omp-conductor 0.12.0 → 0.14.0

package/src/orchestrator-tick.ts

@@ -44,9 +44,11 @@
  * config, believed it held both.
  */
 
+import { createHash, randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
+import { availabilityPrompt, interruptDisposition } from "./availability.ts";
 import { findProject, loadConfig, resolveReleaseGrants } from "./config.ts";
 import {
   bridgeTokenBound,
@@ -58,10 +60,12 @@ import {
 import {
   briefPathForProject,
   policyPathForProject,
+  reportScopeFromPolicy,
   refreshComposedBriefForProject,
 } from "./setup.ts";
 import {
   recordReleaseBlock,
+  redactReleaseArgs,
   releaseDriftDigestLine,
   releaseRefusal,
   releaseShapeFromTool,
@@ -72,8 +76,11 @@ import {
   DEFAULT_REPORT_SCOPE,
   DENIED_RELEASE_GRANTS,
   type DispatchSummary,
+  type DigestBacklog,
   type FrictionSignal,
-  type ReportScope,
+  type HeldNotice,
+  type MaterialEvent,
+  type ReportScopeChoice,
   type ReportingPolicy,
   type ResolvedGrants,
   type Store,
@@ -81,7 +88,7 @@ import {
 import { formatDecisionDigest } from "./decisions.ts";
 import type { RunRecord } from "./types.ts";
 import { dbPath, openStore } from "./store.ts";
-import { digestDue } from "./digest-schedule.ts";
+import { digestDue, localDayKey } from "./digest-schedule.ts";
 
 /** The activation file. Absent means "this is not an orchestrator session". */
 export const TICK_CONFIG_FILE = ".conductor-tick.json";
@@ -110,6 +117,8 @@ const FRICTION_DIGEST_LIMIT = 3;
  * definitive, either way.
  */
 const RETRY_OWNERSHIP_MS = 60_000;
+/** A failed digest turn must release working-hours catch-up ownership promptly. */
+const MIN_AVAILABILITY_DIGEST_LEASE_MS = 30 * 60 * 1_000;
 
 /**
  * The stall marker — written beside the activation file, in the session cwd —
@@ -257,6 +266,23 @@ interface TickApi {
   on(event: "session_start", handler: (event: { type: "session_start" }, ctx: TickContext) => void): void;
   on(event: "turn_start", handler: (event: { type: "turn_start" }, ctx: TickContext) => void): void;
   on(event: "turn_end", handler: (event: { type: "turn_end" }, ctx: TickContext) => void): void;
+  on(
+    event: "message_start",
+    handler: (
+      event: {
+        type: "message_start";
+        message: {
+          role: string;
+          customType?: string;
+          synthetic?: boolean;
+          attribution?: "user" | "agent";
+          timestamp?: number;
+        };
+      },
+      ctx: TickContext,
+    ) => void,
+  ): void;
+  on(event: "agent_end", handler: (event: { type: "agent_end" }, ctx: TickContext) => void): void;
   /**
    * `deliverAs: "followUp"` + `triggerTurn: true`, verified against
    * `AgentSession.sendCustomMessage` rather than assumed:
@@ -409,42 +435,99 @@ export function queueDigestLine(
   return line;
 }
 
-export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScope]: string } = {
+export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScopeChoice]: string } = {
   material: "Report material events per your brief.",
   escalations:
-    "Report NOTHING this turn except a Tier 1 or Tier 2 escalation; everything else -- releases included -- waits for the daily digest.",
+    "Interrupt only for: tier2, fleet-stopped; everything else — releases included — waits for the daily digest.",
   decisions:
-    "Reporting scope decisions: interrupt only for a decision you need (tier-2) or a condition that stops the fleet. Every other material event accumulates and ships as ONE message with this tick's report via omp-conductor report -- a merge, a green PR, a pulled issue wait for the tick; nothing between ticks.",
+    "Reporting scope decisions: interrupt only for a decision you need (tier-2) or a condition that stops the fleet. Every other material event waits for the configured digest; nothing between digests.",
+  quiet:
+    "Interrupt only for: tier2, fleet-stopped, confirmed-failure; everything else waits for the daily digest.",
 };
 
+/** Bounded, durable source material for one due digest. Row ids are part of the
+ * handoff contract: the report and exactly the rows it consumed settle in one
+ * SQLite transaction, so a crash cannot lose an outcome between those writes. */
+export function formatDigestLedger(
+  events: readonly MaterialEvent[],
+  notices: readonly HeldNotice[],
+  backlog: DigestBacklog,
+): string {
+  const oneLine = (text: string, limit: number): string => {
+    const flat = text.replace(/\s+/g, " ").trim();
+    return flat.length <= limit ? flat : `${flat.slice(0, limit - 1)}…`;
+  };
+  const lines = [
+    `Durable digest ledger — ${backlog.materialCount} material event(s), ${backlog.heldNoticeCount} held escalation(s); oldest first:`,
+    ...events.map(
+      (event) =>
+        `  event ${event.id} | ${new Date(event.occurredAt).toISOString()} | ${event.category} | ` +
+        `${oneLine(event.summary, 180)} | evidence: ${oneLine(event.evidence, 240)}`,
+    ),
+    ...notices.map(
+      (notice) =>
+        `  notice ${notice.id} | ${new Date(notice.createdAt).toISOString()} | ${notice.category} | ` +
+        `${oneLine(notice.summary, 180)} | detail: ${oneLine(notice.detail, 240)}`,
+    ),
+  ];
+  if (backlog.materialCount > events.length) {
+    lines.push(`  … ${backlog.materialCount - events.length} newer material event(s) remain owed.`);
+  }
+  if (backlog.heldNoticeCount > notices.length) {
+    lines.push(`  … ${backlog.heldNoticeCount - notices.length} additional held escalation(s) remain owed.`);
+  }
+  const eventIds = events.map((event) => event.id).join(",");
+  const noticeIds = notices.map((notice) => notice.id).join(",");
+  lines.push(
+    "Compose the digest from the relevant rows above. Hand it off with omp-conductor report --kind digest " +
+      `${eventIds.length === 0 ? "" : `--events ${eventIds} `}` +
+      `${noticeIds.length === 0 ? "" : `--notices ${noticeIds} `}` +
+      "--text TEXT. Remove any row id you did not actually include; omitted rows remain owed. Never invent an id.",
+  );
+  return lines.join("\n");
+}
+
 /**
- * The reporting constraint appended to a default tick prompt (#229).
+ * The reporting constraint appended to a default tick prompt (#229, #242).
  *
- * A legacy `scopePreset` keeps its exact words — those are what the policy
- * tests and the fleet already read — with a DUE/not-due clause appended only
- * when the digest is actually scheduled (`daily` + `at`). An explicit
- * non-preset policy derives one sentence naming its allowed interrupt
- * categories and stating that everything else accumulates for the digest.
+ * Material and decisions keep their legacy preset words. The escalations
+ * preset instead names the policy's actual interrupt categories, so the prompt
+ * cannot drift from the gate. Every daily cadence gets an explicit due state:
+ * model-timed digests need that instruction just as scheduled digests do.
  */
 export function tickReportingConstraint(
   policy: ReportingPolicy | undefined,
-  digest: { due: boolean; scheduled: boolean; at?: string; timezone?: string },
+  digest: {
+    due: boolean;
+    cadence: ReportingPolicy["digest"]["cadence"];
+    at?: string;
+    timezone?: string;
+  },
   held: number,
 ): string {
   const preset = policy?.scopePreset;
+  const allowed = policy?.interruptOn ?? [];
   let base: string;
-  if (preset !== undefined) {
+  if (preset === "escalations") {
+    base = `Interrupt only for: ${allowed.join(", ")}; everything else — releases included — waits for the daily digest.`;
+  } else if (preset !== undefined) {
     base = TICK_SCOPE_CONSTRAINTS[preset];
   } else {
-    const allowed = policy?.interruptOn ?? [];
     base =
       allowed.length === 0
         ? "Report nothing that would interrupt this turn; everything else accumulates for the digest."
         : `Interrupt only for: ${allowed.join(", ")}. Everything else accumulates for the digest.`;
   }
-  if (!digest.scheduled) return base;
-  return digest.due
-    ? `${base} The daily digest is DUE now — compose it from this tick's accumulated events and the ${held} held notice(s) below, then send via omp-conductor report --kind digest.`
+  if (policy !== undefined && !allowed.includes("material")) {
+    base +=
+      " Record every material outcome that is not sent as an interrupt immediately with omp-conductor event record; the durable ledger, not session memory, feeds the next digest.";
+  }
+  if (digest.cadence !== "daily") return base;
+  if (digest.due) {
+    return `${base} The daily digest is DUE now — compose it from the durable accumulated events and ${held} held notice(s), then send via omp-conductor report --kind digest.`;
+  }
+  return digest.at === undefined
+    ? `${base} The daily digest was already sent today; do not send another.`
     : `${base} The daily digest is not due (scheduled ${digest.at}${digest.timezone === undefined ? "" : ` ${digest.timezone}`}); do not send one.`;
 }
 
@@ -479,13 +562,14 @@ export function tickReportingConstraint(
  * report is indistinguishable from a quiet tick. #123 moved delivery to the
  * daemon, so the clause now names the handover instead. `omp-conductor report`
  * persists the text before anything is sent and the daemon retries it until it
- * lands; a handover that returns a report id has therefore *already* survived
- * the failure mode this rule exists for, which a watched `telegram_send` never
- * could. `telegram_send` remains the right call for an interactive reply to a
- * person who is waiting — that is a conversation, not a report.
+ * lands; a handover that returns a durable report or held-notice id has
+ * therefore *already* survived the failure mode this rule exists for, which a
+ * watched `telegram_send` never could. `telegram_send` remains the right call
+ * for an interactive reply to a person who is waiting — that is a
+ * conversation, not a report.
  */
 export const TICK_DELIVERY_RULE =
-  "This tick was injected locally, not sent from Telegram, so your end-of-turn text does NOT reach your operator. Hand anything reportable this turn to the durable outbox by running `omp-conductor report --text \"<the whole report>\"` (add `--kind digest` for the daily digest) and confirming it printed a report id; the daemon then owns delivery and retries until it lands. Never claim a report was sent otherwise, and never use telegram_send for a report -- that path leaves no record that it went out.";
+  "This tick was injected locally, not sent from Telegram, so your end-of-turn text does NOT reach your operator. Hand anything reportable this turn to the durable outbox by running `omp-conductor report --text \"<the whole report>\"` (add `--kind digest` for the daily digest) and confirming it printed a durable handoff id (a report id, or a held-notice id during quiet hours); the daemon then owns delivery and retries until it lands. Never claim a report was sent otherwise, and never use telegram_send for a report -- that path leaves no record that it went out.";
 
 /** The {@link TICK_DELIVERY_RULE} variant for a fleet whose bridge actually
  *  delivers the tick's ending text (#169). That is a narrower class than the
@@ -528,8 +612,9 @@ export { TELEGRAM_APPROVAL_TOOL };
  */
 export const TICK_APPROVAL_UNAVAILABLE_RULE =
   `The ${TELEGRAM_APPROVAL_TOOL} tool is NOT mounted on this tick, so the package floor's yes/no amendment approval cannot be asked here. ` +
-  `If you have an amendment to propose, deliver the question with telegram_send and wait for your operator's reply on a later turn; ` +
-  `never apply an amendment, or record one as approved, without an explicit answer you actually received.`;
+  `If you have an amendment to propose, deliver the question with telegram_send, prefix its text with "QUESTION:", and wait for your operator's reply on a later turn. ` +
+  `A returned telegram_ask answer proves an answer, not Telegram delivery. ` +
+  `Never apply an amendment, or record one as approved, without an explicit answer you actually received.`;
 
 /**
  * Appended to every tick — the shipped prompt or the operator's own — composed
@@ -615,7 +700,7 @@ export function formatFrictionDigest(signals: readonly FrictionSignal[]): string
  * trade.
  */
 export function resolveTickScope(): {
-  scope: ReportScope;
+  scope: ReportScopeChoice;
   policy?: ReportingPolicy;
   briefPath?: string;
   policyPath?: string;
@@ -625,7 +710,7 @@ export function resolveTickScope(): {
   try {
     const project = findProject(loadConfig());
     return {
-      scope: project.reporting?.scopePreset ?? DEFAULT_REPORT_SCOPE,
+      scope: reportScopeFromPolicy(project.reporting),
       policy: project.reporting,
       briefPath: briefPathForProject(project),
       policyPath: policyPathForProject(project),
@@ -1272,6 +1357,228 @@ function clearTickRequest(pi: TickApi, cwd: string): void {
   }
 }
 
+interface PendingLocalTick {
+  id: string;
+  projectName?: string;
+  policy?: ReportingPolicy;
+}
+
+interface ActiveLocalTick extends PendingLocalTick {
+  /** A person who writes during an autonomous run is awake by construction. */
+  humanWaiting: boolean;
+}
+
+interface TelegramInterrupt {
+  kind: "question" | "message";
+  category: HeldNotice["category"];
+  summary: string;
+  detail: string;
+  hasFiles: boolean;
+  fingerprint: string;
+}
+
+function objectRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function canonicalTelegramPayload(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(canonicalTelegramPayload);
+  if (!objectRecord(value)) return value;
+  return Object.fromEntries(
+    Object.keys(value)
+      .sort()
+      .map((key) => [key, canonicalTelegramPayload(value[key])]),
+  );
+}
+
+
+function serialiseTelegramPayload(value: unknown): string {
+  try {
+    return JSON.stringify(canonicalTelegramPayload(value)) ?? String(value);
+  } catch {
+    return String(value);
+  }
+}
+
+function telegramInterruptFromTool(
+  toolName: string,
+  input: Record<string, unknown>,
+): TelegramInterrupt | undefined {
+  let kind: TelegramInterrupt["kind"];
+  let payload: Record<string, unknown> = input;
+
+  if (toolName === TELEGRAM_APPROVAL_TOOL) {
+    kind = "question";
+  } else if (toolName === "telegram_send" || toolName === "telegram_react") {
+    kind = "message";
+  } else if (toolName === "write") {
+    const path = input["path"];
+    if (
+      path !== "xd://telegram_ask" &&
+      path !== "xd://telegram_send" &&
+      path !== "xd://telegram_react"
+    ) {
+      return undefined;
+    }
+    kind = path === "xd://telegram_ask" ? "question" : "message";
+    const content = input["content"];
+    if (typeof content === "string") {
+      try {
+        const parsed: unknown = JSON.parse(content);
+        payload = objectRecord(parsed) ? parsed : { content };
+      } catch {
+        payload = { content };
+      }
+    }
+  } else {
+    return undefined;
+  }
+  if (
+    kind === "message" &&
+    typeof payload["text"] === "string" &&
+    /^\s*QUESTION:\s/i.test(payload["text"])
+  ) {
+    // The package floor uses this explicit fallback when telegram_ask is not
+    // mounted. Without the marker a plain send remains a material update.
+    kind = "question";
+  }
+
+  let detail = "";
+  if (kind === "question" && Array.isArray(payload["questions"])) {
+    detail = payload["questions"]
+      .map((value, index) => {
+        if (!objectRecord(value)) return `Question ${index + 1}: ${serialiseTelegramPayload(value)}`;
+        const question = typeof value["question"] === "string" ? value["question"] : "Question";
+        const options = Array.isArray(value["options"])
+          ? value["options"]
+              .map((option) =>
+                objectRecord(option) && typeof option["label"] === "string"
+                  ? `${option["label"]}${
+                      typeof option["description"] === "string" && option["description"] !== ""
+                        ? ` — ${option["description"]}`
+                        : ""
+                    }`
+                  : serialiseTelegramPayload(option),
+              )
+              .join("; ")
+          : "";
+        return options === "" ? question : `${question}\nOptions: ${options}`;
+      })
+      .join("\n\n");
+  } else if (typeof payload["text"] === "string") {
+    detail = payload["text"];
+  }
+  if (detail.trim() === "") detail = serialiseTelegramPayload(payload);
+
+  const flat = detail.replace(/\s+/g, " ").trim();
+  const fallback = kind === "question" ? "Operator question" : "Telegram message";
+  const summary = flat === "" ? fallback : flat.length <= 180 ? flat : `${flat.slice(0, 179)}…`;
+  const canonical = serialiseTelegramPayload({ kind, payload });
+  return {
+    kind,
+    category: kind === "question" ? "decision-needed" : "material",
+    summary,
+    hasFiles: Array.isArray(payload["files"]) && payload["files"].length > 0,
+    detail,
+    fingerprint: createHash("sha256").update(canonical).digest("hex"),
+  };
+}
+
+type TelegramInterruptBlock = { block: true; reason: string };
+
+/**
+ * A locally injected tick is an autonomous actor. Its direct Telegram calls
+ * therefore pass through the same category and availability decision as daemon
+ * escalations. Human-originated runs, including a message steered into a tick,
+ * are exempt: the operator is already present and waiting for the reply.
+ */
+function autonomousTelegramInterruptBlock(
+  pi: TickApi,
+  session: TickSession,
+  event: { toolName: string; input: Record<string, unknown> },
+): TelegramInterruptBlock | undefined {
+  const active = session.activeLocalTick;
+  if (active === undefined || active.humanWaiting) return undefined;
+  const interrupt = telegramInterruptFromTool(event.toolName, event.input);
+  if (interrupt === undefined) return undefined;
+  if (active.projectName === undefined) {
+    return {
+      block: true,
+      reason:
+        "Operator availability policy is unavailable for this autonomous tick, so direct Telegram is blocked fail-closed. " +
+        "Repair the conductor config; do not retry through another Telegram path.",
+    };
+  }
+
+  let policy = active.policy;
+  let configReadable = true;
+  try {
+    policy = findProject(loadConfig(), active.projectName).reporting;
+  } catch (err) {
+    configReadable = false;
+    pi.logger.error(
+      `[omp-conductor] operator availability config unreadable during Telegram call; blocking fail-closed: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    );
+  }
+
+  const at = Date.now();
+  const disposition = configReadable
+    ? interruptDisposition(policy, interrupt.category, at)
+    : "availability";
+  if (disposition === "interrupt") return undefined;
+  const release =
+    disposition === "availability"
+      ? "the availability window opens or the daily digest runs"
+      : "the daily digest runs";
+  if (interrupt.hasFiles) {
+    return {
+      block: true,
+      reason:
+        `Operator policy forbids this autonomous Telegram ${interrupt.kind} until ${release}, ` +
+        "and attachment-bearing Telegram sends cannot be durably replayed. Nothing was sent or held. " +
+        "Do not retry through another Telegram path while the policy forbids delivery.",
+    };
+  }
+
+  const key = `${active.projectName}:autonomous-telegram:${active.id}:${interrupt.fingerprint}`;
+  try {
+    const store = openStore(dbPath());
+    try {
+      if (!store.wasNotified(key)) {
+        store.addHeldNotice({
+          id: createHash("sha256").update(`held-notice\0${key}`).digest("hex"),
+          project: active.projectName,
+          category: interrupt.category,
+          summary: interrupt.summary,
+          detail: interrupt.detail,
+          createdAt: at,
+          ...(disposition === "availability" ? { releaseOnAvailable: true } : {}),
+        });
+        store.markNotified(key);
+      }
+    } finally {
+      store.close();
+    }
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    pi.logger.error(`[omp-conductor] could not persist held Telegram ${interrupt.kind}: ${reason}`);
+    return {
+      block: true,
+      reason:
+        `Operator policy forbids this autonomous Telegram ${interrupt.kind}, and the durable hold failed: ${reason}. ` +
+        "Do not retry through another Telegram path.",
+    };
+  }
+
+  return {
+    block: true,
+    reason:
+      `Operator policy durably held this autonomous Telegram ${interrupt.kind} until ${release}. ` +
+      "Do not retry through another Telegram path.",
+  };
+}
+
 /** Everything one tick remembers for the next. */
 interface TickSession {
   /**
@@ -1300,6 +1607,10 @@ interface TickSession {
   bridgeTokenAtStart: boolean;
   /** Consecutive {@link PENDING_REASON} skips — see {@link STALL_MARKER_FILE}. */
   pendingSkips: number;
+  /** Ticks sent as follow-ups but not yet observed by the agent loop. */
+  pendingLocalTicks: PendingLocalTick[];
+  /** The local tick whose agent loop is currently running, if any. */
+  activeLocalTick?: ActiveLocalTick;
 }
 
 /**
@@ -1377,28 +1688,74 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
     if (scope.projectName !== undefined) {
       const policy = scope.policy;
       const digestPolicy = policy?.digest ?? DEFAULT_REPORT_POLICY.digest;
-      const scheduled = digestPolicy.cadence === "daily" && digestPolicy.at !== undefined;
+      const cadence = digestPolicy.cadence;
       const at = Date.now();
       const store = openStore(dbPath());
       try {
         const lastKey = store.lastDigestDedupeKey(scope.projectName);
         const lastDay = lastKey === undefined ? undefined : lastKey.slice("digest:".length);
+        const due = digestDue(policy ?? DEFAULT_REPORT_POLICY, lastDay, at);
+        // Reserve availability-held rows before reading them. The same SQLite
+        // transaction releases pending catch-ups; daemon enqueue attempts then
+        // observe the lease, closing both orders of the snapshot-to-handoff race.
+        const availabilityReserved =
+          due &&
+          store.reserveAvailabilityDigest(
+            scope.projectName,
+            localDayKey(at, digestPolicy.timezone ?? policy?.availability?.timezone),
+            at,
+            at +
+              Math.max(
+                MIN_AVAILABILITY_DIGEST_LEASE_MS,
+                (config.budgetSeconds ?? DEFAULT_TICK_BUDGET_SECONDS) * 1_000 + 5 * 60_000,
+              ),
+          );
+        const backlog = store.digestBacklog(scope.projectName);
+        const visibleBacklog: DigestBacklog = availabilityReserved
+          ? backlog
+          : {
+              ...backlog,
+              heldNoticeCount: Math.max(
+                0,
+                backlog.heldNoticeCount - (backlog.availabilityHeldNoticeCount ?? 0),
+              ),
+            };
         reportingConstraint = tickReportingConstraint(
           policy,
           {
-            due: digestDue(policy ?? DEFAULT_REPORT_POLICY, lastDay, at),
-            scheduled,
+            due,
+            cadence,
             at: digestPolicy.at,
             timezone: digestPolicy.timezone,
           },
-          store.undigestedNotices(scope.projectName).length,
+          visibleBacklog.heldNoticeCount,
         );
+        if (
+          due &&
+          (visibleBacklog.materialCount > 0 || visibleBacklog.heldNoticeCount > 0)
+        ) {
+          const notices = store
+            .undigestedNotices(scope.projectName)
+            .filter((notice) => notice.releaseOnAvailable !== true || availabilityReserved);
+          reportingConstraint +=
+            `\n${formatDigestLedger(
+              store.undigestedMaterialEvents(scope.projectName),
+              notices,
+              visibleBacklog,
+            )}`;
+        }
       } finally {
         store.close();
       }
     }
     content = `${defaultTickMessage(new Date(), scope.briefPath, scope.policyPath)}\n${reportingConstraint}\n${bridged ? TICK_DELIVERY_RULE_BRIDGED : TICK_DELIVERY_RULE}`;
   }
+  if (scope.projectName !== undefined) {
+    // Unlike ordinary reporting prose, this is a mechanical clock reading and
+    // survives a custom heartbeat message. The model never infers whether the
+    // operator can be interrupted.
+    content = `${content}\n${availabilityPrompt(scope.policy, Date.now())}`;
+  }
   let frictionStore: Store | undefined;
   let frictionSignals: FrictionSignal[] = [];
   const now = Date.now();
@@ -1516,11 +1873,23 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
   // No `accessFile` means no fleet bridge to judge, exactly as above.
   if (profile?.kind === "interactive") content = `${content}\n${TICK_NARRATION_RULE}`;
 
+  const pendingLocalTick: PendingLocalTick = {
+    id: randomUUID(),
+    ...(scope.projectName === undefined ? {} : { projectName: scope.projectName }),
+    ...(scope.policy === undefined ? {} : { policy: scope.policy }),
+  };
+  session.pendingLocalTicks.push(pendingLocalTick);
   try {
-    pi.sendMessage(
-      { customType: TICK_CUSTOM_TYPE, content, display: true, attribution: "user" },
-      { triggerTurn: true, deliverAs: "followUp" },
-    );
+    try {
+      pi.sendMessage(
+        { customType: TICK_CUSTOM_TYPE, content, display: true, attribution: "user" },
+        { triggerTurn: true, deliverAs: "followUp" },
+      );
+    } catch (err) {
+      const pendingIndex = session.pendingLocalTicks.indexOf(pendingLocalTick);
+      if (pendingIndex >= 0) session.pendingLocalTicks.splice(pendingIndex, 1);
+      throw err;
+    }
     if (scope.projectName !== undefined && frictionSignals.length > 0) {
       try {
         frictionStore?.markFrictionSurfaced(
@@ -1635,8 +2004,10 @@ export default function orchestratorTickExtension(pi: TickApi): void {
     approvalToolMissingLogged: false,
     bridgeTokenAtStart: true,
     pendingSkips: 0,
+    pendingLocalTicks: [],
   };
   let releaseGateArmed = false;
+  let availabilityGateArmed = false;
   let guardArmed = false;
   // An activation file makes this a fleet directory before Herdr can prove
   // which pane owns it. The gate therefore starts closed and only honours a
@@ -1683,9 +2054,17 @@ export default function orchestratorTickExtension(pi: TickApi): void {
       // `createSession`; suppress this second copy only after this session has
       // proved it owns the external heartbeat.
       if (releaseAuthorityAccepted && !external) return undefined;
+      // Before ownership is proved this session holds no grant at all, so a
+      // covered shape still refuses with the deny-all wording.
+      const decision = refusal ?? releaseRefusal(DENIED_RELEASE_GRANTS, "orchestrator", shape);
+      if (decision === undefined) return undefined;
       if (projectName !== undefined) {
         try {
-          recordReleaseBlock(projectName, "orchestrator", shape);
+          recordReleaseBlock(projectName, "orchestrator", shape, {
+            tool: event.toolName,
+            reason: decision.reason,
+            args: redactReleaseArgs(event.input),
+          });
         } catch (err) {
           pi.logger.error(
             `[omp-conductor] could not record release-policy block: ${
@@ -1694,13 +2073,65 @@ export default function orchestratorTickExtension(pi: TickApi): void {
           );
         }
       }
-      // Before ownership is proved this session holds no grant at all, so a
-      // covered shape still refuses — with the wording it would get from a
-      // deny-all map rather than a claim about a grant it cannot yet use.
-      return refusal ?? releaseRefusal(DENIED_RELEASE_GRANTS, "orchestrator", shape);
+      return decision;
     });
   };
 
+  const armAvailabilityGate = (): void => {
+    if (availabilityGateArmed) return;
+    availabilityGateArmed = true;
+
+    // Custom messages sent with `pi.sendMessage` bypass `before_agent_start`.
+    // `message_start` is the first lifecycle event that carries their exact
+    // custom type, so it is the reliable boundary between a local tick and an
+    // inbound human turn.
+    pi.on("message_start", (event) => {
+      const message = event.message;
+      if (message.role === "custom" && message.customType === TICK_CUSTOM_TYPE) {
+        const pending = session.pendingLocalTicks.shift();
+        if (pending !== undefined) {
+          session.activeLocalTick = { ...pending, humanWaiting: false };
+        } else {
+          // A queued custom tick can survive a host restart after the in-memory
+          // enqueue record does not. Reconstruct its scope so recovery cannot
+          // silently turn an autonomous run into an interactive one.
+          const scope = resolveTickScope();
+          const id =
+            typeof message.timestamp === "number"
+              ? createHash("sha256").update(`recovered-tick\0${message.timestamp}`).digest("hex")
+              : randomUUID();
+          session.activeLocalTick = {
+            id,
+            ...(scope.projectName === undefined ? {} : { projectName: scope.projectName }),
+            ...(scope.policy === undefined ? {} : { policy: scope.policy }),
+            humanWaiting: false,
+          };
+        }
+        return;
+      }
+      if (
+        session.activeLocalTick !== undefined &&
+        message.role === "user" &&
+        message.synthetic !== true &&
+        message.attribution !== "agent"
+      ) {
+        session.activeLocalTick.humanWaiting = true;
+      }
+    });
+    pi.on("agent_end", () => {
+      session.activeLocalTick = undefined;
+    });
+    (pi as TickApi & {
+      on(
+        event: "tool_call",
+        handler: (
+          event: { toolName: string; input: Record<string, unknown> },
+          ctx: unknown,
+        ) => TelegramInterruptBlock | undefined,
+      ): void;
+    }).on("tool_call", (event) => autonomousTelegramInterruptBlock(pi, session, event));
+  };
+
   pi.on("session_start", (_event, ctx) => {
     if (decided) return;
 
@@ -1728,6 +2159,7 @@ export default function orchestratorTickExtension(pi: TickApi): void {
     // Present but invalid still identifies a fleet directory. Install the
     // fail-closed handler before validation or ownership can return early.
     armReleaseGate();
+    armAvailabilityGate();
 
     if (result.kind === "invalid") {
       const detail = `${result.path}: ${result.problem}`;