omp-conductor 0.20.1 → 0.20.3

package/src/ready-gate.ts

@@ -95,6 +95,65 @@ export function acceptanceCriteriaSection(text: string): { heading: string; crit
   return { heading: lines[start]!.trim(), criteria };
 }
 
+/** The leading run of backticked tokens in a bullet: `` `a.ts`, `b/c.ts` ``
+ *  reads as two paths, while a backticked token after prose is prose, never a
+ *  declaration. Mirrors admission's private helper of the same shape — the
+ *  gate cannot import it, and a second grammar beside the first would make
+ *  issues that render correctly for one parse wrongly for the other. */
+function leadingBacktickedRun(text: string): string[] {
+  const trimmed = text.trim();
+  if (!trimmed.startsWith("`")) return [];
+  const run: string[] = [];
+  let pos = 0;
+  while (true) {
+    if (trimmed[pos] !== "`") break;
+    const close = trimmed.indexOf("`", pos + 1);
+    if (close < 0) break;
+    const token = trimmed.slice(pos + 1, close).trim();
+    if (token === "") break;
+    run.push(token);
+    pos = close + 1;
+    const sep = /^[,\s]+/.exec(trimmed.slice(pos));
+    if (sep === null) break;
+    pos += sep[0].length;
+  }
+  return run;
+}
+
+/**
+ * The read-only entry points an issue declares: files its worker must read —
+ * the caller to understand, the file that proves the convention — but never
+ * write (#1108). The grammar mirrors the write-lane section: a `#`-to-`######`
+ * heading spelling `Read-only` optionally followed by `entry points`, an
+ * optional trailing colon, then the contiguous bullet run any non-bullet line
+ * ends; each bullet contributes its leading backticked run, so an issue that
+ * renders correctly for the lane sections renders correctly here too. Unlike
+ * the lane there is no inline form and no bare-token fallback: marking a file
+ * read-only is a deliberate act, and the backticked bullet is the whole shape.
+ *
+ * Every occurrence in the text counts, where a lane declaration replaces:
+ * read-only lists accumulate, so a correction comment adds references without
+ * restating the body's.
+ */
+export function readOnlyEntryPoints(text: string): string[] {
+  const files: string[] = [];
+  let inSection = false;
+  for (const line of text.split("\n")) {
+    if (/^[ \t]*#{1,6}[ \t]+read[-\s]only(?:[ \t]+entry[ \t]+points)?[ \t]*[:.]?[ \t]*$/i.test(line)) {
+      inSection = true;
+      continue;
+    }
+    if (!inSection || line.trim() === "") continue;
+    const marker = line.match(/^[ \t]*(?:[-*+]|\d+[.)])[ \t]+(?:\[[ xX]\][ \t]+)?/);
+    if (marker === null) {
+      inSection = false;
+      continue;
+    }
+    files.push(...leadingBacktickedRun(line.slice(marker[0].length)));
+  }
+  return files;
+}
+
 /** Trimmed non-empty strings out of a value the type system claims is a string
  *  array. Defensive because the gate is the last thing between a hand-edited
  *  store row and a dispatched worker: a malformed field is a refusal, never a
@@ -114,7 +173,7 @@ function strings(value: unknown): string[] {
  * May this verdict be promoted mechanically?
  *
  * Every check is one named miss. The order is fixed — verdict, readability,
- * acceptance criteria, write lane, proof commands, sizing evidence,
+ * acceptance criteria, write lane, entry points, proof commands, sizing evidence,
  * dependencies, premise, routing, state labels — so the same input always
  * produces the same list and a digest line is stable across ticks.
  *
@@ -181,6 +240,7 @@ export function readyGate(input: ReadyGateInput): ReadyGateVerdict {
       ? undefined
       : (writeLaneSectionHeading(body) ??
         comments.map((comment) => writeLaneSectionHeading(comment.body)).find((found) => found !== undefined));
+  const declared = lane === undefined ? [] : [...new Set(strings(lane.files))].sort();
   if (verdictLane.length === 0) {
     // The schema requires at least one path, so this is a hand-edited or
     // corrupt row. An empty lane on both sides would otherwise *match*, and
@@ -190,11 +250,46 @@ export function readyGate(input: ReadyGateInput): ReadyGateVerdict {
     missing.push(
       `the write-lane section (${heading}) parsed no path-like files — name them as backticked bullets directly under the heading`,
     );
-  } else {
-    const declared = lane === undefined ? [] : [...new Set(strings(lane.files))].sort();
-    if (declared.length !== verdictLane.length || declared.some((path, index) => path !== verdictLane[index])) {
+  } else if (declared.length !== verdictLane.length || declared.some((path, index) => path !== verdictLane[index])) {
+    missing.push(
+      `the issue's write lane [${declared.join(", ")}] disagrees with the verdict's file lane [${verdictLane.join(", ")}]`,
+    );
+  }
+
+  // An entry point outside the lane is usually legitimate — the reference
+  // file, the caller to understand first — so the gate refuses the *unstated*
+  // one, not the idea (#1108): eight settlement flags in one day were lane
+  // escapes, several into files the issue itself had already named as an
+  // entry point. Putting the file in the lane it is meant to be written in,
+  // or listing it under a `## Read-only entry points` heading, both satisfy
+  // the check; a hard refusal for every reference would push promoters into
+  // stopping the one field workers most need.
+  //
+  // Judged only when the two lane lists agree: a disagreement is refused
+  // anyway, and entry points computed against a lane about to be rewritten
+  // would be noise stacked on the actionable fact. No parsed lane means
+  // nothing to stand outside of.
+  const entryPoints = [...new Set(strings(result.entryPoints))];
+  const lanesAgree =
+    verdictLane.length > 0 &&
+    declared.length === verdictLane.length &&
+    declared.every((path, index) => path === verdictLane[index]);
+  if (entryPoints.length > 0 && lanesAgree) {
+    const readOnly = [
+      ...new Set([body, ...comments.map((comment) => comment.body)].flatMap((text) => readOnlyEntryPoints(text))),
+    ];
+    // Exact member or anything under a trailing-slash directory entry — the
+    // containment the lane enforcement itself applies to written files
+    // (diff-flags.ts:withinLane).
+    const escaped = entryPoints.filter(
+      (path) =>
+        !declared.includes(path) &&
+        !declared.some((entry) => entry.endsWith("/") && path.startsWith(entry)) &&
+        !readOnly.includes(path),
+    );
+    if (escaped.length > 0) {
       missing.push(
-        `the issue's write lane [${declared.join(", ")}] disagrees with the verdict's file lane [${verdictLane.join(", ")}]`,
+        `entry points ${escaped.join(", ")} are neither in the issue's write lane [${declared.join(", ")}] nor marked read-only — put each in the \`## Exact write lane\` bullets meant for writing, or declare it under \`## Read-only entry points\``,
       );
     }
   }

package/src/reports.ts

@@ -361,7 +361,10 @@ export function telegramReportSend(p: ProjectConfig): ReportSend {
     // limit would still be delivered whole (never truncated) — the seam would
     // simply under-report the extra ids, which is why the split lives at the
     // caller, not here.
-    const ids = await sendTelegram(token, chatId, text, { topicId: resolveProjectTopicId(p) });
+    const ids = await sendTelegram(token, chatId, text, {
+      topicId: resolveProjectTopicId(p),
+      project: { name: p.name, workspaceRoot: p.workspaceRoot },
+    });
     return ids[0];
   };
 }

package/src/settlement.ts

@@ -26,10 +26,12 @@ import {
   deriveChangedLine,
 } from "./diff-flags.ts";
 import {
+  EFFECTIVE_BUDGET_SAMPLE_RUNS,
   SPINNING_CAP_CLASSES,
   COMPOSE_DEPENDENCY_STARTUP_SIGNATURE,
   classifyRun,
   normalise,
+  observeTurnBudget,
   type ClassifyFacts,
 } from "./failure-class.ts";
 import { GhPrMissingError } from "./tracker/github.ts";
@@ -1516,6 +1518,13 @@ export async function classifyAndRecover(d: SettlementDeps): Promise<number> {
   // merged is settled here when the settle sweep could not establish identity
   // (#497). Every other exit returns 0.
   let settled = 0;
+  // One read for the whole sweep (#1063): the completed-run sample the
+  // effective turn budget is derived from. Each row is then judged against the
+  // budget *excluding itself*, so a just-killed run's own extreme pace cannot
+  // drag the average it is being explained against.
+  const latencySamples = store.recentLatencySamples(project.name, EFFECTIVE_BUDGET_SAMPLE_RUNS);
+  const observedBudgetFor = (runId: string) =>
+    observeTurnBudget(latencySamples, caps, project.workerModel, runId);
   for (const run of store.runsNeedingClassification(project.name, CLASSIFY_BATCH)) {
     const facts: ClassifyFacts = {};
     let classifiedRun = run;
@@ -1605,8 +1614,12 @@ export async function classifyAndRecover(d: SettlementDeps): Promise<number> {
         continue;
       }
     }
-
-    const { cls, recovery, evidence } = classifyRun(classifiedRun, facts, caps);
+    const { cls, recovery, evidence } = classifyRun(
+      classifiedRun,
+      facts,
+      caps,
+      observedBudgetFor(run.id),
+    );
 
     // A healthy green PR is not a failure of any class. Leaving the row
     // unclassified is what keeps it eligible for the sweep on the tick where its
@@ -1695,9 +1708,27 @@ async function recoverRun(
     // candidate admission can never accept — only the failed label comes off,
     // and the exhaustion reaches a human (#490, #348).
     if (cls === "wall-clock-cap-progress") {
+      // Same split the requeue branch applies (#1080): an issue the tracker
+      // reports closed was resolved by another route — a duplicate, a
+      // supersede, a decomposition — so continuing it would dispatch work
+      // nobody asked for. That verdict is terminal: release the lifecycle
+      // label(s) the row could be holding (the kill path swaps in-progress
+      // for failed; a crash between those two writes leaves either) and
+      // stamp `recoveredAt`, or `selectUnclassified` re-offers this row on
+      // every pass forever (#1095). An unreadable answer is the tracker
+      // failing to answer, not answering no — it stays transient and retries.
       const state = await tracker.issueState(run.issue).catch(() => undefined);
+      if (state === "closed") {
+        store.enqueueLabelOps(project.name, [
+          { issue: run.issue, op: "remove", label: project.stateLabels.failed },
+          { issue: run.issue, op: "remove", label: inProgress },
+        ]);
+        store.updateRun(run.id, { recoveredAt: Date.now() });
+        log(`#${run.issue} not continued from ${cls}: issue is closed`);
+        return;
+      }
       if (state !== "open") {
-        log(`#${run.issue} not continued from ${cls}: issue is ${state ?? "unreadable"}`);
+        log(`#${run.issue} not continued from ${cls}: issue is unreadable (retrying)`);
         return;
       }
       const continuation = store.continuationsFor(project.name, run.issue);
@@ -1732,6 +1763,42 @@ async function recoverRun(
       return;
     }
 
+    // `progress-stall`: the watch settled a hung session (#1086), which keeps
+    // the in-progress label held the way an orphan row does. Work to continue
+    // from hands that label back for a continuation brief; a budget already
+    // spent releases the issue to a human instead of re-offering a candidate
+    // admission can never accept — the same ceiling the orphan path honours.
+    if (cls === "progress-stall") {
+      const state = await tracker.issueState(run.issue).catch(() => undefined);
+      if (state !== "open") {
+        log(`#${run.issue} not continued from ${cls}: issue is ${state ?? "unreadable"}`);
+        return;
+      }
+      const continuation = store.continuationsFor(project.name, run.issue);
+      if (hasContinuationBudget(continuation, caps.maxContinuationsPerIssue)) {
+        await swapToQueue(d, run.issue, inProgress);
+        store.updateRun(run.id, { recoveredAt: Date.now() });
+        log(`#${run.issue} requeued after a progress stall: ${evidence}`);
+      } else {
+        store.enqueueLabelOps(project.name, [{ issue: run.issue, op: "remove", label: inProgress }]);
+        store.updateRun(run.id, { recoveredAt: Date.now() });
+        await safeEscalate(d, {
+          tier: 1,
+          project: project.name,
+          issue: run.issue,
+          summary: `#${run.issue} exhausted its continuation budget on progress stalls`,
+          detail: [
+            `Attempt ${run.attempt} was settled silent with work to continue from, but ${continuation} continuation(s) are already charged against a cap of ${caps.maxContinuationsPerIssue}.`,
+            evidence,
+            `Work to continue: branch ${run.branch} at ${run.headSha ?? run.salvageSha}${run.prUrl === undefined ? "" : ` — ${run.prUrl}`}.`,
+            "Sessions on this issue keep hanging, so another run would burn a worker slot for the same outcome. Re-scope it, raise maxContinuationsPerIssue for it, or finish the remaining work by hand.",
+          ].join("\n"),
+        });
+        log(`#${run.issue} not continued from ${cls}: continuation budget exhausted`);
+      }
+      return;
+    }
+
     // `model-empty-stop`: the provider answered with empty turns until the
     // harness ended the session. The work is not at fault and the row is not a
     // failed attempt (the counters exclude the class), so this hands the queue
@@ -1740,9 +1807,22 @@ async function recoverRun(
     // wall-clock path is: a provider stuck in that state must reach a human
     // instead of consuming the issue forever, one free retry at a time.
     if (cls === "model-empty-stop") {
+      // Same split as the wall-clock branch above (#1080, #1095): a closed
+      // issue is terminal — release the lifecycle label(s), stamp
+      // `recoveredAt`, stop being offered — while an unreadable tracker keeps
+      // the row unstamped and retrying on a later pass.
       const state = await tracker.issueState(run.issue).catch(() => undefined);
+      if (state === "closed") {
+        store.enqueueLabelOps(project.name, [
+          { issue: run.issue, op: "remove", label: project.stateLabels.failed },
+          { issue: run.issue, op: "remove", label: inProgress },
+        ]);
+        store.updateRun(run.id, { recoveredAt: Date.now() });
+        log(`#${run.issue} not continued from ${cls}: issue is closed`);
+        return;
+      }
       if (state !== "open") {
-        log(`#${run.issue} not continued from ${cls}: issue is ${state ?? "unreadable"}`);
+        log(`#${run.issue} not continued from ${cls}: issue is unreadable (retrying)`);
         return;
       }
       const continuation = store.continuationsFor(project.name, run.issue);
@@ -1871,11 +1951,22 @@ async function recoverRun(
       return;
     }
     // Only when the tracker still shows this issue as ours to hand back. An
-    // issue that is closed, or has no state label, was resolved by another route
-    // and requeueing it would dispatch work nobody asked for.
+    // issue that is closed was resolved by another route and requeueing it
+    // would dispatch work nobody asked for — so that verdict is terminal
+    // (#1080): release the dispatcher-owned in-progress label and stamp
+    // `recoveredAt`, exactly like the operator-withdrawal branch below, or the
+    // sweep re-offers this row on every pass forever. An unreadable answer is
+    // a different thing in kind — the tracker failing to answer, not answering
+    // no — so it stays transient and keeps retrying.
     const state = await tracker.issueState(run.issue).catch(() => undefined);
+    if (state === "closed") {
+      store.enqueueLabelOps(project.name, [{ issue: run.issue, op: "remove", label: inProgress }]);
+      store.updateRun(run.id, { recoveredAt: Date.now() });
+      log(`#${run.issue} not requeued from ${cls}: issue is closed`);
+      return;
+    }
     if (state !== "open") {
-      log(`#${run.issue} not requeued from ${cls}: issue is ${state ?? "unreadable"}`);
+      log(`#${run.issue} not requeued from ${cls}: issue is unreadable (retrying)`);
       return;
     }
     // A clean orphan whose queue label is already absent is a deliberate

package/src/status-render.ts

@@ -490,6 +490,9 @@ export function formatFleetStatus(
   lastStop: DaemonStop | undefined = undefined,
   siblings: { project: string; live: number }[] = [],
   grooming: string | undefined = undefined,
+  /** One line naming the flat-chat deliveries this project's stale pin caused
+   *  (#1094), or undefined when there is nothing outstanding. */
+  misrouteNote: string | undefined = undefined,
 ): string {
   const tickLine =
     layers.ticksDetail === undefined
@@ -595,6 +598,7 @@ export function formatFleetStatus(
     recoveryLine,
     herdrLine,
     telegramLine,
+    ...(misrouteNote === undefined ? [] : [misrouteNote]),
     ...(brief === undefined ? [] : [brief]),
     ...(decisions === undefined ? [] : [decisions]),
     ...(failureClasses === undefined ? [] : [failureClasses]),
@@ -811,6 +815,18 @@ export function formatReviewCorrections(rounds: readonly ReviewCorrectionRound[]
   });
 }
 
+/**
+ * The #1063 effective-turn-budget annotation for the `new worker turns` row:
+ * shown whenever observed per-turn latency makes the configured ceiling
+ * unreachable at all — the break-even pace is exactly wall clock ÷ max turns,
+ * so anything slower is material, anything faster is noise.
+ */
+function effectiveTurnBudgetSuffix(s: StatusSnapshot): string {
+  const observed = s.workerTurnBudgetObserved;
+  if (observed === undefined || observed.effectiveTurns >= s.caps.workerMaxTurns) return "";
+  return ` (effective ~${observed.effectiveTurns} at ${observed.minutesPerTurn.toFixed(2)} min/turn, last ${observed.sampleSize} runs)`;
+}
+
 
 function formatProjectBody(
   s: StatusSnapshot,
@@ -916,7 +932,7 @@ function formatProjectBody(
               : `${Math.max(1, Math.round(s.labelOps.oldestAgeMs / 1000))}s`
           })`,
         ]),
-    `  new worker turns   ${s.caps.workerMaxTurns}`,
+    `  new worker turns   ${s.caps.workerMaxTurns}${effectiveTurnBudgetSuffix(s)}`,
     ...s.turnOverrides.map(
       ({ issue, maxTurns }) => `  turn override      #${issue} → ${maxTurns} (next attempt)`,
     ),
@@ -1082,6 +1098,15 @@ function formatProjectBody(
       // the phase the line is naming, and a number attributed to the wrong phase
       // is worse than no number. The attempt's own cap remains visible as
       // `N/M turns cumulative`.
+      // Transcript silence (#1086), from the progress watch's recorded write
+      // instant — read off the row, never probed at render time (#919). This
+      // is where a stall is visible forming, before the pass settles it.
+      // Skipped under pause, whose silence is the pause working (#938), and
+      // for rows no longer live, whose transcripts have stopped forever.
+      const silent =
+        paused || r.state !== "running" || r.lastProgressAt === undefined
+          ? ""
+          : `  silent ${formatDownDuration(Math.max(0, now - r.lastProgressAt))}`;
       const progress = paused
         ? ""
         : round !== undefined
@@ -1093,7 +1118,7 @@ function formatProjectBody(
             ).toFixed(1)} turns/min avg` +
             `  projects ${Math.round(
               (r.turns * s.caps.workerWallClockMs) / Math.max(elapsedMs, 1_000),
-            )} turns at cap`;
+            )} turns at cap` + silent;
       lines.push(
         `  #${r.issue}  ${r.repo}  ${state}  attempt ${r.attempt}  ` +
           `${r.turns}/${r.maxTurns} turns${progress}  ${r.spendUsd.toFixed(2)}  ${r.branch}` +

package/src/store.ts

@@ -221,6 +221,7 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   failureCharges: true,
   continuationCharges: true,
   terminalEvidence: true,
+  lastProgressAt: true,
 };
 
 /** Everything SQLite will accept from us. */
@@ -281,6 +282,8 @@ interface RunRow {
   graphTools: string | null;
   failureCharges: number | null;
   continuationCharges: number | null;
+  /** NULL for a row the progress pass has not observed, or one with no transcript yet (#1086). */
+  lastProgressAt: number | null;
 }
 
 /** The `base_health` table exactly as SQLite hands it back. */
@@ -887,7 +890,11 @@ CREATE TABLE IF NOT EXISTS runs (
   model       TEXT,
   graphTools  TEXT,
   failureCharges INTEGER,
-  continuationCharges INTEGER
+  continuationCharges INTEGER,
+  -- When the run's transcript was last observed to grow, as epoch ms (#1086).
+  -- Written by the daemon's progress watch from the file's own mtime; NULL
+  -- reads as "not observed yet", never "no progress".
+  lastProgressAt INTEGER
 );
 CREATE INDEX IF NOT EXISTS runs_project_issue ON runs (project, issue);
 CREATE INDEX IF NOT EXISTS runs_project_state ON runs (project, state);
@@ -1752,6 +1759,7 @@ function toRecord(row: RunRow): RunRecord {
   };
   if (row.spendReservedUsd !== null) record.spendReservedUsd = row.spendReservedUsd;
   if (row.sessionFile !== null) record.sessionFile = row.sessionFile;
+  if (row.lastProgressAt !== null) record.lastProgressAt = row.lastProgressAt;
   if (row.workerPid !== null) record.workerPid = row.workerPid;
   if (row.paneId !== null) record.paneId = row.paneId;
   if (row.paneLabel !== null) record.paneLabel = row.paneLabel;
@@ -2321,6 +2329,12 @@ export function openStore(dbPath: string): Store {
   if (!columns.some((column) => column.name === "terminalEvidence")) {
     db.exec("ALTER TABLE runs ADD COLUMN terminalEvidence TEXT");
   }
+  // The progress watch's last-observed transcript write (#1086). Rows written
+  // before the column were never observed, so NULL is the honest reading — no
+  // backfill, because the instant only the file's own mtime holds.
+  if (!columns.some((column) => column.name === "lastProgressAt")) {
+    db.exec("ALTER TABLE runs ADD COLUMN lastProgressAt INTEGER");
+  }
   // Every row written before #132 is unclassified, and NULL is the honest
   // reading of that: the budget counters below deliberately still count an
   // unclassified terminal row exactly as this release's predecessor did, so an
@@ -2686,8 +2700,8 @@ export function openStore(dbPath: string): Store {
        id, project, issue, repo, branch, worktree, state, attempt, turns,
        maxTurns, spendUsd, spendReservedUsd, sessionFile, resumedFromRunId, lane, prUrl, headSha, mergeSha, baseRef,
        baseCheck, baseCheckAt, salvageSha, salvageError, salvageAckAt, startedAt,
-       endedAt, lastError, settlementFlags, report, graphTools
-     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       endedAt, lastError, settlementFlags, report, graphTools, lastProgressAt
+     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   );
   const selectRun = db.query<RunRow, [string]>(`SELECT * FROM runs WHERE id = ?`);
   const selectGraphToolsObs = db.query<{ graphTools: string }, [string]>(
@@ -3070,6 +3084,16 @@ export function openStore(dbPath: string): Store {
       ORDER BY endedAt DESC, rowid DESC
       LIMIT ?`,
   );
+  // Newest runs that can yield a per-turn pace (#1063): rows with turns and
+  // elapsed time recorded. Same over-sample discipline as the spend query
+  // above — the caller filters by model attribution, so this stays unfiltered
+  // beyond what no row can answer without.
+  const selectLatencySamples = db.query<RunRow, [string, number]>(
+    `SELECT * FROM runs
+      WHERE project = ? AND turns > 0 AND endedAt IS NOT NULL
+      ORDER BY endedAt DESC, rowid DESC
+      LIMIT ?`,
+  );
   const selectFailureClassCounts = db.query<{ cls: string; n: number }, [string]>(
     `SELECT failureClass AS cls, COUNT(*) AS n FROM runs
       WHERE project = ? AND failureClass IS NOT NULL AND recoveredAt IS NULL
@@ -4481,11 +4505,12 @@ export function openStore(dbPath: string): Store {
     },
   );
   // The states the review verb admits and the dispatch pass may therefore
-  // claim (#795): a settled green run, or a capped/failed run that pushed one
-  // (`failed` / `killed`). The terminal set is closed on purpose — a live row
-  // (`running` / `claimed`) is already doing its own work, a `pushed-pending`
-  // PR is not green yet, and a `blocked` / `orphaned` / `stopped` / `merged`
-  // row is not work the orchestrator returned for revision.
+  // claim (#795, #1101): a settled green run, a capped/failed run that pushed
+  // one (`failed` / `killed`), and — since #1101 — a `stopped` run that had
+  // already pushed when the operator stopped it. The set is closed on purpose
+  // — a live row (`running` / `claimed`) is already doing its own work, a
+  // `pushed-pending` PR is not green yet, and a `blocked` / `orphaned` /
+  // `merged` row is not work the orchestrator returned for revision.
   //
   // The terminal leg does two things in the same atomic statement (#795 review
   // rounds 1-2): it PRESERVES the budget charge the row's terminal event was
@@ -4522,13 +4547,21 @@ export function openStore(dbPath: string): Store {
   const claimRunForReviewGreen = db.query<unknown, [string]>(
     `UPDATE runs SET state = 'running', endedAt = NULL WHERE id = ? AND state = 'pushed-green'`,
   );
-  // Exactly one leg can match (the row is either terminal or pushed-green at
-  // the moment of the claim), a repeated claim matches neither, and the two
-  // statements plus the read of `changes` are one transaction — the dispatch
-  // pass can never see a half-claimed row.
+  // The stopped leg (#1101): reclaiming an operator-stopped run spends no
+  // budget — an operator stop never charged one — and `prUrl IS NOT NULL`
+  // keeps a stop before any push unclaimable: only a run whose row records
+  // the reviewed PR may be woken for its revision.
+  const claimRunForReviewStopped = db.query<unknown, [string]>(
+    `UPDATE runs SET state = 'running', endedAt = NULL WHERE id = ? AND state = 'stopped' AND prUrl IS NOT NULL`,
+  );
+  // Exactly one leg can match (the row is in exactly one state at the moment
+  // of the claim), a repeated claim matches none, and the three statements
+  // plus the read of `changes` are one transaction — the dispatch pass can
+  // never see a half-claimed row.
   const claimRunForReviewTx = db.transaction((runId: string): boolean => {
     if (claimRunForReviewTerminal.run(runId).changes > 0) return true;
-    return claimRunForReviewGreen.run(runId).changes > 0;
+    if (claimRunForReviewGreen.run(runId).changes > 0) return true;
+    return claimRunForReviewStopped.run(runId).changes > 0;
   });
 
   // Appending is a single-statement concatenation so even a write from a
@@ -4772,6 +4805,7 @@ export function openStore(dbPath: string): Store {
       toSql(record.settlementFlags),
       toSql(record.report),
       toSql(record.graphTools),
+      toSql(record.lastProgressAt),
     );
     return record;
   };
@@ -5889,6 +5923,9 @@ export function openStore(dbPath: string): Store {
     recentSpendSamples(project: string, limit: number): { turns: number; spendUsd: number }[] {
       return selectSpendSamples.all(project, limit).map((row) => ({ ...row }));
     },
+    recentLatencySamples(project: string, limit: number): RunRecord[] {
+      return selectLatencySamples.all(project, limit).map(toRecord);
+    },
 
     failureClassCounts(project: string): { cls: FailureClass; n: number }[] {
       return selectFailureClassCounts

package/src/to-spec.ts

@@ -99,6 +99,44 @@ export const TO_SPEC_MAX_SOURCE_AGE_MS = 24 * 60 * 60 * 1000;
 /** `routing: "MULTI"` requires `routingSplit` naming one repo per slice. */
 const MULTI_ROUTING = "MULTI" as const;
 
+/**
+ * One write-lane entry (#1060): a plausible repository-relative path.
+ *
+ * A lane entry that is prose — veltro#731's
+ * `"docker-compose.dev.yml (only if …)"` parsed as one non-empty string —
+ * used to harden into the durable verdict and brick its issue: the ready
+ * gate then refuses every promotion whose issue-side lane disagrees, a
+ * gate-rejected candidate is deliberately never re-groomed, and the
+ * refusal's own remedy (edit the issue to match) would have written the
+ * parenthetical into the issue. The grammar is therefore enforced here, at
+ * parse time, where a refusal is `malformed`, the retry cooldown can act on
+ * it, and nothing unusable becomes an admission contract. Deliberately
+ * narrow so no valid lane is newly rejected: dots, hyphens, nested
+ * directories, globs and trailing slashes all pass; only a leading `/`
+ * (absolute) or whitespace/parentheses inside the entry (prose) is refused.
+ */
+const LANE_ENTRY_PROSE = /[\s()]/;
+
+/** Every problem with one write lane's entries, each naming the offending
+ *  entry verbatim (`field[index] "…"`), in array order — the detail a repair
+ *  round hands back and a refusal records must be readable against the next
+ *  pass. Empty for a usable lane. */
+function laneEntryProblems(field: string, entries: readonly string[]): string[] {
+  const problems: string[] = [];
+  for (const [index, entry] of entries.entries()) {
+    if (entry.startsWith("/")) {
+      problems.push(
+        `${field}[${index}] ${JSON.stringify(entry)} is absolute — a write lane names repository-relative paths`,
+      );
+    } else if (LANE_ENTRY_PROSE.test(entry)) {
+      problems.push(
+        `${field}[${index}] ${JSON.stringify(entry)} is not a path — write-lane entries carry no whitespace or parentheses`,
+      );
+    }
+  }
+  return problems;
+}
+
 const ToSpecSourceSchema = z
   .object({
     name: z.string().trim().min(1).describe("The authoritative source that was read: repo or tracker, e.g. `TerrifiedBug/conductor`."),
@@ -146,6 +184,14 @@ const ToSpecDecompositionChildSchema = z
       .describe("The focused commands that prove this child, each with its cwd when it matters."),
   })
   .strict()
+  .superRefine((child, ctx) => {
+    // #1060: a decomposition child carries the identical admission contract,
+    // so its write lane obeys the identical grammar — prose here would
+    // harden into a child slice nothing can file.
+    for (const problem of laneEntryProblems("writeLane", child.writeLane)) {
+      ctx.addIssue({ code: "custom", message: problem });
+    }
+  })
   .describe("One ordered child slice a decomposition proposal names (#1041).");
 
 /**
@@ -309,6 +355,12 @@ const ToSpecResultSchema = z
     if (value.routing !== MULTI_ROUTING && value.routingSplit !== undefined) {
       ctx.addIssue({ code: "custom", message: "routingSplit is only valid with routing `MULTI`" });
     }
+    // #1060: the lane is the admission contract, so its entries must be
+    // plausible repository-relative paths — refused here, at parse time,
+    // rather than hardening into a durable verdict no promotion can use.
+    for (const problem of laneEntryProblems("fileLane", value.fileLane)) {
+      ctx.addIssue({ code: "custom", message: problem });
+    }
   })
   .describe("A complete, to-spec grooming result; nothing outside this shape is accepted.");