator would rather read first — the same refusal to
  * guess that the recovery plugin is built on.
  */
-// --------------------------------------------------------- worker identity (#798) --
-
-/**
- * Re-own a run's working paths (worktree, session dir) under the worker
- * identity before the session launches. The daemon runs this as root; the
- * worker identity is granted its own run paths by ownership, never by
- * loosened modes on the daemon's.
- *
- * The walk never re-owns through a path a worker-uid process could
- * re-resolve: every ownership change is `fchownSync` on a descriptor opened
- * with `O_NOFOLLOW`, and every descriptor is verified — via `/proc/self/fd`'s
- * kernel-resolved path — to still sit under the directory the walk opened.
- * A directory entry raced into a symlink therefore either fails `O_NOFOLLOW`
- * at the final component or resolves outside the verified parent and is
- * skipped; it can never carry the chown to an external target. Symlinks
- * within the tree are left untouched (the worker manages entries through its
- * parent directories, and git recreates links on checkout), as are anything
- * unopenable — fifos, sockets, devices — which git never creates. A missing
- * or racing entry is not this dispatch's problem — the next dispatch re-owns
- * whatever survives; a tree already owned by the worker identity — the
- * resume and review-revision re-ownership of a tree a prior dispatch granted
- * — is the only tree a worker-uid process could have modified, and is
- * skipped outright rather than walked.
- */
-export function chownRecursive(root: string, uid: number, gid: number): void {
-  try {
-    const current = lstatSync(root);
-    if (current.uid === uid && current.gid === gid) return;
-  } catch {
-    // A missing or racing root is the caller's own existence check; the next
-    // dispatch re-owns whatever survives.
-    return;
-  }
-  const rootFd = openNoFollowDir(root);
-  try {
-    walkDir(rootFd, root, uid, gid);
-  } finally {
-    try {
-      closeSync(rootFd);
-    } catch {
-      // Already closed by a raced-away walk; nothing to do.
-    }
-  }
-}
-
-/** Open a directory without following a final-component symlink. */
-function openNoFollowDir(path: string): number {
-  return openSync(path, constants.O_RDONLY | constants.O_DIRECTORY | constants.O_NOFOLLOW);
-}
-
-/** The kernel-resolved path of an open descriptor: what the object actually is. */
-function fdRealPath(fd: number): string | undefined {
-  try {
-    return readlinkSync(`/proc/self/fd/${fd}`);
-  } catch {
-    return undefined;
-  }
-}
-
-function walkDir(dirFd: number, dirPath: string, uid: number, gid: number): void {
-  try {
-    fchownSync(dirFd, uid, gid);
-  } catch {
-    // Raced away; the next dispatch re-owns what survives.
-  }
-  const dirReal = fdRealPath(dirFd);
-  if (dirReal === undefined) return;
-  let entries: Dirent[];
-  try {
-    entries = readdirSync(dirPath, { withFileTypes: true });
-  } catch {
-    return;
-  }
-  for (const entry of entries) {
-    const childPath = join(dirPath, entry.name);
-    try {
-      if (entry.isDirectory()) {
-        const childFd = openNoFollowDir(childPath);
-        try {
-          // The entry is genuinely beneath the directory this fd owns only
-          // when the kernel resolves the opened object to a path under it.
-          // Anything else — a name swapped to a symlink, a foreign listing
-          // read through a replaced parent — is refused, never re-resolved.
-          const childReal = fdRealPath(childFd);
-          if (childReal === undefined || !childReal.startsWith(`${dirReal}/`)) continue;
-          walkDir(childFd, childPath, uid, gid);
-        } finally {
-          try {
-            closeSync(childFd);
-          } catch {
-            // Raced away; nothing to close.
-          }
-        }
-        continue;
-      }
-      // Symlinks stay untouched (never followed, never chowned), and so do
-      // entries a read-only open cannot name safely (fifos, sockets, devices).
-      if (entry.isSymbolicLink() || !entry.isFile()) continue;
-      const fd = openSync(childPath, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
-      try {
-        const real = fdRealPath(fd);
-        if (real !== undefined && real.startsWith(`${dirReal}/`)) fchownSync(fd, uid, gid);
-      } finally {
-        try {
-          closeSync(fd);
-        } catch {
-          // Raced away; nothing to close.
-        }
-      }
-    } catch {
-      // O_NOFOLLOW refusal (a symlink swapped onto the name), or gone: nothing to chown.
-    }
-  }
-}
-
 export async function watchOrchestrator(d: Deps, now = Date.now()): Promise<void> {
   const marker = join(stateDir(), STALL_MARKER_FILE);
   const repeat = d.stall.paged;
@@ -664,180 +593,21 @@ export async function watchOrchestrator(d: Deps, now = Date.now()): Promise<void
   markPaged(d.stall, delivered, now);
 }
 
-/**
- * Pause is a file rather than process state on purpose: `omp-conductor hold`
- * runs in a different process from the daemon, and a flag
- * on disk needs no IPC and survives a restart. A daemon that crashed while
- * paused comes back paused.
- */
-export function pausedPath(project?: string): string {
-  return join(stateDir(), project === undefined ? "paused" : `paused-${project}`);
-}
-
-function activePausePaths(project?: string): string[] {
-  const paths = project === undefined ? [pausedPath()] : [pausedPath(project), pausedPath()];
-  return paths.filter((path) => existsSync(path));
-}
-
-export function isPaused(project?: string): boolean {
-  return activePausePaths(project).length !== 0;
-}
-
-/**
- * The epoch-ms timestamp at which the current pause began. A project pause also
- * observes the legacy bare sentinel, which pauses every project. If any active
- * sentinel is unreadable or unparseable, the timestamp is unknown so callers
- * continue to fail closed.
- */
-export function pausedAt(project?: string): number | undefined {
-  const paths = activePausePaths(project);
-  if (paths.length === 0) return undefined;
-  const times: number[] = [];
-  for (const path of paths) {
-    try {
-      const first = readFileSync(path, "utf8").split("\n")[0]?.trim();
-      if (first === undefined || first === "") return undefined;
-      const time = Date.parse(first);
-      if (Number.isNaN(time)) return undefined;
-      times.push(time);
-    } catch {
-      return undefined;
-    }
-  }
-  return Math.min(...times);
-}
-
-/**
- * Who paused the project and why. Per-project provenance wins when both its
- * sentinel and the legacy all-project sentinel are active.
- */
-export function pauseProvenance(
-  project?: string,
-): { source: string; reason?: string } | undefined {
-  const paths =
-    project === undefined
-      ? [pausedPath()]
-      : [pausedPath(project), pausedPath()];
-  const path = paths.find((candidate) => existsSync(candidate));
-  if (path === undefined) return undefined;
-  try {
-    const second = readFileSync(path, "utf8").split("\n")[1];
-    if (second === undefined) return undefined;
-    const match = /^source=(\S+)(?: reason="(.*)")?$/.exec(second.trim());
-    if (match === null) return undefined;
-    const source = match[1]!;
-    const reason = match[2];
-    return { source, ...(reason === undefined ? {} : { reason }) };
-  } catch {
-    return undefined;
-  }
-}
-
-/**
- * One pause sentinel FILE read as an instance identity: who set it, why, and
- * the creation instant, all from that exact file. An unreadable or malformed
- * file is undefined — the caller may treat it as absence.
- */
-function pauseInstanceAt(
-  path: string,
-): { source: string; reason?: string; since: number } | undefined {
-  try {
-    const [line1, line2] = readFileSync(path, "utf8").split("\n");
-    const since = Date.parse(line1?.trim() ?? "");
-    if (!Number.isFinite(since)) return undefined;
-    if (line2 === undefined) return undefined;
-    const match = /^source=(\S+)(?: reason="(.*)")?$/.exec(line2.trim());
-    if (match === null) return undefined;
-    const source = match[1]!;
-    const reason = match[2];
-    return { source, since, ...(reason === undefined ? {} : { reason }) };
-  } catch {
-    return undefined;
-  }
-}
-
-/**
- * One pause sentinel read as a single identity: who set it, why, and the
- * creation instant, all from the SAME file that was selected. Unlike pairing
- * {@link pauseProvenance} with {@link pausedAt} — which can describe
- * different files when a project pause coexists with the legacy global
- * sentinel, letting a stale global timestamp mask a recreated project pause —
- * this reads provenance and timestamp from one sentinel, so a caller can prove
- * "the pause I set still exists" instead of "some pause with the same labels
- * still exists" (#377). Per-project sentinel wins, like {@link pauseProvenance}.
- */
-export function pauseInstance(
-  project?: string,
-): { source: string; reason?: string; since: number } | undefined {
-  const paths =
-    project === undefined
-      ? [pausedPath()]
-      : [pausedPath(project), pausedPath()];
-  const path = paths.find((candidate) => existsSync(candidate));
-  if (path === undefined) return undefined;
-  return pauseInstanceAt(path);
-}
-
-/**
- * Compare-and-clear one pause sentinel (#780 review): remove `path` only while
- * it still holds exactly the `expected` instance — same source, same reason,
- * same creation instant — as read by {@link pauseInstance}. A hold or pause
- * that replaced or recreated the sentinel between the read and the clear is a
- * newer instance (writes always re-stamp `since`), so it is never destroyed:
- * returning false keeps the newer fence in force. Scoped strictly to one
- * caller-provided path, so auto-expiry can clear the per-project spend-cap
- * sentinel without ever touching the legacy global sentinel.
- */
-export function clearPauseIfUnchanged(
-  path: string,
-  expected: { source: string; reason?: string; since: number },
-): boolean {
-  const current = pauseInstanceAt(path);
-  if (current === undefined) return false;
-  if (
-    current.source !== expected.source ||
-    current.since !== expected.since ||
-    current.reason !== expected.reason
-  ) {
-    return false;
-  }
-  rmSync(path, { force: true });
-  return true;
-}
-
-/**
- * The pause sentinel's `source=` token, proven from a verb. The sentinel's
- * source line is read back as a single `\S+` token (see {@link pauseInstance}
- * and {@link pauseProvenance}), so a verb that contains a space (`setup host`)
- * is unrepresentable verbatim and must be encoded before it reaches disk —
- * otherwise the fence cannot prove its own pause and refuses forever (#552).
- * Spaces become `-`; the human-readable verb is preserved in the sentinel's
- * `reason=` instead.
- */
-export function pauseSourceToken(verb: string): string {
-  return verb.trim().replace(/\s+/g, "-");
-}
-
-export function setPaused(
-  v: boolean,
-  why?: { source: string; reason?: string },
-  project?: string,
-): void {
-  const path = pausedPath(project);
-  if (v) {
-    mkdirSync(dirname(path), { recursive: true });
-    const line1 = `${new Date().toISOString()}\n`;
-    if (why === undefined) {
-      writeFileSync(path, line1);
-    } else {
-      const reason = why.reason === undefined ? "" : ` reason="${why.reason.replaceAll('"', "")}"`;
-      writeFileSync(path, `${line1}source=${why.source}${reason}\n`);
-    }
-  } else {
-    rmSync(path, { force: true });
-    if (project !== undefined) rmSync(pausedPath(), { force: true });
-  }
-}
+// ------------------------------------------------------------------- pause
+// The sentinel itself lives in `pause.ts` (#938): this module imports
+// `doctor.ts`, so a health check that needs to read a fence cannot import back
+// here. Re-exported so every existing `from "./daemon.ts"` import still
+// resolves — the move is structural, not a change of surface.
+export {
+  clearPauseIfUnchanged,
+  isPaused,
+  pausedAt,
+  pausedPath,
+  pauseInstance,
+  pauseProvenance,
+  pauseSourceToken,
+  setPaused,
+};
 
 // ------------------------------------------------------------------- drain
 // (#484 slice 1) A project drain is a durable, self-expiring admission fence:
@@ -1238,19 +1008,6 @@ export function markPaged(
 
 // ---------------------------------------------------------------------- helpers
 
-/**
- * Local midnight, matching how a human reads "today".
- *
- * ponytail: a rolling 24h window would be fairer to a run that started at
- * 23:50, but midnight is what someone checking a morning spend report expects.
- * Upgrade path is a `capWindow: "day" | "rolling24h"` config key.
- */
-function startOfToday(): number {
-  const d = new Date();
-  d.setHours(0, 0, 0, 0);
-  return d.getTime();
-}
-
 /**
  * `owner/repo` for `gh`, derived from the clone URL.
  *
@@ -1448,6 +1205,7 @@ function swapLabel(store: Store, projectName: string, issue: number, from: strin
 function endedBy(killedBy: KilledBy | undefined): string {
   if (killedBy === "turns") return "killed by the turns cap";
   if (killedBy === "wallclock") return "killed by the wall-clock cap";
+  if (killedBy === "spend") return "killed by the per-run spend cap";
   return "killed by a failed run";
 }
 
@@ -1653,7 +1411,19 @@ export interface WorkerControlSlot {
 }
 
 export interface WorkerControlRegistry {
-  open(project: string, issue: number, runId: string): WorkerControlSlot;
+  /**
+   * `onPhase` is called after a pause/resume/stop that actually changed this
+   * worker's phase (#842) — the authoritative transition, from the same control
+   * that performed it. It exists so a surface outside this registry (the run's
+   * Herdr representation) can follow the phase without polling and without
+   * inventing a second notion of "paused".
+   */
+  open(
+    project: string,
+    issue: number,
+    runId: string,
+    onPhase?: (phase: WorkerPausePhase) => void,
+  ): WorkerControlSlot;
   pause(project: string, issue: number): Promise<WorkerControlResult>;
   resume(project: string, issue: number): WorkerControlResult;
   stop(project: string, issue: number, reason: string): Promise<WorkerControlResult>;
@@ -1671,12 +1441,13 @@ export function createWorkerControlRegistry(): WorkerControlRegistry {
     stopReason?: string;
     stopError?: string;
     finished: PromiseWithResolvers<void>;
+    onPhase?: (phase: WorkerPausePhase) => void;
   }
 
   const active = new Map<string, Entry>();
   const key = (project: string, issue: number): string => `${project}\0${issue}`;
   return {
-    open(project, issue, runId) {
+    open(project, issue, runId, onPhase) {
       const k = key(project, issue);
       if (active.has(k)) throw new Error(`#${issue} already has a live worker controller`);
       const entry: Entry = {
@@ -1684,6 +1455,7 @@ export function createWorkerControlRegistry(): WorkerControlRegistry {
         issue,
         runId,
         finished: Promise.withResolvers<void>(),
+        ...(onPhase === undefined ? {} : { onPhase }),
       };
       active.set(k, entry);
       return {
@@ -1709,7 +1481,9 @@ export function createWorkerControlRegistry(): WorkerControlRegistry {
       if (entry?.control === undefined) return { kind: "not-active" };
       try {
         await entry.control.pause();
-        return { kind: "ok", runId: entry.runId, phase: entry.control.phase() };
+        const phase = entry.control.phase();
+        entry.onPhase?.(phase);
+        return { kind: "ok", runId: entry.runId, phase };
       } catch (err) {
         return {
           kind: "refused",
@@ -1723,7 +1497,9 @@ export function createWorkerControlRegistry(): WorkerControlRegistry {
       if (entry?.control === undefined) return { kind: "not-active" };
       try {
         entry.control.resume();
-        return { kind: "ok", runId: entry.runId, phase: entry.control.phase() };
+        const phase = entry.control.phase();
+        entry.onPhase?.(phase);
+        return { kind: "ok", runId: entry.runId, phase };
       } catch (err) {
         return {
           kind: "refused",
@@ -1768,17 +1544,147 @@ export function createWorkerControlRegistry(): WorkerControlRegistry {
   };
 }
 
+/**
+ * The daemon half of a worker's `pushed-green` claim (#85's contact with
+ * reality; #782's publication attribution).
+ *
+ * A yield is a transport, not proof of GitHub side effects: `claim` is
+ * caller-supplied text and the worker adapter turns it into a green result
+ * without the daemon ever having seen a mediated publication verb for it — the
+ * shape that let the #777 incident guess a non-existent PR. The tracker read
+ * at the end proves the PR is open and green at the exact head; the evidence
+ * gate here proves that PR is *this run's own mediated work* first.
+ *
+ * Two things are asked, in cost order:
+ *
+ *  - the claimed URL must equal the one this run's row records, which is never
+ *    a worker-supplied string at the moment a live run is verified —
+ *    conductor_pr_create (create or adoption) writes it on the run, the daemon
+ *    seeds it at claim from a terminal predecessor on the same branch (#434),
+ *    and orchestrator-only recovery writes it for settled runs;
+ *  - and the claimed head must have a mediated publisher: an allowed
+ *    `conductor_push` on this exact run that published it on this run's branch
+ *    (the verb only ever pushes `refs/heads/<branch>`), an allowed
+ *    `conductor_pr_create` on this run for this exact PR, or — for a run that
+ *    published nothing new — the live tip of this run's own branch.
+ *
+ * That last path is the one the row cannot supply. It used to be served by
+ * comparing the claim against `run.prUrl`/`run.headSha`, and both are
+ * worker-tainted upstream: terminal settlement writes a worker's reported pair
+ * onto the row *before* any verification, and continuation inheritance
+ * validates only the predecessor's metadata and open state — so a turn-capped
+ * attempt that reported someone else's real green PR had that pair inherited
+ * and re-presented as its own evidence. Asking the tracker for the branch tip
+ * removes the worker from the loop entirely: `refs/heads/<branch>` is a ref
+ * only a mediated `conductor_push` or a mediated `conductor_pr_update_branch`
+ * can move, so its live commit is daemon provenance no reported string can
+ * forge. It is also why a legitimate mediated base-branch update now passes:
+ * that server-side merge creates a head no `conductor_push` ever published and
+ * the row still carries the older one, which the recorded-pair test rejected.
+ *
+ * Binding to the *exact current run* is what makes an old attempt, a different
+ * branch, or #806's orchestrator-only settled-run recovery invisible here: the
+ * ledger query is run-scoped by `runId`, and recoveries store no runId at all.
+ * That query asks for the run's complete history rather than the ledger's
+ * newest rows — publication evidence sits at the *start* of a run, and a
+ * review-revision round or a burst of refused mutations pushed it past the
+ * default page, turning a verified push into a definitive false failure.
+ *
+ * A claim that fails this gate is a definitive failure — never a retryable
+ * `pushed-pending` — because a guessed URL is not something a later tick is
+ * waiting on. A claim the gate could not *read* is the opposite: an unreadable
+ * branch tip is #781's transient outage, so it stays retryable rather than
+ * burning an attempt on a flaky read.
+ */
 export async function verifyPushedGreenClaim(
-  tracker: Pick<Tracker, "verifyPr">,
+  tracker: Pick<Tracker, "verifyPr" | "branchHead">,
   claim: Pick<WorkerResult, "prUrl" | "headSha">,
+  publication: {
+    project: string;
+    issue: number;
+    runId: string;
+    /** The branch conductor routed this run onto. `conductor_push` publishes
+     *  exactly `refs/heads/<branch>` and refuses any other ref. */
+    branch: string;
+    /** The identity `tracker.branchHead` reads the live tip with: the
+     *  canonical `owner/repo` when the routed clone URL carries one, else the
+     *  routed repository name. A tracker that cannot resolve it answers
+     *  undefined, which stays retryable rather than definitive. */
+    repo: string;
+    store: Pick<Store, "verbLedger" | "getRun">;
+  },
 ): Promise<{
   state: "pushed-green" | "pushed-pending" | "failed";
   reason?: string;
 }> {
-  if (claim.prUrl === undefined || claim.headSha === undefined) {
+  const { prUrl, headSha } = claim;
+  if (prUrl === undefined || headSha === undefined) {
     return { state: "failed", reason: "Worker did not report a PR URL and observed head SHA" };
   }
-  const verification = await tracker.verifyPr(claim.prUrl, claim.headSha);
+  // Exact current run, never "some publication for the issue": the query is
+  // scoped to this runId plus project/issue, so a previous attempt's verbs and
+  // the orchestrator's recovery verbs are invisible here. Unbounded on
+  // purpose — see the note above about evidence ageing off the newest page.
+  const ledger = publication.store.verbLedger(publication.project, {
+    runId: publication.runId,
+    issue: publication.issue,
+    limit: Number.MAX_SAFE_INTEGER,
+  });
+  const run = publication.store.getRun(publication.runId);
+  const branchRef = `refs/heads/${publication.branch}`;
+  if (run?.prUrl !== prUrl) {
+    return {
+      state: "failed",
+      reason:
+        "Pushed-green claim has no mediated publication evidence: the claimed PR is not this run's " +
+        "recorded PR",
+    };
+  }
+  const pushedThisHead = ledger.some(
+    (entry) =>
+      entry.decision === "allowed" &&
+      entry.verb === "conductor_push" &&
+      entry.sha === headSha &&
+      entry.detail.includes(branchRef),
+  );
+  // Bound to the claimed PR, not merely to "a create happened": both allowed
+  // details name the URL they produced (`opened <url> …`, `adopted <url> …`),
+  // so an unrelated create on this run cannot vouch for another PR.
+  const createdHere = ledger.some(
+    (entry) =>
+      entry.decision === "allowed" &&
+      entry.verb === "conductor_pr_create" &&
+      entry.detail.includes(prUrl),
+  );
+
+  if (!pushedThisHead && !createdHere) {
+    // Nothing this run published carries the claimed head, so the only
+    // remaining evidence is the branch itself: a continuation or review round
+    // that pushed nothing, or a head a mediated base-branch update produced.
+    let tip: string | undefined;
+    try {
+      tip = await tracker.branchHead(publication.repo, publication.branch);
+    } catch {
+      tip = undefined;
+    }
+    if (tip === undefined) {
+      return {
+        state: "pushed-pending",
+        reason: `Live head of ${branchRef} unavailable; retrying`,
+      };
+    }
+    if (tip !== headSha) {
+      return {
+        state: "failed",
+        reason:
+          "Pushed-green claim has no mediated publication evidence: this run's conductor_push / " +
+          `conductor_pr_create ledger does not cover the claimed head, and ${branchRef} is at ${tip}, ` +
+          "not the claimed head",
+      };
+    }
+  }
+
+  const verification = await tracker.verifyPr(prUrl, headSha);
   if (verification === undefined) {
     return { state: "pushed-pending", reason: "GitHub PR verification unavailable; retrying" };
   }
@@ -1932,33 +1838,6 @@ function orphanResumeVerdict(
   return { kind: "resume", prior };
 }
 
-/**
- * The worker identity for one launch, resolved now — or a throw naming the host
- * change that is missing (#798/#828).
- *
- * Every input is host state a running daemon does not control: the account can
- * be created after startup, and systemd can bring this service up before it has
- * mounted the harness binding a worker resolves through. So the verdict is taken
- * per launch. A daemon that cached one at startup would hold the whole fleet
- * closed on a boot race until somebody restarted it by hand — the outage #828
- * exists to end, not to relocate.
- *
- * The throw lands in the caller's dispatch catch, which settles the run failed
- * with this reason and escalates. It classifies as a start failure, so a host
- * fault charges the issue no implementation attempt.
- */
-function launchIdentity(d: Pick<Deps, "workerIdentity">, launching: string): WorkerIdentity {
-  const resolution: WorkerIdentityResolution = d.workerIdentity?.() ?? {
-    ok: false,
-    reason: `the ${WORKER_ACCOUNT} account is not installed on this host`,
-  };
-  if (resolution.ok) return resolution.identity;
-  throw new Error(
-    `worker identity unavailable: ${resolution.reason} — refusing to launch an unbound ${launching}; ` +
-      "run `omp-conductor setup host` to install the dedicated worker identity",
-  );
-}
-
 export async function handleIssue(
   d: Deps,
   r: Routed,
@@ -1981,6 +1860,32 @@ export async function handleIssue(
   let turnLimit: TurnLimitController | undefined;
   let workerControl: WorkerControlSlot | undefined;
   let workerSessionInstalled = false;
+  // The run's Herdr representation (#840), hoisted for the same reason the verb
+  // listener is: whoever tears the run down has to hand the pane's lifecycle
+  // authority back, and a representation that outlives its child is a worker the
+  // workspace still shows as live.
+  let workerPane: Extract<WorkerPaneOutcome, { kind: "tracked" }> | undefined;
+  // Herdr orders lifecycle reports by `seq`, so this run owns one counter and
+  // every report takes the next value (#842). A shared or restarted counter would
+  // let a late report overwrite a newer state — the pane would then show `working`
+  // for a worker that has already blocked.
+  let paneSeq = 0;
+  const nextPaneSeq = (): number => (paneSeq += 1);
+  /**
+   * Project one authoritative transition onto the pane (#842).
+   *
+   * The input is always a durable run transition or a typed session event —
+   * never the pane's own output, which is display and nothing more. A failure is
+   * logged, not raised: the workspace lagging is not worth failing a run over.
+   */
+  const projectPaneState = (state: "working" | "idle" | "blocked" | "unknown", message?: string): void => {
+    if (workerPane === undefined) return;
+    const reported = reportWorkerPaneState(workerPane.paneId, workerPane.label, state, {
+      seq: nextPaneSeq(),
+      ...(message === undefined ? {} : { message }),
+    });
+    if (!reported.ok) log(`#${issue} herdr pane state ${state} not reported: ${reported.reason}`);
+  };
   // The run's own repository. Hoisted for the same reason `worktreePath` is —
   // the catch and finally paths have to publish the branch.
   let runRepo: RunRepoRef | undefined;
@@ -2097,6 +2002,73 @@ export async function handleIssue(
     return true;
   };
 
+  /**
+   * The launch half of the credential-class fence (#852).
+   *
+   * Admission already held every candidate while a required provider billed to
+   * the wrong credential, but a grant can be disabled in the window *between*
+   * that check and this spawn — a refresh failing, an operator revoking, a token
+   * expiring — and that window is exactly what the incident's acceptance
+   * criterion names. So the same question is asked again here, as the last thing
+   * before the session exists, and the run is closed rather than launched.
+   *
+   * Settled the same way the stop and drain fences settle: the claim closes, the
+   * tree is salvaged, nothing is launched. It is deliberately NOT a failed
+   * attempt against the issue's budget — the issue is not what is wrong, the
+   * host's credentials are, and charging an attempt for it would exhaust an
+   * issue while the operator re-authenticates.
+   */
+  const settleCredentialClassBeforeSession = async (): Promise<boolean> => {
+    const required = project.requireOauthProviders ?? [];
+    if (required.length === 0 || run === undefined || workerSessionInstalled) return false;
+    const fence = await oauthFenceVerdict(
+      required,
+      d.probeCredentialClass ??
+        (async (provider) => ({
+          ok: false,
+          reason: `no credential probe is wired for ${provider}`,
+        })),
+    );
+    if (fence.ok) return false;
+    turnLimit?.close();
+    turnLimit = undefined;
+    const settlement =
+      worktreePath === undefined
+        ? undefined
+        : await settleWorktree({
+            issue,
+            attempt,
+            ending: "not launched: a required subscription credential is unavailable",
+            worktree: worktreePath,
+            branch,
+            publish,
+            tree: "remove",
+            mirrorPath,
+          });
+    recordOperatorStop(store, {
+      project: project.name,
+      issue,
+      runId: run.id,
+      inProgress,
+      reason: `required subscription credential unavailable: ${fence.reason}`,
+      patch: {
+        endedAt: Date.now(),
+        turns: run.turns,
+        spendUsd: run.spendUsd,
+        worktree: worktreePath ?? run.worktree,
+        report: [
+          "This run was closed instead of launched: a provider this project requires to bill",
+          "to its subscription would have billed to something else.",
+          fence.reason,
+          ...(settlement?.lines ?? []),
+        ].join("\n"),
+        ...settlement?.patch,
+      },
+    });
+    log(`#${issue} not launched: ${fence.reason}`);
+    return true;
+  };
+
   try {
     // The claim-side of the stop fence (#374): the run row is the boundary the
     // shutdown drain waits on, so the claim itself refuses once the daemon is
@@ -2179,13 +2151,27 @@ export async function handleIssue(
     // (#286) keeps its semantics in both cases — it is the same resolution,
     // one different primary.
     const declaredModel = admittedModel?.model;
+    // #807: a chain that already bought its one model escalation dispatches on
+    // that stronger selector, outranking both the declaration and the project
+    // default — the settlement that wrote the marker did so precisely because
+    // the previous tier spun to a cap with nothing to show. Read from the
+    // store, so it is sticky to this issue's chain and a fresh issue (no
+    // marker) resolves exactly as it always has. The provider chain still
+    // layers on top: an escalated run whose provider then aborts fails over
+    // normally, because escalation only ever changes the primary.
+    const escalation = store.modelEscalation(project.name, issue);
+    const primaryModel = escalation?.model ?? declaredModel ?? project.workerModel;
     const choice = resolveDispatchModel({
-      workerModel: declaredModel ?? project.workerModel,
+      workerModel: primaryModel,
       modelFallbacks: project.modelFallbacks,
       threshold: project.modelFallbackThreshold ?? DEFAULT_MODEL_FALLBACK_THRESHOLD,
       streak: chainFacts.streak,
     });
-    const clause = fallbackClause(choice, chainFacts, declaredModel ?? project.workerModel);
+    const clause =
+      fallbackClause(choice, chainFacts, primaryModel) ??
+      (escalation === undefined
+        ? undefined
+        : `on ${escalation.model} — this chain's one model escalation, after ${escalation.failureClass}`);
 
     // #536: an orphan-clean requeue resumes the interrupted session instead of
     // re-reading the repo from zero. Decided here, before this attempt's row
@@ -2238,6 +2224,12 @@ export async function handleIssue(
       // enforced and the brief rendered, never a re-parse. Absent for a run
       // with no declaration (fail open), exactly as it was admitted.
       lane: admittedLane,
+      // #851: the allowance admission reserved for this run, recorded on the
+      // row before anything launches. Derived from the same caps the gate
+      // read, so the reservation the pass enforced and the one the row holds
+      // are one value; `undefined` (NULL) when the fleet has no spend cap at
+      // all, which is the truth rather than "reserved nothing".
+      spendReservedUsd: runSpendAllowanceUsd(caps) ?? undefined,
     });
     // #434: carry a terminal predecessor's open PR onto the continuation row.
     // The claim itself stays synchronous — `handleIssue` claims at the top of
@@ -2272,17 +2264,24 @@ export async function handleIssue(
     store.enqueueLabelOps(project.name, [{ issue, op: "add", label: inProgress }]);
     claimed = true;
     turnLimit = d.turnLimits.open(project.name, issue, runId, maxTurns);
-    workerControl = d.workerControls.open(project.name, issue, runId);
+    // The pane follows the phase the registry actually reached (#842) — never a
+    // guess made at the call site, and never the pane's own output read back.
+    workerControl = d.workerControls.open(project.name, issue, runId, (phase) => {
+      projectPaneState(
+        phase === "running" ? "working" : "idle",
+        phase === "running" ? "resumed" : `${phase} by the operator`,
+      );
+    });
     if (await settleStopBeforeSession()) return;
     if (await settleDrainBeforeSession()) return;
+    // The credential fence, twice, for the same reason the stop fence is
+    // consulted more than once (#852). Here it is the cheap one: a run whose
+    // required subscription credential is already unavailable is closed before
+    // anything clones a mirror or cuts a worktree, because provisioning for a
+    // launch that cannot happen is pure waste. The second call, immediately
+    // before the spawn, is the one that closes the admission-to-session window.
+    if (await settleCredentialClassBeforeSession()) return;
 
-    // The worker identity is this run's launch gate (#798): a worker session
-    // that cannot be launched under the dedicated unprivileged account is
-    // indistinguishable from an operator shell, so dispatch refuses before any
-    // tree or session is created. Resolved here rather than read off a startup
-    // verdict, so a host that gained its account — or its harness binding
-    // (#828) — after the daemon came up dispatches on the next tick.
-    const identity = launchIdentity(d, "worker session");
 
     // A run's tree is <workspaceRoot>/<issue> and addRunRepo refuses to reuse
     // an existing path, so a retry — or a tree kept from a failed attempt — has
@@ -2366,10 +2365,6 @@ export async function handleIssue(
       },
       {
         ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }),
-        // A worker-run channel is secured to the worker identity (#798): the
-        // child that must connect to it runs as that uid, and the peer verdict
-        // expects that uid on the wire rather than the daemon's.
-        channelOwner: { uid: identity.uid, gid: identity.gid },
       },
     );
     if (await settleStopBeforeSession()) return;
@@ -2384,7 +2379,10 @@ export async function handleIssue(
     // Recorded before the launch, so even a run killed mid-flight leaves the
     // model it chose on its row. Only a chain-configured project writes the
     // column: absent `modelFallbacks` must preserve today's rows byte for byte.
-    if (chainConfigured && choice.model !== undefined) {
+    // An escalated chain (#807) writes it too — the selector it dispatched on
+    // is the whole provenance of that recovery, and its harness-resolved model
+    // lands beside it in `resolvedModel` when the run settles.
+    if ((chainConfigured || escalation !== undefined) && choice.model !== undefined) {
       store.updateRun(runId, { model: choice.model });
     }
 
@@ -2433,24 +2431,27 @@ export async function handleIssue(
     }
     if (await settleStopBeforeSession()) return;
     if (await settleDrainBeforeSession()) return;
+    // Last, so it is the newest fact anything has about the credentials — a
+    // grant disabled since admission is caught here rather than paid for.
+    if (await settleCredentialClassBeforeSession()) return;
 
     const repoSlug = githubRepo(r.repo.cloneUrl);
 
-    // The run's working paths are granted to the worker identity by ownership
-    // (#798) — the worktree the session edits and the session directory it
-    // writes its transcript and settings into. The chown lands here, after
-    // provisioning and the verb socket, so the session starts on a tree it
-    // owns; the worker identity never inherits anything from root's trees.
-    d.grantWorkerPaths?.(identity, worktreePath, sessionDir);
 
     let result: WorkerResult;
     try {
+      const runAllowanceUsd = runSpendAllowanceUsd(caps);
       result = await runWorker({
         brief,
         cwd: worktreePath,
         caps,
         ...(repoSlug === undefined ? {} : { repoSlug }),
         maxTurns: () => turnLimit?.maxTurns() ?? maxTurns,
+        // #851: the allowance this run reserved at admission is also its live
+        // ceiling. Without it the reservation would only bound how many runs
+        // start, not what one of them spends, and the day's total would be
+        // unbounded again.
+        ...(runAllowanceUsd === null ? {} : { maxSpendUsd: runAllowanceUsd }),
         onPauseControl: (control) => {
           workerSessionInstalled = true;
           workerControl?.install(control);
@@ -2469,10 +2470,72 @@ export async function handleIssue(
         onSpawn: (pid) => {
           verbListener?.bindPid(pid);
         },
+        // The workspace representation of this exact child (#840). Best effort by
+        // construction: a worker that cannot be *shown* is still a worker, so a
+        // failure is logged with its reason and the run proceeds. What a failure
+        // should mean for the launch — fail closed, or a named degraded state —
+        // is #841's policy and is deliberately not decided here. Nothing is
+        // claimed silently: either the pane id is logged, or the reason is.
+        pane: {
+          open: (pid) => {
+            // Adopt before creating (#842): a run that already carries a pane
+            // identity gets that pane reported against, never a second one. The
+            // durable row is what makes this survive the process that opened it,
+            // and duplicate-prevention is exactly what it buys — a re-entered
+            // launch for one run must not leave two panes claiming it.
+            const recorded = store.getRun(runId);
+            if (recorded?.paneId !== undefined && recorded.paneLabel !== undefined) {
+              workerPane = { kind: "tracked", paneId: recorded.paneId, label: recorded.paneLabel, pid };
+              store.updateRun(runId, { workerPid: pid });
+              const state = reportWorkerPaneState(recorded.paneId, recorded.paneLabel, "working", {
+                seq: nextPaneSeq(),
+              });
+              log(
+                state.ok
+                  ? `#${issue} herdr pane ${recorded.paneId} re-reported for pid ${pid}`
+                  : `#${issue} herdr pane ${recorded.paneId} could not be re-reported: ${state.reason}`,
+              );
+              return;
+            }
+            const outcome = openWorkerPane({
+              project: project.name,
+              issue,
+              attempt,
+              runId,
+              pid,
+              ...(recorded?.sessionFile === undefined ? {} : { sessionFile: recorded.sessionFile }),
+            });
+            if (outcome.kind === "tracked") {
+              workerPane = outcome;
+              // Durable before it is announced: a pane the store does not know
+              // about is a pane a restart cannot reconcile.
+              store.updateRun(runId, {
+                workerPid: pid,
+                paneId: outcome.paneId,
+                paneLabel: outcome.label,
+                // Cleared, because there is now a pane: a leftover reason beside a
+                // tracked run would keep `status` saying degraded forever (#841).
+                paneUnavailable: null,
+              });
+              log(`#${issue} herdr pane ${outcome.paneId} (${outcome.label}) tracks pid ${pid}`);
+            } else {
+              // Named, never silent (#841): the run proceeds untracked, and the
+              // reason is durable so `status` can say the fleet is running blind
+              // rather than looking identical to a fleet with no workers.
+              store.updateRun(runId, { workerPid: pid, paneUnavailable: outcome.reason });
+              log(`#${issue} no herdr pane: ${outcome.reason}`);
+            }
+          },
+          release: () => {
+            if (workerPane === undefined) return;
+            const released = releaseWorkerPane(workerPane.paneId, workerPane.label, { seq: nextPaneSeq() });
+            if (!released.ok) log(`#${issue} herdr pane release failed: ${released.reason}`);
+            workerPane = undefined;
+          },
+        },
         onChildLog: (line) => {
           log(`#${issue} ${line}`);
         },
-        workerIdentity: identity,
         ...(choice.model === undefined ? {} : { model: choice.model }),
         // The fleet-owned omp settings overlay (#537): the staged YAML the
         // session loads through `Settings.init({ configFiles: [<path>] })` —
@@ -2484,6 +2547,11 @@ export async function handleIssue(
         onReleaseBlocked: workerReleaseBlockRecorder(project.name, issue, runId),
         onTurn: (n) => store.updateRun(runId, { turns: n }),
         onSpend: (usd) => store.updateRun(runId, { spendUsd: usd }),
+        // #518: recorded live, not at settlement — the moment this explains is
+        // forty minutes before the wall-clock cap fires, so a number only a
+        // finished run carries would answer the question too late.
+        onTokens: (tokens) =>
+          store.updateRun(runId, { outputTokens: tokens.output, reasoningTokens: tokens.reasoning }),
         onKilled: () => {
           turnLimit?.close();
           turnLimit = undefined;
@@ -2530,7 +2598,14 @@ export async function handleIssue(
 
     const verified: { state: RunState; reason?: string } =
       result.state === "pushed-green"
-        ? await verifyPushedGreenClaim(tracker, result)
+        ? await verifyPushedGreenClaim(tracker, result, {
+            project: project.name,
+            issue,
+            runId,
+            branch,
+            repo: repoSlug ?? r.repo.name,
+            store,
+          })
         : { state: result.state };
     const state = verified.state;
 
@@ -2932,6 +3007,114 @@ export async function handleIssue(
  * recorded it — merged after all, settled, re-claimed — fails the claim and is
  * settled `skipped` rather than woken on stale identity.
  */
+/**
+ * Record what this host has installed, once per dispatch pass (#919).
+ *
+ * Here rather than at render time, and this is the whole design of the slice:
+ * the read costs three subprocesses, and calling it from the tick took the
+ * tick's own suite from 8.4s to 83.4s while spawning three children every
+ * fifteen minutes to answer a question that changes only when someone installs
+ * something. The dispatch pass is already async and already spawns `gh`, so one
+ * read per pass is free by comparison, and every cheap surface then reads a row.
+ *
+ * Advisory throughout: a probe that throws (no `herdr` on PATH, a `$PATH`
+ * without `omp`) leaves the previous observation in place and logs. A stale
+ * observation is still the truth about the last time anyone could look, and
+ * losing a dispatch pass over a version string would be absurd.
+ */
+/**
+ * Make the workspace agree with the live run set, once per pass (#841).
+ *
+ * Runs on every dispatch pass rather than only at startup, because the thing it
+ * repairs — a Herdr restart — is not a conductor event and announces itself
+ * nowhere. It is idempotent by construction: a reconciled fleet reports `intact`
+ * for every live worker and finds no stale panes, so repeated passes converge
+ * instead of accumulating panes or churning them.
+ *
+ * Nothing here can stop a worker. The only mutations are creating a pane, and
+ * releasing one whose run is not live; the authoritative child is never
+ * signalled, and no pane is ever closed.
+ */
+function reconcilePanes(d: Deps, project: string, log: (message: string) => void): void {
+  const live = d.store.liveRuns(project);
+  const result = reconcileWorkerPanes(
+    live.map((run) => ({
+      runId: run.id,
+      issue: run.issue,
+      attempt: run.attempt,
+      project,
+      ...(run.workerPid === undefined ? {} : { pid: run.workerPid }),
+      ...(run.paneId === undefined ? {} : { paneId: run.paneId }),
+      ...(run.paneLabel === undefined ? {} : { paneLabel: run.paneLabel }),
+      ...(run.sessionFile === undefined ? {} : { sessionFile: run.sessionFile }),
+    })),
+  );
+  if (!result.ok) {
+    // An unreadable workspace is not evidence that anything is stale, so nothing
+    // is released and no run is relabelled — but a fleet that cannot see its own
+    // panes says so, on every pass, rather than going quiet.
+    log(`worker panes not reconciled: ${result.reason}`);
+    return;
+  }
+  for (const outcome of result.outcomes) {
+    switch (outcome.kind) {
+      case "intact":
+        break;
+      case "reassociated":
+        d.store.updateRun(outcome.runId, {
+          paneId: outcome.paneId,
+          paneLabel: outcome.label,
+          paneUnavailable: null,
+        });
+        log(`#${runIssue(live, outcome.runId)} herdr pane re-associated as ${outcome.paneId} after a restart`);
+        break;
+      case "untracked":
+        d.store.updateRun(outcome.runId, { paneId: null, paneLabel: null, paneUnavailable: outcome.reason });
+        log(`#${runIssue(live, outcome.runId)} has no herdr pane: ${outcome.reason}`);
+        break;
+      case "stale-released":
+        log(`released stale herdr pane ${outcome.paneId} (run ${outcome.runId || "unidentified"} is not live)`);
+        break;
+      case "stale-release-failed":
+        log(`stale herdr pane ${outcome.paneId} could not be released: ${outcome.reason}`);
+        break;
+    }
+  }
+}
+
+/** The issue a run id belongs to, for a log line a human reads. */
+function runIssue(live: readonly RunRecord[], runId: string): string {
+  return String(live.find((run) => run.id === runId)?.issue ?? "?");
+}
+
+async function recordInstallSurfaces(d: Deps): Promise<void> {
+  if (d.probeInstallSurfaces === undefined) return;
+  try {
+    const surfaces = await d.probeInstallSurfaces();
+    // The telegram peer's versions ride along on the same pass (#961). Read
+    // here rather than in `status` because `status` runs every tick and this
+    // touches the npm registry: one periodic read, rendered from the store as
+    // often as anyone looks. A read that throws leaves the fields absent, which
+    // renders as unverified — never as agreement.
+    const telegram =
+      d.probeTelegramFreshness === undefined ? undefined : await d.probeTelegramFreshness();
+    const tgInstalled = telegram?.surfaces.installed;
+    const tgDaemon = telegram?.surfaces.daemon;
+    const tgPublished = telegram?.surfaces.published;
+    d.store.recordInstallSurfaces({
+      at: Date.now(),
+      cliVersion: surfaces.cliVersion,
+      ...(surfaces.ompVersion === undefined ? {} : { ompVersion: surfaces.ompVersion }),
+      ...(surfaces.herdrSource === undefined ? {} : { herdrSource: surfaces.herdrSource }),
+      ...(tgInstalled?.kind === "version" ? { telegramInstalled: tgInstalled.version } : {}),
+      ...(tgDaemon?.kind === "version" ? { telegramDaemon: tgDaemon.version } : {}),
+      ...(tgPublished?.kind === "version" ? { telegramPublished: tgPublished.version } : {}),
+    });
+  } catch (err) {
+    log(`install-surface read skipped: ${errText(err)}`);
+  }
+}
+
 export async function dispatchReviewRevisions(d: Deps, pool?: WorkerPool): Promise<void> {
   const pending = d.store.pendingReviewRevisions(d.project.name);
   if (pending.length === 0) return;
@@ -3049,6 +3232,350 @@ export async function dispatchReviewRevisions(d: Deps, pool?: WorkerPool): Promi
   await Promise.allSettled(launches);
 }
 
+/**
+ * Launch the review-ceiling adjudications this project owes (#932).
+ *
+ * Deliberately its own pass, next to {@link dispatchReviewRevisions} but never
+ * inside it: a revision resumes an implementation worker to change code, an
+ * adjudication opens a fresh read-only session to decide about code. Folding
+ * them together is how "escalate the automation" quietly becomes "resume the
+ * same worker with a different label", which is #873's named silent fake.
+ *
+ * Only `pending` rows are launched. A `running` row belongs to a live
+ * adjudicator — or to one a restart killed, which the startup sweep settles —
+ * so a restart re-reads it and never launches a second adjudicator for one head.
+ */
+/**
+ * The turn ceiling for one adjudication (#932).
+ *
+ * Small on purpose, and not the worker cap: a verdict is a read and an answer,
+ * not an implementation. A session still going after this is not deciding — and
+ * the ceiling exists so a stuck adjudicator costs a bounded amount rather than a
+ * worker's whole budget, on work that has already spent its review rounds.
+ */
+export const ADJUDICATION_MAX_TURNS = 40;
+
+export async function dispatchReviewAdjudications(d: Deps, pool?: WorkerPool): Promise<void> {
+  const open = d.store.openReviewAdjudications(d.project.name).filter((a) => a.state === "pending");
+  if (open.length === 0) return;
+  const launches: Promise<void>[] = [];
+  for (const adjudication of open) {
+    if (d.drain?.draining === true) {
+      log(`adjudications held: the daemon is draining (${open.length - launches.length} not launched)`);
+      break;
+    }
+    // The head is re-read before anything launches. A verdict describes the diff
+    // it read, so adjudicating a head the PR has since moved past would produce
+    // a decision about code nobody is merging — settled `stale-head` with both
+    // heads named, never launched.
+    let live: string | undefined;
+    try {
+      live = await d.tracker.prHead(adjudication.prUrl);
+    } catch (err) {
+      log(`#${adjudication.issue} adjudication held: ${adjudication.prUrl} head unreadable (${errText(err)})`);
+      continue;
+    }
+    if (live === undefined) {
+      log(`#${adjudication.issue} adjudication held: ${adjudication.prUrl} head could not be read — retrying next tick`);
+      continue;
+    }
+    if (live.toLowerCase() !== adjudication.headSha.toLowerCase()) {
+      d.store.settleReviewAdjudication(
+        adjudication.id,
+        "stale-head",
+        `recorded ${adjudication.headSha}, live ${live} — the pull request moved before this adjudication launched`,
+        Date.now(),
+      );
+      log(`#${adjudication.issue} adjudication stale-head: recorded ${adjudication.headSha}, live ${live}`);
+      continue;
+    }
+    // The claim IS the single-flight guard: the transition is the row's own
+    // WHERE clause, so two dispatch passes racing one adjudication cannot both
+    // launch — the loser changes nothing and skips.
+    const review = resolveReview(d.project);
+    const provenance = { role: adjudication.role, model: adjudication.role, resolvedAt: Date.now() };
+    if (!d.store.markReviewAdjudicationRunning(adjudication.id, provenance, Date.now())) {
+      log(`#${adjudication.issue} adjudication skipped: another pass already claimed it`);
+      continue;
+    }
+    log(`#${adjudication.issue} adjudication → launching role ${adjudication.role} at ${adjudication.headSha}`);
+    launches.push(handleReviewAdjudication(d, adjudication, review.maxRounds));
+  }
+  if (pool !== undefined) {
+    for (const launch of launches) pool.launch(launch);
+    return;
+  }
+  await Promise.allSettled(launches);
+}
+
+/**
+ * Assemble one adjudication's evidence and run it to a durable verdict (#932).
+ *
+ * Every fact comes from a durable row or a live tracker read — never from the
+ * worker's own report, which is the claim under adjudication. The issue body is
+ * carried verbatim because the acceptance criteria ARE the standard being
+ * judged, and every prior round travels WITH its settled outcome: a finding
+ * without its outcome reads as an outstanding complaint even when the worker
+ * fixed it, which is how an adjudicator rejects work that was already corrected.
+ */
+export async function handleReviewAdjudication(
+  d: Deps,
+  adjudication: ReviewAdjudicationRecord,
+  maxRounds: number,
+): Promise<void> {
+  const issue = adjudication.issue;
+  const [title, body, diff, verification] = await Promise.all([
+    d.tracker.getIssue(issue).then(
+      (row) => row?.title,
+      () => undefined,
+    ),
+    d.tracker.issueBody(issue).then(
+      (text) => text,
+      () => undefined,
+    ),
+    d.tracker.prDiff(adjudication.prUrl).then(
+      (parsed) => parsed,
+      () => undefined,
+    ),
+    d.tracker.verifyPr(adjudication.prUrl, adjudication.headSha).then(
+      (result) => result,
+      () => undefined,
+    ),
+  ]);
+  // Prior rounds, oldest first, keyed by PR so a continuation that inherited the
+  // PR cannot hide its predecessor's findings. The ceiling call's own findings
+  // are appended as the last entry — they are the reason this adjudication
+  // exists, and the durable row is where they were kept precisely so this brief
+  // could carry them.
+  const rounds: AdjudicationRound[] = d.store
+    .reviewRevisionsForPr(d.project.name, adjudication.prUrl)
+    .map((revision) => ({
+      round: revision.round,
+      findings: revision.findings,
+      ...(revision.outcome === undefined ? {} : { outcome: revision.outcome }),
+    }));
+  if (adjudication.findings !== undefined) {
+    rounds.push({
+      round: rounds.length + 1,
+      findings: adjudication.findings,
+      outcome: "escalated to this adjudication — no worker round was available",
+    });
+  }
+  const brief = renderAdjudicationBrief({
+    issue,
+    ...(title === undefined ? {} : { issueTitle: title }),
+    issueBody: body ?? "(the issue body could not be read — judge the diff against the findings below)",
+    prUrl: adjudication.prUrl,
+    headSha: adjudication.headSha,
+    checks:
+      verification === undefined
+        ? "(the check state could not be read)"
+        : `${verification.status} — ${verification.reason}`,
+    diff:
+      diff === undefined
+        ? "(the diff could not be read — say so in your reasons rather than guessing)"
+        : renderDiffForAdjudication(diff),
+    rounds,
+    maxRounds,
+  });
+
+  const sessionDir = join(stateDir(), "sessions", `adjudication-${adjudication.id}`);
+  mkdirSync(sessionDir, { recursive: true });
+  const ompSettingsFile = materializeOmpSettings(d.project, sessionDir);
+  const result = await (d.runAdjudicatorImpl ?? runAdjudicator)({
+    brief,
+    // No worktree: an adjudicator has no branch, and everything it needs is in
+    // the brief. The session directory doubles as its confined cwd.
+    cwd: sessionDir,
+    sessionDir,
+    model: adjudication.role,
+    ...(ompSettingsFile === undefined ? {} : { ompSettingsFile }),
+    socketPath: join(sessionDir, "ipc.sock"),
+    maxTurns: ADJUDICATION_MAX_TURNS,
+  });
+
+  // What actually ran it, named in the evidence when it differs from the role
+  // that was asked for: the provenance recorded at claim time is conductor's own
+  // resolution (the role it passed to OMP), and the model that wrote the
+  // messages is a later observation only this result carries.
+  const ran =
+    result.model === undefined
+      ? ""
+      : `adjudicated by ${result.model}${result.provider === undefined ? "" : ` (${result.provider})`}: `;
+  if (result.verdict === undefined) {
+    // A session that never took a turn did not run: the role could not be
+    // resolved or the harness could not start, and the remedy is configuration
+    // rather than a retry. One that ran and produced nothing usable is a
+    // failure. Neither is ever a clear.
+    const state = result.turns === 0 ? "unavailable-model" : "failed";
+    d.store.settleReviewAdjudication(
+      adjudication.id,
+      state,
+      `${ran}${result.report === "" ? "no verdict and no output" : result.report}`,
+      Date.now(),
+    );
+    log(`#${issue} adjudication ${state} at ${adjudication.headSha}`);
+    return;
+  }
+  // A verdict that names a different head judged something else. Fail closed:
+  // the one-shot is spent on the head it was opened for, and nothing merges on
+  // the strength of a decision about another diff.
+  if (
+    result.verdict.headSha !== undefined &&
+    result.verdict.headSha.toLowerCase() !== adjudication.headSha.toLowerCase()
+  ) {
+    d.store.settleReviewAdjudication(
+      adjudication.id,
+      "stale-head",
+      `${ran}the verdict names head ${result.verdict.headSha}, not the adjudicated ${adjudication.headSha}: ${result.verdict.reasons}`,
+      Date.now(),
+    );
+    log(`#${issue} adjudication stale-head: verdict named ${result.verdict.headSha}`);
+    return;
+  }
+  d.store.settleReviewAdjudication(
+    adjudication.id,
+    result.verdict.verdict,
+    `${ran}${result.verdict.reasons}`,
+    Date.now(),
+  );
+  log(`#${issue} adjudication ${result.verdict.verdict} at ${adjudication.headSha}`);
+}
+
+/**
+ * Apply the terminal dispositions an adjudication's verdict implies (#876).
+ *
+ * The verdict is a decision; this is what is DONE about it, and the two are
+ * separate rows for exactly that reason. Recording `cleared` while leaving the
+ * merge gate refusing, or `rejected` while leaving the PR open to block the
+ * issue forever, is the issue's named silent fake — so what this pass changes is
+ * tracker and gate state, and the disposition text is only its receipt.
+ *
+ * Idempotent by that receipt: a row whose `disposition` is already recorded is
+ * skipped, so a restart, a retried tick or a partial failure cannot close one PR
+ * twice. Nothing here is destructive before its explanation is durable.
+ *
+ * Neither branch opens a review round, launches another adjudicator, or asks an
+ * operator for anything. Neither touches an attempt or continuation budget
+ * either: a rejected PR closes, and the ORDINARY settle sweep charges that
+ * closure exactly as it charges any PR closed without merging — which is what
+ * keeps this composable with #815's separate corrective-worker path instead of
+ * resetting its counters.
+ */
+export async function applyAdjudicationDispositions(d: Deps): Promise<void> {
+  const { project, store } = d;
+  // Terminal rows only, and only those nothing has disposed of yet. Read from
+  // the PRs still in flight: a settled adjudication whose PR is long gone needs
+  // no disposition, and scanning history would re-litigate closed work.
+  const pending = store
+    .activeRuns(project.name)
+    .flatMap((run) => (run.prUrl === undefined ? [] : store.reviewAdjudicationsForPr(project.name, run.prUrl)))
+    .filter((row) => row.settledAt !== undefined && row.disposition === undefined);
+  for (const adjudication of pending) {
+    if (adjudication.state === "cleared") {
+      // The clear re-enters the ORDINARY merge path, and it does so through the
+      // mechanism that path already reads: the #888 gate refuses a head carrying
+      // unresolved review evidence, and #913's clearance is the recorded
+      // disposition that settles it. Reusing it means no second gate, no
+      // adjudication-shaped exception inside `conductor_pr_merge`, and one
+      // audit trail for "this head was cleared, by whom, and why".
+      //
+      // The head is re-read first: a clearance is head-scoped and clears
+      // backwards only, so recording one against a head the PR has moved past
+      // would bless a diff nobody adjudicated.
+      let live: string | undefined;
+      try {
+        live = await d.tracker.prHead(adjudication.prUrl);
+      } catch (err) {
+        log(`#${adjudication.issue} adjudication clearance held: head unreadable (${errText(err)})`);
+        continue;
+      }
+      if (live === undefined) {
+        log(`#${adjudication.issue} adjudication clearance held: head could not be read — retrying next tick`);
+        continue;
+      }
+      if (live.toLowerCase() !== adjudication.headSha.toLowerCase()) {
+        // Visible and non-destructive: the clearance is not recorded, the row
+        // says why, and the PR keeps whatever gate state it has.
+        store.recordReviewAdjudicationDisposition(
+          adjudication.id,
+          `no clearance recorded: the head moved from ${adjudication.headSha} to ${live} after the verdict`,
+        );
+        log(`#${adjudication.issue} adjudication clearance skipped: head moved to ${live}`);
+        continue;
+      }
+      store.recordReviewClearance({
+        project: project.name,
+        prUrl: adjudication.prUrl,
+        headSha: adjudication.headSha,
+        by: `adjudication:${adjudication.role}`,
+        reason: `cleared by the review-ceiling adjudication: ${adjudication.evidence ?? "no evidence recorded"}`,
+      });
+      store.recordReviewAdjudicationDisposition(
+        adjudication.id,
+        `recorded a review clearance at ${adjudication.headSha}; the PR is on the ordinary merge path`,
+      );
+      log(`#${adjudication.issue} adjudication cleared → merge path open at ${adjudication.headSha}`);
+      continue;
+    }
+    // Every non-clear terminal state disposes the same way, and that is
+    // deliberate: `rejected`, `failed`, `unavailable-model` and `stale-head` all
+    // mean "this head is not merging and no further round is coming", and the
+    // blocking artefact is identical in each case — an open PR that occupies the
+    // issue. Only the recorded reason differs.
+    const findings = store
+      .reviewRevisionsForPr(project.name, adjudication.prUrl)
+      .map((revision) => `### Review round ${revision.round} (${revision.outcome ?? "never settled"})
+
+${revision.findings}`);
+    const comment = [
+      `## Adjudication: ${adjudication.state}`,
+      "",
+      `The review-round ceiling was reached on ${adjudication.headSha}, and the \`${adjudication.role}\` adjudicator ` +
+        `did not clear it. Closing this pull request so the issue is not blocked by work that cannot merge — ` +
+        "nothing here asks anyone to repair it by hand.",
+      "",
+      "### Adjudicator's reasons",
+      "",
+      adjudication.evidence ?? "(none recorded)",
+      ...(findings.length === 0 ? [] : ["", "## Preserved review findings", "", ...findings]),
+      "",
+      "The branch itself is untouched and remains in the repository.",
+    ].join("\n");
+    const closed = await d.verbActions?.closePr(adjudication.prUrl, comment);
+    if (closed === undefined) {
+      log(`#${adjudication.issue} adjudication disposition held: no action surface is wired`);
+      continue;
+    }
+    if (!closed.ok) {
+      // Retryable, and no receipt written: the next tick tries again rather than
+      // leaving a rejected PR open with a row that claims it was handled.
+      log(`#${adjudication.issue} adjudication disposition held: could not close ${adjudication.prUrl} — ${closed.stderr}`);
+      continue;
+    }
+    store.recordReviewAdjudicationDisposition(
+      adjudication.id,
+      `closed ${adjudication.prUrl} with the adjudicator's reasons and every preserved finding; ` +
+        "the settle sweep releases the issue",
+    );
+    log(`#${adjudication.issue} adjudication ${adjudication.state} → closed ${adjudication.prUrl}`);
+  }
+}
+
+/** The diff as one text, from the structured read the settlement audit uses.
+ *  `renderAdjudicationBrief` bounds the total; this only flattens it, and says
+ *  when the adapter itself had to cut the read short — an adjudicator must know
+ *  its silence covers only what it saw. */
+function renderDiffForAdjudication(diff: PrDiff): string {
+  const files = diff.files.map((file) =>
+    [
+      `--- ${file.status} ${file.previousPath === undefined ? "" : `${file.previousPath} → `}${file.path}`,
+      file.hunks ?? "(no textual hunks: binary, mode-only or pure rename)",
+    ].join("\n"),
+  );
+  return [...(diff.truncated ? ["[the tracker truncated this diff read]"] : []), ...files].join("\n\n");
+}
+
 /**
  * Resume one review-revision worker: the run row is already claimed
  * (`pushed-green` → `running` by the dispatch pass), so this resumes the SAME
@@ -3169,20 +3696,38 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
     // stopped anything, the PR is still green and still open, and only the
     // wake failed; `settleStopBeforeSession` immediately above covers the
     // case where an operator genuinely did. So mirror that branch: restore
-    // `pushed-green` naming the shutdown, settle the revision `skipped` so
-    // the round is not double-counted, and leave the in-progress label alone
-    // — the ordinary settle sweep releases it in the same breath it
+    // `pushed-green` naming the shutdown, and leave the in-progress label
+    // alone — the ordinary settle sweep releases it in the same breath it
     // terminalises the row when the PR resolves. Stopping the row here would
     // strand it: `settlePushedGreen` sweeps only pushed-* rows and
     // classification excludes `stopped`, so the issue would carry neither
     // label and nothing would ever revisit the still-green PR.
+    //
+    // The round itself is RE-QUEUED rather than settled `skipped` (#903). A
+    // daemon shutdown is the plainest infrastructure kill there is — no
+    // session started, so no round was worked — and a settled row consumed
+    // one of the PR's rounds through `latestReviewRound`, which is how an
+    // upgrade or a restart used to cost a review round it never spent. The
+    // retry is counted and bounded exactly like any other infra kill, so a
+    // host that shuts down mid-wake forever still escalates.
     store.updateRun(runId, {
       state: "pushed-green",
       endedAt: Date.now(),
       lastError: "daemon shutdown began after the review revision claim; the round was not launched",
     });
-    store.settleReviewRevision(revision.id, "skipped", Date.now());
-    log(`#${issue} review round ${revision.round} not launched: daemon shutdown began after the claim`);
+    const retry = store.retryReviewRevisionAfterInfra(revision.id, REVIEW_ROUND_INFRA_MAX_RETRIES);
+    if (retry.kind === "exhausted") {
+      store.settleReviewRevision(revision.id, "skipped", Date.now());
+      log(
+        `#${issue} review round ${revision.round} not launched: daemon shutdown began after the claim, and ` +
+          `its infra retries are exhausted (${retry.retries}/${REVIEW_ROUND_INFRA_MAX_RETRIES}) — settled skipped`,
+      );
+      return true;
+    }
+    log(
+      `#${issue} review round ${revision.round} not launched: daemon shutdown began after the claim — ` +
+        `re-queued, retry ${retry.retries}/${REVIEW_ROUND_INFRA_MAX_RETRIES}`,
+    );
     return true;
   };
 
@@ -3215,14 +3760,7 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
   if (await settleStopBeforeSession()) return;
   if (await settleDrainBeforeSession()) return;
 
-  // The same launch gate as a fresh claim (#798): a revision worker is a
-  // worker, and an unbound one is an operator shell — refuse before any tree
-  // or session is created. Thrown inside the try so the ordinary dispatch
-  // catch settles it: the run row is returned to terminal `failed` with the
-  // reason, the revision row is settled with it, and the still-green PR stays
-  // open for a healthy retry.
   try {
-    const identity = launchIdentity(d, "review-revision worker");
     // Reattach the run's own branch at the same per-issue path the run used:
     // a `pushed-green` settle removed the worktree, so provisioning is the
     // same continuation reattach as a normal re-claim. A capped/failed run's
@@ -3337,7 +3875,6 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
       },
       {
         ...(d.verbPeerReader === undefined ? {} : { peerReader: d.verbPeerReader }),
-        channelOwner: { uid: identity.uid, gid: identity.gid },
       },
     );
     if (await settleStopBeforeSession()) return;
@@ -3350,22 +3887,26 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
     // totals the run already recorded.
     const baseTurns = run.turns;
     const baseSpend = run.spendUsd;
+    const baseOutputTokens = run.outputTokens ?? 0;
+    const baseReasoningTokens = run.reasoningTokens ?? 0;
 
     log(`#${issue} review round ${revision.round} → resuming ${branch} (${priorSessionFile})`);
 
-    // The revision worker gets its own tree ownership, exactly as a fresh
-    // claim does (#798): the resumed worktree and session directory belong to
-    // the worker identity before its session starts.
-    d.grantWorkerPaths?.(identity, worktreePath, sessionDir);
 
     let result: WorkerResult;
     try {
+      const runAllowanceUsd = runSpendAllowanceUsd(caps);
       result = await runWorker({
         brief: renderReviewRevisionPrompt(revision.findings, revision.round),
         cwd: worktreePath,
         caps,
         ...(repoSlug === undefined ? {} : { repoSlug }),
         maxTurns: () => turnLimit?.maxTurns() ?? run.maxTurns,
+        // A review round meters its own session from zero and gets the same
+        // allowance as any run (#851) — the round is real work with a real
+        // cost, and an unbounded round would reopen the hole for any PR that
+        // was ever returned for revision.
+        ...(runAllowanceUsd === null ? {} : { maxSpendUsd: runAllowanceUsd }),
         onPauseControl: (control) => {
           workerSessionInstalled = true;
           workerControl?.install(control);
@@ -3382,7 +3923,6 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
         onChildLog: (line) => {
           log(`#${issue} ${line}`);
         },
-        workerIdentity: identity,
         // The continuation stays on the model the green run used (#286).
         ...(run.model === undefined ? {} : { model: run.model }),
         ...(ompSettingsFile === undefined ? {} : { ompSettingsFile }),
@@ -3390,6 +3930,14 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
         onReleaseBlocked: workerReleaseBlockRecorder(project.name, issue, runId),
         onTurn: (n) => store.updateRun(runId, { turns: baseTurns + n }),
         onSpend: (usd) => store.updateRun(runId, { spendUsd: baseSpend + usd }),
+        // A revision resumes the SAME run, so its tokens add to the attempt's
+        // totals exactly as its turns and spend do (#518) — resetting them would
+        // make a long deliberation look like a fresh one.
+        onTokens: (tokens) =>
+          store.updateRun(runId, {
+            outputTokens: baseOutputTokens + tokens.output,
+            reasoningTokens: baseReasoningTokens + tokens.reasoning,
+          }),
         onKilled: () => {
           turnLimit?.close();
           turnLimit = undefined;
@@ -3418,7 +3966,14 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
 
     const verified: { state: RunState; reason?: string } =
       result.state === "pushed-green"
-        ? await verifyPushedGreenClaim(tracker, result)
+        ? await verifyPushedGreenClaim(tracker, result, {
+            project: project.name,
+            issue,
+            runId,
+            branch,
+            repo: repoSlug ?? repo.name,
+            store,
+          })
         : { state: result.state };
     const state = verified.state;
 
@@ -3481,6 +4036,63 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
       report: finalReport,
       ...settlement?.patch,
     };
+    // #903: an infrastructure kill spends no review round.
+    //
+    // A dispatch that dies before the resumed session takes a turn — a host
+    // permission fault, a spawn failure, a harness that could not start — did
+    // none of the work a round exists to do, yet the pre-#903 path settled the
+    // row `failed` with no retry. During the 2026-08-21/22 outage that turned
+    // one broken mount into a review-ceiling deadlock: three such deaths
+    // consumed the PR's three rounds, `conductor_pr_review` then refused any
+    // further round, and the findings could never be addressed by a worker at
+    // all. Nothing in the loop could recover it.
+    //
+    // So the round is returned to the pending set instead: the same row, the
+    // same round number, the same findings, and the run restored to the exact
+    // `pushed-green` state the verb recorded — which is what the restart
+    // reconcile already does for a round a dying daemon interrupted. The next
+    // dispatch pass resumes the same session. Bounded by
+    // REVIEW_ROUND_INFRA_MAX_RETRIES and counted durably on the row, so a
+    // permanently broken host escalates through the ordinary failed path
+    // instead of retrying every tick forever.
+    const infraKill =
+      state === "failed" || state === "killed"
+        ? reviewRoundNeverWorked({
+            turns: result.turns,
+            ...(result.prUrl === undefined ? {} : { prUrl: result.prUrl }),
+            ...(result.headSha === undefined ? {} : { headSha: result.headSha }),
+            ...(settlement?.patch?.salvageSha === undefined
+              ? {}
+              : { salvageSha: settlement.patch.salvageSha }),
+          })
+        : undefined;
+    if (infraKill !== undefined) {
+      const retry = store.retryReviewRevisionAfterInfra(revision.id, REVIEW_ROUND_INFRA_MAX_RETRIES);
+      if (retry.kind === "requeued") {
+        const detail =
+          `review round ${revision.round} was killed before its session took a turn ` +
+          `(${infraKill}); the round is re-queued, retry ${retry.retries}/${REVIEW_ROUND_INFRA_MAX_RETRIES}`;
+        store.updateRun(runId, {
+          ...terminalPatch,
+          state: "pushed-green",
+          // The transcript the round must still resume is the one the run
+          // recorded, not whatever this dead dispatch opened: a session that
+          // never took a turn has no lineage of its own to inherit.
+          sessionFile: priorSessionFile,
+          report: [`review round ${revision.round}: dispatch killed before turn 1`, "", detail].join("\n"),
+          lastError: detail,
+        });
+        // No label swap and no escalation: nothing failed that a human can
+        // act on yet, the issue keeps its in-progress label, and the next
+        // dispatch pass picks the round up on its own.
+        log(`#${issue} ${detail}`);
+        return;
+      }
+      log(
+        `#${issue} review round ${revision.round} exhausted its infra retries ` +
+          `(${retry.retries}/${REVIEW_ROUND_INFRA_MAX_RETRIES}) — settling it the ordinary way`,
+      );
+    }
     if (state === "stopped") {
       recordOperatorStop(store, {
         project: project.name,
@@ -3592,6 +4204,35 @@ export async function handleReviewRevision(d: Deps, revision: ReviewRevisionReco
             publish,
             tree: "keep",
           });
+    // A crash BEFORE the worker session was installed spent no round (#903):
+    // nothing resumed, nothing was reviewed, and the round is re-queued for
+    // the next pass instead of consuming one of the PR's three. Once the
+    // session is installed the round belongs to the worker, and a crash after
+    // that settles the ordinary way below — including the exhausted case, so
+    // a dispatch that keeps throwing still reaches a human.
+    if (!workerSessionInstalled) {
+      const retry = store.retryReviewRevisionAfterInfra(revision.id, REVIEW_ROUND_INFRA_MAX_RETRIES);
+      if (retry.kind === "requeued") {
+        store.updateRun(runId, {
+          state: "pushed-green",
+          endedAt: Date.now(),
+          sessionFile: priorSessionFile,
+          lastError:
+            `review round ${revision.round} could not be dispatched (${detail}); the round is re-queued, ` +
+            `retry ${retry.retries}/${REVIEW_ROUND_INFRA_MAX_RETRIES}`,
+          ...settlement?.patch,
+        });
+        log(
+          `#${issue} review round ${revision.round} re-queued after a pre-session dispatch error — ` +
+            `retry ${retry.retries}/${REVIEW_ROUND_INFRA_MAX_RETRIES}`,
+        );
+        return;
+      }
+      log(
+        `#${issue} review round ${revision.round} exhausted its infra retries ` +
+          `(${retry.retries}/${REVIEW_ROUND_INFRA_MAX_RETRIES}) — failing the round`,
+      );
+    }
     store.updateRun(runId, {
       state: "failed",
       endedAt: Date.now(),
@@ -4341,16 +4982,26 @@ export interface WorkerPool {
   drain(): Promise<void>;
 }
 
-/** Keeps background workers alive without making the five-minute tick await them. */
-export function createWorkerPool(): WorkerPool {
+/**
+ * Keeps background workers alive without making the five-minute tick await them.
+ *
+ * `onSettled` fires as each worker leaves the pool, whichever way it ended
+ * (#878): that is the instant a slot frees, and without it queued work waited
+ * for the next scheduled pass — up to five minutes of idle capacity that reads,
+ * from outside, exactly like a stalled queue. It only *prompts* a pass; every
+ * hold, drain, lane, budget and routing gate is re-evaluated by that pass as
+ * usual.
+ */
+export function createWorkerPool(onSettled?: () => void): WorkerPool {
   const active = new Set<Promise<void>>();
   return {
     launch(work) {
       active.add(work);
-      void work.then(
-        () => active.delete(work),
-        () => active.delete(work),
-      );
+      const settled = (): void => {
+        active.delete(work);
+        onSettled?.();
+      };
+      void work.then(settled, settled);
     },
     activeCount: () => active.size,
     async drain() {
@@ -4671,6 +5322,14 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   } catch (err) {
     log(`label reconcile failed: ${errText(err)}`);
   }
+  try {
+    // Same phase, same reason as the label reconcile above: a durable row the
+    // tracker has moved past (#964). A separate call because that one iterates
+    // labelled issues, and a promotable issue carries no label.
+    await reconcileGroomingClosures(d);
+  } catch (err) {
+    log(`grooming closure reconcile failed: ${errText(err)}`);
+  }
 
   // Drain the label projection outbox (#201). The maintenance phases above may
   // have enqueued ops (settlement releases, recovery requeues, reconciles);
@@ -4864,6 +5523,28 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     log(`review revision dispatch failed: ${errText(err)}`);
   }
 
+  // Adjudications are dispatch too (#932), and their own pass: an adjudication
+  // occupies no worker slot and no issue — it opens a fresh read-only session
+  // about a PR whose run has already settled — so it is neither bounded by the
+  // worker cap nor allowed to consume a review round. Placed after revisions so
+  // a PR with a live revision is never adjudicated in the same tick it is being
+  // corrected in; the head re-read inside the pass is the durable guard.
+  try {
+    await dispatchReviewAdjudications(d, workers);
+  } catch (err) {
+    log(`adjudication dispatch failed: ${errText(err)}`);
+  }
+
+  // And what the verdicts imply (#876). Its own pass, after dispatch, because a
+  // disposition acts on a SETTLED adjudication: running it before dispatch would
+  // simply be a tick late, and running it inside dispatch would tie a tracker
+  // mutation to the launch that produced the verdict.
+  try {
+    await applyAdjudicationDispositions(d);
+  } catch (err) {
+    log(`adjudication dispositions failed: ${errText(err)}`);
+  }
+
   // route() filters the queue through isEligible() itself, so anything already
   // carrying a state label is gone before it gets here.
   const ready = await d.tracker.listReady();
@@ -4882,7 +5563,65 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     const pending = store.pendingLabelOpsFor(project.name, issue.number);
     return pending.length === 0 ? issue : { ...issue, labels: effectiveLabels(issue.labels, pending) };
   });
-  const { routed, unroutable } = route(effective, project);
+  // Post-unblock stale-list revalidation (#891). `listReady` is a
+  // label-FILTERED search, and GitHub's search index is eventually consistent:
+  // measured 2026-08-22T09:18Z, an `unblock` cleared `agent:failed` and
+  // restored the queue label, `gh issue view` returned the clean label set
+  // immediately, and the very next pass still saw the stale labels, held #889
+  // as `stale-lifecycle` and left the fleet at 0/5 with four spare slots. The
+  // next scheduled pass usually recovers — this is throughput, not correctness
+  // — but an operator-driven unblock that cannot refill the fleet has not done
+  // what it says.
+  //
+  // So a lifecycle label read from the LIST is a suspicion, not a verdict: the
+  // exact per-issue read decides. Bounded to candidates that would otherwise be
+  // dropped for a lifecycle label — never the whole queue — and further to those
+  // whose newest run is not active (a genuinely in-flight issue needs no
+  // revalidation; its own row is the authority) and that are not operator-parked
+  // (a park is a decision, not a stale label).
+  //
+  // An unreadable exact read keeps the stale labels, so the issue stays out of
+  // this pass, and is held as `issue-state-lookup-error` rather than
+  // `stale-lifecycle`: "the tracker could not say" is not evidence of a
+  // residual label, and it must not summon Duty 1 to reconcile a label nobody
+  // has read.
+  const stateLabelSet = new Set(Object.values(project.stateLabels));
+  const suspect = effective.filter(
+    (issue) =>
+      !isEligible(issue, project) &&
+      issue.labels.some((l) => stateLabelSet.has(l)) &&
+      !issue.labels.includes(project.stateLabels.backlog) &&
+      !ACTIVE_STATES.includes(store.latestRun(project.name, issue.number)?.state ?? "merged"),
+  );
+  const revalidated = new Map<number, readonly string[]>();
+  const unreadable = new Set<number>();
+  for (const issue of suspect) {
+    let snapshot: IssueSnapshot | undefined;
+    try {
+      snapshot = await d.tracker.issueSnapshot(issue.number);
+    } catch {
+      snapshot = undefined;
+    }
+    if (snapshot === undefined) {
+      unreadable.add(issue.number);
+      log(`#${issue.number} lifecycle labels could not be revalidated — holding this pass`);
+      continue;
+    }
+    // A closed issue is nobody's candidate; leave the list labels alone and let
+    // the ordinary gates speak.
+    if (snapshot.state === "closed") continue;
+    if (snapshot.labels.join("\u0000") === issue.labels.join("\u0000")) continue;
+    revalidated.set(issue.number, snapshot.labels);
+    log(`#${issue.number} lifecycle labels revalidated: the queue list was stale`);
+  }
+  const verified =
+    revalidated.size === 0
+      ? effective
+      : effective.map((issue) => {
+          const live = revalidated.get(issue.number);
+          return live === undefined ? issue : { ...issue, labels: [...live] };
+        });
+  const { routed, unroutable } = route(verified, project);
   // route() drops a candidate for two reasons, only one of which is a claim
   // question. A lifecycle state label (agent:in-progress/blocked/failed)
   // marks a run-owned issue: it is genuinely in flight while its newest run
@@ -4894,9 +5633,10 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // close), which belongs in none of the three populations. So `claimed` is
   // defined from actual ownership over genuinely lifecycle-labelled candidates
   // rather than as the residual of routing (#228, #611).
-  const stateLabels = new Set(Object.values(project.stateLabels));
-  const dropped = effective.filter(
-    (issue) => !isEligible(issue, project) && issue.labels.some((l) => stateLabels.has(l)),
+  // Every population below reads the VERIFIED list, so a candidate the exact
+  // read cleared is not simultaneously admitted and counted as held (#891).
+  const dropped = verified.filter(
+    (issue) => !isEligible(issue, project) && issue.labels.some((l) => stateLabelSet.has(l)),
   );
   // The operator's park label is not a stale lifecycle label: the queue query
   // still returns a parked-and-queued issue, route() drops it as ineligible,
@@ -4905,7 +5645,7 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // to reconcile a deliberate decision. Parked is its own population, derived
   // from the same isEligible read the gate uses, so the number status renders
   // cannot disagree with what admission would hold (#507).
-  const parkedCandidates = effective.filter(
+  const parkedCandidates = verified.filter(
     (issue) => !isEligible(issue, project) && issue.labels.includes(project.stateLabels.backlog),
   );
   const parkedNumbers = new Set(parkedCandidates.map((issue) => issue.number));
@@ -4920,6 +5660,14 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
       // A park never kills a live run; a parked issue with no run is inventory
       // the operator is deliberately holding, not reconciliation work.
       parked += 1;
+    } else if (unreadable.has(issue.number)) {
+      // Fail closed, and say which read failed: a tracker that could not answer
+      // is not evidence of a residual label (#891).
+      lifecycleHolds.push({
+        issue: issue.number,
+        reason: "issue-state-lookup-error",
+        detail: "lifecycle labels could not be revalidated against the exact issue read",
+      });
     } else {
       lifecycleHolds.push({ issue: issue.number, reason: "stale-lifecycle" });
     }
@@ -5021,6 +5769,8 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     return;
   }
   recordDispatch(pass.admitted.length, [...routingHolds, ...pass.holds]);
+  await recordInstallSurfaces(d);
+  reconcilePanes(d, project.name, log);
 
   if (pass.admitted.length === 0) return;
 
@@ -5514,8 +6264,34 @@ export interface StatusSnapshot {
    * materialises it, so this is never absent on a real daemon.
    */
   review: ReviewPolicy;
-  /** Occupied issues: live workers plus green PRs awaiting a human merge. */
+  /** Occupied issues: live workers plus green PRs awaiting a human merge. Both
+   *  lifecycle kinds, told apart by {@link StatusSnapshot.leasedRunIds}. */
   activeRuns: RunRecord[];
+  /**
+   * The subset of {@link StatusSnapshot.activeRuns} holding an **active
+   * mutation lease** (#898): a live worker, or a dispatched unsettled review
+   * revision. Everything else in `activeRuns` is a worker-free preserved
+   * artifact — durable work awaiting review, merge or recovery, with nothing
+   * writing to it.
+   *
+   * Carried as ids rather than a second run list so the two renderings cannot
+   * disagree about the rows themselves, and derived from `Store.leasedRuns` —
+   * the same query admission's file-lane gate and `conductor_pr_recover` read,
+   * so what status calls a lease is exactly what those two enforce (#899,
+   * #925). A plain array so the dashboard's JSON round-trip preserves it.
+   */
+  leasedRunIds?: readonly string[];
+  /**
+   * The review-ceiling adjudications an operator needs to see (#874): every
+   * non-terminal one, plus the terminal one for each active run's PR head — so a
+   * cleared or rejected verdict stays visible for exactly as long as the PR it
+   * decided is still in flight, and disappears with it rather than accumulating.
+   *
+   * Keyed by nothing: the records carry their own `prUrl` and `headSha`, which is
+   * how the renderer matches them to a run without inventing a second identity
+   * for a PR.
+   */
+  reviewAdjudications?: readonly ReviewAdjudicationRecord[];
   /**
    * runId → live review-revision round, for runs whose revision worker is
    * currently dispatched (#692). Derived from the durable `review_revisions`
@@ -5524,7 +6300,22 @@ export interface StatusSnapshot {
    * (not a Map) so the dashboard's JSON round-trip of the snapshot preserves
    * it byte for byte.
    */
-  reviewRounds?: Readonly<Record<string, number>>;
+  /**
+   * The live review round per run: its number AND the instant it was dispatched
+   * (#802). The instant is what makes the line honest — a resumed session's
+   * `turns` and `startedAt` are cumulative over the whole attempt, so without a
+   * phase boundary a fresh revision reads as though it had been running for
+   * hours.
+   */
+  reviewRounds?: Readonly<Record<string, { round: number; dispatchedAt: number }>>;
+  /**
+   * runId → the durable review evidence blocking a merge of the run's
+   * pushed-green PR at its exact recorded head (#888). Derived from the same
+   * `review_revisions` rows `conductor_pr_merge` refuses on, so status can
+   * never present a green PR as merge-ready while the privileged verb will
+   * refuse it. An absent entry means nothing blocks that run's head.
+   */
+  mergeBlockers?: Readonly<Record<string, ReviewHeadBlocker>>;
   /** Newest attempts holding a preserved WIP tip, or a tree that is still the
    *  only copy of work the daemon could not save. */
   salvagedRuns: RunRecord[];
@@ -5558,6 +6349,20 @@ export interface StatusSnapshot {
   liveWorkers: number;
   runsToday: number;
   spendTodayUsd: number;
+  /** The install identities the last dispatch pass recorded (#919). Absent
+   *  means no pass has looked yet, which the renderer says out loud rather
+   *  than presenting as agreement. */
+  installSurfaces?: InstallSurfaceObservation;
+  /** What live runs have reserved out of today's budget but not yet spent
+   *  (#851). Optional so a caller that built a snapshot before reservations
+   *  existed renders no figure rather than a fabricated zero. */
+  reservedSpendUsd?: number;
+  /**
+   * Whether the figure above is built on runs that actually reported cost
+   * (#970). Absent when the caller did not judge it; the renderer then says
+   * nothing rather than implying the telemetry is sound.
+   */
+  spendTelemetry?: SpendTelemetryVerdict;
   dispatch?: DispatchSummary;
   /**
    * Latest plan-allowance verdict, when the caller read one. Optional because
@@ -5632,12 +6437,50 @@ export function statusSnapshotFromStore(
   // (#776 review #2).
   const live = store.liveRuns(p.name);
   const active = store.activeRuns(p.name);
+  // Which of those active rows something is actually writing through (#898).
+  // The same query admission's file-lane gate and `conductor_pr_recover` read,
+  // so status cannot call a row a lease that those two treat as released, or
+  // vice versa (#899, #925).
+  const leasedRunIds = store.leasedRuns(p.name).map((r) => r.id);
+  // Adjudications worth rendering (#874): the open ones always, plus a terminal
+  // verdict for a head an active run is still sitting on. Bounded by the active
+  // set rather than by a history window, so a fleet with a thousand settled
+  // adjudications renders the handful that still describe live work.
+  const openAdjudications = store.openReviewAdjudications(p.name);
+  const adjudicationIds = new Set(openAdjudications.map((a) => a.id));
+  const reviewAdjudications = [...openAdjudications];
+  for (const r of active) {
+    if (r.prUrl === undefined || r.headSha === undefined) continue;
+    const decided = store.reviewAdjudicationForHead(p.name, r.prUrl, r.headSha);
+    if (decided !== undefined && !adjudicationIds.has(decided.id)) {
+      adjudicationIds.add(decided.id);
+      reviewAdjudications.push(decided);
+    }
+  }
   // The live review-revision rounds, read from the same durable rows the
   // restart recovery uses: a run whose revision is dispatched is read as
   // `review-revision N` while its worker is live (#692).
-  const reviewRounds: Record<string, number> = {};
+  const reviewRounds: Record<string, { round: number; dispatchedAt: number }> = {};
   for (const revision of store.unsettledReviewRevisions(p.name)) {
-    if (revision.dispatchedAt !== undefined) reviewRounds[revision.runId] = revision.round;
+    if (revision.dispatchedAt !== undefined) {
+      reviewRounds[revision.runId] = { round: revision.round, dispatchedAt: revision.dispatchedAt };
+    }
+  }
+  // The exact-head merge blockers (#888), read from the same durable rows the
+  // merge verb consults: a pushed-green run whose PR stands at a head carrying
+  // unresolved review evidence — a round queued there, crashed mid-review
+  // there, or settled `failed` there.
+  const mergeBlockers: Record<string, ReviewHeadBlocker> = {};
+  for (const r of active) {
+    if (r.prUrl === undefined || r.headSha === undefined) continue;
+    const blocker = store.mergeBlockingReviews(p.name, r.prUrl, r.headSha)[0];
+    if (blocker !== undefined) {
+      mergeBlockers[r.id] = {
+        round: blocker.round,
+        state:
+          blocker.settledAt !== undefined ? "failed" : blocker.dispatchedAt !== undefined ? "crashed" : "pending",
+      };
+    }
   }
   return {
     project: p.name,
@@ -5662,6 +6505,8 @@ export function statusSnapshotFromStore(
     releaseGrants: resolveReleaseGrants(p),
     review: resolveReview(p),
     activeRuns: active,
+    leasedRunIds,
+    reviewAdjudications,
     reviewRounds,
     salvagedRuns: store.salvagedRuns(p.name),
     quarantinedRuns: store.quarantinedRuns(p.name),
@@ -5672,6 +6517,19 @@ export function statusSnapshotFromStore(
     liveWorkers: live.length,
     runsToday: store.runsStartedSince(p.name, since),
     spendTodayUsd: store.spendSince(p.name, since),
+    reservedSpendUsd: store.reservedSpendUsd(p.name),
+    // Judged from the store on the same read as the figure above (#970), so the
+    // row that qualifies the spend number cannot disagree with it, and nothing
+    // is probed at render time.
+    spendTelemetry: judgeSpendTelemetry(
+      store.recentSpendSamples?.(p.name, SPEND_SAMPLE_ROWS) ?? [],
+      SPEND_SAMPLE_RUNS,
+    ),
+    // Read, never probed: the recorded row is the whole point (#919).
+    ...(() => {
+      const observed = store.installSurfaces();
+      return observed === undefined ? {} : { installSurfaces: observed };
+    })(),
     ...(dispatch === undefined ? {} : { dispatch }),
     ...(planUsage === undefined ? {} : { planUsage }),
     // Written by the tracker's hooks rather than polled, so the renderer does
@@ -5683,6 +6541,7 @@ export function statusSnapshotFromStore(
       : { labelOps: { pending: labelOpsPending, oldestAgeMs: now - oldestLabelOpAt } }),
     baseHealth: store.baseHealth(p.name),
     freezes: store.freezes(p.name),
+    mergeBlockers,
     ...(orchestratorDown === undefined ? {} : { orchestratorDown }),
   };
 }
@@ -5736,8 +6595,15 @@ export function formatDispatchSummary(summary?: DispatchSummary): string {
         lines.push(`    ${hold.reason}  ${hold.count}${sample}`);
         // A `file-lane` hold groups several issues, each blocked by a different
         // file and holder; the grouped line says how many, this says which.
-        if ((hold.details?.length ?? 0) > 0) {
-          lines.push(`      ${hold.details!.join(" | ")}`);
+        //
+        // Deduplicated for display only, never in the record: a fleet-wide hold
+        // (`credential-class`, #852) gives every held candidate the *same*
+        // sentence, and printing one reason five times reads as five problems.
+        // The persisted details stay index-aligned with `issues` — a reader that
+        // needs "which issue got which detail" still has it.
+        const details = [...new Set(hold.details ?? [])];
+        if (details.length > 0) {
+          lines.push(`      ${details.join(" | ")}`);
         }
       }
     }
@@ -5803,71 +6669,6 @@ export function formatFreezes(freezes: readonly BaseFreeze[]): string[] {
 }
 
 
-export function formatStatus(s: StatusSnapshot): string {
-  const lines = [
-    `project   ${s.project}${s.paused ? "  (PAUSED)" : ""}`,
-    `config    ${s.configPath}`,
-    `state     ${s.stateDir}`,
-    "",
-    ...(s.orchestratorDown === undefined ? [] : formatOrchestratorDown(s.orchestratorDown)),
-    "caps",
-    `  workers            ${s.liveWorkers} / ${s.caps.maxConcurrentWorkers}`,
-    `  issues today       ${s.runsToday}`,
-    s.caps.dailySpendUsd === null
-      ? `  spend today        $${s.spendTodayUsd.toFixed(2)} (no daily cap)`
-      : `  spend today        $${s.spendTodayUsd.toFixed(2)} / $${s.caps.dailySpendUsd.toFixed(2)}`,
-    // Its own row, never folded into the spend row: they are two independent
-    // controls, and an operator has to be able to see which one stopped the
-    // fleet (#110).
-    `  plan usage         ${planUsageLine(s.planUsage)}`,
-    `  new worker turns   ${s.caps.workerMaxTurns}`,
-    ...s.turnOverrides.map(
-      ({ issue, maxTurns }) => `  turn override      #${issue} → ${maxTurns} (next attempt)`,
-    ),
-    `  worker wall clock  ${Math.round(s.caps.workerWallClockMs / 60_000)}m`,
-    `  failed attempts    ${s.caps.maxAttemptsPerIssue}`,
-    `  continuations      ${s.caps.maxContinuationsPerIssue}`,
-    "",
-    ...formatReleaseGrants(s.releaseGrants),
-    "",
-    formatDispatchSummary(s.dispatch),
-    "",
-  ];
-  if (s.activeRuns.length === 0) {
-    lines.push("active runs  (none)");
-  } else {
-    lines.push("active runs");
-    for (const r of s.activeRuns) {
-      lines.push(
-        `  #${r.issue}  ${r.repo}  ${r.state}  attempt ${r.attempt}  ` +
-          `${r.turns}/${r.maxTurns} turns  $${r.spendUsd.toFixed(2)}  ${r.branch}` +
-          (r.prUrl ? `  ${r.prUrl}` : ""),
-      );
-      // Its escalation was deduplicated the moment it was delivered, so this
-      // line is the only place a flagged run stays visible while its PR waits
-      // for a merge — which is precisely the window the flag is about (#128).
-      const flagged = settlementFlagSummary(r.settlementFlags);
-      if (flagged !== undefined) lines.push(`      ${flagged}`);
-    }
-  }
-  lines.push(...formatBaseHealth(s.baseHealth));
-  lines.push(...formatFreezes(s.freezes));
-  lines.push(...formatSalvagedRuns(s.salvagedRuns));
-  lines.push(...formatQuarantinedRuns(s.quarantinedRuns));
-  lines.push(...formatOpenReports(s.openReports));
-  lines.push(...formatVerbLedger(s.verbLedger));
-  // Deploy hint: a restart while workers are live orphans them (salvage runs
-  // first — #35). Prefer pause + drain to zero live workers when you can wait.
-  if (s.liveWorkers > 0) {
-    lines.push(
-      "",
-      `deploy    ${s.liveWorkers} live worker(s) — restart salvages dirty trees then orphans the rows; ` +
-        `pause and wait for workers 0/${s.caps.maxConcurrentWorkers} when you can drain instead`,
-    );
-  }
-  return lines.join("\n");
-}
-
 export interface QueuePreview {
   project: string;
   configPath: string;
@@ -6250,32 +7051,21 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   const store = openStore(dbPath());
   const verbPeerReader = peerCredentialReader();
   const verbDir = ensureVerbSocketDir(stateDir());
-  // The worker identity (#798). Probed once here for the startup banner only —
-  // every dispatch re-resolves it through {@link launchIdentity}, because the
-  // account, setpriv and the harness binding (#828) are all host state that can
-  // arrive after this process did. A host that cannot establish it keeps its
-  // control plane running and fails each worker launch closed with the reason,
-  // so the operator hears a concrete host change instead of a fleet that
-  // silently ran workers as root.
-  const identityAtStartup = resolveWorkerIdentity();
-  if (identityAtStartup.ok) {
-    log(
-      `worker identity: ${identityAtStartup.identity.account} uid=${identityAtStartup.identity.uid} ` +
-        `gid=${identityAtStartup.identity.gid} home=${identityAtStartup.identity.home}`,
-    );
-  } else {
-    log(
-      "worker identity unavailable — worker dispatch fails closed until the host provides it " +
-        `(re-checked at every launch, so no restart is needed once it does): ${identityAtStartup.reason}`,
-    );
-  }
   const integrity: IntegrityGate = { baseline: packageManifest(), paged: false };
   const usage = sharedUsageSource();
   const turnLimits = createTurnLimitRegistry((runId, maxTurns) => {
     store.updateRun(runId, { maxTurns });
   });
   const workerControls = createWorkerControlRegistry();
-  const workers = createWorkerPool();
+  // Created before the pool so a worker's completion can poke the loop it
+  // shares with the interval sleep (#878).
+  const pace = createDispatchPace();
+  const workers = createWorkerPool(() => {
+    // Sticky and coalescing by construction: several workers settling together
+    // produce one pass, and a pass already running absorbs the request rather
+    // than overlapping. No second owner is created and no gate is skipped.
+    pace.requestWake();
+  });
   const alive = livingDaemon();
   const runtimes: ProjectRuntime[] = [];
 
@@ -6322,6 +7112,21 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
             : pushRunBranch(project, { repo, runRepoPath: run.worktree, branch });
       };
       for (const run of await reconcileOrphanedRuns(store, project.name, orphanPublisher)) {
+        // The workspace outlives the process, so a restart inherits panes whose
+        // workers are gone (#842). A session-host child dies with the daemon that
+        // owned its socket, so an orphaned row's pane is authoritatively dead
+        // whatever its recorded pid says — pids are reused, and matching one
+        // would be the mechanism that makes a stranger's process read as a live
+        // worker. Release (never close) so lifecycle authority goes back to
+        // Herdr and the pane stops claiming a worker conductor no longer runs.
+        const orphanPane = releaseOrphanedWorkerPane(run);
+        if (orphanPane.kind === "released") {
+          projectLog(
+            `#${run.issue} herdr pane ${orphanPane.paneId} released: its worker died with the previous daemon`,
+          );
+        } else if (orphanPane.kind === "failed") {
+          projectLog(`#${run.issue} herdr pane ${orphanPane.paneId} release failed: ${orphanPane.reason}`);
+        }
         projectLog(
           `#${run.issue} orphaned by a previous daemon (attempt ${run.attempt}, was ${run.state}, ` +
             `worktree ${run.worktree}) — slot freed; the ${project.stateLabels.inProgress} label stays ` +
@@ -6446,17 +7251,27 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
       cleanup: { next: 0 },
       probeCriticalBase: (repo, markers, branch) =>
         probeCriticalBase(project, repo, branch, markers),
+      // The same seam `doctor` and `upgrade` read (#904/#919), never a second
+      // implementation. `readHerdr` stays on: a host that runs herdr is the
+      // case where a stale recovery pin matters, and a host without it answers
+      // "absent", which no cheap surface treats as a fault.
+      probeInstallSurfaces: () => inspectSurfaces({ run: runCommand, log, env: process.env }),
+      probeTelegramFreshness: () =>
+        // The module's own reader, so the daemon, `doctor` and `status` cannot
+        // come to disagree about what is installed (#961).
+        checkTelegramFreshness({
+          run: async (cmd, args) => {
+            const r = await runCommand(cmd, args);
+            return { code: r.code, stdout: r.stdout };
+          },
+        }),
       probeWorktreeLane: (input) => probeRunLane(input),
-      // The live host, per launch — never the startup verdict above.
-      workerIdentity: () => resolveWorkerIdentity(),
-      // Grant each run's paths to the worker identity by ownership, before the
-      // session that must edit them starts (#798). The recursive chown runs as
-      // root from the dispatch path; the worker identity owns its checkout and
-      // transcript and nothing else.
-      grantWorkerPaths: (identity, worktreePath, sessionDir) => {
-        chownRecursive(worktreePath, identity.uid, identity.gid);
-        chownRecursive(sessionDir, identity.uid, identity.gid);
-      },
+      // The credential-class fence's reader (#852): the runnable probe module,
+      // spawned against the live credential store. Wired once here so the
+      // admission gate and the launch fence ask the same question through the
+      // same transport — two readers would eventually disagree, and the one that
+      // disagreed by passing is the expensive one.
+      probeCredentialClass: (provider) => probeCredentialClass(provider),
       // A cross-repo Depends-on prerequisite reads through the same GitHub
       // credential/accounting seams as the project tracker — a fresh tracker
       // scoped to the referenced repo, reusing the daemon's gh hooks so API
@@ -6498,6 +7313,31 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
         projectLog(`review revision restart recovery failed: ${errText(err)}`);
       }
     }
+    // Adjudication restart recovery (#932). An adjudication is `running` only
+    // while a session it launched is alive, and that session died with the
+    // previous process — nothing resumes it, because an adjudicator has no
+    // branch, no worktree and no transcript worth continuing: its whole output
+    // is a verdict it never produced.
+    //
+    // So it settles `failed`, which is honest and terminal, rather than being
+    // left `running` forever (a row nothing would ever touch again) or silently
+    // re-queued (a second launch for one head, which the one-shot exists to
+    // prevent). The one shot for that head is spent, and #876's disposition path
+    // reads `failed` exactly as it reads any other non-clear verdict.
+    if (alive === undefined || alive.pid === process.pid) {
+      for (const adjudication of store.openReviewAdjudications(project.name)) {
+        if (adjudication.state !== "running") continue;
+        store.settleReviewAdjudication(
+          adjudication.id,
+          "failed",
+          "the daemon restarted while this adjudication was running; no verdict was produced",
+          Date.now(),
+        );
+        projectLog(
+          `#${adjudication.issue} adjudication failed across restart — its session died with the previous daemon`,
+        );
+      }
+    }
     // Startup reconciliation: close an incident carried over from a previous
     // process when the orchestrator is up (one recovery notice), or open one
     // when it failed to start (one down page). A daemon restarted while still
@@ -6595,7 +7435,6 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   // The wake surface (#380): `resume` POSTs /wake, `stop` interrupts the same
   // sleep. A wake request is sticky and coalescing — several resumes in quick
   // succession produce one prompt pass, never an overlapping one.
-  const pace = createDispatchPace();
   const stop = (): void => {
     if (stopping) return;
     stopping = true;