omp-conductor 0.13.0 → 0.15.0

package/src/orchestrator-tick.ts

@@ -25,7 +25,7 @@
  *
  * Beyond those three gates, every tick carries the project's `reporting.scope`
  * as one explicit constraint line, re-read from the conductor config on each
- * tick so a `/conductor setup` change binds the next heartbeat rather than
+ * tick so an `omp-conductor setup` change binds the next heartbeat rather than
  * waiting for a session restart — and one delivery rule
  * ({@link TICK_DELIVERY_RULE}), because a tick is injected locally and a report
  * written as end-of-turn text on such a turn reaches nobody. An operator's own
@@ -44,10 +44,12 @@
  * config, believed it held both.
  */
 
+import { createHash, randomUUID } from "node:crypto";
 import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
-import { findProject, loadConfig, resolveReleaseGrants } from "./config.ts";
+import { availabilityPrompt, interruptDisposition } from "./availability.ts";
+import { findProject, loadConfig, resolveReleaseGrants, stateDir } from "./config.ts";
 import {
   bridgeTokenBound,
   hasBotToken,
@@ -58,6 +60,7 @@ import {
 import {
   briefPathForProject,
   policyPathForProject,
+  reportScopeFromPolicy,
   refreshComposedBriefForProject,
 } from "./setup.ts";
 import {
@@ -73,8 +76,11 @@ import {
   DEFAULT_REPORT_SCOPE,
   DENIED_RELEASE_GRANTS,
   type DispatchSummary,
+  type DigestBacklog,
   type FrictionSignal,
-  type ReportScope,
+  type HeldNotice,
+  type MaterialEvent,
+  type ReportScopeChoice,
   type ReportingPolicy,
   type ResolvedGrants,
   type Store,
@@ -82,7 +88,7 @@ import {
 import { formatDecisionDigest } from "./decisions.ts";
 import type { RunRecord } from "./types.ts";
 import { dbPath, openStore } from "./store.ts";
-import { digestDue } from "./digest-schedule.ts";
+import { digestDue, localDayKey } from "./digest-schedule.ts";
 
 /** The activation file. Absent means "this is not an orchestrator session". */
 export const TICK_CONFIG_FILE = ".conductor-tick.json";
@@ -111,6 +117,8 @@ const FRICTION_DIGEST_LIMIT = 3;
  * definitive, either way.
  */
 const RETRY_OWNERSHIP_MS = 60_000;
+/** A failed digest turn must release working-hours catch-up ownership promptly. */
+const MIN_AVAILABILITY_DIGEST_LEASE_MS = 30 * 60 * 1_000;
 
 /**
  * The stall marker — written beside the activation file, in the session cwd —
@@ -145,13 +153,18 @@ const PENDING_MESSAGE_GRACE_MS = 60_000;
 const DEFAULT_GROOM_BELOW = 4;
 
 /**
- * Written by herdr-conductor `recover.sh` *before* `agent start`, so a resumed
- * fleet can reconcile orphans without waiting a full `intervalSeconds`. Cleared
- * only after a tick is actually sent — a disarmed or channel-down fleet keeps
- * the request until gates pass (or a human removes the file).
+ * Written by herdr-conductor `recover.sh` *before* `agent start`, and by the
+ * dispatch daemon when a watched decision condition transitions false→true
+ * (#329), so the orchestrator can reconcile without waiting a full
+ * `intervalSeconds`. Cleared only after a tick is actually sent — a disarmed or
+ * channel-down fleet keeps the request until gates pass (or a human removes the
+ * file). Mid-interval the heartbeat polls for this file on a short cadence.
  */
 export const TICK_REQUESTED_FILE = ".conductor-tick-requested";
 
+/** How often a live heartbeat looks for {@link TICK_REQUESTED_FILE} between ticks. */
+const TICK_REQUEST_POLL_MS = 10_000;
+
 /** Runtime heartbeat schedule consumed by `omp-conductor status`. */
 export const TICK_STATUS_FILE = ".conductor-tick-status.json";
 
@@ -205,9 +218,9 @@ const PENDING_REASON = "tick already pending";
  * The slice of the omp extension API this entry touches, mirroring
  * `ExtensionAPI` / `ExtensionContext` from `@oh-my-pi/pi-coding-agent`.
  *
- * Declared here rather than imported for the reason ./plugin.ts declares its
- * own: the harness is a peer dependency and the package has to type-check
- * without it installed. Structural typing means the real objects satisfy these
+ * Declared here rather than imported because the harness is a peer dependency and
+ * the package has to type-check without it installed — the same reason ./omp.ts
+ * loads the SDK dynamically. Structural typing means the real objects satisfy these
  * on the way in.
  */
 interface TickLogger {
@@ -258,6 +271,23 @@ interface TickApi {
   on(event: "session_start", handler: (event: { type: "session_start" }, ctx: TickContext) => void): void;
   on(event: "turn_start", handler: (event: { type: "turn_start" }, ctx: TickContext) => void): void;
   on(event: "turn_end", handler: (event: { type: "turn_end" }, ctx: TickContext) => void): void;
+  on(
+    event: "message_start",
+    handler: (
+      event: {
+        type: "message_start";
+        message: {
+          role: string;
+          customType?: string;
+          synthetic?: boolean;
+          attribution?: "user" | "agent";
+          timestamp?: number;
+        };
+      },
+      ctx: TickContext,
+    ) => void,
+  ): void;
+  on(event: "agent_end", handler: (event: { type: "agent_end" }, ctx: TickContext) => void): void;
   /**
    * `deliverAs: "followUp"` + `triggerTurn: true`, verified against
    * `AgentSession.sendCustomMessage` rather than assumed:
@@ -287,6 +317,19 @@ interface TickApi {
  *  they get here. */
 export interface TickConfig {
   intervalSeconds: number;
+  /**
+   * The conductor project this fleet session ticks for, stamped by `setup host`
+   * (one tick config per fleet cwd). It is what lets a host with several
+   * configured projects resolve *this* fleet's brief, reporting policy, digest
+   * ledger and release grants, instead of asking `findProject` a question it
+   * refuses to guess through.
+   *
+   * Omitted is the pre-multi-project spelling. Resolution then falls back to the
+   * un-named `findProject`: exact for a single-project fleet — which must keep
+   * behaving exactly as it did — and ambiguous, therefore degrading, for more
+   * than one.
+   */
+  project?: string;
   armedFile?: string;
   accessFile?: string;
   message?: string;
@@ -410,14 +453,58 @@ export function queueDigestLine(
   return line;
 }
 
-export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScope]: string } = {
+export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScopeChoice]: string } = {
   material: "Report material events per your brief.",
   escalations:
     "Interrupt only for: tier2, fleet-stopped; everything else — releases included — waits for the daily digest.",
   decisions:
-    "Reporting scope decisions: interrupt only for a decision you need (tier-2) or a condition that stops the fleet. Every other material event accumulates and ships as ONE message with this tick's report via omp-conductor report -- a merge, a green PR, a pulled issue wait for the tick; nothing between ticks.",
+    "Reporting scope decisions: interrupt only for a decision you need (tier-2) or a condition that stops the fleet. Every other material event waits for the configured digest; nothing between digests.",
+  quiet:
+    "Interrupt only for: tier2, fleet-stopped, confirmed-failure; everything else waits for the daily digest.",
 };
 
+/** Bounded, durable source material for one due digest. Row ids are part of the
+ * handoff contract: the report and exactly the rows it consumed settle in one
+ * SQLite transaction, so a crash cannot lose an outcome between those writes. */
+export function formatDigestLedger(
+  events: readonly MaterialEvent[],
+  notices: readonly HeldNotice[],
+  backlog: DigestBacklog,
+): string {
+  const oneLine = (text: string, limit: number): string => {
+    const flat = text.replace(/\s+/g, " ").trim();
+    return flat.length <= limit ? flat : `${flat.slice(0, limit - 1)}…`;
+  };
+  const lines = [
+    `Durable digest ledger — ${backlog.materialCount} material event(s), ${backlog.heldNoticeCount} held escalation(s); oldest first:`,
+    ...events.map(
+      (event) =>
+        `  event ${event.id} | ${new Date(event.occurredAt).toISOString()} | ${event.category} | ` +
+        `${oneLine(event.summary, 180)} | evidence: ${oneLine(event.evidence, 240)}`,
+    ),
+    ...notices.map(
+      (notice) =>
+        `  notice ${notice.id} | ${new Date(notice.createdAt).toISOString()} | ${notice.category} | ` +
+        `${oneLine(notice.summary, 180)} | detail: ${oneLine(notice.detail, 240)}`,
+    ),
+  ];
+  if (backlog.materialCount > events.length) {
+    lines.push(`  … ${backlog.materialCount - events.length} newer material event(s) remain owed.`);
+  }
+  if (backlog.heldNoticeCount > notices.length) {
+    lines.push(`  … ${backlog.heldNoticeCount - notices.length} additional held escalation(s) remain owed.`);
+  }
+  const eventIds = events.map((event) => event.id).join(",");
+  const noticeIds = notices.map((notice) => notice.id).join(",");
+  lines.push(
+    "Compose the digest from the relevant rows above. Hand it off with omp-conductor report --kind digest " +
+      `${eventIds.length === 0 ? "" : `--events ${eventIds} `}` +
+      `${noticeIds.length === 0 ? "" : `--notices ${noticeIds} `}` +
+      "--text TEXT. Remove any row id you did not actually include; omitted rows remain owed. Never invent an id.",
+  );
+  return lines.join("\n");
+}
+
 /**
  * The reporting constraint appended to a default tick prompt (#229, #242).
  *
@@ -449,9 +536,13 @@ export function tickReportingConstraint(
         ? "Report nothing that would interrupt this turn; everything else accumulates for the digest."
         : `Interrupt only for: ${allowed.join(", ")}. Everything else accumulates for the digest.`;
   }
+  if (policy !== undefined && !allowed.includes("material")) {
+    base +=
+      " Record every material outcome that is not sent as an interrupt immediately with omp-conductor event record; the durable ledger, not session memory, feeds the next digest.";
+  }
   if (digest.cadence !== "daily") return base;
   if (digest.due) {
-    return `${base} The daily digest is DUE now — compose it from this tick's accumulated events and the ${held} held notice(s) below, then send via omp-conductor report --kind digest.`;
+    return `${base} The daily digest is DUE now — compose it from the durable accumulated events and ${held} held notice(s), then send via omp-conductor report --kind digest.`;
   }
   return digest.at === undefined
     ? `${base} The daily digest was already sent today; do not send another.`
@@ -489,13 +580,14 @@ export function tickReportingConstraint(
  * report is indistinguishable from a quiet tick. #123 moved delivery to the
  * daemon, so the clause now names the handover instead. `omp-conductor report`
  * persists the text before anything is sent and the daemon retries it until it
- * lands; a handover that returns a report id has therefore *already* survived
- * the failure mode this rule exists for, which a watched `telegram_send` never
- * could. `telegram_send` remains the right call for an interactive reply to a
- * person who is waiting — that is a conversation, not a report.
+ * lands; a handover that returns a durable report or held-notice id has
+ * therefore *already* survived the failure mode this rule exists for, which a
+ * watched `telegram_send` never could. `telegram_send` remains the right call
+ * for an interactive reply to a person who is waiting — that is a
+ * conversation, not a report.
  */
 export const TICK_DELIVERY_RULE =
-  "This tick was injected locally, not sent from Telegram, so your end-of-turn text does NOT reach your operator. Hand anything reportable this turn to the durable outbox by running `omp-conductor report --text \"<the whole report>\"` (add `--kind digest` for the daily digest) and confirming it printed a report id; the daemon then owns delivery and retries until it lands. Never claim a report was sent otherwise, and never use telegram_send for a report -- that path leaves no record that it went out.";
+  "This tick was injected locally, not sent from Telegram, so your end-of-turn text does NOT reach your operator. Hand anything reportable this turn to the durable outbox by running `omp-conductor report --text \"<the whole report>\"` (add `--kind digest` for the daily digest) and confirming it printed a durable handoff id (a report id, or a held-notice id during quiet hours); the daemon then owns delivery and retries until it lands. Never claim a report was sent otherwise, and never use telegram_send for a report -- that path leaves no record that it went out.";
 
 /** The {@link TICK_DELIVERY_RULE} variant for a fleet whose bridge actually
  *  delivers the tick's ending text (#169). That is a narrower class than the
@@ -538,8 +630,9 @@ export { TELEGRAM_APPROVAL_TOOL };
  */
 export const TICK_APPROVAL_UNAVAILABLE_RULE =
   `The ${TELEGRAM_APPROVAL_TOOL} tool is NOT mounted on this tick, so the package floor's yes/no amendment approval cannot be asked here. ` +
-  `If you have an amendment to propose, deliver the question with telegram_send and wait for your operator's reply on a later turn; ` +
-  `never apply an amendment, or record one as approved, without an explicit answer you actually received.`;
+  `If you have an amendment to propose, deliver the question with telegram_send, prefix its text with "QUESTION:", and wait for your operator's reply on a later turn. ` +
+  `A returned telegram_ask answer proves an answer, not Telegram delivery. ` +
+  `Never apply an amendment, or record one as approved, without an explicit answer you actually received.`;
 
 /**
  * Appended to every tick — the shipped prompt or the operator's own — composed
@@ -607,7 +700,7 @@ export function formatFrictionDigest(signals: readonly FrictionSignal[]): string
  * config could not answer — why.
  *
  * Read on every tick rather than cached at session start, for the reason the
- * channel gate is: the operator re-runs `/conductor setup` while this session
+ * channel gate is: the operator re-runs `omp-conductor setup` while this session
  * lives, and a heartbeat holding a startup snapshot would keep injecting the
  * old contract until somebody restarted it.
  *
@@ -623,27 +716,141 @@ export function formatFrictionDigest(signals: readonly FrictionSignal[]): string
  * none named — the same ambiguity `findProject` refuses to guess through for
  * `status`. Stopping the heartbeat over either preference would be the worse
  * trade.
+ *
+ * `projectName` is {@link TickConfig.project}, stamped per fleet cwd, and it is
+ * the whole difference between a two-project host resolving each fleet's own
+ * contract and both of them degrading. Omitted (a pre-multi-project tick config)
+ * keeps the un-named lookup, which only a host with more than one project can
+ * fail — and that host gets {@link LEGACY_TICK_PROJECT_HINT} naming the one
+ * command that fixes it.
  */
-export function resolveTickScope(): {
-  scope: ReportScope;
+export function resolveTickScope(projectName?: string): {
+  scope: ReportScopeChoice;
   policy?: ReportingPolicy;
   briefPath?: string;
   policyPath?: string;
   projectName?: string;
   fallback?: string;
 } {
+  // Counted before `findProject` can throw, because "several projects and this
+  // tick config names none" is the one fault with a one-command remedy and the
+  // only way to tell it apart from "no config at all" is the count.
+  let projects = 0;
   try {
-    const project = findProject(loadConfig());
+    const config = loadConfig();
+    projects = config.projects.length;
+    const project = findProject(config, projectName);
     return {
-      scope: project.reporting?.scopePreset ?? DEFAULT_REPORT_SCOPE,
+      scope: reportScopeFromPolicy(project.reporting),
       policy: project.reporting,
       briefPath: briefPathForProject(project),
       policyPath: policyPathForProject(project),
       projectName: project.name,
     };
   } catch (err) {
-    return { scope: DEFAULT_REPORT_SCOPE, fallback: err instanceof Error ? err.message : String(err) };
+    const problem = err instanceof Error ? err.message : String(err);
+    const unstamped = projectName === undefined && projects > 1;
+    return { scope: DEFAULT_REPORT_SCOPE, fallback: unstamped ? `${problem} ${LEGACY_TICK_PROJECT_HINT}` : problem };
+  }
+}
+
+/**
+ * The fix for the one degradation an operator can clear in a single command: a
+ * tick config written before {@link TickConfig.project} existed, on a host that
+ * has since gained a second project.
+ */
+export const LEGACY_TICK_PROJECT_HINT =
+  "Re-run `omp-conductor setup host` to stamp the project into .conductor-tick.json.";
+
+/**
+ * Whether a tick config found on disk belongs to the project being asked about.
+ *
+ * Search roots overlap — `stateDir()` and the shared parent of two fleet cwds
+ * are read for every project — so without this a stray config in a shared root
+ * answers for whichever project asked first, and `setup host` would restamp one
+ * project's file while planning another. An unstamped config matches anything,
+ * which is what keeps a single-project fleet on its existing file.
+ */
+export function tickConfigMatchesProject(config: TickConfig, projectName?: string): boolean {
+  if (projectName === undefined || config.project === undefined) return true;
+  return config.project === projectName;
+}
+
+/**
+ * Directory that owns this project's {@link TICK_CONFIG_FILE}, if one is
+ * present and stamped for the project (or unstamped on a single-project host).
+ * Used by out-of-process writers of {@link TICK_REQUESTED_FILE} — the dispatch
+ * daemon must not import `fleet.ts` (fleet already imports daemon).
+ */
+export function resolveTickConfigCwd(projectName?: string): string | undefined {
+  const roots: string[] = [stateDir()];
+  try {
+    const p = findProject(loadConfig(), projectName);
+    const parent = dirname(p.workspaceRoot);
+    if (parent !== roots[0]) roots.push(parent);
+    if (p.workspaceRoot !== roots[0] && p.workspaceRoot !== parent) roots.push(p.workspaceRoot);
+  } catch {
+    /* no config */
+  }
+  for (const cwd of roots) {
+    const r = readTickConfig(cwd);
+    if (r.kind === "ok") {
+      if (!tickConfigMatchesProject(r.config, projectName)) continue;
+      return cwd;
+    }
+    if (r.kind === "invalid") return undefined;
+  }
+  return undefined;
+}
+
+/** The shared, pre-per-project arm marker: `<stateDir>/armed`. */
+export function legacyArmedMarkerPath(): string {
+  return join(stateDir(), "armed");
+}
+
+/** What `status` says about a bare `armed` marker that no tick will honour. */
+export const LEGACY_ARM_MARKER_DETAIL =
+  "legacy global arm marker — re-run setup host, then arm per project";
+
+/**
+ * Whether the arm gate is open, and whether the shared pre-per-project marker is
+ * what decided it.
+ *
+ * Two migrations meet here. A single-project fleet whose `armedFile` has just
+ * been restamped from `armed` to `armed-<name>` must not be silently disarmed by
+ * the upgrade, so its bare `armed` marker still counts (`legacy: "honoured"`). A
+ * host with more than one project cannot let one marker arm every fleet — that is
+ * the collision this issue removes — so there the bare marker arms nothing and
+ * says so instead (`legacy: "stranded"`), including for a tick config that still
+ * names it directly.
+ *
+ * The fallback reaches exactly two `armedFile` spellings: the shared path itself,
+ * and the per-project path the restamp replaces it with. An operator's own gate
+ * — any other value, which `setup host` deliberately preserves — is the gate; its
+ * absence means disarmed however many stale markers lie around it.
+ *
+ * The config is read only when a legacy marker is actually in play, so the
+ * healthy path costs one string compare. An unreadable or absent config is
+ * treated as single-project: a host with no conductor config cannot be a
+ * multi-project host, and 0.14 behaviour is the honest default there.
+ */
+export type ArmState = { armed: boolean; legacy?: "honoured" | "stranded" };
+
+export function resolveArmState(armedFile: string, projectName?: string): ArmState {
+  const legacy = legacyArmedMarkerPath();
+  const shared = armedFile === legacy;
+  if (!shared && existsSync(armedFile)) return { armed: true };
+  const migratable =
+    shared || (projectName !== undefined && armedFile === join(stateDir(), `armed-${projectName}`));
+  if (!migratable || !existsSync(legacy)) return { armed: false };
+  let multiProject = false;
+  try {
+    multiProject = loadConfig().projects.length > 1;
+  } catch {
+    // No readable config: not a multi-project host, so keep 0.14 behaviour.
   }
+  if (multiProject) return { armed: false, legacy: "stranded" };
+  return shared ? { armed: true } : { armed: true, legacy: "honoured" };
 }
 
 /**
@@ -655,9 +862,9 @@ export function resolveTickScope(): {
  * the default prompt path. Failures (no config, no `POLICY.md`, unreadable
  * overlay) are silent: the tick still goes out.
  */
-export function refreshComposedBriefBestEffort(): boolean {
+export function refreshComposedBriefBestEffort(projectName?: string): boolean {
   try {
-    return refreshComposedBriefForProject(findProject(loadConfig()));
+    return refreshComposedBriefForProject(findProject(loadConfig(), projectName));
   } catch {
     return false;
   }
@@ -747,6 +954,16 @@ export function readTickConfig(cwd: string): TickConfigResult {
     }
   }
 
+  const projectRaw = raw["project"];
+  let project: string | undefined;
+  if (projectRaw !== undefined) {
+    if (typeof projectRaw !== "string" || projectRaw.trim().length === 0) {
+      problems.push("project must be a non-empty string when present");
+    } else {
+      project = projectRaw.trim();
+    }
+  }
+
   if (problems.length > 0) return { kind: "invalid", path, problem: problems.join("; ") };
 
   return {
@@ -754,6 +971,7 @@ export function readTickConfig(cwd: string): TickConfigResult {
     path,
     config: {
       intervalSeconds,
+      ...(project === undefined ? {} : { project }),
       ...(budgetSeconds === undefined ? {} : { budgetSeconds }),
       ...(armedFile === undefined ? {} : { armedFile }),
       ...(accessFile === undefined ? {} : { accessFile }),
@@ -916,9 +1134,17 @@ export function paneOwnership(input: { paneId: string; agentName: string; agents
   if (mine?.name !== undefined) {
     // A registered agent, just not this fleet's. herdr can name several omp
     // agents in one directory, and requiring merely *a* name would arm each one.
+    //
+    // The rename hint is conditional because this branch has two very different
+    // causes: a scratch pane that is correctly named something else, and the
+    // fleet's own pane still carrying the name it had before its tick config was
+    // restamped for a project. Only the operator knows which.
     return {
       kind: "declined",
-      reason: `this pane is agent "${mine.name}", not the fleet agent "${input.agentName}" — this session will not tick`,
+      reason:
+        `this pane is agent "${mine.name}", not the fleet agent "${input.agentName}" — ` +
+        `if this is the fleet pane under an old name, \`herdr agent rename ${input.paneId} ${input.agentName}\`; ` +
+        `this session will not tick`,
     };
   }
 
@@ -933,12 +1159,19 @@ export function paneOwnership(input: { paneId: string; agentName: string; agents
   // No name here and nobody else holding it: an ad-hoc pane in the fleet's
   // directory, which is exactly the session that must stay inert. Fail-closed,
   // and the fix is named — an orchestrator that lost its registration is one
-  // `herdr agent start` from ticking again.
+  // `herdr agent rename` from ticking again.
+  //
+  // Deliberately NOT `herdr agent start`: that submits omp *into* the pane's
+  // existing shell and requires a pane at a shell prompt hosting no agent
+  // (herdr/README.md). This pane is running the omp session reading this line, so
+  // `agent start` would either be refused or start a second orchestrator in it.
+  // `rename` names the agent herdr already detects, and touches no process.
   return {
     kind: "declined",
     reason:
       `this pane is not a registered herdr agent, and no pane is running the fleet agent ` +
-      `"${input.agentName}" — register it with \`herdr agent start ${input.agentName} --kind omp --pane ${input.paneId}\`; ` +
+      `"${input.agentName}" — name its running agent with ` +
+      `\`herdr agent rename ${input.paneId} ${input.agentName}\`; ` +
       `this session will not tick`,
   };
 }
@@ -1265,23 +1498,285 @@ function clearStallMarker(pi: TickApi, cwd: string): void {
   }
 }
 
+/**
+ * Best-effort poke that asks a live orchestrator heartbeat to fire soon.
+ *
+ * Same file shape as herdr `recover.sh`: one line `${iso} ${reason}`. Writers
+ * (recover, the dispatch daemon on a false→true condition) never clear it —
+ * only a successful tick send does, so a disarmed or channel-down fleet keeps
+ * the request until gates pass.
+ */
+export function requestImmediateTick(cwd: string, reason: string): boolean {
+  const path = join(cwd, TICK_REQUESTED_FILE);
+  const label = reason.trim().length > 0 ? reason.trim() : "wake";
+  try {
+    writeFileSync(path, `${new Date().toISOString()} ${label}\n`);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** First non-empty token after the optional ISO stamp on a poke line. */
+export function readTickRequestReason(cwd: string): string | undefined {
+  const path = join(cwd, TICK_REQUESTED_FILE);
+  if (!existsSync(path)) return undefined;
+  let raw: string;
+  try {
+    raw = readFileSync(path, "utf8");
+  } catch {
+    return undefined;
+  }
+  const line = raw.split(/\r?\n/, 1)[0]?.trim() ?? "";
+  if (line.length === 0) return undefined;
+  const parts = line.split(/\s+/);
+  if (parts.length === 0) return undefined;
+  // recover.sh writes `${iso} recover`; a bare reason is also accepted.
+  if (parts.length >= 2 && Number.isFinite(Date.parse(parts[0]!))) {
+    return parts.slice(1).join(" ");
+  }
+  return parts.join(" ");
+}
+
 /**
  * Best-effort, same posture as {@link clearStallMarker}. Leaving the file on a
  * failed unlink means the next successful send retries the clear; that is
- * preferable to treating a recover poke as fire-and-forget when the tick did
- * land.
+ * preferable to treating a recover/condition poke as fire-and-forget when the
+ * tick did land.
  */
 function clearTickRequest(pi: TickApi, cwd: string): void {
   const path = join(cwd, TICK_REQUESTED_FILE);
   if (!existsSync(path)) return;
   try {
     rmSync(path, { force: true });
-    pi.logger.info("[omp-conductor] recover tick request cleared: a tick was sent");
+    pi.logger.info("[omp-conductor] tick request cleared: a tick was sent");
   } catch (err) {
     pi.logger.error(`[omp-conductor] could not remove ${path}: ${err instanceof Error ? err.message : String(err)}`);
   }
 }
 
+interface PendingLocalTick {
+  id: string;
+  projectName?: string;
+  policy?: ReportingPolicy;
+}
+
+interface ActiveLocalTick extends PendingLocalTick {
+  /** A person who writes during an autonomous run is awake by construction. */
+  humanWaiting: boolean;
+}
+
+interface TelegramInterrupt {
+  kind: "question" | "message";
+  category: HeldNotice["category"];
+  summary: string;
+  detail: string;
+  hasFiles: boolean;
+  fingerprint: string;
+}
+
+function objectRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function canonicalTelegramPayload(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(canonicalTelegramPayload);
+  if (!objectRecord(value)) return value;
+  return Object.fromEntries(
+    Object.keys(value)
+      .sort()
+      .map((key) => [key, canonicalTelegramPayload(value[key])]),
+  );
+}
+
+
+function serialiseTelegramPayload(value: unknown): string {
+  try {
+    return JSON.stringify(canonicalTelegramPayload(value)) ?? String(value);
+  } catch {
+    return String(value);
+  }
+}
+
+function telegramInterruptFromTool(
+  toolName: string,
+  input: Record<string, unknown>,
+): TelegramInterrupt | undefined {
+  let kind: TelegramInterrupt["kind"];
+  let payload: Record<string, unknown> = input;
+
+  if (toolName === TELEGRAM_APPROVAL_TOOL) {
+    kind = "question";
+  } else if (toolName === "telegram_send" || toolName === "telegram_react") {
+    kind = "message";
+  } else if (toolName === "write") {
+    const path = input["path"];
+    if (
+      path !== "xd://telegram_ask" &&
+      path !== "xd://telegram_send" &&
+      path !== "xd://telegram_react"
+    ) {
+      return undefined;
+    }
+    kind = path === "xd://telegram_ask" ? "question" : "message";
+    const content = input["content"];
+    if (typeof content === "string") {
+      try {
+        const parsed: unknown = JSON.parse(content);
+        payload = objectRecord(parsed) ? parsed : { content };
+      } catch {
+        payload = { content };
+      }
+    }
+  } else {
+    return undefined;
+  }
+  if (
+    kind === "message" &&
+    typeof payload["text"] === "string" &&
+    /^\s*QUESTION:\s/i.test(payload["text"])
+  ) {
+    // The package floor uses this explicit fallback when telegram_ask is not
+    // mounted. Without the marker a plain send remains a material update.
+    kind = "question";
+  }
+
+  let detail = "";
+  if (kind === "question" && Array.isArray(payload["questions"])) {
+    detail = payload["questions"]
+      .map((value, index) => {
+        if (!objectRecord(value)) return `Question ${index + 1}: ${serialiseTelegramPayload(value)}`;
+        const question = typeof value["question"] === "string" ? value["question"] : "Question";
+        const options = Array.isArray(value["options"])
+          ? value["options"]
+              .map((option) =>
+                objectRecord(option) && typeof option["label"] === "string"
+                  ? `${option["label"]}${
+                      typeof option["description"] === "string" && option["description"] !== ""
+                        ? ` — ${option["description"]}`
+                        : ""
+                    }`
+                  : serialiseTelegramPayload(option),
+              )
+              .join("; ")
+          : "";
+        return options === "" ? question : `${question}\nOptions: ${options}`;
+      })
+      .join("\n\n");
+  } else if (typeof payload["text"] === "string") {
+    detail = payload["text"];
+  }
+  if (detail.trim() === "") detail = serialiseTelegramPayload(payload);
+
+  const flat = detail.replace(/\s+/g, " ").trim();
+  const fallback = kind === "question" ? "Operator question" : "Telegram message";
+  const summary = flat === "" ? fallback : flat.length <= 180 ? flat : `${flat.slice(0, 179)}…`;
+  const canonical = serialiseTelegramPayload({ kind, payload });
+  return {
+    kind,
+    category: kind === "question" ? "decision-needed" : "material",
+    summary,
+    hasFiles: Array.isArray(payload["files"]) && payload["files"].length > 0,
+    detail,
+    fingerprint: createHash("sha256").update(canonical).digest("hex"),
+  };
+}
+
+type TelegramInterruptBlock = { block: true; reason: string };
+
+/**
+ * A locally injected tick is an autonomous actor. Its direct Telegram calls
+ * therefore pass through the same category and availability decision as daemon
+ * escalations. Human-originated runs, including a message steered into a tick,
+ * are exempt: the operator is already present and waiting for the reply.
+ */
+function autonomousTelegramInterruptBlock(
+  pi: TickApi,
+  session: TickSession,
+  event: { toolName: string; input: Record<string, unknown> },
+): TelegramInterruptBlock | undefined {
+  const active = session.activeLocalTick;
+  if (active === undefined || active.humanWaiting) return undefined;
+  const interrupt = telegramInterruptFromTool(event.toolName, event.input);
+  if (interrupt === undefined) return undefined;
+  if (active.projectName === undefined) {
+    return {
+      block: true,
+      reason:
+        "Operator availability policy is unavailable for this autonomous tick, so direct Telegram is blocked fail-closed. " +
+        "Repair the conductor config; do not retry through another Telegram path.",
+    };
+  }
+
+  let policy = active.policy;
+  let configReadable = true;
+  try {
+    policy = findProject(loadConfig(), active.projectName).reporting;
+  } catch (err) {
+    configReadable = false;
+    pi.logger.error(
+      `[omp-conductor] operator availability config unreadable during Telegram call; blocking fail-closed: ${
+        err instanceof Error ? err.message : String(err)
+      }`,
+    );
+  }
+
+  const at = Date.now();
+  const disposition = configReadable
+    ? interruptDisposition(policy, interrupt.category, at)
+    : "availability";
+  if (disposition === "interrupt") return undefined;
+  const release =
+    disposition === "availability"
+      ? "the availability window opens or the daily digest runs"
+      : "the daily digest runs";
+  if (interrupt.hasFiles) {
+    return {
+      block: true,
+      reason:
+        `Operator policy forbids this autonomous Telegram ${interrupt.kind} until ${release}, ` +
+        "and attachment-bearing Telegram sends cannot be durably replayed. Nothing was sent or held. " +
+        "Do not retry through another Telegram path while the policy forbids delivery.",
+    };
+  }
+
+  const key = `${active.projectName}:autonomous-telegram:${active.id}:${interrupt.fingerprint}`;
+  try {
+    const store = openStore(dbPath());
+    try {
+      if (!store.wasNotified(key)) {
+        store.addHeldNotice({
+          id: createHash("sha256").update(`held-notice\0${key}`).digest("hex"),
+          project: active.projectName,
+          category: interrupt.category,
+          summary: interrupt.summary,
+          detail: interrupt.detail,
+          createdAt: at,
+          ...(disposition === "availability" ? { releaseOnAvailable: true } : {}),
+        });
+        store.markNotified(key);
+      }
+    } finally {
+      store.close();
+    }
+  } catch (err) {
+    const reason = err instanceof Error ? err.message : String(err);
+    pi.logger.error(`[omp-conductor] could not persist held Telegram ${interrupt.kind}: ${reason}`);
+    return {
+      block: true,
+      reason:
+        `Operator policy forbids this autonomous Telegram ${interrupt.kind}, and the durable hold failed: ${reason}. ` +
+        "Do not retry through another Telegram path.",
+    };
+  }
+
+  return {
+    block: true,
+    reason:
+      `Operator policy durably held this autonomous Telegram ${interrupt.kind} until ${release}. ` +
+      "Do not retry through another Telegram path.",
+  };
+}
+
 /** Everything one tick remembers for the next. */
 interface TickSession {
   /**
@@ -1310,6 +1805,17 @@ interface TickSession {
   bridgeTokenAtStart: boolean;
   /** Consecutive {@link PENDING_REASON} skips — see {@link STALL_MARKER_FILE}. */
   pendingSkips: number;
+  /** Ticks sent as follow-ups but not yet observed by the agent loop. */
+  pendingLocalTicks: PendingLocalTick[];
+  /**
+   * Whether the stranded shared arm marker has been named. Latched for
+   * {@link TickSession.scopeFallbackLogged}'s reason: a host that gained a
+   * second project without re-running setup would otherwise repeat the same
+   * line every interval, forever.
+   */
+  legacyArmLogged: boolean;
+  /** The local tick whose agent loop is currently running, if any. */
+  activeLocalTick?: ActiveLocalTick;
 }
 
 /**
@@ -1318,8 +1824,15 @@ interface TickSession {
  * otherwise emit a notification every interval, forever.
  */
 function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSession): void {
+  const arm = config.armedFile === undefined ? undefined : resolveArmState(config.armedFile, config.project);
+  if (arm?.legacy === "stranded" && !session.legacyArmLogged) {
+    session.legacyArmLogged = true;
+    pi.logger.error(
+      `[omp-conductor] ${legacyArmedMarkerPath()}: ${LEGACY_ARM_MARKER_DETAIL} — this heartbeat stays disarmed`,
+    );
+  }
   const decision = tickDecision({
-    armed: config.armedFile === undefined || existsSync(config.armedFile),
+    armed: arm === undefined || arm.armed,
     channelOk: config.accessFile === undefined || channelIsUp(config.accessFile),
     hasPending: ctx.hasPendingMessages(),
   });
@@ -1346,9 +1859,9 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
 
   // Floor refresh is independent of which prompt we send: a custom message still
   // expects ORCHESTRATOR.md / AGENTS.md to track the installed package.
-  refreshComposedBriefBestEffort();
+  refreshComposedBriefBestEffort(config.project);
 
-  const scope = resolveTickScope();
+  const scope = resolveTickScope(config.project);
   // The transport contract, read once from the same file at the same moment so
   // the approval line, the delivery rule and the narration line cannot disagree
   // (#169, #179). No access file means no fleet channel to judge; a session
@@ -1393,22 +1906,68 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
       try {
         const lastKey = store.lastDigestDedupeKey(scope.projectName);
         const lastDay = lastKey === undefined ? undefined : lastKey.slice("digest:".length);
+        const due = digestDue(policy ?? DEFAULT_REPORT_POLICY, lastDay, at);
+        // Reserve availability-held rows before reading them. The same SQLite
+        // transaction releases pending catch-ups; daemon enqueue attempts then
+        // observe the lease, closing both orders of the snapshot-to-handoff race.
+        const availabilityReserved =
+          due &&
+          store.reserveAvailabilityDigest(
+            scope.projectName,
+            localDayKey(at, digestPolicy.timezone ?? policy?.availability?.timezone),
+            at,
+            at +
+              Math.max(
+                MIN_AVAILABILITY_DIGEST_LEASE_MS,
+                (config.budgetSeconds ?? DEFAULT_TICK_BUDGET_SECONDS) * 1_000 + 5 * 60_000,
+              ),
+          );
+        const backlog = store.digestBacklog(scope.projectName);
+        const visibleBacklog: DigestBacklog = availabilityReserved
+          ? backlog
+          : {
+              ...backlog,
+              heldNoticeCount: Math.max(
+                0,
+                backlog.heldNoticeCount - (backlog.availabilityHeldNoticeCount ?? 0),
+              ),
+            };
         reportingConstraint = tickReportingConstraint(
           policy,
           {
-            due: digestDue(policy ?? DEFAULT_REPORT_POLICY, lastDay, at),
+            due,
             cadence,
             at: digestPolicy.at,
             timezone: digestPolicy.timezone,
           },
-          store.undigestedNotices(scope.projectName).length,
+          visibleBacklog.heldNoticeCount,
         );
+        if (
+          due &&
+          (visibleBacklog.materialCount > 0 || visibleBacklog.heldNoticeCount > 0)
+        ) {
+          const notices = store
+            .undigestedNotices(scope.projectName)
+            .filter((notice) => notice.releaseOnAvailable !== true || availabilityReserved);
+          reportingConstraint +=
+            `\n${formatDigestLedger(
+              store.undigestedMaterialEvents(scope.projectName),
+              notices,
+              visibleBacklog,
+            )}`;
+        }
       } finally {
         store.close();
       }
     }
     content = `${defaultTickMessage(new Date(), scope.briefPath, scope.policyPath)}\n${reportingConstraint}\n${bridged ? TICK_DELIVERY_RULE_BRIDGED : TICK_DELIVERY_RULE}`;
   }
+  if (scope.projectName !== undefined) {
+    // Unlike ordinary reporting prose, this is a mechanical clock reading and
+    // survives a custom heartbeat message. The model never infers whether the
+    // operator can be interrupted.
+    content = `${content}\n${availabilityPrompt(scope.policy, Date.now())}`;
+  }
   let frictionStore: Store | undefined;
   let frictionSignals: FrictionSignal[] = [];
   const now = Date.now();
@@ -1442,7 +2001,10 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
         // tracker (#181). A failed config read skips the line rather than
         // wedging the tick.
         try {
-          const project = findProject(loadConfig());
+          // Named: this block is already inside `scope.projectName !== undefined`,
+          // so the resolved name is in hand and an un-named lookup would refuse
+          // to guess on a host with a second project.
+          const project = findProject(loadConfig(), scope.projectName);
           const queue = queueDigestLine(
             frictionStore.latestDispatch(scope.projectName),
             project.queueLabel,
@@ -1526,11 +2088,28 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
   // No `accessFile` means no fleet bridge to judge, exactly as above.
   if (profile?.kind === "interactive") content = `${content}\n${TICK_NARRATION_RULE}`;
 
+  // Recover / condition-met pokes are auditable: the same reason the writer put
+  // on the sentinel line lands in the prompt and the "tick sent" log.
+  const wakeReason = readTickRequestReason(ctx.cwd);
+  if (wakeReason !== undefined) content = `${content}\nWake reason: ${wakeReason}`;
+
+  const pendingLocalTick: PendingLocalTick = {
+    id: randomUUID(),
+    ...(scope.projectName === undefined ? {} : { projectName: scope.projectName }),
+    ...(scope.policy === undefined ? {} : { policy: scope.policy }),
+  };
+  session.pendingLocalTicks.push(pendingLocalTick);
   try {
-    pi.sendMessage(
-      { customType: TICK_CUSTOM_TYPE, content, display: true, attribution: "user" },
-      { triggerTurn: true, deliverAs: "followUp" },
-    );
+    try {
+      pi.sendMessage(
+        { customType: TICK_CUSTOM_TYPE, content, display: true, attribution: "user" },
+        { triggerTurn: true, deliverAs: "followUp" },
+      );
+    } catch (err) {
+      const pendingIndex = session.pendingLocalTicks.indexOf(pendingLocalTick);
+      if (pendingIndex >= 0) session.pendingLocalTicks.splice(pendingIndex, 1);
+      throw err;
+    }
     if (scope.projectName !== undefined && frictionSignals.length > 0) {
       try {
         frictionStore?.markFrictionSurfaced(
@@ -1547,13 +2126,19 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
   } finally {
     frictionStore?.close();
   }
-  pi.logger.info(`[omp-conductor] tick sent: ${decision.reason}`, { reason: decision.reason });
+  pi.logger.info(
+    wakeReason === undefined
+      ? `[omp-conductor] tick sent: ${decision.reason}`
+      : `[omp-conductor] tick sent: ${decision.reason} (wake: ${wakeReason})`,
+    { reason: decision.reason, ...(wakeReason === undefined ? {} : { wakeReason }) },
+  );
   // An empty queue at send time is the proof the previous tick was consumed, so
   // this is the only place either the counter or the marker is cleared.
   session.pendingSkips = 0;
   clearStallMarker(pi, ctx.cwd);
-  // Recover poke is consumed only on a real send — gates still apply above.
+  // Immediate-tick poke is consumed only on a real send — gates still apply above.
   clearTickRequest(pi, ctx.cwd);
+
 }
 
 function writeTickRuntimeStatus(pi: TickApi, cwd: string, intervalSeconds: number): void {
@@ -1574,22 +2159,40 @@ function writeTickRuntimeStatus(pi: TickApi, cwd: string, intervalSeconds: numbe
 }
 
 /**
- * Arm the interval heartbeat, then honour a recover poke if one is waiting.
+ * Arm the interval heartbeat, honour a poke already waiting at arm time, and
+ * poll mid-interval for later pokes (recover resume, condition-met #329).
  * Extracted so the ownership-retry path and the immediate-accept path cannot
- * drift: both must fire the same "do not wait a full interval after resume"
- * behaviour.
+ * drift: both must fire the same "do not wait a full interval after a poke"
+ * behaviour. Every path still runs {@link tick} → {@link tickDecision}, so a
+ * live turn coalesces rather than stacking concurrent ticks.
  */
 function armTickHeartbeat(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSession): void {
   writeTickRuntimeStatus(pi, ctx.cwd, config.intervalSeconds);
-  ctx.setInterval(() => {
+  const runScheduledTick = (): void => {
     try {
       tick(pi, ctx, config, session);
     } finally {
       writeTickRuntimeStatus(pi, ctx.cwd, config.intervalSeconds);
     }
-  }, config.intervalSeconds * 1000);
+  };
+  ctx.setInterval(runScheduledTick, config.intervalSeconds * 1000);
+  // Short mid-interval poll so a condition that flips between heartbeats does
+  // not wait a full cycle. Cap at the heartbeat itself so a misconfigured short
+  // interval cannot arm a second timer faster than the primary.
+  const pollMs = Math.min(TICK_REQUEST_POLL_MS, config.intervalSeconds * 1000);
+  if (pollMs < config.intervalSeconds * 1000) {
+    ctx.setInterval(() => {
+      if (!existsSync(join(ctx.cwd, TICK_REQUESTED_FILE))) return;
+      const reason = readTickRequestReason(ctx.cwd) ?? "wake";
+      pi.logger.info(
+        `[omp-conductor] tick requested by ${reason} — firing without waiting for the interval`,
+      );
+      runScheduledTick();
+    }, pollMs);
+  }
   if (!existsSync(join(ctx.cwd, TICK_REQUESTED_FILE))) return;
-  pi.logger.info("[omp-conductor] tick requested by recover — firing without waiting for the interval");
+  const reason = readTickRequestReason(ctx.cwd) ?? "wake";
+  pi.logger.info(`[omp-conductor] tick requested by ${reason} — firing without waiting for the interval`);
   tick(pi, ctx, config, session);
 }
 
@@ -1645,14 +2248,24 @@ export default function orchestratorTickExtension(pi: TickApi): void {
     approvalToolMissingLogged: false,
     bridgeTokenAtStart: true,
     pendingSkips: 0,
+    pendingLocalTicks: [],
+    legacyArmLogged: false,
   };
   let releaseGateArmed = false;
+  let availabilityGateArmed = false;
   let guardArmed = false;
   // An activation file makes this a fleet directory before Herdr can prove
   // which pane owns it. The gate therefore starts closed and only honours a
   // configured grant after ownership is accepted.
   let releaseAuthorityAccepted = false;
-  const armReleaseGate = (): void => {
+  /**
+   * `configuredProject` is {@link TickConfig.project}, and it is what stops a
+   * second configured project from collapsing every release grant this fleet
+   * really holds to {@link DENIED_RELEASE_GRANTS}. Undefined for a tick config
+   * that names none — including an invalid one, which arms this gate before the
+   * config can be trusted at all.
+   */
+  const armReleaseGate = (configuredProject?: string): void => {
     if (releaseGateArmed) return;
     releaseGateArmed = true;
     (pi as TickApi & {
@@ -1672,7 +2285,7 @@ export default function orchestratorTickExtension(pi: TickApi): void {
       let grants: ResolvedGrants = DENIED_RELEASE_GRANTS;
       let external = true;
       try {
-        const project = findProject(loadConfig());
+        const project = findProject(loadConfig(), configuredProject);
         projectName = project.name;
         grants = resolveReleaseGrants(project);
         external = project.escalation.orchestrator === "external";
@@ -1716,6 +2329,64 @@ export default function orchestratorTickExtension(pi: TickApi): void {
     });
   };
 
+  /** `configuredProject` carries {@link TickConfig.project} for the same reason
+   *  {@link armReleaseGate} takes it: a recovered tick must reconstruct *this*
+   *  fleet's availability policy, not refuse to guess between two projects. */
+  const armAvailabilityGate = (configuredProject?: string): void => {
+    if (availabilityGateArmed) return;
+    availabilityGateArmed = true;
+
+    // Custom messages sent with `pi.sendMessage` bypass `before_agent_start`.
+    // `message_start` is the first lifecycle event that carries their exact
+    // custom type, so it is the reliable boundary between a local tick and an
+    // inbound human turn.
+    pi.on("message_start", (event) => {
+      const message = event.message;
+      if (message.role === "custom" && message.customType === TICK_CUSTOM_TYPE) {
+        const pending = session.pendingLocalTicks.shift();
+        if (pending !== undefined) {
+          session.activeLocalTick = { ...pending, humanWaiting: false };
+        } else {
+          // A queued custom tick can survive a host restart after the in-memory
+          // enqueue record does not. Reconstruct its scope so recovery cannot
+          // silently turn an autonomous run into an interactive one.
+          const scope = resolveTickScope(configuredProject);
+          const id =
+            typeof message.timestamp === "number"
+              ? createHash("sha256").update(`recovered-tick\0${message.timestamp}`).digest("hex")
+              : randomUUID();
+          session.activeLocalTick = {
+            id,
+            ...(scope.projectName === undefined ? {} : { projectName: scope.projectName }),
+            ...(scope.policy === undefined ? {} : { policy: scope.policy }),
+            humanWaiting: false,
+          };
+        }
+        return;
+      }
+      if (
+        session.activeLocalTick !== undefined &&
+        message.role === "user" &&
+        message.synthetic !== true &&
+        message.attribution !== "agent"
+      ) {
+        session.activeLocalTick.humanWaiting = true;
+      }
+    });
+    pi.on("agent_end", () => {
+      session.activeLocalTick = undefined;
+    });
+    (pi as TickApi & {
+      on(
+        event: "tool_call",
+        handler: (
+          event: { toolName: string; input: Record<string, unknown> },
+          ctx: unknown,
+        ) => TelegramInterruptBlock | undefined,
+      ): void;
+    }).on("tool_call", (event) => autonomousTelegramInterruptBlock(pi, session, event));
+  };
+
   pi.on("session_start", (_event, ctx) => {
     if (decided) return;
 
@@ -1742,7 +2413,12 @@ export default function orchestratorTickExtension(pi: TickApi): void {
 
     // Present but invalid still identifies a fleet directory. Install the
     // fail-closed handler before validation or ownership can return early.
-    armReleaseGate();
+    // The project this fleet cwd ticks for, so both gates resolve its own policy
+    // rather than collapsing fail-closed on a host with a second project. An
+    // invalid config names none — it cannot be trusted to.
+    const configuredProject = result.kind === "ok" ? result.config.project : undefined;
+    armReleaseGate(configuredProject);
+    armAvailabilityGate(configuredProject);
 
     if (result.kind === "invalid") {
       const detail = `${result.path}: ${result.problem}`;