omp-conductor 0.10.0 → 0.12.0

package/src/failure-class.ts

@@ -144,6 +144,16 @@ export function providerCreditRefusal(error: {
   return error.message.split("\n")[0]?.trim() ?? error.message;
 }
 
+/** Provider text that names a per-request stream fault. Deliberately narrow:
+ *  a 429 is rate limiting and a 402 is credit — different remedies (#220). */
+const TRANSIENT_FAULT_SIGNATURES = ["stream stalled"] as const;
+
+export function providerTransientFault(error: { status?: number; message: string }): string | undefined {
+  const text = error.message.toLowerCase();
+  if (!TRANSIENT_FAULT_SIGNATURES.some((s) => text.includes(s))) return undefined;
+  return error.message.split("\n")[0]?.trim() ?? error.message;
+}
+
 /**
  * Evidence that this run never started, or `undefined` when something did happen.
  *
@@ -248,6 +258,21 @@ export function classifyRun(run: RunRecord, facts: ClassifyFacts): Classificatio
     }
   }
 
+  // A per-request stream fault: the provider aborted mid-stream — the session
+  // records "OpenAI responses stream stalled while waiting for the next event",
+  // but the attempt never produced a verdict and 0 tokens were billed. Not the
+  // work's fault, so it must not charge an implementation attempt; requeued, but
+  // bounded by PROVIDER_TRANSIENT_MAX_STRIKES so a provider that keeps aborting
+  // escalates to a human instead of looping (#220). Ahead of `neverStarted` for
+  // the same reason as the credit branch: a turn-0 stall would otherwise be
+  // absorbed by `env-start-failure` and lose its cause.
+  if (run.state === "failed" || run.state === "killed") {
+    const transient = run.lastError === undefined ? undefined : providerTransientFault({ message: run.lastError });
+    if (transient !== undefined) {
+      return { cls: "provider-transient", recovery: "requeue", evidence: transient };
+    }
+  }
+
   // A run that never started is the most classifiable failure there is, and the
   // least deserving of an implementation attempt: the session did not get as far
   // as reading the issue. See {@link neverStarted} for the two shapes and why the

package/src/fleet.ts

@@ -1381,7 +1381,7 @@ export async function probeTelegramHealth(
       detail: `${username}; inbound configured; interactive profile relays assistant text — /telegram set profile daemon`,
     };
   }
-  return { kind: "ok", detail: `${username}; inbound configured; telegram_ask available` };
+  return { kind: "ok", detail: `${username}; inbound configured; telegram_ask expected per config (mounted per turn by omp-telegram — a tick that finds it missing falls back to telegram_send and says so)` };
 }
 
 export function sessionDirForCwd(cwd: string): string {

package/src/gitops.ts

@@ -19,7 +19,9 @@
 
 import { join } from "node:path";
 
+import { parseChainSource, type ChainEntry } from "./chain-check.ts";
 import type { ProjectConfig, RepoTarget } from "./types.ts";
+import { ensureMirror } from "./worktree.ts";
 
 /**
  * One process run, captured. Injected everywhere in this module so the
@@ -190,3 +192,50 @@ export async function openRunPr(
   }
   return { ok: true, url };
 }
+
+// ------------------------------------------------- the migration-chain guard
+
+/**
+ * The base branch's ordered migration chain, read at the tip — not from a
+ * checkout that might be stale, but from the live mirror `ensureMirror`
+ * refreshes every call, which is the same freshness contract the dispatch path
+ * relies on. Alembic fields only; files without a `revision` line are skipped.
+ */
+export async function readBaseChain(
+  project: Pick<ProjectConfig, "mirrorRoot">,
+  repo: RepoTarget,
+  dir: string,
+  exec: Exec = spawnCaptured,
+): Promise<{ ok: true; entries: ChainEntry[] } | { ok: false; stderr: string }> {
+  try {
+    const mirror = await ensureMirror(repo, project.mirrorRoot);
+    const env = credentialedEnv();
+    const listed = await exec(
+      ["git", "--git-dir", mirror, "ls-tree", "-r", "--name-only", repo.defaultBranch, "--", dir],
+      { env },
+    );
+    if (listed.code !== 0) {
+      return {
+        ok: false,
+        stderr: scrubUserinfo(listed.stderr.trim() || listed.stdout.trim() || `git ls-tree exited ${String(listed.code)}`),
+      };
+    }
+    const entries: ChainEntry[] = [];
+    for (const rel of listed.stdout.split("\n")) {
+      const path = rel.trim();
+      if (path === "" || !path.endsWith(".py")) continue;
+      const shown = await exec(["git", "--git-dir", mirror, "show", `${repo.defaultBranch}:${path}`], { env });
+      if (shown.code !== 0) {
+        return {
+          ok: false,
+          stderr: scrubUserinfo(shown.stderr.trim() || `git show ${path} exited ${String(shown.code)}`),
+        };
+      }
+      const parsed = parseChainSource(path, shown.stdout);
+      if (parsed !== undefined) entries.push(parsed);
+    }
+    return { ok: true, entries };
+  } catch (err) {
+    return { ok: false, stderr: err instanceof Error ? err.message : String(err) };
+  }
+}

package/src/omp.ts

@@ -46,6 +46,12 @@ export interface AgentSessionLike {
    */
   on(event: string, cb: (e: unknown) => void): void;
   abort(): void;
+  /**
+   * Cooperative operator park: abort the active turn and resolve when the
+   * harness is idle (#238). Distinct from `abort()`, which is the
+   * fire-and-forget kill path and must stay cheap for cap kills.
+   */
+  park(): Promise<void>;
   /**
    * Absolute transcript path the harness opened, so a human — and the
    * arm/monitor tooling — can read what the worker actually did. `undefined`
@@ -93,7 +99,11 @@ interface OmpModule {
 interface RawSession {
   prompt(text: string, opts?: unknown): Promise<unknown>;
   subscribe(listener: (event: unknown) => void): unknown;
-  abort(opts?: unknown): void;
+  abort(opts?: {
+    goalReason?: "interrupted" | "internal";
+    reason?: string;
+    preserveCompaction?: boolean;
+  }): Promise<void> | void;
   dispose?(opts?: unknown): Promise<unknown>;
   readonly sessionFile?: string;
 }
@@ -262,6 +272,11 @@ export async function createLocalSession(opts: {
     abort() {
       raw.abort();
     },
+    park() {
+      return Promise.resolve(
+        raw.abort({ goalReason: "interrupted", reason: "operator pause" }),
+      ).then(() => undefined);
+    },
     // The path the session actually opened, never one we asked for: the
     // arm/monitor tooling reads this file as proof of activity, so a path
     // nothing ever writes to is worse than no path at all.
@@ -421,10 +436,10 @@ export interface CreateSessionOptions {
  * Start one omp coding session in a **child process** and return a proxy for it.
  *
  * The proxy is the whole of `omp-conductor`'s view of a session, and it is
- * deliberately thin: {@link AgentSessionLike} has five members, so there are
- * five things to forward and nothing else belongs here. `prompt` and `abort`
- * go out over a unix socket, harness events come back and are re-emitted to the
- * same `on()` subscribers the in-process version served, and `sessionFile` is
+ * deliberately thin: {@link AgentSessionLike} is the entire forwarded
+ * surface. `prompt`, `park`, and `abort` go out over a unix socket, harness
+ * events come back and are re-emitted to the same `on()` subscribers the
+ * in-process version served, and `sessionFile` is
  * whatever path the child reports the session actually opened — never one this
  * side invented.
  *
@@ -657,6 +672,14 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
           else waiter.reject(new Error(message.error ?? "session prompt failed"));
           break;
         }
+        case "park-result": {
+          const waiter = pending.get(message.id);
+          if (waiter === undefined) break;
+          pending.delete(message.id);
+          if (message.ok) waiter.resolve();
+          else waiter.reject(new Error(message.error ?? "session park failed"));
+          break;
+        }
         case "release-blocked":
           opts.onReleaseBlocked?.(message.shape);
           break;
@@ -693,6 +716,14 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
       // would make this seam depend on a shape it deliberately does not name.
       return promise.then(() => undefined);
     },
+    park() {
+      promptSeq += 1;
+      const id = promptSeq;
+      const { promise, resolve, reject } = Promise.withResolvers<void>();
+      pending.set(id, { resolve, reject });
+      write({ t: "park", id });
+      return promise.then(() => undefined);
+    },
     on(event, cb) {
       const list = handlers.get(event);
       if (list) list.push(cb);

package/src/orchestrator-tick.ts

@@ -68,17 +68,20 @@ import {
   type ReleaseDecision,
 } from "./release-policy.ts";
 import {
+  DEFAULT_REPORT_POLICY,
   DEFAULT_REPORT_SCOPE,
   DENIED_RELEASE_GRANTS,
   type DispatchSummary,
   type FrictionSignal,
   type ReportScope,
+  type ReportingPolicy,
   type ResolvedGrants,
   type Store,
 } from "./types.ts";
 import { formatDecisionDigest } from "./decisions.ts";
 import type { RunRecord } from "./types.ts";
 import { dbPath, openStore } from "./store.ts";
+import { digestDue } from "./digest-schedule.ts";
 
 /** The activation file. Absent means "this is not an orchestrator session". */
 export const TICK_CONFIG_FILE = ".conductor-tick.json";
@@ -386,7 +389,17 @@ export function queueDigestLine(
     return `Queue: empty — nothing carries "${queueLabel}". Groom the backlog (Duty 2): promote or file the next issues, or say in this tick's report why there is nothing to do.`;
   }
   if (summary.routed === 0) {
-    return `Queue: ${summary.ready} ready but 0 routable — each needs exactly one "${labelPrefix}<repo>" label before dispatch can ever see it.`;
+    // `ready` counts claimed (in-flight) issues too; route() drops those with a
+    // state label silently, so "0 routable" must not blanket-blame missing
+    // `repo:` labels (#228). Spare depth is what dispatch can actually claim.
+    const claimed = summary.claimed ?? 0;
+    const unroutable = summary.holds
+      .filter((h) => h.reason.startsWith("unroutable:"))
+      .reduce((n, h) => n + h.count, 0);
+    if (unroutable === 0) {
+      return `Queue: ${summary.ready} ready, 0 spare — ${claimed} in flight. Spare depth is what dispatch can actually claim: groom the backlog (Duty 2) before the live runs settle.`;
+    }
+    return `Queue: ${summary.ready} ready, 0 spare — ${claimed} in flight, ${unroutable} unroutable (each unroutable issue needs exactly one "${labelPrefix}<repo>" label).`;
   }
   if (summary.routed >= groomBelow) return undefined;
   let line = `Queue: running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}.`;
@@ -404,6 +417,37 @@ export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScope]: string } = {
     "Reporting scope decisions: interrupt only for a decision you need (tier-2) or a condition that stops the fleet. Every other material event accumulates and ships as ONE message with this tick's report via omp-conductor report -- a merge, a green PR, a pulled issue wait for the tick; nothing between ticks.",
 };
 
+/**
+ * The reporting constraint appended to a default tick prompt (#229).
+ *
+ * A legacy `scopePreset` keeps its exact words — those are what the policy
+ * tests and the fleet already read — with a DUE/not-due clause appended only
+ * when the digest is actually scheduled (`daily` + `at`). An explicit
+ * non-preset policy derives one sentence naming its allowed interrupt
+ * categories and stating that everything else accumulates for the digest.
+ */
+export function tickReportingConstraint(
+  policy: ReportingPolicy | undefined,
+  digest: { due: boolean; scheduled: boolean; at?: string; timezone?: string },
+  held: number,
+): string {
+  const preset = policy?.scopePreset;
+  let base: string;
+  if (preset !== undefined) {
+    base = TICK_SCOPE_CONSTRAINTS[preset];
+  } else {
+    const allowed = policy?.interruptOn ?? [];
+    base =
+      allowed.length === 0
+        ? "Report nothing that would interrupt this turn; everything else accumulates for the digest."
+        : `Interrupt only for: ${allowed.join(", ")}. Everything else accumulates for the digest.`;
+  }
+  if (!digest.scheduled) return base;
+  return digest.due
+    ? `${base} The daily digest is DUE now — compose it from this tick's accumulated events and the ${held} held notice(s) below, then send via omp-conductor report --kind digest.`
+    : `${base} The daily digest is not due (scheduled ${digest.at}${digest.timezone === undefined ? "" : ` ${digest.timezone}`}); do not send one.`;
+}
+
 /**
  * The delivery clause, appended to every default tick prompt.
  *
@@ -572,6 +616,7 @@ export function formatFrictionDigest(signals: readonly FrictionSignal[]): string
  */
 export function resolveTickScope(): {
   scope: ReportScope;
+  policy?: ReportingPolicy;
   briefPath?: string;
   policyPath?: string;
   projectName?: string;
@@ -580,7 +625,8 @@ export function resolveTickScope(): {
   try {
     const project = findProject(loadConfig());
     return {
-      scope: project.reporting?.scope ?? DEFAULT_REPORT_SCOPE,
+      scope: project.reporting?.scopePreset ?? DEFAULT_REPORT_SCOPE,
+      policy: project.reporting,
       briefPath: briefPathForProject(project),
       policyPath: policyPathForProject(project),
       projectName: project.name,
@@ -1327,7 +1373,31 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
       pi.logger.info(`[omp-conductor] tick reporting scope: using ${DEFAULT_REPORT_SCOPE} — ${scope.fallback}`);
     }
     const bridged = approval?.kind === "ready" && approval.notifyMode === "always" && profile?.kind === "interactive";
-    content = `${defaultTickMessage(new Date(), scope.briefPath, scope.policyPath)}\n${TICK_SCOPE_CONSTRAINTS[scope.scope]}\n${bridged ? TICK_DELIVERY_RULE_BRIDGED : TICK_DELIVERY_RULE}`;
+    let reportingConstraint = TICK_SCOPE_CONSTRAINTS[scope.scope];
+    if (scope.projectName !== undefined) {
+      const policy = scope.policy;
+      const digestPolicy = policy?.digest ?? DEFAULT_REPORT_POLICY.digest;
+      const scheduled = digestPolicy.cadence === "daily" && digestPolicy.at !== undefined;
+      const at = Date.now();
+      const store = openStore(dbPath());
+      try {
+        const lastKey = store.lastDigestDedupeKey(scope.projectName);
+        const lastDay = lastKey === undefined ? undefined : lastKey.slice("digest:".length);
+        reportingConstraint = tickReportingConstraint(
+          policy,
+          {
+            due: digestDue(policy ?? DEFAULT_REPORT_POLICY, lastDay, at),
+            scheduled,
+            at: digestPolicy.at,
+            timezone: digestPolicy.timezone,
+          },
+          store.undigestedNotices(scope.projectName).length,
+        );
+      } finally {
+        store.close();
+      }
+    }
+    content = `${defaultTickMessage(new Date(), scope.briefPath, scope.policyPath)}\n${reportingConstraint}\n${bridged ? TICK_DELIVERY_RULE_BRIDGED : TICK_DELIVERY_RULE}`;
   }
   let frictionStore: Store | undefined;
   let frictionSignals: FrictionSignal[] = [];

package/src/plugin.ts

@@ -91,6 +91,7 @@ import {
   type ProjectPolicy,
   type ReleaseRequirement,
   type ReportScope,
+  type ReportScopeChoice,
   type ResolvedGrants,
 } from "./types.ts";
 
@@ -309,7 +310,7 @@ async function askGates(
  * means silence. The cursor starts on the current setting so Enter re-affirms
  * it, the same contract every other prompt here has.
  */
-async function askReportScope(ctx: CommandContext, current: ReportScope): Promise<ReportScope> {
+async function askReportScope(ctx: CommandContext, current: ReportScopeChoice): Promise<ReportScopeChoice> {
   const options = REPORT_SCOPE_CHOICES.map((c) => ({ label: c.label, description: c.description }));
   const at = REPORT_SCOPE_CHOICES.findIndex((c) => c.scope === current);
   const picked = await ctx.ui.select("What should the orchestrator report unprompted?", options, {
@@ -898,7 +899,22 @@ const askEscalation: AreaAsker = async (ctx, a) => {
 };
 
 /** How loud the orchestrator is when nobody asked it anything. */
-const askReporting: AreaAsker = async (ctx, a) => ({ ...a, reportScope: await askReportScope(ctx, a.reportScope) });
+const askReporting: AreaAsker = async (ctx, a) => {
+  const reportScope = await askReportScope(ctx, a.reportScope);
+  if (reportScope !== "quiet") return { ...a, reportScope };
+  // `quiet` picks the explicit form, whose only free parameter is when the
+  // daily rollup happens. Blank = whenever the orchestrator composes it.
+  const at = await ctx.ui.input(
+    "Daily rollup time, 24h HH:MM (blank = whenever the orchestrator composes it):",
+    a.quietDigestAt,
+  );
+  const trimmed = at?.trim() ?? "";
+  if (trimmed !== "" && !/^([01]\d|2[0-3]):[0-5]\d$/.test(trimmed)) {
+    ctx.ui.notify(`"${trimmed}" is not a 24h HH:MM time — leaving the digest model-timed.`, "warning");
+    return { ...a, reportScope };
+  }
+  return { ...a, reportScope, ...(trimmed === "" ? {} : { quietDigestAt: trimmed }) };
+};
 
 /** The operator's own brief. Asked last in the full interview, because the
  *  question quotes the path the rest of the answers derive. */

package/src/reports.ts

@@ -37,6 +37,7 @@
  */
 
 import { readTelegramToken, sendTelegram, TelegramSendError } from "./escalate.ts";
+import { localDayKey } from "./digest-schedule.ts";
 import type { Escalation, ProjectConfig, ReportRecord, Store } from "./types.ts";
 
 /**
@@ -120,13 +121,11 @@ export interface ReportOutboxDeps {
 /**
  * Local day, matching how a human reads "one daily digest" and how the
  * dispatcher's own `startOfToday` reads "today". A UTC key would roll the
- * digest over mid-evening for anyone west of Greenwich.
+ * digest over mid-evening for anyone west of Greenwich; the zone is the
+ * project's `reporting.digest.timezone` when set, else the host zone (#229).
  */
-export function digestDedupeKey(at: number): string {
-  const d = new Date(at);
-  const month = `${d.getMonth() + 1}`.padStart(2, "0");
-  const day = `${d.getDate()}`.padStart(2, "0");
-  return `digest:${d.getFullYear()}-${month}-${day}`;
+export function digestDedupeKey(at: number, timezone?: string): string {
+  return `digest:${localDayKey(at, timezone)}`;
 }
 
 /** Exponential, capped. `attempts` is attempts *started*, so the first failure

package/src/session-host.ts

@@ -9,14 +9,14 @@
  * fleet, and what makes a kill a real kill.
  *
  * This file is the far side: it loads the harness, runs the real session, and
- * speaks a five-verb protocol back over a unix socket to the
+ * speaks a small protocol back over a unix socket to the
  * {@link AgentSessionLike} proxy in `omp.ts`. It holds no conductor state, opens
  * no database, and reads no config — everything it needs arrives in
  * {@link SessionHostSpec}, so the child's inputs are data a caller can see
  * rather than ambient state it inherits.
  *
- * The protocol is deliberately tiny. `AgentSessionLike` has five members, so
- * there are five things to carry, and every one of them is data.
+ * The protocol deliberately mirrors the narrow session surface and carries
+ * only data.
  */
 
 import { connect } from "node:net";
@@ -53,6 +53,7 @@ export interface SessionHostSpec {
 /** Parent → child. */
 export type ParentToHost =
   | { t: "prompt"; id: number; text: string; opts?: Record<string, unknown> }
+  | { t: "park"; id: number }
   | { t: "abort" }
   | { t: "dispose" };
 
@@ -63,6 +64,7 @@ export type HostToParent =
   | { t: "event"; event: unknown }
   | { t: "session-file"; path: string }
   | { t: "prompt-result"; id: number; ok: boolean; error?: string }
+  | { t: "park-result"; id: number; ok: boolean; error?: string }
   | { t: "release-blocked"; shape: ReleaseShape };
 
 /**
@@ -240,6 +242,20 @@ export async function runSessionHost(
         );
         continue;
       }
+      if (message.t === "park") {
+        const id = message.id;
+        void live.park().then(
+          () => send({ t: "park-result", id, ok: true }),
+          (err: unknown) =>
+            send({
+              t: "park-result",
+              id,
+              ok: false,
+              error: err instanceof Error ? err.message : String(err),
+            }),
+        );
+        continue;
+      }
       if (message.t === "abort") {
         live.abort();
         continue;

package/src/setup.ts

@@ -40,6 +40,7 @@ import {
   resolveCaps,
   resolvePolicy,
   resolveReleaseGrants,
+  SCOPE_PRESETS,
   stateDir,
 } from "./config.ts";
 import { graphProjectPath, graphRepos } from "./graph.ts";
@@ -61,6 +62,8 @@ import {
   type ProjectPolicy,
   type ReleaseRequirement,
   type ReportScope,
+  type ReportScopeChoice,
+  type ReportingPolicy,
   type RepoTarget,
   type ResolvedGrants,
 } from "./types.ts";
@@ -88,7 +91,9 @@ export interface SetupAnswers {
   telegramChatId?: string;
   fallbackToIssueComment: boolean;
   /** How loud the supervising orchestrator session should be. */
-  reportScope: ReportScope;
+  reportScope: ReportScopeChoice;
+  /** The daily digest wall-clock (`HH:MM`) for the `quiet` choice, blank = model-timed. */
+  quietDigestAt?: string;
   /**
    * Mechanical gate for release/deploy-shaped tool calls, per shape. Always
    * complete: the wizard asks about every shape, so an answer object can never
@@ -175,7 +180,11 @@ export const SETUP_DEFAULTS = {
  * brief spells the same three options out — so "material" cannot come to mean
  * one thing in the dialog and another in the session that has to honour it.
  */
-export const REPORT_SCOPE_CHOICES: readonly { scope: ReportScope; label: string; description: string }[] = [
+export const REPORT_SCOPE_CHOICES: readonly {
+  scope: ReportScopeChoice;
+  label: string;
+  description: string;
+}[] = [
   {
     scope: "decisions",
     label: "Decisions interrupt, rest batches",
@@ -192,6 +201,12 @@ export const REPORT_SCOPE_CHOICES: readonly { scope: ReportScope; label: string;
     label: "Escalations only",
     description: "escalations when they happen, plus one daily digest — silent otherwise",
   },
+  {
+    scope: "quiet",
+    label: "Quiet (scheduled digest)",
+    description:
+      "interrupt only for escalations, fleet stops and confirmed failures; one daily rollup on your schedule",
+  },
 ];
 
 /**
@@ -204,7 +219,7 @@ export const REPORT_SCOPE_CHOICES: readonly { scope: ReportScope; label: string;
  * answers "an operator being asked the question for the first time", where the
  * recommended answer is the useful one — and they see it, and confirm it.
  */
-export const SETUP_DEFAULT_REPORT_SCOPE: ReportScope = REPORT_SCOPE_CHOICES[0]!.scope;
+export const SETUP_DEFAULT_REPORT_SCOPE: ReportScopeChoice = REPORT_SCOPE_CHOICES[0]!.scope;
 
 /**
  * What each precondition value means to the operator being asked about it, in
@@ -560,8 +575,24 @@ export function buildProject(a: SetupAnswers): ProjectConfig {
     // and a release require without anyone having to know a default (#129).
     policy: clonePolicy(a.policy),
     // Written out even when it is the default, so an operator amending the
-    // volume has a line in the file to point at.
-    reporting: { scope: a.reportScope },
+    // volume has a line in the file to point at. A `scope` answer is
+    // materialised as its preset policy (with `scopePreset` set) so the file
+    // and the prompt agree with no migration rule; `quiet` is the explicit
+    // form — a curated interrupt list and a scheduled digest (#229).
+    reporting:
+      a.reportScope === "quiet"
+        ? {
+            interruptOn: ["tier2", "fleet-stopped", "confirmed-failure"],
+            digest: {
+              cadence: "daily",
+              ...(a.quietDigestAt !== undefined && a.quietDigestAt.length > 0 ? { at: a.quietDigestAt } : {}),
+            },
+          }
+        : {
+            interruptOn: [...(SCOPE_PRESETS[a.reportScope] ?? SCOPE_PRESETS[DEFAULT_REPORT_SCOPE]).interruptOn],
+            digest: { ...(SCOPE_PRESETS[a.reportScope] ?? SCOPE_PRESETS[DEFAULT_REPORT_SCOPE]).digest },
+            scopePreset: (SCOPE_PRESETS[a.reportScope] ?? SCOPE_PRESETS[DEFAULT_REPORT_SCOPE]).scopePreset,
+          },
     // Both under the state dir so one `rm -rf ~/.omp/conductor` is a complete
     // uninstall, and neither can land in a repo the daemon then tries to commit.
     workspaceRoot: defaultWorkspaceRoot(),
@@ -667,7 +698,7 @@ export function answersFromProject(p: ProjectConfig): SetupAnswers {
     releaseGrants: resolveReleaseGrants(p),
     policy: resolvePolicy(p),
     orchestratorMode: p.escalation.orchestrator,
-    reportScope: p.reporting?.scope ?? DEFAULT_REPORT_SCOPE,
+    reportScope: p.reporting?.scopePreset ?? DEFAULT_REPORT_SCOPE,
     writeOrchestratorBrief: false,
   };
 
@@ -704,7 +735,7 @@ function briefVarsForProject(p: ProjectConfig): Record<string, string> {
     QUEUE_LABEL: p.queueLabel,
     RELEASES_DEFAULT: RELEASES_DEFAULTS[`${p.authority.merge}/${p.authority.release}`],
     MERGE_DUTY: MERGE_DUTY[p.authority.merge],
-    REPORT_SCOPE: p.reporting?.scope ?? DEFAULT_REPORT_SCOPE,
+    REPORT_SCOPE: p.reporting?.scopePreset ?? DEFAULT_REPORT_SCOPE,
     POLICY_SOURCE: policySourceLine(p),
   };
 }
@@ -1234,7 +1265,7 @@ export const AMEND_AREAS: {
     name: "reporting scope",
     asks: "how much the orchestrator says unprompted",
     describe: (p) => {
-      const scope = p.reporting?.scope ?? DEFAULT_REPORT_SCOPE;
+      const scope = p.reporting?.scopePreset ?? DEFAULT_REPORT_SCOPE;
       const choice = REPORT_SCOPE_CHOICES.find((c) => c.scope === scope);
       return `${scope} — ${choice?.description ?? "unknown scope"}`;
     },

package/src/store.ts

@@ -26,6 +26,8 @@ import type {
   FrictionKind,
   FrictionObservation,
   FrictionSignal,
+  HeldNotice,
+  HeldNoticeDraft,
   LabelOp,
   MergeLock,
   ReportDeliveryState,
@@ -332,6 +334,24 @@ CREATE UNIQUE INDEX IF NOT EXISTS reports_dedupe
 CREATE INDEX IF NOT EXISTS reports_project_state
   ON reports (project, state, nextAttemptAt);
 
+-- Interrupts a project's reporting.interruptOn policy deferred to the digest
+-- (#229): an escalation that must not page the operator's phone now is held
+-- here so the daily rollup can surface it. digestedAt set -> re-surfaced by a
+-- digest pass and no longer owed. A table rather than a flag on reports: these
+-- are escalations that never reached a send, distinct from reports the model
+-- wrote on purpose.
+CREATE TABLE IF NOT EXISTS held_notices (
+  id         TEXT    PRIMARY KEY,
+  project    TEXT    NOT NULL,
+  category   TEXT    NOT NULL,
+  summary    TEXT    NOT NULL,
+  detail     TEXT    NOT NULL,
+  createdAt  INTEGER NOT NULL,
+  digestedAt INTEGER
+);
+CREATE INDEX IF NOT EXISTS held_notices_project_undigested
+  ON held_notices (project, digestedAt) WHERE digestedAt IS NULL;
+
 -- The action ledger for the conductor-owned mutation verbs (#126). Every
 -- decided call lands here, refusals included: the question an escalation asks
 -- is "what did this run try", and a table that only records what succeeded
@@ -902,12 +922,12 @@ export function openStore(dbPath: string): Store {
   const countFailures = db.query<{ n: number }, [string, number]>(
     `SELECT COUNT(*) AS n FROM runs
       WHERE project = ? AND issue = ? AND state = 'failed'
-        AND (failureClass IS NULL OR failureClass NOT IN ('ci-infra', 'settlement-stuck', 'env-start-failure', 'dispatch-infra', 'provider-credit'))`,
+        AND (failureClass IS NULL OR failureClass NOT IN ('ci-infra', 'settlement-stuck', 'env-start-failure', 'dispatch-infra', 'provider-credit', 'provider-transient'))`,
   );
   const countContinuations = db.query<{ n: number }, [string, number]>(
     `SELECT COUNT(*) AS n FROM runs
       WHERE project = ? AND issue = ? AND state IN ('killed', 'orphaned', 'blocked')
-        AND (failureClass IS NULL OR failureClass NOT IN ('admin-kill', 'settlement-stuck', 'env-start-failure', 'dispatch-infra', 'provider-credit'))`,
+        AND (failureClass IS NULL OR failureClass NOT IN ('admin-kill', 'settlement-stuck', 'env-start-failure', 'dispatch-infra', 'provider-credit', 'provider-transient'))`,
   );
   // How many times one issue reached a given class. Recovery uses it to bound a
   // retry loop whose cause is persistent (e.g. a mirror that will not refresh):
@@ -1079,6 +1099,33 @@ export function openStore(dbPath: string): Store {
       ORDER BY createdAt ASC, rowid ASC
       LIMIT ?`,
   );
+
+  // Held notices (#229): escalations deferred to the digest by the project's
+  // `reporting.interruptOn` policy. `digestedAt` NULL = still owed.
+  const insertHeldNotice = db.query<unknown, SqlValue[]>(
+    `INSERT INTO held_notices (id, project, category, summary, detail, createdAt, digestedAt)
+     VALUES (?, ?, ?, ?, ?, ?, NULL)`,
+  );
+  const selectUndigestedNotices = db.query<
+    { id: string; category: string; summary: string; detail: string; createdAt: number },
+    [string]
+  >(
+    `SELECT id, category, summary, detail, createdAt FROM held_notices
+      WHERE project = ? AND digestedAt IS NULL
+      ORDER BY createdAt ASC`,
+  );
+  const markNoticesDigestedRow = db.query<unknown, [number, string]>(
+    `UPDATE held_notices SET digestedAt = ? WHERE project = ? AND digestedAt IS NULL`,
+  );
+  // The newest digest dedupe key a project has actually run toward — an
+  // `updatedAt`-newest row whose key is a digest prefix and that did not end in
+  // failure. The CLI refuses an off-schedule digest by comparing this against
+  // today's key under `digestDue` (#229).
+  const selectLastDigestKey = db.query<{ key: string | null }, [string]>(
+    `SELECT dedupeKey AS key FROM reports
+      WHERE project = ? AND dedupeKey LIKE 'digest:%' AND state <> 'failed'
+      ORDER BY createdAt DESC LIMIT 1`,
+  );
   const claimReportRow = db.query<unknown, [string, number, string, number]>(
     `UPDATE reports
         SET state = 'sending', attemptId = ?, attempts = attempts + 1, updatedAt = ?
@@ -1445,6 +1492,30 @@ export function openStore(dbPath: string): Store {
       return row === null ? undefined : toDispatchSummary(row.summary);
     },
 
+    lastDigestDedupeKey(project: string): string | undefined {
+      const row = selectLastDigestKey.get(project);
+      return row?.key ?? undefined;
+    },
+
+    addHeldNotice(notice: HeldNoticeDraft): void {
+      insertHeldNotice.run(
+        crypto.randomUUID(),
+        notice.project,
+        notice.category,
+        notice.summary,
+        notice.detail,
+        notice.createdAt,
+      );
+    },
+
+    undigestedNotices(project: string): HeldNotice[] {
+      return selectUndigestedNotices.all(project).map((row) => ({ ...row }) as HeldNotice);
+    },
+
+    markNoticesDigested(project: string, at: number): void {
+      markNoticesDigestedRow.run(at, project);
+    },
+
     recordFriction,
 
     recordGhRefusal,