omp-conductor 0.18.2 → 0.19.0

package/src/store.ts

@@ -16,7 +16,12 @@ import { dirname, join } from "node:path";
 
 import { backupTimestamp, publishTempFile } from "./backups.ts";
 import { stateDir } from "./config.ts";
-import { DECISION_TTL_MS, DEFAULT_CAPS, DIGEST_BACKLOG_LIMIT } from "./types.ts";
+import {
+  DECISION_TTL_MS,
+  DEFAULT_CAPS,
+  DIGEST_BACKLOG_LIMIT,
+  TERMINAL_REVIEW_ADJUDICATION_STATES,
+} from "./types.ts";
 
 /**
  * `expiresAt` for a watch (#459). It has no human deadline — a condition that
@@ -53,24 +58,34 @@ import type {
   HeldNoticeDraft,
   IntakeDraft,
   IntakeItem,
+  InstallSurfaceObservation,
   IntakeState,
   MaterialEvent,
   MaterialEventDraft,
   LabelOp,
   MergeLock,
+  ModelEscalation,
   OrchestratorDownMode,
   OrchestratorIncident,
   OrchestratorIncidentDraft,
+  ReleaseComposition,
+  ReleaseCompositionOverride,
   ReportDeliveryState,
   ReportDraft,
   ReportEnqueue,
   ReportKind,
   ReportRecord,
   RecoveryAction,
+  ReviewClearance,
   ReviewReason,
+  ReviewAdjudicationAdmission,
+  ReviewAdjudicationProvenance,
+  ReviewAdjudicationRecord,
+  ReviewAdjudicationState,
   ReviewRevisionEnqueue,
   ReviewRevisionOutcome,
   ReviewRevisionRecord,
+  ReviewRevisionRetry,
   RunPatch,
   RunRecord,
   RunState,
@@ -156,6 +171,7 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   turns: true,
   maxTurns: true,
   spendUsd: true,
+  spendReservedUsd: true,
   provider429Count: true,
   resolvedModel: true,
   resolvedProvider: true,
@@ -165,6 +181,12 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   autoRetryCount: true,
   autoCompactionCount: true,
   sessionFile: true,
+  workerPid: true,
+  paneId: true,
+  paneLabel: true,
+  paneUnavailable: true,
+  outputTokens: true,
+  reasoningTokens: true,
   resumedFromRunId: true,
   lane: true,
   prUrl: true,
@@ -197,6 +219,12 @@ type SqlValue = string | number | null;
 /** The `runs` table exactly as SQLite hands it back: optional means NULL. */
 interface RunRow {
   id: string;
+  workerPid: number | null;
+  paneId: string | null;
+  paneLabel: string | null;
+  paneUnavailable: string | null;
+  outputTokens: number | null;
+  reasoningTokens: number | null;
   project: string;
   issue: number;
   repo: string;
@@ -207,6 +235,8 @@ interface RunRow {
   turns: number;
   maxTurns: number;
   spendUsd: number;
+  /** NULL for a row admitted with no spend cap, or one written before #851. */
+  spendReservedUsd: number | null;
   provider429Count: number | null;
   resolvedModel: string | null;
   resolvedProvider: string | null;
@@ -294,6 +324,45 @@ function toBaseFreeze(row: BaseFreezeRow): BaseFreeze {
   return freeze;
 }
 
+/** The `release_composition` table exactly as SQLite hands it back (#850). */
+interface ReleaseCompositionRow {
+  project: string;
+  campaign: string;
+  /** JSON-encoded array of full PR URLs. */
+  allowedPrUrls: string;
+  declaredBy: string | null;
+  declaredAt: number;
+  closedAt: number | null;
+  closedBy: string | null;
+  closedReason: string | null;
+}
+
+function toReleaseComposition(row: ReleaseCompositionRow): ReleaseComposition {
+  const composition: ReleaseComposition = {
+    campaign: row.campaign,
+    allowedPrUrls: JSON.parse(row.allowedPrUrls) as string[],
+    declaredAt: row.declaredAt,
+  };
+  if (row.declaredBy !== null) composition.declaredBy = row.declaredBy;
+  if (row.closedAt !== null) {
+    composition.closedAt = row.closedAt;
+    if (row.closedBy !== null) composition.closedBy = row.closedBy;
+    if (row.closedReason !== null) composition.closedReason = row.closedReason;
+  }
+  return composition;
+}
+
+/** The `release_composition_overrides` table exactly as SQLite hands it back (#850). */
+interface ReleaseCompositionOverrideRow {
+  id: string;
+  project: string;
+  campaign: string;
+  prUrl: string;
+  at: number;
+  by: string;
+  reason: string;
+}
+
 interface FrictionRollupRow {
   project: string;
   day: string;
@@ -413,6 +482,19 @@ interface ReviewRevisionRow {
   dispatchedAt: number | null;
   settledAt: number | null;
   outcome: string | null;
+  /** Nullable rather than NOT NULL DEFAULT 0: rows written before #903 carry
+   *  NULL, which reads back as absent and counts as zero retries. */
+  infraRetries: number | null;
+}
+
+/** The `model_escalations` table exactly as SQLite hands it back (#807). Every
+ *  column is NOT NULL, so the row is the record once `failureClass` is read
+ *  back as the enum the writer narrowed it from. */
+interface ModelEscalationRow {
+  model: string;
+  failureClass: string;
+  runId: string;
+  at: number;
 }
 
 /**
@@ -436,6 +518,64 @@ function toReviewRevision(row: ReviewRevisionRow): ReviewRevisionRecord {
   if (row.dispatchedAt !== null) record.dispatchedAt = row.dispatchedAt;
   if (row.settledAt !== null) record.settledAt = row.settledAt;
   if (row.outcome !== null) record.outcome = row.outcome as ReviewRevisionOutcome;
+  // Zero and NULL both read back as absent: a round nobody has retried and a
+  // row written before the column existed are the same fact.
+  if (row.infraRetries !== null && row.infraRetries > 0) record.infraRetries = row.infraRetries;
+  return record;
+}
+
+/**
+ * The `review_clearances` table exactly as SQLite hands it back (#913). Every
+ * column is NOT NULL, so the row *is* the record — no converter needed.
+ */
+type ReviewClearanceRow = ReviewClearance;
+
+/** The `review_adjudications` table exactly as SQLite hands it back (#874). */
+interface ReviewAdjudicationRow {
+  id: string;
+  project: string;
+  issue: number;
+  prUrl: string;
+  headSha: string;
+  role: string;
+  provenance: string | null;
+  state: string;
+  evidence: string | null;
+  disposition: string | null;
+  requestedAt: number;
+  dispatchedAt: number | null;
+  settledAt: number | null;
+  findings: string | null;
+}
+
+/** NULL columns become absent properties, like every other converter here, so
+ *  a record read back deep-equals the one that went in. Unparseable
+ *  provenance reads as absent rather than throwing: a corrupt JSON blob must
+ *  not make an otherwise-readable adjudication unreadable, and "no launch
+ *  recorded" is the honest degraded answer. */
+function toReviewAdjudication(row: ReviewAdjudicationRow): ReviewAdjudicationRecord {
+  const record: ReviewAdjudicationRecord = {
+    id: row.id,
+    project: row.project,
+    issue: row.issue,
+    prUrl: row.prUrl,
+    headSha: row.headSha,
+    role: row.role,
+    state: row.state as ReviewAdjudicationState,
+    requestedAt: row.requestedAt,
+  };
+  if (row.provenance !== null) {
+    try {
+      record.provenance = JSON.parse(row.provenance) as ReviewAdjudicationProvenance;
+    } catch {
+      // left absent
+    }
+  }
+  if (row.evidence !== null) record.evidence = row.evidence;
+  if (row.disposition !== null) record.disposition = row.disposition;
+  if (row.dispatchedAt !== null) record.dispatchedAt = row.dispatchedAt;
+  if (row.settledAt !== null) record.settledAt = row.settledAt;
+  if (row.findings !== null) record.findings = row.findings;
   return record;
 }
 
@@ -560,6 +700,9 @@ CREATE TABLE IF NOT EXISTS runs (
   turns       INTEGER NOT NULL,
   maxTurns    INTEGER NOT NULL,
   spendUsd    REAL    NOT NULL,
+  -- What admission reserved out of the daily budget for this run (#851).
+  -- Nullable: an older row, or one admitted while the fleet had no cap.
+  spendReservedUsd REAL,
   provider429Count INTEGER,
   resolvedModel TEXT,
   resolvedProvider TEXT,
@@ -569,6 +712,25 @@ CREATE TABLE IF NOT EXISTS runs (
   autoRetryCount INTEGER,
   autoCompactionCount INTEGER,
   sessionFile TEXT,
+  -- The worker's exact process and workspace identity (#842). The pid is the
+  -- session-host child the pane was reported for; the pane id and label are what
+  -- Herdr knows it as. Nullable throughout: a historical row never had one, a
+  -- run whose host has no Herdr never gets one, and NULL is the honest answer in
+  -- both cases rather than a pane nobody can find.
+  workerPid   INTEGER,
+  paneId      TEXT,
+  paneLabel   TEXT,
+  -- Why this run has no workspace representation (#841). Set when a pane could
+  -- not be established or was lost, cleared when one is. Its presence beside a
+  -- live run is what makes "degraded" a named state in status output rather than a
+  -- silence the operator has to notice.
+  paneUnavailable TEXT,
+  -- Cumulative output and reasoning tokens (#518). Nullable: a historical row
+  -- predates the accounting, and a provider that reports no token block leaves
+  -- them absent rather than zero -- "reported nothing" and "produced nothing"
+  -- invite opposite readings, and a zero would make the share silently wrong.
+  outputTokens    INTEGER,
+  reasoningTokens INTEGER,
   resumedFromRunId TEXT,
   lane        TEXT,
   prUrl       TEXT,
@@ -641,6 +803,38 @@ CREATE TABLE IF NOT EXISTS base_freeze (
   PRIMARY KEY (project, repo)
 );
 
+-- The active release composition (#850): the campaign whose release a project
+-- is assembling plus the exact PRs allowed into it. While closedAt IS NULL,
+-- prMergeVerb refuses every other conductor_pr_merge with the
+-- outside-active-release refusal, so an early patch cannot accumulate
+-- unrelated merges; the clear columns hold the completion/cancellation audit
+-- on the row itself, and material_events carry the immutable lifecycle trail.
+CREATE TABLE IF NOT EXISTS release_composition (
+  project       TEXT    PRIMARY KEY,
+  campaign      TEXT    NOT NULL,
+  allowedPrUrls TEXT    NOT NULL,
+  declaredBy    TEXT,
+  declaredAt    INTEGER NOT NULL,
+  closedAt      INTEGER,
+  closedBy      TEXT,
+  closedReason  TEXT
+);
+
+-- Append-only operator overrides admitting exactly one PR into one campaign
+-- (#850). An override applies to its campaign only — it never outlives the
+-- release it was recorded for, and bypasses nothing but the composition check.
+CREATE TABLE IF NOT EXISTS release_composition_overrides (
+  id       TEXT    PRIMARY KEY,
+  project  TEXT    NOT NULL,
+  campaign TEXT    NOT NULL,
+  prUrl    TEXT    NOT NULL,
+  at       INTEGER NOT NULL,
+  by       TEXT    NOT NULL,
+  reason   TEXT    NOT NULL
+);
+CREATE INDEX IF NOT EXISTS release_composition_overrides_lookup
+  ON release_composition_overrides (project, campaign, prUrl, at);
+
 CREATE TABLE IF NOT EXISTS notifications (
   "key" TEXT    PRIMARY KEY,
   at    INTEGER NOT NULL
@@ -668,6 +862,23 @@ CREATE TABLE IF NOT EXISTS turn_override_ledger (
 CREATE INDEX IF NOT EXISTS turn_override_ledger_project_at
   ON turn_override_ledger (project, setAt);
 
+-- The one-shot model escalation an issue chain has spent (#807). The primary
+-- key IS the cap: the insert either creates the chain's only escalation or
+-- changes nothing, so a settlement that crashes between claiming and queueing
+-- the continuation can never hand the same chain a second tier on restart, and
+-- a second spinning cap falls through to the existing decomposition verdict.
+-- Never deleted: the row is also what dispatch reads to keep the escalated
+-- chain on its stronger selector.
+CREATE TABLE IF NOT EXISTS model_escalations (
+  project      TEXT    NOT NULL,
+  issue        INTEGER NOT NULL CHECK (issue > 0),
+  model        TEXT    NOT NULL,
+  failureClass TEXT    NOT NULL,
+  runId        TEXT    NOT NULL,
+  at           INTEGER NOT NULL CHECK (at >= 0),
+  PRIMARY KEY (project, issue)
+);
+
 CREATE TABLE IF NOT EXISTS dispatch_summaries (
   project   TEXT PRIMARY KEY,
   summary   TEXT NOT NULL
@@ -833,7 +1044,11 @@ CREATE TABLE IF NOT EXISTS review_revisions (
   requestedAt  INTEGER NOT NULL,
   dispatchedAt INTEGER,
   settledAt    INTEGER,
-  outcome      TEXT
+  outcome      TEXT,
+  -- Infrastructure kills that returned this round to the pending set (#903).
+  -- Nullable so an older database migrates by ALTER without a rewrite; NULL
+  -- and 0 mean the same thing.
+  infraRetries INTEGER
 );
 CREATE INDEX IF NOT EXISTS review_revisions_pending
   ON review_revisions (project, dispatchedAt, runId);
@@ -847,6 +1062,111 @@ CREATE UNIQUE INDEX IF NOT EXISTS review_revisions_one_pending_per_run
   ON review_revisions (runId)
   WHERE dispatchedAt IS NULL AND settledAt IS NULL;
 
+-- One recorded review clearance (#913): the explicit orchestrator disposition
+-- that the durable review findings standing at one exact head are settled.
+--
+-- The #888 merge gate had no reachable clearance at an unchanged head. A
+-- re-review at the same head appends to (or opens) an unsettled row, so it
+-- blocks too, and nothing an orchestrator can call settles a round — a PR at
+-- the review-round ceiling was therefore permanently unmergeable at that head.
+-- This table is that missing disposition, kept deliberately separate from the
+-- merge call's own reason argument so the override is a recorded act with its
+-- own ledger row rather than a sentence in a merge.
+--
+-- Append-only: a second clearance at the same head is another row, and its
+-- recorded timestamp is load-bearing -- the gate honours a clearance only for
+-- revision rows whose own last activity is at or before it, so a clearance can
+-- never bless a *later* finding at the same head.
+CREATE TABLE IF NOT EXISTS review_clearances (
+  id      TEXT    PRIMARY KEY,
+  project TEXT    NOT NULL,
+  prUrl   TEXT    NOT NULL,
+  headSha TEXT    NOT NULL,
+  at      INTEGER NOT NULL,
+  by      TEXT    NOT NULL,
+  reason  TEXT    NOT NULL
+);
+CREATE INDEX IF NOT EXISTS review_clearances_lookup
+  ON review_clearances (project, prUrl, headSha, at);
+
+-- One terminal review-ceiling adjudication (#874): the durable lifecycle that
+-- makes the final adjudication a recorded act rather than an in-memory fourth
+-- review round.
+--
+-- The one-shot guarantee is the UNIQUE index below, not a flag a caller
+-- remembers to check: a repeated tick, two dispatchers, or a daemon restart all
+-- collide on (project, prUrl, headSha) and re-read the existing row. The exact
+-- head is part of that key on purpose — a verdict describes the diff it read,
+-- so it must never travel to a head nobody adjudicated.
+--
+-- Deliberately NOT a row in review_revisions. Reusing round N+1 there would
+-- spend a worker review round the ceiling has already exhausted, and would
+-- resume the same session and model for a nominal fourth opinion, which is the
+-- failure #873 exists to end. The tables also answer different questions: a
+-- revision is "go and change this"; an adjudication is "decide about this".
+--
+-- state carries the verdict: the terminal states ARE it (cleared, rejected,
+-- unavailable-model, stale-head, failed), so there is no second verdict column
+-- to disagree with them. evidence says why, and disposition (written by
+-- #876) says what was done about it.
+CREATE TABLE IF NOT EXISTS review_adjudications (
+  id           TEXT    PRIMARY KEY,
+  project      TEXT    NOT NULL,
+  issue        INTEGER NOT NULL,
+  prUrl        TEXT    NOT NULL,
+  headSha      TEXT    NOT NULL,
+  role         TEXT    NOT NULL,
+  -- The resolved launch provenance (#875) as JSON, absent while pending: no
+  -- model has resolved yet, and recording an intention as provenance would make
+  -- status claim a launch that never happened.
+  provenance   TEXT,
+  state        TEXT    NOT NULL,
+  evidence     TEXT,
+  disposition  TEXT,
+  requestedAt  INTEGER NOT NULL,
+  dispatchedAt INTEGER,
+  settledAt    INTEGER,
+  -- The findings that provoked the escalation (#932): what the orchestrator was
+  -- submitting when it hit the ceiling. Nullable so an older database migrates
+  -- by ALTER, and because an adjudication opened by any other path has none.
+  -- Kept here rather than as a review_revisions round because a round would
+  -- spend a ceiling that is already exhausted and would wake a worker; this is
+  -- evidence for the adjudicator, not work for an implementer.
+  findings     TEXT
+);
+-- The one-shot identity, structural rather than advisory: at most one
+-- adjudication per PR head, ever.
+CREATE UNIQUE INDEX IF NOT EXISTS review_adjudications_one_per_head
+  ON review_adjudications (project, prUrl, headSha);
+-- Restart recovery and the status projection both read the non-terminal rows
+-- for one project; the PR lookup answers "is this head adjudicated".
+CREATE INDEX IF NOT EXISTS review_adjudications_open
+  ON review_adjudications (project, settledAt);
+
+-- The install identities the host carried when the daemon last looked (#919).
+-- One row (the primary key is a constant): the question is what is installed
+-- NOW, and the install history is the upgrade journal's job. Recorded by the
+-- dispatch pass because reading it costs three subprocesses -- doing that at
+-- render time took the tick suite from 8.4s to 83.4s and would spawn three
+-- children every fifteen minutes forever.
+CREATE TABLE IF NOT EXISTS install_surfaces (
+  host        TEXT    PRIMARY KEY,
+  at          INTEGER NOT NULL,
+  cliVersion  TEXT    NOT NULL,
+  ompVersion  TEXT,
+  herdrSource TEXT,
+  -- The one peer plugin a documented conductor contract runs on (#961). Carried
+  -- on this row rather than in a table of its own because it is read by the same
+  -- periodic pass, about the same host, for the same reason: an install that
+  -- diverged from what is running or published, observed without an on-demand
+  -- doctor run (#919). Every column is nullable — a pass that could not reach
+  -- the registry records what it did read and leaves the rest unobserved, which
+  -- the renderer must show as "unverified" and never as agreement.
+  tgInstalled TEXT,
+  tgDaemon    TEXT,
+  tgPublished TEXT
+);
+
 -- Questions the orchestrator has put to its operator, and their answers (#136).
 --
 -- The reason this is a table and not the session's memory: a question lived only
@@ -879,9 +1199,20 @@ CREATE TABLE IF NOT EXISTS decisions (
   conditionHead  TEXT,
   state          TEXT    NOT NULL,
   resolvedAt     INTEGER,
-  resolution     TEXT
+  resolution     TEXT,
+  -- One spec-out questionnaire (#947): N rows written in a single transaction,
+  -- delivered as one message, resolved independently and in any order. Nullable
+  -- because every ordinary single ask has neither: a historical row was never
+  -- part of a group and must not read as a group of one, and specIssue is what
+  -- makes a group's answers the spec's provenance rather than chat history.
+  groupId        TEXT,
+  specIssue      INTEGER
 );
 CREATE INDEX IF NOT EXISTS decisions_project_state ON decisions (project, state);
+-- The groupId index is NOT here on purpose: this whole script runs before the
+-- additive migrations, and on a database written before #947 the column does not
+-- exist yet, so an index over it here fails the entire schema step. It is created
+-- beside the ALTER that adds the column, which every open path runs.
 
 -- One issue's current grooming verdict (#735), the durable answer to "has
 -- this been groomed, and what was decided" that the tick reads instead of
@@ -1133,7 +1464,14 @@ function toRecord(row: RunRow): RunRecord {
     spendUsd: row.spendUsd,
     startedAt: row.startedAt,
   };
+  if (row.spendReservedUsd !== null) record.spendReservedUsd = row.spendReservedUsd;
   if (row.sessionFile !== null) record.sessionFile = row.sessionFile;
+  if (row.workerPid !== null) record.workerPid = row.workerPid;
+  if (row.paneId !== null) record.paneId = row.paneId;
+  if (row.paneLabel !== null) record.paneLabel = row.paneLabel;
+  if (row.paneUnavailable !== null) record.paneUnavailable = row.paneUnavailable;
+  if (row.outputTokens !== null) record.outputTokens = row.outputTokens;
+  if (row.reasoningTokens !== null) record.reasoningTokens = row.reasoningTokens;
   if (row.resumedFromRunId !== null) record.resumedFromRunId = row.resumedFromRunId;
   if (row.lane !== null) {
     const lane = toLane(row.lane);
@@ -1246,6 +1584,8 @@ interface DecisionRow {
   state: string;
   resolvedAt: number | null;
   resolution: string | null;
+  groupId: string | null;
+  specIssue: number | null;
 }
 
 /** Same NULL-to-absent contract as {@link toReport}. */
@@ -1268,6 +1608,8 @@ function toDecision(row: DecisionRow): DecisionRecord {
   if (row.conditionHead !== null) record.conditionHead = row.conditionHead;
   if (row.resolvedAt !== null) record.resolvedAt = row.resolvedAt;
   if (row.resolution !== null) record.resolution = row.resolution;
+  if (row.groupId !== null) record.groupId = row.groupId;
+  if (row.specIssue !== null) record.specIssue = row.specIssue;
   return record;
 }
 
@@ -1619,6 +1961,23 @@ export function openStore(dbPath: string): Store {
   if (!columns.some((column) => column.name === "quarantineDetail")) {
     db.exec("ALTER TABLE runs ADD COLUMN quarantineDetail TEXT");
   }
+  // The worker's process/workspace identity (#842). Rows written before it exists
+  // carry none, which is the truth: nothing reported a pane for them, so there is
+  // no pane for a restart to reconcile. Nothing is backfilled — a pid guessed
+  // after the fact is the one thing worse than no pid, because a reused pid reads
+  // as a live worker.
+  for (const [name, type] of [
+    ["workerPid", "INTEGER"],
+    ["paneId", "TEXT"],
+    ["paneLabel", "TEXT"],
+    ["paneUnavailable", "TEXT"],
+    ["outputTokens", "INTEGER"],
+    ["reasoningTokens", "INTEGER"],
+  ] as const) {
+    if (!columns.some((column) => column.name === name)) {
+      db.exec(`ALTER TABLE runs ADD COLUMN ${name} ${type}`);
+    }
+  }
   // Rows written before the settlement audit existed (#128) were never audited,
   // so a NULL here means "no audit ran" and reads the same as "found nothing".
   // That conflation is deliberate and harmless: the flags are advisory, and no
@@ -1646,6 +2005,17 @@ export function openStore(dbPath: string): Store {
       db.exec(`ALTER TABLE runs ADD COLUMN ${name} ${type}`);
     }
   }
+  // The telegram plugin's three versions (#961), on the existing host row. A
+  // store written before this release has no observation of them, and NULL is
+  // the honest reading: the periodic pass that reads them had not shipped, so
+  // the renderer says "unverified" until the next pass rather than implying the
+  // versions agreed.
+  const surfaceColumns = db.query<{ name: string }, []>("PRAGMA table_info(install_surfaces)").all();
+  for (const name of ["tgInstalled", "tgDaemon", "tgPublished"] as const) {
+    if (!surfaceColumns.some((column) => column.name === name)) {
+      db.exec(`ALTER TABLE install_surfaces ADD COLUMN ${name} TEXT`);
+    }
+  }
   // The model a run dispatched on was first written by the modelFallbacks
   // failover chain (#286). Rows predating the column are NULL, which is the
   // honest reading: only a chain-configured project records a model, and the
@@ -1762,7 +2132,64 @@ export function openStore(dbPath: string): Store {
   if (!decisionColumns.some((column) => column.name === "conditionHead")) {
     db.exec("ALTER TABLE decisions ADD COLUMN conditionHead TEXT");
   }
+  // The spec-out questionnaire (#947). Both columns are nullable and NULL is the
+  // truthful value for every historical row: it was a single ask, not one item
+  // of a group, and it specced nothing. The index is created here too, so an
+  // upgraded database reads groups as fast as a fresh one.
+  for (const [name, type] of [
+    ["groupId", "TEXT"],
+    ["specIssue", "INTEGER"],
+  ] as const) {
+    if (!decisionColumns.some((column) => column.name === name)) {
+      db.exec(`ALTER TABLE decisions ADD COLUMN ${name} ${type}`);
+    }
+  }
+  db.exec("CREATE INDEX IF NOT EXISTS decisions_group ON decisions (groupId)");
+  // Already-met watches, written before the deadline existed (#966). Unlike the
+  // head binding above this IS backfilled, and the difference is that nothing is
+  // being guessed: `conditionMetAt` is a recorded observation, and the deadline
+  // is arithmetic on it.
+  //
+  // It has to be a migration rather than a re-observation, because
+  // `markDecisionConditionMet` refuses a row whose `conditionMetAt` is already
+  // set — deliberately, so the digest flag cannot look new every tick. Without
+  // this, the three watches that motivated the fix would have kept
+  // "[CONDITION MET — act on this now]" forever and the fix would have applied
+  // only to conditions that fire in the future.
+  //
+  // Narrow on purpose: open watches only, only where the deadline is still the
+  // infinite sentinel. A resolved row is history, a question's deadline runs
+  // from `askedAt`, and a watch that somehow already carries a finite deadline
+  // is left exactly as it is.
+  db.run(
+    `UPDATE decisions
+        SET expiresAt = conditionMetAt + ?
+      WHERE kind = 'watch'
+        AND state = 'open'
+        AND conditionMetAt IS NOT NULL
+        AND expiresAt = ?`,
+    [DECISION_TTL_MS, DECISION_WATCH_NEVER_EXPIRES],
+  );
+  // The per-run spend reservation (#851). Rows written before it existed hold
+  // no reservation, which is the truth: admission never took one for them.
+  if (!columns.some((column) => column.name === "spendReservedUsd")) {
+    db.exec("ALTER TABLE runs ADD COLUMN spendReservedUsd REAL");
+  }
+  // Infra retries on a review round (#903). Historical rows were never
+  // retried — the path did not exist, every infra kill settled `failed` — so
+  // NULL is the honest reading and counts as zero.
+  const reviewRevisionColumns = db.query<{ name: string }, []>("PRAGMA table_info(review_revisions)").all();
+  if (!reviewRevisionColumns.some((column) => column.name === "infraRetries")) {
+    db.exec("ALTER TABLE review_revisions ADD COLUMN infraRetries INTEGER");
+  }
 
+  // The escalation findings on an adjudication (#932). Rows written by #874's
+  // lifecycle carried none — the ceiling still refused then — so NULL is the
+  // honest reading and renders as "no findings recorded".
+  const adjudicationColumns = db.query<{ name: string }, []>("PRAGMA table_info(review_adjudications)").all();
+  if (!adjudicationColumns.some((column) => column.name === "findings")) {
+    db.exec("ALTER TABLE review_adjudications ADD COLUMN findings TEXT");
+  }
   // One-time repair, and the reason it lives here rather than in the classifier:
   // a turn-0 environment fault that was ALREADY classified `unknown` and
   // escalated is never revisited. `runsNeedingClassification` only offers a row
@@ -1855,10 +2282,10 @@ export function openStore(dbPath: string): Store {
   const insertRun = db.query<unknown, SqlValue[]>(
     `INSERT INTO runs (
        id, project, issue, repo, branch, worktree, state, attempt, turns,
-       maxTurns, spendUsd, sessionFile, resumedFromRunId, lane, prUrl, headSha, mergeSha, baseRef,
+       maxTurns, spendUsd, spendReservedUsd, sessionFile, resumedFromRunId, lane, prUrl, headSha, mergeSha, baseRef,
        baseCheck, baseCheckAt, salvageSha, salvageError, salvageAckAt, startedAt,
        endedAt, lastError, settlementFlags, report, graphTools
-     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   );
   const selectRun = db.query<RunRow, [string]>(`SELECT * FROM runs WHERE id = ?`);
   const selectGraphToolsObs = db.query<{ graphTools: string }, [string]>(
@@ -1874,6 +2301,26 @@ export function openStore(dbPath: string): Store {
       WHERE project = ? AND state IN (${LIVE_PLACEHOLDERS})
       ORDER BY startedAt ASC`,
   );
+  // Runs holding an ACTIVE MUTATION LEASE (#899, #925): a live worker, or a
+  // review revision the daemon has handed to one and that has not settled.
+  // The second half is belt-and-braces — `claimRunForReview` moves the row to
+  // `running` — but the claim and the launch are not the same instant, and a
+  // lease the reader briefly forgets is a lane two writers can share. A
+  // *queued* revision holds nothing: no worker has been woken for it.
+  //
+  // One query rather than a composition at each call site, because two
+  // readers now decide "may this file be written" from it — admission's
+  // file-lane gate and `conductor_pr_recover`'s fail-closed lane check — and
+  // a lease rule that disagrees between them is the bug both are guarding.
+  const selectLeased = db.query<RunRow, SqlValue[]>(
+    `SELECT * FROM runs
+      WHERE project = ?
+        AND (state IN (${LIVE_PLACEHOLDERS})
+          OR id IN (
+            SELECT runId FROM review_revisions
+              WHERE project = ? AND dispatchedAt IS NOT NULL AND settledAt IS NULL))
+      ORDER BY startedAt ASC`,
+  );
   const selectRetained = db.query<RunRow, [string]>(
     `SELECT * FROM runs
       WHERE project = ?
@@ -1987,6 +2434,73 @@ export function openStore(dbPath: string): Store {
         SET clearedAt = ?, clearedBy = ?, clearedReason = ?
       WHERE project = ? AND repo = ? AND clearedAt IS NULL`,
   );
+  const selectActiveReleaseComposition = db.query<ReleaseCompositionRow, [string]>(
+    `SELECT * FROM release_composition WHERE project = ? AND closedAt IS NULL`,
+  );
+  const declareReleaseCompositionRow = db.query<
+    unknown,
+    [string, string, string, SqlValue, number]
+  >(
+    `INSERT INTO release_composition (project, campaign, allowedPrUrls, declaredBy, declaredAt)
+     VALUES (?, ?, ?, ?, ?)
+     ON CONFLICT(project) DO UPDATE SET
+       campaign = excluded.campaign,
+       allowedPrUrls = excluded.allowedPrUrls,
+       declaredBy = excluded.declaredBy,
+       declaredAt = excluded.declaredAt,
+       closedAt = NULL,
+       closedBy = NULL,
+       closedReason = NULL`,
+  );
+  const retireReleaseCompositionRow = db.query<unknown, [number, string, string, string]>(
+    `UPDATE release_composition
+        SET closedAt = ?, closedBy = ?, closedReason = ?
+      WHERE project = ? AND closedAt IS NULL`,
+  );
+  const insertReleaseCompositionOverride = db.query<
+    unknown,
+    [string, string, string, string, number, string, string]
+  >(
+    `INSERT INTO release_composition_overrides (id, project, campaign, prUrl, at, by, reason)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`,
+  );
+  const selectReleaseCompositionOverride = db.query<
+    ReleaseCompositionOverrideRow,
+    [string, string, string]
+  >(
+    `SELECT * FROM release_composition_overrides
+      WHERE project = ? AND campaign = ? AND prUrl = ?
+      ORDER BY at DESC LIMIT 1`,
+  );
+  const selectReleaseCompositionOverrides = db.query<
+    ReleaseCompositionOverrideRow,
+    [string, string]
+  >(
+    `SELECT * FROM release_composition_overrides
+      WHERE project = ? AND campaign = ?
+      ORDER BY at DESC`,
+  );
+
+  // Declaring is a check-then-insert, and two processes (CLI + daemon) can
+  // race: without the transaction the second declarer would silently replace
+  // a still-active composition — exactly the overwrite this guard exists to
+  // prevent. Inside one write transaction the re-check sees the row the first
+  // declarer just wrote. Returns the conflicting active row, or null when the
+  // declaration took.
+  const declareReleaseCompositionTx = db.transaction(
+    (
+      project: string,
+      campaign: string,
+      allowedPrUrls: string,
+      declaredBy: string | null,
+      declaredAt: number,
+    ): ReleaseCompositionRow | null => {
+      const existing = selectActiveReleaseComposition.get(project);
+      if (existing !== null) return existing;
+      declareReleaseCompositionRow.run(project, campaign, allowedPrUrls, declaredBy, declaredAt);
+      return null;
+    },
+  );
   const countAttempts = db.query<{ n: number }, [string, number]>(
     `SELECT COUNT(*) AS n FROM runs WHERE project = ? AND issue = ?`,
   );
@@ -2111,10 +2625,43 @@ export function openStore(dbPath: string): Store {
   const reclassifyToInfra = db.query<unknown, [string]>(
     `UPDATE runs SET failureClass = 'ci-infra' WHERE id = ? AND failureClass = 'ci-deterministic'`,
   );
+  // Two different questions, deliberately not one number (#132).
+  //
+  // `recoveredAt IS NULL` alone does NOT mean "awaiting recovery": two actions
+  // are **recorded only** by design and never stamp it. `hold` is documented as
+  // such right above `selectUnclassified`; `none` is what the settle sweep
+  // writes beside `returned-for-revision` when a reviewer closes pushed work
+  // without merging, because the remedy there is the queue label the sweep
+  // deliberately leaves on, not an action any sweep takes.
+  //
+  // Counting them together is the #109 defect restated: on this fleet the line
+  // read `returned-for-revision 44` while every genuinely actionable class sat
+  // at zero, so a monotonically growing tally of *review decisions* crowded out
+  // the classes an operator can act on. The split is on `recoveryAction`, which
+  // the sweep already treats this way, so the surface now agrees with the model
+  // instead of contradicting it.
+  // Newest terminal runs, reduced to the two columns the spend-telemetry
+  // judgement needs (#970). Terminal only: an in-flight run has not finished
+  // reporting cost, so its 0.00 is not a telemetry statement.
+  const selectSpendSamples = db.query<{ turns: number; spendUsd: number }, [string, number]>(
+    `SELECT turns, spendUsd FROM runs
+      WHERE project = ? AND endedAt IS NOT NULL
+      ORDER BY endedAt DESC, rowid DESC
+      LIMIT ?`,
+  );
   const selectFailureClassCounts = db.query<{ cls: string; n: number }, [string]>(
     `SELECT failureClass AS cls, COUNT(*) AS n FROM runs
       WHERE project = ? AND failureClass IS NOT NULL AND recoveredAt IS NULL
         AND state IN ('blocked', 'killed', 'failed', 'orphaned', 'pushed-green')
+        AND recoveryAction NOT IN ('none', 'hold')
+      GROUP BY failureClass
+      ORDER BY n DESC, failureClass ASC`,
+  );
+  const selectRecordedOnlyClassCounts = db.query<{ cls: string; n: number }, [string]>(
+    `SELECT failureClass AS cls, COUNT(*) AS n FROM runs
+      WHERE project = ? AND failureClass IS NOT NULL AND recoveredAt IS NULL
+        AND state IN ('blocked', 'killed', 'failed', 'orphaned', 'pushed-green')
+        AND recoveryAction IN ('none', 'hold')
       GROUP BY failureClass
       ORDER BY n DESC, failureClass ASC`,
   );
@@ -2203,6 +2750,24 @@ export function openStore(dbPath: string): Store {
       ORDER BY setAt DESC, rowid DESC
       LIMIT ?`,
   );
+  // #807. `INSERT OR IGNORE` is the whole one-shot rule: the second spinning
+  // cap on a chain changes no rows, so the decomposition verdict is reached
+  // without any read-then-write window. Composed into `escalateModelTx`, which
+  // is what makes the marker and the continuation it authorises one fact.
+  const claimModelEscalation = db.query<
+    unknown,
+    [string, number, string, string, string, number]
+  >(
+    `INSERT OR IGNORE INTO model_escalations (project, issue, model, failureClass, runId, at)
+     VALUES (?, ?, ?, ?, ?, ?)`,
+  );
+  const selectModelEscalation = db.query<ModelEscalationRow, [string, number]>(
+    `SELECT model, failureClass, runId, at FROM model_escalations
+      WHERE project = ? AND issue = ?`,
+  );
+  const stampRecovered = db.query<unknown, [number, string]>(
+    `UPDATE runs SET recoveredAt = ? WHERE id = ?`,
+  );
   // The settlement report row is kept for the audit trail; nothing pools it
   // across attempts any more (#488).
   const countStartedSince = db.query<{ n: number }, [string, number]>(
@@ -2212,6 +2777,47 @@ export function openStore(dbPath: string): Store {
     `SELECT COALESCE(SUM(spendUsd), 0) AS total
        FROM runs WHERE project = ? AND startedAt >= ?`,
   );
+  // Reservations held by runs that are still live (#851). Summed rather than
+  // tracked: a settle releases the unspent remainder by leaving LIVE_STATES,
+  // with nothing to remember to write, and a daemon restart re-reads the same
+  // reservations off the same rows. A run that spent MORE than it reserved is
+  // counted at what it reserved — its overspend is already in `spendSince`.
+  const sumLiveReservations = db.query<{ total: number }, SqlValue[]>(
+    `SELECT COALESCE(SUM(spendReservedUsd), 0) AS total
+       FROM runs
+      WHERE project = ? AND state IN (${LIVE_PLACEHOLDERS}) AND spendReservedUsd IS NOT NULL`,
+  );
+  const upsertInstallSurfaces = db.query<
+    unknown,
+    [number, string, string | null, string | null, string | null, string | null, string | null]
+  >(
+    `INSERT INTO install_surfaces
+       (host, at, cliVersion, ompVersion, herdrSource, tgInstalled, tgDaemon, tgPublished)
+     VALUES ('host', ?, ?, ?, ?, ?, ?, ?)
+     ON CONFLICT(host) DO UPDATE SET
+       at = excluded.at,
+       cliVersion = excluded.cliVersion,
+       ompVersion = excluded.ompVersion,
+       herdrSource = excluded.herdrSource,
+       tgInstalled = excluded.tgInstalled,
+       tgDaemon = excluded.tgDaemon,
+       tgPublished = excluded.tgPublished`,
+  );
+  const selectInstallSurfaces = db.query<
+    {
+      at: number;
+      cliVersion: string;
+      ompVersion: string | null;
+      herdrSource: string | null;
+      tgInstalled: string | null;
+      tgDaemon: string | null;
+      tgPublished: string | null;
+    },
+    []
+  >(
+    `SELECT at, cliVersion, ompVersion, herdrSource, tgInstalled, tgDaemon, tgPublished
+       FROM install_surfaces WHERE host = 'host'`,
+  );
   const countNotified = db.query<{ n: number }, [string]>(
     `SELECT COUNT(*) AS n FROM notifications WHERE "key" = ?`,
   );
@@ -2282,6 +2888,26 @@ export function openStore(dbPath: string): Store {
       }
     },
   );
+  // A groomed verdict describes an OPEN issue, and nothing retired one when its
+  // issue closed (#964). `clearGroomedBlocked` above only ever cleared the two
+  // per-pass admission holds, so every other row — `promotable`, `considered`,
+  // `needs-product-decision`, an in-flight batch marker — accumulated forever.
+  // Measured on this fleet 2026-08-23: 64 of 65 rows named a closed issue, and
+  // all 26 `promotable` ones did, so `status` advertised 26 candidates ready to
+  // promote on a repo with exactly one open issue.
+  //
+  // Deleted one row at a time inside a transaction rather than with a generated
+  // `NOT IN (...)`: the closed set is computed by the caller from a complete
+  // open-issue snapshot, and an over-long IN list is exactly where a partial
+  // snapshot would quietly delete verdicts it never verified.
+  const deleteGroomingRow = db.query<unknown, [string, number]>(
+    `DELETE FROM grooming WHERE project = ? AND issue = ?`,
+  );
+  const retireGroomingTx = db.transaction((project: string, issues: readonly number[]): number => {
+    let removed = 0;
+    for (const issue of issues) removed += deleteGroomingRow.run(project, issue).changes;
+    return removed;
+  });
   const selectFrictionRollup = db.query<FrictionRollupRow, [string, string, string]>(
     `SELECT * FROM friction_rollups WHERE project = ? AND day = ? AND kind = ?`,
   );
@@ -2762,10 +3388,16 @@ export function openStore(dbPath: string): Store {
     },
   );
 
-  const insertDecision = db.query<never, [string, string, string, string, SqlValue, number, number, SqlValue, string]>(
+  const insertDecision = db.query<
+    never,
+    [string, string, string, string, SqlValue, number, number, SqlValue, string, SqlValue, SqlValue]
+  >(
     `INSERT INTO decisions
-       (id, project, kind, question, blocks, askedAt, expiresAt, condition, state)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       (id, project, kind, question, blocks, askedAt, expiresAt, condition, state, groupId, specIssue)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+  );
+  const selectDecisionGroup = db.query<DecisionRow, [string]>(
+    `SELECT * FROM decisions WHERE groupId = ? ORDER BY askedAt ASC, rowid ASC`,
   );
   const selectDecision = db.query<DecisionRow, [string]>(`SELECT * FROM decisions WHERE id = ?`);
   const selectOpenDecisions = db.query<DecisionRow, [string]>(
@@ -2793,8 +3425,27 @@ export function openStore(dbPath: string): Store {
   // every tick. A `pr-checks-green` / `pr-review-ready` row whose PR head
   // moved is cleared first and re-marks here against the new head (`head`
   // binds the verdict to the exact commit it was observed at, #808).
-  const markConditionMetRow = db.query<never, [number, SqlValue, string]>(
-    `UPDATE decisions SET conditionMetAt = ?, conditionHead = ?
+  // A watch's deadline starts when its condition fires, not when it was opened
+  // (#966).
+  //
+  // `DECISION_WATCH_NEVER_EXPIRES` is right for the waiting phase, and its
+  // reasoning is quoted where it is defined: a condition that has not fired is
+  // not a question nobody answered, and expiring it could drop a release. But
+  // the instant `conditionMetAt` is stamped the row stops waiting — it becomes
+  // an actionable item, which is exactly what a question's TTL bounds. Measured
+  // on this fleet 2026-08-23: three watches had carried
+  // "[CONDITION MET — act on this now]" for 10-12 hours over work that was
+  // entirely closed, and would have carried it forever.
+  //
+  // Only watches are touched: a question's `expiresAt` already runs from
+  // `askedAt` and must keep doing so, so the deadline is written only where it
+  // is currently infinite. `kind = 'watch'` is the guard rather than a value
+  // comparison, because a question with a condition is still a question.
+  const markConditionMetRow = db.query<never, [number, SqlValue, number, string]>(
+    `UPDATE decisions
+        SET conditionMetAt = ?,
+            conditionHead = ?,
+            expiresAt = CASE WHEN kind = 'watch' THEN ? ELSE expiresAt END
       WHERE id = ? AND state = 'open' AND conditionMetAt IS NULL`,
   );
   // The inverse of the mark, for the two conditions whose observation goes
@@ -2802,8 +3453,15 @@ export function openStore(dbPath: string): Store {
   // so a head change drops both the timestamp and the binding and the row
   // returns to pending (#808). Returns false when no met state existed to
   // drop, so re-runs are a no-op.
-  const clearConditionMetRow = db.query<never, [string]>(
-    `UPDATE decisions SET conditionMetAt = NULL, conditionHead = NULL
+  //
+  // The deadline goes back with it (#966): a PR that went red again is waiting,
+  // not ignored, and leaving a countdown on it would expire a watch whose
+  // condition is once again unfired.
+  const clearConditionMetRow = db.query<never, [number, string]>(
+    `UPDATE decisions
+        SET conditionMetAt = NULL,
+            conditionHead = NULL,
+            expiresAt = CASE WHEN kind = 'watch' THEN ? ELSE expiresAt END
       WHERE id = ? AND state = 'open' AND conditionMetAt IS NOT NULL`,
   );
 
@@ -2889,6 +3547,155 @@ export function openStore(dbPath: string): Store {
   const requeueReviewRevisionRow = db.query<unknown, [string]>(
     `UPDATE review_revisions SET dispatchedAt = NULL WHERE id = ?`,
   );
+  // The bounded infra retry (#903). One statement decides and writes: the
+  // WHERE carries the bound, so two daemons cannot both spend the last retry
+  // and a settled row can never be revived. `changes` is the decision.
+  const retryReviewRevisionRow = db.query<unknown, [string, number]>(
+    `UPDATE review_revisions
+        SET dispatchedAt = NULL,
+            infraRetries = COALESCE(infraRetries, 0) + 1
+      WHERE id = ? AND settledAt IS NULL AND COALESCE(infraRetries, 0) < ?`,
+  );
+  const selectReviewRevisionById = db.query<ReviewRevisionRow, [string]>(
+    `SELECT * FROM review_revisions WHERE id = ?`,
+  );
+  // The exact-head merge gate (#888): every row that stands between a PR and
+  // a merge at one head — anything not yet settled (queued, or dispatched and
+  // crashed mid-review) plus anything settled `failed` there. `skipped`,
+  // `revised` and `pending` outcomes never block: a skip is an assessment
+  // that never ran (the escalation for one says "merge it as it stands"), and
+  // a revised/pending outcome belongs to a worker that pushed past the
+  // reviewed head. Head comparison is case-insensitive; prUrl is matched
+  // exactly — every writer records it from the same tracker payloads.
+  //
+  // A recorded clearance (#913) is the one disposition available at an
+  // *unchanged* head, and it applies strictly backwards: the NOT EXISTS
+  // requires the clearance to be at or after the row's own last activity
+  // (`settledAt` when the round finished, else `requestedAt`). Without that
+  // comparison a single clearance would bless every future finding at that
+  // head — a strictly worse hole than the deadlock it fixes — so the
+  // timestamp is the load-bearing half of this clause, not decoration. The
+  // `outcome = 'failed'` term stays exactly as it was: a clearance is how
+  // failed evidence is dispositioned, never by widening what counts as
+  // blocking.
+  const selectMergeBlockingReviews = db.query<ReviewRevisionRow, [string, string, string]>(
+    `SELECT * FROM review_revisions
+      WHERE project = ? AND prUrl = ? AND lower(headSha) = lower(?)
+        AND (settledAt IS NULL OR outcome = 'failed')
+        AND NOT EXISTS (
+          SELECT 1 FROM review_clearances c
+           WHERE c.project = review_revisions.project
+             AND c.prUrl = review_revisions.prUrl
+             AND lower(c.headSha) = lower(review_revisions.headSha)
+             AND c.at >= COALESCE(review_revisions.settledAt, review_revisions.requestedAt)
+        )
+      ORDER BY requestedAt ASC, rowid ASC`,
+  );
+  const insertReviewClearance = db.query<unknown, [string, string, string, string, number, string, string]>(
+    `INSERT INTO review_clearances (id, project, prUrl, headSha, at, by, reason)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`,
+  );
+  const selectReviewClearances = db.query<ReviewClearanceRow, [string, string, string]>(
+    `SELECT * FROM review_clearances
+      WHERE project = ? AND prUrl = ? AND lower(headSha) = lower(?)
+      ORDER BY at DESC, rowid DESC`,
+  );
+
+  // The review-ceiling adjudication lifecycle (#874). Head comparison is
+  // case-insensitive everywhere, exactly as the merge gate and the clearance
+  // lookup are: a 40-hex SHA read from two GitHub surfaces can differ in case
+  // and mean the same commit.
+  const insertReviewAdjudication = db.query<unknown, SqlValue[]>(
+    `INSERT INTO review_adjudications
+       (id, project, issue, prUrl, headSha, role, provenance, state, evidence, disposition,
+        requestedAt, dispatchedAt, settledAt, findings)
+     VALUES (?, ?, ?, ?, ?, ?, NULL, 'pending', NULL, NULL, ?, NULL, NULL, ?)`,
+  );
+  const selectAdjudicationForHead = db.query<ReviewAdjudicationRow, [string, string, string]>(
+    `SELECT * FROM review_adjudications
+      WHERE project = ? AND prUrl = ? AND lower(headSha) = lower(?)`,
+  );
+  // The non-terminal row for one PR, whatever head it is on. This is what makes
+  // a moved head refuse rather than open a second live adjudication.
+  const selectOpenAdjudicationForPr = db.query<ReviewAdjudicationRow, [string, string]>(
+    `SELECT * FROM review_adjudications
+      WHERE project = ? AND prUrl = ? AND settledAt IS NULL
+      ORDER BY requestedAt ASC, rowid ASC
+      LIMIT 1`,
+  );
+  const selectAdjudicationById = db.query<ReviewAdjudicationRow, [string]>(
+    `SELECT * FROM review_adjudications WHERE id = ?`,
+  );
+  const selectOpenAdjudications = db.query<ReviewAdjudicationRow, [string]>(
+    `SELECT * FROM review_adjudications
+      WHERE project = ? AND settledAt IS NULL
+      ORDER BY requestedAt ASC, rowid ASC`,
+  );
+  // Every review round recorded for one PR, oldest first (#932): the history the
+  // adjudicator is shown. Keyed by PR rather than by run so a continuation that
+  // inherited the PR does not hide its predecessor's findings.
+  const selectRevisionsForPr = db.query<ReviewRevisionRow, [string, string]>(
+    `SELECT * FROM review_revisions
+      WHERE project = ? AND prUrl = ?
+      ORDER BY round ASC, requestedAt ASC, rowid ASC`,
+  );
+  const selectAdjudicationsForPr = db.query<ReviewAdjudicationRow, [string, string]>(
+    `SELECT * FROM review_adjudications
+      WHERE project = ? AND prUrl = ?
+      ORDER BY requestedAt DESC, rowid DESC`,
+  );
+  // Dispatch: pending -> running, recording the launch provenance. The WHERE
+  // carries the transition, so two dispatchers racing one row cannot both
+  // launch — the loser changes nothing and reads `false`.
+  const markAdjudicationRunningRow = db.query<unknown, [string, number, string]>(
+    `UPDATE review_adjudications
+        SET state = 'running', provenance = ?, dispatchedAt = ?
+      WHERE id = ? AND state = 'pending' AND settledAt IS NULL`,
+  );
+  // Settle: only from a non-terminal state, and only once. An invalid
+  // transition changes nothing and preserves whatever the row already said,
+  // which is the diagnostic evidence a later reader needs.
+  const settleAdjudicationRow = db.query<unknown, SqlValue[]>(
+    `UPDATE review_adjudications
+        SET state = ?, evidence = COALESCE(?, evidence), settledAt = ?
+      WHERE id = ? AND settledAt IS NULL`,
+  );
+  const recordAdjudicationDispositionRow = db.query<unknown, [string, string]>(
+    `UPDATE review_adjudications SET disposition = ? WHERE id = ?`,
+  );
+
+  // Admission is a transaction for the same reason the revision enqueue is: the
+  // CLI and the daemon are separate processes with separate connections, so a
+  // deferred read-then-write would let both see "no row" and both insert. It
+  // begins IMMEDIATE, taking the write lock before the read, and the UNIQUE
+  // index on (project, prUrl, headSha) is the structural backstop underneath.
+  const openAdjudicationTx = db.transaction(
+    (
+      id: string,
+      project: string,
+      issue: number,
+      prUrl: string,
+      headSha: string,
+      role: string,
+      requestedAt: number,
+      findings: string | undefined,
+    ): ReviewAdjudicationAdmission => {
+      const sameHead = selectAdjudicationForHead.get(project, prUrl, headSha);
+      if (sameHead !== null && sameHead !== undefined) {
+        return { kind: "existing", record: toReviewAdjudication(sameHead) };
+      }
+      const open = selectOpenAdjudicationForPr.get(project, prUrl);
+      if (open !== null && open !== undefined) {
+        return {
+          kind: "refused",
+          block: "in-flight-different-head",
+          record: toReviewAdjudication(open),
+        };
+      }
+      insertReviewAdjudication.run(id, project, issue, prUrl, headSha, role, requestedAt, findings ?? null);
+      return { kind: "created", record: toReviewAdjudication(selectAdjudicationById.get(id)!) };
+    },
+  );
   // The states the review verb admits and the dispatch pass may therefore
   // claim (#795): a settled green run, or a capped/failed run that pushed one
   // (`failed` / `killed`). The terminal set is closed on purpose — a live row
@@ -3046,21 +3853,62 @@ export function openStore(dbPath: string): Store {
       WHERE project = ? AND issue = ? AND label = ?
       ORDER BY id DESC LIMIT 1`,
   );
-  const enqueueLabelOpsTx = db.transaction(
+  /** The coalescing outbox insert, without a transaction of its own: the caller
+   *  owns one, so a decision that must be durable *with* its label transition
+   *  (the #807 escalation) can commit both or neither. */
+  const enqueueLabelOpRows = (
+    rows: readonly {
+      project: string;
+      issue: number;
+      op: "add" | "remove";
+      label: string;
+      createdAt: number;
+    }[],
+  ): void => {
+    for (const row of rows) {
+      const latest = selectLatestLabelOp.get(row.project, row.issue, row.label);
+      if (latest !== undefined && latest !== null && latest.op === row.op) continue;
+      insertLabelOp.run(toSql(row.project), row.issue, row.op, row.label, row.createdAt);
+    }
+  };
+  const enqueueLabelOpsTx = db.transaction(enqueueLabelOpRows);
+
+  /**
+   * The whole #807 escalation as one durable decision: the chain's one-shot
+   * marker, the failed → queue label swap that spends it, and the settling
+   * run's recovery stamp.
+   *
+   * They commit together or not at all, which is the only way the promise
+   * survives a restart. As three separate writes led by the marker, a daemon
+   * that died right after it would come back to a chain reading as
+   * already-escalated with no queue label owed: the continuation silently lost,
+   * and the next cap on that chain judged a second one.
+   *
+   * A run id with no row is a caller bug, not a state: throwing rolls the
+   * marker back rather than recording an escalation nothing can ever spend.
+   */
+  const escalateModelTx = db.transaction(
     (
-      rows: readonly {
-        project: string;
-        issue: number;
-        op: "add" | "remove";
-        label: string;
-        createdAt: number;
-      }[],
-    ): void => {
-      for (const row of rows) {
-        const latest = selectLatestLabelOp.get(row.project, row.issue, row.label);
-        if (latest !== undefined && latest !== null && latest.op === row.op) continue;
-        insertLabelOp.run(toSql(row.project), row.issue, row.op, row.label, row.createdAt);
+      project: string,
+      issue: number,
+      model: string,
+      failureClass: string,
+      runId: string,
+      swapFrom: string,
+      queueLabel: string,
+      at: number,
+    ): boolean => {
+      if (claimModelEscalation.run(project, issue, model, failureClass, runId, at).changes === 0) {
+        return false;
+      }
+      enqueueLabelOpRows([
+        { project, issue, op: "remove", label: swapFrom, createdAt: at },
+        { project, issue, op: "add", label: queueLabel, createdAt: at },
+      ]);
+      if (stampRecovered.run(at, runId).changes === 0) {
+        throw new Error(`escalateModel: run ${runId} does not exist`);
       }
+      return true;
     },
   );
 
@@ -3121,6 +3969,7 @@ export function openStore(dbPath: string): Store {
       record.turns,
       record.maxTurns,
       record.spendUsd,
+      toSql(record.spendReservedUsd),
       toSql(record.sessionFile),
       toSql(record.resumedFromRunId),
       toSql(record.lane),
@@ -3142,6 +3991,63 @@ export function openStore(dbPath: string): Store {
     );
     return record;
   };
+  /** The one row writer both the single ask and a questionnaire item use. */
+  const writeDecision = (draft: DecisionDraft): DecisionRecord => {
+    const kind = draft.kind ?? "question";
+    const record: DecisionRecord = {
+      id: crypto.randomUUID(),
+      project: draft.project,
+      kind,
+      question: draft.question,
+      askedAt: draft.at,
+      // The seven-day deadline is for a question a human never answered. A
+      // watch has no such deadline: it is the orchestrator's own bookkeeping,
+      // and expiring it silently could drop a release the day its condition
+      // finally fires, so it is never due.
+      expiresAt: kind === "watch" ? DECISION_WATCH_NEVER_EXPIRES : draft.at + DECISION_TTL_MS,
+      state: "open",
+    };
+    if (draft.blocks !== undefined) record.blocks = draft.blocks;
+    if (draft.condition !== undefined) record.condition = draft.condition;
+    if (draft.groupId !== undefined) record.groupId = draft.groupId;
+    if (draft.specIssue !== undefined) record.specIssue = draft.specIssue;
+    insertDecision.run(
+      record.id,
+      record.project,
+      record.kind,
+      record.question,
+      toSql(record.blocks),
+      record.askedAt,
+      record.expiresAt,
+      toSql(record.condition),
+      record.state,
+      toSql(record.groupId),
+      toSql(record.specIssue),
+    );
+    return record;
+  };
+
+  /**
+   * One spec-out questionnaire, written in one transaction (#947).
+   *
+   * The atomicity is the whole guarantee: every item is durable BEFORE the
+   * single delivery, so a crash halfway can never put questions in front of an
+   * operator that no row is waiting on. The group id is minted here rather than
+   * supplied, because a caller that can name the group can also collide with
+   * another one, and an empty batch is refused — a questionnaire of nothing is a
+   * caller bug, not an empty delivery.
+   */
+  const createDecisionGroupTx = db.transaction(
+    (drafts: readonly DecisionDraft[], specIssue: number): DecisionRecord[] => {
+      if (drafts.length === 0) throw new Error("a questionnaire needs at least one item");
+      if (!Number.isInteger(specIssue) || specIssue <= 0) {
+        throw new Error(`a questionnaire must name the issue it specs, got ${String(specIssue)}`);
+      }
+      const groupId = crypto.randomUUID();
+      return drafts.map((draft) => writeDecision({ ...draft, groupId, specIssue }));
+    },
+  );
+
   const createRunTx = db.transaction((r: Omit<RunRecord, "id">): RunRecord => {
     if (r.state !== "claimed") return insertRunRecord(r);
     const turnOverride = selectTurnOverride.get(r.project, r.issue)?.maxTurns;
@@ -3212,6 +4118,10 @@ export function openStore(dbPath: string): Store {
       return selectLive.all(project, ...LIVE_STATES).map(toRecord);
     },
 
+    leasedRuns(project: string): RunRecord[] {
+      return selectLeased.all(project, ...LIVE_STATES, project).map(toRecord);
+    },
+
     retainedRuns(project: string): RunRecord[] {
       return selectRetained.all(project).map(toRecord);
     },
@@ -3250,6 +4160,111 @@ export function openStore(dbPath: string): Store {
     requeueReviewRevision(id: string): void {
       requeueReviewRevisionRow.run(id);
     },
+    retryReviewRevisionAfterInfra(id: string, max: number): ReviewRevisionRetry {
+      const requeued = retryReviewRevisionRow.run(id, max).changes > 0;
+      const retries = selectReviewRevisionById.get(id)?.infraRetries ?? 0;
+      return requeued ? { kind: "requeued", retries } : { kind: "exhausted", retries };
+    },
+    mergeBlockingReviews(project: string, prUrl: string, headSha: string): ReviewRevisionRecord[] {
+      return selectMergeBlockingReviews.all(project, prUrl, headSha).map(toReviewRevision);
+    },
+    recordReviewClearance(clearance: {
+      project: string;
+      prUrl: string;
+      headSha: string;
+      by: string;
+      reason: string;
+      at?: number;
+    }): ReviewClearance {
+      const record: ReviewClearance = {
+        id: newReportId(),
+        project: clearance.project,
+        prUrl: clearance.prUrl,
+        headSha: clearance.headSha,
+        at: clearance.at ?? Date.now(),
+        by: clearance.by,
+        reason: clearance.reason,
+      };
+      insertReviewClearance.run(
+        record.id,
+        record.project,
+        record.prUrl,
+        record.headSha,
+        record.at,
+        record.by,
+        record.reason,
+      );
+      return record;
+    },
+    reviewClearances(project: string, prUrl: string, headSha: string): ReviewClearance[] {
+      return selectReviewClearances.all(project, prUrl, headSha).map((row) => ({ ...row }));
+    },
+    openReviewAdjudication(draft: {
+      project: string;
+      issue: number;
+      prUrl: string;
+      headSha: string;
+      role: string;
+      requestedAt?: number;
+      findings?: string;
+    }): ReviewAdjudicationAdmission {
+      // `immediate` = BEGIN IMMEDIATE: the write lock is taken before the
+      // one-shot read, so two processes cannot both see "no adjudication" and
+      // both insert one (#874).
+      return openAdjudicationTx.immediate(
+        newReportId(),
+        draft.project,
+        draft.issue,
+        draft.prUrl,
+        draft.headSha,
+        draft.role,
+        draft.requestedAt ?? Date.now(),
+        draft.findings,
+      );
+    },
+    markReviewAdjudicationRunning(
+      id: string,
+      provenance: ReviewAdjudicationProvenance,
+      at: number = Date.now(),
+    ): boolean {
+      return markAdjudicationRunningRow.run(JSON.stringify(provenance), at, id).changes > 0;
+    },
+    settleReviewAdjudication(
+      id: string,
+      state: ReviewAdjudicationState,
+      evidence?: string,
+      at: number = Date.now(),
+    ): boolean {
+      // Terminal only, and once. A caller asking to settle into `pending` or
+      // `running` is a bug, not a transition: refusing it here keeps "settled"
+      // meaning "finished forever" for every reader.
+      if (!TERMINAL_REVIEW_ADJUDICATION_STATES.some((terminal) => terminal === state)) return false;
+      return settleAdjudicationRow.run(state, evidence ?? null, at, id).changes > 0;
+    },
+    recordReviewAdjudicationDisposition(id: string, disposition: string): boolean {
+      return recordAdjudicationDispositionRow.run(disposition, id).changes > 0;
+    },
+    reviewAdjudication(id: string): ReviewAdjudicationRecord | undefined {
+      const row = selectAdjudicationById.get(id);
+      return row === null || row === undefined ? undefined : toReviewAdjudication(row);
+    },
+    reviewAdjudicationForHead(
+      project: string,
+      prUrl: string,
+      headSha: string,
+    ): ReviewAdjudicationRecord | undefined {
+      const row = selectAdjudicationForHead.get(project, prUrl, headSha);
+      return row === null || row === undefined ? undefined : toReviewAdjudication(row);
+    },
+    openReviewAdjudications(project: string): ReviewAdjudicationRecord[] {
+      return selectOpenAdjudications.all(project).map(toReviewAdjudication);
+    },
+    reviewRevisionsForPr(project: string, prUrl: string): ReviewRevisionRecord[] {
+      return selectRevisionsForPr.all(project, prUrl).map(toReviewRevision);
+    },
+    reviewAdjudicationsForPr(project: string, prUrl: string): ReviewAdjudicationRecord[] {
+      return selectAdjudicationsForPr.all(project, prUrl).map(toReviewAdjudication);
+    },
     claimRunForReview(runId: string): boolean {
       return claimRunForReviewTx(runId);
     },
@@ -3318,6 +4333,78 @@ export function openStore(dbPath: string): Store {
       return clearBaseFreezeRow.run(at, by, reason, project, repo).changes > 0;
     },
 
+    activeReleaseComposition(project: string): ReleaseComposition | undefined {
+      const row = selectActiveReleaseComposition.get(project);
+      return row === null ? undefined : toReleaseComposition(row);
+    },
+
+    declareReleaseComposition(
+      project: string,
+      composition: {
+        campaign: string;
+        allowedPrUrls: string[];
+        declaredBy?: string;
+        declaredAt?: number;
+      },
+    ): ReleaseComposition | undefined {
+      // One active composition per project: a second declaration while one
+      // is live is the caller's error to see, so hand the conflict straight
+      // back. The transactional re-check keeps two declarers from racing.
+      const conflict = declareReleaseCompositionTx(
+        project,
+        composition.campaign,
+        JSON.stringify(composition.allowedPrUrls),
+        composition.declaredBy ?? null,
+        composition.declaredAt ?? Date.now(),
+      );
+      return conflict === null ? undefined : toReleaseComposition(conflict);
+    },
+
+    completeReleaseComposition(project: string, by: string, reason: string, at = Date.now()): boolean {
+      return retireReleaseCompositionRow.run(at, by, reason, project).changes > 0;
+    },
+
+    cancelReleaseComposition(project: string, by: string, reason: string, at = Date.now()): boolean {
+      return retireReleaseCompositionRow.run(at, by, reason, project).changes > 0;
+    },
+
+    grantReleaseCompositionOverride(
+      project: string,
+      override: { campaign: string; prUrl: string; by: string; reason: string; at?: number },
+    ): ReleaseCompositionOverride {
+      const record: ReleaseCompositionOverride = {
+        id: newReportId(),
+        project,
+        campaign: override.campaign,
+        prUrl: override.prUrl,
+        at: override.at ?? Date.now(),
+        by: override.by,
+        reason: override.reason,
+      };
+      insertReleaseCompositionOverride.run(
+        record.id,
+        record.project,
+        record.campaign,
+        record.prUrl,
+        record.at,
+        record.by,
+        record.reason,
+      );
+      return record;
+    },
+
+    releaseCompositionOverride(
+      project: string,
+      campaign: string,
+      prUrl: string,
+    ): ReleaseCompositionOverride | undefined {
+      const row = selectReleaseCompositionOverride.get(project, campaign, prUrl);
+      return row === null ? undefined : { ...row };
+    },
+
+    releaseCompositionOverrides(project: string, campaign: string): ReleaseCompositionOverride[] {
+      return selectReleaseCompositionOverrides.all(project, campaign).map((row) => ({ ...row }));
+    },
 
     salvagedRuns(project: string): RunRecord[] {
       return selectSalvaged.all(project).map(toRecord);
@@ -3351,6 +4438,54 @@ export function openStore(dbPath: string): Store {
       return selectRunsForIssue.all(project, issue).map(toRecord);
     },
 
+    /**
+     * Spends the one model escalation this issue chain is allowed (#807), and
+     * everything that makes it true: the marker, the `swapFrom` → `queueLabel`
+     * transition that hands the continuation back, and the settling run's
+     * recovery stamp — one transaction, so a restart never finds a chain that
+     * reads as escalated with no continuation owed.
+     *
+     * `true` means this call spent it; `false` means the chain had already
+     * escalated and nothing was written, which is the second-cap decomposition
+     * verdict. Throws when `runId` names no row: the marker rolls back with it
+     * rather than recording an escalation nothing can spend.
+     */
+    escalateModel(escalation: {
+      project: string;
+      issue: number;
+      model: string;
+      failureClass: FailureClass;
+      runId: string;
+      swapFrom: string;
+      queueLabel: string;
+      at?: number;
+    }): boolean {
+      return escalateModelTx(
+        escalation.project,
+        escalation.issue,
+        escalation.model,
+        escalation.failureClass,
+        escalation.runId,
+        escalation.swapFrom,
+        escalation.queueLabel,
+        escalation.at ?? Date.now(),
+      );
+    },
+
+    /** The escalation this chain has already spent, or `undefined` for a chain
+     *  that never capped — which is what a fresh issue always reads. */
+    modelEscalation(project: string, issue: number): ModelEscalation | undefined {
+      const row = selectModelEscalation.get(project, issue);
+      return row === null
+        ? undefined
+        : {
+            model: row.model,
+            failureClass: row.failureClass as FailureClass,
+            runId: row.runId,
+            at: row.at,
+          };
+    },
+
     setTurnOverride(project: string, issue: number, maxTurns: number, setAt = Date.now()): void {
       setTurnOverrideTx(project, issue, maxTurns, setAt);
     },
@@ -3383,6 +4518,10 @@ export function openStore(dbPath: string): Store {
       return sumSpendSince.get(project, sinceEpochMs)?.total ?? 0;
     },
 
+    reservedSpendUsd(project: string): number {
+      return sumLiveReservations.get(project, ...LIVE_STATES)?.total ?? 0;
+    },
+
     statsRuns(project: string, sinceEpochMs: number): RunRecord[] {
       return selectStatsRuns.all(project, sinceEpochMs, project, sinceEpochMs).map(toRecord);
     },
@@ -3524,6 +4663,32 @@ export function openStore(dbPath: string): Store {
       }));
     },
 
+    recordInstallSurfaces(observation: InstallSurfaceObservation): void {
+      upsertInstallSurfaces.run(
+        observation.at,
+        observation.cliVersion,
+        observation.ompVersion ?? null,
+        observation.herdrSource ?? null,
+        observation.telegramInstalled ?? null,
+        observation.telegramDaemon ?? null,
+        observation.telegramPublished ?? null,
+      );
+    },
+
+    installSurfaces(): InstallSurfaceObservation | undefined {
+      const row = selectInstallSurfaces.get();
+      if (row === null) return undefined;
+      return {
+        at: row.at,
+        cliVersion: row.cliVersion,
+        ...(row.ompVersion === null ? {} : { ompVersion: row.ompVersion }),
+        ...(row.herdrSource === null ? {} : { herdrSource: row.herdrSource }),
+        ...(row.tgInstalled === null ? {} : { telegramInstalled: row.tgInstalled }),
+        ...(row.tgDaemon === null ? {} : { telegramDaemon: row.tgDaemon }),
+        ...(row.tgPublished === null ? {} : { telegramPublished: row.tgPublished }),
+      };
+    },
+
     recordMaterialEvent(event: MaterialEventDraft): MaterialEvent {
       const record: MaterialEvent = {
         id: newReportId(),
@@ -3829,45 +4994,36 @@ export function openStore(dbPath: string): Store {
       return reclassifyToInfra.run(id).changes > 0;
     },
 
+    recentSpendSamples(project: string, limit: number): { turns: number; spendUsd: number }[] {
+      return selectSpendSamples.all(project, limit).map((row) => ({ ...row }));
+    },
+
     failureClassCounts(project: string): { cls: FailureClass; n: number }[] {
       return selectFailureClassCounts
         .all(project)
         .map((row) => ({ cls: row.cls as FailureClass, n: row.n }));
     },
 
+    recordedOnlyClassCounts(project: string): { cls: FailureClass; n: number }[] {
+      return selectRecordedOnlyClassCounts
+        .all(project)
+        .map((row) => ({ cls: row.cls as FailureClass, n: row.n }));
+    },
+
     recoveredSince(project: string, since: number): RunRecord[] {
       return selectRecoveredSince.all(project, since).map(toRecord);
     },
 
     createDecision(draft: DecisionDraft): DecisionRecord {
-      const kind = draft.kind ?? "question";
-      const record: DecisionRecord = {
-        id: crypto.randomUUID(),
-        project: draft.project,
-        kind,
-        question: draft.question,
-        askedAt: draft.at,
-        // The seven-day deadline is for a question a human never answered. A
-        // watch has no such deadline: it is the orchestrator's own bookkeeping,
-        // and expiring it silently could drop a release the day its condition
-        // finally fires, so it is never due.
-        expiresAt: kind === "watch" ? DECISION_WATCH_NEVER_EXPIRES : draft.at + DECISION_TTL_MS,
-        state: "open",
-      };
-      if (draft.blocks !== undefined) record.blocks = draft.blocks;
-      if (draft.condition !== undefined) record.condition = draft.condition;
-      insertDecision.run(
-        record.id,
-        record.project,
-        record.kind,
-        record.question,
-        toSql(record.blocks),
-        record.askedAt,
-        record.expiresAt,
-        toSql(record.condition),
-        record.state,
-      );
-      return record;
+      return writeDecision(draft);
+    },
+
+    createDecisionGroup(drafts: readonly DecisionDraft[], specIssue: number): DecisionRecord[] {
+      return createDecisionGroupTx(drafts, specIssue);
+    },
+
+    decisionGroup(groupId: string): DecisionRecord[] {
+      return selectDecisionGroup.all(groupId).map(toDecision);
     },
 
     openDecisions(project: string): DecisionRecord[] {
@@ -3884,11 +5040,14 @@ export function openStore(dbPath: string): Store {
     },
 
     markDecisionConditionMet(id: string, at: number, head?: string): boolean {
-      return markConditionMetRow.run(at, toSql(head), id).changes > 0;
+      // The window is computed from the observation instant, not from `now()`,
+      // so a pass that observed a condition and wrote it a second later cannot
+      // give the row a second longer to live.
+      return markConditionMetRow.run(at, toSql(head), at + DECISION_TTL_MS, id).changes > 0;
     },
 
     clearDecisionConditionMet(id: string): boolean {
-      return clearConditionMetRow.run(id).changes > 0;
+      return clearConditionMetRow.run(DECISION_WATCH_NEVER_EXPIRES, id).changes > 0;
     },
 
     expireDueDecisions(project: string, now: number): DecisionRecord[] {
@@ -4046,6 +5205,21 @@ export function openStore(dbPath: string): Store {
       reconcileGroomingTx(project, holds);
     },
 
+    retireGroomingNotOpen(project: string, openIssues: readonly number[]): number[] {
+      // The caller owns "is this snapshot complete"; this owns "which rows does
+      // it condemn". Computed here rather than in SQL so the returned list is
+      // exactly what was deleted, which is what the log line reports.
+      const open = new Set(openIssues);
+      const condemned = selectGroomingAll
+        .all(project)
+        .map(toGrooming)
+        .filter((row) => !open.has(row.issue))
+        .map((row) => row.issue);
+      if (condemned.length === 0) return [];
+      retireGroomingTx(project, condemned);
+      return condemned;
+    },
+
     close(): void {
       db.close(false);
     },