omp-conductor 0.20.1 → 0.20.2

package/src/graph-health.ts

@@ -52,7 +52,10 @@ export type CodeGraphHealth =
         active: "active" | "inactive" | "unknown";
       };
       refresh: {
-        result: "success" | "failed" | "unknown";
+        /** "running": the oneshot is executing right now (#1090). systemd has
+         *  already cleared the previous exit timestamp mid-run, so this is a
+         *  progress report — never a claim about staleness or absence. */
+        result: "success" | "failed" | "running" | "unknown";
         fresh: boolean | null;
         lastSuccessAt?: string;
         ageMs?: number;
@@ -208,6 +211,12 @@ function refreshResult(result: ReadOnlyCommandResult, now: number): RefreshResul
   const serviceResult = fields.get("Result");
   const exitStatus = fields.get("ExecMainStatus");
   const completedAt = fields.get("ExecMainExitTimestamp");
+  // #1090: an empty ExecMainExitTimestamp says "no completed run yet", which
+  // is equally true of a unit that has never run and of one executing right
+  // now — systemd clears it when the next run starts. ActiveState comes back
+  // from the same single `systemctl show` and separates the two; evidence
+  // captured without the property keeps the conservative pre-#1090 reading.
+  const activeState = fields.get("ActiveState");
   if (serviceResult === undefined || exitStatus === undefined || completedAt === undefined) {
     return unknown("refresh service returned an unrecognized result", true);
   }
@@ -219,6 +228,12 @@ function refreshResult(result: ReadOnlyCommandResult, now: number): RefreshResul
     };
   }
   if (completedAt === "" || completedAt === "n/a") {
+    if (activeState === "activating" || activeState === "active") {
+      // There is no completed timestamp to measure staleness against yet, but
+      // this is progress, not absence: the reindex is keeping the graph fresh
+      // at this moment, so neither the row nor the previous message degrades.
+      return { health: { result: "running", fresh: null }, uncertain: false };
+    }
     return unknown("no successful refresh has been recorded", false);
   }
   const completedMs = Date.parse(completedAt);
@@ -290,6 +305,7 @@ export async function probeCodeGraph(
       "--property=Result",
       "--property=ExecMainStatus",
       "--property=ExecMainExitTimestamp",
+      "--property=ActiveState",
     ]),
   ]);
 

package/src/groom.ts

@@ -114,6 +114,17 @@ export interface ReadyGateRejection {
  * {@link toSpecDurableVerdict} still recovers the verdict and the candidate is
  * not re-groomed — the spec is rejected, not ungroomed.
  *
+ * That durability is bounded by the verdict itself (#1060). A rejection
+ * beside a verdict the contract still accepts is not re-groomable, because
+ * the fault lies in the issue — missing criteria, a missing lane — and only
+ * an edit to the issue can fix it. A rejection beside a verdict the contract
+ * refuses — veltro#731's prose lane entry, persisted before parse-time lane
+ * validation — reads as not-durable through {@link toSpecDurableVerdict},
+ * and the candidate becomes re-groomable: no issue edit can ever satisfy a
+ * gate whose refusal is baked into the verdict, and complying with the
+ * refusal's remedy would write the unusable entry into the issue itself, so
+ * a fresh pass is the only repair.
+ *
  * Fails closed on anything it cannot read: an empty `missing` array is not a
  * rejection (a gate that found nothing missing passed), and a non-string entry
  * would render as `undefined` in a digest line an operator is asked to act on.

package/src/orchestrator-tick.ts

@@ -3642,14 +3642,20 @@ export async function sendArmNotice(text: string, surface: ArmNoticeSurface): Pr
     throw new Error("no Telegram bot token readable — the arm notice cannot send");
   }
   let topicId: number | undefined;
+  let project: { name: string; workspaceRoot?: string } | undefined;
   if (surface.project !== undefined) {
     try {
-      topicId = resolveProjectTopicId(findProject(loadConfig(), surface.project));
+      const p = findProject(loadConfig(), surface.project);
+      topicId = resolveProjectTopicId(p);
+      project = { name: p.name, workspaceRoot: p.workspaceRoot };
     } catch {
       /* no project config — flat chat, exactly like armTicks */
     }
   }
-  await sendTelegram(token, channel.owner, text, { topicId });
+  await sendTelegram(token, channel.owner, text, {
+    topicId,
+    ...(project === undefined ? {} : { project }),
+  });
 }
 
 /**

package/src/reports.ts

@@ -361,7 +361,10 @@ export function telegramReportSend(p: ProjectConfig): ReportSend {
     // limit would still be delivered whole (never truncated) — the seam would
     // simply under-report the extra ids, which is why the split lives at the
     // caller, not here.
-    const ids = await sendTelegram(token, chatId, text, { topicId: resolveProjectTopicId(p) });
+    const ids = await sendTelegram(token, chatId, text, {
+      topicId: resolveProjectTopicId(p),
+      project: { name: p.name, workspaceRoot: p.workspaceRoot },
+    });
     return ids[0];
   };
 }

package/src/settlement.ts

@@ -26,10 +26,12 @@ import {
   deriveChangedLine,
 } from "./diff-flags.ts";
 import {
+  EFFECTIVE_BUDGET_SAMPLE_RUNS,
   SPINNING_CAP_CLASSES,
   COMPOSE_DEPENDENCY_STARTUP_SIGNATURE,
   classifyRun,
   normalise,
+  observeTurnBudget,
   type ClassifyFacts,
 } from "./failure-class.ts";
 import { GhPrMissingError } from "./tracker/github.ts";
@@ -1516,6 +1518,13 @@ export async function classifyAndRecover(d: SettlementDeps): Promise<number> {
   // merged is settled here when the settle sweep could not establish identity
   // (#497). Every other exit returns 0.
   let settled = 0;
+  // One read for the whole sweep (#1063): the completed-run sample the
+  // effective turn budget is derived from. Each row is then judged against the
+  // budget *excluding itself*, so a just-killed run's own extreme pace cannot
+  // drag the average it is being explained against.
+  const latencySamples = store.recentLatencySamples(project.name, EFFECTIVE_BUDGET_SAMPLE_RUNS);
+  const observedBudgetFor = (runId: string) =>
+    observeTurnBudget(latencySamples, caps, project.workerModel, runId);
   for (const run of store.runsNeedingClassification(project.name, CLASSIFY_BATCH)) {
     const facts: ClassifyFacts = {};
     let classifiedRun = run;
@@ -1605,8 +1614,12 @@ export async function classifyAndRecover(d: SettlementDeps): Promise<number> {
         continue;
       }
     }
-
-    const { cls, recovery, evidence } = classifyRun(classifiedRun, facts, caps);
+    const { cls, recovery, evidence } = classifyRun(
+      classifiedRun,
+      facts,
+      caps,
+      observedBudgetFor(run.id),
+    );
 
     // A healthy green PR is not a failure of any class. Leaving the row
     // unclassified is what keeps it eligible for the sweep on the tick where its
@@ -1695,9 +1708,27 @@ async function recoverRun(
     // candidate admission can never accept — only the failed label comes off,
     // and the exhaustion reaches a human (#490, #348).
     if (cls === "wall-clock-cap-progress") {
+      // Same split the requeue branch applies (#1080): an issue the tracker
+      // reports closed was resolved by another route — a duplicate, a
+      // supersede, a decomposition — so continuing it would dispatch work
+      // nobody asked for. That verdict is terminal: release the lifecycle
+      // label(s) the row could be holding (the kill path swaps in-progress
+      // for failed; a crash between those two writes leaves either) and
+      // stamp `recoveredAt`, or `selectUnclassified` re-offers this row on
+      // every pass forever (#1095). An unreadable answer is the tracker
+      // failing to answer, not answering no — it stays transient and retries.
       const state = await tracker.issueState(run.issue).catch(() => undefined);
+      if (state === "closed") {
+        store.enqueueLabelOps(project.name, [
+          { issue: run.issue, op: "remove", label: project.stateLabels.failed },
+          { issue: run.issue, op: "remove", label: inProgress },
+        ]);
+        store.updateRun(run.id, { recoveredAt: Date.now() });
+        log(`#${run.issue} not continued from ${cls}: issue is closed`);
+        return;
+      }
       if (state !== "open") {
-        log(`#${run.issue} not continued from ${cls}: issue is ${state ?? "unreadable"}`);
+        log(`#${run.issue} not continued from ${cls}: issue is unreadable (retrying)`);
         return;
       }
       const continuation = store.continuationsFor(project.name, run.issue);
@@ -1732,6 +1763,42 @@ async function recoverRun(
       return;
     }
 
+    // `progress-stall`: the watch settled a hung session (#1086), which keeps
+    // the in-progress label held the way an orphan row does. Work to continue
+    // from hands that label back for a continuation brief; a budget already
+    // spent releases the issue to a human instead of re-offering a candidate
+    // admission can never accept — the same ceiling the orphan path honours.
+    if (cls === "progress-stall") {
+      const state = await tracker.issueState(run.issue).catch(() => undefined);
+      if (state !== "open") {
+        log(`#${run.issue} not continued from ${cls}: issue is ${state ?? "unreadable"}`);
+        return;
+      }
+      const continuation = store.continuationsFor(project.name, run.issue);
+      if (hasContinuationBudget(continuation, caps.maxContinuationsPerIssue)) {
+        await swapToQueue(d, run.issue, inProgress);
+        store.updateRun(run.id, { recoveredAt: Date.now() });
+        log(`#${run.issue} requeued after a progress stall: ${evidence}`);
+      } else {
+        store.enqueueLabelOps(project.name, [{ issue: run.issue, op: "remove", label: inProgress }]);
+        store.updateRun(run.id, { recoveredAt: Date.now() });
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue: run.issue,
+          summary: `#${run.issue} exhausted its continuation budget on progress stalls`,
+          detail: [
+            `Attempt ${run.attempt} was settled silent with work to continue from, but ${continuation} continuation(s) are already charged against a cap of ${caps.maxContinuationsPerIssue}.`,
+            evidence,
+            `Work to continue: branch ${run.branch} at ${run.headSha ?? run.salvageSha}${run.prUrl === undefined ? "" : ` — ${run.prUrl}`}.`,
+            "Sessions on this issue keep hanging, so another run would burn a worker slot for the same outcome. Re-scope it, raise maxContinuationsPerIssue for it, or finish the remaining work by hand.",
+          ].join("\n"),
+        });
+        log(`#${run.issue} not continued from ${cls}: continuation budget exhausted`);
+      }
+      return;
+    }
+
     // `model-empty-stop`: the provider answered with empty turns until the
     // harness ended the session. The work is not at fault and the row is not a
     // failed attempt (the counters exclude the class), so this hands the queue
@@ -1740,9 +1807,22 @@ async function recoverRun(
     // wall-clock path is: a provider stuck in that state must reach a human
     // instead of consuming the issue forever, one free retry at a time.
     if (cls === "model-empty-stop") {
+      // Same split as the wall-clock branch above (#1080, #1095): a closed
+      // issue is terminal — release the lifecycle label(s), stamp
+      // `recoveredAt`, stop being offered — while an unreadable tracker keeps
+      // the row unstamped and retrying on a later pass.
       const state = await tracker.issueState(run.issue).catch(() => undefined);
+      if (state === "closed") {
+        store.enqueueLabelOps(project.name, [
+          { issue: run.issue, op: "remove", label: project.stateLabels.failed },
+          { issue: run.issue, op: "remove", label: inProgress },
+        ]);
+        store.updateRun(run.id, { recoveredAt: Date.now() });
+        log(`#${run.issue} not continued from ${cls}: issue is closed`);
+        return;
+      }
       if (state !== "open") {
-        log(`#${run.issue} not continued from ${cls}: issue is ${state ?? "unreadable"}`);
+        log(`#${run.issue} not continued from ${cls}: issue is unreadable (retrying)`);
         return;
       }
       const continuation = store.continuationsFor(project.name, run.issue);
@@ -1871,11 +1951,22 @@ async function recoverRun(
       return;
     }
     // Only when the tracker still shows this issue as ours to hand back. An
-    // issue that is closed, or has no state label, was resolved by another route
-    // and requeueing it would dispatch work nobody asked for.
+    // issue that is closed was resolved by another route and requeueing it
+    // would dispatch work nobody asked for — so that verdict is terminal
+    // (#1080): release the dispatcher-owned in-progress label and stamp
+    // `recoveredAt`, exactly like the operator-withdrawal branch below, or the
+    // sweep re-offers this row on every pass forever. An unreadable answer is
+    // a different thing in kind — the tracker failing to answer, not answering
+    // no — so it stays transient and keeps retrying.
     const state = await tracker.issueState(run.issue).catch(() => undefined);
+    if (state === "closed") {
+      store.enqueueLabelOps(project.name, [{ issue: run.issue, op: "remove", label: inProgress }]);
+      store.updateRun(run.id, { recoveredAt: Date.now() });
+      log(`#${run.issue} not requeued from ${cls}: issue is closed`);
+      return;
+    }
     if (state !== "open") {
-      log(`#${run.issue} not requeued from ${cls}: issue is ${state ?? "unreadable"}`);
+      log(`#${run.issue} not requeued from ${cls}: issue is unreadable (retrying)`);
       return;
     }
     // A clean orphan whose queue label is already absent is a deliberate

package/src/status-render.ts

@@ -490,6 +490,9 @@ export function formatFleetStatus(
   lastStop: DaemonStop | undefined = undefined,
   siblings: { project: string; live: number }[] = [],
   grooming: string | undefined = undefined,
+  /** One line naming the flat-chat deliveries this project's stale pin caused
+   *  (#1094), or undefined when there is nothing outstanding. */
+  misrouteNote: string | undefined = undefined,
 ): string {
   const tickLine =
     layers.ticksDetail === undefined
@@ -595,6 +598,7 @@ export function formatFleetStatus(
     recoveryLine,
     herdrLine,
     telegramLine,
+    ...(misrouteNote === undefined ? [] : [misrouteNote]),
     ...(brief === undefined ? [] : [brief]),
     ...(decisions === undefined ? [] : [decisions]),
     ...(failureClasses === undefined ? [] : [failureClasses]),
@@ -811,6 +815,18 @@ export function formatReviewCorrections(rounds: readonly ReviewCorrectionRound[]
   });
 }
 
+/**
+ * The #1063 effective-turn-budget annotation for the `new worker turns` row:
+ * shown whenever observed per-turn latency makes the configured ceiling
+ * unreachable at all — the break-even pace is exactly wall clock ÷ max turns,
+ * so anything slower is material, anything faster is noise.
+ */
+function effectiveTurnBudgetSuffix(s: StatusSnapshot): string {
+  const observed = s.workerTurnBudgetObserved;
+  if (observed === undefined || observed.effectiveTurns >= s.caps.workerMaxTurns) return "";
+  return ` (effective ~${observed.effectiveTurns} at ${observed.minutesPerTurn.toFixed(2)} min/turn, last ${observed.sampleSize} runs)`;
+}
+
 
 function formatProjectBody(
   s: StatusSnapshot,
@@ -916,7 +932,7 @@ function formatProjectBody(
               : `${Math.max(1, Math.round(s.labelOps.oldestAgeMs / 1000))}s`
           })`,
         ]),
-    `  new worker turns   ${s.caps.workerMaxTurns}`,
+    `  new worker turns   ${s.caps.workerMaxTurns}${effectiveTurnBudgetSuffix(s)}`,
     ...s.turnOverrides.map(
       ({ issue, maxTurns }) => `  turn override      #${issue} → ${maxTurns} (next attempt)`,
     ),
@@ -1082,6 +1098,15 @@ function formatProjectBody(
       // the phase the line is naming, and a number attributed to the wrong phase
       // is worse than no number. The attempt's own cap remains visible as
       // `N/M turns cumulative`.
+      // Transcript silence (#1086), from the progress watch's recorded write
+      // instant — read off the row, never probed at render time (#919). This
+      // is where a stall is visible forming, before the pass settles it.
+      // Skipped under pause, whose silence is the pause working (#938), and
+      // for rows no longer live, whose transcripts have stopped forever.
+      const silent =
+        paused || r.state !== "running" || r.lastProgressAt === undefined
+          ? ""
+          : `  silent ${formatDownDuration(Math.max(0, now - r.lastProgressAt))}`;
       const progress = paused
         ? ""
         : round !== undefined
@@ -1093,7 +1118,7 @@ function formatProjectBody(
             ).toFixed(1)} turns/min avg` +
             `  projects ${Math.round(
               (r.turns * s.caps.workerWallClockMs) / Math.max(elapsedMs, 1_000),
-            )} turns at cap`;
+            )} turns at cap` + silent;
       lines.push(
         `  #${r.issue}  ${r.repo}  ${state}  attempt ${r.attempt}  ` +
           `${r.turns}/${r.maxTurns} turns${progress}  ${r.spendUsd.toFixed(2)}  ${r.branch}` +

package/src/store.ts

@@ -221,6 +221,7 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   failureCharges: true,
   continuationCharges: true,
   terminalEvidence: true,
+  lastProgressAt: true,
 };
 
 /** Everything SQLite will accept from us. */
@@ -281,6 +282,8 @@ interface RunRow {
   graphTools: string | null;
   failureCharges: number | null;
   continuationCharges: number | null;
+  /** NULL for a row the progress pass has not observed, or one with no transcript yet (#1086). */
+  lastProgressAt: number | null;
 }
 
 /** The `base_health` table exactly as SQLite hands it back. */
@@ -887,7 +890,11 @@ CREATE TABLE IF NOT EXISTS runs (
   model       TEXT,
   graphTools  TEXT,
   failureCharges INTEGER,
-  continuationCharges INTEGER
+  continuationCharges INTEGER,
+  -- When the run's transcript was last observed to grow, as epoch ms (#1086).
+  -- Written by the daemon's progress watch from the file's own mtime; NULL
+  -- reads as "not observed yet", never "no progress".
+  lastProgressAt INTEGER
 );
 CREATE INDEX IF NOT EXISTS runs_project_issue ON runs (project, issue);
 CREATE INDEX IF NOT EXISTS runs_project_state ON runs (project, state);
@@ -1752,6 +1759,7 @@ function toRecord(row: RunRow): RunRecord {
   };
   if (row.spendReservedUsd !== null) record.spendReservedUsd = row.spendReservedUsd;
   if (row.sessionFile !== null) record.sessionFile = row.sessionFile;
+  if (row.lastProgressAt !== null) record.lastProgressAt = row.lastProgressAt;
   if (row.workerPid !== null) record.workerPid = row.workerPid;
   if (row.paneId !== null) record.paneId = row.paneId;
   if (row.paneLabel !== null) record.paneLabel = row.paneLabel;
@@ -2321,6 +2329,12 @@ export function openStore(dbPath: string): Store {
   if (!columns.some((column) => column.name === "terminalEvidence")) {
     db.exec("ALTER TABLE runs ADD COLUMN terminalEvidence TEXT");
   }
+  // The progress watch's last-observed transcript write (#1086). Rows written
+  // before the column were never observed, so NULL is the honest reading — no
+  // backfill, because the instant only the file's own mtime holds.
+  if (!columns.some((column) => column.name === "lastProgressAt")) {
+    db.exec("ALTER TABLE runs ADD COLUMN lastProgressAt INTEGER");
+  }
   // Every row written before #132 is unclassified, and NULL is the honest
   // reading of that: the budget counters below deliberately still count an
   // unclassified terminal row exactly as this release's predecessor did, so an
@@ -2686,8 +2700,8 @@ export function openStore(dbPath: string): Store {
        id, project, issue, repo, branch, worktree, state, attempt, turns,
        maxTurns, spendUsd, spendReservedUsd, sessionFile, resumedFromRunId, lane, prUrl, headSha, mergeSha, baseRef,
        baseCheck, baseCheckAt, salvageSha, salvageError, salvageAckAt, startedAt,
-       endedAt, lastError, settlementFlags, report, graphTools
-     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       endedAt, lastError, settlementFlags, report, graphTools, lastProgressAt
+     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   );
   const selectRun = db.query<RunRow, [string]>(`SELECT * FROM runs WHERE id = ?`);
   const selectGraphToolsObs = db.query<{ graphTools: string }, [string]>(
@@ -3070,6 +3084,16 @@ export function openStore(dbPath: string): Store {
       ORDER BY endedAt DESC, rowid DESC
       LIMIT ?`,
   );
+  // Newest runs that can yield a per-turn pace (#1063): rows with turns and
+  // elapsed time recorded. Same over-sample discipline as the spend query
+  // above — the caller filters by model attribution, so this stays unfiltered
+  // beyond what no row can answer without.
+  const selectLatencySamples = db.query<RunRow, [string, number]>(
+    `SELECT * FROM runs
+      WHERE project = ? AND turns > 0 AND endedAt IS NOT NULL
+      ORDER BY endedAt DESC, rowid DESC
+      LIMIT ?`,
+  );
   const selectFailureClassCounts = db.query<{ cls: string; n: number }, [string]>(
     `SELECT failureClass AS cls, COUNT(*) AS n FROM runs
       WHERE project = ? AND failureClass IS NOT NULL AND recoveredAt IS NULL
@@ -4481,11 +4505,12 @@ export function openStore(dbPath: string): Store {
     },
   );
   // The states the review verb admits and the dispatch pass may therefore
-  // claim (#795): a settled green run, or a capped/failed run that pushed one
-  // (`failed` / `killed`). The terminal set is closed on purpose — a live row
-  // (`running` / `claimed`) is already doing its own work, a `pushed-pending`
-  // PR is not green yet, and a `blocked` / `orphaned` / `stopped` / `merged`
-  // row is not work the orchestrator returned for revision.
+  // claim (#795, #1101): a settled green run, a capped/failed run that pushed
+  // one (`failed` / `killed`), and — since #1101 — a `stopped` run that had
+  // already pushed when the operator stopped it. The set is closed on purpose
+  // — a live row (`running` / `claimed`) is already doing its own work, a
+  // `pushed-pending` PR is not green yet, and a `blocked` / `orphaned` /
+  // `merged` row is not work the orchestrator returned for revision.
   //
   // The terminal leg does two things in the same atomic statement (#795 review
   // rounds 1-2): it PRESERVES the budget charge the row's terminal event was
@@ -4522,13 +4547,21 @@ export function openStore(dbPath: string): Store {
   const claimRunForReviewGreen = db.query<unknown, [string]>(
     `UPDATE runs SET state = 'running', endedAt = NULL WHERE id = ? AND state = 'pushed-green'`,
   );
-  // Exactly one leg can match (the row is either terminal or pushed-green at
-  // the moment of the claim), a repeated claim matches neither, and the two
-  // statements plus the read of `changes` are one transaction — the dispatch
-  // pass can never see a half-claimed row.
+  // The stopped leg (#1101): reclaiming an operator-stopped run spends no
+  // budget — an operator stop never charged one — and `prUrl IS NOT NULL`
+  // keeps a stop before any push unclaimable: only a run whose row records
+  // the reviewed PR may be woken for its revision.
+  const claimRunForReviewStopped = db.query<unknown, [string]>(
+    `UPDATE runs SET state = 'running', endedAt = NULL WHERE id = ? AND state = 'stopped' AND prUrl IS NOT NULL`,
+  );
+  // Exactly one leg can match (the row is in exactly one state at the moment
+  // of the claim), a repeated claim matches none, and the three statements
+  // plus the read of `changes` are one transaction — the dispatch pass can
+  // never see a half-claimed row.
   const claimRunForReviewTx = db.transaction((runId: string): boolean => {
     if (claimRunForReviewTerminal.run(runId).changes > 0) return true;
-    return claimRunForReviewGreen.run(runId).changes > 0;
+    if (claimRunForReviewGreen.run(runId).changes > 0) return true;
+    return claimRunForReviewStopped.run(runId).changes > 0;
   });
 
   // Appending is a single-statement concatenation so even a write from a
@@ -4772,6 +4805,7 @@ export function openStore(dbPath: string): Store {
       toSql(record.settlementFlags),
       toSql(record.report),
       toSql(record.graphTools),
+      toSql(record.lastProgressAt),
     );
     return record;
   };
@@ -5889,6 +5923,9 @@ export function openStore(dbPath: string): Store {
     recentSpendSamples(project: string, limit: number): { turns: number; spendUsd: number }[] {
       return selectSpendSamples.all(project, limit).map((row) => ({ ...row }));
     },
+    recentLatencySamples(project: string, limit: number): RunRecord[] {
+      return selectLatencySamples.all(project, limit).map(toRecord);
+    },
 
     failureClassCounts(project: string): { cls: FailureClass; n: number }[] {
       return selectFailureClassCounts

package/src/to-spec.ts

@@ -99,6 +99,44 @@ export const TO_SPEC_MAX_SOURCE_AGE_MS = 24 * 60 * 60 * 1000;
 /** `routing: "MULTI"` requires `routingSplit` naming one repo per slice. */
 const MULTI_ROUTING = "MULTI" as const;
 
+/**
+ * One write-lane entry (#1060): a plausible repository-relative path.
+ *
+ * A lane entry that is prose — veltro#731's
+ * `"docker-compose.dev.yml (only if …)"` parsed as one non-empty string —
+ * used to harden into the durable verdict and brick its issue: the ready
+ * gate then refuses every promotion whose issue-side lane disagrees, a
+ * gate-rejected candidate is deliberately never re-groomed, and the
+ * refusal's own remedy (edit the issue to match) would have written the
+ * parenthetical into the issue. The grammar is therefore enforced here, at
+ * parse time, where a refusal is `malformed`, the retry cooldown can act on
+ * it, and nothing unusable becomes an admission contract. Deliberately
+ * narrow so no valid lane is newly rejected: dots, hyphens, nested
+ * directories, globs and trailing slashes all pass; only a leading `/`
+ * (absolute) or whitespace/parentheses inside the entry (prose) is refused.
+ */
+const LANE_ENTRY_PROSE = /[\s()]/;
+
+/** Every problem with one write lane's entries, each naming the offending
+ *  entry verbatim (`field[index] "…"`), in array order — the detail a repair
+ *  round hands back and a refusal records must be readable against the next
+ *  pass. Empty for a usable lane. */
+function laneEntryProblems(field: string, entries: readonly string[]): string[] {
+  const problems: string[] = [];
+  for (const [index, entry] of entries.entries()) {
+    if (entry.startsWith("/")) {
+      problems.push(
+        `${field}[${index}] ${JSON.stringify(entry)} is absolute — a write lane names repository-relative paths`,
+      );
+    } else if (LANE_ENTRY_PROSE.test(entry)) {
+      problems.push(
+        `${field}[${index}] ${JSON.stringify(entry)} is not a path — write-lane entries carry no whitespace or parentheses`,
+      );
+    }
+  }
+  return problems;
+}
+
 const ToSpecSourceSchema = z
   .object({
     name: z.string().trim().min(1).describe("The authoritative source that was read: repo or tracker, e.g. `TerrifiedBug/conductor`."),
@@ -146,6 +184,14 @@ const ToSpecDecompositionChildSchema = z
       .describe("The focused commands that prove this child, each with its cwd when it matters."),
   })
   .strict()
+  .superRefine((child, ctx) => {
+    // #1060: a decomposition child carries the identical admission contract,
+    // so its write lane obeys the identical grammar — prose here would
+    // harden into a child slice nothing can file.
+    for (const problem of laneEntryProblems("writeLane", child.writeLane)) {
+      ctx.addIssue({ code: "custom", message: problem });
+    }
+  })
   .describe("One ordered child slice a decomposition proposal names (#1041).");
 
 /**
@@ -309,6 +355,12 @@ const ToSpecResultSchema = z
     if (value.routing !== MULTI_ROUTING && value.routingSplit !== undefined) {
       ctx.addIssue({ code: "custom", message: "routingSplit is only valid with routing `MULTI`" });
     }
+    // #1060: the lane is the admission contract, so its entries must be
+    // plausible repository-relative paths — refused here, at parse time,
+    // rather than hardening into a durable verdict no promotion can use.
+    for (const problem of laneEntryProblems("fileLane", value.fileLane)) {
+      ctx.addIssue({ code: "custom", message: problem });
+    }
   })
   .describe("A complete, to-spec grooming result; nothing outside this shape is accepted.");