omp-conductor 0.12.0 → 0.14.0

package/src/orchestrator.ts

@@ -33,6 +33,7 @@ import { stateDir } from "./config.ts";
 import { formatEscalation } from "./escalate.ts";
 import { createSession, disposeSession } from "./omp.ts";
 import type { AgentSessionLike } from "./omp.ts";
+import type { ReleaseBlockContext } from "./release-policy.ts";
 import type { Escalation, ReleaseShape, ResolvedGrants, SessionRole } from "./types.ts";
 
 /**
@@ -46,7 +47,7 @@ export type CreateSessionFn = (opts: {
   resume?: boolean;
   role: SessionRole;
   releaseGrants?: ResolvedGrants;
-  onReleaseBlocked?: (shape: ReleaseShape) => void;
+  onReleaseBlocked?: (shape: ReleaseShape, context: ReleaseBlockContext) => void;
   onSpawn?: (pid: number) => void;
   socketPath?: string;
   verbSocketPath?: string;
@@ -84,7 +85,7 @@ export interface OrchestratorOpts {
   sessionDir?: string;
   model?: string;
   releaseGrants?: ResolvedGrants;
-  onReleaseBlocked?: (shape: ReleaseShape) => void;
+  onReleaseBlocked?: (shape: ReleaseShape, context: ReleaseBlockContext) => void;
   /** The child's pid, the instant it exists. See {@link VerbListener.bindPid}. */
   onSpawn?: (pid: number) => void;
   /** Control socket for the session child, beside its own working directory. */

package/src/plugin.ts

@@ -83,10 +83,14 @@ import {
   DEFAULT_CAPS,
   DRAFT_POLICIES,
   RELEASE_REQUIREMENTS,
+  INTERRUPT_CATEGORIES,
   RELEASE_SHAPES,
+  WEEKDAYS,
   type Caps,
   type ConductorConfig,
   type OrchestratorMode,
+  type InterruptCategory,
+  type Weekday,
   type ProjectConfig,
   type ProjectPolicy,
   type ReleaseRequirement,
@@ -230,6 +234,7 @@ async function askValid(
   throw new Cancelled();
 }
 
+
 /** A cap. Unparseable input keeps the current value rather than writing a NaN
  *  the validator would later reject — the operator sees why, immediately. */
 async function askNumber(ctx: CommandContext, title: string, fallback: number): Promise<number> {
@@ -794,7 +799,8 @@ const askCaps: AreaAsker = async (ctx, a) => {
   const tuneCaps = await ctx.ui.confirm(
     "Caps",
     `Defaults: ${workersDefault} workers, ` +
-      `${spendLabel}, ${DEFAULT_CAPS.workerMaxTurns} turns and ` +
+      `${spendLabel}, ${DEFAULT_CAPS.workerMaxTurns} base / ` +
+      `${DEFAULT_CAPS.workerMaxTurnsCeiling} max turns and ` +
       `${Math.round(DEFAULT_CAPS.workerWallClockMs / 60000)} min per worker, ` +
       `${DEFAULT_CAPS.maxAttemptsPerIssue} failed attempts and ` +
       `${DEFAULT_CAPS.maxContinuationsPerIssue} operational continuations per issue.${smallHostNote} Change them?`,
@@ -821,7 +827,32 @@ const askCaps: AreaAsker = async (ctx, a) => {
     "Spend ceiling per rolling day (USD) — blank = no spend cap",
     caps.dailySpendUsd !== undefined ? caps.dailySpendUsd : DEFAULT_CAPS.dailySpendUsd,
   );
-  caps.workerMaxTurns = await askNumber(ctx, "Turn ceiling per worker", caps.workerMaxTurns ?? DEFAULT_CAPS.workerMaxTurns);
+  const workerMaxTurns = await askNumber(
+    ctx,
+    "Turn ceiling per worker",
+    caps.workerMaxTurns ?? DEFAULT_CAPS.workerMaxTurns,
+  );
+  caps.workerMaxTurns = workerMaxTurns;
+  const turnCeilingFallback = Math.max(
+    workerMaxTurns,
+    caps.workerMaxTurnsCeiling ??
+      Math.min(workerMaxTurns * 2, Number.MAX_SAFE_INTEGER),
+  );
+  const workerMaxTurnsCeiling = await askNumber(
+    ctx,
+    "Maximum turn ceiling for one issue",
+    turnCeilingFallback,
+  );
+  if (workerMaxTurnsCeiling < workerMaxTurns) {
+    ctx.ui.notify(
+      `Maximum turn ceiling ${workerMaxTurnsCeiling} cannot be below the ` +
+        `${workerMaxTurns}-turn worker base — keeping ${turnCeilingFallback}.`,
+      "warning",
+    );
+    caps.workerMaxTurnsCeiling = turnCeilingFallback;
+  } else {
+    caps.workerMaxTurnsCeiling = workerMaxTurnsCeiling;
+  }
   caps.workerWallClockMs = await askNumber(
     ctx,
     "Wall-clock ceiling per worker (ms)",
@@ -898,22 +929,143 @@ const askEscalation: AreaAsker = async (ctx, a) => {
   return next;
 };
 
-/** How loud the orchestrator is when nobody asked it anything. */
+/** How loud the orchestrator is and when the operator permits interruptions. */
 const askReporting: AreaAsker = async (ctx, a) => {
   const reportScope = await askReportScope(ctx, a.reportScope);
-  if (reportScope !== "quiet") return { ...a, reportScope };
-  // `quiet` picks the explicit form, whose only free parameter is when the
-  // daily rollup happens. Blank = whenever the orchestrator composes it.
-  const at = await ctx.ui.input(
-    "Daily rollup time, 24h HH:MM (blank = whenever the orchestrator composes it):",
-    a.quietDigestAt,
+  const continuous = "Continuous (24-hour interrupts)";
+  const weekly = "Weekly availability window";
+  const mode = await ctx.ui.select(
+    "Operator availability",
+    [
+      {
+        label: continuous,
+        description: "preserve legacy behavior: configured interrupt categories may page at any hour",
+      },
+      {
+        label: weekly,
+        description: "hold non-bypass interruptions outside selected local working hours",
+      },
+    ],
+    { initialIndex: a.availability === undefined ? 0 : 1 },
   );
-  const trimmed = at?.trim() ?? "";
-  if (trimmed !== "" && !/^([01]\d|2[0-3]):[0-5]\d$/.test(trimmed)) {
-    ctx.ui.notify(`"${trimmed}" is not a 24h HH:MM time — leaving the digest model-timed.`, "warning");
-    return { ...a, reportScope };
+  if (mode === undefined) throw new Cancelled();
+
+  const next: SetupAnswers = { ...a, reportScope };
+  delete next.preservedReporting;
+  delete next.availability;
+  const applyDigestSchedule = (raw: string): SetupAnswers => {
+    const updated = { ...next };
+    delete updated.dailyDigestAt;
+    const value = raw.trim().toLowerCase();
+    if (value === "per-tick") {
+      updated.digestCadence = "per-tick";
+    } else if (value === "off" || value === "disabled" || value === "none") {
+      updated.digestCadence = "none";
+    } else if (value === "model-timed" || value === "daily") {
+      updated.digestCadence = "daily";
+    } else {
+      updated.digestCadence = "daily";
+      updated.dailyDigestAt = raw;
+    }
+    return updated;
+  };
+  const askDigestSchedule = async (fallback: string): Promise<SetupAnswers> => {
+    const shown =
+      a.digestCadence === "per-tick"
+        ? "per-tick"
+        : a.digestCadence === "none"
+          ? "off"
+          : a.dailyDigestAt ?? (a.digestCadence === "daily" ? "model-timed" : fallback);
+    const schedule = await askValid(
+      ctx,
+      'Daily rollup time in that timezone / digest cadence ("per-tick", "model-timed", "off", or 24h HH:MM)',
+      shown,
+      (value) =>
+        ["per-tick", "model-timed", "daily", "none", "off", "disabled"].includes(
+          value.toLowerCase(),
+        ) || /^([01]\d|2[0-3]):[0-5]\d$/.test(value)
+          ? undefined
+          : 'Use "per-tick", "model-timed", "off", or a 24h HH:MM time.',
+    );
+    return applyDigestSchedule(schedule);
+  };
+
+  if (mode !== weekly) {
+    if (mode !== continuous) {
+      ctx.ui.notify(`Unrecognised availability choice "${mode}" — keeping 24-hour interrupts.`, "warning");
+    }
+    if (reportScope !== "quiet") return next;
+    return await askDigestSchedule("model-timed");
   }
-  return { ...a, reportScope, ...(trimmed === "" ? {} : { quietDigestAt: trimmed }) };
+
+  const defaultZone =
+    a.reportingTimezone ?? Intl.DateTimeFormat().resolvedOptions().timeZone ?? "UTC";
+  const reportingTimezone = await askValid(
+    ctx,
+    "Operator timezone (IANA, for example Europe/London)",
+    defaultZone,
+    (value) => {
+      try {
+        new Intl.DateTimeFormat("en", { timeZone: value }).format();
+        return undefined;
+      } catch {
+        return `"${value}" is not a known IANA timezone.`;
+      }
+    },
+  );
+  const daysText = await askValid(
+    ctx,
+    "Working weekdays (comma-separated: mon,tue,wed,thu,fri,sat,sun)",
+    a.availability?.days.join(",") ?? "mon,tue,wed,thu,fri",
+    (value) => {
+      const days = value.split(",").map((day) => day.trim().toLowerCase());
+      if (days.length === 0 || days.some((day) => !WEEKDAYS.includes(day as Weekday))) {
+        return `Use only: ${WEEKDAYS.join(",")}.`;
+      }
+      return new Set(days).size === days.length ? undefined : "List each weekday only once.";
+    },
+  );
+  const days = daysText.split(",").map((day) => day.trim().toLowerCase() as Weekday);
+  const start = await askValid(
+    ctx,
+    "Availability starts (24h HH:MM)",
+    a.availability?.start ?? "09:00",
+    (value) => (/^([01]\d|2[0-3]):[0-5]\d$/.test(value) ? undefined : "Use 24h HH:MM."),
+  );
+  const end = await askValid(
+    ctx,
+    "Availability ends (24h HH:MM)",
+    a.availability?.end ?? "17:00",
+    (value) =>
+      !/^([01]\d|2[0-3]):[0-5]\d$/.test(value)
+        ? "Use 24h HH:MM."
+        : value === start
+          ? "Start and end must differ."
+          : undefined,
+  );
+  const bypassText = await askValid(
+    ctx,
+    `Quiet-hours bypass categories (comma-separated; "none" = none; choices: ${INTERRUPT_CATEGORIES.join(",")})`,
+    a.availability === undefined ? "fleet-stopped" : a.availability.bypass.join(",") || "none",
+    (value) => {
+      if (value.toLowerCase() === "none") return undefined;
+      const categories = value.split(",").map((category) => category.trim().toLowerCase());
+      if (categories.some((category) => !INTERRUPT_CATEGORIES.includes(category as InterruptCategory))) {
+        return `Use only: ${INTERRUPT_CATEGORIES.join(",")}, or "none".`;
+      }
+      return new Set(categories).size === categories.length ? undefined : "List each category only once.";
+    },
+  );
+  const bypass =
+    bypassText.toLowerCase() === "none"
+      ? []
+      : bypassText.split(",").map((category) => category.trim().toLowerCase() as InterruptCategory);
+  const scheduled = await askDigestSchedule(end);
+  return {
+    ...scheduled,
+    reportingTimezone,
+    availability: { days, start, end, bypass },
+  };
 };
 
 /** The operator's own brief. Asked last in the full interview, because the

package/src/release-policy.ts

@@ -36,11 +36,19 @@ import type { ReleaseShape, ResolvedGrants, SessionRole } from "./types.ts";
 
 export const RELEASE_POLICY_AUDIT_FILE = "release-policy-blocks.jsonl";
 
-export interface ReleaseBlock {
+export interface ReleaseBlockContext {
+  tool: string;
+  reason: string;
+  args: Record<string, string>;
+}
+
+export interface ReleaseBlock extends Partial<ReleaseBlockContext> {
   project: string;
   source: "worker" | "orchestrator";
   shape: ReleaseShape;
   at: string;
+  issue?: number;
+  runId?: string;
 }
 
 export type ReleaseDecision = { block: true; reason: string };
@@ -271,6 +279,32 @@ export function releaseDecision(
   return decision === undefined ? undefined : { shape, decision };
 }
 
+const RELEASE_ARG_ALLOWLIST = new Set([
+  "repo",
+  "stack",
+  "artefact",
+  "artifact",
+  "environment",
+  "tag",
+  "version",
+  "image",
+  "prUrl",
+  "branch",
+  "service",
+]);
+
+/** Keep only explicitly safe release-target strings; redact every other value. */
+export function redactReleaseArgs(input: Record<string, unknown>): Record<string, string> {
+  const redacted: Record<string, string> = {};
+  for (const [key, value] of Object.entries(input)) {
+    redacted[key] =
+      RELEASE_ARG_ALLOWLIST.has(key) && typeof value === "string"
+        ? value.slice(0, 120)
+        : "(redacted)";
+  }
+  return redacted;
+}
+
 interface ReleasePolicyPi {
   on(
     event: "tool_call",
@@ -285,14 +319,18 @@ interface ReleasePolicyPi {
 export function releasePolicyTripwire(
   grants: ResolvedGrants,
   role: SessionRole,
-  onBlocked: (shape: ReleaseShape) => void = () => {},
+  onBlocked: (shape: ReleaseShape, context: ReleaseBlockContext) => void = () => {},
 ): (pi: ReleasePolicyPi) => void {
   return (pi) => {
     pi.on("tool_call", (event) => {
       const blocked = releaseDecision(grants, role, event.toolName, event.input);
       if (blocked === undefined) return undefined;
       try {
-        onBlocked(blocked.shape);
+        onBlocked(blocked.shape, {
+          tool: event.toolName,
+          reason: blocked.decision.reason,
+          args: redactReleaseArgs(event.input),
+        });
       } catch {
         // Audit is evidence, not the gate. A full disk must not turn a deny into allow.
       }
@@ -305,11 +343,22 @@ export function recordReleaseBlock(
   project: string,
   source: ReleaseBlock["source"],
   shape: ReleaseShape,
+  details: Omit<ReleaseBlock, "project" | "source" | "shape" | "at"> = {},
   root = stateDir(),
   now = new Date(),
 ): void {
   mkdirSync(root, { recursive: true });
-  const record: ReleaseBlock = { project, source, shape, at: now.toISOString() };
+  // Redact again at the durable boundary. Callers normally pass the tripwire's
+  // already-safe context, but no alternate recorder path gets to rely on that.
+  const { args, ...attribution } = details;
+  const record: ReleaseBlock = {
+    project,
+    source,
+    shape,
+    ...attribution,
+    ...(args === undefined ? {} : { args: redactReleaseArgs(args) }),
+    at: now.toISOString(),
+  };
   appendFileSync(join(root, RELEASE_POLICY_AUDIT_FILE), `${JSON.stringify(record)}\n`, { mode: 0o600 });
 }
 
@@ -354,12 +403,23 @@ export function releaseDriftToday(
   return latest === undefined ? undefined : { count, latest };
 }
 
-export function releaseDriftDigestLine(project: string, root = stateDir(), now = new Date()): string | undefined {
+export function releaseDriftDigestLine(
+  project: string,
+  root = stateDir(),
+  now = new Date(),
+): string | undefined {
   const drift = releaseDriftToday(project, root, now);
   if (drift === undefined) return undefined;
+  const latest = drift.latest;
+  const attribution = [
+    `${latest.source} ${latest.shape} at ${latest.at}`,
+    ...(latest.issue === undefined ? [] : [`issue #${latest.issue}`]),
+    ...(latest.runId === undefined ? [] : [`run ${latest.runId}`]),
+    ...(latest.tool === undefined ? [] : [`tool ${latest.tool}`]),
+  ].join(", ");
   return (
     `Release-policy drift today: ${drift.count} release/deploy tool call(s) were blocked ` +
-    `(latest: ${drift.latest.source} ${drift.latest.shape} at ${drift.latest.at}). ` +
+    `(latest: ${attribution}). ` +
     "Include this divergence from releasePolicy=none in today's digest."
   );
 }

package/src/reports.ts

@@ -36,9 +36,21 @@
  * conclusion leaves something for the next pass to pick up.
  */
 
+import { availabilityDisposition, interruptDisposition } from "./availability.ts";
 import { readTelegramToken, sendTelegram, TelegramSendError } from "./escalate.ts";
 import { localDayKey } from "./digest-schedule.ts";
-import type { Escalation, ProjectConfig, ReportRecord, Store } from "./types.ts";
+import {
+  DIGEST_BACKLOG_LIMIT,
+  INTERRUPT_CATEGORIES,
+  type DigestBacklog,
+  type Escalation,
+  type HeldNotice,
+  type InterruptCategory,
+  type ProjectConfig,
+  type ReportEnqueue,
+  type ReportRecord,
+  type Store,
+} from "./types.ts";
 
 /**
  * Attempts before a report is written off. Six attempts across the backoff
@@ -85,6 +97,8 @@ export type ReportSend = (text: string) => Promise<number | undefined>;
 /** What one pass did, by report id. Returned for the daemon's log and the tests. */
 export interface ReportDeliveryPass {
   delivered: string[];
+  /** Material reports preserved without sending after policy or availability changed. */
+  deferred: string[];
   /** Known-failed, back in `pending` behind a backoff. */
   requeued: string[];
   /** The attempt ended without an answer. Left `sending` and flagged as a
@@ -108,7 +122,8 @@ export interface ReportOutbox {
 }
 
 export interface ReportOutboxDeps {
-  project: ProjectConfig;
+  /** A provider lets a resident daemon apply config edits at the next tick. */
+  project: ProjectConfig | (() => ProjectConfig);
   store: Store;
   /** A report nobody can deliver escalates through this. Optional so a unit
    *  test can exercise delivery without wiring an escalator. */
@@ -116,6 +131,8 @@ export interface ReportOutboxDeps {
   send?: ReportSend;
   now?: () => number;
   log?: (msg: string) => void;
+  /** False while the resident daemon cannot validate live delivery policy. */
+  deliveryAllowed?: () => boolean;
 }
 
 /**
@@ -200,6 +217,20 @@ export function formatOpenReports(
   return lines;
 }
 
+/** Durable rows still owed to a future digest. Always rendered in `status`: a
+ * quiet line proves the accumulator is empty, while a non-zero line makes loss
+ * or backlog visible without asking the session what it remembers. */
+export function formatDigestBacklog(backlog: DigestBacklog, now: number = Date.now()): string[] {
+  const age = (at: number | undefined): string =>
+    at === undefined ? "" : ` (oldest ${humanAge(Math.max(0, now - at))})`;
+  return [
+    "",
+    "digest backlog",
+    `  material events    ${backlog.materialCount}${age(backlog.materialOldestAt)}`,
+    `  held escalations   ${backlog.heldNoticeCount}${age(backlog.heldNoticeOldestAt)}`,
+  ];
+}
+
 function openReportDetail(r: ReportRecord, now: number): string {
   const flat = r.lastError?.replace(/\s+/g, " ").trim() ?? "";
   const error =
@@ -257,10 +288,115 @@ export function telegramReportSend(p: ProjectConfig): ReportSend {
   };
 }
 
+/** Keep the mechanical catch-up comfortably inside Telegram's report wrapper. */
+const AVAILABILITY_REPORT_BODY_LIMIT = 3_200;
+const AVAILABILITY_REPORT_KEY_PREFIX = "availability/";
+
+interface AvailabilityReportMarker {
+  categories: InterruptCategory[];
+  urgent: boolean;
+}
+
+function availabilityReportMarker(report: ReportRecord): AvailabilityReportMarker | undefined {
+  const key = report.dedupeKey;
+  if (key === undefined || !key.startsWith(AVAILABILITY_REPORT_KEY_PREFIX)) return undefined;
+  const parts = key.slice(AVAILABILITY_REPORT_KEY_PREFIX.length).split("/");
+  const urgent = parts[0] === "urgent";
+  const encoded = (urgent ? parts[1] : parts[0]) ?? "";
+  return {
+    urgent,
+    categories: encoded
+      .split(",")
+      .filter((category): category is InterruptCategory =>
+        INTERRUPT_CATEGORIES.includes(category as InterruptCategory),
+      ),
+  };
+}
+
+function availabilityNoticeLine(notice: HeldNotice): string {
+  const flat = (text: string, limit: number): string => {
+    const value = text.replace(/\s+/g, " ").trim();
+    return value.length <= limit ? value : `${value.slice(0, limit - 1)}…`;
+  };
+  return (
+    `- [${notice.category}] ${flat(notice.summary, 180)} ` +
+    `(${new Date(notice.createdAt).toISOString()}) — ${flat(notice.detail, 240)}`
+  );
+}
+
+/**
+ * Hand availability-held notices to the existing durable outbox when the live
+ * policy permits them again. Association and report creation are one SQLite
+ * transaction, so daemon downtime or a send failure cannot lose a notice.
+ */
+export function enqueueAvailableHeldNotices(
+  project: ProjectConfig,
+  store: Store,
+  now: number,
+): ReportEnqueue | undefined {
+  // The Store arbitrates the due-digest lease and this catch-up in the same
+  // SQLite transaction. A preflight here would reopen the snapshot race.
+  const categories = INTERRUPT_CATEGORIES.filter(
+    (category) => interruptDisposition(project.reporting, category, now) === "interrupt",
+  );
+  const urgentCategories = INTERRUPT_CATEGORIES.filter(
+    (category) =>
+      availabilityDisposition(project.reporting?.availability, category, now) === "interrupt",
+  );
+  const urgent = store.undigestedNotices(
+    project.name,
+    DIGEST_BACKLOG_LIMIT,
+    true,
+    urgentCategories,
+    true,
+  );
+  const eligible =
+    urgent.length > 0
+      ? urgent
+      : store.undigestedNotices(
+          project.name,
+          DIGEST_BACKLOG_LIMIT,
+          true,
+          categories,
+          false,
+        );
+  if (eligible.length === 0) return undefined;
+
+  const lines = [
+    "Working-hours catch-up",
+    "These interruptions were held durably while the operator was outside the configured availability window:",
+  ];
+  const selected: HeldNotice[] = [];
+  for (const notice of eligible) {
+    const line = availabilityNoticeLine(notice);
+    const next = [...lines, line].join("\n");
+    if (selected.length > 0 && next.length > AVAILABILITY_REPORT_BODY_LIMIT) break;
+    lines.push(line);
+    selected.push(notice);
+  }
+
+  const selectedCategories = INTERRUPT_CATEGORIES.filter((category) =>
+    selected.some((notice) => notice.category === category),
+  );
+  const urgentMarker = selected[0]?.urgent === true ? "urgent/" : "";
+  return store.enqueueAvailabilityReport(
+    {
+      project: project.name,
+      kind: "digest",
+      body: lines.join("\n"),
+      dedupeKey: `${AVAILABILITY_REPORT_KEY_PREFIX}${urgentMarker}${selectedCategories.join(",")}/${selected[0]!.id}`,
+      at: now,
+    },
+    selected.map((notice) => notice.id),
+  );
+}
+
 export function createReportOutbox(deps: ReportOutboxDeps): ReportOutbox {
-  const { project, store } = deps;
+  const { store } = deps;
+  const currentProject =
+    typeof deps.project === "function" ? deps.project : (): ProjectConfig => deps.project as ProjectConfig;
   const now = deps.now ?? Date.now;
-  const send = deps.send ?? telegramReportSend(project);
+  const injectedSend = deps.send;
   const log = deps.log ?? ((): void => {});
 
   /**
@@ -279,6 +415,7 @@ export function createReportOutbox(deps: ReportOutboxDeps): ReportOutbox {
    * undeliverable report pages exactly once and never every five minutes.
    */
   const pageUndeliverable = async (r: ReportRecord, error: string): Promise<void> => {
+    const project = currentProject();
     if (deps.escalate === undefined) return;
     try {
       await deps.escalate({
@@ -318,6 +455,64 @@ export function createReportOutbox(deps: ReportOutboxDeps): ReportOutbox {
   };
 
   const attempt = async (r: ReportRecord, pass: ReportDeliveryPass): Promise<void> => {
+    const project = currentProject();
+    if (deps.deliveryAllowed?.() === false) {
+      pass.deferred.push(r.id);
+      return;
+    }
+    const availabilityMarker = availabilityReportMarker(r);
+    if (availabilityMarker !== undefined) {
+      if (availabilityMarker.categories.length === 0) {
+        pass.deferred.push(r.id);
+        log(`availability catch-up ${r.id} has no valid category marker and was held fail-closed`);
+        return;
+      }
+      const dispositions = availabilityMarker.categories.map((category) =>
+        availabilityMarker.urgent
+          ? availabilityDisposition(project.reporting?.availability, category, now())
+          : interruptDisposition(project.reporting, category, now()),
+      );
+      if (dispositions.some((disposition) => disposition !== "interrupt")) {
+        if (store.releasePendingAvailabilityReport(r.id, project.name, r.ambiguous)) {
+          const reason = dispositions.includes("digest")
+            ? "reporting policy changed"
+            : "the availability window closed";
+          log(`availability catch-up ${r.id} returned to the digest because ${reason}`);
+        }
+        pass.deferred.push(r.id);
+        return;
+      }
+    }
+    if (r.kind === "material") {
+      const at = now();
+      const disposition = interruptDisposition(project.reporting, "material", at);
+      if (disposition !== "interrupt") {
+        const firstLine = r.body.split("\n", 1)[0]!;
+        const deferred = store.deferPendingReportToNotice(r.id, {
+          id: r.id,
+          project: project.name,
+          category: "material",
+          summary: (
+            r.ambiguous ? `POSSIBLE REPEAT of report ${r.id}: ${firstLine}` : firstLine
+          ).slice(0, 240),
+          detail: r.ambiguous
+            ? `This report may already have reached Telegram before its outcome was lost.\n\n${r.body}`
+            : r.body,
+          createdAt: at,
+          ...(disposition === "availability" ? { releaseOnAvailable: true } : {}),
+        });
+        if (deferred) {
+          pass.deferred.push(r.id);
+          log(
+            `report ${r.id} preserved for ${
+              disposition === "availability" ? "the next availability window" : "a digest"
+            } after reporting policy changed`,
+          );
+          return;
+        }
+      }
+    }
+    const send = injectedSend ?? telegramReportSend(project);
     const attemptId = crypto.randomUUID();
     // Losing this race is ordinary: another pass, or another daemon, already
     // owns the attempt. Returning is what keeps one report from being in flight
@@ -400,12 +595,14 @@ export function createReportOutbox(deps: ReportOutboxDeps): ReportOutbox {
 
   return {
     recover(staleAt: number): ReportRecord[] {
-      return store.recoverSendingReports(project.name, staleAt, now());
+      return store.recoverSendingReports(currentProject().name, staleAt, now());
     },
 
     async deliverDue(): Promise<ReportDeliveryPass> {
+      const project = currentProject();
       const pass: ReportDeliveryPass = {
         delivered: [],
+        deferred: [],
         requeued: [],
         uncertain: [],
         failed: [],

package/src/session-host.ts

@@ -22,6 +22,7 @@
 import { connect } from "node:net";
 
 import { createLocalSession, disposeSession, type AgentSessionLike } from "./omp.ts";
+import type { ReleaseBlockContext } from "./release-policy.ts";
 
 import type { ReleaseShape, ResolvedGrants, SessionRole } from "./types.ts";
 
@@ -65,7 +66,7 @@ export type HostToParent =
   | { t: "session-file"; path: string }
   | { t: "prompt-result"; id: number; ok: boolean; error?: string }
   | { t: "park-result"; id: number; ok: boolean; error?: string }
-  | { t: "release-blocked"; shape: ReleaseShape };
+  | ({ t: "release-blocked"; shape: ReleaseShape } & ReleaseBlockContext);
 
 /**
  * Depth at which a harness event stops being copied for the wire.
@@ -186,8 +187,8 @@ export async function runSessionHost(
       // The release audit lives in the daemon's state directory, which this
       // process may not be able to write and must not be trusted to. It
       // becomes a message; the parent performs the durable write.
-      onReleaseBlocked: (shape) => {
-        send({ t: "release-blocked", shape });
+      onReleaseBlocked: (shape, context) => {
+        send({ t: "release-blocked", shape, ...context });
       },
     });
   } catch (err) {