quadwork 2.1.0 → 2.2.0

package/server/routes.js

@@ -26,6 +26,16 @@ const ENV_PATH = path.join(CONFIG_DIR, ".env");
 const TEMPLATES_DIR = path.join(__dirname, "..", "templates");
 const REPO_RE = /^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/;
 
+// #837: `gh api` list fetches (closed-PR pages with `-i`, GraphQL repo
+// snapshot, batch progress) can exceed Node's default 1MB execFile maxBuffer.
+// A real `pulls?state=closed&per_page=100` -i page measured ~1.74MB on
+// realproject7/quadwork, which made ghApiConditional reject with
+// ERR_CHILD_PROCESS_STDIO_MAXBUFFER → "Recently Merged PRs" stayed empty AND
+// the #828/#834 queued-from-snapshot fast-path was forced off because
+// closedPagesComplete couldn't ever become true. 32MB is well above today's
+// page sizes and still well under node's hard 2GB cap.
+const GH_LIST_MAX_BUFFER = 32 * 1024 * 1024;
+
 function isLocalhost(ip) {
   return ip === "127.0.0.1" || ip === "::1" || ip === "::ffff:127.0.0.1";
 }
@@ -40,6 +50,15 @@ const _rateLimit = {
   updatedAt: 0,      // epoch ms when we last fetched
   error: null,       // last fetch error message, if any
 };
+// #802: GitHub tracks REST (core) and GraphQL as SEPARATE budgets, so GraphQL
+// can hit 0 while REST is full. The background GraphQL poller and the
+// batch-progress GraphQL query must back off on THIS bucket, not the REST one.
+const _graphqlRateLimit = {
+  limit: 5000,       // GraphQL is a points/hour budget, not request count
+  remaining: 5000,
+  resetAt: 0,        // epoch ms
+  updatedAt: 0,      // epoch ms when we last fetched
+};
 const RATE_LIMIT_POLL_MS = 60_000;       // refresh every 60s
 const RATE_LIMIT_LOW_THRESHOLD = 200;    // below this → back off
 const RATE_LIMIT_CRITICAL = 50;          // below this → stop all infra gh calls
@@ -47,15 +66,24 @@ let _rateLimitTimer = null;
 
 async function refreshRateLimit() {
   try {
+    // One `gh api rate_limit` call returns every resource bucket; grab both
+    // core (REST) and graphql so each stream can gate on its own budget (#802).
     const { stdout } = await _execFileAsync("gh", [
-      "api", "rate_limit", "--jq", ".resources.core | {limit,remaining,reset}",
+      "api", "rate_limit", "--jq",
+      "{core: (.resources.core | {limit,remaining,reset}), graphql: (.resources.graphql | {limit,remaining,reset})}",
     ], { encoding: "utf-8", timeout: 10000 });
     const data = JSON.parse(stdout);
-    _rateLimit.limit = data.limit;
-    _rateLimit.remaining = data.remaining;
-    _rateLimit.resetAt = data.reset * 1000; // seconds → ms
+    _rateLimit.limit = data.core.limit;
+    _rateLimit.remaining = data.core.remaining;
+    _rateLimit.resetAt = data.core.reset * 1000; // seconds → ms
     _rateLimit.updatedAt = Date.now();
     _rateLimit.error = null;
+    if (data.graphql) {
+      _graphqlRateLimit.limit = data.graphql.limit;
+      _graphqlRateLimit.remaining = data.graphql.remaining;
+      _graphqlRateLimit.resetAt = data.graphql.reset * 1000;
+      _graphqlRateLimit.updatedAt = Date.now();
+    }
   } catch (err) {
     _rateLimit.error = err.message;
     _rateLimit.updatedAt = Date.now();
@@ -65,7 +93,13 @@ async function refreshRateLimit() {
 function startRateLimitPolling() {
   if (_rateLimitTimer) return;
   refreshRateLimit();
+  // #836: .unref() so this interval doesn't alone pin the event loop.
+  // Production keeps the process alive via the Express HTTP listener, so
+  // cadence/auto-start is unchanged; .unref() only lets test imports and
+  // one-off `node -e` invocations exit cleanly (an unref'd `node -e` poller
+  // ran for 11 days in the wild before this was caught).
   _rateLimitTimer = setInterval(refreshRateLimit, RATE_LIMIT_POLL_MS);
+  _rateLimitTimer.unref();
 }
 
 function isRateLimited() {
@@ -74,6 +108,13 @@ function isRateLimited() {
 function isRateLow() {
   return _rateLimit.remaining < RATE_LIMIT_LOW_THRESHOLD;
 }
+// #802: same thresholds, applied to the separate GraphQL budget.
+function isGraphqlRateLimited() {
+  return _graphqlRateLimit.remaining < RATE_LIMIT_CRITICAL;
+}
+function isGraphqlRateLow() {
+  return _graphqlRateLimit.remaining < RATE_LIMIT_LOW_THRESHOLD;
+}
 
 // Adaptive cache TTL: normal 30s, low 120s, critical ∞ (serve stale)
 function adaptiveTTL(baseTTL) {
@@ -82,80 +123,15 @@ function adaptiveTTL(baseTTL) {
   return baseTTL;
 }
 
-// ─── Cached GitHub endpoint helper (#554) ─────────────────────────────────
-// Wraps a synchronous execFileSync gh call with an in-memory cache that
-// serves stale data when rate-limited instead of hammering the API.
-const _ghEndpointCache = new Map(); // key → { ts, data }
+// ─── Shared GitHub endpoint cache (#554) ──────────────────────────────────
+// Per-endpoint in-memory cache of the canonical board slices, populated by the
+// REST+ETag fetcher (#806, githubStateFetcher / refreshRepoRest) and served by
+// the /api/github/* routes (serveGithubList) so reads cost ~0.
+const _ghEndpointCache = new Map(); // key → { ts, data, stale? }
 const GH_ENDPOINT_CACHE_TTL = 60_000; // #698: 60s base TTL (was 30s)
-
-// #698: concurrency-limited background refresh queue. Caps simultaneous
-// gh CLI calls to avoid triggering GitHub's secondary rate limit even
-// when many endpoints expire on the same poll cycle.
-const _ghRefreshing = new Set();
+// #698: cap simultaneous gh calls (per-PR fan-out, multi-project refresh) so we
+// never trip GitHub's secondary rate limit.
 const GH_MAX_CONCURRENT = 2;
-const _ghRefreshQueue = [];
-let _ghActiveRefreshes = 0;
-
-function _ghDrainQueue() {
-  while (_ghRefreshQueue.length > 0 && _ghActiveRefreshes < GH_MAX_CONCURRENT) {
-    const job = _ghRefreshQueue.shift();
-    _ghActiveRefreshes++;
-    job().finally(() => { _ghActiveRefreshes--; _ghDrainQueue(); });
-  }
-}
-
-function _ghEnqueueRefresh(cacheKey, ghArgs, transform) {
-  if (_ghRefreshing.has(cacheKey)) return; // already queued/in-flight
-  _ghRefreshing.add(cacheKey);
-  _ghRefreshQueue.push(() =>
-    _execFileAsync("gh", ghArgs, { encoding: "utf-8", timeout: 15000 })
-      .then(({ stdout }) => {
-        let data = JSON.parse(stdout);
-        if (transform) data = transform(data);
-        _ghEndpointCache.set(cacheKey, { ts: Date.now(), data, stale: false });
-      })
-      .catch(() => {}) // keep serving stale on error
-      .finally(() => _ghRefreshing.delete(cacheKey))
-  );
-  _ghDrainQueue();
-}
-
-function cachedGhEndpoint(cacheKey, ghArgs, res, { transform, idle } = {}) {
-  const cached = _ghEndpointCache.get(cacheKey);
-  // #812: a parked (idle) project must never initiate a gh fetch. Serve
-  // whatever we last cached, or an empty list — never call gh. The list
-  // endpoints return a bare array (client contract), so signal idle via a
-  // response header rather than mutating the JSON shape.
-  if (idle) {
-    res.set("X-QuadWork-Idle", "1");
-    return res.json(cached ? cached.data : []);
-  }
-  const ttl = adaptiveTTL(GH_ENDPOINT_CACHE_TTL);
-  if (cached && Date.now() - cached.ts < ttl) {
-    return res.json(cached.stale ? { ...cached.data, _stale: true } : cached.data);
-  }
-  // If critically rate-limited, serve whatever we have (even expired)
-  if (isRateLimited() && cached) {
-    return res.json({ ...cached.data, _stale: true, _rateLimited: true });
-  }
-  // #698: stale-while-revalidate — if we have stale data, serve it
-  // immediately and enqueue a background refresh. The queue caps
-  // concurrent gh calls to GH_MAX_CONCURRENT to prevent burst traffic.
-  if (cached) {
-    _ghEnqueueRefresh(cacheKey, ghArgs, transform);
-    return res.json({ ...cached.data, _stale: true });
-  }
-  // No cached data at all — must fetch synchronously for first load
-  try {
-    const out = execFileSync("gh", ghArgs, { encoding: "utf-8", timeout: 15000 });
-    let data = JSON.parse(out);
-    if (transform) data = transform(data);
-    _ghEndpointCache.set(cacheKey, { ts: Date.now(), data, stale: false });
-    res.json(data);
-  } catch (err) {
-    res.status(502).json({ error: "gh call failed", detail: err.message });
-  }
-}
 
 const DEFAULT_CONFIG = {
   port: 8400,
@@ -248,6 +224,23 @@ function writeOvernightQueueFileSafe(projectId, projectName, repo) {
   } catch { /* non-fatal */ }
 }
 
+// #807: seed the per-project GITHUB.md from the template (idempotent — no-op if
+// it already exists). Mirrors writeOvernightQueueFileSafe. The machine sections
+// are then authored by the server on each fetch pass (writeGithubFileFromSnapshot).
+function writeGithubFileSafe(projectId, projectName, repo) {
+  try {
+    const ghPath = path.join(CONFIG_DIR, projectId, "GITHUB.md");
+    if (fs.existsSync(ghPath)) return;
+    const tpl = path.join(TEMPLATES_DIR, "GITHUB.md");
+    if (!fs.existsSync(tpl)) return;
+    ensureSecureDir(path.dirname(ghPath));
+    let content = fs.readFileSync(tpl, "utf-8");
+    content = content.replace(/\{\{project_name\}\}/g, projectName || projectId || "");
+    content = content.replace(/\{\{repo\}\}/g, repo || "");
+    fs.writeFileSync(ghPath, content);
+  } catch { /* non-fatal */ }
+}
+
 function getProjectMaxHops(projectId) {
   if (!projectId) return 30;
   const cfg = readConfigFile();
@@ -286,16 +279,20 @@ router.get("/api/chat", (req, res) => {
 // Bare "head", "dev", "re1", "re2" become "@head", "@dev", "@re1", "@re2".
 // Already-prefixed mentions are not double-prefixed; suffixed names like
 // "head-2" or "re1-3" are left untouched.
+// #788: `skipName` is the sender's own agent name — it is never converted, so
+// an agent writing "head received the batch" doesn't self-mention. Pass a
+// falsy skipName (user / bridge senders) to normalize every name.
 const MENTION_AGENT_NAMES = ["head", "dev", "re1", "re2"];
-function normalizeMentions(text) {
+function normalizeMentions(text, skipName) {
   if (typeof text !== "string" || !text) return text || "";
+  const names = skipName ? MENTION_AGENT_NAMES.filter((n) => n !== skipName) : MENTION_AGENT_NAMES;
   const preserved = [];
   const ph = "\x00CODE\x00";
   let safe = text.replace(/```[\s\S]*?```|`[^`]+`/g, (m) => {
     preserved.push(m);
     return ph;
   });
-  safe = MENTION_AGENT_NAMES.reduce(
+  safe = names.reduce(
     (t, name) =>
       t.replace(new RegExp(`(?<![@\\w])\\b${name}\\b(?![\\w-])`, "gi"), (match, offset, str) => {
         const before = str.slice(Math.max(0, offset - 20), offset);
@@ -718,17 +715,21 @@ router.post("/api/chat", (req, res) => {
   const shimToken = req.headers["x-chat-token"];
   const bridgeSender = req.headers["x-bridge-sender"];
   let sender = "user";
+  // #788: only an authenticated agent (shim) sender skips its own name; user
+  // and bridge messages normalize every name.
+  let selfMentionSkip = null;
   if (shimSender && shimToken) {
     if (!fileChat.validateShimToken(projectId, shimSender, shimToken)) {
       return res.status(403).json({ error: "Invalid shim token" });
     }
     sender = shimSender;
+    selfMentionSkip = shimSender;
   } else if (bridgeSender && isLocalhost(req.ip)) {
     sender = bridgeSender;
   }
   const msg = fileChat.appendMessage(projectId, {
     sender,
-    text: normalizeMentions(text),
+    text: normalizeMentions(text, selfMentionSkip),
     channel: req.body?.channel || "general",
     type: "message",
   });
@@ -874,12 +875,14 @@ router.get("/api/projects", async (req, res) => {
     }
     if (REPO_RE.test(p.repo)) {
       try {
-        const [prs, recentPrs] = await Promise.allSettled([
-          ghJsonExecAsync(["pr", "list", "-R", p.repo, "--json", "number", "--limit", "100"]),
-          ghJsonExecAsync(["pr", "list", "-R", p.repo, "--state", "all", "--json", "updatedAt", "--limit", "1"]),
+        // #806: REST + ETag instead of `gh pr list` (GraphQL-backed). Open-PR
+        // count + latest cross-state PR activity; both conditional (mostly 304).
+        const [prs, recentPrs] = await Promise.all([
+          ghApiConditional(`${p.repo}#projects-open-pulls`, `repos/${p.repo}/pulls?state=open&per_page=100`),
+          ghApiConditional(`${p.repo}#projects-last-activity`, `repos/${p.repo}/pulls?state=all&sort=updated&direction=desc&per_page=1`),
         ]);
-        if (prs.status === "fulfilled") openPrs = prs.value.length;
-        if (recentPrs.status === "fulfilled") lastActivity = recentPrs.value[0]?.updatedAt || null;
+        if (Array.isArray(prs.data)) openPrs = prs.data.length;
+        if (Array.isArray(recentPrs.data) && recentPrs.data[0]) lastActivity = recentPrs.data[0].updated_at || null;
       } catch {}
     }
     const hasAgents = p.agents && Object.keys(p.agents).length > 0;
@@ -973,11 +976,11 @@ function isProjectIdle(projectId) {
   }
 }
 
-// ─── #703: Batched GraphQL layer ──────────────────────────────────────────
-// Instead of spawning individual `gh issue list` / `gh pr list` subprocesses
-// per project per endpoint, we fetch ALL configured projects' GitHub data in
-// a single GraphQL query. The per-project endpoints read from this shared
-// cache, falling back to individual gh CLI calls if GraphQL fails.
+// ─── #703 / #806: shared board cache ──────────────────────────────────────
+// `_graphqlCache` holds each repo's assembled board snapshot. As of #806 it is
+// populated by the REST+ETag fetcher (githubStateFetcher / refreshRepoRest);
+// the batched GraphQL query below (fetchAllProjectsGraphQL) remains ONLY as an
+// emergency fallback, gated on the GraphQL budget. Name kept for minimal churn.
 
 const _graphqlCache = new Map(); // repo → { ts, issues, prs, closedIssues, mergedPrs }
 const GRAPHQL_CACHE_TTL = 60_000; // same as GH_ENDPOINT_CACHE_TTL
@@ -985,6 +988,676 @@ let _graphqlRefreshInFlight = false;
 
 const RECENT_FETCH_LIMIT = 20;
 const RECENT_DISPLAY_LIMIT = 5;
+// #828 P3: max state=closed pages (×100) to scan for the latest merged PRs when
+// a burst of recently-closed *unmerged* PRs pushes real merges past page 1.
+const MERGED_PAGE_CAP = 3;
+
+// ─── #806 (#805 step 1): REST + ETag GitHub state fetcher ──────────────────
+// The dashboard board was fed by `gh pr list`/`gh issue list --json
+// reviewDecision,statusCheckRollup,...`, which are GraphQL-backed under the
+// hood — draining GitHub's GraphQL points budget on every poll. This fetcher
+// acquires the same state via plain REST (`gh api repos/...`) with conditional
+// If-None-Match requests, so steady-state polling costs ~0 (304s are free and
+// don't count against the budget). It feeds the existing _ghEndpointCache /
+// _graphqlCache, and emits a single fully-assembled snapshot per pass.
+
+// ETag store: etagKey → { etag, data } (the RAW REST JSON, re-mapped per pass).
+const _etagStore = new Map();
+// Per-repo in-flight refresh: repo → Promise. Concurrent callers AWAIT the same
+// refresh (not just skip it) so a cold first load — where GitHubPanel fires the
+// four list endpoints in parallel — never races ahead of the populated cache.
+const _restRefreshing = new Map();
+
+// Split a `gh api -i` response into its header block and JSON body. gh emits
+// HTTP headers (CRLF) then a blank line then the body.
+function _parseGhInclude(raw) {
+  const sep = raw.search(/\r?\n\r?\n/);
+  if (sep === -1) return { headerBlock: raw, body: "" };
+  return {
+    headerBlock: raw.slice(0, sep),
+    body: raw.slice(sep).replace(/^\r?\n\r?\n/, ""),
+  };
+}
+
+// Extract the ETag header value (GitHub sends it as `Etag:`; match any case).
+function _extractEtag(headerBlock) {
+  const m = headerBlock.match(/^etag:\s*(.+)$/im);
+  return m ? m[1].trim() : null;
+}
+
+// gh exits non-zero on a 304; the marker lands in stderr ("gh: HTTP 304") and
+// the status line in stdout when `-i` is used.
+function _is304Error(err) {
+  const blob = `${(err && err.stderr) || ""}${(err && err.stdout) || ""}`;
+  return /HTTP 304|304 Not Modified/.test(blob);
+}
+
+// Conditional `gh api` GET. Reuses the stored ETag; on 304 returns the cached
+// payload (status "unchanged", zero budget cost). Never throws — a hard
+// failure returns the last good payload (if any) with status "error".
+async function ghApiConditional(etagKey, apiPath) {
+  const prev = _etagStore.get(etagKey);
+  const args = ["api", apiPath, "-i"];
+  if (prev && prev.etag) args.push("-H", `If-None-Match: ${prev.etag}`);
+  try {
+    const { stdout } = await _execFileAsync("gh", args, { encoding: "utf-8", timeout: 15000, maxBuffer: GH_LIST_MAX_BUFFER });
+    const { headerBlock, body } = _parseGhInclude(stdout);
+    const etag = _extractEtag(headerBlock);
+    let data = null;
+    try { data = body ? JSON.parse(body) : null; } catch { data = null; }
+    _etagStore.set(etagKey, { etag, data });
+    return { status: "ok", data, changed: true };
+  } catch (err) {
+    if (_is304Error(err) && prev) {
+      return { status: "unchanged", data: prev.data, changed: false };
+    }
+    return { status: "error", data: prev ? prev.data : null, changed: false };
+  }
+}
+
+// Coalesce concurrent async work by key: a caller arriving while a call for the
+// same key is in flight awaits the SAME promise (so it sees the result, not a
+// premature miss); a fresh call starts only after the prior one settles.
+function _coalesce(map, key, fn) {
+  const inflight = map.get(key);
+  if (inflight) return inflight;
+  // Invoke eagerly so the work starts now; register before any await of fn can
+  // resolve so same-tick concurrent callers join this exact promise.
+  const p = (async () => fn())().finally(() => map.delete(key));
+  map.set(key, p);
+  return p;
+}
+
+// Run `fn` over `items` with at most `limit` concurrent in flight (keeps the
+// per-PR fan-out from draining the core budget). Preserves input order.
+async function _mapLimited(items, limit, fn) {
+  const results = new Array(items.length);
+  let next = 0;
+  async function worker() {
+    while (next < items.length) {
+      const idx = next++;
+      results[idx] = await fn(items[idx], idx);
+    }
+  }
+  const n = Math.max(1, Math.min(limit, items.length));
+  await Promise.all(Array.from({ length: n }, worker));
+  return results;
+}
+
+// ── Canonical dashboard shape (pinned + tested; do NOT defer to "same as
+// GraphQL"). issue/PR `state` is UPPERCASE OPEN/CLOSED/MERGED — matches the
+// gh-CLI path and GitHubPanel.tsx's `state === "OPEN"` dot (the prior GraphQL
+// transform lowercased to "open", an inconsistency this pins). ──
+function restIssueToCanonical(it) {
+  return {
+    number: it.number,
+    title: it.title,
+    state: (it.state || "").toUpperCase(),
+    url: it.html_url,
+    labels: (it.labels || []).map((l) => ({ name: typeof l === "string" ? l : l.name })),
+    assignees: (it.assignees || []).map((a) => ({ login: a.login })),
+    createdAt: it.created_at,
+  };
+}
+
+function restClosedIssueToCanonical(it) {
+  return {
+    number: it.number,
+    title: it.title,
+    state: (it.state || "closed").toUpperCase(),
+    url: it.html_url,
+    closedAt: it.closed_at,
+  };
+}
+
+function restMergedPrToCanonical(p) {
+  return {
+    number: p.number,
+    title: p.title,
+    state: "MERGED",
+    url: p.html_url,
+    mergedAt: p.merged_at,
+    author: p.user ? { login: p.user.login } : null,
+  };
+}
+
+// Base open-PR row; reviews/reviewDecision/statusCheckRollup are attached after
+// the per-PR sub-fetches.
+function restPullBaseToCanonical(p) {
+  return {
+    number: p.number,
+    title: p.title,
+    state: (p.state || "").toUpperCase(),
+    url: p.html_url,
+    author: p.user ? { login: p.user.login } : null,
+    assignees: (p.assignees || []).map((a) => ({ login: a.login })),
+    createdAt: p.created_at,
+  };
+}
+
+// Keep the FULL review list with bodies — re1/re2 share one GitHub author, so
+// #807/#810 attribute ROLE from body markers, not author-latest collapse.
+function mapReviews(restReviews) {
+  return (restReviews || []).map((r) => ({
+    state: r.state,
+    author: r.user ? { login: r.user.login } : null,
+    submittedAt: r.submitted_at,
+    body: r.body || "",
+  }));
+}
+
+// Derive a reviewDecision from the raw review list (the per-PR reviews are
+// authoritative). Latest decision-affecting review per author wins; any
+// CHANGES_REQUESTED blocks, else any APPROVED approves, else REVIEW_REQUIRED.
+function deriveReviewDecision(reviews) {
+  const byAuthor = new Map();
+  const sorted = (reviews || []).slice().sort(
+    (a, b) => (Date.parse(a && a.submittedAt) || 0) - (Date.parse(b && b.submittedAt) || 0),
+  );
+  for (const r of sorted) {
+    const login = r && r.author && r.author.login;
+    if (!login) continue;
+    if (r.state === "APPROVED" || r.state === "CHANGES_REQUESTED" || r.state === "DISMISSED") {
+      byAuthor.set(login, r.state);
+    }
+  }
+  let approved = false;
+  for (const s of byAuthor.values()) {
+    if (s === "CHANGES_REQUESTED") return "CHANGES_REQUESTED";
+    if (s === "APPROVED") approved = true;
+  }
+  return approved ? "APPROVED" : "REVIEW_REQUIRED";
+}
+
+function _normCheckRunState(run) {
+  if (run.status && run.status !== "completed") return "PENDING";
+  switch ((run.conclusion || "").toLowerCase()) {
+    case "success": return "SUCCESS";
+    case "failure": case "timed_out": case "startup_failure": return "FAILURE";
+    case "cancelled": case "action_required": case "stale": return "ERROR";
+    case "neutral": case "skipped": return "SUCCESS";
+    default: return "PENDING";
+  }
+}
+
+function _normStatusState(state) {
+  switch ((state || "").toLowerCase()) {
+    case "success": return "SUCCESS";
+    case "failure": return "FAILURE";
+    case "error": return "ERROR";
+    default: return "PENDING";
+  }
+}
+
+// statusCheckRollup = check-runs AND the legacy combined-status, normalized to
+// the { state } array GitHubPanel.tsx's ciColor/ciLabel expect (SUCCESS /
+// FAILURE / ERROR / PENDING).
+function buildStatusCheckRollup(checkRunsResp, statusResp) {
+  const rollup = [];
+  const runs = (checkRunsResp && checkRunsResp.check_runs) || [];
+  for (const r of runs) rollup.push({ state: _normCheckRunState(r) });
+  const statuses = (statusResp && statusResp.statuses) || [];
+  for (const s of statuses) rollup.push({ state: _normStatusState(s.state) });
+  return rollup;
+}
+
+// Fetch a repo's full board state via REST + ETag in one pass. Returns a single
+// fully-assembled snapshot (never section-by-section) plus a status the file
+// writer (#807) can trust: "ok" (something changed), "unchanged" (all 304s),
+// or "error" (could not assemble any list — never stamp this as fresh).
+// #828 P3: page through state=closed (newest-updated first) until we have
+// ≥RECENT_DISPLAY_LIMIT merged PRs or hit the page cap — a burst of recently-
+// closed *unmerged* PRs could otherwise push real merges past a single page and
+// under-report "Recently merged". Page 1 is fetched in parallel with the other
+// top lists and passed in; further pages are fetched on demand only when page 1
+// is FULL (more pages may exist) AND short on merges. `fetchPage(page)` returns
+// the same { status, data } shape as ghApiConditional. Pure control flow over
+// an injected fetcher → unit-testable without network.
+async function gatherClosedPrPages(firstPage, fetchPage) {
+  const pages = [firstPage];
+  const mergedCount = (r) => (Array.isArray(r && r.data) ? r.data : []).filter((p) => p.merged_at).length;
+  let mergedSoFar = mergedCount(firstPage);
+  let lastLen = Array.isArray(firstPage && firstPage.data) ? firstPage.data.length : 0;
+  for (let page = 2; page <= MERGED_PAGE_CAP && mergedSoFar < RECENT_DISPLAY_LIMIT && lastLen === 100; page++) {
+    const r = await fetchPage(page);
+    pages.push(r);
+    mergedSoFar += mergedCount(r);
+    lastLen = Array.isArray(r && r.data) ? r.data.length : 0;
+  }
+  return pages;
+}
+
+// The latest RECENT_DISPLAY_LIMIT merged PRs across the gathered closed-PR
+// pages, newest merge first. Pure → unit-testable.
+function selectRecentMergedPrs(pages) {
+  return pages
+    .flatMap((r) => (Array.isArray(r && r.data) ? r.data : []))
+    .filter((p) => p.merged_at)
+    .sort((a, b) => (Date.parse(b && b.merged_at) || 0) - (Date.parse(a && a.merged_at) || 0))
+    .slice(0, RECENT_DISPLAY_LIMIT)
+    .map(restMergedPrToCanonical);
+}
+
+// #834: whether the closed-PR pagination reached the ACTUAL end of the list —
+// the ONLY proof that no further closed/merged PR exists beyond what we scanned.
+// True iff the LAST fetched page came back reliably (not an "error") AND had
+// < 100 items (a genuine final page; a full 100 means more may exist). This is
+// deliberately stricter than "the loop stopped": stopping early because the
+// display need was met (≥5 merged) or hitting MERGED_PAGE_CAP while pages were
+// still full does NOT prove completeness — those leave a full (===100) last
+// page, so this returns false and the caller falls back to by-number. A 304
+// carries the unchanged real data, so a short (<100) 304 page is a genuine end
+// too; only "error" pages (possibly stale/null data) can't prove it. Pure.
+function closedPagesComplete(pages) {
+  const last = pages[pages.length - 1];
+  return !!last && last.status !== "error" && Array.isArray(last.data) && last.data.length < 100;
+}
+
+// #834: issue numbers linked by the team's `[#N]` PR-title convention across
+// ALL fetched closed-PR pages (not just the 5 displayed merged). Lets
+// progressFromSnapshot prove an OPEN issue has no closed/merged linked PR —
+// even one merged/closed outside the recent-5 window — before classifying it
+// queued. Pure → unit-testable.
+function closedPrIssueNumsFromPages(pages) {
+  const re = /^\s*\[#(\d{1,7})\]/;
+  const nums = [];
+  for (const r of pages) {
+    const arr = Array.isArray(r && r.data) ? r.data : [];
+    for (const p of arr) {
+      const m = ((p && p.title) || "").match(re);
+      if (m) nums.push(parseInt(m[1], 10));
+    }
+  }
+  return nums;
+}
+
+async function githubStateFetcher(repo) {
+  const [owner, name] = (repo || "").split("/");
+  if (!owner || !name) return { status: "error", data: null };
+  const base = `repos/${owner}/${name}`;
+  let changed = 0;
+
+  const [openPullsR, openIssuesR, closedIssuesR, closedPulls1R] = await Promise.all([
+    ghApiConditional(`${repo}#pulls-open`, `${base}/pulls?state=open&per_page=50&sort=updated&direction=desc`),
+    ghApiConditional(`${repo}#issues-open`, `${base}/issues?state=open&per_page=50&sort=updated&direction=desc`),
+    ghApiConditional(`${repo}#issues-closed`, `${base}/issues?state=closed&per_page=100&sort=updated&direction=desc`),
+    ghApiConditional(`${repo}#pulls-closed`, `${base}/pulls?state=closed&per_page=100&sort=updated&direction=desc`),
+  ]);
+
+  // #828 P3: extend the closed-PR window across pages only when needed (each
+  // page conditional/ETag'd, so steady-state extra pages cost nothing on a 304).
+  const closedPullPages = await gatherClosedPrPages(closedPulls1R, (page) =>
+    ghApiConditional(`${repo}#pulls-closed-p${page}`, `${base}/pulls?state=closed&per_page=100&sort=updated&direction=desc&page=${page}`),
+  );
+
+  let anyTopData = false;
+  for (const r of [openPullsR, openIssuesR, closedIssuesR, ...closedPullPages]) {
+    if (r.status === "ok") changed++;
+    if (Array.isArray(r.data)) anyTopData = true;
+  }
+  // No list data at all (first run, every call failed) → don't fabricate a
+  // snapshot; let callers keep serving whatever they already had.
+  if (!anyTopData) return { status: "error", data: null };
+
+  // REST /issues includes PRs — drop anything carrying a pull_request key.
+  const issues = (Array.isArray(openIssuesR.data) ? openIssuesR.data : [])
+    .filter((it) => !it.pull_request)
+    .map(restIssueToCanonical);
+
+  const closedIssues = (Array.isArray(closedIssuesR.data) ? closedIssuesR.data : [])
+    .filter((it) => !it.pull_request)
+    .sort((a, b) => (Date.parse(b && b.closed_at) || 0) - (Date.parse(a && a.closed_at) || 0))
+    .slice(0, RECENT_DISPLAY_LIMIT)
+    .map(restClosedIssueToCanonical);
+
+  const mergedPrs = selectRecentMergedPrs(closedPullPages);
+
+  // #828 P1: record whether the open-PR board window is PROVABLY complete — we
+  // asked for 50 and got fewer, so we've seen EVERY open PR. progressFrom-
+  // Snapshot relies on this to classify a no-matching-PR open issue as queued
+  // without a by-number fetch; if exactly 50 came back the window may be
+  // truncated and it must NOT guess.
+  const openPrsWindowComplete = Array.isArray(openPullsR.data) && openPullsR.data.length < 50;
+  // #834: queued-from-snapshot also requires proving NO closed/merged linked PR
+  // exists. closedPrsWindowComplete = the closed-PR pagination reached an actual
+  // <100 end (not just stopped early); closedPrIssueNums = every [#N] across ALL
+  // scanned closed pages, so a PR merged/closed outside the recent-5 window
+  // still blocks a false "queued". Both are consumed by progressFromSnapshot.
+  const closedPrsWindowComplete = closedPagesComplete(closedPullPages);
+  const closedPrIssueNums = closedPrIssueNumsFromPages(closedPullPages);
+
+  const openPullsRaw = Array.isArray(openPullsR.data) ? openPullsR.data : [];
+  const prs = await _mapLimited(openPullsRaw, GH_MAX_CONCURRENT, async (p) => {
+    const sha = p.head && p.head.sha;
+    const [reviewsR, checkRunsR, statusR] = await Promise.all([
+      ghApiConditional(`${repo}#reviews-${p.number}`, `${base}/pulls/${p.number}/reviews?per_page=100`),
+      sha ? ghApiConditional(`${repo}#checkruns-${sha}`, `${base}/commits/${sha}/check-runs?per_page=100`) : Promise.resolve({ status: "error", data: null }),
+      sha ? ghApiConditional(`${repo}#status-${sha}`, `${base}/commits/${sha}/status`) : Promise.resolve({ status: "error", data: null }),
+    ]);
+    if (reviewsR.status === "ok" || checkRunsR.status === "ok" || statusR.status === "ok") changed++;
+    const reviews = mapReviews(Array.isArray(reviewsR.data) ? reviewsR.data : []);
+    return {
+      ...restPullBaseToCanonical(p),
+      reviews,
+      reviewDecision: deriveReviewDecision(reviews),
+      statusCheckRollup: buildStatusCheckRollup(checkRunsR.data, statusR.data),
+    };
+  });
+
+  return {
+    status: changed > 0 ? "ok" : "unchanged",
+    data: { issues, prs, closedIssues, mergedPrs, openPrsWindowComplete, closedPrsWindowComplete, closedPrIssueNums },
+  };
+}
+
+// Refresh a single repo's REST snapshot into the shared caches. Coalesced: a
+// concurrent caller (e.g. the parallel cold-load of all four list endpoints, or
+// a background stale refresh overlapping an on-demand one) joins and awaits the
+// SAME in-flight pass, so by the time it resolves the slice caches are written.
+function refreshRepoRest(repo) {
+  return _coalesce(_restRefreshing, repo, async () => {
+    let result;
+    try {
+      const { status, data } = await githubStateFetcher(repo);
+      if (data) {
+        const now = Date.now();
+        _graphqlCache.set(repo, { ts: now, ...data });
+        _ghEndpointCache.set(`issues:${repo}`, { ts: now, data: data.issues, stale: false });
+        _ghEndpointCache.set(`prs:${repo}`, { ts: now, data: data.prs, stale: false });
+        _ghEndpointCache.set(`closed-issues:${repo}`, { ts: now, data: data.closedIssues, stale: false });
+        _ghEndpointCache.set(`merged-prs:${repo}`, { ts: now, data: data.mergedPrs, stale: false });
+      }
+      result = { status, data };
+    } catch {
+      result = { status: "error", data: null };
+    }
+    // #807: the server is the sole author of GITHUB.md's machine sections —
+    // regenerate it from this completed pass's snapshot (success or error so
+    // staleCycles advances). Non-fatal; never affects the board cache result.
+    try { syncGithubFilesForRepo(repo, result.status); } catch { /* non-fatal */ }
+    return result;
+  });
+}
+
+// ─── #807 (#805 step 2): server-authored GITHUB.md ────────────────────────
+// Per-project GITHUB.md mirrors OVERNIGHT-QUEUE.md: the server is the sole
+// author of the machine sections (built from #806's structured snapshot),
+// agents read the file for discovery. Section bodies are injection-safe and
+// strictly parseable (parseGithub). The `## Notes` block is human/HEAD-writable
+// and preserved across regeneration.
+
+// Per-project freshness: projectId → { generatedAt(ms), staleCycles }.
+const _githubMeta = new Map();
+// #807: FIXED freshness window for the live `_stale` signal — must NOT use
+// adaptiveTTL, which returns Infinity under critical rate-limit (the exact case
+// where no sync pass runs and staleness is unbounded). ~5 poll cycles.
+const GITHUB_FRESH_TTL_MS = 5 * 60_000;
+
+// Live staleness for /api/github-parsed: stale if the file says so, if we have
+// no generatedAt, or if the snapshot is older than the FIXED window. Pure so
+// the rate-limit edge case (unbounded age) is regression-tested directly.
+// #827: a NaN ageMs (Date.parse of a malformed/corrupted `generatedAt`) must
+// count as stale/unknown — NOT fresh. Without the guard, `NaN > window` is
+// false and staleness would be hidden exactly when the file is suspect.
+function _githubLiveStale(headerStale, ageMs) {
+  return headerStale || ageMs == null || Number.isNaN(ageMs) || ageMs > GITHUB_FRESH_TTL_MS;
+}
+const GITHUB_SECTION_HEADERS = {
+  openIssues: "Open Issues",
+  openPRs: "Open PRs",
+  closedIssues: "Recently Closed Issues",
+  mergedPrs: "Recently Merged PRs",
+};
+
+// Collapse untrusted text to a single safe line so it can NEVER begin a new
+// `## ` section marker or break the strict list-line grammar. Also strips the
+// field delimiter (·) we use, and `[`/`]` that bound the assignees field.
+function _sanitizeInline(s) {
+  return String(s == null ? "" : s)
+    .replace(/[\r\n]+/g, " ")
+    .replace(/[·\[\]]/g, " ")
+    .replace(/\s+/g, " ")
+    .trim();
+}
+
+function _renderAssignees(assignees) {
+  // Empty → "" so the rendered `[]` round-trips back to an empty array (rather
+  // than a phantom assignee literally named "none").
+  const logins = (assignees || []).map((a) => a && a.login).filter(Boolean).map(_sanitizeInline);
+  return logins.map((l) => `@${l}`).join(", ");
+}
+
+// One strict list line: `- [#N](url) · STATE · [assignees] · title`. The
+// free-text title is LAST (the parser reads it as the line tail), and url is
+// whitespace-free, so neither can corrupt the earlier fixed fields.
+function _renderListItem(item) {
+  const url = _sanitizeInline(item.url).replace(/\s/g, "") || "-";
+  const state = _sanitizeInline(item.state).toUpperCase() || "OPEN";
+  return `- [#${item.number}](${url}) · ${state} · [${_renderAssignees(item.assignees)}] · ${_sanitizeInline(item.title)}`;
+}
+
+function _renderSection(items, renderLine) {
+  if (!items || items.length === 0) return "(none)";
+  return items.map(renderLine).join("\n");
+}
+
+// Latest review per body-marker ROLE (re1/re2) across the shared author's full
+// review list — GitHub login can't distinguish the reviewers (same account), so
+// we match RE1/RE2/Reviewer1/Reviewer2/T2a/T2b (and `## Verdict`→re1) prefixes
+// in the review BODY. A marker-less/ambiguous review is UNCOUNTED (never
+// over-counts). Mirrors GitHubPanel.tsx's body-marker logic.
+function attributeReviewsByRole(reviews) {
+  const sorted = (reviews || []).slice().sort(
+    (a, b) => (Date.parse(a && a.submittedAt) || 0) - (Date.parse(b && b.submittedAt) || 0),
+  );
+  const out = { re1: null, re2: null };
+  for (const r of sorted) {
+    const body = ((r && r.body) || "").trim();
+    let role = null;
+    if (/^(?:RE2|Reviewer2|T2b)\b/i.test(body)) role = "re2";
+    else if (/^(?:RE1|Reviewer1|T2a)\b/i.test(body) || /^##\s*Verdict/i.test(body)) role = "re1";
+    if (!role) continue; // ambiguous → uncounted
+    out[role] = { state: r.state, submittedAt: r.submittedAt || null };
+  }
+  return out;
+}
+
+function _renderReviewDetail(prs) {
+  const lines = [];
+  for (const pr of prs || []) {
+    const roles = attributeReviewsByRole(pr.reviews);
+    for (const role of ["re1", "re2"]) {
+      const rv = roles[role];
+      if (!rv) continue;
+      lines.push(`- #${pr.number} · ${role}:${_sanitizeInline(rv.state).toUpperCase()} · ${_sanitizeInline(rv.submittedAt) || "-"}`);
+    }
+  }
+  return lines.length ? lines.join("\n") : "(none)";
+}
+
+// Build the full GITHUB.md from a structured snapshot. Pure (no I/O). `notesBody`
+// is the preserved `## Notes` text. `meta` = { generatedAt(ms), staleCycles }.
+function renderGithubMarkdown(projectName, repo, snapshot, meta, notesBody) {
+  const snap = snapshot || {};
+  const generatedAt = meta && meta.generatedAt ? new Date(meta.generatedAt).toISOString() : "never";
+  const staleCycles = (meta && meta.staleCycles) || 0;
+  const stale = staleCycles > 0 || !meta || !meta.generatedAt;
+  return [
+    `# ${projectName || ""} — GitHub State`,
+    "",
+    `> **Repo:** ${repo || ""}`,
+    `> **Generated:** ${generatedAt} · staleCycles: ${staleCycles} · stale: ${stale}`,
+    ">",
+    "> Machine-generated by QuadWork — do NOT edit the sections below (overwritten",
+    "> on every sync). Edit only `## Notes`.",
+    "",
+    "---",
+    "",
+    `## ${GITHUB_SECTION_HEADERS.openIssues}`,
+    "",
+    _renderSection(snap.issues, _renderListItem),
+    "",
+    "---",
+    "",
+    `## ${GITHUB_SECTION_HEADERS.openPRs}`,
+    "",
+    _renderSection(snap.prs, _renderListItem),
+    "",
+    "---",
+    "",
+    `## ${GITHUB_SECTION_HEADERS.closedIssues}`,
+    "",
+    _renderSection(snap.closedIssues, _renderListItem),
+    "",
+    "---",
+    "",
+    `## ${GITHUB_SECTION_HEADERS.mergedPrs}`,
+    "",
+    _renderSection(snap.mergedPrs, _renderListItem),
+    "",
+    "---",
+    "",
+    "## Review Detail",
+    "",
+    _renderReviewDetail(snap.prs),
+    "",
+    "---",
+    "",
+    "## Notes",
+    "",
+    (notesBody && notesBody.trim()) ? notesBody.trim() : "(none)",
+    "",
+  ].join("\n");
+}
+
+const _GITHUB_DEFAULT_NOTES =
+  "_Advisory only. The Review Detail above is body-marker attribution (re1/re2),\n" +
+  "not merge-authoritative — Head re-checks live before merging. This section is\n" +
+  "human/Head-writable and is preserved across regeneration._";
+
+// Extract the existing `## Notes` body (preserved verbatim across regeneration).
+// Anchored to line start (multiline) so it matches the real `## Notes` SECTION,
+// not the `` `## Notes` `` reference in the header instructions. Notes is the
+// last section, so we capture to EOF and do NOT strip trailing `## ` lines —
+// that lets a human note contain its own `## ` headings without truncation.
+function _extractNotesBody(text) {
+  const m = (text || "").match(/^##\s+Notes\b[^\n]*\n([\s\S]*)$/im);
+  if (!m) return _GITHUB_DEFAULT_NOTES;
+  const body = m[1].trim();
+  return body || _GITHUB_DEFAULT_NOTES;
+}
+
+// Write one project's GITHUB.md atomically (temp + rename) from a snapshot,
+// preserving its `## Notes`. status drives the freshness meta.
+function writeGithubFileFromSnapshot(projectId, projectName, repo, snapshot, status) {
+  try {
+    // #827: re-check idle here (reads config fresh) — syncGithubFilesForRepo
+    // filtered on a config snapshot taken earlier, so an idle-flip concurrent
+    // with a setup-seed/refresh pass could otherwise still write a parked
+    // project's GITHUB.md. Defensive; idle projects must author nothing.
+    if (isProjectIdle(projectId)) return;
+    const dir = path.join(CONFIG_DIR, projectId);
+    const filePath = path.join(dir, "GITHUB.md");
+    // Cold + total failure with nothing cached: leave the seeded template be.
+    if (!snapshot && status === "error") return;
+    ensureSecureDir(dir);
+
+    let notesBody = _GITHUB_DEFAULT_NOTES;
+    try { notesBody = _extractNotesBody(fs.readFileSync(filePath, "utf-8")); } catch { /* seed defaults */ }
+
+    const meta = _githubMeta.get(projectId) || { generatedAt: 0, staleCycles: 0 };
+    if (status === "error") {
+      meta.staleCycles += 1; // keep last generatedAt — never stamp a failed cycle fresh
+    } else {
+      meta.generatedAt = Date.now();
+      meta.staleCycles = 0;
+    }
+    _githubMeta.set(projectId, meta);
+
+    const content = renderGithubMarkdown(projectName, repo, snapshot, meta, notesBody);
+    const tmp = path.join(dir, `.GITHUB.md.tmp-${process.pid}`);
+    fs.writeFileSync(tmp, content, { mode: 0o600 });
+    fs.renameSync(tmp, filePath); // atomic — readers never see partial content
+  } catch { /* non-fatal */ }
+}
+
+// Regenerate GITHUB.md for every non-idle project bound to this repo, from the
+// last-good snapshot in _graphqlCache. Idle projects are never regenerated.
+function syncGithubFilesForRepo(repo, status) {
+  let cfg;
+  try { cfg = JSON.parse(fs.readFileSync(CONFIG_PATH, "utf-8")); } catch { return; }
+  const snapshot = _graphqlCache.get(repo) || null;
+  for (const p of cfg.projects || []) {
+    if (p.repo !== repo || p.idle) continue;
+    writeGithubFileFromSnapshot(p.id, p.name || p.id, repo, snapshot, status);
+  }
+}
+
+// ── Strict GITHUB.md parser (mirrors parseActiveBatch). Pure; section-isolating
+// (stops at the next `## `); list lines must match the exact grammar so prose
+// `#N` can't leak. Distinguishes a parse error (not our file) from an
+// empty-but-valid section. Exported for unit tests. ──
+const _GH_ITEM_RE = /^-\s+\[#(\d{1,7})\]\((\S+)\)\s+·\s+(OPEN|CLOSED|MERGED)\s+·\s+\[([^\]]*)\]\s+·\s+(.*)$/;
+const _GH_REVIEW_RE = /^-\s+#(\d{1,7})\s+·\s+(re1|re2):([A-Z_]+)\s+·\s+(\S+)$/;
+const _GH_FRESH_RE = /\*\*Generated:\*\*\s*(\S+)\s*·\s*staleCycles:\s*(\d+)\s*·\s*stale:\s*(true|false)/i;
+
+function _ghSection(text, header) {
+  const re = new RegExp(`##\\s+${header.replace(/[.*+?^${}()|[\\]\\\\]/g, "\\$&")}\\b[\\s\\S]*?(?=\\n##\\s|$)`, "i");
+  const m = text.match(re);
+  return m ? m[0] : null;
+}
+
+function _parseGhList(text, header) {
+  const section = _ghSection(text, header);
+  if (section == null) return null; // header missing → distinct from empty
+  const items = [];
+  for (const line of section.split("\n")) {
+    const m = line.match(_GH_ITEM_RE);
+    if (!m) continue; // prose / "(none)" / blanks are skipped
+    const assignees = m[4].split(",").map((s) => s.trim().replace(/^@/, "")).filter(Boolean).map((login) => ({ login }));
+    items.push({ number: parseInt(m[1], 10), url: m[2], state: m[3], assignees, title: m[5].trim() });
+  }
+  return items;
+}
+
+function parseGithub(text) {
+  if (typeof text !== "string" || !text.trim()) {
+    return { ok: false, error: "empty or non-string input" };
+  }
+  const openIssues = _parseGhList(text, GITHUB_SECTION_HEADERS.openIssues);
+  const openPRs = _parseGhList(text, GITHUB_SECTION_HEADERS.openPRs);
+  const closedIssues = _parseGhList(text, GITHUB_SECTION_HEADERS.closedIssues);
+  const mergedPrs = _parseGhList(text, GITHUB_SECTION_HEADERS.mergedPrs);
+  // If none of the required machine headers exist, this isn't a GITHUB.md.
+  if (openIssues == null && openPRs == null && closedIssues == null && mergedPrs == null) {
+    return { ok: false, error: "no recognizable GITHUB.md sections" };
+  }
+
+  // Review Detail → { [prNumber]: { re1?: {state,submittedAt}, re2?: {...} } }.
+  const reviewDetail = {};
+  const reviewSection = _ghSection(text, "Review Detail");
+  if (reviewSection) {
+    for (const line of reviewSection.split("\n")) {
+      const m = line.match(_GH_REVIEW_RE);
+      if (!m) continue;
+      const n = parseInt(m[1], 10);
+      (reviewDetail[n] || (reviewDetail[n] = {}))[m[2]] = { state: m[3], submittedAt: m[4] };
+    }
+  }
+
+  const fresh = text.match(_GH_FRESH_RE);
+  return {
+    ok: true,
+    generatedAt: fresh && fresh[1] !== "never" ? fresh[1] : null,
+    staleCycles: fresh ? parseInt(fresh[2], 10) : 0,
+    stale: fresh ? fresh[3].toLowerCase() === "true" : true,
+    openIssues: openIssues || [],
+    openPRs: openPRs || [],
+    closedIssues: closedIssues || [],
+    mergedPrs: mergedPrs || [],
+    reviewDetail,
+  };
+}
 
 // Build and execute a batched GraphQL query for all configured projects.
 // Returns a Map of repo → { issues, prs, closedIssues, mergedPrs }.
@@ -1021,7 +1694,7 @@ fragment repoFields on Repository {
     nodes { number title url state closedAt }
   }
   openPRs: pullRequests(first: 50, states: OPEN, orderBy: {field: UPDATED_AT, direction: DESC}) {
-    nodes { number title url state author { login } reviews(last: 100) { nodes { state author { login } submittedAt } } createdAt }
+    nodes { number title url state author { login } reviews(last: 100) { nodes { state author { login } submittedAt body } } createdAt }
   }
   mergedPRs: pullRequests(first: ${RECENT_FETCH_LIMIT}, states: MERGED, orderBy: {field: UPDATED_AT, direction: DESC}) {
     nodes { number title url state mergedAt author { login } }
@@ -1031,7 +1704,7 @@ fragment repoFields on Repository {
   try {
     const { stdout } = await _execFileAsync("gh", [
       "api", "graphql", "-f", `query=${query}`,
-    ], { encoding: "utf-8", timeout: 15000 });
+    ], { encoding: "utf-8", timeout: 15000, maxBuffer: GH_LIST_MAX_BUFFER });
     const data = JSON.parse(stdout).data;
     if (!data) return null;
 
@@ -1042,10 +1715,13 @@ fragment repoFields on Repository {
       if (!repoData) continue;
 
       // Transform GraphQL nodes into the same shape as gh CLI JSON output.
+      // #806: pin canonical uppercase state for emergency-fallback parity with
+      // the REST path. reviewDecision/statusCheckRollup are absent here (the
+      // GraphQL query doesn't fetch them) — acceptable for a degraded fallback.
       const issues = (repoData.openIssues?.nodes || []).map((n) => ({
         number: n.number,
         title: n.title,
-        state: n.state === "OPEN" ? "open" : n.state?.toLowerCase() || n.state,
+        state: (n.state || "").toUpperCase(),
         url: n.url,
         labels: (n.labels?.nodes || []).map((l) => ({ name: l.name })),
         assignees: (n.assignees?.nodes || []).map((a) => ({ login: a.login })),
@@ -1055,7 +1731,7 @@ fragment repoFields on Repository {
       const prs = (repoData.openPRs?.nodes || []).map((n) => ({
         number: n.number,
         title: n.title,
-        state: n.state === "OPEN" ? "open" : n.state?.toLowerCase() || n.state,
+        state: (n.state || "").toUpperCase(),
         url: n.url,
         author: n.author ? { login: n.author.login } : null,
         assignees: [],
@@ -1063,6 +1739,7 @@ fragment repoFields on Repository {
           state: r.state,
           author: r.author ? { login: r.author.login } : null,
           submittedAt: r.submittedAt,
+          body: r.body || "",
         })),
         createdAt: n.createdAt,
       }));
@@ -1078,7 +1755,7 @@ fragment repoFields on Repository {
         .map((n) => ({
           number: n.number,
           title: n.title,
-          state: n.state?.toLowerCase() || "closed",
+          state: (n.state || "CLOSED").toUpperCase(),
           url: n.url,
           closedAt: n.closedAt,
         }));
@@ -1094,7 +1771,7 @@ fragment repoFields on Repository {
         .map((n) => ({
           number: n.number,
           title: n.title,
-          state: n.state?.toLowerCase() || "merged",
+          state: (n.state || "MERGED").toUpperCase(),
           url: n.url,
           mergedAt: n.mergedAt,
           author: n.author ? { login: n.author.login } : null,
@@ -1112,24 +1789,48 @@ fragment repoFields on Repository {
 // and on demand when a per-project endpoint has no cached data.
 async function refreshGraphQLCache() {
   if (_graphqlRefreshInFlight) return;
-  if (isRateLimited()) return; // don't burn quota when critically low
+  // #806: the board state now comes from REST + ETag (githubStateFetcher), so
+  // gate on the REST (core) budget. 304s are free, but the first/changed
+  // fetches cost core — back off when REST is critically low and let consumers
+  // serve stale. (Name kept so the module-scope auto-start stays untouched.)
+  if (isRateLimited()) return;
   _graphqlRefreshInFlight = true;
   try {
-    const data = await fetchAllProjectsGraphQL();
-    if (data) {
-      const now = Date.now();
-      for (const [repo, repoData] of data) {
-        _graphqlCache.set(repo, { ts: now, ...repoData });
-        // Also populate the per-endpoint _ghEndpointCache so stale-while-
-        // revalidate and existing per-project endpoints pick up the data.
-        _ghEndpointCache.set(`issues:${repo}`, { ts: now, data: repoData.issues, stale: false });
-        _ghEndpointCache.set(`prs:${repo}`, { ts: now, data: repoData.prs, stale: false });
-        _ghEndpointCache.set(`closed-issues:${repo}`, { ts: now, data: repoData.closedIssues, stale: false });
-        _ghEndpointCache.set(`merged-prs:${repo}`, { ts: now, data: repoData.mergedPrs, stale: false });
+    let cfg;
+    try { cfg = JSON.parse(fs.readFileSync(CONFIG_PATH, "utf-8")); } catch { return; }
+    const seen = new Set();
+    const repos = [];
+    for (const p of cfg.projects || []) {
+      if (!p.repo || !REPO_RE.test(p.repo) || p.idle) continue; // #812: skip idle
+      if (seen.has(p.repo)) continue;
+      seen.add(p.repo);
+      repos.push(p.repo);
+    }
+    const results = await _mapLimited(repos, GH_MAX_CONCURRENT, (repo) =>
+      refreshRepoRest(repo).then((r) => ({ repo, status: r.status })),
+    );
+
+    // #805/#806 emergency fallback: if REST could not assemble a snapshot for
+    // some repos AND the GraphQL budget is healthy, backfill via the legacy
+    // batched GraphQL query (gated on the GRAPHQL bucket, never REST).
+    const failed = results.filter((r) => r.status === "error").map((r) => r.repo);
+    if (failed.length > 0 && !isGraphqlRateLimited()) {
+      const gql = await fetchAllProjectsGraphQL();
+      if (gql) {
+        const now = Date.now();
+        for (const repo of failed) {
+          const d = gql.get(repo);
+          if (!d) continue;
+          _graphqlCache.set(repo, { ts: now, ...d });
+          _ghEndpointCache.set(`issues:${repo}`, { ts: now, data: d.issues, stale: false });
+          _ghEndpointCache.set(`prs:${repo}`, { ts: now, data: d.prs, stale: false });
+          _ghEndpointCache.set(`closed-issues:${repo}`, { ts: now, data: d.closedIssues, stale: false });
+          _ghEndpointCache.set(`merged-prs:${repo}`, { ts: now, data: d.mergedPrs, stale: false });
+        }
       }
     }
   } catch {
-    // Non-fatal — per-project endpoints still work via individual gh CLI.
+    // Non-fatal — consumers serve last-known cache.
   } finally {
     _graphqlRefreshInFlight = false;
   }
@@ -1139,128 +1840,110 @@ async function refreshGraphQLCache() {
 let _graphqlPollTimer = null;
 function startGraphQLPolling() {
   if (_graphqlPollTimer) return;
+  // #836: both the warm-up setTimeout and the steady-state setInterval are
+  // .unref()'d so a test/import process can exit. The Express HTTP listener
+  // keeps prod alive on its own; cadence is unchanged.
   // Initial fetch after a short delay (let rate-limit poll run first).
-  setTimeout(() => refreshGraphQLCache(), 2000);
+  setTimeout(() => refreshGraphQLCache(), 2000).unref();
   _graphqlPollTimer = setInterval(refreshGraphQLCache, GRAPHQL_CACHE_TTL);
+  _graphqlPollTimer.unref();
 }
 
-// #703: Batched GraphQL for batch progress — fetch all issue states +
-// linked PRs in a single query instead of 2N individual gh calls.
-async function fetchBatchProgressGraphQL(repo, issueNumbers) {
-  if (!issueNumbers || issueNumbers.length === 0) return null;
-  const [owner, name] = repo.split("/");
-  if (!owner || !name) return null;
-
-  // Build aliased issue fields.
-  const issueFields = issueNumbers.map((n) =>
-    `issue${n}: issue(number: ${n}) {
-      number title state url
-      closedByPullRequestsReferences(first: 3) {
-        nodes { number state url merged reviews(last: 100) { nodes { state author { login } submittedAt } } }
-      }
-    }`
-  ).join("\n    ");
-
-  const query = `query {
-  repository(owner: "${owner}", name: "${name}") {
-    ${issueFields}
-  }
-}`;
-
-  try {
-    const { stdout } = await _execFileAsync("gh", [
-      "api", "graphql", "-f", `query=${query}`,
-    ], { encoding: "utf-8", timeout: 15000 });
-    const data = JSON.parse(stdout).data;
-    if (!data?.repository) return null;
-    return data.repository;
-  } catch {
-    return null; // fallback to individual gh CLI calls
-  }
+// ─── #810: batch progress sourced from the REST snapshot ──────────────────
+// #806's server cache already holds open PRs (with full reviews + bodies),
+// open/closed issues, and merged PRs. Batch progress is computed from that
+// snapshot in steady state — no GraphQL — falling back to a targeted by-number
+// fetch only when an active-batch issue sits outside the board window.
+
+// Per-ROLE approval count. re1/re2 share one GitHub login, so we attribute by
+// body-marker ROLE (attributeReviewsByRole, #807) and count roles whose LATEST
+// decision-affecting review is APPROVED — max 2 (re1, re2). NOT per-author.
+function countApprovedRoles(reviews) {
+  const roles = attributeReviewsByRole(reviews);
+  return ["re1", "re2"].filter((r) => roles[r] && roles[r].state === "APPROVED").length;
 }
 
-// Convert a GraphQL batch progress issue node into the same progress
-// row shape that progressForItemAsync produces.
-function graphqlIssueToProgressRow(issueData) {
-  if (!issueData) return null;
-
-  const linked = issueData.closedByPullRequestsReferences?.nodes || [];
-  const pr = linked.length > 0
-    ? linked.slice().sort((a, b) => (b.number || 0) - (a.number || 0))[0]
-    : null;
-
-  // No linked PR — delegate to the existing buildNoPrRow helper.
-  if (!pr) {
-    return buildNoPrRow({
-      number: issueData.number,
-      title: issueData.title,
-      state: issueData.state,
-      url: issueData.url,
-    });
-  }
-
-  const merged = pr.merged && issueData.state === "CLOSED";
-  if (merged) {
+// Compute issue `n`'s progress row from the snapshot (no network). Links
+// issue↔PR by the team's `[#<issue>]` PR-title convention. Returns a row when
+// the snapshot can PROVE the state: a matching in-window PR (in_review/approved/
+// ready/merged), or — #828 P1 / #834 — a queued OPEN issue when BOTH windows are
+// provably complete: openPrsWindowComplete (<50 open PRs → no open PR exists)
+// AND closedPrsWindowComplete (the closed-PR pagination reached an actual <100
+// end) with the issue absent from closedPrIssueNums (every [#N] across ALL
+// scanned closed pages, so a PR merged/closed even OUTSIDE the recent-5 window
+// is accounted for). Returns null otherwise (either window unproven, issue
+// absent, CLOSED-with-no-in-window-PR, merged-but-open, or a linked closed/
+// merged PR exists) — a partial window can't prove absence of a linked PR, so
+// the caller does the authoritative by-number REST fetch (progressForItemRest).
+function progressFromSnapshot(snapshot, n) {
+  if (!snapshot) return null;
+  const titleRe = new RegExp(`^\\s*\\[#${n}\\]`);
+  const openPr = (snapshot.prs || []).find((p) => titleRe.test(p.title || ""));
+  const mergedPr = (snapshot.mergedPrs || []).find((p) => titleRe.test(p.title || ""));
+  const openIssue = (snapshot.issues || []).find((i) => i.number === n);
+  const closedIssue = (snapshot.closedIssues || []).find((i) => i.number === n);
+  const title = (openIssue && openIssue.title) || (closedIssue && closedIssue.title) || `#${n}`;
+
+  // merged requires a matching merged PR in-window AND the issue CLOSED.
+  if (mergedPr && closedIssue) {
     return {
-      issue_number: issueData.number,
-      title: issueData.title,
-      url: pr.url || issueData.url,
-      pr_number: pr.number,
-      status: "merged",
-      progress: 100,
-      label: "Merged ✓",
+      issue_number: n, title: closedIssue.title, url: mergedPr.url || closedIssue.url,
+      pr_number: mergedPr.number, status: "merged", progress: 100, label: "Merged ✓",
     };
   }
+  // Matching open PR in-window → confident in_review/approved/ready.
+  if (openPr) {
+    const approvals = countApprovedRoles(openPr.reviews);
+    if (approvals >= 2) return { issue_number: n, title, url: openPr.url, pr_number: openPr.number, status: "ready", progress: 80, label: `PR #${openPr.number} · 2 approvals · ready` };
+    if (approvals === 1) return { issue_number: n, title, url: openPr.url, pr_number: openPr.number, status: "approved1", progress: 50, label: `PR #${openPr.number} · 1 approval` };
+    return { issue_number: n, title, url: openPr.url, pr_number: openPr.number, status: "in_review", progress: 20, label: `PR #${openPr.number} · waiting on review` };
+  }
+  // No matching open/in-window-merged PR. #828 P1 / #834: classify queued from
+  // the snapshot ONLY when absence of BOTH an open AND a closed/merged linked PR
+  // is proven — openPrsWindowComplete (no open PR) AND closedPrsWindowComplete
+  // (the closed-PR window genuinely ended) AND `n` not in closedPrIssueNums
+  // (no [#N] across ANY scanned closed page, incl. merges past the recent-5
+  // display window). Then an OPEN issue is genuinely queued — NO network. Any
+  // gap (either window unproven, or a linked closed/merged PR exists) → null,
+  // and the by-number REST fetch resolves it authoritatively.
+  if (
+    snapshot.openPrsWindowComplete &&
+    snapshot.closedPrsWindowComplete &&
+    openIssue &&
+    !openPr &&
+    !(snapshot.closedPrIssueNums || []).includes(n)
+  ) {
+    return buildNoPrRow({ number: n, title: openIssue.title, state: "OPEN", url: openIssue.url });
+  }
+  // Can't prove the issue has no linked PR (a window unproven / issue absent /
+  // linked closed PR) — return null; the by-number REST fetch resolves it.
+  return null;
+}
 
-  // Count distinct APPROVED reviews per author.
-  const reviews = (pr.reviews?.nodes || []).slice();
-  reviews.sort((a, b) => {
-    const ta = a?.submittedAt ? Date.parse(a.submittedAt) : 0;
-    const tb = b?.submittedAt ? Date.parse(b.submittedAt) : 0;
-    return ta - tb;
-  });
-  const latestByAuthor = new Map();
-  for (const r of reviews) {
-    const author = r?.author?.login || "";
-    if (!author) continue;
-    latestByAuthor.set(author, r.state);
-  }
-  let approvalCount = 0;
-  for (const state of latestByAuthor.values()) {
-    if (state === "APPROVED") approvalCount++;
-  }
-
-  if (approvalCount >= 2) {
-    return {
-      issue_number: issueData.number,
-      title: issueData.title,
-      url: pr.url || issueData.url,
-      pr_number: pr.number,
-      status: "ready",
-      progress: 80,
-      label: `PR #${pr.number} · 2 approvals · ready`,
-    };
-  }
-  if (approvalCount === 1) {
-    return {
-      issue_number: issueData.number,
-      title: issueData.title,
-      url: pr.url || issueData.url,
-      pr_number: pr.number,
-      status: "approved1",
-      progress: 50,
-      label: `PR #${pr.number} · 1 approval`,
-    };
-  }
-  return {
-    issue_number: issueData.number,
-    title: issueData.title,
-    url: pr.url || issueData.url,
-    pr_number: pr.number,
-    status: "in_review",
-    progress: 20,
-    label: `PR #${pr.number} · waiting on review`,
-  };
+// Confirmed-complete state machine, per project. `complete` must hold across
+// TWO consecutive SUCCESSFUL fetch cycles with DISTINCT generatedAt (the
+// snapshot ts, which only advances on a real #806 refresh) before we confirm.
+// A stale/served-expired cycle keeps the same ts, and an errored item flips
+// complete=false — so neither can confirm on its own. Consumers (server
+// auto-stop) gate stopTrigger/bridge-stop on the confirmed signal, never a
+// single transient `complete`.
+const _batchCompleteState = new Map(); // projectId -> { batchKey, ts, confirmed }
+// #828 P2: confirmation is BATCH-scoped, not just project-scoped. `batchKey`
+// identifies the batch (its number + issue set); when it changes, the streak
+// resets so a brand-new already-complete batch can never inherit the prior
+// batch's first cycle and confirm in a single tick (premature auto-stop). A new
+// batch must earn its own two distinct successful cycles.
+function evalBatchCompleteConfirmed(projectId, batchKey, complete, generatedAt) {
+  let st = _batchCompleteState.get(projectId);
+  if (!st || st.batchKey !== batchKey) {
+    st = { batchKey, ts: null, confirmed: false };
+    _batchCompleteState.set(projectId, st);
+  }
+  if (!complete) { st.ts = null; st.confirmed = false; return false; }
+  if (generatedAt == null) return st.confirmed;          // inconclusive cycle — no advance
+  if (st.ts == null) { st.ts = generatedAt; st.confirmed = false; return false; }
+  if (generatedAt !== st.ts) { st.ts = generatedAt; st.confirmed = true; return true; }
+  return st.confirmed;                                   // same snapshot re-served — no new cycle
 }
 
 // ─── /api/github/all — batched endpoint (#703) ────────────────────────────
@@ -1314,41 +1997,22 @@ router.get("/api/github/all", async (req, res) => {
     }
   }
 
-  // Fallback: fetch missing projects via individual gh CLI calls.
+  // #806: fallback for still-missing repos goes through the REST+ETag snapshot
+  // (refreshRepoRest), NOT `gh pr list`/`gh issue list`. Concurrency-limited so
+  // a cold multi-project load doesn't drain the core budget.
   if (fallbackNeeded.length > 0 && !isRateLimited()) {
-    const fallbackResults = await Promise.allSettled(
-      fallbackNeeded.map(async (p) => {
-        const repo = p.repo;
-        const [issues, prs, closedIssues, mergedPrs] = await Promise.allSettled([
-          _execFileAsync("gh", ["issue", "list", "-R", repo, "--json", "number,title,state,assignees,labels,createdAt,url", "--limit", "50"], { encoding: "utf-8", timeout: 15000 }).then(({ stdout }) => JSON.parse(stdout)),
-          _execFileAsync("gh", ["pr", "list", "-R", repo, "--json", "number,title,state,author,assignees,reviewDecision,reviews,statusCheckRollup,url,createdAt", "--limit", "50"], { encoding: "utf-8", timeout: 15000 }).then(({ stdout }) => JSON.parse(stdout)),
-          _execFileAsync("gh", ["issue", "list", "-R", repo, "--state", "closed", "--json", "number,title,state,url,closedAt", "--limit", String(RECENT_FETCH_LIMIT)], { encoding: "utf-8", timeout: 15000 }).then(({ stdout }) => {
-            const items = JSON.parse(stdout);
-            return Array.isArray(items)
-              ? items.sort((a, b) => (Date.parse(b?.closedAt || 0)) - (Date.parse(a?.closedAt || 0))).slice(0, RECENT_DISPLAY_LIMIT)
-              : items;
-          }),
-          _execFileAsync("gh", ["pr", "list", "-R", repo, "--state", "merged", "--json", "number,title,state,url,mergedAt,author", "--limit", String(RECENT_FETCH_LIMIT)], { encoding: "utf-8", timeout: 15000 }).then(({ stdout }) => {
-            const items = JSON.parse(stdout);
-            return Array.isArray(items)
-              ? items.sort((a, b) => (Date.parse(b?.mergedAt || 0)) - (Date.parse(a?.mergedAt || 0))).slice(0, RECENT_DISPLAY_LIMIT)
-              : items;
-          }),
-        ]);
-        return {
-          id: p.id,
-          issues: issues.status === "fulfilled" ? issues.value : [],
-          prs: prs.status === "fulfilled" ? prs.value : [],
-          closedIssues: closedIssues.status === "fulfilled" ? closedIssues.value : [],
-          mergedPrs: mergedPrs.status === "fulfilled" ? mergedPrs.value : [],
-          _fallback: true,
-        };
-      }),
-    );
-    for (const r of fallbackResults) {
-      if (r.status === "fulfilled") {
-        result[r.value.id] = r.value;
-      }
+    await _mapLimited(fallbackNeeded, GH_MAX_CONCURRENT, (p) => refreshRepoRest(p.repo));
+    for (const p of fallbackNeeded) {
+      const cached = _graphqlCache.get(p.repo);
+      result[p.id] = cached
+        ? {
+            issues: cached.issues,
+            prs: cached.prs,
+            closedIssues: cached.closedIssues,
+            mergedPrs: cached.mergedPrs,
+            _fallback: true,
+          }
+        : { issues: [], prs: [], closedIssues: [], mergedPrs: [], _fallback: true };
     }
   }
 
@@ -1356,90 +2020,71 @@ router.get("/api/github/all", async (req, res) => {
 });
 
 // ─── Per-project endpoints (backward compat, served from shared cache) ────
-
-router.get("/api/github/issues", (req, res) => {
-  const repo = getRepo(req.query.project || "");
+//
+// #806: all four lists are slices of the single REST+ETag snapshot built by
+// githubStateFetcher (closed/merged already sorted newest-first and capped to
+// RECENT_DISPLAY_LIMIT there). On a warm cache we serve instantly; cold misses
+// fetch the whole snapshot once via refreshRepoRest — no `gh pr list`/`gh issue
+// list` (those are GraphQL-backed). Idle projects never fetch.
+async function serveGithubList(req, res, kind) {
+  const project = req.query.project || "";
+  const repo = getRepo(project);
   if (!repo) return res.status(400).json({ error: "No repo configured for project" });
-  cachedGhEndpoint(
-    `issues:${repo}`,
-    ["issue", "list", "-R", repo, "--json", "number,title,state,assignees,labels,createdAt,url", "--limit", "50"],
-    res,
-    { idle: isProjectIdle(req.query.project || "") },
-  );
-});
+  const cacheKey = `${kind}:${repo}`;
+  const cached = _ghEndpointCache.get(cacheKey);
 
-router.get("/api/github/prs", (req, res) => {
-  const repo = getRepo(req.query.project || "");
-  if (!repo) return res.status(400).json({ error: "No repo configured for project" });
-  cachedGhEndpoint(
-    `prs:${repo}`,
-    ["pr", "list", "-R", repo, "--json", "number,title,state,author,assignees,reviewDecision,reviews,statusCheckRollup,url,createdAt", "--limit", "50"],
-    res,
-    { idle: isProjectIdle(req.query.project || "") },
-  );
-});
+  // #812: a parked (idle) project must never initiate a fetch.
+  if (isProjectIdle(project)) {
+    res.set("X-QuadWork-Idle", "1");
+    return res.json(cached ? cached.data : []);
+  }
 
-// #411 / quadwork#281: recently closed issues + merged PRs for the
-// "Recently closed" / "Recently merged" sub-sections under each
-// list in GitHubPanel. Limit 5 items each, ordered by closedAt
-// descending so the freshest activity sits at the top.
-// gh CLI's default ordering for `issue list --state closed` and
-// `pr list --state merged` is createdAt-desc, not closedAt/mergedAt-desc,
-// so a stale-but-recently-closed item can sit below a fresh-but-
-// older one. We pull a wider window and re-sort by close/merge time
-// before truncating to 5 to honor #281's "newest first" requirement.
-
-router.get("/api/github/closed-issues", (req, res) => {
-  const repo = getRepo(req.query.project || "");
-  if (!repo) return res.status(400).json({ error: "No repo configured for project" });
-  cachedGhEndpoint(
-    `closed-issues:${repo}`,
-    ["issue", "list", "-R", repo, "--state", "closed", "--json", "number,title,state,url,closedAt", "--limit", String(RECENT_FETCH_LIMIT)],
-    res,
-    {
-      idle: isProjectIdle(req.query.project || ""),
-      transform: (items) =>
-        Array.isArray(items)
-          ? items
-              .slice()
-              .sort((a, b) => {
-                const ta = a && a.closedAt ? Date.parse(a.closedAt) : 0;
-                const tb = b && b.closedAt ? Date.parse(b.closedAt) : 0;
-                return tb - ta;
-              })
-              .slice(0, RECENT_DISPLAY_LIMIT)
-          : items,
-    },
-  );
-});
+  // #824: these four endpoints serve a BARE ARRAY (cached.data is an array).
+  // Stale/rate-limited state must be signalled via a response header — mirroring
+  // the X-QuadWork-Idle pattern above — never by spreading the array into an
+  // object (which yields {"0":…,"_stale":true} and trips GitHubPanel's
+  // Array.isArray guard, blanking the board exactly when it should show
+  // last-known data).
+  //
+  // Freshness is measured against the BASE TTL, not adaptiveTTL: under critical
+  // rate-limit adaptiveTTL is Infinity, so an age<ttl check would treat an
+  // arbitrarily-old cache as fresh and skip the staleness signal entirely.
+  const baseFresh = cached && Date.now() - cached.ts < GH_ENDPOINT_CACHE_TTL;
+
+  // Critically REST-rate-limited → serve whatever we have (even expired) without
+  // revalidating. MUST precede the cache-hit branch below: adaptiveTTL is
+  // Infinity here, so that branch would otherwise return first and an expired
+  // array would go out with no X-QuadWork-Stale / X-QuadWork-Rate-Limited.
+  if (isRateLimited() && cached) {
+    res.set("X-QuadWork-Rate-Limited", "1");
+    if (!baseFresh || cached.stale) res.set("X-QuadWork-Stale", "1");
+    return res.json(cached.data);
+  }
+  // Fresh enough (within the adaptive window) → serve as-is.
+  if (cached && Date.now() - cached.ts < adaptiveTTL(GH_ENDPOINT_CACHE_TTL)) {
+    if (cached.stale) res.set("X-QuadWork-Stale", "1");
+    return res.json(cached.data);
+  }
+  // Stale-while-revalidate: serve stale now, refresh the snapshot in background.
+  if (cached) {
+    refreshRepoRest(repo);
+    res.set("X-QuadWork-Stale", "1");
+    return res.json(cached.data);
+  }
+  // Cold: assemble the snapshot synchronously, then serve this slice.
+  await refreshRepoRest(repo);
+  const fresh = _ghEndpointCache.get(cacheKey);
+  if (fresh) return res.json(fresh.data);
+  return res.status(502).json({ error: "gh call failed" });
+}
 
-router.get("/api/github/merged-prs", (req, res) => {
-  const repo = getRepo(req.query.project || "");
-  if (!repo) return res.status(400).json({ error: "No repo configured for project" });
-  // gh pr list with `--state merged` filters server-side so we
-  // don't have to pull every closed PR and discard the un-merged
-  // ones (closed-without-merge). Same fetch-wider-then-sort
-  // strategy as closed-issues so the newest merge always wins.
-  cachedGhEndpoint(
-    `merged-prs:${repo}`,
-    ["pr", "list", "-R", repo, "--state", "merged", "--json", "number,title,state,url,mergedAt,author", "--limit", String(RECENT_FETCH_LIMIT)],
-    res,
-    {
-      idle: isProjectIdle(req.query.project || ""),
-      transform: (items) =>
-        Array.isArray(items)
-          ? items
-              .slice()
-              .sort((a, b) => {
-                const ta = a && a.mergedAt ? Date.parse(a.mergedAt) : 0;
-                const tb = b && b.mergedAt ? Date.parse(b.mergedAt) : 0;
-                return tb - ta;
-              })
-              .slice(0, RECENT_DISPLAY_LIMIT)
-          : items,
-    },
-  );
-});
+router.get("/api/github/issues", (req, res) => serveGithubList(req, res, "issues"));
+router.get("/api/github/prs", (req, res) => serveGithubList(req, res, "prs"));
+// #411 / quadwork#281: "Recently closed" / "Recently merged" — newest-first,
+// capped to 5 in githubStateFetcher (REST default ordering isn't close/merge
+// time, so the snapshot re-sorts by closedAt/mergedAt before truncating).
+router.get("/api/github/closed-issues", (req, res) => serveGithubList(req, res, "closed-issues"));
+router.get("/api/github/merged-prs", (req, res) => serveGithubList(req, res, "merged-prs"));
 
 // #413 / quadwork#282: Current Batch Progress panel.
 //
@@ -1514,15 +2159,10 @@ async function checkBatchSnapshotFreshness(repo, snapshot) {
   }
   const first = snapshot.issueNumbers[0];
   try {
-    await ghJsonExecAsync([
-      "issue",
-      "view",
-      String(first),
-      "-R",
-      repo,
-      "--json",
-      "number",
-    ]);
+    // #828 P1: REST, not `gh issue view` (GraphQL). We only need existence, so
+    // the cheap REST issue endpoint suffices and keeps the whole batch-progress
+    // path off GraphQL.
+    await ghJsonExecAsync(["api", `repos/${repo}/issues/${first}`, "--jq", ".number"]);
     return "fresh";
   } catch (err) {
     // gh surfaces a 404 via stderr text on a non-zero exit. Only
@@ -1530,7 +2170,7 @@ async function checkBatchSnapshotFreshness(repo, snapshot) {
     // count as genuinely gone; anything else (network, auth,
     // timeout) is transient and must NOT delete the snapshot.
     const msg = String((err && (err.stderr || err.message)) || "").toLowerCase();
-    if (msg.includes("could not resolve") || msg.includes("not found") || msg.includes("no issue")) {
+    if (msg.includes("could not resolve") || msg.includes("not found") || msg.includes("http 404")) {
       return "gone";
     }
     return "unknown";
@@ -1634,22 +2274,22 @@ function parseActiveBatch(queueText) {
 // progress fetcher. Wraps node's execFile in a promise.
 //
 // THROWS on subprocess failure (non-zero exit, timeout, JSON parse,
-// network) so progressForItemAsync can decide which subset of
+// network) so progressForItemRest can decide which subset of
 // failures should bubble up to the Promise.allSettled "fetch failed"
 // row vs. which should fall through to a softer state. The previous
 // catch-all-and-return-null contract collapsed real subprocess
 // errors into the "not found" branch, making the new failure-row
 // fallback unreachable for genuine command failures (t2a review).
 async function ghJsonExecAsync(args) {
-  const { stdout } = await _execFileAsync("gh", args, { encoding: "utf-8", timeout: 10000 });
+  const { stdout } = await _execFileAsync("gh", args, { encoding: "utf-8", timeout: 10000, maxBuffer: GH_LIST_MAX_BUFFER });
   return JSON.parse(stdout);
 }
 
 // #350: pure helper for the "no linked PR" branch of
-// progressForItemAsync. Takes the issue JSON (shape: { number,
+// progressForItemRest. Takes the issue JSON (shape: { number,
 // title, state, url, ... }) and returns the batch-progress row
-// for an item that has no closedByPullRequestsReferences. Exported
-// from module.exports below for unit tests — no other callers.
+// for an item that has no linked PR. Exported from module.exports
+// below for unit tests — no other callers.
 function buildNoPrRow(issue) {
   if (issue && issue.state === "CLOSED") {
     return {
@@ -1671,61 +2311,79 @@ function buildNoPrRow(issue) {
   };
 }
 
-async function progressForItemAsync(repo, issueNumber) {
-  // Pull issue state + linked PRs in one call. closedByPullRequestsReferences
-  // is gh's serializer for the GraphQL `closedByPullRequestsReferences`
-  // edge — only present when a PR with `Fixes #N` / `Closes #N`
-  // (or the link UI) targets the issue.
-  // Issue fetch is the load-bearing call — if gh can't read the
-  // issue at all (404, network, auth, timeout) we can't compute a
-  // meaningful progress row. Let the rejection propagate to the
-  // route's Promise.allSettled so the operator sees a single
-  // "fetch failed" row instead of a misleading "queued" entry.
-  const issue = await ghJsonExecAsync([
-    "issue",
-    "view",
-    String(issueNumber),
-    "-R",
-    repo,
-    "--json",
-    "number,title,state,url,closedByPullRequestsReferences",
-  ]);
-  const linked = Array.isArray(issue.closedByPullRequestsReferences)
-    ? issue.closedByPullRequestsReferences
-    : [];
-  // Pick the freshest linked PR (highest number) if there are multiple.
-  const pr = linked.length > 0
-    ? linked.slice().sort((a, b) => (b.number || 0) - (a.number || 0))[0]
-    : null;
-  // No linked PR. #350: before falling into the "queued" bucket,
-  // honor the issue's own state — a CLOSED issue with no linked
-  // PR is fully done (superseded, not planned, runbook-only, etc.)
-  // and should render at 100% with a ✓ label instead of a
-  // misleading "0% · queued" row. Only truly OPEN issues with no
-  // linked PR are still queued.
-  if (!pr) {
+// #828 P1: find the PR linked to issue `n` by the team's `[#N]` PR-title
+// convention, via the REST Search API (1 search point) — NOT GraphQL. gh's
+// `-X GET -f q=…` URL-encodes the query, so we never hand-concatenate the repo
+// or number into the URL. Search tokenises loosely (and `is:pr in:title N`
+// would also surface `[#807]` for n=80), so we re-apply the strict `^\s*\[#N\]`
+// regex the snapshot matcher uses. Returns the freshest matching PR number (or
+// null), treating a search failure as "no linked PR found".
+// Pure: pick the freshest PR (highest number) whose title matches the STRICT
+// `^\s*\[#N\]` convention from a set of REST search items. Guards `[#807]` from
+// matching n=80 even though Search's loose `in:title 80` would surface it.
+// Returns the PR number or null. Exported for unit tests.
+function pickLinkedPrFromSearch(items, n) {
+  const titleRe = new RegExp(`^\\s*\\[#${n}\\]`);
+  const matches = (Array.isArray(items) ? items : []).filter((it) => titleRe.test((it && it.title) || ""));
+  if (matches.length === 0) return null;
+  return matches.slice().sort((a, b) => (b.number || 0) - (a.number || 0))[0].number;
+}
+
+// The actual REST Search call, split out so findLinkedPrByTitle's
+// success-vs-failure distinction is unit-testable via an injected executor.
+// `gh api -X GET -f q=…` URL-encodes the query (we never hand-concatenate repo
+// or number into the URL). THROWS (propagates) on any Search failure.
+async function _searchLinkedPrItems(repo, n) {
+  const res = await ghJsonExecAsync(["api", "-X", "GET", "search/issues", "-f", `q=repo:${repo} is:pr in:title ${n}`]);
+  return Array.isArray(res && res.items) ? res.items : [];
+}
+
+// Find the PR linked to issue `n` by the strict `[#N]` title convention via the
+// REST Search API (1 search point) — NOT GraphQL. Returns the freshest matching
+// PR number, or null ONLY when Search SUCCEEDED with zero strict matches
+// (authoritative "no linked PR"). #828/RE1: a Search FAILURE (rate-limit /
+// network / parse) is NOT proof of no PR — it must NOT collapse to null, or an
+// out-of-window OPEN issue with a real PR would render queued (and a CLOSED one
+// with a merged PR would render closed). So failure THROWS, and the caller
+// (progressForItemRest, awaiting without a catch) drops the item to the
+// non-authoritative "fetch failed" row, retried on the next cache miss.
+async function findLinkedPrByTitle(repo, n, search = _searchLinkedPrItems) {
+  const items = await search(repo, n);
+  return pickLinkedPrFromSearch(items, n);
+}
+
+// Authoritative by-number resolution for an active-batch issue the board
+// snapshot can't prove (outside / truncated window, or absent). #828 P1: REST +
+// Search ONLY — zero `gh issue view` / `gh pr view` (GraphQL). Bucket mapping
+// matches progressFromSnapshot exactly.
+async function progressForItemRest(repo, issueNumber) {
+  // Load-bearing call: the issue's own state via REST. If gh can't read it at
+  // all (404, network, auth, timeout) we can't compute a meaningful row — let
+  // the rejection propagate to the route's Promise.allSettled "fetch failed"
+  // row instead of emitting a misleading "queued" entry.
+  const raw = await ghJsonExecAsync(["api", `repos/${repo}/issues/${issueNumber}`]);
+  const issue = {
+    number: raw.number,
+    title: raw.title,
+    state: (raw.state || "").toUpperCase(),
+    url: raw.html_url,
+  };
+  // Throws (→ route's "fetch failed" row) if Search itself fails, so a
+  // could-not-determine is NEVER mistaken for proof of no linked PR. A null
+  // here means Search SUCCEEDED with zero strict [#N] matches — authoritative.
+  const prNumber = await findLinkedPrByTitle(repo, issueNumber);
+  // No linked PR (authoritative). #350: honor the issue's own state — a CLOSED
+  // issue with no linked PR is fully done (superseded/not-planned/runbook) →
+  // 100% ✓; only a truly OPEN issue with no PR is queued.
+  if (prNumber == null) {
     return buildNoPrRow(issue);
   }
-  // Re-fetch the PR to get reviewDecision + reviews + state, since
-  // the issue's closedByPullRequestsReferences edge only carries
-  // number/state/url. The PR fetch is intentionally soft: if gh
-  // glitches on this single call we still know the PR exists (we
-  // got the link from the issue) and can render a partial
-  // "in_review" row, which is more useful than dropping the whole
-  // item to "fetch failed". A persistent failure here will still
-  // surface on the next cache miss because the issue fetch above
-  // is the load-bearing one that controls the per-item rejection.
+  // REST-fetch the PR for state + reviews. Soft: a glitch on these single calls
+  // still lets us render a partial in_review row (we know the PR exists) rather
+  // than dropping the whole item to "fetch failed".
   let prData = null;
   try {
-    prData = await ghJsonExecAsync([
-      "pr",
-      "view",
-      String(pr.number),
-      "-R",
-      repo,
-      "--json",
-      "number,state,url,reviewDecision,reviews",
-    ]);
+    prData = await ghJsonExecAsync(["api", `repos/${repo}/pulls/${prNumber}`]);
   } catch {
     // soft fall-through to the in_review row below
   }
@@ -1733,78 +2391,44 @@ async function progressForItemAsync(repo, issueNumber) {
     return {
       issue_number: issue.number,
       title: issue.title,
-      url: pr.url || issue.url,
-      pr_number: pr.number,
+      url: issue.url,
+      pr_number: prNumber,
       status: "in_review",
       progress: 20,
-      label: `PR #${pr.number} · waiting on review`,
+      label: `PR #${prNumber} · waiting on review`,
     };
   }
-  const merged = prData.state === "MERGED" && issue.state === "CLOSED";
-  if (merged) {
+  let reviews = [];
+  try {
+    const rv = await ghJsonExecAsync(["api", `repos/${repo}/pulls/${prNumber}/reviews?per_page=100`]);
+    reviews = mapReviews(Array.isArray(rv) ? rv : []);
+  } catch {
+    // soft — reviews stay [], so the row degrades to in_review, never "failed"
+  }
+  const url = prData.html_url || issue.url;
+  // REST: a merged PR is state "closed" with `merged: true`. merged requires
+  // the issue CLOSED too (mirrors progressFromSnapshot and the prior path).
+  if (prData.merged === true && issue.state === "CLOSED") {
     return {
       issue_number: issue.number,
       title: issue.title,
-      url: prData.url || issue.url,
+      url,
       pr_number: prData.number,
       status: "merged",
       progress: 100,
       label: "Merged ✓",
     };
   }
-  // Count distinct APPROVED reviews per author so a stale APPROVED
-  // followed by REQUEST_CHANGES doesn't double-count. Sort by
-  // submittedAt ascending first so the Map's "last write wins"
-  // genuinely lands on the freshest review per author — gh's
-  // current ordering is chronological in practice but undocumented,
-  // so the explicit sort keeps us safe if that ever changes.
-  const reviews = Array.isArray(prData.reviews) ? prData.reviews.slice() : [];
-  reviews.sort((a, b) => {
-    const ta = (a && a.submittedAt) ? Date.parse(a.submittedAt) : 0;
-    const tb = (b && b.submittedAt) ? Date.parse(b.submittedAt) : 0;
-    return ta - tb;
-  });
-  const latestByAuthor = new Map();
-  for (const r of reviews) {
-    const author = (r && r.author && r.author.login) || "";
-    if (!author) continue;
-    latestByAuthor.set(author, r.state);
-  }
-  let approvalCount = 0;
-  for (const state of latestByAuthor.values()) {
-    if (state === "APPROVED") approvalCount++;
-  }
+  // #810: count APPROVED reviews per body-marker ROLE (re1/re2 share one login),
+  // latest decision-affecting review per role — no stale double-count.
+  const approvalCount = countApprovedRoles(reviews);
   if (approvalCount >= 2) {
-    return {
-      issue_number: issue.number,
-      title: issue.title,
-      url: prData.url || issue.url,
-      pr_number: prData.number,
-      status: "ready",
-      progress: 80,
-      label: `PR #${prData.number} · 2 approvals · ready`,
-    };
+    return { issue_number: issue.number, title: issue.title, url, pr_number: prData.number, status: "ready", progress: 80, label: `PR #${prData.number} · 2 approvals · ready` };
   }
   if (approvalCount === 1) {
-    return {
-      issue_number: issue.number,
-      title: issue.title,
-      url: prData.url || issue.url,
-      pr_number: prData.number,
-      status: "approved1",
-      progress: 50,
-      label: `PR #${prData.number} · 1 approval`,
-    };
+    return { issue_number: issue.number, title: issue.title, url, pr_number: prData.number, status: "approved1", progress: 50, label: `PR #${prData.number} · 1 approval` };
   }
-  return {
-    issue_number: issue.number,
-    title: issue.title,
-    url: prData.url || issue.url,
-    pr_number: prData.number,
-    status: "in_review",
-    progress: 20,
-    label: `PR #${prData.number} · waiting on review`,
-  };
+  return { issue_number: issue.number, title: issue.title, url, pr_number: prData.number, status: "in_review", progress: 20, label: `PR #${prData.number} · waiting on review` };
 }
 
 function summarizeItems(items) {
@@ -1832,45 +2456,104 @@ function summarizeItems(items) {
   return parts.join(" · ");
 }
 
-router.get("/api/batch-active", (req, res) => {
+// #839: derive the sidebar heartbeat-active flag from a batch-progress payload
+// so the pulse means "batch actively in progress", not just "Active Batch
+// section non-empty". Once `complete` is true (every item merged/closed —
+// see getOrComputeBatchProgress at items.every(...merged||closed)), the pulse
+// must stop even if Head leaves a parked/blocked ticket lingering in the
+// Active Batch section. Returns null when there's no progress payload (an
+// undefined input — current callers always pass a value), defensively
+// treated as "not active" at the route.
+function isBatchActiveFromProgress(progress) {
+  if (!progress) return null;
+  const items = Array.isArray(progress.items) ? progress.items : [];
+  return items.length > 0 && !progress.complete;
+}
+
+router.get("/api/batch-active", async (req, res) => {
   const projectId = req.query.project;
   if (!projectId) return res.status(400).json({ error: "Missing project" });
   if (!getRepo(projectId)) return res.status(400).json({ error: "No repo configured for project" });
-  const queuePath = path.join(CONFIG_DIR, projectId, "OVERNIGHT-QUEUE.md");
-  let active = false;
-  try {
-    const text = fs.readFileSync(queuePath, "utf-8");
-    const { issueNumbers } = parseActiveBatch(text);
-    active = issueNumbers.length > 0;
-  } catch {}
-  return res.json({ active });
+
+  // #839 (re1 follow-up on #844): share the same compute path that
+  // /api/batch-progress uses so the completion-aware answer is available on
+  // cache miss too, not only after the panel has been opened once. The
+  // sidebar's 30s poll on all projects stays cheap because (a) the shared
+  // BATCH_PROGRESS_TTL_MS cache absorbs most hits, (b) idle projects skip the
+  // compute entirely, and (c) progressFromSnapshot resolves items from the
+  // already-polled #806 GraphQL snapshot — REST fallback only fires for
+  // items outside the recent window.
+  const data = await getOrComputeBatchProgress(projectId);
+  const active = isBatchActiveFromProgress(data);
+  return res.json({ active: active === null ? false : active });
 });
 
-router.get("/api/batch-progress", async (req, res) => {
+// #807: parsed view of the server-authored GITHUB.md. Single source of truth is
+// the file, so this endpoint and file-reading agents see identical data. Same
+// project/config guard as batch-active (a traversal id isn't in config →
+// getRepo null → 400). Surfaces freshness + a distinct parse-error result.
+router.get("/api/github-parsed", (req, res) => {
   const projectId = req.query.project;
   if (!projectId) return res.status(400).json({ error: "Missing project" });
+  if (!getRepo(projectId)) return res.status(400).json({ error: "No repo configured for project" });
+  const ghPath = path.join(CONFIG_DIR, projectId, "GITHUB.md");
+  let text;
+  try {
+    text = fs.readFileSync(ghPath, "utf-8");
+  } catch {
+    return res.json({ ok: false, error: "GITHUB.md not found" });
+  }
+  const parsed = parseGithub(text);
+  if (!parsed.ok) return res.json(parsed);
+  // Live staleness: even when the file isn't regenerated (e.g. rate-limited →
+  // no new sync pass), age must stay visible. Compare against a FIXED window,
+  // never adaptiveTTL (which is Infinity under critical rate-limit and would
+  // hide unbounded staleness exactly when it matters).
+  // #827: a malformed `generatedAt` → Date.parse NaN. Normalize to null so the
+  // response field is a clean "unknown age" (not NaN), and _githubLiveStale
+  // also treats NaN/null as stale rather than hiding staleness on a suspect file.
+  const rawAge = parsed.generatedAt ? Date.now() - Date.parse(parsed.generatedAt) : null;
+  const ageMs = Number.isNaN(rawAge) ? null : rawAge;
+  return res.json({
+    ...parsed,
+    ageMs,
+    _stale: _githubLiveStale(parsed.stale, ageMs),
+  });
+});
 
+// #839 (re1 follow-up on #844): shared compute path for /api/batch-progress
+// and /api/batch-active. Returns the JSON body either route would send for a
+// successful response, or null to signal "no repo configured for project"
+// (caller's 400). Hits/populates _batchProgressCache so concurrent panel +
+// sidebar polls share the work via the BATCH_PROGRESS_TTL_MS cache.
+async function getOrComputeBatchProgress(projectId) {
   const cached = _batchProgressCache.get(projectId);
   // #812: parked (idle) project — never run batch-progress gh/GraphQL calls,
   // and ALWAYS flag the payload _idle (even on a fresh cache hit), so the
   // endpoint contract is consistent regardless of cache freshness. This must
   // precede the fresh-cache and rate-limit returns below.
   if (isProjectIdle(projectId)) {
-    if (cached) return res.json({ ...cached.data, _idle: true });
-    return res.json({ batch_number: null, items: [], summary: "", complete: false, _idle: true });
+    if (cached) return { ...cached.data, _idle: true };
+    return { batch_number: null, items: [], summary: "", complete: false, completeConfirmed: false, _idle: true };
   }
   const batchTTL = adaptiveTTL(BATCH_PROGRESS_TTL_MS);
   if (cached && Date.now() - cached.ts < batchTTL) {
-    return res.json(cached.data);
+    return cached.data;
   }
   // #554: if critically rate-limited, serve stale cache instead of
   // firing N gh calls per batch item.
   if (isRateLimited() && cached) {
-    return res.json({ ...cached.data, _stale: true, _rateLimited: true });
+    return { ...cached.data, _stale: true, _rateLimited: true };
+  }
+  // #802: GraphQL budget exhausted (separate from REST) — prefer serving the
+  // existing cache (even stale) over the GraphQL query below. With no cache we
+  // fall through to the REST gh-CLI fallback path (gated on its own bucket).
+  if (isGraphqlRateLimited() && cached) {
+    return { ...cached.data, _stale: true, _rateLimited: true };
   }
 
   const repo = getRepo(projectId);
-  if (!repo) return res.status(400).json({ error: "No repo configured for project" });
+  if (!repo) return null;
 
   const queuePath = path.join(CONFIG_DIR, projectId, "OVERNIGHT-QUEUE.md");
   let queueText = "";
@@ -1909,55 +2592,56 @@ router.get("/api/batch-progress", async (req, res) => {
   // snapshot-aware helper so merged items stay visible after Head
   // moves them from Active Batch to Done, until a new batch starts.
   const { batchNumber, issueNumbers } = resolveDisplayedBatch(queueText, projectId, { queueReadOk });
+  // #828 P2: batch identity = number + issue set. evalBatchCompleteConfirmed
+  // resets its streak when this changes, so a new already-complete batch can't
+  // inherit the prior batch's first cycle and confirm in one tick.
+  const batchKey = `${batchNumber}::${[...issueNumbers].sort((a, b) => a - b).join(",")}`;
   if (issueNumbers.length === 0) {
-    const data = { batch_number: batchNumber, items: [], summary: "", complete: false };
+    evalBatchCompleteConfirmed(projectId, batchKey, false, null); // reset any complete streak
+    const data = { batch_number: batchNumber, items: [], summary: "", complete: false, completeConfirmed: false };
     _batchProgressCache.set(projectId, { ts: Date.now(), data });
-    return res.json(data);
-  }
-
-  // #703: Try batched GraphQL first — one query for all batch items.
-  // Falls back to individual gh CLI calls (the #416 parallel approach)
-  // if GraphQL fails.
-  let items;
-  const graphqlData = await fetchBatchProgressGraphQL(repo, issueNumbers);
-  if (graphqlData) {
-    items = issueNumbers.map((n) => {
-      const issueNode = graphqlData[`issue${n}`];
-      const row = issueNode ? graphqlIssueToProgressRow(issueNode) : null;
-      return row || {
-        issue_number: n,
-        title: `#${n} (fetch failed)`,
-        url: null,
-        status: "unknown",
-        progress: 0,
-        label: "fetch failed",
-      };
-    });
-  } else {
-    // Fallback: #416 parallel individual gh CLI calls.
-    const settled = await Promise.allSettled(
-      issueNumbers.map((n) => progressForItemAsync(repo, n)),
-    );
-    items = settled.map((r, i) => {
-      if (r.status === "fulfilled") return r.value;
-      return {
-        issue_number: issueNumbers[i],
-        title: `#${issueNumbers[i]} (fetch failed)`,
-        url: null,
-        status: "unknown",
-        progress: 0,
-        label: "fetch failed",
-      };
-    });
+    return data;
   }
+
+  // #810: compute each item from the #806 REST snapshot (no GraphQL in steady
+  // state); #828 P1: fall back to a targeted by-number REST/Search fetch
+  // (progressForItemRest, no GraphQL) only for active-batch issues the snapshot
+  // can't prove (outside / truncated window, or absent).
+  const snapshot = _graphqlCache.get(repo) || null;
+  const settled = await Promise.allSettled(
+    issueNumbers.map(async (n) => progressFromSnapshot(snapshot, n) || progressForItemRest(repo, n)),
+  );
+  const items = settled.map((r, i) => {
+    if (r.status === "fulfilled") return r.value;
+    return {
+      issue_number: issueNumbers[i],
+      title: `#${issueNumbers[i]} (fetch failed)`,
+      url: null,
+      status: "unknown",
+      progress: 0,
+      label: "fetch failed",
+    };
+  });
   const summary = summarizeItems(items);
   // #350: treat CLOSED-without-PR items as complete alongside merged
   // so batches that mix runbook/superseded closes with real PRs
   // still flip to the COMPLETE state once everything is done.
   const complete = items.length > 0 && items.every((it) => it.status === "merged" || it.status === "closed");
-  const data = { batch_number: batchNumber, items, summary, complete };
+  // #810: confirm `complete` across two distinct successful snapshot cycles
+  // before any auto-stop consumer may act on it (never auto-stop on a single
+  // transient/stale complete). Keyed on the snapshot's ts as the cycle marker.
+  const completeConfirmed = evalBatchCompleteConfirmed(projectId, batchKey, complete, snapshot ? snapshot.ts : null);
+  const data = { batch_number: batchNumber, items, summary, complete, completeConfirmed };
   _batchProgressCache.set(projectId, { ts: Date.now(), data });
-  res.json(data);
+  return data;
+}
+
+router.get("/api/batch-progress", async (req, res) => {
+  const projectId = req.query.project;
+  if (!projectId) return res.status(400).json({ error: "Missing project" });
+  const data = await getOrComputeBatchProgress(projectId);
+  if (data === null) return res.status(400).json({ error: "No repo configured for project" });
+  return res.json(data);
 });
 
 // #445: Memory section (agent-memory butler integration) removed.
@@ -2227,6 +2911,7 @@ router.post("/api/setup", (req, res) => {
         // below no-ops when the file is already present, so this
         // can't clobber Head/user edits.
         writeOvernightQueueFileSafe(id, cfg.projects.find((p) => p.id === id)?.name || id, cfg.projects.find((p) => p.id === id)?.repo || "");
+        writeGithubFileSafe(id, cfg.projects.find((p) => p.id === id)?.name || id, cfg.projects.find((p) => p.id === id)?.repo || "");
         return res.json({ ok: true, message: "Project already in config" });
       }
       // Match CLI wizard agent structure: { cwd, command, auto_approve, mcp_inject }
@@ -2266,6 +2951,8 @@ router.post("/api/setup", (req, res) => {
       // Batch 25 / #204: seed the per-project OVERNIGHT-QUEUE.md at
       // ~/.quadwork/{id}/OVERNIGHT-QUEUE.md.
       writeOvernightQueueFileSafe(id, name || id, repo);
+      // #807: seed the per-project GITHUB.md alongside it.
+      writeGithubFileSafe(id, name || id, repo);
 
       return res.json({ ok: true });
     }
@@ -2274,6 +2961,399 @@ router.post("/api/setup", (req, res) => {
   }
 });
 
+// ─── Re-seed agents from current templates (#845) ──────────────────────────
+
+// Split an AGENTS.md into the leading "intro" text (above the first H2) plus
+// one block per `## H2` heading. Lines that begin with `## ` (exactly two
+// hashes + whitespace) start a new block; H1 / H3+ stay inside the current
+// block so subsections nested under an H2 are not orphaned.
+function _splitAgentsMdSections(text) {
+  const blocks = [];
+  let intro = [];
+  let current = null;
+  for (const line of String(text || "").split("\n")) {
+    const m = line.match(/^##\s+(.+?)\s*$/);
+    if (m) {
+      if (current) blocks.push(current);
+      current = { heading: m[1], body: "" };
+    } else if (current) {
+      current.body += (current.body ? "\n" : "") + line;
+    } else {
+      intro.push(line);
+    }
+  }
+  if (current) blocks.push(current);
+  return { intro: intro.join("\n"), blocks };
+}
+
+// Merge a fresh seed template with operator-added sections from the existing
+// worktree AGENTS.md. The fresh template wins for any H2 heading it defines
+// (so canonical role/workflow/communication sections always reflect current
+// rules), and any H2 block in the existing file whose heading is NOT in the
+// template is appended at the end under a marker comment. Heading comparison
+// is case-insensitive and whitespace-normalized.
+//
+// Returns { content, preservedHeadings }. If the existing content is empty
+// or has no custom sections, returns the fresh template verbatim.
+function reseedAgentsMd(existingContent, freshContent) {
+  if (!existingContent || !existingContent.trim()) {
+    return { content: freshContent, preservedHeadings: [] };
+  }
+  const norm = (s) => s.toLowerCase().replace(/\s+/g, " ").trim();
+  const fresh = _splitAgentsMdSections(freshContent);
+  const existing = _splitAgentsMdSections(existingContent);
+  const freshHeadings = new Set(fresh.blocks.map((b) => norm(b.heading)));
+  const preserved = existing.blocks.filter((b) => !freshHeadings.has(norm(b.heading)));
+  if (preserved.length === 0) {
+    return { content: freshContent, preservedHeadings: [] };
+  }
+  const trailer =
+    "\n\n<!-- Operator notes preserved from prior AGENTS.md (#845) -->\n\n" +
+    preserved
+      .map((b) => `## ${b.heading}\n${b.body}`.replace(/\s+$/, ""))
+      .join("\n\n");
+  const base = freshContent.replace(/\s+$/, "");
+  return {
+    content: base + trailer + "\n",
+    preservedHeadings: preserved.map((b) => b.heading),
+  };
+}
+
+// #854: Extract the reviewer token path from a worktree's existing AGENTS.md
+// so the re-seed substitution preserves a custom path instead of resetting
+// it to the default. The re1/re2 seed renders:
+//
+//     export GH_TOKEN=$(cat <path>)
+//
+// Common operator-edited variations are recognized:
+//   • optional `export ` prefix
+//   • optional outer `"$(cat …)"` double-quote wrapping
+//   • optional inner quoting of the path (single or double quotes)
+//   • whitespace tolerated between tokens
+//
+// Returns the raw extracted path (quotes stripped, whitespace trimmed) or
+// `null` when no GH_TOKEN line is present or the line doesn't use the
+// `$(cat …)` form. Pure — no I/O.
+function _extractReviewerTokenPath(existingContent) {
+  if (!existingContent || typeof existingContent !== "string") return null;
+  // First find a GH_TOKEN line. We anchor on the literal name so an operator
+  // comment about token paths can't accidentally seed a stale path.
+  const lineMatch = existingContent.match(/^[ \t]*(?:export[ \t]+)?GH_TOKEN[ \t]*=.*$/m);
+  if (!lineMatch) return null;
+  // Then pull the path out of `$(cat …)` on that line. Non-greedy capture
+  // stops at the first `)` after `cat`, which is the correct boundary for
+  // any well-formed command substitution.
+  const catMatch = lineMatch[0].match(/\$\(\s*cat\s+(.+?)\s*\)/);
+  if (!catMatch) return null;
+  let raw = catMatch[1].trim();
+  if (
+    (raw.startsWith('"') && raw.endsWith('"')) ||
+    (raw.startsWith("'") && raw.endsWith("'"))
+  ) {
+    raw = raw.slice(1, -1);
+  }
+  return raw || null;
+}
+
+// #855: Map legacy agent config keys to the canonical seed-template names.
+// Older projects (and operator-renamed agents) may use keys like
+// `reviewer1` / `reviewer2` / `t1..t3`; the seed templates only exist for
+// the canonical `head/re1/re2/dev` slugs. Any key not in this table is
+// assumed canonical (so future agent slugs work without a code change).
+const LEGACY_AGENT_KEY_TO_CANONICAL = Object.freeze({
+  t1: "head",
+  t2a: "re1",
+  t2b: "re2",
+  t3: "dev",
+  reviewer1: "re1",
+  reviewer2: "re2",
+});
+
+function _canonicalAgentSlug(agentKey) {
+  return LEGACY_AGENT_KEY_TO_CANONICAL[agentKey] || agentKey;
+}
+
+// #855: Resolve the per-agent re-seed targets for a project. Pulls the
+// worktree path from `project.agents[key].cwd` (the source of truth — the
+// agent process itself spawns there) rather than reconstructing
+// `${dirName}-${key}`, so legacy worktree names like `*-reviewer1` are
+// covered. When a project has no `agents` map at all (very old config),
+// falls back to the canonical sibling layout. Pure — no I/O.
+function _resolveReseedTargets(project) {
+  const workingDir = project?.working_dir;
+  if (!workingDir) return [];
+  const dirName = path.basename(workingDir);
+  const parentDir = path.dirname(workingDir);
+  const agentsCfg = project.agents && typeof project.agents === "object" ? project.agents : null;
+  const keys = agentsCfg ? Object.keys(agentsCfg) : ["head", "re1", "re2", "dev"];
+  return keys.map((agentKey) => {
+    const canonical = _canonicalAgentSlug(agentKey);
+    const configuredCwd = agentsCfg?.[agentKey]?.cwd;
+    const wtDir = configuredCwd || path.join(parentDir, `${dirName}-${canonical}`);
+    return { agentKey, canonical, wtDir };
+  });
+}
+
+// Operator-triggered re-seed of a project's worktree AGENTS.md files from
+// the current `templates/seeds/*.AGENTS.md` templates, using the same
+// placeholder substitution as the setup wizard's `seed-files` step. New
+// seed content (e.g. the #809 GITHUB.md discovery instructions) takes
+// effect on the NEXT agent restart — this endpoint only rewrites the file.
+//
+// Guard: refuses to run while the project's batch is active, so a re-seed
+// can't drop new instructions on agents in the middle of a task. Pass
+// `{ force: true }` to override (operator escape hatch — the file is only
+// re-read on next spawn, so even a forced re-seed is harmless to a live
+// session, but the guard makes the safe path obvious).
+router.post("/api/projects/:project/reseed-agents", async (req, res) => {
+  const projectId = req.params.project;
+  const body = req.body || {};
+  const force = body.force === true;
+  let cfg;
+  try { cfg = JSON.parse(fs.readFileSync(CONFIG_PATH, "utf-8")); }
+  catch { return res.status(500).json({ ok: false, error: "Failed to read config" }); }
+  const project = cfg.projects?.find((p) => p.id === projectId);
+  if (!project) return res.status(404).json({ ok: false, error: "Project not found" });
+  const workingDir = project.working_dir;
+  if (!workingDir) return res.status(400).json({ ok: false, error: "Project has no working_dir" });
+
+  if (!force) {
+    // re1 review on #845: fail CLOSED when batch state can't be computed.
+    // Falling through to a re-seed when the gate is uncertain re-introduces
+    // the exact mid-batch rewrite the gate exists to prevent. Three cases
+    // route to the same "unknown" 503 (operator can retry or pass force:true):
+    //  1. getOrComputeBatchProgress throws (network/IO)
+    //  2. getOrComputeBatchProgress returns null (no repo / no progress data)
+    //  3. isBatchActiveFromProgress returns null (no items payload)
+    let active;
+    try {
+      const progress = await getOrComputeBatchProgress(projectId);
+      active = isBatchActiveFromProgress(progress);
+    } catch {
+      return res.status(503).json({
+        ok: false,
+        error: "Could not verify batch state — aborting to avoid a mid-batch re-seed. Retry, or pass force:true to override.",
+        batchUnknown: true,
+      });
+    }
+    if (active === null) {
+      return res.status(503).json({
+        ok: false,
+        error: "Batch state unknown (no progress data) — aborting to avoid a mid-batch re-seed. Retry, or pass force:true to override.",
+        batchUnknown: true,
+      });
+    }
+    if (active) {
+      return res.status(409).json({
+        ok: false,
+        error: "Batch is active — re-seed deferred to avoid mid-batch instruction drift. Pass force:true to override; new seed content only takes effect on next agent restart.",
+        batchActive: true,
+      });
+    }
+  }
+
+  let result;
+  try {
+    result = _performReseedWrites(project, cfg, {
+      reviewerUser: body.reviewerUser,
+      reviewerTokenPath: body.reviewerTokenPath,
+    });
+  } catch (err) {
+    return res.status(500).json({ ok: false, error: err.message });
+  }
+  return res.json({
+    ok: true,
+    reseeded: result.reseeded,
+    skipped: result.skipped,
+    preserved: result.preserved,
+    note: "Re-seeded files take effect on next agent restart.",
+  });
+});
+
+// #856: Per-target write loop, extracted so the manual route handler and the
+// auto-reseed startup hook share one implementation. Throws on missing seed
+// template (the route handler maps that to a 500). Returns the same shape
+// the endpoint returns so the auto-reseed log can include per-project stats.
+//
+// `opts.reviewerUser` and `opts.reviewerTokenPath` are operator overrides:
+// when set they win over the per-agent extraction / cfg fallback. Auto-reseed
+// passes neither so each project uses the same priority chain manual re-seed
+// uses (per-agent extraction → cfg → default).
+function _performReseedWrites(project, cfg, opts = {}) {
+  const workingDir = project.working_dir;
+  const dirName = path.basename(workingDir);
+  const reviewerUser = opts.reviewerUser ?? cfg.reviewer_github_user ?? "";
+  const defaultReviewerTokenPath = path.join(os.homedir(), ".quadwork", "reviewer-token");
+
+  // #855: walk the project's configured agents (resolved by `cwd`) instead of
+  // reconstructing sibling paths. Legacy keys (`reviewer1` etc.) still pull
+  // the canonical seed template via `_canonicalAgentSlug`.
+  const targets = _resolveReseedTargets(project);
+  const reseeded = [];
+  const preserved = {};
+  const skipped = [];
+  for (const { agentKey, canonical, wtDir } of targets) {
+    if (!fs.existsSync(wtDir)) { skipped.push(`${agentKey} (no worktree)`); continue; }
+    const seedSrc = path.join(TEMPLATES_DIR, "seeds", `${canonical}.AGENTS.md`);
+    if (!fs.existsSync(seedSrc)) {
+      throw new Error(`Missing seed template: templates/seeds/${canonical}.AGENTS.md`);
+    }
+
+    // #854: Read the existing AGENTS.md FIRST so the per-agent token path
+    // resolution can see what the operator currently has. Resolution order:
+    //   1. explicit opts override (`opts.reviewerTokenPath`)
+    //   2. extracted from this worktree's existing AGENTS.md
+    //   3. project/global config (`cfg.reviewer_token_path`)
+    //   4. default `~/.quadwork/reviewer-token`
+    // Head/dev seeds have no GH_TOKEN line, so (2) is `null` for them and
+    // they fall through to the default — the substituted placeholder is
+    // unused in those templates anyway.
+    const agentsMd = path.join(wtDir, "AGENTS.md");
+    let existing = "";
+    if (fs.existsSync(agentsMd)) {
+      try { existing = fs.readFileSync(agentsMd, "utf-8"); } catch { existing = ""; }
+    }
+    const tokenPath =
+      opts.reviewerTokenPath
+      || _extractReviewerTokenPath(existing)
+      || cfg.reviewer_token_path
+      || defaultReviewerTokenPath;
+
+    let freshContent = fs.readFileSync(seedSrc, "utf-8");
+    freshContent = freshContent
+      .replace(/\{\{reviewer_github_user\}\}/g, reviewerUser)
+      .replace(/\{\{reviewer_token_path\}\}/g, tokenPath)
+      .replace(/\{\{project_name\}\}/g, dirName);
+
+    const merged = reseedAgentsMd(existing, freshContent);
+    fs.writeFileSync(agentsMd, merged.content);
+    reseeded.push(`${agentKey}/AGENTS.md`);
+    if (merged.preservedHeadings.length > 0) {
+      preserved[agentKey] = merged.preservedHeadings;
+    }
+  }
+  return { reseeded, skipped, preserved };
+}
+
+// ─── #856: Auto-reseed on version upgrade ────────────────────────────────
+//
+// On every server startup we compare the current package version against a
+// per-project completion record in `~/.quadwork/reseed-state.json`. Any
+// project that hasn't been re-seeded for the current version gets re-seeded
+// from the current templates so existing users pick up new seed instructions
+// (e.g. GITHUB.md discovery) without ever clicking the manual button.
+//
+// The per-project state is load-bearing: a project deferred mid-batch stays
+// pending in the state file so the very next startup (or any future safe-
+// boundary hook) retries it. Using a single global "last run version"
+// marker would strand any deferred project — once the marker advanced past
+// the upgrade version, the deferred project would never be re-seeded.
+
+const RESEED_STATE_PATH = path.join(os.homedir(), ".quadwork", "reseed-state.json");
+const PACKAGE_JSON_PATH = path.join(__dirname, "..", "package.json");
+
+function _readPackageVersion(pkgPath = PACKAGE_JSON_PATH) {
+  try {
+    const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+    return typeof pkg.version === "string" && pkg.version ? pkg.version : "0.0.0";
+  } catch { return "0.0.0"; }
+}
+
+function _loadReseedState(statePath = RESEED_STATE_PATH) {
+  try {
+    const parsed = JSON.parse(fs.readFileSync(statePath, "utf-8"));
+    const map = parsed && typeof parsed === "object" && parsed !== null && parsed.completedByProjectVersion;
+    const completed = map && typeof map === "object" && !Array.isArray(map) ? { ...map } : {};
+    // Drop non-string version values so a corrupt write can't poison the
+    // up-to-date check (which is a string equality).
+    for (const k of Object.keys(completed)) {
+      if (typeof completed[k] !== "string") delete completed[k];
+    }
+    return { completedByProjectVersion: completed };
+  } catch { return { completedByProjectVersion: {} }; }
+}
+
+function _saveReseedState(state, statePath = RESEED_STATE_PATH) {
+  try {
+    const dir = path.dirname(statePath);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+  } catch {}
+  // Single fs.writeFileSync — write-replace is atomic enough for this
+  // boot-time-only writer (no concurrent writer exists).
+  fs.writeFileSync(statePath, JSON.stringify(state, null, 2) + "\n");
+}
+
+async function autoReseedOnStartup(cfg, opts = {}) {
+  const version = opts.version || _readPackageVersion();
+  const statePath = opts.statePath || RESEED_STATE_PATH;
+  const log = opts.log || ((m) => console.log(m));
+  // Dependency-injected for tests so we don't have to spin up gh.
+  const getProgress = opts.getProgress || getOrComputeBatchProgress;
+  const isActiveFromProgress = opts.isActiveFromProgress || isBatchActiveFromProgress;
+  const performWrites = opts.performWrites || _performReseedWrites;
+
+  const state = _loadReseedState(statePath);
+  const decisions = [];
+  const projects = (cfg?.projects || []).filter((p) => p && p.id && p.working_dir);
+
+  for (const project of projects) {
+    if (state.completedByProjectVersion[project.id] === version) {
+      decisions.push({ projectId: project.id, action: "skip", reason: "already current" });
+      continue;
+    }
+
+    // Fail-closed batch gate, same contract as the manual /reseed-agents
+    // route (#853): a throw OR a null result both mean "we cannot prove the
+    // batch is idle, so we MUST defer rather than risk mid-batch instruction
+    // drift". The deferred state stays pending so the next startup retries.
+    let active;
+    try {
+      const progress = await getProgress(project.id);
+      active = isActiveFromProgress(progress);
+    } catch (err) {
+      decisions.push({ projectId: project.id, action: "deferred", reason: `batch-state check threw: ${err.message}` });
+      log(`[reseed] ${project.id}: deferred — batch state unknown (${err.message}); will retry on next startup`);
+      continue;
+    }
+    if (active === null) {
+      decisions.push({ projectId: project.id, action: "deferred", reason: "batch state unknown" });
+      log(`[reseed] ${project.id}: deferred — batch state unknown; will retry on next startup`);
+      continue;
+    }
+    if (active === true) {
+      decisions.push({ projectId: project.id, action: "deferred", reason: "batch active" });
+      log(`[reseed] ${project.id}: deferred — batch active; will retry on next startup`);
+      continue;
+    }
+
+    let result;
+    try {
+      result = performWrites(project, cfg, {});
+    } catch (err) {
+      decisions.push({ projectId: project.id, action: "error", error: err.message });
+      log(`[reseed] ${project.id}: ERROR — ${err.message}; state NOT advanced, will retry on next startup`);
+      continue;
+    }
+
+    state.completedByProjectVersion[project.id] = version;
+    try {
+      _saveReseedState(state, statePath);
+    } catch (err) {
+      // If we can't persist, the project will re-seed again next boot.
+      // Idempotent (file rewrite + #845 merger) so this is annoying-but-safe.
+      log(`[reseed] ${project.id}: WARN — could not persist reseed-state (${err.message}); will re-seed next startup`);
+    }
+    decisions.push({
+      projectId: project.id, action: "reseeded",
+      reseeded: result.reseeded, skipped: result.skipped, preserved: result.preserved,
+    });
+    log(`[reseed] ${project.id}: reseeded for v${version} — wrote ${result.reseeded.length} file(s)` +
+        (result.skipped.length ? `, skipped ${result.skipped.length}` : ""));
+  }
+
+  return { version, decisions };
+}
+
 // ─── Rename ────────────────────────────────────────────────────────────────
 
 function replaceInFile(filePath, oldStr, newStr) {
@@ -2805,9 +3885,91 @@ module.exports.parseActiveBatch = parseActiveBatch;
 // summarizeItems for the batch-progress fixture test.
 module.exports.buildNoPrRow = buildNoPrRow;
 module.exports.summarizeItems = summarizeItems;
+// #810: expose batch-progress-from-snapshot helpers for unit tests.
+module.exports.progressFromSnapshot = progressFromSnapshot;
+module.exports.countApprovedRoles = countApprovedRoles;
+module.exports.evalBatchCompleteConfirmed = evalBatchCompleteConfirmed;
 // #693: expose normalizeMentions for unit tests
 module.exports.normalizeMentions = normalizeMentions;
 // #714: expose for file-chat integration
 module.exports.getProjectChatMode = getProjectChatMode;
 // #730: PTY dispatch callback setter
 module.exports.setPtyDispatchCallback = setPtyDispatchCallback;
+// #802: expose the GraphQL rate-limit bucket + predicates for unit tests.
+// No production callers outside this file.
+module.exports._graphqlRateLimit = _graphqlRateLimit;
+module.exports.isGraphqlRateLimited = isGraphqlRateLimited;
+module.exports.isGraphqlRateLow = isGraphqlRateLow;
+// #806: expose the canonical-shape transforms for unit tests + the fetcher
+// entry point (#807's file writer consumes the assembled snapshot).
+module.exports.githubStateFetcher = githubStateFetcher;
+module.exports._coalesce = _coalesce;
+// #837: expose ghApiConditional + the shared list-fetch maxBuffer constant for
+// the >1MB closed-PR page regression test.
+module.exports.ghApiConditional = ghApiConditional;
+module.exports.GH_LIST_MAX_BUFFER = GH_LIST_MAX_BUFFER;
+// #839: expose the completion-aware sidebar-heartbeat helper for unit tests.
+module.exports.isBatchActiveFromProgress = isBatchActiveFromProgress;
+// #845: expose the AGENTS.md re-seed merger so the placeholder substitution +
+// custom-section preservation contract is exercisable without spinning up a
+// real worktree. Pure function; no production callers outside this file.
+module.exports.reseedAgentsMd = reseedAgentsMd;
+// #855: expose the per-agent target resolver + legacy-key map so the legacy
+// config (`reviewer1` / `reviewer2` / `t1..t3`) → canonical-template mapping
+// is exercisable without spinning up a real worktree. Pure helpers; no
+// production callers outside this file.
+module.exports._resolveReseedTargets = _resolveReseedTargets;
+module.exports._canonicalAgentSlug = _canonicalAgentSlug;
+// #854: expose the GH_TOKEN path extractor so the parse forms (`export`,
+// double-quoted, inner-quoted, etc.) are exercisable without a temp fs.
+module.exports._extractReviewerTokenPath = _extractReviewerTokenPath;
+// #856: expose the auto-reseed startup hook + supporting state/version
+// helpers. server/index.js calls `autoReseedOnStartup` after config is
+// loaded; the helpers are exposed for unit tests + the integration test
+// (state corruption, version round-trip, per-project decision matrix).
+module.exports.autoReseedOnStartup = autoReseedOnStartup;
+module.exports._loadReseedState = _loadReseedState;
+module.exports._saveReseedState = _saveReseedState;
+module.exports._readPackageVersion = _readPackageVersion;
+module.exports._performReseedWrites = _performReseedWrites;
+module.exports.RESEED_STATE_PATH = RESEED_STATE_PATH;
+// #839 (re1 follow-up): expose the shared compute path plus the caches it
+// reads so the cache-miss completed-batch case is exercisable end-to-end.
+module.exports.getOrComputeBatchProgress = getOrComputeBatchProgress;
+module.exports._batchProgressCache = _batchProgressCache;
+module.exports._graphqlCache = _graphqlCache;
+module.exports.restIssueToCanonical = restIssueToCanonical;
+module.exports.restClosedIssueToCanonical = restClosedIssueToCanonical;
+module.exports.restMergedPrToCanonical = restMergedPrToCanonical;
+module.exports.restPullBaseToCanonical = restPullBaseToCanonical;
+module.exports.mapReviews = mapReviews;
+module.exports.deriveReviewDecision = deriveReviewDecision;
+module.exports.buildStatusCheckRollup = buildStatusCheckRollup;
+// #807: expose the GITHUB.md parser/renderer + role attribution for unit tests.
+// No production callers outside this file.
+module.exports.parseGithub = parseGithub;
+module.exports.renderGithubMarkdown = renderGithubMarkdown;
+module.exports.attributeReviewsByRole = attributeReviewsByRole;
+module.exports._githubLiveStale = _githubLiveStale;
+module.exports._extractNotesBody = _extractNotesBody;
+module.exports.GITHUB_FRESH_TTL_MS = GITHUB_FRESH_TTL_MS;
+// #824: expose the bare-array list handler + its cache and the REST rate-limit
+// bucket so the regression test can drive the stale/rate-limited paths and
+// assert the body stays a JSON array (never an object). No production callers
+// outside this file.
+module.exports.serveGithubList = serveGithubList;
+module.exports._ghEndpointCache = _ghEndpointCache;
+module.exports._rateLimit = _rateLimit;
+// #828: expose the merged-PR pagination helpers + the REST-search linked-PR
+// picker for unit tests. No production callers outside this file.
+module.exports.gatherClosedPrPages = gatherClosedPrPages;
+module.exports.selectRecentMergedPrs = selectRecentMergedPrs;
+// #834: closed-PR window completeness + linked-issue extraction, for the
+// queued-from-snapshot fix. No production callers outside this file.
+module.exports.closedPagesComplete = closedPagesComplete;
+module.exports.closedPrIssueNumsFromPages = closedPrIssueNumsFromPages;
+module.exports.pickLinkedPrFromSearch = pickLinkedPrFromSearch;
+module.exports.findLinkedPrByTitle = findLinkedPrByTitle;
+// #827: expose the GITHUB.md writer for the idle-no-op regression test. No
+// production callers outside this file.
+module.exports.writeGithubFileFromSnapshot = writeGithubFileFromSnapshot;