fix: freeze approved feature heads during integration

[krasnoperov-coding-agent]

Summary

• freeze approved feature heads when main movement produces a dirty PR
• route approved retries and steward incidents exclusively through candidate integration repair
• make Queue Health Monitor the sole candidate reader and repair dispatcher
• consume repair budgets only after a Codex turn actually starts

Invariants

• an approved feature head is never rewritten to resolve integration drift
• a missing candidate waits for Merge Steward instead of falling back to feature-branch repair
• pre-turn infrastructure failures do not consume an agent repair attempt

[review-quill]

Verdict: 🛑 Request changes — The new attempt-accounting boundary can both strand pre-turn CI failures and miss completed repair attempts.

[review-quill]

🚨 Attempt accounting is not atomic with turn start. claimRun still records lastAttemptedFailure* before pre-turn setup, so a failed CI launch suppresses same-head retry despite consuming no budget; an early completion can also release the lease before this post-await increment, letting retries evade the budget. Record both counter and provenance at a turn-start boundary ordered before completion handling.

Superseded by newer head 91a829a; review-quill will re-review the latest commit separately.

[review-quill]

Verdict: 🛑 Request changes — The follow-up resolves early-completion accounting, but pre-turn crash recovery and conflict-safe counter updates remain incorrect.

[review-quill]

🚨 Claim-time accounting still misses a pre-turn crash window. If PatchRelay exits after persisting the thread but before startTurn, restart reads a valid thread with zero turns; reconciliation never settles it, leaving activeRunId and the consumed budget pinned indefinitely.

[review-quill]

🚨 The counter is derived from fresh, but the claim commit reuses that same update on version conflict. A concurrent head/reset write can therefore be overwritten with a stale counter value instead of recomputing current + 1, prematurely exhausting the repair budget.

Superseded by newer head 4c17901; review-quill will re-review the latest commit separately.

[review-quill]

Verdict: ✅ Approve — The follow-up now recomputes claim-time counters on conflicts and settles/refunds persisted pre-turn threads with no turns. No remaining actionable current-head issues found.