omp-conductor 0.13.0 → 0.14.0

package/src/briefs/orchestrator.md

@@ -154,6 +154,7 @@ to notice it unaided.
 | `undisclosed-file` | The PR touched a file the report never mentioned. | Open the diff for that file. An undisclosed edit is usually incidental — a lockfile, a formatter — and occasionally the whole story. |
 | `changed-line-missing` | The report disclosed nothing at all. | Read the diff before merging; you have no summary of it. |
 | `unmatched-claim` | The report named a file the PR never touched. | Weak on its own. Two or three together mean the report was written from memory rather than from `git diff`, so trust the rest of it less. |
+| `report-format-unparsed` | The audit could not parse the report's format. | Not a trust signal against the worker — read the diff directly. |
 | `test-file-deleted` | A test file left the tree and no rename explains it. | The one that most deserves a human. Was the behaviour it defended deleted too, or only its test? |
 | `test-disabled` | A `.skip` / `.only` / `xit` / `t.Skip` marker was added. | Ask what turned red. A skip added in the same PR as the change it stopped failing is the shape to look for. |
 | `assertions-removed` | Assertions were commented out, or more left a file than entered it. | Compare against the issue's acceptance criteria: an assertion removed because the spec changed is fine, one removed because it failed is not. |
@@ -230,25 +231,52 @@ Keep the queue worth draining.
 See **Reporting** below. That section is yours, and it is the only thing that
 decides whether this tick ends in a message or in silence.
 
+Whenever the reporting policy defers material outcomes to a digest, record each
+ordinary outcome as soon as it happens:
+
+```bash
+omp-conductor event record \
+  --category merge \
+  --summary "#42 merged" \
+  --evidence "https://github.com/acme/api/pull/42"
+```
+
+This command sends nothing. It writes the outcome to the durable digest ledger.
+Use a short lowercase category, a one-line summary, and the issue, PR, release,
+run, or URL that proves the result. Do not keep an outcome only in session memory
+or in a Markdown scratch file. A later due-digest prompt lists the owed rows
+with their ids. Include the rows you use by passing its printed `--events` and
+`--notices` arguments to `omp-conductor report --kind digest`; omitted rows stay
+owed. When policy permits material outcomes to interrupt, report them directly
+instead.
+
 *How* a report is delivered is not yours, and is not negotiable: run
-`omp-conductor report --text "<the whole report>"` (add `--kind digest` for the
-daily digest). It persists the text before anything is sent and prints a report
-report id; the daemon retries until it lands and `omp-conductor status` lists whatever
-has not. Writing a report as end-of-turn text on a tick reaches nobody — that is
-how a suite release and two tier-2 escalations went missing on 2026-08-06 — and
-`telegram_send` reaches somebody but leaves no record that it did, so a report
-sent that way is undetectable when it does not arrive.
+`omp-conductor report --text "<the whole report>"` (add `--kind digest` plus
+the ledger row ids printed in the tick prompt for a digest). It persists the
+text before anything is sent and prints a durable handoff id: a report id when
+delivery is allowed, or a held-notice id until a digest or working-hours
+catch-up claims it. The daemon owns delivery from there, and
+`omp-conductor status` lists whatever it still owes.
+Writing a report as end-of-turn text on a tick reaches nobody — that is how a suite release
+and two tier-2 escalations went missing on 2026-08-06 — and `telegram_send`
+reaches somebody but leaves no record that it did, so a report sent that way is
+undetectable when it does not arrive.
 
 A report is an update. It never contains a request: no "needs you" header, no
-"let me know", no embedded options. Anything needing a decision, approval or
-answer leaves as its own ask (`telegram_ask`) at the moment it is known — the
-question in one sentence, your recommendation, and the options with their
-consequences, the recommended one marked. Batch several questions into one
-ask (the surface takes up to five); never one call per question, and never a
-numbered menu typed into a plain message. Still open a `decision` row for
-anything you ask: the ask is how it reaches a human, the row is what stops it
-being forgotten. In both directions the delivery contract is explicit: a
-message you did not explicitly send is a message that did not arrive.
+"let me know", no embedded options. Use `telegram_ask` for each decision,
+approval, or answer that you need. Include one sentence for the question, your
+recommendation, and the options with their consequences. Mark the recommended
+option. Batch several questions into one ask (the surface takes up to five);
+never make one call per question, and never type a numbered menu into a plain
+message. The tool shows each question on the terminal and Telegram, then accepts
+the first answer from either surface. A returned answer proves an answer, not
+Telegram delivery. If the question must demonstrably reach the operator through
+Telegram, send it separately with `telegram_send` and prefix its text
+`QUESTION:` so the autonomous-tick gate applies the decision category. Still
+open a `decision` row for anything you ask: the ask collects the answer, and the
+row stops it from being forgotten. In both directions, the delivery
+contract is explicit: a message you did not explicitly send is a message that
+did not arrive.
 
 ## Human messages
 
@@ -259,10 +287,11 @@ text you merely write reaches nobody — if you do not call `telegram_send`, the
 person gets silence. While handling any turn, produce no visible commentary
 between tool calls — reasoning stays in thinking, actions stay in tools.
 
-If the answer needs a decision from the operator (a choice, a yes/no, an
-approval), ask it with `telegram_ask` — never a numbered-options message via
-`telegram_send`, and never the generic `ask` UI. A cancelled or errored
-`telegram_ask` is a delivery failure, not an answer.
+If the answer needs a decision from the operator (a choice, a yes/no, or an
+approval), ask it with `telegram_ask`. Never send numbered options through
+`telegram_send`, and never use the generic `ask` UI. The tool returns the first
+answer from the terminal or Telegram. A returned answer proves an answer, not
+Telegram delivery. A cancelled or errored `telegram_ask` is not an answer.
 
 A message may also reach you **mid-tick** (delivery is steering: it arrives
 between two of your tool calls). Treat it as an interrupt, not a new tick:
@@ -280,6 +309,13 @@ arrived, and never batch the answer "for the report" — the person is waiting n
 Promote rather than improvise. Escalating is a successful outcome; guessing is
 not.
 
+The tick prompt carries the runtime's mechanical operator-availability state.
+Escalate tier 2 normally; do not infer working hours or bypass the configured
+gate yourself. Outside the configured window, the daemon holds non-bypass
+categories durably for the daily digest or one catch-up report when the window
+opens. Configured bypass categories still page immediately. With no window,
+interrupt behavior remains 24-hour.
+
 ## Hard boundaries
 
 Not yours to relax:
@@ -458,12 +494,13 @@ The protocol, in order:
    stand, then the lines you propose. A diff, not a description of one. This full
    text is what you *apply* on a yes — it is not what you send.
 2. **Ask, once — a single yes/no question, written for a phone.** Explicitly
-   call `telegram_ask`; never use the generic `ask` UI. Confirm that the tool
-   delivered the question to the configured Telegram chat. It is mounted on a
-   locally injected tick only once your operator has configured the bridge's
-   notify destination, and a tick that lacks it says so in its own text. When it
-   does, send the same single yes/no question with `telegram_send` and treat
-   your operator's later reply as the answer — never assume one. Telegram renders
+   call `telegram_ask`; never use the generic `ask` UI. The tool shows the
+   question on the terminal and Telegram, then returns the first answer from
+   either surface. A returned answer proves an answer, not Telegram delivery.
+   If the proposal must demonstrably reach the operator through Telegram, send
+   the compact question separately with `telegram_send`. If `telegram_ask` is
+   unavailable, send the same single yes/no question with `telegram_send`.
+   Wait for the operator's later reply, and never assume one. Telegram renders
    none of your markdown, so asterisks and backticks arrive as literal characters:
    - Lead with one plain sentence: what changes, and why, in your own words.
    - Then show only the lines that actually change, compact, under two short

package/src/briefs/policy.md

@@ -59,39 +59,48 @@ and spot issues that would collide. Ask an omp session to read
 
 ## Reporting
 
-Your report scope is **`{{REPORT_SCOPE}}`**. All three scopes, spelled out:
-
-- **`escalations`** — you speak when a human is needed, and once a day otherwise.
-  That is: every tier-2 escalation immediately, carrying the issue link and the
-  single question; plus one daily digest naming what merged, what is green and
-  waiting on a merge, and what is stuck and why. Every other tick is silent.
-- **`decisions`** — tier-2 escalations immediately, and a fleet-stopping
-  condition immediately; every other material event is held and delivered as one
-  message with the next tick report. A merge at 10:04 and a green PR at 10:09
-  arrive together at the 10:15 tick, not as two pings.
+The live report scope and availability window come from conductor config on
+every tick; the tick's `Reporting` and `Operator availability` lines are
+authoritative. All four scopes, spelled out:
+
+- **`escalations`** — you speak when a human is needed, and otherwise wait for
+  the configured digest. That is: every tier-2 escalation when operator
+  availability permits, carrying the issue link and the single question; plus
+  a digest naming what merged, what is green and waiting on a merge, and what is
+  stuck and why.
+- **`decisions`** — tier-2 escalations and fleet-stopping conditions interrupt
+  when operator availability permits; every other material event is held and
+  delivered in the configured digest instead of as its own ping.
 - **`material`** — everything in `escalations`, plus each material event as it
-  happens: a run reaching a green PR (with the link), a run that failed twice, an
-  issue you pulled off the queue, a cap that stopped the fleet. A tick where
-  nothing changed still says nothing — "no change" is not an event.
-
-**Delivery.** Never rely on end-of-turn text reaching anyone. The only delivery
-paths are `omp-conductor report` (reports — persisted, daemon-retried),
-`telegram_send` (a person who is waiting), and `telegram_ask` (a decision).
-Everything else is noise or silence. Hand every reportable event to the
-conductor's outbox:
+  happens when operator availability permits: a run reaching a green PR (with
+  the link), a run that failed twice, an issue you pulled off the queue, a cap
+  that stopped the fleet. Outside configured hours, non-bypass interruptions
+  wait for the next configured digest or opening. A tick where nothing changed
+  still says nothing.
+- **`quiet`** — tier-2 escalations, fleet stops, and confirmed failures may
+  interrupt when operator availability permits; everything else waits for one
+  daily rollup.
+
+**Delivery.** Never rely on end-of-turn text reaching anyone. The provable
+delivery paths are `omp-conductor report` (reports — persisted and retried by
+the daemon) and `telegram_send` (direct messages). `telegram_ask` is the decision
+primitive, not Telegram delivery evidence. Everything else is noise or silence.
+Hand every reportable event to the conductor's outbox:
 
 ```
 omp-conductor report --text "<the whole report>"          # a material event
 omp-conductor report --text "<the whole digest>" --kind digest
 ```
 
-The command persists the text *before* anything is sent and prints a report id;
-from there the daemon owns delivery and retries until it lands, so a report
-survives you being compacted, interrupted, or restarted mid-sentence. That is
-the difference between a report and a claim about one: check for the report id,
-and never say something was reported without it. Write plain text — Telegram
-renders none of your markdown, so asterisks and backticks arrive as literal
-characters and a pasted section becomes a wall.
+The command persists the text *before* anything is sent and prints a durable
+handoff id. During quiet hours a material report becomes a held-notice id for
+the next digest or working-hours catch-up; otherwise it becomes a report id and
+the daemon retries delivery until it lands. Both survive you being compacted,
+interrupted, or restarted mid-sentence. That is the difference between a report
+and a claim about one: check for the handoff id, and never say something was
+reported without it. Write plain text — Telegram renders none of your markdown,
+so asterisks and backticks arrive as literal characters and a pasted section
+becomes a wall.
 
 The digest is at-most-once per day and the ledger decides that, not your memory:
 a second `--kind digest` on the same day is refused and tells you which report
@@ -100,12 +109,15 @@ was lost mid-send is retried and arrives marked as a possible repeat; that is
 deliberate, and a duplicate you can spot by its report id is the cheaper of the
 two mistakes. `omp-conductor status` lists anything still undelivered.
 
-`telegram_send` is still the right call for talking to a person who is waiting —
-an answer to their message, or a question of your own. It is not a report: it
-leaves no record that anything went out. And a `cancelled` or errored
-`telegram_ask` is a delivery failure, not an answer: re-deliver the question with
-with `telegram_send`, or report the channel as broken. It is never "asked once, no
-reply, dropped".
+`telegram_send` is still the right call for direct delivery to a person who is
+waiting — an answer to their message, or a question of your own. It is not a
+report: it leaves no record that anything went out. `telegram_ask` is the right
+call for a decision. It shows the question on the terminal and Telegram, then
+returns the first answer from either surface. A returned answer proves an
+answer, not Telegram delivery. A cancelled or errored `telegram_ask` is not an
+answer: re-deliver the question with `telegram_send`, prefixing its text
+`QUESTION:` so an autonomous tick applies the decision category, or report the
+channel as broken. It is never "asked once, no reply, dropped".
 
 Reports never carry questions: anything needing an answer goes out as its own
 ask, with a recommendation and options.

package/src/cli.ts

@@ -5,6 +5,7 @@
  * process lifecycle in ./lifecycle.ts, so the CLI and the `/conductor` plugin
  * cannot drift apart.
  */
+import { randomUUID } from "node:crypto";
 import { closeSync, openSync, readFileSync, readSync, statSync } from "node:fs";
 import { userInfo } from "node:os";
 import { dirname, join } from "node:path";
@@ -21,6 +22,7 @@ import {
   proposeRetrofit,
   repairPolicyBannerCrumbs,
 } from "./brief-upgrade.ts";
+import { interruptDisposition } from "./availability.ts";
 import { findProject, loadConfig, resolveCaps, stateDir } from "./config.ts";
 import { CONDITION_FORMS, parseCondition } from "./decisions.ts";
 import { isPaused, pausedAt, runDaemon, setPaused } from "./daemon.ts";
@@ -115,7 +117,8 @@ usage:
   omp-conductor graph-setup [--project NAME] [--write]
   omp-conductor brief-upgrade [--migrate|--retrofit] [--apply] [--file PATH] [--project NAME]
   omp-conductor friction <escalation-digest|report-noise|report-surprise> --detail TEXT [--issue N] [--project NAME]
-  omp-conductor report --text TEXT [--kind material|digest] [--project NAME]
+  omp-conductor event record --category NAME --summary TEXT --evidence REF [--occurred-at ISO] [--project NAME]
+  omp-conductor report --text TEXT [--kind material|digest] [--events IDS] [--notices IDS] [--project NAME]
   omp-conductor decision open --question TEXT [--blocks TEXT] [--resolves-when COND] [--project NAME]
   omp-conductor decision resolve <id> --answer TEXT [--project NAME]
   omp-conductor decision withdraw <id> [--reason TEXT] [--project NAME]
@@ -197,12 +200,17 @@ usage:
            strings, one per --arg (e.g. --arg prUrl=https://x --arg headSha=y).
            A refusal exits 3. See conductor_pr_merge/conductor_label/
            conductor_release/conductor_pr_update_branch in the brief.
+  event    persist one ordinary material outcome without sending it. Category
+           is a short lowercase slug; summary and evidence name what happened
+           and where it can be verified. --occurred-at defaults to now.
   report   hand a rendered report to the daemon's durable outbox. The report is
            persisted before anything is sent, delivered by the daemon with
            bounded retries, and shown by status until it lands. Delivery is
            at-least-once: a crash mid-send is retried and the retry says it may
            be a repeat. --kind digest is accepted at most once per local day,
            decided from the ledger rather than from what you remember sending.
+           A digest associates the comma-separated --events and --notices rows
+           atomically; omitted rows stay owed.
   decision record, list and close the questions you have put to your operator.
            A question that lives only in a session's context is lost to the next
            compaction, so \`decision open\` writes it down and every tick's prompt
@@ -265,6 +273,26 @@ function flag(argv: string[], name: string): string | undefined {
   return prefixed?.slice(name.length + 3);
 }
 
+function digestIdsFlag(argv: string[], name: "events" | "notices"): string[] {
+  const raw = flag(argv, name);
+  if (raw === undefined) {
+    if (argv.includes(`--${name}`)) {
+      process.stderr.write(`omp-conductor: report --${name} needs comma-separated row ids\n`);
+      process.exit(2);
+    }
+    return [];
+  }
+  const ids = [...new Set(raw.split(",").map((id) => id.trim()).filter((id) => id.length > 0))];
+  if (
+    ids.length === 0 ||
+    ids.some((id) => !/^(?:[0-9a-f]{12}|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})$/.test(id))
+  ) {
+    process.stderr.write(`omp-conductor: report --${name} needs comma-separated ledger row ids\n`);
+    process.exit(2);
+  }
+  return ids;
+}
+
 /**
  * `--port` for the three verbs that take one. Exits 2 rather than defaulting,
  * because silently ignoring a typo'd port would leave the operator probing an
@@ -1019,6 +1047,58 @@ try {
       break;
     }
 
+    case "event": {
+      if (argv[1] !== "record") {
+        process.stderr.write("omp-conductor: event needs the record subcommand\n");
+        process.exit(2);
+      }
+      const category = flag(argv, "category");
+      const summary = flag(argv, "summary")?.replace(/\s+/g, " ").trim();
+      const evidence = flag(argv, "evidence")?.replace(/\s+/g, " ").trim();
+      if (
+        category === undefined ||
+        !/^[a-z0-9][a-z0-9-]{0,31}$/.test(category) ||
+        summary === undefined ||
+        summary.length === 0 ||
+        summary.length > 240 ||
+        summary.startsWith("--") ||
+        evidence === undefined ||
+        evidence.length === 0 ||
+        evidence.length > 500 ||
+        evidence.startsWith("--")
+      ) {
+        process.stderr.write(
+          "omp-conductor: event record needs --category with a lowercase slug, --summary (1-240 chars), and --evidence (1-500 chars)\n",
+        );
+        process.exit(2);
+      }
+      const rawOccurredAt = flag(argv, "occurred-at");
+      const recordedAt = Date.now();
+      const occurredAt = rawOccurredAt === undefined ? recordedAt : Date.parse(rawOccurredAt);
+      if (!Number.isFinite(occurredAt)) {
+        process.stderr.write("omp-conductor: event record --occurred-at needs an ISO timestamp\n");
+        process.exit(2);
+      }
+      const project = findProject(loadConfig(), flag(argv, "project"));
+      const store = openStore(dbPath());
+      try {
+        const event = store.recordMaterialEvent({
+          project: project.name,
+          category,
+          summary,
+          evidence,
+          occurredAt,
+          recordedAt,
+        });
+        process.stdout.write(
+          `event ${event.id} recorded for ${project.name} (${event.category}, ${new Date(event.occurredAt).toISOString()}) — nothing sent\n`,
+        );
+      } finally {
+        store.close();
+      }
+      break;
+    }
+
     /**
      * The handover point. Authorship stays with the model; from here the daemon
      * owns delivery, so "I sent the report" stops being a claim the model makes
@@ -1043,6 +1123,12 @@ try {
         process.exit(2);
       }
       const kind = rawKind as ReportKind;
+      if (kind !== "digest" && (argv.includes("--events") || argv.includes("--notices"))) {
+        process.stderr.write(
+          "omp-conductor: report --events and --notices are valid only with --kind digest\n",
+        );
+        process.exit(2);
+      }
       const project = findProject(loadConfig(), flag(argv, "project"));
       const store = openStore(dbPath());
       try {
@@ -1051,8 +1137,8 @@ try {
         // policy defers is refused here rather than silently turning into a
         // page, or a digest going out off-schedule.
         const policy = project.reporting;
+        const digestPolicy = policy?.digest ?? { cadence: "per-tick" };
         if (kind === "digest") {
-          const digestPolicy = policy?.digest ?? { cadence: "per-tick" };
           if (digestPolicy.cadence === "none") {
             process.stderr.write(`omp-conductor: report: digest cadence is "none" for this project\n`);
             process.exit(2);
@@ -1070,32 +1156,54 @@ try {
           }
         }
         if (kind === "material") {
-          const interruptOn = policy?.interruptOn;
-          if (interruptOn !== undefined && !interruptOn.includes("material")) {
+          const disposition = interruptDisposition(policy, "material", at);
+          if (disposition === "digest") {
             process.stderr.write(
               "omp-conductor: report: material updates are digest-only under this reporting policy; fold this into the next digest (--kind digest)\n",
             );
             process.exit(2);
           }
+          if (disposition === "availability") {
+            const noticeId = randomUUID();
+            store.addHeldNotice({
+              id: noticeId,
+              project: project.name,
+              category: "material",
+              summary: body.split("\n", 1)[0]!.slice(0, 240),
+              detail: body,
+              createdAt: at,
+              releaseOnAvailable: true,
+            });
+            process.stdout.write(
+              `held notice ${noticeId} queued for ${project.name} (material; quiet hours)\n` +
+                "the daemon will include it in the next digest or working-hours catch-up\n",
+            );
+            break;
+          }
         }
-        const { report, deduped } = store.enqueueReport({
+        const draft = {
           project: project.name,
           kind,
           body,
-          // Only the digest is at-most-once. A material report describes one
-          // event as it happens, and two of those in a day are two events.
-          ...(kind === "digest"
-            ? { dedupeKey: digestDedupeKey(at, project.reporting?.digest?.timezone) }
+          // Only a daily digest is at-most-once. Per-tick digests and material
+          // reports describe new outcomes each time, so they carry no daily key.
+          ...(kind === "digest" && digestPolicy.cadence === "daily"
+            ? { dedupeKey: digestDedupeKey(at, digestPolicy.timezone) }
             : {}),
           at,
-        });
-        // The held notices an accepted digest re-surfaces are now owed by it,
-        // whatever the model goes on to write.
-        if (kind === "digest") store.markNoticesDigested(project.name, at);
+        };
+        const { report, deduped } =
+          kind === "digest"
+            ? store.enqueueDigestReport(
+                draft,
+                digestIdsFlag(argv, "events"),
+                digestIdsFlag(argv, "notices"),
+              )
+            : store.enqueueReport(draft);
         process.stdout.write(
           deduped
             ? `today's digest was already handed over as report ${report.id} (${report.state}) — nothing queued\n` +
-                "the ledger decides this, not your memory of the last tick; use --kind material for a second event\n"
+                "the ledger decides this, not your memory of the last tick; newly named rows remain owed for a later digest\n"
             : `report ${report.id} queued for ${project.name} (${kind})\n` +
                 "the daemon owns delivery from here; omp-conductor status shows it until it lands\n",
         );

package/src/config.ts

@@ -37,6 +37,7 @@ import {
   REPORT_SCOPES,
   INTERRUPT_CATEGORIES,
   DIGEST_CADENCES,
+  WEEKDAYS,
   type Caps,
   type ConductorConfig,
   type DigestCadence,
@@ -49,6 +50,8 @@ import {
   type ReleaseRequirement,
   type ReportScope,
   type ReportingPolicy,
+  type Weekday,
+  type WeeklyAvailability,
   type RepoTarget,
   type ResolvedGrants,
 } from "./types.ts";
@@ -72,6 +75,7 @@ const CAP_KEYS = Object.keys(DEFAULT_CAPS) as (keyof Caps)[];
 const REPORT_SCOPE_LIST = quoteList(REPORT_SCOPES);
 const INTERRUPT_CATEGORY_LIST = quoteList(INTERRUPT_CATEGORIES);
 const DIGEST_CADENCE_LIST = quoteList(DIGEST_CADENCES);
+const WEEKDAY_LIST = quoteList(WEEKDAYS);
 const AUTHORITY_HOLDER_LIST = quoteList(AUTHORITY_HOLDERS);
 const ORCHESTRATOR_MODE_LIST = quoteList(ORCHESTRATOR_MODES);
 const RELEASE_SHAPE_LIST = quoteList(RELEASE_SHAPES);
@@ -544,15 +548,17 @@ function normalizeReporting(parsed: unknown, label: string, problems: string[]):
   const keys = Object.keys(raw);
   // `scopePreset` is written by a fully-normalised policy (the setup wizard
   // saves presets materialised); `scope` is the legacy form. Both are known.
-  const known = ["scope", "interruptOn", "digest", "scopePreset"];
+  const known = ["scope", "interruptOn", "digest", "availability", "scopePreset"];
   const unknownKeys = keys.filter((k) => !known.includes(k));
   if (unknownKeys.length > 0) {
     problems.push(`${label}: reporting has unknown key(s): ${unknownKeys.join(", ")}`);
   }
   const hasScope = raw["scope"] !== undefined;
-  const hasExplicit = keys.includes("interruptOn") || keys.includes("digest");
+  const hasExplicit = keys.includes("interruptOn") || keys.includes("digest") || keys.includes("availability");
   if (hasScope && hasExplicit) {
-    problems.push(`${label}: reporting.scope is a preset — remove it when configuring interruptOn/digest explicitly`);
+    problems.push(
+      `${label}: reporting.scope is a preset — remove it when configuring interruptOn/digest/availability explicitly`,
+    );
     return defaultReporting();
   }
   if (hasScope || (!hasExplicit && keys.length === 0)) {
@@ -581,9 +587,23 @@ function normalizeReporting(parsed: unknown, label: string, problems: string[]):
       ? (storedPreset as ReportScope)
       : undefined;
 
+  const interruptOn = normalizeInterruptOn(raw["interruptOn"], label, problems);
+  const digest = normalizeDigest(raw["digest"], label, problems);
+  const availability = normalizeAvailability(raw["availability"], label, problems);
+  // One setup answer supplies both clocks. Hand-written configs may omit the
+  // digest copy; the availability zone then becomes its daily clock too.
+  if (availability !== undefined && digest.cadence === "daily") {
+    if (digest.timezone === undefined) digest.timezone = availability.timezone;
+    else if (digest.timezone !== availability.timezone) {
+      problems.push(
+        `${label}: reporting.digest.timezone must match reporting.availability.timezone`,
+      );
+    }
+  }
   return {
-    interruptOn: normalizeInterruptOn(raw["interruptOn"], label, problems),
-    digest: normalizeDigest(raw["digest"], label, problems),
+    interruptOn,
+    digest,
+    ...(availability === undefined ? {} : { availability }),
     ...(scopePreset === undefined ? {} : { scopePreset }),
   };
 }
@@ -665,6 +685,94 @@ function normalizeDigest(parsed: unknown, label: string, problems: string[]): Re
   return digest;
 }
 
+function normalizeAvailability(
+  parsed: unknown,
+  label: string,
+  problems: string[],
+): WeeklyAvailability | undefined {
+  if (parsed === undefined) return undefined;
+  if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+    problems.push(`${label}: reporting.availability must be an object`);
+    return undefined;
+  }
+  const raw = parsed as Raw;
+  const unknownKeys = Object.keys(raw).filter(
+    (key) => !["timezone", "days", "start", "end", "bypass"].includes(key),
+  );
+  if (unknownKeys.length > 0) {
+    problems.push(`${label}: reporting.availability has unknown key(s): ${unknownKeys.join(", ")}`);
+  }
+
+  let timezone: string | undefined;
+  if (typeof raw["timezone"] !== "string" || raw["timezone"].trim() === "") {
+    problems.push(`${label}: reporting.availability.timezone must be a known IANA timezone`);
+  } else {
+    try {
+      new Intl.DateTimeFormat("en-GB", { timeZone: raw["timezone"] });
+      timezone = raw["timezone"];
+    } catch {
+      problems.push(`${label}: reporting.availability.timezone is not a known IANA timezone`);
+    }
+  }
+
+  const days: Weekday[] = [];
+  if (!Array.isArray(raw["days"]) || raw["days"].length === 0) {
+    problems.push(`${label}: reporting.availability.days must be a non-empty array of ${WEEKDAY_LIST}`);
+  } else {
+    for (const item of raw["days"]) {
+      if (typeof item !== "string" || !(WEEKDAYS as readonly string[]).includes(item)) {
+        problems.push(
+          `${label}: reporting.availability.days has unknown day ${JSON.stringify(item)} — one of ${WEEKDAY_LIST}`,
+        );
+        continue;
+      }
+      const day = item as Weekday;
+      if (!days.includes(day)) days.push(day);
+    }
+  }
+
+  const start = raw["start"];
+  const end = raw["end"];
+  if (typeof start !== "string" || !DIGEST_AT.test(start)) {
+    problems.push(`${label}: reporting.availability.start must be a 24h HH:MM time`);
+  }
+  if (typeof end !== "string" || !DIGEST_AT.test(end)) {
+    problems.push(`${label}: reporting.availability.end must be a 24h HH:MM time`);
+  }
+  if (typeof start === "string" && typeof end === "string" && start === end) {
+    problems.push(`${label}: reporting.availability.start and end must differ`);
+  }
+
+  const bypass: InterruptCategory[] = [];
+  if (!Array.isArray(raw["bypass"])) {
+    problems.push(
+      `${label}: reporting.availability.bypass must be an array of ${INTERRUPT_CATEGORY_LIST} (empty means none)`,
+    );
+  } else {
+    for (const item of raw["bypass"]) {
+      if (typeof item !== "string" || !(INTERRUPT_CATEGORIES as readonly string[]).includes(item)) {
+        problems.push(
+          `${label}: reporting.availability.bypass has unknown category ${JSON.stringify(item)} — one of ${INTERRUPT_CATEGORY_LIST}`,
+        );
+        continue;
+      }
+      const category = item as InterruptCategory;
+      if (!bypass.includes(category)) bypass.push(category);
+    }
+  }
+
+  return timezone === undefined ||
+    days.length === 0 ||
+    typeof start !== "string" ||
+    !DIGEST_AT.test(start) ||
+    typeof end !== "string" ||
+    !DIGEST_AT.test(end) ||
+    start === end ||
+    !Array.isArray(raw["bypass"])
+    ? undefined
+    : { timezone, days, start, end, bypass };
+}
+
 /**
  * Who triages escalations, and how they are delivered when nobody answers.
  *