omp-conductor 0.6.0 → 0.7.1

package/src/daemon.ts

@@ -102,6 +102,11 @@ const GRAPH_HEALTH_INTERVAL_MS = 60_000;
  *  report an operator is waiting on must not sit in the outbox for the length of
  *  a poll interval, and delivery is owed even while claiming is paused (#123). */
 const REPORT_DELIVERY_INTERVAL_MS = 30_000;
+/** A dispatch-infra run (turn-0 git failure) is requeued so the next tick
+ *  retries — but only a bounded number of times. Three strikes for one issue
+ *  means the mirror itself is broken, not unlucky, and the sweep escalates
+ *  instead of burning a turn-0 run per tick forever (#168, #177). */
+const DISPATCH_INFRA_MAX_STRIKES = 3;
 const DEFAULT_PORT = 8787;
 const BRIEF_TEMPLATE_PATH = join(import.meta.dir, "briefs", "worker.md");
 
@@ -121,8 +126,13 @@ export interface DaemonOpts {
   project?: string;
 }
 
-/** Everything one tick touches, resolved once at startup so a tick never
- *  re-reads config mid-flight and changes its own limits underneath itself. */
+/** Everything one tick touches. `project` and `caps` are re-resolved at each
+ *  tick boundary so an operator's config edit applies on the next tick rather
+ *  than the next daemon restart (#170); a tick and the runs it admits see one
+ *  consistent snapshot, and a mid-run edit never changes a live run's labels,
+ *  model or caps — `handleIssue` destructures them at dispatch time. The rest
+ *  are resolved once at startup so a tick never re-reads config mid-flight and
+ *  changes its own limits underneath itself. */
 interface Deps {
   project: ProjectConfig;
   caps: Caps;
@@ -176,6 +186,7 @@ export function verbDeps(d: Pick<Deps, "project" | "store" | "tracker" | "verbAc
       isPaused()
         ? "claiming is paused for this fleet (omp-conductor pause, hold or halt)"
         : undefined,
+    pausedAt,
     log,
     now: () => Date.now(),
   };
@@ -288,6 +299,30 @@ export function isPaused(): boolean {
   return existsSync(join(stateDir(), "paused"));
 }
 
+/**
+ * The epoch-ms timestamp at which the current pause began, read from the same
+ * sentinel file {@link setPaused} writes (`<stateDir()>/paused`). Returns
+ * `undefined` when the fleet is not paused, or when the file's first line does
+ * not parse as a date — a legacy/blank sentinel keeps today's refuse-everything
+ * behavior, because a run admitted before an *unknown* pause cannot be proven
+ * innocent. {@link isPaused} is the authority on *whether*; this answers
+ * *since when*.
+ */
+export function pausedAt(): number | undefined {
+  const f = join(stateDir(), "paused");
+  if (!existsSync(f)) return undefined;
+  try {
+    const first = readFileSync(f, "utf8").split("\n")[0]?.trim();
+    if (first === undefined || first === "") return undefined;
+    const t = Date.parse(first);
+    return Number.isNaN(t) ? undefined : t;
+  } catch {
+    // Unreadable sentinel (permissions, corruption): fail closed like an
+    // unparseable line — refuse mutations while the pause is unprovable.
+    return undefined;
+  }
+}
+
 export function setPaused(v: boolean): void {
   const f = join(stateDir(), "paused");
   if (v) {
@@ -1709,8 +1744,19 @@ export async function admitCandidates(
   slots: number,
 ): Promise<AdmissionPass> {
   const { project, caps, tracker, store } = d;
-  const busyIssues = store.activeRuns(project.name).map((r) => r.issue);
+  const activeRuns = store.activeRuns(project.name);
+  const busyIssues = activeRuns.map((r) => r.issue);
   const busy = new Set(busyIssues);
+  // issue -> its active run rows, for the pushed-green admission bypass (#175):
+  // only a worker-free pushed-green row may be bypassed, and only when *every*
+  // active run for the issue is worker-free. A live (claimed/running) row still
+  // holds unconditionally.
+  const activeByIssue = new Map<number, RunRecord[]>();
+  for (const run of activeRuns) {
+    const list = activeByIssue.get(run.issue);
+    if (list === undefined) activeByIssue.set(run.issue, [run]);
+    else list.push(run);
+  }
   const holds: AdmissionHold[] = [];
   const hold = (issue: number, reason: AdmissionHoldReason): void => {
     holds.push({ issue, reason });
@@ -1769,8 +1815,17 @@ export async function admitCandidates(
       continue;
     }
     if (busy.has(issue)) {
-      hold(issue, "issue-active");
-      continue;
+      // A pushed-green row is worker-free by definition (it is not in
+      // LIVE_STATES): its PR is live but no process is writing to its branch.
+      // So an issue whose active runs are ALL pushed-green is not actually
+      // occupied — the corrective attempt the operator unblocked may be
+      // admitted as a continuation of that PR, and the open-PR gate below
+      // decides the identity. Any live row still holds (#175).
+      const allWorkerFree = (activeByIssue.get(issue) ?? []).every((r) => r.state === "pushed-green");
+      if (!allWorkerFree) {
+        hold(issue, "issue-active");
+        continue;
+      }
     }
 
     const priorRuns = store.attemptsFor(project.name, issue);
@@ -1888,7 +1943,8 @@ export async function admitCandidates(
         latest?.state === "blocked" ||
         latest?.state === "failed" ||
         latest?.state === "killed" ||
-        latest?.state === "orphaned"
+        latest?.state === "orphaned" ||
+        latest?.state === "pushed-green"
           ? latest
           : undefined;
       // The second half asks "is this open PR our retained work", and accepts
@@ -1966,6 +2022,24 @@ export async function dispatchAdmissions(
 // ----------------------------------------------------------------------- a tick
 
 export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
+  // A config edit takes effect on the next tick, not the next daemon restart
+  // (#170). Re-resolve the project and its caps at the tick boundary so a tick
+  // and every run it admits see one consistent snapshot; a failed read keeps
+  // the boot values rather than wedging the tick, and the next tick tries
+  // again.
+  try {
+    const cfg = loadConfig();
+    const fresh = findProject(cfg, d.project.name);
+    const freshCaps = resolveCaps(fresh, cfg.defaults);
+    if (JSON.stringify(fresh) !== JSON.stringify(d.project) || JSON.stringify(freshCaps) !== JSON.stringify(d.caps)) {
+      log(`config reloaded: project ${d.project.name} changed on disk — applying from this tick`);
+    }
+    d.project = fresh;
+    d.caps = freshCaps;
+  } catch (err) {
+    log(`config reload failed (${errText(err)}) — continuing with the values loaded at boot`);
+  }
+
   // Before the pause check, deliberately. This one is not about dispatch: the
   // orchestrator is a different process, and it can be wedged while this fleet
   // is paused — which is exactly the state the reference fleet was in when the
@@ -2643,6 +2717,14 @@ export async function classifyAndRecover(d: Deps): Promise<void> {
         }
         if (run.state === "failed" && facts.pr === "open") {
           facts.checks = await tracker.checkConclusions(run.prUrl);
+          // When a check failed with a reachable log, pull its tail so the
+          // table can tell an infra outage (#177) from a real test failure by
+          // the log's own words. First failure wins; a log that cannot be
+          // fetched is left undefined and classification stays conservative.
+          const firstFailure = facts.checks.find((c) => c.state === "failure" && c.link !== undefined);
+          if (firstFailure?.link !== undefined) {
+            facts.failingLog = await tracker.checkLog(firstFailure.link);
+          }
         }
       }
     } catch (err) {
@@ -2730,6 +2812,26 @@ async function recoverRun(
   }
 
   if (recovery === "requeue") {
+    // A dispatch-infra requeue that keeps landing on the same issue means the
+    // mirror for its repo is persistently broken — a ref-lock that retry already
+    // exhausted, a dead remote. Requeueing forever spends a turn-0 run per tick
+    // with no chance of success, so after a bounded number of strikes this
+    // escalates to a human instead (#168, #177).
+    if (cls === "dispatch-infra" && store.classCountFor(project.name, run.issue, "dispatch-infra") >= DISPATCH_INFRA_MAX_STRIKES) {
+      await safeEscalate(d, {
+        tier: 1,
+        project: project.name,
+        issue: run.issue,
+        summary: `[dispatch-infra] #${run.issue}: the mirror for ${run.repo} is failing persistently — ${evidence}`,
+        detail: [
+          `The dispatcher could not provision a worktree for #${run.issue} ${DISPATCH_INFRA_MAX_STRIKES} times in a row, all before the worker's first turn.`,
+          "The mirror on this host needs attention (check disk, SSH/HTTPS credentials, and the mirror root).",
+        ].join("\n"),
+      });
+      store.updateRun(run.id, { recoveredAt: Date.now() });
+      log(`#${run.issue} escalated from persistent ${cls}: ${evidence}`);
+      return;
+    }
     // Only when the tracker still shows this issue as ours to hand back. An
     // issue that is closed, or has no state label, was resolved by another route
     // and requeueing it would dispatch work nobody asked for.
@@ -2772,7 +2874,15 @@ async function recoverRun(
       );
     }
     if (run.lastError !== undefined && cls !== "question") detail.push(run.lastError);
-    detail.push(`Session: ${run.sessionFile ?? "(no transcript)"}`);
+    // #172: an unwritten transcript is "the run died before it flushed", not a
+    // link to a file the operator will open and find missing.
+    detail.push(
+      run.sessionFile === undefined
+        ? "Session: (no transcript)"
+        : existsSync(run.sessionFile)
+          ? `Session: ${run.sessionFile}`
+          : `Session: ${run.sessionFile} (file was never written — the run died before its transcript was flushed)`,
+    );
     // The class and the run are in the summary, which is what the notifications
     // ledger dedupes on — so one class escalates once per run rather than every
     // five minutes.

package/src/failure-class.ts

@@ -22,6 +22,10 @@ export interface ClassifyFacts {
   pr?: "open" | "merged" | "closed";
   mergeable?: "conflicting" | "clean" | "unknown";
   checks?: { name: string; state: string; link?: string }[];
+  /** Tail (ANSI-stripped) of the first failed check's log, when one was
+   *  reachable. Lets the table tell an infrastructure outage (#177) from a
+   *  deterministic test failure by the log's own words. */
+  failingLog?: string;
 }
 
 export interface Classification {
@@ -50,6 +54,24 @@ const INFRA_CHECK_STATES: Record<string, true> = {
 /** States that mean "this check has a verdict and it is good". */
 const SUCCESS_CHECK_STATES: Record<string, true> = { success: true, neutral: true };
 
+/**
+ * Substrings in a failed check's log that prove the failure was infrastructure,
+ * not the diff (#177). Each is a registry/docker/runner fault a worker cannot
+ * have introduced: a rate limit, an image-manifest resolution failure, a runner
+ * being torn down under the job, or a DNS failure. Matched lowercased against
+ * the log tail.
+ *
+ * Deliberately *not* matching bare `failed to solve:` — a docker build failure
+ * often prints it with a real resolution error, so the closing words carry the
+ * signal, not the phrase.
+ */
+const INFRA_LOG_SIGNATURES = [
+  "429 too many requests",
+  "failed to resolve source metadata for",
+  "the runner has received a shutdown signal",
+  "could not resolve host",
+];
+
 function normalise(state: string): string {
   return state.trim().toLowerCase();
 }
@@ -127,6 +149,35 @@ export function neverStarted(
   return undefined;
 }
 
+/**
+ * Evidence that the conductor's own git path failed before the worker's first
+ * turn, or `undefined` when this row is something else.
+ *
+ * A mirror ref-lock (#168), a dead mirror, a transiently unreachable host: the
+ * worker never touched the issue, so none of this should charge an
+ * implementation attempt. `lastError` of this shape is written only by the
+ * dispatch catch (`errText(err)` = the stack, which prefixes the thrown
+ * "git … exited N: …" message with "Error: ") and by state messages — never by
+ * a worker — so it is proof of the daemon's own git rather than a worker's
+ * failed push.
+ *
+ * Exported for the same reason {@link neverStarted} is: the store's one-time
+ * repair has to recognise exactly what the classifier does, or history and
+ * future disagree about which rows were the daemon's fault.
+ */
+export function dispatchInfra(
+  run: Pick<RunRecord, "turns" | "lastError" | "prUrl" | "headSha" | "salvageSha">,
+): string | undefined {
+  if (run.turns !== 0) return undefined;
+  if (run.prUrl !== undefined || run.headSha !== undefined || run.salvageSha !== undefined) return undefined;
+  if (run.lastError === undefined || !DISPATCH_GIT_ERROR.test(run.lastError)) return undefined;
+  return `dispatch failed in the conductor's own git path before turn 1: ${run.lastError.split("\n")[0]}`;
+}
+
+// See {@link dispatchInfra}: the "Error: " prefix is what `errText` puts in
+// front of the thrown message, so a bare /^git / would never match a real row.
+const DISPATCH_GIT_ERROR = /^(?:Error: )?git .+ exited \d+/s;
+
 export function classifyRun(run: RunRecord, facts: ClassifyFacts): Classification {
   const hasArtifacts = run.prUrl !== undefined || run.headSha !== undefined || run.salvageSha !== undefined;
 
@@ -161,6 +212,16 @@ export function classifyRun(run: RunRecord, facts: ClassifyFacts): Classificatio
     }
   }
 
+  // Dispatch infra: the conductor's own git path failed before the worker's
+  // first turn. See {@link dispatchInfra} — the worker never touched the issue,
+  // so this must not charge an implementation attempt.
+  if (run.state === "failed") {
+    const evidence = dispatchInfra(run);
+    if (evidence !== undefined) {
+      return { cls: "dispatch-infra", recovery: "requeue", evidence };
+    }
+  }
+
   if (run.state === "blocked") {
     return {
       cls: "question",
@@ -215,6 +276,24 @@ export function classifyRun(run: RunRecord, facts: ClassifyFacts): Classificatio
     const checks = facts.checks ?? [];
     const unresolved = checks.filter((c) => !SUCCESS_CHECK_STATES[normalise(c.state)] === true);
     if (checks.length > 0 && unresolved.length > 0) {
+      // A failed check whose *log* smells like infrastructure — a registry 429,
+      // a runner shutdown, a DNS failure (#177). The check has a verdict, so
+      // the check-state table above cannot call it infra; only the log can. It
+      // beats ci-deterministic because charging an implementation attempt for a
+      // rate limit is exactly the waste that class exists to prevent.
+      if (facts.failingLog !== undefined) {
+        const lower = facts.failingLog.toLowerCase();
+        for (const signature of INFRA_LOG_SIGNATURES) {
+          if (lower.includes(signature)) {
+            const check = checks.find((c) => normalise(c.state) === "failure");
+            return {
+              cls: "ci-infra",
+              recovery: "rerun-checks",
+              evidence: `infrastructure signature in ${check?.name === undefined ? "failed check" : check.name} log: "${signature}"`,
+            };
+          }
+        }
+      }
       const failing = unresolved.filter((c) => normalise(c.state) === "failure");
       if (failing.length > 0) {
         return {

package/src/orchestrator-tick.ts

@@ -400,6 +400,16 @@ export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScope]: string } = {
 export const TICK_DELIVERY_RULE =
   "This tick was injected locally, not sent from Telegram, so your end-of-turn text does NOT reach your operator. Hand anything reportable this turn to the durable outbox by running `omp-conductor report --text \"<the whole report>\"` (add `--kind digest` for the daily digest) and confirming it printed a report id; the daemon then owns delivery and retries until it lands. Never claim a report was sent otherwise, and never use telegram_send for a report -- that path leaves no record that it went out.";
 
+/** The {@link TICK_DELIVERY_RULE} variant for a fleet whose bridge actually
+ *  delivers the tick's ending text (#169). That is a narrower class than the
+ *  approval surface being ready: `notifyMode: "always"` has to be set, and the
+ *  profile has to be `interactive` — a `daemon` profile suppresses the
+ *  `agent_end` notify post, so its end-of-turn text reaches nobody and the
+ *  durable-outbox rule above is the honest one there. Everything here keeps the
+ *  outbox as the message; only the opening claim about delivery differs. */
+export const TICK_DELIVERY_RULE_BRIDGED =
+  "Your end-of-turn text IS delivered to the operator by the Telegram bridge (notifyMode: always). Still hand anything reportable to the durable outbox with omp-conductor report — and then close with at most one short line. The report is the message; never restate it in your closing text.";
+
 /** Re-exported so the tick's own contract stays readable from one file: the
  *  constant itself lives beside the check that decides whether it is callable. */
 export { TELEGRAM_APPROVAL_TOOL };
@@ -1195,6 +1205,29 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
   refreshComposedBriefBestEffort();
 
   const scope = resolveTickScope();
+  // The transport contract, read once from the same file at the same moment so
+  // the approval line, the delivery rule and the narration line cannot disagree
+  // (#169, #179). No access file means no fleet channel to judge; a session
+  // with no bound bridge token means omp-telegram posts nothing, so both halves
+  // fail toward "not delivered" — the durable outbox instruction — rather than
+  // asserting a delivery the bridge cannot make.
+  const approval =
+    config.accessFile === undefined
+      ? undefined
+      : session.bridgeTokenAtStart
+        ? readApprovalSurface(config.accessFile)
+        : ({
+            kind: "missing",
+            reason:
+              `${TELEGRAM_APPROVAL_TOOL} unavailable on local ticks: omp-telegram had no bot token when this ` +
+              "session started, so it bound none and its tools stay dead however complete the access file looks " +
+              "now — run `/telegram on` in this session, or restart it, to rebind the bridge",
+          } as const);
+  const profile =
+    config.accessFile === undefined || !session.bridgeTokenAtStart
+      ? undefined
+      : readDaemonProfile(config.accessFile);
+
   // A configured message owns the ordinary reporting and delivery clauses.
   // Mechanical evidence is different: release-policy drift and repeated
   // operational friction must not disappear because an operator customized the
@@ -1205,7 +1238,8 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
       session.scopeFallbackLogged = true;
       pi.logger.info(`[omp-conductor] tick reporting scope: using ${DEFAULT_REPORT_SCOPE} — ${scope.fallback}`);
     }
-    content = `${defaultTickMessage(new Date(), scope.briefPath, scope.policyPath)}\n${TICK_SCOPE_CONSTRAINTS[scope.scope]}\n${TICK_DELIVERY_RULE}`;
+    const bridged = approval?.kind === "ready" && approval.notifyMode === "always" && profile?.kind === "interactive";
+    content = `${defaultTickMessage(new Date(), scope.briefPath, scope.policyPath)}\n${TICK_SCOPE_CONSTRAINTS[scope.scope]}\n${bridged ? TICK_DELIVERY_RULE_BRIDGED : TICK_DELIVERY_RULE}`;
   }
   let frictionStore: Store | undefined;
   let frictionSignals: FrictionSignal[] = [];
@@ -1275,18 +1309,6 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
   // `telegram_ask` and `telegram_send` dead until `/telegram on`. Trusting the
   // file alone there puts the tick straight back to mandating a call its surface
   // cannot make, which is #114 exactly.
-  const approval =
-    config.accessFile === undefined
-      ? undefined
-      : session.bridgeTokenAtStart
-        ? readApprovalSurface(config.accessFile)
-        : ({
-            kind: "missing",
-            reason:
-              `${TELEGRAM_APPROVAL_TOOL} unavailable on local ticks: omp-telegram had no bot token when this ` +
-              "session started, so it bound none and its tools stay dead however complete the access file looks " +
-              "now — run `/telegram on` in this session, or restart it, to rebind the bridge",
-          } as const);
   if (approval?.kind === "missing") {
     content = `${content}\n${TICK_APPROVAL_UNAVAILABLE_RULE}`;
     if (!session.approvalToolMissingLogged) {
@@ -1318,10 +1340,6 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
   // live bridge whose profile is not `daemon`.
   //
   // No `accessFile` means no fleet bridge to judge, exactly as above.
-  const profile =
-    config.accessFile === undefined || !session.bridgeTokenAtStart
-      ? undefined
-      : readDaemonProfile(config.accessFile);
   if (profile?.kind === "interactive") content = `${content}\n${TICK_NARRATION_RULE}`;
 
   try {

package/src/store.ts

@@ -15,7 +15,7 @@ import { dirname, join } from "node:path";
 
 import { stateDir } from "./config.ts";
 import { DECISION_TTL_MS, DEFAULT_CAPS } from "./types.ts";
-import { neverStarted } from "./failure-class.ts";
+import { dispatchInfra, neverStarted } from "./failure-class.ts";
 import type {
   DecisionDraft,
   FailureClass,
@@ -61,7 +61,7 @@ export const LIVE_STATES: readonly RunState[] = ["claimed", "running"];
  * worktrees removed, so they must not consume slots, while their live PRs must
  * still block duplicate attempts.
  */
-const ACTIVE_STATES: readonly RunState[] = [...LIVE_STATES, "pushed-pending", "pushed-green"];
+export const ACTIVE_STATES: readonly RunState[] = [...LIVE_STATES, "pushed-pending", "pushed-green"];
 
 const LIVE_PLACEHOLDERS = LIVE_STATES.map(() => "?").join(", ");
 const ACTIVE_PLACEHOLDERS = ACTIVE_STATES.map(() => "?").join(", ");
@@ -726,6 +726,48 @@ export function openStore(dbPath: string): Store {
     for (const row of misread) reclassify.run(row.id);
   }
 
+  // The same repair, for the case the one above deliberately leaves alone: its
+  // comment names it exactly ("a turn-0 row carrying an unrecognised error (a
+  // failed mirror fetch, say) is untouched"). #177 gave that fault a name, but
+  // only for rows written after it existed. Every earlier one was logged
+  // `unknown`, whose recovery is `escalate` — so `runsNeedingClassification`
+  // never revisits it and `countFailures` counts it forever. With
+  // `maxAttemptsPerIssue` defaulting to 2, a single mirror ref-lock is half an
+  // issue's entire budget spent on a fault that was never in its code.
+  //
+  // Narrow the same way: exactly `unknown`, state `failed`, and the
+  // CLASSIFIER's own predicate rather than a second copy of the rule.
+  // Deliberately only `failureClass` — not `recoveryAction`/`recoveredAt`.
+  // Relieving the budget is the point; re-animating a months-old run into the
+  // requeue sweep is not, and clearing the recovery columns would do exactly
+  // that. Idempotent for free: these rows then read `dispatch-infra`, which the
+  // WHERE no longer matches.
+  const mirrorBroke = db
+    .query<
+      { id: string; lastError: string | null; prUrl: string | null; headSha: string | null; salvageSha: string | null },
+      []
+    >(
+      `SELECT id, lastError, prUrl, headSha, salvageSha FROM runs
+        WHERE failureClass = 'unknown' AND turns = 0 AND state = 'failed'`,
+    )
+    .all()
+    .filter(
+      (row) =>
+        dispatchInfra({
+          turns: 0,
+          ...(row.lastError === null ? {} : { lastError: row.lastError }),
+          ...(row.prUrl === null ? {} : { prUrl: row.prUrl }),
+          ...(row.headSha === null ? {} : { headSha: row.headSha }),
+          ...(row.salvageSha === null ? {} : { salvageSha: row.salvageSha }),
+        }) !== undefined,
+    );
+  if (mirrorBroke.length > 0) {
+    const reclassify = db.query<unknown, [string]>(
+      `UPDATE runs SET failureClass = 'dispatch-infra' WHERE id = ?`,
+    );
+    for (const row of mirrorBroke) reclassify.run(row.id);
+  }
+
   const insertRun = db.query<unknown, SqlValue[]>(
     `INSERT INTO runs (
        id, project, issue, repo, branch, worktree, state, attempt, turns,
@@ -773,12 +815,19 @@ export function openStore(dbPath: string): Store {
   const countFailures = db.query<{ n: number }, [string, number]>(
     `SELECT COUNT(*) AS n FROM runs
       WHERE project = ? AND issue = ? AND state = 'failed'
-        AND (failureClass IS NULL OR failureClass NOT IN ('ci-infra', 'settlement-stuck', 'env-start-failure'))`,
+        AND (failureClass IS NULL OR failureClass NOT IN ('ci-infra', 'settlement-stuck', 'env-start-failure', 'dispatch-infra'))`,
   );
   const countContinuations = db.query<{ n: number }, [string, number]>(
     `SELECT COUNT(*) AS n FROM runs
       WHERE project = ? AND issue = ? AND state IN ('killed', 'orphaned', 'blocked')
-        AND (failureClass IS NULL OR failureClass NOT IN ('admin-kill', 'settlement-stuck', 'env-start-failure'))`,
+        AND (failureClass IS NULL OR failureClass NOT IN ('admin-kill', 'settlement-stuck', 'env-start-failure', 'dispatch-infra'))`,
+  );
+  // How many times one issue reached a given class. Recovery uses it to bound a
+  // retry loop whose cause is persistent (e.g. a mirror that will not refresh):
+  // after `DISPATCH_INFRA_MAX_STRIKES` the daemon escalates instead of looping.
+  const countByClass = db.query<{ n: number }, [string, number, FailureClass]>(
+    `SELECT COUNT(*) AS n FROM runs
+      WHERE project = ? AND issue = ? AND failureClass = ?`,
   );
   // Newest first, and bounded: every row this returns costs `gh` calls to gather
   // facts for, so a fleet with a long unclassified history classifies over
@@ -1142,6 +1191,10 @@ export function openStore(dbPath: string): Store {
       return countContinuations.get(project, issue)?.n ?? 0;
     },
 
+    classCountFor(project: string, issue: number, cls: FailureClass): number {
+      return countByClass.get(project, issue, cls)?.n ?? 0;
+    },
+
     latestRun(project: string, issue: number): RunRecord | undefined {
       const row = selectLatestRun.get(project, issue);
       return row ? toRecord(row) : undefined;

package/src/tracker/github.ts

@@ -695,6 +695,22 @@ export function makeTracker(p: ProjectConfig, runGh: typeof gh = gh): Tracker {
       }
     },
 
+    async checkLog(detailsUrl: string): Promise<string | undefined> {
+      const args = runLogArgs(detailsUrl);
+      if (args === undefined) return undefined;
+      try {
+        const raw = await runGh(args);
+        const lines = raw.replaceAll(/\u001b\[[0-9;]*m/g, "").split("\n");
+        return lines.slice(-400).join("\n");
+      } catch {
+        // Best-effort, never throws: a revoked token, a deleted run or a flaky
+        // network must not error the classifier out of gathering facts. The
+        // caller treats `undefined` as "could not read the log" and classifies
+        // conservatively (#177).
+        return undefined;
+      }
+    },
+
     async mergeable(prUrl: string): Promise<"conflicting" | "clean" | "unknown"> {
       if (!PR_URL.test(prUrl)) return "unknown";
       try {

package/src/types.ts

@@ -766,6 +766,12 @@ export interface Tracker {
    * port: nothing downstream may read it as "no checks failed".
    */
   checkConclusions(prUrl: string): Promise<{ name: string; state: string; link?: string }[]>;
+  /** The tail of a failed workflow run's log, ANSI stripped, or `undefined`
+   *  when it cannot be fetched. Best-effort, never throws: the classifier uses
+   *  it to tell an infrastructure outage from a deterministic test failure
+   *  (#177), and "could not read the log" must fall through to the existing
+   *  conservative classification rather than error out of fact-gathering. */
+  checkLog(detailsUrl: string): Promise<string | undefined>;
   /** Whether the PR can merge into its base. `unknown` on any doubt, so a
    *  mergeability nobody could read never becomes a conflict recovery. */
   mergeable(prUrl: string): Promise<"conflicting" | "clean" | "unknown">;
@@ -803,6 +809,7 @@ export const FAILURE_CLASSES = [
   "admin-kill",
   "ci-infra",
   "ci-deterministic",
+  "dispatch-infra",
   "merge-conflict",
   "question",
   "orphan-clean",
@@ -1155,6 +1162,10 @@ export interface Store {
   failuresFor(project: string, issue: number): number;
   /** Operational stops that require a bounded continuation resume. */
   continuationsFor(project: string, issue: number): number;
+  /** How many times one issue has reached a given failure class. A recovery
+   *  that keeps landing on the same class (e.g. a persistently broken mirror)
+   *  uses this to escalate instead of retrying forever. */
+  classCountFor(project: string, issue: number, cls: FailureClass): number;
   /** Newest attempt for one issue, whatever state it reached. `omp-conductor
    *  tail` resolves an issue number to a transcript through this; the number is
    *  what an operator has, the run id is not. */
@@ -1321,6 +1332,7 @@ export const VERB_NAMES = [
   "conductor_push",
   "conductor_pr_create",
   "conductor_pr_update_branch",
+  "conductor_pr_update",
   "conductor_pr_merge",
   "conductor_label",
   "conductor_release",

package/src/unblock.ts

@@ -40,6 +40,10 @@ export interface UnblockOutcome {
   continuationsUsed: number;
   /** Newest attempt, when the store has one for this issue at all. */
   latest?: RunRecord;
+  /** Whether any run for the issue is still in an active state — the answer
+   *  to "will the dispatcher hold this issue as issue-active?" that #178
+   *  found this verb guessing at. */
+  active: boolean;
   /** Set when nothing was cleared because the newest attempt's work exists
    *  only in its worktree. Carries the salvage failure verbatim. */
   refused?: string;
@@ -92,10 +96,12 @@ export async function unblockIssue(
   // for clearing in-progress, so the row that carries it decides the set.
   const latest = store.latestRun(project.name, issue);
   const terminal = latest !== undefined && !LIVE_STATES.includes(latest.state);
+  const active = store.activeRuns(project.name).some((r) => r.issue === issue);
   const counts = {
     attemptsUsed: store.attemptsFor(project.name, issue),
     failuresUsed: store.failuresFor(project.name, issue),
     continuationsUsed: store.continuationsFor(project.name, issue),
+    active,
   };
 
   // The one case where this verb refuses. Clearing the labels here re-queues an
@@ -205,8 +211,31 @@ export function formatUnblock(
         `run row to prove the worker is gone, "${project.stateLabels.inProgress}" was left in place, and ` +
         "on its own it keeps the issue ineligible",
     );
+  } else if (latest.state === "pushed-green" || latest.state === "pushed-pending") {
+    // #178: an unblocked issue whose newest run pushed a green PR is not "free
+    // for a fresh attempt" — the dispatcher continues the pushed run's branch,
+    // and only once the PR resolves does the issue settle (#175). Say that
+    // instead of promising a re-claim the next tick withholds.
+    lines.push(
+      latest.prUrl === undefined
+        ? `  next tick  eligible again, as long as the issue still carries "${project.queueLabel}" ` +
+            `(newest run is ${latest.state} with no recorded PR; the dispatcher still applies its open-PR check at claim time)`
+        : `  next tick  eligible as a continuation of ${latest.prUrl} — the pushed run stays active until ` +
+            "that PR resolves; dispatch continues on its branch",
+    );
+  } else if (o.active) {
+    // A run other than the newest is still active (e.g. a live sibling under a
+    // terminal newest row), so the dispatcher will hold the issue as
+    // issue-active whatever the labels now say. #178's misleading case.
+    lines.push(
+      `  in flight  a run for this issue is still active, so the dispatcher holds the issue until it settles — ` +
+        `nothing is re-claimed before then ("${project.stateLabels.inProgress}" stays unless already released)`,
+    );
   } else {
-    lines.push(`  next tick  eligible again, as long as the issue still carries "${project.queueLabel}"`);
+    lines.push(
+      `  next tick  eligible again, as long as the issue still carries "${project.queueLabel}" ` +
+        "(the dispatcher still applies its open-PR check at claim time)",
+    );
   }
 
   return lines.join("\n");

package/src/verbs/actions.ts

@@ -97,6 +97,14 @@ export function githubVerbActions(project: ProjectConfig, run: CommandRunner = s
 
     updatePrBranch: (prUrl) => gh(["pr", "update-branch", prUrl]),
 
+    updatePr: async (prUrl, fields) => {
+      const argv = ["pr", "edit", prUrl];
+      if (fields.title !== undefined) argv.push("--title", fields.title);
+      if (fields.body !== undefined) argv.push("--body", fields.body);
+      const outcome = await gh(argv);
+      return outcome.ok ? { ok: true } : { ok: false, stderr: outcome.stderr };
+    },
+
     // `--match-head-commit` is the server-side half of the exact-head rule: the
     // daemon already re-read the head and refused a stale one, and this makes
     // GitHub refuse too if the branch moved in the milliseconds between. Belt